8602b5a93f61ef26519762e545df3a252ac765cd2e8062837722d049bf1ab34d

Analysis

max time kernel
149s
max time network
116s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 21:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
_8602b5a93f61ef26519762e545df3a252ac765cd2e8062837722d049bf1ab34d.exe
Size 13.6MB
Sample260709-1sb5psbs2z
SHA256 8602b5a93f61ef26519762e545df3a252ac765cd2e8062837722d049bf1ab34d
MD5 a90a801f776cab1cf0d5faedacf0cc5a
SHA1 a8a1a600a199fd5c16d16aeef7312cfacad5aa1c
SHA512 03b1b9d92bb7d7d92e6c749a90ca9ca8d1a62e3c19c7bca78d050a1e6c12f5b616dac829e53ece90489c811edc7690082599ece6219b35fd6384ffb093fb2645
SSDEEP 393216:bNx0hGL5+xLMu/Plif+j5qyxgLXMCHWUjX8cuI3/PGTAI:bNah65+tL10+jQ0gLXMb8XpH/O7
TLSH
T1B1E6335826F026FEF9739038E8E24D90E4A9B4A55735CACF07EC82923D572D4C93D693
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3608	powershell.exe
5916	powershell.exe
1056	powershell.exe
4252	powershell.exe
4240	powershell.exe
2028	powershell.exe
2436	powershell.exe
4728	powershell.exe
4384	powershell.exe
1828	powershell.exe
5436	powershell.exe
2492	powershell.exe

Loads dropped DLL 16 IoCs

pid	Process
2564	_8602b5a93f61ef26519762e545df3a252ac765cd2e8062837722d049bf1ab34d.exe
2564	_8602b5a93f61ef26519762e545df3a252ac765cd2e8062837722d049bf1ab34d.exe
2564	_8602b5a93f61ef26519762e545df3a252ac765cd2e8062837722d049bf1ab34d.exe
2564	_8602b5a93f61ef26519762e545df3a252ac765cd2e8062837722d049bf1ab34d.exe
2564	_8602b5a93f61ef26519762e545df3a252ac765cd2e8062837722d049bf1ab34d.exe
2564	_8602b5a93f61ef26519762e545df3a252ac765cd2e8062837722d049bf1ab34d.exe
2564	_8602b5a93f61ef26519762e545df3a252ac765cd2e8062837722d049bf1ab34d.exe
2564	_8602b5a93f61ef26519762e545df3a252ac765cd2e8062837722d049bf1ab34d.exe
2564	_8602b5a93f61ef26519762e545df3a252ac765cd2e8062837722d049bf1ab34d.exe
2564	_8602b5a93f61ef26519762e545df3a252ac765cd2e8062837722d049bf1ab34d.exe
2564	_8602b5a93f61ef26519762e545df3a252ac765cd2e8062837722d049bf1ab34d.exe
2564	_8602b5a93f61ef26519762e545df3a252ac765cd2e8062837722d049bf1ab34d.exe
2564	_8602b5a93f61ef26519762e545df3a252ac765cd2e8062837722d049bf1ab34d.exe
2564	_8602b5a93f61ef26519762e545df3a252ac765cd2e8062837722d049bf1ab34d.exe
2564	_8602b5a93f61ef26519762e545df3a252ac765cd2e8062837722d049bf1ab34d.exe
2564	_8602b5a93f61ef26519762e545df3a252ac765cd2e8062837722d049bf1ab34d.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
2564	_8602b5a93f61ef26519762e545df3a252ac765cd2e8062837722d049bf1ab34d.exe
2564	_8602b5a93f61ef26519762e545df3a252ac765cd2e8062837722d049bf1ab34d.exe
4384	powershell.exe
4384	powershell.exe
3608	powershell.exe
3608	powershell.exe
1828	powershell.exe
1828	powershell.exe
5436	powershell.exe
5436	powershell.exe
5916	powershell.exe
5916	powershell.exe
1056	powershell.exe
1056	powershell.exe
4252	powershell.exe
4252	powershell.exe
4240	powershell.exe
4240	powershell.exe
2028	powershell.exe
2028	powershell.exe
2492	powershell.exe
2492	powershell.exe
4728	powershell.exe
4728	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2564	_8602b5a93f61ef26519762e545df3a252ac765cd2e8062837722d049bf1ab34d.exe
Token: SeDebugPrivilege	4384	powershell.exe
Token: SeIncreaseQuotaPrivilege	4384	powershell.exe
Token: SeSecurityPrivilege	4384	powershell.exe
Token: SeTakeOwnershipPrivilege	4384	powershell.exe
Token: SeLoadDriverPrivilege	4384	powershell.exe
Token: SeSystemProfilePrivilege	4384	powershell.exe
Token: SeSystemtimePrivilege	4384	powershell.exe
Token: SeProfSingleProcessPrivilege	4384	powershell.exe
Token: SeIncBasePriorityPrivilege	4384	powershell.exe
Token: SeCreatePagefilePrivilege	4384	powershell.exe
Token: SeBackupPrivilege	4384	powershell.exe
Token: SeRestorePrivilege	4384	powershell.exe
Token: SeShutdownPrivilege	4384	powershell.exe
Token: SeDebugPrivilege	4384	powershell.exe
Token: SeSystemEnvironmentPrivilege	4384	powershell.exe
Token: SeRemoteShutdownPrivilege	4384	powershell.exe
Token: SeUndockPrivilege	4384	powershell.exe
Token: SeManageVolumePrivilege	4384	powershell.exe
Token: 33	4384	powershell.exe
Token: 34	4384	powershell.exe
Token: 35	4384	powershell.exe
Token: 36	4384	powershell.exe
Token: SeDebugPrivilege	3608	powershell.exe
Token: SeIncreaseQuotaPrivilege	3608	powershell.exe
Token: SeSecurityPrivilege	3608	powershell.exe
Token: SeTakeOwnershipPrivilege	3608	powershell.exe
Token: SeLoadDriverPrivilege	3608	powershell.exe
Token: SeSystemProfilePrivilege	3608	powershell.exe
Token: SeSystemtimePrivilege	3608	powershell.exe
Token: SeProfSingleProcessPrivilege	3608	powershell.exe
Token: SeIncBasePriorityPrivilege	3608	powershell.exe
Token: SeCreatePagefilePrivilege	3608	powershell.exe
Token: SeBackupPrivilege	3608	powershell.exe
Token: SeRestorePrivilege	3608	powershell.exe
Token: SeShutdownPrivilege	3608	powershell.exe
Token: SeDebugPrivilege	3608	powershell.exe
Token: SeSystemEnvironmentPrivilege	3608	powershell.exe
Token: SeRemoteShutdownPrivilege	3608	powershell.exe
Token: SeUndockPrivilege	3608	powershell.exe
Token: SeManageVolumePrivilege	3608	powershell.exe
Token: 33	3608	powershell.exe
Token: 34	3608	powershell.exe
Token: 35	3608	powershell.exe
Token: 36	3608	powershell.exe
Token: SeDebugPrivilege	1828	powershell.exe
Token: SeIncreaseQuotaPrivilege	1828	powershell.exe
Token: SeSecurityPrivilege	1828	powershell.exe
Token: SeTakeOwnershipPrivilege	1828	powershell.exe
Token: SeLoadDriverPrivilege	1828	powershell.exe
Token: SeSystemProfilePrivilege	1828	powershell.exe
Token: SeSystemtimePrivilege	1828	powershell.exe
Token: SeProfSingleProcessPrivilege	1828	powershell.exe
Token: SeIncBasePriorityPrivilege	1828	powershell.exe
Token: SeCreatePagefilePrivilege	1828	powershell.exe
Token: SeBackupPrivilege	1828	powershell.exe
Token: SeRestorePrivilege	1828	powershell.exe
Token: SeShutdownPrivilege	1828	powershell.exe
Token: SeDebugPrivilege	1828	powershell.exe
Token: SeSystemEnvironmentPrivilege	1828	powershell.exe
Token: SeRemoteShutdownPrivilege	1828	powershell.exe
Token: SeUndockPrivilege	1828	powershell.exe
Token: SeManageVolumePrivilege	1828	powershell.exe
Token: 33	1828	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 5116 wrote to memory of 2564	5116	_8602b5a93f61ef26519762e545df3a252ac765cd2e8062837722d049bf1ab34d.exe	88
PID 2564 wrote to memory of 3212	2564	_8602b5a93f61ef26519762e545df3a252ac765cd2e8062837722d049bf1ab34d.exe	89
PID 3212 wrote to memory of 4384	3212	cmd.exe	91
PID 2564 wrote to memory of 3252	2564	_8602b5a93f61ef26519762e545df3a252ac765cd2e8062837722d049bf1ab34d.exe	93
PID 3252 wrote to memory of 3608	3252	cmd.exe	95
PID 2564 wrote to memory of 2740	2564	_8602b5a93f61ef26519762e545df3a252ac765cd2e8062837722d049bf1ab34d.exe	96
PID 2740 wrote to memory of 1828	2740	cmd.exe	98
PID 2564 wrote to memory of 4900	2564	_8602b5a93f61ef26519762e545df3a252ac765cd2e8062837722d049bf1ab34d.exe	99
PID 4900 wrote to memory of 5436	4900	cmd.exe	101
PID 2564 wrote to memory of 1756	2564	_8602b5a93f61ef26519762e545df3a252ac765cd2e8062837722d049bf1ab34d.exe	102
PID 1756 wrote to memory of 5916	1756	cmd.exe	104
PID 2564 wrote to memory of 5208	2564	_8602b5a93f61ef26519762e545df3a252ac765cd2e8062837722d049bf1ab34d.exe	105
PID 5208 wrote to memory of 1056	5208	cmd.exe	107
PID 2564 wrote to memory of 2420	2564	_8602b5a93f61ef26519762e545df3a252ac765cd2e8062837722d049bf1ab34d.exe	108
PID 2420 wrote to memory of 4252	2420	cmd.exe	110
PID 2564 wrote to memory of 4152	2564	_8602b5a93f61ef26519762e545df3a252ac765cd2e8062837722d049bf1ab34d.exe	111
PID 4152 wrote to memory of 4240	4152	cmd.exe	113
PID 2564 wrote to memory of 1844	2564	_8602b5a93f61ef26519762e545df3a252ac765cd2e8062837722d049bf1ab34d.exe	114
PID 1844 wrote to memory of 2028	1844	cmd.exe	116
PID 2564 wrote to memory of 1524	2564	_8602b5a93f61ef26519762e545df3a252ac765cd2e8062837722d049bf1ab34d.exe	117
PID 1524 wrote to memory of 2436	1524	cmd.exe	119
PID 2564 wrote to memory of 4732	2564	_8602b5a93f61ef26519762e545df3a252ac765cd2e8062837722d049bf1ab34d.exe	120
PID 4732 wrote to memory of 2492	4732	cmd.exe	122
PID 2564 wrote to memory of 3384	2564	_8602b5a93f61ef26519762e545df3a252ac765cd2e8062837722d049bf1ab34d.exe	123
PID 3384 wrote to memory of 4728	3384	cmd.exe	125

C:\Users\Admin\AppData\Local\Temp\_8602b5a93f61ef26519762e545df3a252ac765cd2e8062837722d049bf1ab34d.exe
"C:\Users\Admin\AppData\Local\Temp\_8602b5a93f61ef26519762e545df3a252ac765cd2e8062837722d049bf1ab34d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5116
- C:\Users\Admin\AppData\Local\Temp\_8602b5a93f61ef26519762e545df3a252ac765cd2e8062837722d049bf1ab34d.exe
  "C:\Users\Admin\AppData\Local\Temp\_8602b5a93f61ef26519762e545df3a252ac765cd2e8062837722d049bf1ab34d.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2564
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3212
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4384
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\rekigema'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3252
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\rekigema'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3608
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2740
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1828
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4900
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5436
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1756
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5916
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5208
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1056
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2420
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4152
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4240
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1844
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2028
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1524
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:2436
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4732
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2492
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3384
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4728

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact