ed74b54adeea87f6c2b55e5d4344011a3f4cc660af29493c87ffa1804d1d0c82

Analysis

max time kernel
149s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 23:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
default.dat.exe
Size 13.6MB
Sample260709-3wy5rab15v
SHA256 ed74b54adeea87f6c2b55e5d4344011a3f4cc660af29493c87ffa1804d1d0c82
MD5 3443909d7c6697a9f2cf26ad234d4230
SHA1 cd955bf6546b1910de417b789d5b6073b6b715cf
SHA512 fd7c22fc73bcfca3f0e0a8e3c07f07e11014938db86495065736abe53932e037427c2f9e29e42182fe6f6334cfc280d5685cb9d8d68ab5332d849afbf3f9e8e7
SSDEEP 393216:0/SfgpX4mHMq0HKZjhlgiXuOumXMCHWUjXFcuI3/PGTAI:0jp4mM5cjhlgiXLumXMb8XyH/O7
TLSH
T13BE63308B7E106EEF9B35138E4E16785F168346A1B71C99F57A4C3B29E672F00D3A643
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2320	powershell.exe
236	powershell.exe
1052	powershell.exe
4184	powershell.exe
5584	powershell.exe
4268	powershell.exe
5596	powershell.exe
1876	powershell.exe
5344	powershell.exe
1996	powershell.exe
5708	powershell.exe
2464	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
4108	default.dat.exe
4108	default.dat.exe
4108	default.dat.exe
4108	default.dat.exe
4108	default.dat.exe
4108	default.dat.exe
4108	default.dat.exe
4108	default.dat.exe
4108	default.dat.exe
4108	default.dat.exe
4108	default.dat.exe
4108	default.dat.exe
4108	default.dat.exe
4108	default.dat.exe
4108	default.dat.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
4108	default.dat.exe
4108	default.dat.exe
2320	powershell.exe
2320	powershell.exe
236	powershell.exe
236	powershell.exe
1876	powershell.exe
1876	powershell.exe
1052	powershell.exe
1052	powershell.exe
5344	powershell.exe
5344	powershell.exe
1996	powershell.exe
1996	powershell.exe
5708	powershell.exe
5708	powershell.exe
4184	powershell.exe
4184	powershell.exe
5584	powershell.exe
5584	powershell.exe
4268	powershell.exe
4268	powershell.exe
2464	powershell.exe
2464	powershell.exe
5596	powershell.exe
5596	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4108	default.dat.exe
Token: SeDebugPrivilege	2320	powershell.exe
Token: SeIncreaseQuotaPrivilege	2320	powershell.exe
Token: SeSecurityPrivilege	2320	powershell.exe
Token: SeTakeOwnershipPrivilege	2320	powershell.exe
Token: SeLoadDriverPrivilege	2320	powershell.exe
Token: SeSystemProfilePrivilege	2320	powershell.exe
Token: SeSystemtimePrivilege	2320	powershell.exe
Token: SeProfSingleProcessPrivilege	2320	powershell.exe
Token: SeIncBasePriorityPrivilege	2320	powershell.exe
Token: SeCreatePagefilePrivilege	2320	powershell.exe
Token: SeBackupPrivilege	2320	powershell.exe
Token: SeRestorePrivilege	2320	powershell.exe
Token: SeShutdownPrivilege	2320	powershell.exe
Token: SeDebugPrivilege	2320	powershell.exe
Token: SeSystemEnvironmentPrivilege	2320	powershell.exe
Token: SeRemoteShutdownPrivilege	2320	powershell.exe
Token: SeUndockPrivilege	2320	powershell.exe
Token: SeManageVolumePrivilege	2320	powershell.exe
Token: 33	2320	powershell.exe
Token: 34	2320	powershell.exe
Token: 35	2320	powershell.exe
Token: 36	2320	powershell.exe
Token: SeDebugPrivilege	236	powershell.exe
Token: SeIncreaseQuotaPrivilege	236	powershell.exe
Token: SeSecurityPrivilege	236	powershell.exe
Token: SeTakeOwnershipPrivilege	236	powershell.exe
Token: SeLoadDriverPrivilege	236	powershell.exe
Token: SeSystemProfilePrivilege	236	powershell.exe
Token: SeSystemtimePrivilege	236	powershell.exe
Token: SeProfSingleProcessPrivilege	236	powershell.exe
Token: SeIncBasePriorityPrivilege	236	powershell.exe
Token: SeCreatePagefilePrivilege	236	powershell.exe
Token: SeBackupPrivilege	236	powershell.exe
Token: SeRestorePrivilege	236	powershell.exe
Token: SeShutdownPrivilege	236	powershell.exe
Token: SeDebugPrivilege	236	powershell.exe
Token: SeSystemEnvironmentPrivilege	236	powershell.exe
Token: SeRemoteShutdownPrivilege	236	powershell.exe
Token: SeUndockPrivilege	236	powershell.exe
Token: SeManageVolumePrivilege	236	powershell.exe
Token: 33	236	powershell.exe
Token: 34	236	powershell.exe
Token: 35	236	powershell.exe
Token: 36	236	powershell.exe
Token: SeDebugPrivilege	1876	powershell.exe
Token: SeIncreaseQuotaPrivilege	1876	powershell.exe
Token: SeSecurityPrivilege	1876	powershell.exe
Token: SeTakeOwnershipPrivilege	1876	powershell.exe
Token: SeLoadDriverPrivilege	1876	powershell.exe
Token: SeSystemProfilePrivilege	1876	powershell.exe
Token: SeSystemtimePrivilege	1876	powershell.exe
Token: SeProfSingleProcessPrivilege	1876	powershell.exe
Token: SeIncBasePriorityPrivilege	1876	powershell.exe
Token: SeCreatePagefilePrivilege	1876	powershell.exe
Token: SeBackupPrivilege	1876	powershell.exe
Token: SeRestorePrivilege	1876	powershell.exe
Token: SeShutdownPrivilege	1876	powershell.exe
Token: SeDebugPrivilege	1876	powershell.exe
Token: SeSystemEnvironmentPrivilege	1876	powershell.exe
Token: SeRemoteShutdownPrivilege	1876	powershell.exe
Token: SeUndockPrivilege	1876	powershell.exe
Token: SeManageVolumePrivilege	1876	powershell.exe
Token: 33	1876	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 3368 wrote to memory of 4108	3368	default.dat.exe	86
PID 4108 wrote to memory of 3916	4108	default.dat.exe	87
PID 3916 wrote to memory of 2320	3916	cmd.exe	89
PID 4108 wrote to memory of 3096	4108	default.dat.exe	91
PID 3096 wrote to memory of 236	3096	cmd.exe	93
PID 4108 wrote to memory of 3836	4108	default.dat.exe	94
PID 3836 wrote to memory of 1876	3836	cmd.exe	96
PID 4108 wrote to memory of 3164	4108	default.dat.exe	97
PID 3164 wrote to memory of 1052	3164	cmd.exe	99
PID 4108 wrote to memory of 1284	4108	default.dat.exe	100
PID 1284 wrote to memory of 5344	1284	cmd.exe	102
PID 4108 wrote to memory of 4576	4108	default.dat.exe	103
PID 4576 wrote to memory of 1996	4576	cmd.exe	105
PID 4108 wrote to memory of 3696	4108	default.dat.exe	106
PID 3696 wrote to memory of 5708	3696	cmd.exe	108
PID 4108 wrote to memory of 4496	4108	default.dat.exe	109
PID 4496 wrote to memory of 4184	4496	cmd.exe	111
PID 4108 wrote to memory of 2424	4108	default.dat.exe	112
PID 2424 wrote to memory of 5584	2424	cmd.exe	114
PID 4108 wrote to memory of 620	4108	default.dat.exe	115
PID 620 wrote to memory of 4268	620	cmd.exe	117
PID 4108 wrote to memory of 1228	4108	default.dat.exe	118
PID 1228 wrote to memory of 2464	1228	cmd.exe	120
PID 4108 wrote to memory of 1956	4108	default.dat.exe	121
PID 1956 wrote to memory of 5596	1956	cmd.exe	123

C:\Users\Admin\AppData\Local\Temp\default.dat.exe
"C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3368
- C:\Users\Admin\AppData\Local\Temp\default.dat.exe
  "C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4108
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3916
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2320
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\rekigema'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3096
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\rekigema'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3836
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1876
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3164
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1052
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1284
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5344
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4576
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1996
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3696
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5708
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4496
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4184
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2424
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5584
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:620
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4268
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1228
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1956
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5596

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact