ed74b54adeea87f6c2b55e5d4344011a3f4cc660af29493c87ffa1804d1d0c82

Analysis

max time kernel
150s
max time network
119s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 23:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
_ed74b54adeea87f6c2b55e5d4344011a3f4cc660af29493c87ffa1804d1d0c82.exe
Size 13.6MB
Sample260709-3x4rmab16v
SHA256 ed74b54adeea87f6c2b55e5d4344011a3f4cc660af29493c87ffa1804d1d0c82
MD5 3443909d7c6697a9f2cf26ad234d4230
SHA1 cd955bf6546b1910de417b789d5b6073b6b715cf
SHA512 fd7c22fc73bcfca3f0e0a8e3c07f07e11014938db86495065736abe53932e037427c2f9e29e42182fe6f6334cfc280d5685cb9d8d68ab5332d849afbf3f9e8e7
SSDEEP 393216:0/SfgpX4mHMq0HKZjhlgiXuOumXMCHWUjXFcuI3/PGTAI:0jp4mM5cjhlgiXLumXMb8XyH/O7
TLSH
T13BE63308B7E106EEF9B35138E4E16785F168346A1B71C99F57A4C3B29E672F00D3A643
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4464	powershell.exe
5944	powershell.exe
1208	powershell.exe
360	powershell.exe
2248	powershell.exe
3296	powershell.exe
5012	powershell.exe
2688	powershell.exe
4884	powershell.exe
4976	powershell.exe
916	powershell.exe
4476	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
5160	_ed74b54adeea87f6c2b55e5d4344011a3f4cc660af29493c87ffa1804d1d0c82.exe
5160	_ed74b54adeea87f6c2b55e5d4344011a3f4cc660af29493c87ffa1804d1d0c82.exe
5160	_ed74b54adeea87f6c2b55e5d4344011a3f4cc660af29493c87ffa1804d1d0c82.exe
5160	_ed74b54adeea87f6c2b55e5d4344011a3f4cc660af29493c87ffa1804d1d0c82.exe
5160	_ed74b54adeea87f6c2b55e5d4344011a3f4cc660af29493c87ffa1804d1d0c82.exe
5160	_ed74b54adeea87f6c2b55e5d4344011a3f4cc660af29493c87ffa1804d1d0c82.exe
5160	_ed74b54adeea87f6c2b55e5d4344011a3f4cc660af29493c87ffa1804d1d0c82.exe
5160	_ed74b54adeea87f6c2b55e5d4344011a3f4cc660af29493c87ffa1804d1d0c82.exe
5160	_ed74b54adeea87f6c2b55e5d4344011a3f4cc660af29493c87ffa1804d1d0c82.exe
5160	_ed74b54adeea87f6c2b55e5d4344011a3f4cc660af29493c87ffa1804d1d0c82.exe
5160	_ed74b54adeea87f6c2b55e5d4344011a3f4cc660af29493c87ffa1804d1d0c82.exe
5160	_ed74b54adeea87f6c2b55e5d4344011a3f4cc660af29493c87ffa1804d1d0c82.exe
5160	_ed74b54adeea87f6c2b55e5d4344011a3f4cc660af29493c87ffa1804d1d0c82.exe
5160	_ed74b54adeea87f6c2b55e5d4344011a3f4cc660af29493c87ffa1804d1d0c82.exe
5160	_ed74b54adeea87f6c2b55e5d4344011a3f4cc660af29493c87ffa1804d1d0c82.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
5160	_ed74b54adeea87f6c2b55e5d4344011a3f4cc660af29493c87ffa1804d1d0c82.exe
5160	_ed74b54adeea87f6c2b55e5d4344011a3f4cc660af29493c87ffa1804d1d0c82.exe
360	powershell.exe
360	powershell.exe
4976	powershell.exe
4976	powershell.exe
916	powershell.exe
916	powershell.exe
4476	powershell.exe
4476	powershell.exe
4464	powershell.exe
4464	powershell.exe
5944	powershell.exe
5944	powershell.exe
2248	powershell.exe
2248	powershell.exe
3296	powershell.exe
3296	powershell.exe
5012	powershell.exe
5012	powershell.exe
2688	powershell.exe
2688	powershell.exe
4884	powershell.exe
4884	powershell.exe
1208	powershell.exe
1208	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5160	_ed74b54adeea87f6c2b55e5d4344011a3f4cc660af29493c87ffa1804d1d0c82.exe
Token: SeDebugPrivilege	360	powershell.exe
Token: SeIncreaseQuotaPrivilege	360	powershell.exe
Token: SeSecurityPrivilege	360	powershell.exe
Token: SeTakeOwnershipPrivilege	360	powershell.exe
Token: SeLoadDriverPrivilege	360	powershell.exe
Token: SeSystemProfilePrivilege	360	powershell.exe
Token: SeSystemtimePrivilege	360	powershell.exe
Token: SeProfSingleProcessPrivilege	360	powershell.exe
Token: SeIncBasePriorityPrivilege	360	powershell.exe
Token: SeCreatePagefilePrivilege	360	powershell.exe
Token: SeBackupPrivilege	360	powershell.exe
Token: SeRestorePrivilege	360	powershell.exe
Token: SeShutdownPrivilege	360	powershell.exe
Token: SeDebugPrivilege	360	powershell.exe
Token: SeSystemEnvironmentPrivilege	360	powershell.exe
Token: SeRemoteShutdownPrivilege	360	powershell.exe
Token: SeUndockPrivilege	360	powershell.exe
Token: SeManageVolumePrivilege	360	powershell.exe
Token: 33	360	powershell.exe
Token: 34	360	powershell.exe
Token: 35	360	powershell.exe
Token: 36	360	powershell.exe
Token: SeDebugPrivilege	4976	powershell.exe
Token: SeIncreaseQuotaPrivilege	4976	powershell.exe
Token: SeSecurityPrivilege	4976	powershell.exe
Token: SeTakeOwnershipPrivilege	4976	powershell.exe
Token: SeLoadDriverPrivilege	4976	powershell.exe
Token: SeSystemProfilePrivilege	4976	powershell.exe
Token: SeSystemtimePrivilege	4976	powershell.exe
Token: SeProfSingleProcessPrivilege	4976	powershell.exe
Token: SeIncBasePriorityPrivilege	4976	powershell.exe
Token: SeCreatePagefilePrivilege	4976	powershell.exe
Token: SeBackupPrivilege	4976	powershell.exe
Token: SeRestorePrivilege	4976	powershell.exe
Token: SeShutdownPrivilege	4976	powershell.exe
Token: SeDebugPrivilege	4976	powershell.exe
Token: SeSystemEnvironmentPrivilege	4976	powershell.exe
Token: SeRemoteShutdownPrivilege	4976	powershell.exe
Token: SeUndockPrivilege	4976	powershell.exe
Token: SeManageVolumePrivilege	4976	powershell.exe
Token: 33	4976	powershell.exe
Token: 34	4976	powershell.exe
Token: 35	4976	powershell.exe
Token: 36	4976	powershell.exe
Token: SeDebugPrivilege	916	powershell.exe
Token: SeIncreaseQuotaPrivilege	916	powershell.exe
Token: SeSecurityPrivilege	916	powershell.exe
Token: SeTakeOwnershipPrivilege	916	powershell.exe
Token: SeLoadDriverPrivilege	916	powershell.exe
Token: SeSystemProfilePrivilege	916	powershell.exe
Token: SeSystemtimePrivilege	916	powershell.exe
Token: SeProfSingleProcessPrivilege	916	powershell.exe
Token: SeIncBasePriorityPrivilege	916	powershell.exe
Token: SeCreatePagefilePrivilege	916	powershell.exe
Token: SeBackupPrivilege	916	powershell.exe
Token: SeRestorePrivilege	916	powershell.exe
Token: SeShutdownPrivilege	916	powershell.exe
Token: SeDebugPrivilege	916	powershell.exe
Token: SeSystemEnvironmentPrivilege	916	powershell.exe
Token: SeRemoteShutdownPrivilege	916	powershell.exe
Token: SeUndockPrivilege	916	powershell.exe
Token: SeManageVolumePrivilege	916	powershell.exe
Token: 33	916	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 5808 wrote to memory of 5160	5808	_ed74b54adeea87f6c2b55e5d4344011a3f4cc660af29493c87ffa1804d1d0c82.exe	86
PID 5160 wrote to memory of 5140	5160	_ed74b54adeea87f6c2b55e5d4344011a3f4cc660af29493c87ffa1804d1d0c82.exe	87
PID 5140 wrote to memory of 360	5140	cmd.exe	89
PID 5160 wrote to memory of 4496	5160	_ed74b54adeea87f6c2b55e5d4344011a3f4cc660af29493c87ffa1804d1d0c82.exe	91
PID 4496 wrote to memory of 4976	4496	cmd.exe	93
PID 5160 wrote to memory of 2664	5160	_ed74b54adeea87f6c2b55e5d4344011a3f4cc660af29493c87ffa1804d1d0c82.exe	94
PID 2664 wrote to memory of 916	2664	cmd.exe	96
PID 5160 wrote to memory of 5692	5160	_ed74b54adeea87f6c2b55e5d4344011a3f4cc660af29493c87ffa1804d1d0c82.exe	97
PID 5692 wrote to memory of 4476	5692	cmd.exe	99
PID 5160 wrote to memory of 4468	5160	_ed74b54adeea87f6c2b55e5d4344011a3f4cc660af29493c87ffa1804d1d0c82.exe	100
PID 4468 wrote to memory of 4464	4468	cmd.exe	102
PID 5160 wrote to memory of 2888	5160	_ed74b54adeea87f6c2b55e5d4344011a3f4cc660af29493c87ffa1804d1d0c82.exe	103
PID 2888 wrote to memory of 5944	2888	cmd.exe	105
PID 5160 wrote to memory of 3768	5160	_ed74b54adeea87f6c2b55e5d4344011a3f4cc660af29493c87ffa1804d1d0c82.exe	106
PID 3768 wrote to memory of 2248	3768	cmd.exe	108
PID 5160 wrote to memory of 5124	5160	_ed74b54adeea87f6c2b55e5d4344011a3f4cc660af29493c87ffa1804d1d0c82.exe	109
PID 5124 wrote to memory of 3296	5124	cmd.exe	111
PID 5160 wrote to memory of 5192	5160	_ed74b54adeea87f6c2b55e5d4344011a3f4cc660af29493c87ffa1804d1d0c82.exe	112
PID 5192 wrote to memory of 5012	5192	cmd.exe	114
PID 5160 wrote to memory of 1044	5160	_ed74b54adeea87f6c2b55e5d4344011a3f4cc660af29493c87ffa1804d1d0c82.exe	115
PID 1044 wrote to memory of 2688	1044	cmd.exe	117
PID 5160 wrote to memory of 4980	5160	_ed74b54adeea87f6c2b55e5d4344011a3f4cc660af29493c87ffa1804d1d0c82.exe	118
PID 4980 wrote to memory of 4884	4980	cmd.exe	120
PID 5160 wrote to memory of 5560	5160	_ed74b54adeea87f6c2b55e5d4344011a3f4cc660af29493c87ffa1804d1d0c82.exe	121
PID 5560 wrote to memory of 1208	5560	cmd.exe	123

C:\Users\Admin\AppData\Local\Temp\_ed74b54adeea87f6c2b55e5d4344011a3f4cc660af29493c87ffa1804d1d0c82.exe
"C:\Users\Admin\AppData\Local\Temp\_ed74b54adeea87f6c2b55e5d4344011a3f4cc660af29493c87ffa1804d1d0c82.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5808
- C:\Users\Admin\AppData\Local\Temp\_ed74b54adeea87f6c2b55e5d4344011a3f4cc660af29493c87ffa1804d1d0c82.exe
  "C:\Users\Admin\AppData\Local\Temp\_ed74b54adeea87f6c2b55e5d4344011a3f4cc660af29493c87ffa1804d1d0c82.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5160
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5140
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:360
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\rekigema'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4496
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\rekigema'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4976
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2664
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:916
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5692
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4476
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4468
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2888
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5944
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3768
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2248
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5124
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3296
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5192
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5012
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1044
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2688
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4980
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4884
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5560
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1208

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact