81438ec974a24527a4218f451214e4abeda74c6d112c2b2366571d1ba8eb700e

Analysis

max time kernel
150s
max time network
116s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 02:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
_81438ec974a24527a4218f451214e4abeda74c6d112c2b2366571d1ba8eb700e.exe
Size 13.7MB
Sample260710-dd7azacv3l
SHA256 81438ec974a24527a4218f451214e4abeda74c6d112c2b2366571d1ba8eb700e
MD5 46a7d8d9303db9b9c5301b6d080088cc
SHA1 27312667da1771cefb8880a0364d41ed056b59f0
SHA512 f9ccadd4da6f6cfbd59cf909d12372c45aee182517e67b3ddd22cd2227bccb17214dedb2a11ad981769462b3cf5b80e19f38b2c1889ed4b1042c412dbb598ef1
SSDEEP 393216:4Xp7kyys4TMx9h4BdKDXMCHWUjXMcuI3/PGTAI:GhuTMJ4Bd2XMb8XZH/O7
TLSH
T120E63354B5E020FDE9B7423CFEE1818AE4D570224F75CA9B47688AF4AF131E06D3DA16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2952	powershell.exe
3124	powershell.exe
3588	powershell.exe
2356	powershell.exe
2332	powershell.exe
5464	powershell.exe
2168	powershell.exe
1952	powershell.exe
3912	powershell.exe
8	powershell.exe
4876	powershell.exe
2860	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
4996	_81438ec974a24527a4218f451214e4abeda74c6d112c2b2366571d1ba8eb700e.exe
4996	_81438ec974a24527a4218f451214e4abeda74c6d112c2b2366571d1ba8eb700e.exe
4996	_81438ec974a24527a4218f451214e4abeda74c6d112c2b2366571d1ba8eb700e.exe
4996	_81438ec974a24527a4218f451214e4abeda74c6d112c2b2366571d1ba8eb700e.exe
4996	_81438ec974a24527a4218f451214e4abeda74c6d112c2b2366571d1ba8eb700e.exe
4996	_81438ec974a24527a4218f451214e4abeda74c6d112c2b2366571d1ba8eb700e.exe
4996	_81438ec974a24527a4218f451214e4abeda74c6d112c2b2366571d1ba8eb700e.exe
4996	_81438ec974a24527a4218f451214e4abeda74c6d112c2b2366571d1ba8eb700e.exe
4996	_81438ec974a24527a4218f451214e4abeda74c6d112c2b2366571d1ba8eb700e.exe
4996	_81438ec974a24527a4218f451214e4abeda74c6d112c2b2366571d1ba8eb700e.exe
4996	_81438ec974a24527a4218f451214e4abeda74c6d112c2b2366571d1ba8eb700e.exe
4996	_81438ec974a24527a4218f451214e4abeda74c6d112c2b2366571d1ba8eb700e.exe
4996	_81438ec974a24527a4218f451214e4abeda74c6d112c2b2366571d1ba8eb700e.exe
4996	_81438ec974a24527a4218f451214e4abeda74c6d112c2b2366571d1ba8eb700e.exe
4996	_81438ec974a24527a4218f451214e4abeda74c6d112c2b2366571d1ba8eb700e.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
4996	_81438ec974a24527a4218f451214e4abeda74c6d112c2b2366571d1ba8eb700e.exe
4996	_81438ec974a24527a4218f451214e4abeda74c6d112c2b2366571d1ba8eb700e.exe
2952	powershell.exe
2952	powershell.exe
3124	powershell.exe
3124	powershell.exe
3588	powershell.exe
3588	powershell.exe
3912	powershell.exe
3912	powershell.exe
2356	powershell.exe
2356	powershell.exe
2332	powershell.exe
2332	powershell.exe
5464	powershell.exe
5464	powershell.exe
2168	powershell.exe
2168	powershell.exe
1952	powershell.exe
1952	powershell.exe
8	powershell.exe
8	powershell.exe
4876	powershell.exe
4876	powershell.exe
2860	powershell.exe
2860	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4996	_81438ec974a24527a4218f451214e4abeda74c6d112c2b2366571d1ba8eb700e.exe
Token: SeDebugPrivilege	2952	powershell.exe
Token: SeIncreaseQuotaPrivilege	2952	powershell.exe
Token: SeSecurityPrivilege	2952	powershell.exe
Token: SeTakeOwnershipPrivilege	2952	powershell.exe
Token: SeLoadDriverPrivilege	2952	powershell.exe
Token: SeSystemProfilePrivilege	2952	powershell.exe
Token: SeSystemtimePrivilege	2952	powershell.exe
Token: SeProfSingleProcessPrivilege	2952	powershell.exe
Token: SeIncBasePriorityPrivilege	2952	powershell.exe
Token: SeCreatePagefilePrivilege	2952	powershell.exe
Token: SeBackupPrivilege	2952	powershell.exe
Token: SeRestorePrivilege	2952	powershell.exe
Token: SeShutdownPrivilege	2952	powershell.exe
Token: SeDebugPrivilege	2952	powershell.exe
Token: SeSystemEnvironmentPrivilege	2952	powershell.exe
Token: SeRemoteShutdownPrivilege	2952	powershell.exe
Token: SeUndockPrivilege	2952	powershell.exe
Token: SeManageVolumePrivilege	2952	powershell.exe
Token: 33	2952	powershell.exe
Token: 34	2952	powershell.exe
Token: 35	2952	powershell.exe
Token: 36	2952	powershell.exe
Token: SeDebugPrivilege	3124	powershell.exe
Token: SeIncreaseQuotaPrivilege	3124	powershell.exe
Token: SeSecurityPrivilege	3124	powershell.exe
Token: SeTakeOwnershipPrivilege	3124	powershell.exe
Token: SeLoadDriverPrivilege	3124	powershell.exe
Token: SeSystemProfilePrivilege	3124	powershell.exe
Token: SeSystemtimePrivilege	3124	powershell.exe
Token: SeProfSingleProcessPrivilege	3124	powershell.exe
Token: SeIncBasePriorityPrivilege	3124	powershell.exe
Token: SeCreatePagefilePrivilege	3124	powershell.exe
Token: SeBackupPrivilege	3124	powershell.exe
Token: SeRestorePrivilege	3124	powershell.exe
Token: SeShutdownPrivilege	3124	powershell.exe
Token: SeDebugPrivilege	3124	powershell.exe
Token: SeSystemEnvironmentPrivilege	3124	powershell.exe
Token: SeRemoteShutdownPrivilege	3124	powershell.exe
Token: SeUndockPrivilege	3124	powershell.exe
Token: SeManageVolumePrivilege	3124	powershell.exe
Token: 33	3124	powershell.exe
Token: 34	3124	powershell.exe
Token: 35	3124	powershell.exe
Token: 36	3124	powershell.exe
Token: SeDebugPrivilege	3588	powershell.exe
Token: SeIncreaseQuotaPrivilege	3588	powershell.exe
Token: SeSecurityPrivilege	3588	powershell.exe
Token: SeTakeOwnershipPrivilege	3588	powershell.exe
Token: SeLoadDriverPrivilege	3588	powershell.exe
Token: SeSystemProfilePrivilege	3588	powershell.exe
Token: SeSystemtimePrivilege	3588	powershell.exe
Token: SeProfSingleProcessPrivilege	3588	powershell.exe
Token: SeIncBasePriorityPrivilege	3588	powershell.exe
Token: SeCreatePagefilePrivilege	3588	powershell.exe
Token: SeBackupPrivilege	3588	powershell.exe
Token: SeRestorePrivilege	3588	powershell.exe
Token: SeShutdownPrivilege	3588	powershell.exe
Token: SeDebugPrivilege	3588	powershell.exe
Token: SeSystemEnvironmentPrivilege	3588	powershell.exe
Token: SeRemoteShutdownPrivilege	3588	powershell.exe
Token: SeUndockPrivilege	3588	powershell.exe
Token: SeManageVolumePrivilege	3588	powershell.exe
Token: 33	3588	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 6028 wrote to memory of 4996	6028	_81438ec974a24527a4218f451214e4abeda74c6d112c2b2366571d1ba8eb700e.exe	87
PID 4996 wrote to memory of 3376	4996	_81438ec974a24527a4218f451214e4abeda74c6d112c2b2366571d1ba8eb700e.exe	88
PID 3376 wrote to memory of 2952	3376	cmd.exe	90
PID 4996 wrote to memory of 3424	4996	_81438ec974a24527a4218f451214e4abeda74c6d112c2b2366571d1ba8eb700e.exe	92
PID 3424 wrote to memory of 3124	3424	cmd.exe	94
PID 4996 wrote to memory of 252	4996	_81438ec974a24527a4218f451214e4abeda74c6d112c2b2366571d1ba8eb700e.exe	95
PID 252 wrote to memory of 3588	252	cmd.exe	97
PID 4996 wrote to memory of 2916	4996	_81438ec974a24527a4218f451214e4abeda74c6d112c2b2366571d1ba8eb700e.exe	98
PID 2916 wrote to memory of 3912	2916	cmd.exe	100
PID 4996 wrote to memory of 3032	4996	_81438ec974a24527a4218f451214e4abeda74c6d112c2b2366571d1ba8eb700e.exe	101
PID 3032 wrote to memory of 2356	3032	cmd.exe	103
PID 4996 wrote to memory of 2172	4996	_81438ec974a24527a4218f451214e4abeda74c6d112c2b2366571d1ba8eb700e.exe	104
PID 2172 wrote to memory of 2332	2172	cmd.exe	106
PID 4996 wrote to memory of 3368	4996	_81438ec974a24527a4218f451214e4abeda74c6d112c2b2366571d1ba8eb700e.exe	107
PID 3368 wrote to memory of 5464	3368	cmd.exe	109
PID 4996 wrote to memory of 2104	4996	_81438ec974a24527a4218f451214e4abeda74c6d112c2b2366571d1ba8eb700e.exe	110
PID 2104 wrote to memory of 2168	2104	cmd.exe	112
PID 4996 wrote to memory of 2476	4996	_81438ec974a24527a4218f451214e4abeda74c6d112c2b2366571d1ba8eb700e.exe	113
PID 2476 wrote to memory of 1952	2476	cmd.exe	115
PID 4996 wrote to memory of 1236	4996	_81438ec974a24527a4218f451214e4abeda74c6d112c2b2366571d1ba8eb700e.exe	116
PID 1236 wrote to memory of 8	1236	cmd.exe	118
PID 4996 wrote to memory of 3328	4996	_81438ec974a24527a4218f451214e4abeda74c6d112c2b2366571d1ba8eb700e.exe	119
PID 3328 wrote to memory of 4876	3328	cmd.exe	121
PID 4996 wrote to memory of 2132	4996	_81438ec974a24527a4218f451214e4abeda74c6d112c2b2366571d1ba8eb700e.exe	122
PID 2132 wrote to memory of 2860	2132	cmd.exe	124

C:\Users\Admin\AppData\Local\Temp\_81438ec974a24527a4218f451214e4abeda74c6d112c2b2366571d1ba8eb700e.exe
"C:\Users\Admin\AppData\Local\Temp\_81438ec974a24527a4218f451214e4abeda74c6d112c2b2366571d1ba8eb700e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:6028
- C:\Users\Admin\AppData\Local\Temp\_81438ec974a24527a4218f451214e4abeda74c6d112c2b2366571d1ba8eb700e.exe
  "C:\Users\Admin\AppData\Local\Temp\_81438ec974a24527a4218f451214e4abeda74c6d112c2b2366571d1ba8eb700e.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4996
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3376
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2952
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\hirireha'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3424
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\hirireha'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:252
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3588
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2916
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3912
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3032
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2356
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2172
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2332
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3368
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2104
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2168
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2476
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1952
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1236
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:8
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3328
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4876
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2132
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2860

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact