1138f7a02699421c300ea4a08e02fa014ea1e15f36647b27cd79eb339231842d

Analysis

max time kernel
149s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 06:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
default.dat.exe
Size 13.7MB
Sample260710-hnee6ags4x
SHA256 1138f7a02699421c300ea4a08e02fa014ea1e15f36647b27cd79eb339231842d
MD5 1b05bb4b7783efd8ac3e9d0ea2cd0254
SHA1 9d1f8916a0a1b5379dc2138fb2ffc3b552d2285b
SHA512 de0c06dfb422237ff768fdb1643eab0b950e2727b15e8e27498772b4323dfea92474c0f2bb09cf9cb31ee3f8f30b57302329b43fb1773c40d67a6f00c854b9fc
SSDEEP 393216:evkeZZXmvVUWjWG0i9kXMCHWUjXrcuI3/PGTAI:evPXSVH7zkXMb8XIH/O7
TLSH
T17FE6335CB6D116FDEAA3807DBEE20A99E02A78250B76C6DF0B5443B56E1B0D0CC3C657
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3520	powershell.exe
1036	powershell.exe
2632	powershell.exe
4380	powershell.exe
2432	powershell.exe
2288	powershell.exe
1616	powershell.exe
792	powershell.exe
1340	powershell.exe
1860	powershell.exe
3196	powershell.exe
1956	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
3488	default.dat.exe
3488	default.dat.exe
3488	default.dat.exe
3488	default.dat.exe
3488	default.dat.exe
3488	default.dat.exe
3488	default.dat.exe
3488	default.dat.exe
3488	default.dat.exe
3488	default.dat.exe
3488	default.dat.exe
3488	default.dat.exe
3488	default.dat.exe
3488	default.dat.exe
3488	default.dat.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
3488	default.dat.exe
3488	default.dat.exe
3520	powershell.exe
3520	powershell.exe
1616	powershell.exe
1616	powershell.exe
792	powershell.exe
792	powershell.exe
1036	powershell.exe
1036	powershell.exe
1340	powershell.exe
1340	powershell.exe
1860	powershell.exe
1860	powershell.exe
3196	powershell.exe
3196	powershell.exe
2632	powershell.exe
2632	powershell.exe
4380	powershell.exe
4380	powershell.exe
1956	powershell.exe
1956	powershell.exe
2288	powershell.exe
2288	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3488	default.dat.exe
Token: SeDebugPrivilege	3520	powershell.exe
Token: SeIncreaseQuotaPrivilege	3520	powershell.exe
Token: SeSecurityPrivilege	3520	powershell.exe
Token: SeTakeOwnershipPrivilege	3520	powershell.exe
Token: SeLoadDriverPrivilege	3520	powershell.exe
Token: SeSystemProfilePrivilege	3520	powershell.exe
Token: SeSystemtimePrivilege	3520	powershell.exe
Token: SeProfSingleProcessPrivilege	3520	powershell.exe
Token: SeIncBasePriorityPrivilege	3520	powershell.exe
Token: SeCreatePagefilePrivilege	3520	powershell.exe
Token: SeBackupPrivilege	3520	powershell.exe
Token: SeRestorePrivilege	3520	powershell.exe
Token: SeShutdownPrivilege	3520	powershell.exe
Token: SeDebugPrivilege	3520	powershell.exe
Token: SeSystemEnvironmentPrivilege	3520	powershell.exe
Token: SeRemoteShutdownPrivilege	3520	powershell.exe
Token: SeUndockPrivilege	3520	powershell.exe
Token: SeManageVolumePrivilege	3520	powershell.exe
Token: 33	3520	powershell.exe
Token: 34	3520	powershell.exe
Token: 35	3520	powershell.exe
Token: 36	3520	powershell.exe
Token: SeDebugPrivilege	1616	powershell.exe
Token: SeIncreaseQuotaPrivilege	1616	powershell.exe
Token: SeSecurityPrivilege	1616	powershell.exe
Token: SeTakeOwnershipPrivilege	1616	powershell.exe
Token: SeLoadDriverPrivilege	1616	powershell.exe
Token: SeSystemProfilePrivilege	1616	powershell.exe
Token: SeSystemtimePrivilege	1616	powershell.exe
Token: SeProfSingleProcessPrivilege	1616	powershell.exe
Token: SeIncBasePriorityPrivilege	1616	powershell.exe
Token: SeCreatePagefilePrivilege	1616	powershell.exe
Token: SeBackupPrivilege	1616	powershell.exe
Token: SeRestorePrivilege	1616	powershell.exe
Token: SeShutdownPrivilege	1616	powershell.exe
Token: SeDebugPrivilege	1616	powershell.exe
Token: SeSystemEnvironmentPrivilege	1616	powershell.exe
Token: SeRemoteShutdownPrivilege	1616	powershell.exe
Token: SeUndockPrivilege	1616	powershell.exe
Token: SeManageVolumePrivilege	1616	powershell.exe
Token: 33	1616	powershell.exe
Token: 34	1616	powershell.exe
Token: 35	1616	powershell.exe
Token: 36	1616	powershell.exe
Token: SeDebugPrivilege	792	powershell.exe
Token: SeIncreaseQuotaPrivilege	792	powershell.exe
Token: SeSecurityPrivilege	792	powershell.exe
Token: SeTakeOwnershipPrivilege	792	powershell.exe
Token: SeLoadDriverPrivilege	792	powershell.exe
Token: SeSystemProfilePrivilege	792	powershell.exe
Token: SeSystemtimePrivilege	792	powershell.exe
Token: SeProfSingleProcessPrivilege	792	powershell.exe
Token: SeIncBasePriorityPrivilege	792	powershell.exe
Token: SeCreatePagefilePrivilege	792	powershell.exe
Token: SeBackupPrivilege	792	powershell.exe
Token: SeRestorePrivilege	792	powershell.exe
Token: SeShutdownPrivilege	792	powershell.exe
Token: SeDebugPrivilege	792	powershell.exe
Token: SeSystemEnvironmentPrivilege	792	powershell.exe
Token: SeRemoteShutdownPrivilege	792	powershell.exe
Token: SeUndockPrivilege	792	powershell.exe
Token: SeManageVolumePrivilege	792	powershell.exe
Token: 33	792	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4048 wrote to memory of 3488	4048	default.dat.exe	86
PID 3488 wrote to memory of 1424	3488	default.dat.exe	87
PID 1424 wrote to memory of 3520	1424	cmd.exe	89
PID 3488 wrote to memory of 1060	3488	default.dat.exe	91
PID 1060 wrote to memory of 1616	1060	cmd.exe	93
PID 3488 wrote to memory of 1648	3488	default.dat.exe	94
PID 1648 wrote to memory of 792	1648	cmd.exe	96
PID 3488 wrote to memory of 1744	3488	default.dat.exe	97
PID 1744 wrote to memory of 1036	1744	cmd.exe	99
PID 3488 wrote to memory of 2636	3488	default.dat.exe	100
PID 2636 wrote to memory of 1340	2636	cmd.exe	102
PID 3488 wrote to memory of 6052	3488	default.dat.exe	103
PID 6052 wrote to memory of 1860	6052	cmd.exe	105
PID 3488 wrote to memory of 4452	3488	default.dat.exe	106
PID 4452 wrote to memory of 3196	4452	cmd.exe	108
PID 3488 wrote to memory of 2592	3488	default.dat.exe	109
PID 2592 wrote to memory of 2632	2592	cmd.exe	111
PID 3488 wrote to memory of 2224	3488	default.dat.exe	112
PID 2224 wrote to memory of 4380	2224	cmd.exe	114
PID 3488 wrote to memory of 5752	3488	default.dat.exe	115
PID 5752 wrote to memory of 1956	5752	cmd.exe	117
PID 3488 wrote to memory of 4056	3488	default.dat.exe	118
PID 4056 wrote to memory of 2432	4056	cmd.exe	120
PID 3488 wrote to memory of 4888	3488	default.dat.exe	121
PID 4888 wrote to memory of 2288	4888	cmd.exe	123

C:\Users\Admin\AppData\Local\Temp\default.dat.exe
"C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4048
- C:\Users\Admin\AppData\Local\Temp\default.dat.exe
  "C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3488
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1424
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3520
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\hirireha'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1060
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\hirireha'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1616
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1648
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:792
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1744
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1036
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2636
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1340
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6052
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1860
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4452
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3196
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2592
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2632
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2224
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5752
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1956
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4056
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:2432
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4888
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2288

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact