518820c647ae2a73253b8cadffe1c3881be40936c228cf774c85af42a1c06b9a

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 09:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
default.dat.exe
Size 13.7MB
Sample260710-lwanqag14k
SHA256 518820c647ae2a73253b8cadffe1c3881be40936c228cf774c85af42a1c06b9a
MD5 d9f41571617f5566313d683b8750483c
SHA1 43bf652c52e286bf637b42f2ae8a6aef92cf9f2b
SHA512 cf99d07477f7384585e9622ca76c2a9069876278fdc7a32e70f0ce9818eca8830090fc43b927bc88f56a08c09d348f655a0f942bf081e5b2e7cc9f8a3e167793
SSDEEP 393216:2d6Ga3RG0jPq8T9HBM1ozduTxTX8pPXMCHWUjX5cuI3/PGTAI:2AG4MoPpT961o5uxX8pPXMb8XOH/O7
TLSH
T160E6331996E042EEE9735139EFE253A5E52874A71F72CACF461883A0BE530F04D3DA17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4940	powershell.exe
1432	powershell.exe
4208	powershell.exe
2108	powershell.exe
3448	powershell.exe
4840	powershell.exe
3424	powershell.exe
124	powershell.exe
3592	powershell.exe
3888	powershell.exe
2056	powershell.exe
2940	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
2848	default.dat.exe
2848	default.dat.exe
2848	default.dat.exe
2848	default.dat.exe
2848	default.dat.exe
2848	default.dat.exe
2848	default.dat.exe
2848	default.dat.exe
2848	default.dat.exe
2848	default.dat.exe
2848	default.dat.exe
2848	default.dat.exe
2848	default.dat.exe
2848	default.dat.exe
2848	default.dat.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
2848	default.dat.exe
2848	default.dat.exe
4208	powershell.exe
4208	powershell.exe
2108	powershell.exe
2108	powershell.exe
3888	powershell.exe
3888	powershell.exe
3448	powershell.exe
3448	powershell.exe
4840	powershell.exe
4840	powershell.exe
2056	powershell.exe
2056	powershell.exe
2940	powershell.exe
2940	powershell.exe
3424	powershell.exe
3424	powershell.exe
4940	powershell.exe
4940	powershell.exe
1432	powershell.exe
1432	powershell.exe
124	powershell.exe
124	powershell.exe
3592	powershell.exe
3592	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2848	default.dat.exe
Token: SeDebugPrivilege	4208	powershell.exe
Token: SeIncreaseQuotaPrivilege	4208	powershell.exe
Token: SeSecurityPrivilege	4208	powershell.exe
Token: SeTakeOwnershipPrivilege	4208	powershell.exe
Token: SeLoadDriverPrivilege	4208	powershell.exe
Token: SeSystemProfilePrivilege	4208	powershell.exe
Token: SeSystemtimePrivilege	4208	powershell.exe
Token: SeProfSingleProcessPrivilege	4208	powershell.exe
Token: SeIncBasePriorityPrivilege	4208	powershell.exe
Token: SeCreatePagefilePrivilege	4208	powershell.exe
Token: SeBackupPrivilege	4208	powershell.exe
Token: SeRestorePrivilege	4208	powershell.exe
Token: SeShutdownPrivilege	4208	powershell.exe
Token: SeDebugPrivilege	4208	powershell.exe
Token: SeSystemEnvironmentPrivilege	4208	powershell.exe
Token: SeRemoteShutdownPrivilege	4208	powershell.exe
Token: SeUndockPrivilege	4208	powershell.exe
Token: SeManageVolumePrivilege	4208	powershell.exe
Token: 33	4208	powershell.exe
Token: 34	4208	powershell.exe
Token: 35	4208	powershell.exe
Token: 36	4208	powershell.exe
Token: SeDebugPrivilege	2108	powershell.exe
Token: SeIncreaseQuotaPrivilege	2108	powershell.exe
Token: SeSecurityPrivilege	2108	powershell.exe
Token: SeTakeOwnershipPrivilege	2108	powershell.exe
Token: SeLoadDriverPrivilege	2108	powershell.exe
Token: SeSystemProfilePrivilege	2108	powershell.exe
Token: SeSystemtimePrivilege	2108	powershell.exe
Token: SeProfSingleProcessPrivilege	2108	powershell.exe
Token: SeIncBasePriorityPrivilege	2108	powershell.exe
Token: SeCreatePagefilePrivilege	2108	powershell.exe
Token: SeBackupPrivilege	2108	powershell.exe
Token: SeRestorePrivilege	2108	powershell.exe
Token: SeShutdownPrivilege	2108	powershell.exe
Token: SeDebugPrivilege	2108	powershell.exe
Token: SeSystemEnvironmentPrivilege	2108	powershell.exe
Token: SeRemoteShutdownPrivilege	2108	powershell.exe
Token: SeUndockPrivilege	2108	powershell.exe
Token: SeManageVolumePrivilege	2108	powershell.exe
Token: 33	2108	powershell.exe
Token: 34	2108	powershell.exe
Token: 35	2108	powershell.exe
Token: 36	2108	powershell.exe
Token: SeDebugPrivilege	3888	powershell.exe
Token: SeIncreaseQuotaPrivilege	3888	powershell.exe
Token: SeSecurityPrivilege	3888	powershell.exe
Token: SeTakeOwnershipPrivilege	3888	powershell.exe
Token: SeLoadDriverPrivilege	3888	powershell.exe
Token: SeSystemProfilePrivilege	3888	powershell.exe
Token: SeSystemtimePrivilege	3888	powershell.exe
Token: SeProfSingleProcessPrivilege	3888	powershell.exe
Token: SeIncBasePriorityPrivilege	3888	powershell.exe
Token: SeCreatePagefilePrivilege	3888	powershell.exe
Token: SeBackupPrivilege	3888	powershell.exe
Token: SeRestorePrivilege	3888	powershell.exe
Token: SeShutdownPrivilege	3888	powershell.exe
Token: SeDebugPrivilege	3888	powershell.exe
Token: SeSystemEnvironmentPrivilege	3888	powershell.exe
Token: SeRemoteShutdownPrivilege	3888	powershell.exe
Token: SeUndockPrivilege	3888	powershell.exe
Token: SeManageVolumePrivilege	3888	powershell.exe
Token: 33	3888	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 3892 wrote to memory of 2848	3892	default.dat.exe	87
PID 2848 wrote to memory of 108	2848	default.dat.exe	88
PID 108 wrote to memory of 4208	108	cmd.exe	90
PID 2848 wrote to memory of 4352	2848	default.dat.exe	92
PID 4352 wrote to memory of 2108	4352	cmd.exe	94
PID 2848 wrote to memory of 4660	2848	default.dat.exe	95
PID 4660 wrote to memory of 3888	4660	cmd.exe	97
PID 2848 wrote to memory of 2060	2848	default.dat.exe	98
PID 2060 wrote to memory of 3448	2060	cmd.exe	100
PID 2848 wrote to memory of 3784	2848	default.dat.exe	101
PID 3784 wrote to memory of 4840	3784	cmd.exe	103
PID 2848 wrote to memory of 4808	2848	default.dat.exe	104
PID 4808 wrote to memory of 2056	4808	cmd.exe	106
PID 2848 wrote to memory of 2156	2848	default.dat.exe	107
PID 2156 wrote to memory of 2940	2156	cmd.exe	109
PID 2848 wrote to memory of 5956	2848	default.dat.exe	110
PID 5956 wrote to memory of 3424	5956	cmd.exe	112
PID 2848 wrote to memory of 4120	2848	default.dat.exe	113
PID 4120 wrote to memory of 4940	4120	cmd.exe	115
PID 2848 wrote to memory of 2444	2848	default.dat.exe	116
PID 2444 wrote to memory of 1432	2444	cmd.exe	118
PID 2848 wrote to memory of 2596	2848	default.dat.exe	119
PID 2596 wrote to memory of 124	2596	cmd.exe	121
PID 2848 wrote to memory of 5884	2848	default.dat.exe	122
PID 5884 wrote to memory of 3592	5884	cmd.exe	124

C:\Users\Admin\AppData\Local\Temp\default.dat.exe
"C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3892
- C:\Users\Admin\AppData\Local\Temp\default.dat.exe
  "C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2848
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:108
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4208
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\hirireha'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4352
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\hirireha'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2108
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4660
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3888
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2060
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3448
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3784
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4840
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4808
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2056
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2156
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2940
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5956
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3424
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4120
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4940
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2444
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1432
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2596
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5884
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3592

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact