08db493f33654c7b2f850eb64f12ac148dab7c60fdcf428b6f3c407847710c68

Analysis

max time kernel
149s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/07/2026, 14:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
default.dat.exe
Size 13.7MB
Sample260711-sbc2nsc16j
SHA256 08db493f33654c7b2f850eb64f12ac148dab7c60fdcf428b6f3c407847710c68
MD5 b69ae1a5bc3092b286d6f47c48566ce2
SHA1 a14b04a0901e66222bc6dd9b0812ee213b4f8dfd
SHA512 163b47d90c6a31fb18dfa01fb366a25063b947d37ad83e2d82438466313f9b326365f2d76c9fd4c92a69b2fd6643285d8a274b8bf4e323a248cf44ae30ce92e2
SSDEEP 393216:w0ekHEw93qXtrxXMCHWUjXlcuI3/PGTAI:wJkOxXMb8XSH/O7
TLSH
T172E6331469E102FEFAB3013DDEA1555AE2A7B06A5370C9CF0BE853A15E171E08E3D727
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1116	powershell.exe
6032	powershell.exe
2384	powershell.exe
2264	powershell.exe
3976	powershell.exe
2988	powershell.exe
5236	powershell.exe
4380	powershell.exe
3536	powershell.exe
4232	powershell.exe
1320	powershell.exe
5224	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
4640	default.dat.exe
4640	default.dat.exe
4640	default.dat.exe
4640	default.dat.exe
4640	default.dat.exe
4640	default.dat.exe
4640	default.dat.exe
4640	default.dat.exe
4640	default.dat.exe
4640	default.dat.exe
4640	default.dat.exe
4640	default.dat.exe
4640	default.dat.exe
4640	default.dat.exe
4640	default.dat.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
4640	default.dat.exe
4640	default.dat.exe
2988	powershell.exe
2988	powershell.exe
5236	powershell.exe
5236	powershell.exe
4380	powershell.exe
4380	powershell.exe
5224	powershell.exe
5224	powershell.exe
1116	powershell.exe
1116	powershell.exe
6032	powershell.exe
6032	powershell.exe
2384	powershell.exe
2384	powershell.exe
2264	powershell.exe
2264	powershell.exe
3536	powershell.exe
3536	powershell.exe
4232	powershell.exe
4232	powershell.exe
1320	powershell.exe
1320	powershell.exe
3976	powershell.exe
3976	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4640	default.dat.exe
Token: SeDebugPrivilege	2988	powershell.exe
Token: SeIncreaseQuotaPrivilege	2988	powershell.exe
Token: SeSecurityPrivilege	2988	powershell.exe
Token: SeTakeOwnershipPrivilege	2988	powershell.exe
Token: SeLoadDriverPrivilege	2988	powershell.exe
Token: SeSystemProfilePrivilege	2988	powershell.exe
Token: SeSystemtimePrivilege	2988	powershell.exe
Token: SeProfSingleProcessPrivilege	2988	powershell.exe
Token: SeIncBasePriorityPrivilege	2988	powershell.exe
Token: SeCreatePagefilePrivilege	2988	powershell.exe
Token: SeBackupPrivilege	2988	powershell.exe
Token: SeRestorePrivilege	2988	powershell.exe
Token: SeShutdownPrivilege	2988	powershell.exe
Token: SeDebugPrivilege	2988	powershell.exe
Token: SeSystemEnvironmentPrivilege	2988	powershell.exe
Token: SeRemoteShutdownPrivilege	2988	powershell.exe
Token: SeUndockPrivilege	2988	powershell.exe
Token: SeManageVolumePrivilege	2988	powershell.exe
Token: 33	2988	powershell.exe
Token: 34	2988	powershell.exe
Token: 35	2988	powershell.exe
Token: 36	2988	powershell.exe
Token: SeDebugPrivilege	5236	powershell.exe
Token: SeIncreaseQuotaPrivilege	5236	powershell.exe
Token: SeSecurityPrivilege	5236	powershell.exe
Token: SeTakeOwnershipPrivilege	5236	powershell.exe
Token: SeLoadDriverPrivilege	5236	powershell.exe
Token: SeSystemProfilePrivilege	5236	powershell.exe
Token: SeSystemtimePrivilege	5236	powershell.exe
Token: SeProfSingleProcessPrivilege	5236	powershell.exe
Token: SeIncBasePriorityPrivilege	5236	powershell.exe
Token: SeCreatePagefilePrivilege	5236	powershell.exe
Token: SeBackupPrivilege	5236	powershell.exe
Token: SeRestorePrivilege	5236	powershell.exe
Token: SeShutdownPrivilege	5236	powershell.exe
Token: SeDebugPrivilege	5236	powershell.exe
Token: SeSystemEnvironmentPrivilege	5236	powershell.exe
Token: SeRemoteShutdownPrivilege	5236	powershell.exe
Token: SeUndockPrivilege	5236	powershell.exe
Token: SeManageVolumePrivilege	5236	powershell.exe
Token: 33	5236	powershell.exe
Token: 34	5236	powershell.exe
Token: 35	5236	powershell.exe
Token: 36	5236	powershell.exe
Token: SeDebugPrivilege	4380	powershell.exe
Token: SeIncreaseQuotaPrivilege	4380	powershell.exe
Token: SeSecurityPrivilege	4380	powershell.exe
Token: SeTakeOwnershipPrivilege	4380	powershell.exe
Token: SeLoadDriverPrivilege	4380	powershell.exe
Token: SeSystemProfilePrivilege	4380	powershell.exe
Token: SeSystemtimePrivilege	4380	powershell.exe
Token: SeProfSingleProcessPrivilege	4380	powershell.exe
Token: SeIncBasePriorityPrivilege	4380	powershell.exe
Token: SeCreatePagefilePrivilege	4380	powershell.exe
Token: SeBackupPrivilege	4380	powershell.exe
Token: SeRestorePrivilege	4380	powershell.exe
Token: SeShutdownPrivilege	4380	powershell.exe
Token: SeDebugPrivilege	4380	powershell.exe
Token: SeSystemEnvironmentPrivilege	4380	powershell.exe
Token: SeRemoteShutdownPrivilege	4380	powershell.exe
Token: SeUndockPrivilege	4380	powershell.exe
Token: SeManageVolumePrivilege	4380	powershell.exe
Token: 33	4380	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 5892 wrote to memory of 4640	5892	default.dat.exe	87
PID 4640 wrote to memory of 5756	4640	default.dat.exe	88
PID 5756 wrote to memory of 2988	5756	cmd.exe	90
PID 4640 wrote to memory of 2852	4640	default.dat.exe	92
PID 2852 wrote to memory of 5236	2852	cmd.exe	94
PID 4640 wrote to memory of 3748	4640	default.dat.exe	95
PID 3748 wrote to memory of 4380	3748	cmd.exe	97
PID 4640 wrote to memory of 1676	4640	default.dat.exe	98
PID 1676 wrote to memory of 5224	1676	cmd.exe	100
PID 4640 wrote to memory of 4744	4640	default.dat.exe	101
PID 4744 wrote to memory of 1116	4744	cmd.exe	103
PID 4640 wrote to memory of 2040	4640	default.dat.exe	104
PID 2040 wrote to memory of 6032	2040	cmd.exe	106
PID 4640 wrote to memory of 1144	4640	default.dat.exe	107
PID 1144 wrote to memory of 2384	1144	cmd.exe	109
PID 4640 wrote to memory of 5304	4640	default.dat.exe	110
PID 5304 wrote to memory of 2264	5304	cmd.exe	112
PID 4640 wrote to memory of 3420	4640	default.dat.exe	113
PID 3420 wrote to memory of 3536	3420	cmd.exe	115
PID 4640 wrote to memory of 628	4640	default.dat.exe	116
PID 628 wrote to memory of 4232	628	cmd.exe	118
PID 4640 wrote to memory of 4388	4640	default.dat.exe	119
PID 4388 wrote to memory of 1320	4388	cmd.exe	121
PID 4640 wrote to memory of 2348	4640	default.dat.exe	123
PID 2348 wrote to memory of 3976	2348	cmd.exe	125

C:\Users\Admin\AppData\Local\Temp\default.dat.exe
"C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5892
- C:\Users\Admin\AppData\Local\Temp\default.dat.exe
  "C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4640
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5756
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2988
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\huxepihi'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2852
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\huxepihi'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3748
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1676
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5224
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4744
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2040
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:6032
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1144
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2384
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5304
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2264
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3420
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3536
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:628
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4232
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4388
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1320
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2348
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact