a4c79a72a8aa38058a43b502d2a7faf04b8367f18875468f37d009c235a9249e

Analysis

max time kernel
149s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/07/2026, 15:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
default.dat.exe
Size 13.6MB
Sample260712-tbaf8aew2s
SHA256 a4c79a72a8aa38058a43b502d2a7faf04b8367f18875468f37d009c235a9249e
MD5 fb543254ed01bd259241edde0000157b
SHA1 c567472add370e797468c22b8b943bf61855853a
SHA512 931270692f2b6ba87539eb1c7260419e084e140a116f208d366a46f6a3ff9a2cd4f4db5fc85f00ca484caeaf423d227caa4ab24841dc48ceb86a1a49e91fff75
SSDEEP 393216:mvYg9FBFlBSkydKJ8qCXMCHWUjXycuI3/PGTAI:mvZ7zSkydKJ8qCXMb8XPH/O7
TLSH
T1DCE63309A5E042FEE6A3913CEDE296B8E570F4531B31CEDF07A48252AC972E1493D717
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1108	powershell.exe
728	powershell.exe
2752	powershell.exe
2052	powershell.exe
3352	powershell.exe
3604	powershell.exe
3796	powershell.exe
2348	powershell.exe
1872	powershell.exe
4704	powershell.exe
3828	powershell.exe
4652	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
4624	default.dat.exe
4624	default.dat.exe
4624	default.dat.exe
4624	default.dat.exe
4624	default.dat.exe
4624	default.dat.exe
4624	default.dat.exe
4624	default.dat.exe
4624	default.dat.exe
4624	default.dat.exe
4624	default.dat.exe
4624	default.dat.exe
4624	default.dat.exe
4624	default.dat.exe
4624	default.dat.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
4624	default.dat.exe
4624	default.dat.exe
3604	powershell.exe
3604	powershell.exe
3796	powershell.exe
3796	powershell.exe
2348	powershell.exe
2348	powershell.exe
1872	powershell.exe
1872	powershell.exe
4704	powershell.exe
4704	powershell.exe
1108	powershell.exe
1108	powershell.exe
728	powershell.exe
728	powershell.exe
2752	powershell.exe
2752	powershell.exe
2052	powershell.exe
2052	powershell.exe
3352	powershell.exe
3352	powershell.exe
3828	powershell.exe
3828	powershell.exe
4652	powershell.exe
4652	powershell.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	4624	default.dat.exe
Token: SeDebugPrivilege	3604	powershell.exe
Token: SeDebugPrivilege	3796	powershell.exe
Token: SeDebugPrivilege	2348	powershell.exe
Token: SeDebugPrivilege	1872	powershell.exe
Token: SeDebugPrivilege	4704	powershell.exe
Token: SeDebugPrivilege	1108	powershell.exe
Token: SeDebugPrivilege	728	powershell.exe
Token: SeDebugPrivilege	2752	powershell.exe
Token: SeDebugPrivilege	2052	powershell.exe
Token: SeDebugPrivilege	3352	powershell.exe
Token: SeDebugPrivilege	3828	powershell.exe
Token: SeDebugPrivilege	4652	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 3724 wrote to memory of 4624	3724	default.dat.exe	84
PID 4624 wrote to memory of 2324	4624	default.dat.exe	86
PID 2324 wrote to memory of 3604	2324	cmd.exe	88
PID 4624 wrote to memory of 4148	4624	default.dat.exe	89
PID 4148 wrote to memory of 3796	4148	cmd.exe	91
PID 4624 wrote to memory of 3544	4624	default.dat.exe	92
PID 3544 wrote to memory of 2348	3544	cmd.exe	94
PID 4624 wrote to memory of 1856	4624	default.dat.exe	95
PID 1856 wrote to memory of 1872	1856	cmd.exe	97
PID 4624 wrote to memory of 4432	4624	default.dat.exe	98
PID 4432 wrote to memory of 4704	4432	cmd.exe	100
PID 4624 wrote to memory of 1224	4624	default.dat.exe	101
PID 1224 wrote to memory of 1108	1224	cmd.exe	103
PID 4624 wrote to memory of 2124	4624	default.dat.exe	104
PID 2124 wrote to memory of 728	2124	cmd.exe	106
PID 4624 wrote to memory of 4844	4624	default.dat.exe	107
PID 4844 wrote to memory of 2752	4844	cmd.exe	109
PID 4624 wrote to memory of 3788	4624	default.dat.exe	110
PID 3788 wrote to memory of 2052	3788	cmd.exe	112
PID 4624 wrote to memory of 756	4624	default.dat.exe	113
PID 756 wrote to memory of 3352	756	cmd.exe	115
PID 4624 wrote to memory of 4748	4624	default.dat.exe	116
PID 4748 wrote to memory of 3828	4748	cmd.exe	118
PID 4624 wrote to memory of 4176	4624	default.dat.exe	119
PID 4176 wrote to memory of 4652	4176	cmd.exe	121

C:\Users\Admin\AppData\Local\Temp\default.dat.exe
"C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3724
- C:\Users\Admin\AppData\Local\Temp\default.dat.exe
  "C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2324
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3604
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\dovuyoja'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4148
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\dovuyoja'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3796
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3544
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2348
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1856
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1872
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4432
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4704
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1224
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1108
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2124
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:728
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4844
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2752
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3788
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2052
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:756
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3352
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4748
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3828
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4176
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4652

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...