173a31b134df06802874ab7c0073d8dfed090544dad98eea4cc35958fdc3ac18

Analysis

max time kernel
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/07/2026, 18:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
default.dat.exe
Size 13.6MB
Sample260712-wlx2dagy7w
SHA256 173a31b134df06802874ab7c0073d8dfed090544dad98eea4cc35958fdc3ac18
MD5 81f01c3bb6c0330bf6030771a96f4907
SHA1 2911e7f3b2cf6fe7566b77f02e217151ceb7c560
SHA512 fb2b769de3404cc38ec3da86077d1ccdd180aec7f097c2529fbd4dfd2082fe0aed32ca8d4e3ae314e154697fdbd35696c103c30d2d312a7236bed0b51905bf95
SSDEEP 393216:TgAPinLvKQwC3e80H5HvfvVXMCHWUjXBcuI3/PGTAI:TgAP6LvKg3evJvVXMb8XWH/O7
TLSH
T1D5E633045BF011FEE5B3513CEEA24261E1A4B4A25732C5DB1BA887E5BD431E20D7EB63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5720	powershell.exe
5860	powershell.exe
3412	powershell.exe
5172	powershell.exe
4576	powershell.exe
4252	powershell.exe
3404	powershell.exe
3012	powershell.exe
4832	powershell.exe
4964	powershell.exe
4056	powershell.exe
4400	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
932	default.dat.exe
932	default.dat.exe
932	default.dat.exe
932	default.dat.exe
932	default.dat.exe
932	default.dat.exe
932	default.dat.exe
932	default.dat.exe
932	default.dat.exe
932	default.dat.exe
932	default.dat.exe
932	default.dat.exe
932	default.dat.exe
932	default.dat.exe
932	default.dat.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
932	default.dat.exe
932	default.dat.exe
4964	powershell.exe
4964	powershell.exe
3412	powershell.exe
3412	powershell.exe
5172	powershell.exe
5172	powershell.exe
4576	powershell.exe
4576	powershell.exe
4056	powershell.exe
4056	powershell.exe
4252	powershell.exe
4252	powershell.exe
3404	powershell.exe
3404	powershell.exe
4400	powershell.exe
4400	powershell.exe
3012	powershell.exe
3012	powershell.exe
5720	powershell.exe
5720	powershell.exe
5860	powershell.exe
5860	powershell.exe
4832	powershell.exe
4832	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	932	default.dat.exe
Token: SeDebugPrivilege	4964	powershell.exe
Token: SeIncreaseQuotaPrivilege	4964	powershell.exe
Token: SeSecurityPrivilege	4964	powershell.exe
Token: SeTakeOwnershipPrivilege	4964	powershell.exe
Token: SeLoadDriverPrivilege	4964	powershell.exe
Token: SeSystemProfilePrivilege	4964	powershell.exe
Token: SeSystemtimePrivilege	4964	powershell.exe
Token: SeProfSingleProcessPrivilege	4964	powershell.exe
Token: SeIncBasePriorityPrivilege	4964	powershell.exe
Token: SeCreatePagefilePrivilege	4964	powershell.exe
Token: SeBackupPrivilege	4964	powershell.exe
Token: SeRestorePrivilege	4964	powershell.exe
Token: SeShutdownPrivilege	4964	powershell.exe
Token: SeDebugPrivilege	4964	powershell.exe
Token: SeSystemEnvironmentPrivilege	4964	powershell.exe
Token: SeRemoteShutdownPrivilege	4964	powershell.exe
Token: SeUndockPrivilege	4964	powershell.exe
Token: SeManageVolumePrivilege	4964	powershell.exe
Token: 33	4964	powershell.exe
Token: 34	4964	powershell.exe
Token: 35	4964	powershell.exe
Token: 36	4964	powershell.exe
Token: SeDebugPrivilege	3412	powershell.exe
Token: SeIncreaseQuotaPrivilege	3412	powershell.exe
Token: SeSecurityPrivilege	3412	powershell.exe
Token: SeTakeOwnershipPrivilege	3412	powershell.exe
Token: SeLoadDriverPrivilege	3412	powershell.exe
Token: SeSystemProfilePrivilege	3412	powershell.exe
Token: SeSystemtimePrivilege	3412	powershell.exe
Token: SeProfSingleProcessPrivilege	3412	powershell.exe
Token: SeIncBasePriorityPrivilege	3412	powershell.exe
Token: SeCreatePagefilePrivilege	3412	powershell.exe
Token: SeBackupPrivilege	3412	powershell.exe
Token: SeRestorePrivilege	3412	powershell.exe
Token: SeShutdownPrivilege	3412	powershell.exe
Token: SeDebugPrivilege	3412	powershell.exe
Token: SeSystemEnvironmentPrivilege	3412	powershell.exe
Token: SeRemoteShutdownPrivilege	3412	powershell.exe
Token: SeUndockPrivilege	3412	powershell.exe
Token: SeManageVolumePrivilege	3412	powershell.exe
Token: 33	3412	powershell.exe
Token: 34	3412	powershell.exe
Token: 35	3412	powershell.exe
Token: 36	3412	powershell.exe
Token: SeDebugPrivilege	5172	powershell.exe
Token: SeIncreaseQuotaPrivilege	5172	powershell.exe
Token: SeSecurityPrivilege	5172	powershell.exe
Token: SeTakeOwnershipPrivilege	5172	powershell.exe
Token: SeLoadDriverPrivilege	5172	powershell.exe
Token: SeSystemProfilePrivilege	5172	powershell.exe
Token: SeSystemtimePrivilege	5172	powershell.exe
Token: SeProfSingleProcessPrivilege	5172	powershell.exe
Token: SeIncBasePriorityPrivilege	5172	powershell.exe
Token: SeCreatePagefilePrivilege	5172	powershell.exe
Token: SeBackupPrivilege	5172	powershell.exe
Token: SeRestorePrivilege	5172	powershell.exe
Token: SeShutdownPrivilege	5172	powershell.exe
Token: SeDebugPrivilege	5172	powershell.exe
Token: SeSystemEnvironmentPrivilege	5172	powershell.exe
Token: SeRemoteShutdownPrivilege	5172	powershell.exe
Token: SeUndockPrivilege	5172	powershell.exe
Token: SeManageVolumePrivilege	5172	powershell.exe
Token: 33	5172	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 840 wrote to memory of 932	840	default.dat.exe	87
PID 932 wrote to memory of 2860	932	default.dat.exe	88
PID 2860 wrote to memory of 4964	2860	cmd.exe	90
PID 932 wrote to memory of 2412	932	default.dat.exe	92
PID 2412 wrote to memory of 3412	2412	cmd.exe	94
PID 932 wrote to memory of 2032	932	default.dat.exe	95
PID 2032 wrote to memory of 5172	2032	cmd.exe	97
PID 932 wrote to memory of 4532	932	default.dat.exe	98
PID 4532 wrote to memory of 4576	4532	cmd.exe	100
PID 932 wrote to memory of 2444	932	default.dat.exe	101
PID 2444 wrote to memory of 4056	2444	cmd.exe	103
PID 932 wrote to memory of 1572	932	default.dat.exe	104
PID 1572 wrote to memory of 4252	1572	cmd.exe	106
PID 932 wrote to memory of 5408	932	default.dat.exe	107
PID 5408 wrote to memory of 3404	5408	cmd.exe	109
PID 932 wrote to memory of 2396	932	default.dat.exe	110
PID 2396 wrote to memory of 4400	2396	cmd.exe	112
PID 932 wrote to memory of 5580	932	default.dat.exe	113
PID 5580 wrote to memory of 3012	5580	cmd.exe	115
PID 932 wrote to memory of 4644	932	default.dat.exe	116
PID 4644 wrote to memory of 5720	4644	cmd.exe	118
PID 932 wrote to memory of 1824	932	default.dat.exe	119
PID 1824 wrote to memory of 5860	1824	cmd.exe	121
PID 932 wrote to memory of 1012	932	default.dat.exe	122
PID 1012 wrote to memory of 4832	1012	cmd.exe	124

C:\Users\Admin\AppData\Local\Temp\default.dat.exe
"C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:840
- C:\Users\Admin\AppData\Local\Temp\default.dat.exe
  "C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:932
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2860
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4964
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\dovuyoja'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2412
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\dovuyoja'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2032
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5172
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4532
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4576
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2444
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4056
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1572
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5408
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3404
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2396
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4400
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5580
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3012
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4644
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5720
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1824
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5860
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1012
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4832

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact