fe33733d353438f4edcf5baf73b602a3a668cc5a948e4a685b13d5d4bfc16b12

Analysis

max time kernel
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 02:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
default.dat.exe
Size 13.7MB
Sample260714-dc1rsscy6m
SHA256 fe33733d353438f4edcf5baf73b602a3a668cc5a948e4a685b13d5d4bfc16b12
MD5 e097be87d39d5673afd233fbb535d768
SHA1 4920e8b0a9e9975aa3f032dc234937b053738114
SHA512 b8270b6584087283ef62dd6459cd0eaa2a0688ef37ae8ef5b2febce61bd3fb6db2e1d04e6e978a12c3a6974ed81e9904cbc0a19c89b7d1b2724adb69aa1404c5
SSDEEP 393216:GgtTYVvhwkt1E7PnFgaLmohSkZm9XMCHWUjXicuI3/PGTAI:GgiVv7t1YPnJKoG9XMb8XfH/O7
TLSH
T1D9E63359A9E000FFC8B3847DE9E15695E5B1B4BA47B2C9CB5A34C2763D032E1493A733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3276	powershell.exe
3476	powershell.exe
3368	powershell.exe
4280	powershell.exe
1948	powershell.exe
4816	powershell.exe
1484	powershell.exe
5604	powershell.exe
1132	powershell.exe
2900	powershell.exe
6072	powershell.exe
4596	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
3416	default.dat.exe
3416	default.dat.exe
3416	default.dat.exe
3416	default.dat.exe
3416	default.dat.exe
3416	default.dat.exe
3416	default.dat.exe
3416	default.dat.exe
3416	default.dat.exe
3416	default.dat.exe
3416	default.dat.exe
3416	default.dat.exe
3416	default.dat.exe
3416	default.dat.exe
3416	default.dat.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
3416	default.dat.exe
3416	default.dat.exe
1484	powershell.exe
1484	powershell.exe
5604	powershell.exe
5604	powershell.exe
3276	powershell.exe
3276	powershell.exe
3476	powershell.exe
3476	powershell.exe
1132	powershell.exe
1132	powershell.exe
3368	powershell.exe
3368	powershell.exe
2900	powershell.exe
2900	powershell.exe
4280	powershell.exe
4280	powershell.exe
1948	powershell.exe
1948	powershell.exe
6072	powershell.exe
6072	powershell.exe
4816	powershell.exe
4816	powershell.exe
4596	powershell.exe
4596	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3416	default.dat.exe
Token: SeDebugPrivilege	1484	powershell.exe
Token: SeIncreaseQuotaPrivilege	1484	powershell.exe
Token: SeSecurityPrivilege	1484	powershell.exe
Token: SeTakeOwnershipPrivilege	1484	powershell.exe
Token: SeLoadDriverPrivilege	1484	powershell.exe
Token: SeSystemProfilePrivilege	1484	powershell.exe
Token: SeSystemtimePrivilege	1484	powershell.exe
Token: SeProfSingleProcessPrivilege	1484	powershell.exe
Token: SeIncBasePriorityPrivilege	1484	powershell.exe
Token: SeCreatePagefilePrivilege	1484	powershell.exe
Token: SeBackupPrivilege	1484	powershell.exe
Token: SeRestorePrivilege	1484	powershell.exe
Token: SeShutdownPrivilege	1484	powershell.exe
Token: SeDebugPrivilege	1484	powershell.exe
Token: SeSystemEnvironmentPrivilege	1484	powershell.exe
Token: SeRemoteShutdownPrivilege	1484	powershell.exe
Token: SeUndockPrivilege	1484	powershell.exe
Token: SeManageVolumePrivilege	1484	powershell.exe
Token: 33	1484	powershell.exe
Token: 34	1484	powershell.exe
Token: 35	1484	powershell.exe
Token: 36	1484	powershell.exe
Token: SeDebugPrivilege	5604	powershell.exe
Token: SeIncreaseQuotaPrivilege	5604	powershell.exe
Token: SeSecurityPrivilege	5604	powershell.exe
Token: SeTakeOwnershipPrivilege	5604	powershell.exe
Token: SeLoadDriverPrivilege	5604	powershell.exe
Token: SeSystemProfilePrivilege	5604	powershell.exe
Token: SeSystemtimePrivilege	5604	powershell.exe
Token: SeProfSingleProcessPrivilege	5604	powershell.exe
Token: SeIncBasePriorityPrivilege	5604	powershell.exe
Token: SeCreatePagefilePrivilege	5604	powershell.exe
Token: SeBackupPrivilege	5604	powershell.exe
Token: SeRestorePrivilege	5604	powershell.exe
Token: SeShutdownPrivilege	5604	powershell.exe
Token: SeDebugPrivilege	5604	powershell.exe
Token: SeSystemEnvironmentPrivilege	5604	powershell.exe
Token: SeRemoteShutdownPrivilege	5604	powershell.exe
Token: SeUndockPrivilege	5604	powershell.exe
Token: SeManageVolumePrivilege	5604	powershell.exe
Token: 33	5604	powershell.exe
Token: 34	5604	powershell.exe
Token: 35	5604	powershell.exe
Token: 36	5604	powershell.exe
Token: SeDebugPrivilege	3276	powershell.exe
Token: SeIncreaseQuotaPrivilege	3276	powershell.exe
Token: SeSecurityPrivilege	3276	powershell.exe
Token: SeTakeOwnershipPrivilege	3276	powershell.exe
Token: SeLoadDriverPrivilege	3276	powershell.exe
Token: SeSystemProfilePrivilege	3276	powershell.exe
Token: SeSystemtimePrivilege	3276	powershell.exe
Token: SeProfSingleProcessPrivilege	3276	powershell.exe
Token: SeIncBasePriorityPrivilege	3276	powershell.exe
Token: SeCreatePagefilePrivilege	3276	powershell.exe
Token: SeBackupPrivilege	3276	powershell.exe
Token: SeRestorePrivilege	3276	powershell.exe
Token: SeShutdownPrivilege	3276	powershell.exe
Token: SeDebugPrivilege	3276	powershell.exe
Token: SeSystemEnvironmentPrivilege	3276	powershell.exe
Token: SeRemoteShutdownPrivilege	3276	powershell.exe
Token: SeUndockPrivilege	3276	powershell.exe
Token: SeManageVolumePrivilege	3276	powershell.exe
Token: 33	3276	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2844 wrote to memory of 3416	2844	default.dat.exe	87
PID 3416 wrote to memory of 5660	3416	default.dat.exe	88
PID 5660 wrote to memory of 1484	5660	cmd.exe	90
PID 3416 wrote to memory of 2228	3416	default.dat.exe	92
PID 2228 wrote to memory of 5604	2228	cmd.exe	94
PID 3416 wrote to memory of 3304	3416	default.dat.exe	95
PID 3304 wrote to memory of 3276	3304	cmd.exe	97
PID 3416 wrote to memory of 2400	3416	default.dat.exe	98
PID 2400 wrote to memory of 3476	2400	cmd.exe	100
PID 3416 wrote to memory of 2820	3416	default.dat.exe	101
PID 2820 wrote to memory of 1132	2820	cmd.exe	103
PID 3416 wrote to memory of 5488	3416	default.dat.exe	104
PID 5488 wrote to memory of 3368	5488	cmd.exe	106
PID 3416 wrote to memory of 4692	3416	default.dat.exe	107
PID 4692 wrote to memory of 2900	4692	cmd.exe	109
PID 3416 wrote to memory of 3036	3416	default.dat.exe	110
PID 3036 wrote to memory of 4280	3036	cmd.exe	112
PID 3416 wrote to memory of 5372	3416	default.dat.exe	113
PID 5372 wrote to memory of 1948	5372	cmd.exe	115
PID 3416 wrote to memory of 1704	3416	default.dat.exe	116
PID 1704 wrote to memory of 6072	1704	cmd.exe	118
PID 3416 wrote to memory of 4060	3416	default.dat.exe	119
PID 4060 wrote to memory of 4816	4060	cmd.exe	121
PID 3416 wrote to memory of 852	3416	default.dat.exe	122
PID 852 wrote to memory of 4596	852	cmd.exe	124

C:\Users\Admin\AppData\Local\Temp\default.dat.exe
"C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Users\Admin\AppData\Local\Temp\default.dat.exe
  "C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3416
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5660
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1484
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\vikofiqi'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2228
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\vikofiqi'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5604
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3304
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3276
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2400
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3476
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2820
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1132
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5488
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3368
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4692
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2900
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3036
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4280
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5372
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1948
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1704
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:6072
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4060
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4816
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:852
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4596

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact