4c4d7bf04f5c8b9be321db745fd616f9b429bc409e6ee03445fc5278cedee6e0

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 03:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
default.dat.exe
Size 13.6MB
Sample260715-efcd2sa16k
SHA256 4c4d7bf04f5c8b9be321db745fd616f9b429bc409e6ee03445fc5278cedee6e0
MD5 0fac677d69e190133243b02a2454b3b8
SHA1 86a3adaa9a7efb6e77af0724c3d3176f38f6e4d2
SHA512 4879287396472f7ad4559bf44ce25cb92915e4164ed08b568d7307dfe1f5a210907abbdde10e7cf371cc95a7570f696e1e958331e24a69f997ef3bf0e90d1daf
SSDEEP 393216:7o2Wj6MUYYF52+c0nQIjE6ENcXXMCHWUjXhcuI3/PGTAI:7oHZPYF5B1xjbEmXXMb8X2H/O7
TLSH
T131E633483AD016BBEAE7C038EDE1692AE56674A94B30C5CB427CC7E56D571E0CE3D213
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3848	powershell.exe
4668	powershell.exe
2228	powershell.exe
624	powershell.exe
5124	powershell.exe
4188	powershell.exe
3924	powershell.exe
4968	powershell.exe
4272	powershell.exe
1320	powershell.exe
5228	powershell.exe
5720	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
2604	default.dat.exe
2604	default.dat.exe
2604	default.dat.exe
2604	default.dat.exe
2604	default.dat.exe
2604	default.dat.exe
2604	default.dat.exe
2604	default.dat.exe
2604	default.dat.exe
2604	default.dat.exe
2604	default.dat.exe
2604	default.dat.exe
2604	default.dat.exe
2604	default.dat.exe
2604	default.dat.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
2604	default.dat.exe
2604	default.dat.exe
4668	powershell.exe
4668	powershell.exe
2228	powershell.exe
2228	powershell.exe
624	powershell.exe
624	powershell.exe
5124	powershell.exe
5124	powershell.exe
1320	powershell.exe
1320	powershell.exe
5228	powershell.exe
5228	powershell.exe
4188	powershell.exe
4188	powershell.exe
3924	powershell.exe
3924	powershell.exe
5720	powershell.exe
5720	powershell.exe
4968	powershell.exe
4968	powershell.exe
4272	powershell.exe
4272	powershell.exe
3848	powershell.exe
3848	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2604	default.dat.exe
Token: SeDebugPrivilege	4668	powershell.exe
Token: SeIncreaseQuotaPrivilege	4668	powershell.exe
Token: SeSecurityPrivilege	4668	powershell.exe
Token: SeTakeOwnershipPrivilege	4668	powershell.exe
Token: SeLoadDriverPrivilege	4668	powershell.exe
Token: SeSystemProfilePrivilege	4668	powershell.exe
Token: SeSystemtimePrivilege	4668	powershell.exe
Token: SeProfSingleProcessPrivilege	4668	powershell.exe
Token: SeIncBasePriorityPrivilege	4668	powershell.exe
Token: SeCreatePagefilePrivilege	4668	powershell.exe
Token: SeBackupPrivilege	4668	powershell.exe
Token: SeRestorePrivilege	4668	powershell.exe
Token: SeShutdownPrivilege	4668	powershell.exe
Token: SeDebugPrivilege	4668	powershell.exe
Token: SeSystemEnvironmentPrivilege	4668	powershell.exe
Token: SeRemoteShutdownPrivilege	4668	powershell.exe
Token: SeUndockPrivilege	4668	powershell.exe
Token: SeManageVolumePrivilege	4668	powershell.exe
Token: 33	4668	powershell.exe
Token: 34	4668	powershell.exe
Token: 35	4668	powershell.exe
Token: 36	4668	powershell.exe
Token: SeDebugPrivilege	2228	powershell.exe
Token: SeIncreaseQuotaPrivilege	2228	powershell.exe
Token: SeSecurityPrivilege	2228	powershell.exe
Token: SeTakeOwnershipPrivilege	2228	powershell.exe
Token: SeLoadDriverPrivilege	2228	powershell.exe
Token: SeSystemProfilePrivilege	2228	powershell.exe
Token: SeSystemtimePrivilege	2228	powershell.exe
Token: SeProfSingleProcessPrivilege	2228	powershell.exe
Token: SeIncBasePriorityPrivilege	2228	powershell.exe
Token: SeCreatePagefilePrivilege	2228	powershell.exe
Token: SeBackupPrivilege	2228	powershell.exe
Token: SeRestorePrivilege	2228	powershell.exe
Token: SeShutdownPrivilege	2228	powershell.exe
Token: SeDebugPrivilege	2228	powershell.exe
Token: SeSystemEnvironmentPrivilege	2228	powershell.exe
Token: SeRemoteShutdownPrivilege	2228	powershell.exe
Token: SeUndockPrivilege	2228	powershell.exe
Token: SeManageVolumePrivilege	2228	powershell.exe
Token: 33	2228	powershell.exe
Token: 34	2228	powershell.exe
Token: 35	2228	powershell.exe
Token: 36	2228	powershell.exe
Token: SeDebugPrivilege	624	powershell.exe
Token: SeIncreaseQuotaPrivilege	624	powershell.exe
Token: SeSecurityPrivilege	624	powershell.exe
Token: SeTakeOwnershipPrivilege	624	powershell.exe
Token: SeLoadDriverPrivilege	624	powershell.exe
Token: SeSystemProfilePrivilege	624	powershell.exe
Token: SeSystemtimePrivilege	624	powershell.exe
Token: SeProfSingleProcessPrivilege	624	powershell.exe
Token: SeIncBasePriorityPrivilege	624	powershell.exe
Token: SeCreatePagefilePrivilege	624	powershell.exe
Token: SeBackupPrivilege	624	powershell.exe
Token: SeRestorePrivilege	624	powershell.exe
Token: SeShutdownPrivilege	624	powershell.exe
Token: SeDebugPrivilege	624	powershell.exe
Token: SeSystemEnvironmentPrivilege	624	powershell.exe
Token: SeRemoteShutdownPrivilege	624	powershell.exe
Token: SeUndockPrivilege	624	powershell.exe
Token: SeManageVolumePrivilege	624	powershell.exe
Token: 33	624	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2620 wrote to memory of 2604	2620	default.dat.exe	88
PID 2604 wrote to memory of 5632	2604	default.dat.exe	89
PID 5632 wrote to memory of 4668	5632	cmd.exe	91
PID 2604 wrote to memory of 3524	2604	default.dat.exe	93
PID 3524 wrote to memory of 2228	3524	cmd.exe	95
PID 2604 wrote to memory of 1976	2604	default.dat.exe	96
PID 1976 wrote to memory of 624	1976	cmd.exe	98
PID 2604 wrote to memory of 1908	2604	default.dat.exe	99
PID 1908 wrote to memory of 5124	1908	cmd.exe	101
PID 2604 wrote to memory of 2916	2604	default.dat.exe	102
PID 2916 wrote to memory of 1320	2916	cmd.exe	104
PID 2604 wrote to memory of 5368	2604	default.dat.exe	105
PID 5368 wrote to memory of 5228	5368	cmd.exe	107
PID 2604 wrote to memory of 3220	2604	default.dat.exe	108
PID 3220 wrote to memory of 4188	3220	cmd.exe	110
PID 2604 wrote to memory of 5132	2604	default.dat.exe	111
PID 5132 wrote to memory of 3924	5132	cmd.exe	113
PID 2604 wrote to memory of 4592	2604	default.dat.exe	114
PID 4592 wrote to memory of 5720	4592	cmd.exe	116
PID 2604 wrote to memory of 2576	2604	default.dat.exe	117
PID 2576 wrote to memory of 4968	2576	cmd.exe	119
PID 2604 wrote to memory of 6004	2604	default.dat.exe	120
PID 6004 wrote to memory of 4272	6004	cmd.exe	122
PID 2604 wrote to memory of 3672	2604	default.dat.exe	123
PID 3672 wrote to memory of 3848	3672	cmd.exe	125

C:\Users\Admin\AppData\Local\Temp\default.dat.exe
"C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2620
- C:\Users\Admin\AppData\Local\Temp\default.dat.exe
  "C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2604
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5632
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4668
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\rikarajo'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3524
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\rikarajo'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2228
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1976
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1908
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2916
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1320
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5368
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5228
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3220
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4188
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5132
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3924
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4592
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5720
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2576
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4968
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6004
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4272
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3672
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3848

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact