77e74075645dd76bc4836bb5e8ffb6a6a1dbdfb520a5cd116b8e6848a6ec61ac

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 00:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
default.dat.exe
Size 13.7MB
Sample260718-a8d15aey6x
SHA256 77e74075645dd76bc4836bb5e8ffb6a6a1dbdfb520a5cd116b8e6848a6ec61ac
MD5 18ad51d34f7092e6c87930c40cde319a
SHA1 7086f9d1f0f080219b5048418b91a03a9349be51
SHA512 7d005b495b6323c49760e06f19ddcbe5f9e0f0d19bfdf0f9e84989f15e9754a9fd8a22d6519dac2954b52df826bbcc3da07f8410f7fbcf13d56a331e579194f6
SSDEEP 393216:09arm+y38sLWluhEncuv1ZPGTXMCHWUjXVcuI3/PGTAI:090xy3IlJc+ZPGTXMb8XiH/O7
TLSH
T191E6339869E039FDFA73907C9DE19892E129B82507B3C6CB176483A65E171D0CD3EB13
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3320	powershell.exe
4584	powershell.exe
6104	powershell.exe
4120	powershell.exe
2308	powershell.exe
4420	powershell.exe
4416	powershell.exe
1700	powershell.exe
5400	powershell.exe
5588	powershell.exe
3588	powershell.exe
1632	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
4940	default.dat.exe
4940	default.dat.exe
4940	default.dat.exe
4940	default.dat.exe
4940	default.dat.exe
4940	default.dat.exe
4940	default.dat.exe
4940	default.dat.exe
4940	default.dat.exe
4940	default.dat.exe
4940	default.dat.exe
4940	default.dat.exe
4940	default.dat.exe
4940	default.dat.exe
4940	default.dat.exe

Executes a command shell one-liner 1 TTPs 12 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2840	cmd.exe
4856	cmd.exe
2964	cmd.exe
2352	cmd.exe
2572	cmd.exe
4112	cmd.exe
1348	cmd.exe
3316	cmd.exe
992	cmd.exe
5048	cmd.exe
5808	cmd.exe
2868	cmd.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
4940	default.dat.exe
4940	default.dat.exe
4416	powershell.exe
4416	powershell.exe
1700	powershell.exe
1700	powershell.exe
1700	powershell.exe
6104	powershell.exe
6104	powershell.exe
6104	powershell.exe
5400	powershell.exe
5400	powershell.exe
5400	powershell.exe
5588	powershell.exe
5588	powershell.exe
5588	powershell.exe
3588	powershell.exe
3588	powershell.exe
1632	powershell.exe
1632	powershell.exe
4120	powershell.exe
4120	powershell.exe
2308	powershell.exe
2308	powershell.exe
4420	powershell.exe
4420	powershell.exe
3320	powershell.exe
3320	powershell.exe
4584	powershell.exe
4584	powershell.exe
4584	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4940	default.dat.exe
Token: SeDebugPrivilege	4416	powershell.exe
Token: SeIncreaseQuotaPrivilege	4416	powershell.exe
Token: SeSecurityPrivilege	4416	powershell.exe
Token: SeTakeOwnershipPrivilege	4416	powershell.exe
Token: SeLoadDriverPrivilege	4416	powershell.exe
Token: SeSystemProfilePrivilege	4416	powershell.exe
Token: SeSystemtimePrivilege	4416	powershell.exe
Token: SeProfSingleProcessPrivilege	4416	powershell.exe
Token: SeIncBasePriorityPrivilege	4416	powershell.exe
Token: SeCreatePagefilePrivilege	4416	powershell.exe
Token: SeBackupPrivilege	4416	powershell.exe
Token: SeRestorePrivilege	4416	powershell.exe
Token: SeShutdownPrivilege	4416	powershell.exe
Token: SeDebugPrivilege	4416	powershell.exe
Token: SeSystemEnvironmentPrivilege	4416	powershell.exe
Token: SeRemoteShutdownPrivilege	4416	powershell.exe
Token: SeUndockPrivilege	4416	powershell.exe
Token: SeManageVolumePrivilege	4416	powershell.exe
Token: 33	4416	powershell.exe
Token: 34	4416	powershell.exe
Token: 35	4416	powershell.exe
Token: 36	4416	powershell.exe
Token: SeDebugPrivilege	1700	powershell.exe
Token: SeIncreaseQuotaPrivilege	1700	powershell.exe
Token: SeSecurityPrivilege	1700	powershell.exe
Token: SeTakeOwnershipPrivilege	1700	powershell.exe
Token: SeLoadDriverPrivilege	1700	powershell.exe
Token: SeSystemProfilePrivilege	1700	powershell.exe
Token: SeSystemtimePrivilege	1700	powershell.exe
Token: SeProfSingleProcessPrivilege	1700	powershell.exe
Token: SeIncBasePriorityPrivilege	1700	powershell.exe
Token: SeCreatePagefilePrivilege	1700	powershell.exe
Token: SeBackupPrivilege	1700	powershell.exe
Token: SeRestorePrivilege	1700	powershell.exe
Token: SeShutdownPrivilege	1700	powershell.exe
Token: SeDebugPrivilege	1700	powershell.exe
Token: SeSystemEnvironmentPrivilege	1700	powershell.exe
Token: SeRemoteShutdownPrivilege	1700	powershell.exe
Token: SeUndockPrivilege	1700	powershell.exe
Token: SeManageVolumePrivilege	1700	powershell.exe
Token: 33	1700	powershell.exe
Token: 34	1700	powershell.exe
Token: 35	1700	powershell.exe
Token: 36	1700	powershell.exe
Token: SeDebugPrivilege	6104	powershell.exe
Token: SeIncreaseQuotaPrivilege	6104	powershell.exe
Token: SeSecurityPrivilege	6104	powershell.exe
Token: SeTakeOwnershipPrivilege	6104	powershell.exe
Token: SeLoadDriverPrivilege	6104	powershell.exe
Token: SeSystemProfilePrivilege	6104	powershell.exe
Token: SeSystemtimePrivilege	6104	powershell.exe
Token: SeProfSingleProcessPrivilege	6104	powershell.exe
Token: SeIncBasePriorityPrivilege	6104	powershell.exe
Token: SeCreatePagefilePrivilege	6104	powershell.exe
Token: SeBackupPrivilege	6104	powershell.exe
Token: SeRestorePrivilege	6104	powershell.exe
Token: SeShutdownPrivilege	6104	powershell.exe
Token: SeDebugPrivilege	6104	powershell.exe
Token: SeSystemEnvironmentPrivilege	6104	powershell.exe
Token: SeRemoteShutdownPrivilege	6104	powershell.exe
Token: SeUndockPrivilege	6104	powershell.exe
Token: SeManageVolumePrivilege	6104	powershell.exe
Token: 33	6104	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 6044 wrote to memory of 4940	6044	default.dat.exe	89
PID 4940 wrote to memory of 4112	4940	default.dat.exe	90
PID 4112 wrote to memory of 4416	4112	cmd.exe	92
PID 4940 wrote to memory of 1348	4940	default.dat.exe	94
PID 1348 wrote to memory of 1700	1348	cmd.exe	96
PID 4940 wrote to memory of 2840	4940	default.dat.exe	97
PID 2840 wrote to memory of 6104	2840	cmd.exe	99
PID 4940 wrote to memory of 3316	4940	default.dat.exe	100
PID 3316 wrote to memory of 5400	3316	cmd.exe	102
PID 4940 wrote to memory of 992	4940	default.dat.exe	103
PID 992 wrote to memory of 5588	992	cmd.exe	105
PID 4940 wrote to memory of 4856	4940	default.dat.exe	106
PID 4856 wrote to memory of 3588	4856	cmd.exe	108
PID 4940 wrote to memory of 5048	4940	default.dat.exe	109
PID 5048 wrote to memory of 1632	5048	cmd.exe	111
PID 4940 wrote to memory of 2964	4940	default.dat.exe	112
PID 2964 wrote to memory of 4120	2964	cmd.exe	114
PID 4940 wrote to memory of 2352	4940	default.dat.exe	115
PID 2352 wrote to memory of 2308	2352	cmd.exe	117
PID 4940 wrote to memory of 2572	4940	default.dat.exe	118
PID 2572 wrote to memory of 4420	2572	cmd.exe	120
PID 4940 wrote to memory of 5808	4940	default.dat.exe	121
PID 5808 wrote to memory of 3320	5808	cmd.exe	123
PID 4940 wrote to memory of 2868	4940	default.dat.exe	124
PID 2868 wrote to memory of 4584	2868	cmd.exe	126

C:\Users\Admin\AppData\Local\Temp\default.dat.exe
"C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:6044
- C:\Users\Admin\AppData\Local\Temp\default.dat.exe
  "C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4940
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4112
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4416
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\lohocada'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1348
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\lohocada'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1700
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2840
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:6104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3316
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5400
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:992
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5588
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4856
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3588
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5048
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1632
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2964
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4120
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2352
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2308
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2572
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5808
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3320
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2868
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4584

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact