f85c795e38bd714fd320ce2888c6eb3d445723cd586c3db1411e443fb69edd7f

Analysis

max time kernel
150s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 01:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
default.dat.exe
Size 13.7MB
Sample260718-carknscv5p
SHA256 f85c795e38bd714fd320ce2888c6eb3d445723cd586c3db1411e443fb69edd7f
MD5 1e0e6fc873098ca705b15bf80ee22b64
SHA1 3bbe67845c033d712dd7b0f5c22a37e4d5ca390b
SHA512 fb136bedbc252c99cf531ff811c564f6ac8fdde38b8f4a9e13f565c9fd628da0def78ac273b9fddb27c058f1b76b337e2cad7c242d97b5ba8eceb9232eebc04e
SSDEEP 393216:6guLmmJA68r3dxLfqe1OKmXMCHWUjXlcuI3/PGTAI:6gO7A6+SXMb8XSH/O7
TLSH
T1F4E63358A2D002FFE6B34138FEE1E059D2A1B4B90B33C98F4B4887669D572F1493DA57
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1740	powershell.exe
1292	powershell.exe
2856	powershell.exe
5160	powershell.exe
2556	powershell.exe
2156	powershell.exe
2432	powershell.exe
2448	powershell.exe
716	powershell.exe
4368	powershell.exe
3456	powershell.exe
4440	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
1372	default.dat.exe
1372	default.dat.exe
1372	default.dat.exe
1372	default.dat.exe
1372	default.dat.exe
1372	default.dat.exe
1372	default.dat.exe
1372	default.dat.exe
1372	default.dat.exe
1372	default.dat.exe
1372	default.dat.exe
1372	default.dat.exe
1372	default.dat.exe
1372	default.dat.exe
1372	default.dat.exe

Executes a command shell one-liner 1 TTPs 12 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2440	cmd.exe
2132	cmd.exe
5164	cmd.exe
2672	cmd.exe
1676	cmd.exe
3812	cmd.exe
3808	cmd.exe
5228	cmd.exe
4784	cmd.exe
3768	cmd.exe
5284	cmd.exe
2020	cmd.exe

Suspicious behavior: EnumeratesProcesses 29 IoCs

pid	Process
1372	default.dat.exe
1372	default.dat.exe
1740	powershell.exe
1740	powershell.exe
716	powershell.exe
716	powershell.exe
716	powershell.exe
1292	powershell.exe
1292	powershell.exe
2856	powershell.exe
2856	powershell.exe
5160	powershell.exe
5160	powershell.exe
2556	powershell.exe
2556	powershell.exe
4368	powershell.exe
4368	powershell.exe
2156	powershell.exe
2156	powershell.exe
2156	powershell.exe
2432	powershell.exe
2432	powershell.exe
2432	powershell.exe
2448	powershell.exe
2448	powershell.exe
3456	powershell.exe
3456	powershell.exe
4440	powershell.exe
4440	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1372	default.dat.exe
Token: SeDebugPrivilege	1740	powershell.exe
Token: SeIncreaseQuotaPrivilege	1740	powershell.exe
Token: SeSecurityPrivilege	1740	powershell.exe
Token: SeTakeOwnershipPrivilege	1740	powershell.exe
Token: SeLoadDriverPrivilege	1740	powershell.exe
Token: SeSystemProfilePrivilege	1740	powershell.exe
Token: SeSystemtimePrivilege	1740	powershell.exe
Token: SeProfSingleProcessPrivilege	1740	powershell.exe
Token: SeIncBasePriorityPrivilege	1740	powershell.exe
Token: SeCreatePagefilePrivilege	1740	powershell.exe
Token: SeBackupPrivilege	1740	powershell.exe
Token: SeRestorePrivilege	1740	powershell.exe
Token: SeShutdownPrivilege	1740	powershell.exe
Token: SeDebugPrivilege	1740	powershell.exe
Token: SeSystemEnvironmentPrivilege	1740	powershell.exe
Token: SeRemoteShutdownPrivilege	1740	powershell.exe
Token: SeUndockPrivilege	1740	powershell.exe
Token: SeManageVolumePrivilege	1740	powershell.exe
Token: 33	1740	powershell.exe
Token: 34	1740	powershell.exe
Token: 35	1740	powershell.exe
Token: 36	1740	powershell.exe
Token: SeDebugPrivilege	716	powershell.exe
Token: SeIncreaseQuotaPrivilege	716	powershell.exe
Token: SeSecurityPrivilege	716	powershell.exe
Token: SeTakeOwnershipPrivilege	716	powershell.exe
Token: SeLoadDriverPrivilege	716	powershell.exe
Token: SeSystemProfilePrivilege	716	powershell.exe
Token: SeSystemtimePrivilege	716	powershell.exe
Token: SeProfSingleProcessPrivilege	716	powershell.exe
Token: SeIncBasePriorityPrivilege	716	powershell.exe
Token: SeCreatePagefilePrivilege	716	powershell.exe
Token: SeBackupPrivilege	716	powershell.exe
Token: SeRestorePrivilege	716	powershell.exe
Token: SeShutdownPrivilege	716	powershell.exe
Token: SeDebugPrivilege	716	powershell.exe
Token: SeSystemEnvironmentPrivilege	716	powershell.exe
Token: SeRemoteShutdownPrivilege	716	powershell.exe
Token: SeUndockPrivilege	716	powershell.exe
Token: SeManageVolumePrivilege	716	powershell.exe
Token: 33	716	powershell.exe
Token: 34	716	powershell.exe
Token: 35	716	powershell.exe
Token: 36	716	powershell.exe
Token: SeDebugPrivilege	1292	powershell.exe
Token: SeIncreaseQuotaPrivilege	1292	powershell.exe
Token: SeSecurityPrivilege	1292	powershell.exe
Token: SeTakeOwnershipPrivilege	1292	powershell.exe
Token: SeLoadDriverPrivilege	1292	powershell.exe
Token: SeSystemProfilePrivilege	1292	powershell.exe
Token: SeSystemtimePrivilege	1292	powershell.exe
Token: SeProfSingleProcessPrivilege	1292	powershell.exe
Token: SeIncBasePriorityPrivilege	1292	powershell.exe
Token: SeCreatePagefilePrivilege	1292	powershell.exe
Token: SeBackupPrivilege	1292	powershell.exe
Token: SeRestorePrivilege	1292	powershell.exe
Token: SeShutdownPrivilege	1292	powershell.exe
Token: SeDebugPrivilege	1292	powershell.exe
Token: SeSystemEnvironmentPrivilege	1292	powershell.exe
Token: SeRemoteShutdownPrivilege	1292	powershell.exe
Token: SeUndockPrivilege	1292	powershell.exe
Token: SeManageVolumePrivilege	1292	powershell.exe
Token: 33	1292	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 3860 wrote to memory of 1372	3860	default.dat.exe	89
PID 1372 wrote to memory of 4784	1372	default.dat.exe	90
PID 4784 wrote to memory of 1740	4784	cmd.exe	92
PID 1372 wrote to memory of 5164	1372	default.dat.exe	94
PID 5164 wrote to memory of 716	5164	cmd.exe	96
PID 1372 wrote to memory of 2672	1372	default.dat.exe	97
PID 2672 wrote to memory of 1292	2672	cmd.exe	99
PID 1372 wrote to memory of 3768	1372	default.dat.exe	100
PID 3768 wrote to memory of 2856	3768	cmd.exe	102
PID 1372 wrote to memory of 1676	1372	default.dat.exe	103
PID 1676 wrote to memory of 5160	1676	cmd.exe	105
PID 1372 wrote to memory of 5284	1372	default.dat.exe	106
PID 5284 wrote to memory of 2556	5284	cmd.exe	108
PID 1372 wrote to memory of 2020	1372	default.dat.exe	109
PID 2020 wrote to memory of 4368	2020	cmd.exe	111
PID 1372 wrote to memory of 2440	1372	default.dat.exe	112
PID 2440 wrote to memory of 2156	2440	cmd.exe	114
PID 1372 wrote to memory of 3812	1372	default.dat.exe	115
PID 3812 wrote to memory of 2432	3812	cmd.exe	118
PID 1372 wrote to memory of 3808	1372	default.dat.exe	119
PID 3808 wrote to memory of 2448	3808	cmd.exe	121
PID 1372 wrote to memory of 2132	1372	default.dat.exe	122
PID 2132 wrote to memory of 3456	2132	cmd.exe	124
PID 1372 wrote to memory of 5228	1372	default.dat.exe	125
PID 5228 wrote to memory of 4440	5228	cmd.exe	127

C:\Users\Admin\AppData\Local\Temp\default.dat.exe
"C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3860
- C:\Users\Admin\AppData\Local\Temp\default.dat.exe
  "C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1372
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4784
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\lohocada'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5164
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\lohocada'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:716
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2672
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1292
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3768
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2856
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1676
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5160
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5284
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2556
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2020
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4368
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2440
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2156
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3812
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2432
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3808
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2448
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2132
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3456
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5228
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4440

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact