3ef32ae4171c7a2da4aab0c7bdc9a31581e9e49365b96ea951f6c06625e0b7d7

Analysis

max time kernel
149s
max time network
139s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 02:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
default.dat.exe
Size 13.6MB
Sample260718-dc6m2shv61
SHA256 3ef32ae4171c7a2da4aab0c7bdc9a31581e9e49365b96ea951f6c06625e0b7d7
MD5 b2fc6693306b7808fe77a22113cd238f
SHA1 6506f5da77f44587fc9a9779b7c9233194b15b14
SHA512 524d839f2b4607741a18aa0282738d0d348f8625ebc7722bdd53ba8731bb96ca8849288b98453843b4b3fc540af9c20b2071ee1920578801f97314b809a31a85
SSDEEP 393216:csRlR402DOKDaCz+rB/KkSxY1XMCHWUjXXcuI3/PGTAI:csjqDcKkm6XMb8XsH/O7
TLSH
T1DEE6334C99F005EDEBB7903CEDE055A2D46874664B72C68F9BA483F02D271D04E3DE6A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1648	powershell.exe
2356	powershell.exe
6576	powershell.exe
1584	powershell.exe
5180	powershell.exe
7116	powershell.exe
3384	powershell.exe
5028	powershell.exe
1868	powershell.exe
5084	powershell.exe
6736	powershell.exe
2528	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
3844	default.dat.exe
3844	default.dat.exe
3844	default.dat.exe
3844	default.dat.exe
3844	default.dat.exe
3844	default.dat.exe
3844	default.dat.exe
3844	default.dat.exe
3844	default.dat.exe
3844	default.dat.exe
3844	default.dat.exe
3844	default.dat.exe
3844	default.dat.exe
3844	default.dat.exe
3844	default.dat.exe

Executes a command shell one-liner 1 TTPs 12 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4144	cmd.exe
1724	cmd.exe
1176	cmd.exe
1900	cmd.exe
6112	cmd.exe
2992	cmd.exe
5964	cmd.exe
4364	cmd.exe
260	cmd.exe
4864	cmd.exe
4160	cmd.exe
1160	cmd.exe

Suspicious behavior: EnumeratesProcesses 38 IoCs

pid	Process
3844	default.dat.exe
3844	default.dat.exe
6736	powershell.exe
6736	powershell.exe
6736	powershell.exe
1584	powershell.exe
1584	powershell.exe
1584	powershell.exe
5180	powershell.exe
5180	powershell.exe
5180	powershell.exe
2528	powershell.exe
2528	powershell.exe
2528	powershell.exe
1648	powershell.exe
1648	powershell.exe
1648	powershell.exe
7116	powershell.exe
7116	powershell.exe
7116	powershell.exe
3384	powershell.exe
3384	powershell.exe
3384	powershell.exe
2356	powershell.exe
2356	powershell.exe
2356	powershell.exe
5028	powershell.exe
5028	powershell.exe
5028	powershell.exe
6576	powershell.exe
6576	powershell.exe
6576	powershell.exe
1868	powershell.exe
1868	powershell.exe
1868	powershell.exe
5084	powershell.exe
5084	powershell.exe
5084	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3844	default.dat.exe
Token: SeDebugPrivilege	6736	powershell.exe
Token: SeIncreaseQuotaPrivilege	6736	powershell.exe
Token: SeSecurityPrivilege	6736	powershell.exe
Token: SeTakeOwnershipPrivilege	6736	powershell.exe
Token: SeLoadDriverPrivilege	6736	powershell.exe
Token: SeSystemProfilePrivilege	6736	powershell.exe
Token: SeSystemtimePrivilege	6736	powershell.exe
Token: SeProfSingleProcessPrivilege	6736	powershell.exe
Token: SeIncBasePriorityPrivilege	6736	powershell.exe
Token: SeCreatePagefilePrivilege	6736	powershell.exe
Token: SeBackupPrivilege	6736	powershell.exe
Token: SeRestorePrivilege	6736	powershell.exe
Token: SeShutdownPrivilege	6736	powershell.exe
Token: SeDebugPrivilege	6736	powershell.exe
Token: SeSystemEnvironmentPrivilege	6736	powershell.exe
Token: SeRemoteShutdownPrivilege	6736	powershell.exe
Token: SeUndockPrivilege	6736	powershell.exe
Token: SeManageVolumePrivilege	6736	powershell.exe
Token: 33	6736	powershell.exe
Token: 34	6736	powershell.exe
Token: 35	6736	powershell.exe
Token: 36	6736	powershell.exe
Token: SeDebugPrivilege	1584	powershell.exe
Token: SeIncreaseQuotaPrivilege	1584	powershell.exe
Token: SeSecurityPrivilege	1584	powershell.exe
Token: SeTakeOwnershipPrivilege	1584	powershell.exe
Token: SeLoadDriverPrivilege	1584	powershell.exe
Token: SeSystemProfilePrivilege	1584	powershell.exe
Token: SeSystemtimePrivilege	1584	powershell.exe
Token: SeProfSingleProcessPrivilege	1584	powershell.exe
Token: SeIncBasePriorityPrivilege	1584	powershell.exe
Token: SeCreatePagefilePrivilege	1584	powershell.exe
Token: SeBackupPrivilege	1584	powershell.exe
Token: SeRestorePrivilege	1584	powershell.exe
Token: SeShutdownPrivilege	1584	powershell.exe
Token: SeDebugPrivilege	1584	powershell.exe
Token: SeSystemEnvironmentPrivilege	1584	powershell.exe
Token: SeRemoteShutdownPrivilege	1584	powershell.exe
Token: SeUndockPrivilege	1584	powershell.exe
Token: SeManageVolumePrivilege	1584	powershell.exe
Token: 33	1584	powershell.exe
Token: 34	1584	powershell.exe
Token: 35	1584	powershell.exe
Token: 36	1584	powershell.exe
Token: SeDebugPrivilege	5180	powershell.exe
Token: SeIncreaseQuotaPrivilege	5180	powershell.exe
Token: SeSecurityPrivilege	5180	powershell.exe
Token: SeTakeOwnershipPrivilege	5180	powershell.exe
Token: SeLoadDriverPrivilege	5180	powershell.exe
Token: SeSystemProfilePrivilege	5180	powershell.exe
Token: SeSystemtimePrivilege	5180	powershell.exe
Token: SeProfSingleProcessPrivilege	5180	powershell.exe
Token: SeIncBasePriorityPrivilege	5180	powershell.exe
Token: SeCreatePagefilePrivilege	5180	powershell.exe
Token: SeBackupPrivilege	5180	powershell.exe
Token: SeRestorePrivilege	5180	powershell.exe
Token: SeShutdownPrivilege	5180	powershell.exe
Token: SeDebugPrivilege	5180	powershell.exe
Token: SeSystemEnvironmentPrivilege	5180	powershell.exe
Token: SeRemoteShutdownPrivilege	5180	powershell.exe
Token: SeUndockPrivilege	5180	powershell.exe
Token: SeManageVolumePrivilege	5180	powershell.exe
Token: 33	5180	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 3348 wrote to memory of 3844	3348	default.dat.exe	90
PID 3844 wrote to memory of 4160	3844	default.dat.exe	91
PID 4160 wrote to memory of 6736	4160	cmd.exe	93
PID 3844 wrote to memory of 6112	3844	default.dat.exe	95
PID 6112 wrote to memory of 1584	6112	cmd.exe	97
PID 3844 wrote to memory of 2992	3844	default.dat.exe	98
PID 2992 wrote to memory of 5180	2992	cmd.exe	100
PID 3844 wrote to memory of 1160	3844	default.dat.exe	101
PID 1160 wrote to memory of 2528	1160	cmd.exe	103
PID 3844 wrote to memory of 5964	3844	default.dat.exe	104
PID 5964 wrote to memory of 1648	5964	cmd.exe	106
PID 3844 wrote to memory of 4144	3844	default.dat.exe	107
PID 4144 wrote to memory of 7116	4144	cmd.exe	109
PID 3844 wrote to memory of 4364	3844	default.dat.exe	110
PID 4364 wrote to memory of 3384	4364	cmd.exe	112
PID 3844 wrote to memory of 1724	3844	default.dat.exe	113
PID 1724 wrote to memory of 2356	1724	cmd.exe	115
PID 3844 wrote to memory of 1176	3844	default.dat.exe	116
PID 1176 wrote to memory of 5028	1176	cmd.exe	118
PID 3844 wrote to memory of 260	3844	default.dat.exe	119
PID 260 wrote to memory of 6576	260	cmd.exe	121
PID 3844 wrote to memory of 1900	3844	default.dat.exe	122
PID 1900 wrote to memory of 1868	1900	cmd.exe	124
PID 3844 wrote to memory of 4864	3844	default.dat.exe	125
PID 4864 wrote to memory of 5084	4864	cmd.exe	127

C:\Users\Admin\AppData\Local\Temp\default.dat.exe
"C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3348
- C:\Users\Admin\AppData\Local\Temp\default.dat.exe
  "C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3844
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4160
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:6736
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\lohocada'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6112
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\lohocada'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1584
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2992
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5180
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1160
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2528
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5964
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1648
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4144
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:7116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4364
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3384
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1724
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2356
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1176
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5028
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:260
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:6576
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1900
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1868
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4864
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5084

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact