ebe4b50a4ea0130f7fb9277eb113d6fb2668b6983c2be4477b163aa812b2b8a4

Analysis

max time kernel
149s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 10:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
default.dat.exe
Size 13.7MB
Sample260718-mzacsscs9x
SHA256 ebe4b50a4ea0130f7fb9277eb113d6fb2668b6983c2be4477b163aa812b2b8a4
MD5 7e663e83718d8b65b26acad0ecbd4847
SHA1 3d593f6652667ae0937adb7b0b2abece2705ba8a
SHA512 f948c35d8b670dde9a2210b5c75dedb5202651e85a265faeaf31fe6a3bbc8e292df7d644ee78b0f288e4ab0297941fb352cf01da498e18d2b29086101ced3846
SSDEEP 393216:/gUEVdx1uJJvQi+IIH/0iXMCHWUjXbcuI3/PGTAI:/7EVn1wGi+z/0iXMb8XYH/O7
TLSH
T148E63304AAD017FDE9B3047DEEE0466995A8BC765B32C4EF4B6D42E52E531E08C3C663
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
784	powershell.exe
4180	powershell.exe
3156	powershell.exe
1816	powershell.exe
5128	powershell.exe
5980	powershell.exe
2660	powershell.exe
5340	powershell.exe
3920	powershell.exe
4332	powershell.exe
2588	powershell.exe
4592	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
696	default.dat.exe
696	default.dat.exe
696	default.dat.exe
696	default.dat.exe
696	default.dat.exe
696	default.dat.exe
696	default.dat.exe
696	default.dat.exe
696	default.dat.exe
696	default.dat.exe
696	default.dat.exe
696	default.dat.exe
696	default.dat.exe
696	default.dat.exe
696	default.dat.exe

Executes a command shell one-liner 1 TTPs 12 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4860	cmd.exe
1984	cmd.exe
1392	cmd.exe
1472	cmd.exe
1068	cmd.exe
1456	cmd.exe
3600	cmd.exe
1912	cmd.exe
1308	cmd.exe
4460	cmd.exe
2012	cmd.exe
4696	cmd.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
696	default.dat.exe
696	default.dat.exe
784	powershell.exe
784	powershell.exe
4180	powershell.exe
4180	powershell.exe
4180	powershell.exe
3156	powershell.exe
3156	powershell.exe
3156	powershell.exe
1816	powershell.exe
1816	powershell.exe
1816	powershell.exe
3920	powershell.exe
3920	powershell.exe
3920	powershell.exe
5128	powershell.exe
5128	powershell.exe
5128	powershell.exe
5980	powershell.exe
5980	powershell.exe
5980	powershell.exe
2660	powershell.exe
2660	powershell.exe
2660	powershell.exe
5340	powershell.exe
5340	powershell.exe
5340	powershell.exe
4332	powershell.exe
4332	powershell.exe
4332	powershell.exe
2588	powershell.exe
2588	powershell.exe
2588	powershell.exe
4592	powershell.exe
4592	powershell.exe
4592	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	696	default.dat.exe
Token: SeDebugPrivilege	784	powershell.exe
Token: SeIncreaseQuotaPrivilege	784	powershell.exe
Token: SeSecurityPrivilege	784	powershell.exe
Token: SeTakeOwnershipPrivilege	784	powershell.exe
Token: SeLoadDriverPrivilege	784	powershell.exe
Token: SeSystemProfilePrivilege	784	powershell.exe
Token: SeSystemtimePrivilege	784	powershell.exe
Token: SeProfSingleProcessPrivilege	784	powershell.exe
Token: SeIncBasePriorityPrivilege	784	powershell.exe
Token: SeCreatePagefilePrivilege	784	powershell.exe
Token: SeBackupPrivilege	784	powershell.exe
Token: SeRestorePrivilege	784	powershell.exe
Token: SeShutdownPrivilege	784	powershell.exe
Token: SeDebugPrivilege	784	powershell.exe
Token: SeSystemEnvironmentPrivilege	784	powershell.exe
Token: SeRemoteShutdownPrivilege	784	powershell.exe
Token: SeUndockPrivilege	784	powershell.exe
Token: SeManageVolumePrivilege	784	powershell.exe
Token: 33	784	powershell.exe
Token: 34	784	powershell.exe
Token: 35	784	powershell.exe
Token: 36	784	powershell.exe
Token: SeDebugPrivilege	4180	powershell.exe
Token: SeIncreaseQuotaPrivilege	4180	powershell.exe
Token: SeSecurityPrivilege	4180	powershell.exe
Token: SeTakeOwnershipPrivilege	4180	powershell.exe
Token: SeLoadDriverPrivilege	4180	powershell.exe
Token: SeSystemProfilePrivilege	4180	powershell.exe
Token: SeSystemtimePrivilege	4180	powershell.exe
Token: SeProfSingleProcessPrivilege	4180	powershell.exe
Token: SeIncBasePriorityPrivilege	4180	powershell.exe
Token: SeCreatePagefilePrivilege	4180	powershell.exe
Token: SeBackupPrivilege	4180	powershell.exe
Token: SeRestorePrivilege	4180	powershell.exe
Token: SeShutdownPrivilege	4180	powershell.exe
Token: SeDebugPrivilege	4180	powershell.exe
Token: SeSystemEnvironmentPrivilege	4180	powershell.exe
Token: SeRemoteShutdownPrivilege	4180	powershell.exe
Token: SeUndockPrivilege	4180	powershell.exe
Token: SeManageVolumePrivilege	4180	powershell.exe
Token: 33	4180	powershell.exe
Token: 34	4180	powershell.exe
Token: 35	4180	powershell.exe
Token: 36	4180	powershell.exe
Token: SeDebugPrivilege	3156	powershell.exe
Token: SeIncreaseQuotaPrivilege	3156	powershell.exe
Token: SeSecurityPrivilege	3156	powershell.exe
Token: SeTakeOwnershipPrivilege	3156	powershell.exe
Token: SeLoadDriverPrivilege	3156	powershell.exe
Token: SeSystemProfilePrivilege	3156	powershell.exe
Token: SeSystemtimePrivilege	3156	powershell.exe
Token: SeProfSingleProcessPrivilege	3156	powershell.exe
Token: SeIncBasePriorityPrivilege	3156	powershell.exe
Token: SeCreatePagefilePrivilege	3156	powershell.exe
Token: SeBackupPrivilege	3156	powershell.exe
Token: SeRestorePrivilege	3156	powershell.exe
Token: SeShutdownPrivilege	3156	powershell.exe
Token: SeDebugPrivilege	3156	powershell.exe
Token: SeSystemEnvironmentPrivilege	3156	powershell.exe
Token: SeRemoteShutdownPrivilege	3156	powershell.exe
Token: SeUndockPrivilege	3156	powershell.exe
Token: SeManageVolumePrivilege	3156	powershell.exe
Token: 33	3156	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 6092 wrote to memory of 696	6092	default.dat.exe	89
PID 696 wrote to memory of 1308	696	default.dat.exe	90
PID 1308 wrote to memory of 784	1308	cmd.exe	92
PID 696 wrote to memory of 1472	696	default.dat.exe	94
PID 1472 wrote to memory of 4180	1472	cmd.exe	96
PID 696 wrote to memory of 1068	696	default.dat.exe	97
PID 1068 wrote to memory of 3156	1068	cmd.exe	99
PID 696 wrote to memory of 4460	696	default.dat.exe	100
PID 4460 wrote to memory of 1816	4460	cmd.exe	102
PID 696 wrote to memory of 2012	696	default.dat.exe	103
PID 2012 wrote to memory of 3920	2012	cmd.exe	105
PID 696 wrote to memory of 1456	696	default.dat.exe	106
PID 1456 wrote to memory of 5128	1456	cmd.exe	108
PID 696 wrote to memory of 4696	696	default.dat.exe	109
PID 4696 wrote to memory of 5980	4696	cmd.exe	111
PID 696 wrote to memory of 3600	696	default.dat.exe	112
PID 3600 wrote to memory of 2660	3600	cmd.exe	114
PID 696 wrote to memory of 1912	696	default.dat.exe	115
PID 1912 wrote to memory of 5340	1912	cmd.exe	118
PID 696 wrote to memory of 4860	696	default.dat.exe	119
PID 4860 wrote to memory of 4332	4860	cmd.exe	121
PID 696 wrote to memory of 1984	696	default.dat.exe	122
PID 1984 wrote to memory of 2588	1984	cmd.exe	124
PID 696 wrote to memory of 1392	696	default.dat.exe	125
PID 1392 wrote to memory of 4592	1392	cmd.exe	127

C:\Users\Admin\AppData\Local\Temp\default.dat.exe
"C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:6092
- C:\Users\Admin\AppData\Local\Temp\default.dat.exe
  "C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:696
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1308
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\lohocada'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1472
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\lohocada'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4180
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1068
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3156
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4460
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1816
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2012
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3920
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1456
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5128
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4696
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5980
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3600
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2660
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1912
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5340
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4860
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4332
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1984
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2588
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1392
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4592

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact