2da2b2e8381abec31833b592192c7bc935bae944957b287547222815b4ba0501

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 12:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
default.dat.exe
Size 13.6MB
Sample260718-p4e5ysbz6m
SHA256 2da2b2e8381abec31833b592192c7bc935bae944957b287547222815b4ba0501
MD5 42a615c166050e586c02a07222f0279f
SHA1 a11197986be68644eeade088b864d33b882d82c4
SHA512 bbfdb382797fa9d07650ab13fd8993b3f3ff4defa8162e10bb7077ec6445fe78b4f9b80497ebb6cdc1cc5430fc6ba77ec2a77f231f80f09623be4a3074c2781f
SSDEEP 393216:Ug61wCTCsjogCqFlRCdseZ94EMYZRbXMCHWUjXMcuI3/PGTAI:UgQwMCsjwwRCdl94EdRbXMb8XZH/O7
TLSH
T194E633A8A9D012EDD673D43DAAE1C5C6E26630394371C9CB176863B17E632E48C3C767
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2164	powershell.exe
4564	powershell.exe
5980	powershell.exe
1052	powershell.exe
2184	powershell.exe
3324	powershell.exe
2580	powershell.exe
2496	powershell.exe
2536	powershell.exe
2660	powershell.exe
4600	powershell.exe
5000	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
928	default.dat.exe
928	default.dat.exe
928	default.dat.exe
928	default.dat.exe
928	default.dat.exe
928	default.dat.exe
928	default.dat.exe
928	default.dat.exe
928	default.dat.exe
928	default.dat.exe
928	default.dat.exe
928	default.dat.exe
928	default.dat.exe
928	default.dat.exe
928	default.dat.exe

Executes a command shell one-liner 1 TTPs 12 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5868	cmd.exe
1700	cmd.exe
4644	cmd.exe
4800	cmd.exe
3680	cmd.exe
2088	cmd.exe
5068	cmd.exe
2256	cmd.exe
744	cmd.exe
1576	cmd.exe
5400	cmd.exe
5860	cmd.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
928	default.dat.exe
928	default.dat.exe
2164	powershell.exe
2164	powershell.exe
4564	powershell.exe
4564	powershell.exe
5980	powershell.exe
5980	powershell.exe
1052	powershell.exe
1052	powershell.exe
2536	powershell.exe
2536	powershell.exe
2184	powershell.exe
2184	powershell.exe
3324	powershell.exe
3324	powershell.exe
2580	powershell.exe
2580	powershell.exe
2496	powershell.exe
2496	powershell.exe
2660	powershell.exe
2660	powershell.exe
4600	powershell.exe
4600	powershell.exe
5000	powershell.exe
5000	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	928	default.dat.exe
Token: SeDebugPrivilege	2164	powershell.exe
Token: SeIncreaseQuotaPrivilege	2164	powershell.exe
Token: SeSecurityPrivilege	2164	powershell.exe
Token: SeTakeOwnershipPrivilege	2164	powershell.exe
Token: SeLoadDriverPrivilege	2164	powershell.exe
Token: SeSystemProfilePrivilege	2164	powershell.exe
Token: SeSystemtimePrivilege	2164	powershell.exe
Token: SeProfSingleProcessPrivilege	2164	powershell.exe
Token: SeIncBasePriorityPrivilege	2164	powershell.exe
Token: SeCreatePagefilePrivilege	2164	powershell.exe
Token: SeBackupPrivilege	2164	powershell.exe
Token: SeRestorePrivilege	2164	powershell.exe
Token: SeShutdownPrivilege	2164	powershell.exe
Token: SeDebugPrivilege	2164	powershell.exe
Token: SeSystemEnvironmentPrivilege	2164	powershell.exe
Token: SeRemoteShutdownPrivilege	2164	powershell.exe
Token: SeUndockPrivilege	2164	powershell.exe
Token: SeManageVolumePrivilege	2164	powershell.exe
Token: 33	2164	powershell.exe
Token: 34	2164	powershell.exe
Token: 35	2164	powershell.exe
Token: 36	2164	powershell.exe
Token: SeDebugPrivilege	4564	powershell.exe
Token: SeIncreaseQuotaPrivilege	4564	powershell.exe
Token: SeSecurityPrivilege	4564	powershell.exe
Token: SeTakeOwnershipPrivilege	4564	powershell.exe
Token: SeLoadDriverPrivilege	4564	powershell.exe
Token: SeSystemProfilePrivilege	4564	powershell.exe
Token: SeSystemtimePrivilege	4564	powershell.exe
Token: SeProfSingleProcessPrivilege	4564	powershell.exe
Token: SeIncBasePriorityPrivilege	4564	powershell.exe
Token: SeCreatePagefilePrivilege	4564	powershell.exe
Token: SeBackupPrivilege	4564	powershell.exe
Token: SeRestorePrivilege	4564	powershell.exe
Token: SeShutdownPrivilege	4564	powershell.exe
Token: SeDebugPrivilege	4564	powershell.exe
Token: SeSystemEnvironmentPrivilege	4564	powershell.exe
Token: SeRemoteShutdownPrivilege	4564	powershell.exe
Token: SeUndockPrivilege	4564	powershell.exe
Token: SeManageVolumePrivilege	4564	powershell.exe
Token: 33	4564	powershell.exe
Token: 34	4564	powershell.exe
Token: 35	4564	powershell.exe
Token: 36	4564	powershell.exe
Token: SeDebugPrivilege	5980	powershell.exe
Token: SeIncreaseQuotaPrivilege	5980	powershell.exe
Token: SeSecurityPrivilege	5980	powershell.exe
Token: SeTakeOwnershipPrivilege	5980	powershell.exe
Token: SeLoadDriverPrivilege	5980	powershell.exe
Token: SeSystemProfilePrivilege	5980	powershell.exe
Token: SeSystemtimePrivilege	5980	powershell.exe
Token: SeProfSingleProcessPrivilege	5980	powershell.exe
Token: SeIncBasePriorityPrivilege	5980	powershell.exe
Token: SeCreatePagefilePrivilege	5980	powershell.exe
Token: SeBackupPrivilege	5980	powershell.exe
Token: SeRestorePrivilege	5980	powershell.exe
Token: SeShutdownPrivilege	5980	powershell.exe
Token: SeDebugPrivilege	5980	powershell.exe
Token: SeSystemEnvironmentPrivilege	5980	powershell.exe
Token: SeRemoteShutdownPrivilege	5980	powershell.exe
Token: SeUndockPrivilege	5980	powershell.exe
Token: SeManageVolumePrivilege	5980	powershell.exe
Token: 33	5980	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1796 wrote to memory of 928	1796	default.dat.exe	89
PID 928 wrote to memory of 5860	928	default.dat.exe	90
PID 5860 wrote to memory of 2164	5860	cmd.exe	92
PID 928 wrote to memory of 5868	928	default.dat.exe	94
PID 5868 wrote to memory of 4564	5868	cmd.exe	96
PID 928 wrote to memory of 3680	928	default.dat.exe	97
PID 3680 wrote to memory of 5980	3680	cmd.exe	99
PID 928 wrote to memory of 2088	928	default.dat.exe	100
PID 2088 wrote to memory of 1052	2088	cmd.exe	102
PID 928 wrote to memory of 1700	928	default.dat.exe	103
PID 1700 wrote to memory of 2536	1700	cmd.exe	105
PID 928 wrote to memory of 5068	928	default.dat.exe	106
PID 5068 wrote to memory of 2184	5068	cmd.exe	108
PID 928 wrote to memory of 2256	928	default.dat.exe	109
PID 2256 wrote to memory of 3324	2256	cmd.exe	111
PID 928 wrote to memory of 744	928	default.dat.exe	112
PID 744 wrote to memory of 2580	744	cmd.exe	114
PID 928 wrote to memory of 1576	928	default.dat.exe	115
PID 1576 wrote to memory of 2496	1576	cmd.exe	117
PID 928 wrote to memory of 4644	928	default.dat.exe	118
PID 4644 wrote to memory of 2660	4644	cmd.exe	120
PID 928 wrote to memory of 5400	928	default.dat.exe	121
PID 5400 wrote to memory of 4600	5400	cmd.exe	123
PID 928 wrote to memory of 4800	928	default.dat.exe	124
PID 4800 wrote to memory of 5000	4800	cmd.exe	126

C:\Users\Admin\AppData\Local\Temp\default.dat.exe
"C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1796
- C:\Users\Admin\AppData\Local\Temp\default.dat.exe
  "C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5860
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2164
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\lohocada'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5868
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\lohocada'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4564
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3680
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5980
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2088
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1052
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1700
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2536
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5068
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2184
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2256
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3324
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:744
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2580
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1576
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2496
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4644
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2660
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5400
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4600
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4800
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5000

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact