e6fe49120349640169b007fe45a57d0d16cf4cd7dd109f950942e20e2b2a6e05

Analysis

max time kernel
149s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/07/2026, 15:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
default.dat.exe
Size 13.7MB
Sample260719-tbbdhsdy4k
SHA256 e6fe49120349640169b007fe45a57d0d16cf4cd7dd109f950942e20e2b2a6e05
MD5 d9e6c031e7e21d7783ad504cb3fdd409
SHA1 de74685ad7ca15b9d011f810a7c65b658df0e12e
SHA512 42a8d30b0e9264c9d577cf5191320cd38ed3b558eb18c6860ee6c92f2cfcea45682c3eb30d6dba5f59dab6d9f0d31d128e850b0c3d4fae3fd85ee29d7e2718df
SSDEEP 393216:JcCB95liIOEEL2VOykXMCHWUjX8cuI3/PGTAI:JLT7VkykXMb8XpH/O7
TLSH
T161E6334CA6C822FEF272503CFDE245C9E978782A6B72C8CB6B2446B16D535D05A3D713
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4348	powershell.exe
4808	powershell.exe
1900	powershell.exe
3192	powershell.exe
5444	powershell.exe
1184	powershell.exe
4180	powershell.exe
3964	powershell.exe
1604	powershell.exe
720	powershell.exe
3916	powershell.exe
5904	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
5228	default.dat.exe
5228	default.dat.exe
5228	default.dat.exe
5228	default.dat.exe
5228	default.dat.exe
5228	default.dat.exe
5228	default.dat.exe
5228	default.dat.exe
5228	default.dat.exe
5228	default.dat.exe
5228	default.dat.exe
5228	default.dat.exe
5228	default.dat.exe
5228	default.dat.exe
5228	default.dat.exe

Executes a command shell one-liner 1 TTPs 12 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2508	cmd.exe
4252	cmd.exe
2904	cmd.exe
5260	cmd.exe
1532	cmd.exe
1732	cmd.exe
3432	cmd.exe
4520	cmd.exe
4728	cmd.exe
1516	cmd.exe
3768	cmd.exe
1232	cmd.exe

Suspicious behavior: EnumeratesProcesses 29 IoCs

pid	Process
5228	default.dat.exe
5228	default.dat.exe
4348	powershell.exe
4348	powershell.exe
4180	powershell.exe
4180	powershell.exe
3964	powershell.exe
3964	powershell.exe
4808	powershell.exe
4808	powershell.exe
1604	powershell.exe
1604	powershell.exe
720	powershell.exe
720	powershell.exe
1900	powershell.exe
1900	powershell.exe
3916	powershell.exe
3916	powershell.exe
3192	powershell.exe
3192	powershell.exe
3192	powershell.exe
5444	powershell.exe
5444	powershell.exe
5444	powershell.exe
5904	powershell.exe
5904	powershell.exe
1184	powershell.exe
1184	powershell.exe
1184	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5228	default.dat.exe
Token: SeDebugPrivilege	4348	powershell.exe
Token: SeIncreaseQuotaPrivilege	4348	powershell.exe
Token: SeSecurityPrivilege	4348	powershell.exe
Token: SeTakeOwnershipPrivilege	4348	powershell.exe
Token: SeLoadDriverPrivilege	4348	powershell.exe
Token: SeSystemProfilePrivilege	4348	powershell.exe
Token: SeSystemtimePrivilege	4348	powershell.exe
Token: SeProfSingleProcessPrivilege	4348	powershell.exe
Token: SeIncBasePriorityPrivilege	4348	powershell.exe
Token: SeCreatePagefilePrivilege	4348	powershell.exe
Token: SeBackupPrivilege	4348	powershell.exe
Token: SeRestorePrivilege	4348	powershell.exe
Token: SeShutdownPrivilege	4348	powershell.exe
Token: SeDebugPrivilege	4348	powershell.exe
Token: SeSystemEnvironmentPrivilege	4348	powershell.exe
Token: SeRemoteShutdownPrivilege	4348	powershell.exe
Token: SeUndockPrivilege	4348	powershell.exe
Token: SeManageVolumePrivilege	4348	powershell.exe
Token: 33	4348	powershell.exe
Token: 34	4348	powershell.exe
Token: 35	4348	powershell.exe
Token: 36	4348	powershell.exe
Token: SeDebugPrivilege	4180	powershell.exe
Token: SeIncreaseQuotaPrivilege	4180	powershell.exe
Token: SeSecurityPrivilege	4180	powershell.exe
Token: SeTakeOwnershipPrivilege	4180	powershell.exe
Token: SeLoadDriverPrivilege	4180	powershell.exe
Token: SeSystemProfilePrivilege	4180	powershell.exe
Token: SeSystemtimePrivilege	4180	powershell.exe
Token: SeProfSingleProcessPrivilege	4180	powershell.exe
Token: SeIncBasePriorityPrivilege	4180	powershell.exe
Token: SeCreatePagefilePrivilege	4180	powershell.exe
Token: SeBackupPrivilege	4180	powershell.exe
Token: SeRestorePrivilege	4180	powershell.exe
Token: SeShutdownPrivilege	4180	powershell.exe
Token: SeDebugPrivilege	4180	powershell.exe
Token: SeSystemEnvironmentPrivilege	4180	powershell.exe
Token: SeRemoteShutdownPrivilege	4180	powershell.exe
Token: SeUndockPrivilege	4180	powershell.exe
Token: SeManageVolumePrivilege	4180	powershell.exe
Token: 33	4180	powershell.exe
Token: 34	4180	powershell.exe
Token: 35	4180	powershell.exe
Token: 36	4180	powershell.exe
Token: SeDebugPrivilege	3964	powershell.exe
Token: SeIncreaseQuotaPrivilege	3964	powershell.exe
Token: SeSecurityPrivilege	3964	powershell.exe
Token: SeTakeOwnershipPrivilege	3964	powershell.exe
Token: SeLoadDriverPrivilege	3964	powershell.exe
Token: SeSystemProfilePrivilege	3964	powershell.exe
Token: SeSystemtimePrivilege	3964	powershell.exe
Token: SeProfSingleProcessPrivilege	3964	powershell.exe
Token: SeIncBasePriorityPrivilege	3964	powershell.exe
Token: SeCreatePagefilePrivilege	3964	powershell.exe
Token: SeBackupPrivilege	3964	powershell.exe
Token: SeRestorePrivilege	3964	powershell.exe
Token: SeShutdownPrivilege	3964	powershell.exe
Token: SeDebugPrivilege	3964	powershell.exe
Token: SeSystemEnvironmentPrivilege	3964	powershell.exe
Token: SeRemoteShutdownPrivilege	3964	powershell.exe
Token: SeUndockPrivilege	3964	powershell.exe
Token: SeManageVolumePrivilege	3964	powershell.exe
Token: 33	3964	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 5096 wrote to memory of 5228	5096	default.dat.exe	89
PID 5228 wrote to memory of 5260	5228	default.dat.exe	90
PID 5260 wrote to memory of 4348	5260	cmd.exe	92
PID 5228 wrote to memory of 1532	5228	default.dat.exe	94
PID 1532 wrote to memory of 4180	1532	cmd.exe	96
PID 5228 wrote to memory of 1232	5228	default.dat.exe	97
PID 1232 wrote to memory of 3964	1232	cmd.exe	99
PID 5228 wrote to memory of 1732	5228	default.dat.exe	100
PID 1732 wrote to memory of 4808	1732	cmd.exe	102
PID 5228 wrote to memory of 2508	5228	default.dat.exe	103
PID 2508 wrote to memory of 1604	2508	cmd.exe	105
PID 5228 wrote to memory of 4252	5228	default.dat.exe	106
PID 4252 wrote to memory of 720	4252	cmd.exe	108
PID 5228 wrote to memory of 3432	5228	default.dat.exe	109
PID 3432 wrote to memory of 1900	3432	cmd.exe	111
PID 5228 wrote to memory of 2904	5228	default.dat.exe	112
PID 2904 wrote to memory of 3916	2904	cmd.exe	114
PID 5228 wrote to memory of 4520	5228	default.dat.exe	115
PID 4520 wrote to memory of 3192	4520	cmd.exe	117
PID 5228 wrote to memory of 4728	5228	default.dat.exe	118
PID 4728 wrote to memory of 5444	4728	cmd.exe	120
PID 5228 wrote to memory of 1516	5228	default.dat.exe	122
PID 1516 wrote to memory of 5904	1516	cmd.exe	124
PID 5228 wrote to memory of 3768	5228	default.dat.exe	125
PID 3768 wrote to memory of 1184	3768	cmd.exe	127

C:\Users\Admin\AppData\Local\Temp\default.dat.exe
"C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5096
- C:\Users\Admin\AppData\Local\Temp\default.dat.exe
  "C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5228
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5260
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4348
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\pileweh'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1532
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\pileweh'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4180
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1232
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3964
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1732
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4808
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2508
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1604
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4252
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:720
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3432
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1900
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2904
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3916
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4520
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3192
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4728
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5444
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1516
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5904
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3768
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1184

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact