65dc2da8e1dc43bcbe782754a06f03f144b490781f94ff07c37a12e0e66e6844

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
21/07/2026, 03:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
default.dat.exe
Size 13.6MB
Sample260721-efdbcaes2k
SHA256 65dc2da8e1dc43bcbe782754a06f03f144b490781f94ff07c37a12e0e66e6844
MD5 ee2b57565c612eb5153a90e16d2e4bdc
SHA1 8da1744012c8ff14697a804f58b7a7eac43e18ae
SHA512 8d59b20570465bdb97e80d10c3d9e770d5a90b9d1f656a0d54b46f544aaf652a03f933ffcfae2acd4ff0996ec0b6a5310c264d33eb6b3a93d0380e7e90c4b00d
SSDEEP 393216:2z1Czkz/uEdht3XyuF/iIY8fw3Qt8p4VXMCHWUjX5cuI3/PGTAI:2IzkzvnyuFI8V8IXMb8XOH/O7
TLSH
T1EAE63308FAE022FFE477013DED515B999999B822AB35C5DF13B487316D971F08A39223
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3344	powershell.exe
1904	powershell.exe
3804	powershell.exe
2008	powershell.exe
5804	powershell.exe
5128	powershell.exe
4604	powershell.exe
3128	powershell.exe
2980	powershell.exe
316	powershell.exe
3528	powershell.exe
4776	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
5520	default.dat.exe
5520	default.dat.exe
5520	default.dat.exe
5520	default.dat.exe
5520	default.dat.exe
5520	default.dat.exe
5520	default.dat.exe
5520	default.dat.exe
5520	default.dat.exe
5520	default.dat.exe
5520	default.dat.exe
5520	default.dat.exe
5520	default.dat.exe
5520	default.dat.exe
5520	default.dat.exe

Executes a command shell one-liner 1 TTPs 12 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5176	cmd.exe
1212	cmd.exe
5856	cmd.exe
5624	cmd.exe
5476	cmd.exe
2380	cmd.exe
4964	cmd.exe
3108	cmd.exe
4088	cmd.exe
1864	cmd.exe
3480	cmd.exe
4732	cmd.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
5520	default.dat.exe
5520	default.dat.exe
5520	default.dat.exe
5520	default.dat.exe
5520	default.dat.exe
5520	default.dat.exe
5804	powershell.exe
5804	powershell.exe
5128	powershell.exe
5128	powershell.exe
4604	powershell.exe
4604	powershell.exe
3128	powershell.exe
3128	powershell.exe
2980	powershell.exe
2980	powershell.exe
316	powershell.exe
316	powershell.exe
3344	powershell.exe
3344	powershell.exe
1904	powershell.exe
1904	powershell.exe
3528	powershell.exe
3528	powershell.exe
4776	powershell.exe
4776	powershell.exe
3804	powershell.exe
3804	powershell.exe
2008	powershell.exe
2008	powershell.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	5520	default.dat.exe
Token: SeDebugPrivilege	5804	powershell.exe
Token: SeDebugPrivilege	5128	powershell.exe
Token: SeDebugPrivilege	4604	powershell.exe
Token: SeDebugPrivilege	3128	powershell.exe
Token: SeDebugPrivilege	2980	powershell.exe
Token: SeDebugPrivilege	316	powershell.exe
Token: SeDebugPrivilege	3344	powershell.exe
Token: SeDebugPrivilege	1904	powershell.exe
Token: SeDebugPrivilege	3528	powershell.exe
Token: SeDebugPrivilege	4776	powershell.exe
Token: SeDebugPrivilege	3804	powershell.exe
Token: SeDebugPrivilege	2008	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4936 wrote to memory of 5520	4936	default.dat.exe	86
PID 5520 wrote to memory of 4964	5520	default.dat.exe	91
PID 4964 wrote to memory of 5804	4964	cmd.exe	93
PID 5520 wrote to memory of 3108	5520	default.dat.exe	95
PID 3108 wrote to memory of 5128	3108	cmd.exe	97
PID 5520 wrote to memory of 5176	5520	default.dat.exe	98
PID 5176 wrote to memory of 4604	5176	cmd.exe	100
PID 5520 wrote to memory of 1212	5520	default.dat.exe	103
PID 1212 wrote to memory of 3128	1212	cmd.exe	105
PID 5520 wrote to memory of 5856	5520	default.dat.exe	107
PID 5856 wrote to memory of 2980	5856	cmd.exe	109
PID 5520 wrote to memory of 4088	5520	default.dat.exe	110
PID 4088 wrote to memory of 316	4088	cmd.exe	112
PID 5520 wrote to memory of 5624	5520	default.dat.exe	113
PID 5624 wrote to memory of 3344	5624	cmd.exe	115
PID 5520 wrote to memory of 1864	5520	default.dat.exe	116
PID 1864 wrote to memory of 1904	1864	cmd.exe	118
PID 5520 wrote to memory of 5476	5520	default.dat.exe	119
PID 5476 wrote to memory of 3528	5476	cmd.exe	121
PID 5520 wrote to memory of 2380	5520	default.dat.exe	122
PID 2380 wrote to memory of 4776	2380	cmd.exe	124
PID 5520 wrote to memory of 3480	5520	default.dat.exe	125
PID 3480 wrote to memory of 3804	3480	cmd.exe	127
PID 5520 wrote to memory of 4732	5520	default.dat.exe	128
PID 4732 wrote to memory of 2008	4732	cmd.exe	130

C:\Users\Admin\AppData\Local\Temp\default.dat.exe
"C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4936
- C:\Users\Admin\AppData\Local\Temp\default.dat.exe
  "C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5520
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4964
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5804
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\vuzowun'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3108
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\vuzowun'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5128
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5176
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4604
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1212
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3128
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5856
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2980
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4088
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:316
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5624
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3344
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1864
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1904
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5476
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3528
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2380
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4776
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3480
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3804
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4732
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2008

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...