90c46ec7e2400e4999afe7ad56f205afecb41041493ae2884c76666a77c82f8b

Analysis

max time kernel
149s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/07/2026, 19:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
default.dat.exe
Size 13.7MB
Sample260721-yllz8atcnf
SHA256 90c46ec7e2400e4999afe7ad56f205afecb41041493ae2884c76666a77c82f8b
MD5 108834f2d3ba6a9731c100c4f30a2825
SHA1 e45bdb988bc5dea61cb4833323bc2adb09568b6c
SHA512 b9d4f9caaf508d3d6282327d21c7ef2292b6193b90a881fd50a4d2f43d072ae86932fe824d0039420472caa15751a423cbd222021f0782689aee70e80cfb4d7f
SSDEEP 393216:JAtoLGdvtPua5UHQoytHzrHsbFvXMCHWUjXmcuI3/PGTAI:JAeLG1tD0stHyFvXMb8XbH/O7
TLSH
T127E63368BAC802EFE1730078ECD25985E95474A65F72C9AB53DC9BB16E670E0CC3D712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4656	powershell.exe
6032	powershell.exe
5760	powershell.exe
4460	powershell.exe
3484	powershell.exe
2228	powershell.exe
1460	powershell.exe
1084	powershell.exe
5924	powershell.exe
2124	powershell.exe
3724	powershell.exe
3784	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
2912	default.dat.exe
2912	default.dat.exe
2912	default.dat.exe
2912	default.dat.exe
2912	default.dat.exe
2912	default.dat.exe
2912	default.dat.exe
2912	default.dat.exe
2912	default.dat.exe
2912	default.dat.exe
2912	default.dat.exe
2912	default.dat.exe
2912	default.dat.exe
2912	default.dat.exe
2912	default.dat.exe

Executes a command shell one-liner 1 TTPs 12 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3948	cmd.exe
4484	cmd.exe
2980	cmd.exe
3292	cmd.exe
6076	cmd.exe
2812	cmd.exe
2016	cmd.exe
996	cmd.exe
2644	cmd.exe
5908	cmd.exe
616	cmd.exe
476	cmd.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
2912	default.dat.exe
2912	default.dat.exe
4656	powershell.exe
4656	powershell.exe
6032	powershell.exe
6032	powershell.exe
6032	powershell.exe
1084	powershell.exe
1084	powershell.exe
5760	powershell.exe
5760	powershell.exe
4460	powershell.exe
4460	powershell.exe
5924	powershell.exe
5924	powershell.exe
2124	powershell.exe
2124	powershell.exe
3484	powershell.exe
3484	powershell.exe
3724	powershell.exe
3724	powershell.exe
2228	powershell.exe
2228	powershell.exe
1460	powershell.exe
1460	powershell.exe
3784	powershell.exe
3784	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2912	default.dat.exe
Token: SeDebugPrivilege	4656	powershell.exe
Token: SeIncreaseQuotaPrivilege	4656	powershell.exe
Token: SeSecurityPrivilege	4656	powershell.exe
Token: SeTakeOwnershipPrivilege	4656	powershell.exe
Token: SeLoadDriverPrivilege	4656	powershell.exe
Token: SeSystemProfilePrivilege	4656	powershell.exe
Token: SeSystemtimePrivilege	4656	powershell.exe
Token: SeProfSingleProcessPrivilege	4656	powershell.exe
Token: SeIncBasePriorityPrivilege	4656	powershell.exe
Token: SeCreatePagefilePrivilege	4656	powershell.exe
Token: SeBackupPrivilege	4656	powershell.exe
Token: SeRestorePrivilege	4656	powershell.exe
Token: SeShutdownPrivilege	4656	powershell.exe
Token: SeDebugPrivilege	4656	powershell.exe
Token: SeSystemEnvironmentPrivilege	4656	powershell.exe
Token: SeRemoteShutdownPrivilege	4656	powershell.exe
Token: SeUndockPrivilege	4656	powershell.exe
Token: SeManageVolumePrivilege	4656	powershell.exe
Token: 33	4656	powershell.exe
Token: 34	4656	powershell.exe
Token: 35	4656	powershell.exe
Token: 36	4656	powershell.exe
Token: SeDebugPrivilege	6032	powershell.exe
Token: SeIncreaseQuotaPrivilege	6032	powershell.exe
Token: SeSecurityPrivilege	6032	powershell.exe
Token: SeTakeOwnershipPrivilege	6032	powershell.exe
Token: SeLoadDriverPrivilege	6032	powershell.exe
Token: SeSystemProfilePrivilege	6032	powershell.exe
Token: SeSystemtimePrivilege	6032	powershell.exe
Token: SeProfSingleProcessPrivilege	6032	powershell.exe
Token: SeIncBasePriorityPrivilege	6032	powershell.exe
Token: SeCreatePagefilePrivilege	6032	powershell.exe
Token: SeBackupPrivilege	6032	powershell.exe
Token: SeRestorePrivilege	6032	powershell.exe
Token: SeShutdownPrivilege	6032	powershell.exe
Token: SeDebugPrivilege	6032	powershell.exe
Token: SeSystemEnvironmentPrivilege	6032	powershell.exe
Token: SeRemoteShutdownPrivilege	6032	powershell.exe
Token: SeUndockPrivilege	6032	powershell.exe
Token: SeManageVolumePrivilege	6032	powershell.exe
Token: 33	6032	powershell.exe
Token: 34	6032	powershell.exe
Token: 35	6032	powershell.exe
Token: 36	6032	powershell.exe
Token: SeDebugPrivilege	1084	powershell.exe
Token: SeIncreaseQuotaPrivilege	1084	powershell.exe
Token: SeSecurityPrivilege	1084	powershell.exe
Token: SeTakeOwnershipPrivilege	1084	powershell.exe
Token: SeLoadDriverPrivilege	1084	powershell.exe
Token: SeSystemProfilePrivilege	1084	powershell.exe
Token: SeSystemtimePrivilege	1084	powershell.exe
Token: SeProfSingleProcessPrivilege	1084	powershell.exe
Token: SeIncBasePriorityPrivilege	1084	powershell.exe
Token: SeCreatePagefilePrivilege	1084	powershell.exe
Token: SeBackupPrivilege	1084	powershell.exe
Token: SeRestorePrivilege	1084	powershell.exe
Token: SeShutdownPrivilege	1084	powershell.exe
Token: SeDebugPrivilege	1084	powershell.exe
Token: SeSystemEnvironmentPrivilege	1084	powershell.exe
Token: SeRemoteShutdownPrivilege	1084	powershell.exe
Token: SeUndockPrivilege	1084	powershell.exe
Token: SeManageVolumePrivilege	1084	powershell.exe
Token: 33	1084	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 5476 wrote to memory of 2912	5476	default.dat.exe	89
PID 2912 wrote to memory of 2644	2912	default.dat.exe	90
PID 2644 wrote to memory of 4656	2644	cmd.exe	92
PID 2912 wrote to memory of 6076	2912	default.dat.exe	94
PID 6076 wrote to memory of 6032	6076	cmd.exe	96
PID 2912 wrote to memory of 5908	2912	default.dat.exe	97
PID 5908 wrote to memory of 1084	5908	cmd.exe	99
PID 2912 wrote to memory of 616	2912	default.dat.exe	100
PID 616 wrote to memory of 5760	616	cmd.exe	102
PID 2912 wrote to memory of 476	2912	default.dat.exe	103
PID 476 wrote to memory of 4460	476	cmd.exe	105
PID 2912 wrote to memory of 3948	2912	default.dat.exe	106
PID 3948 wrote to memory of 5924	3948	cmd.exe	108
PID 2912 wrote to memory of 2812	2912	default.dat.exe	109
PID 2812 wrote to memory of 2124	2812	cmd.exe	111
PID 2912 wrote to memory of 4484	2912	default.dat.exe	112
PID 4484 wrote to memory of 3484	4484	cmd.exe	114
PID 2912 wrote to memory of 2980	2912	default.dat.exe	115
PID 2980 wrote to memory of 3724	2980	cmd.exe	117
PID 2912 wrote to memory of 3292	2912	default.dat.exe	118
PID 3292 wrote to memory of 2228	3292	cmd.exe	120
PID 2912 wrote to memory of 2016	2912	default.dat.exe	121
PID 2016 wrote to memory of 1460	2016	cmd.exe	123
PID 2912 wrote to memory of 996	2912	default.dat.exe	124
PID 996 wrote to memory of 3784	996	cmd.exe	126

C:\Users\Admin\AppData\Local\Temp\default.dat.exe
"C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5476
- C:\Users\Admin\AppData\Local\Temp\default.dat.exe
  "C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2912
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2644
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4656
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\vuzowun'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6076
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\vuzowun'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:6032
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5908
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1084
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:616
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5760
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:476
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4460
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3948
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5924
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2812
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4484
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3484
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2980
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3724
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3292
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2228
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2016
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1460
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:996
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3784

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact