f5a92dcadc6bed2e1cf5efff18221929b0a3fbb7db1a69f26f53f4c7295fab35

Analysis

max time kernel
149s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 21:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
default.dat.exe
Size 13.6MB
Sample260722-1rcpvace97
SHA256 f5a92dcadc6bed2e1cf5efff18221929b0a3fbb7db1a69f26f53f4c7295fab35
MD5 99eeae80567fd81fb151afe190d03e71
SHA1 4358456c8735248e0286d2b91575947364de42af
SHA512 1597c35c146aa98681876754a1f2a03863f31c4659d1e1814f8c0ce118ab9e04df3ea409abcb7fa105208d1d20b16c8e1d85d2d215d530043276de8be12c3d52
SSDEEP 393216:3HXeZbuFpIgMk3GobNOC3mQCvXMCHWUjXWcuI3/PGTAI:3HrdMWf8mPCvXMb8XrH/O7
TLSH
T1B2E633184BD426FEEAF3C03CEAD196E5B5A8786107B1D99F17A483615F473D08C3EA06
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4860	powershell.exe
4564	powershell.exe
6124	powershell.exe
364	powershell.exe
5516	powershell.exe
1916	powershell.exe
4724	powershell.exe
3648	powershell.exe
6036	powershell.exe
6056	powershell.exe
1288	powershell.exe
2312	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
616	default.dat.exe
616	default.dat.exe
616	default.dat.exe
616	default.dat.exe
616	default.dat.exe
616	default.dat.exe
616	default.dat.exe
616	default.dat.exe
616	default.dat.exe
616	default.dat.exe
616	default.dat.exe
616	default.dat.exe
616	default.dat.exe
616	default.dat.exe
616	default.dat.exe

Executes a command shell one-liner 1 TTPs 12 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2472	cmd.exe
1368	cmd.exe
1944	cmd.exe
4916	cmd.exe
5652	cmd.exe
4532	cmd.exe
3320	cmd.exe
4416	cmd.exe
1980	cmd.exe
1432	cmd.exe
3976	cmd.exe
5716	cmd.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
616	default.dat.exe
616	default.dat.exe
2312	powershell.exe
2312	powershell.exe
4860	powershell.exe
4860	powershell.exe
4860	powershell.exe
3648	powershell.exe
3648	powershell.exe
3648	powershell.exe
4564	powershell.exe
4564	powershell.exe
4564	powershell.exe
6124	powershell.exe
6124	powershell.exe
6124	powershell.exe
364	powershell.exe
364	powershell.exe
364	powershell.exe
5516	powershell.exe
5516	powershell.exe
5516	powershell.exe
1916	powershell.exe
1916	powershell.exe
1916	powershell.exe
4724	powershell.exe
4724	powershell.exe
4724	powershell.exe
6036	powershell.exe
6036	powershell.exe
6036	powershell.exe
6056	powershell.exe
6056	powershell.exe
6056	powershell.exe
1288	powershell.exe
1288	powershell.exe
1288	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	616	default.dat.exe
Token: SeDebugPrivilege	2312	powershell.exe
Token: SeIncreaseQuotaPrivilege	2312	powershell.exe
Token: SeSecurityPrivilege	2312	powershell.exe
Token: SeTakeOwnershipPrivilege	2312	powershell.exe
Token: SeLoadDriverPrivilege	2312	powershell.exe
Token: SeSystemProfilePrivilege	2312	powershell.exe
Token: SeSystemtimePrivilege	2312	powershell.exe
Token: SeProfSingleProcessPrivilege	2312	powershell.exe
Token: SeIncBasePriorityPrivilege	2312	powershell.exe
Token: SeCreatePagefilePrivilege	2312	powershell.exe
Token: SeBackupPrivilege	2312	powershell.exe
Token: SeRestorePrivilege	2312	powershell.exe
Token: SeShutdownPrivilege	2312	powershell.exe
Token: SeDebugPrivilege	2312	powershell.exe
Token: SeSystemEnvironmentPrivilege	2312	powershell.exe
Token: SeRemoteShutdownPrivilege	2312	powershell.exe
Token: SeUndockPrivilege	2312	powershell.exe
Token: SeManageVolumePrivilege	2312	powershell.exe
Token: 33	2312	powershell.exe
Token: 34	2312	powershell.exe
Token: 35	2312	powershell.exe
Token: 36	2312	powershell.exe
Token: SeDebugPrivilege	4860	powershell.exe
Token: SeIncreaseQuotaPrivilege	4860	powershell.exe
Token: SeSecurityPrivilege	4860	powershell.exe
Token: SeTakeOwnershipPrivilege	4860	powershell.exe
Token: SeLoadDriverPrivilege	4860	powershell.exe
Token: SeSystemProfilePrivilege	4860	powershell.exe
Token: SeSystemtimePrivilege	4860	powershell.exe
Token: SeProfSingleProcessPrivilege	4860	powershell.exe
Token: SeIncBasePriorityPrivilege	4860	powershell.exe
Token: SeCreatePagefilePrivilege	4860	powershell.exe
Token: SeBackupPrivilege	4860	powershell.exe
Token: SeRestorePrivilege	4860	powershell.exe
Token: SeShutdownPrivilege	4860	powershell.exe
Token: SeDebugPrivilege	4860	powershell.exe
Token: SeSystemEnvironmentPrivilege	4860	powershell.exe
Token: SeRemoteShutdownPrivilege	4860	powershell.exe
Token: SeUndockPrivilege	4860	powershell.exe
Token: SeManageVolumePrivilege	4860	powershell.exe
Token: 33	4860	powershell.exe
Token: 34	4860	powershell.exe
Token: 35	4860	powershell.exe
Token: 36	4860	powershell.exe
Token: SeDebugPrivilege	3648	powershell.exe
Token: SeIncreaseQuotaPrivilege	3648	powershell.exe
Token: SeSecurityPrivilege	3648	powershell.exe
Token: SeTakeOwnershipPrivilege	3648	powershell.exe
Token: SeLoadDriverPrivilege	3648	powershell.exe
Token: SeSystemProfilePrivilege	3648	powershell.exe
Token: SeSystemtimePrivilege	3648	powershell.exe
Token: SeProfSingleProcessPrivilege	3648	powershell.exe
Token: SeIncBasePriorityPrivilege	3648	powershell.exe
Token: SeCreatePagefilePrivilege	3648	powershell.exe
Token: SeBackupPrivilege	3648	powershell.exe
Token: SeRestorePrivilege	3648	powershell.exe
Token: SeShutdownPrivilege	3648	powershell.exe
Token: SeDebugPrivilege	3648	powershell.exe
Token: SeSystemEnvironmentPrivilege	3648	powershell.exe
Token: SeRemoteShutdownPrivilege	3648	powershell.exe
Token: SeUndockPrivilege	3648	powershell.exe
Token: SeManageVolumePrivilege	3648	powershell.exe
Token: 33	3648	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 5400 wrote to memory of 616	5400	default.dat.exe	89
PID 616 wrote to memory of 4416	616	default.dat.exe	90
PID 4416 wrote to memory of 2312	4416	cmd.exe	92
PID 616 wrote to memory of 1980	616	default.dat.exe	94
PID 1980 wrote to memory of 4860	1980	cmd.exe	96
PID 616 wrote to memory of 1432	616	default.dat.exe	97
PID 1432 wrote to memory of 3648	1432	cmd.exe	99
PID 616 wrote to memory of 1944	616	default.dat.exe	100
PID 1944 wrote to memory of 4564	1944	cmd.exe	102
PID 616 wrote to memory of 4916	616	default.dat.exe	103
PID 4916 wrote to memory of 6124	4916	cmd.exe	105
PID 616 wrote to memory of 5652	616	default.dat.exe	106
PID 5652 wrote to memory of 364	5652	cmd.exe	108
PID 616 wrote to memory of 3976	616	default.dat.exe	109
PID 3976 wrote to memory of 5516	3976	cmd.exe	111
PID 616 wrote to memory of 4532	616	default.dat.exe	112
PID 4532 wrote to memory of 1916	4532	cmd.exe	114
PID 616 wrote to memory of 5716	616	default.dat.exe	115
PID 5716 wrote to memory of 4724	5716	cmd.exe	117
PID 616 wrote to memory of 2472	616	default.dat.exe	118
PID 2472 wrote to memory of 6036	2472	cmd.exe	120
PID 616 wrote to memory of 3320	616	default.dat.exe	121
PID 3320 wrote to memory of 6056	3320	cmd.exe	123
PID 616 wrote to memory of 1368	616	default.dat.exe	124
PID 1368 wrote to memory of 1288	1368	cmd.exe	126

C:\Users\Admin\AppData\Local\Temp\default.dat.exe
"C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5400
- C:\Users\Admin\AppData\Local\Temp\default.dat.exe
  "C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:616
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4416
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2312
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\dusunuk'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1980
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\dusunuk'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4860
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1432
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3648
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1944
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4564
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4916
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:6124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5652
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:364
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3976
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5516
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4532
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1916
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5716
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4724
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2472
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:6036
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3320
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:6056
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1368
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1288

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact