ac197dc54bf1c690dce6eff2024651fee1c57f3273ef4deb253854fe2b0afba7

Analysis

max time kernel
148s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 00:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
default.dat.exe
Size 13.7MB
Sample260722-a8a98shb73
SHA256 ac197dc54bf1c690dce6eff2024651fee1c57f3273ef4deb253854fe2b0afba7
MD5 710f0942c75f9b12c61f55c166b50fc4
SHA1 e433cca452309f84f87100208fd3354d643643b5
SHA512 46e065446f32b8dc06eecb7d3e5c91685ce41355d9b7888e3cc16908aebac6ce6bb8660467c8c37d0705f100f8c5edd040d913052d598b0c0ed8ff8c4c1e54ee
SSDEEP 393216:OdubvQoZsJjr3rXMCHWUjXWcuI3/PGTAI:Ow7TAr3rXMb8XrH/O7
TLSH
T194E633488AE001EDE5FB403CEEA156A1E572747453B3C6CB47AC43E26E571E09E3E61B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3596	powershell.exe
3568	powershell.exe
1572	powershell.exe
956	powershell.exe
4108	powershell.exe
3292	powershell.exe
3896	powershell.exe
692	powershell.exe
5856	powershell.exe
5676	powershell.exe
4340	powershell.exe
2828	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
4256	default.dat.exe
4256	default.dat.exe
4256	default.dat.exe
4256	default.dat.exe
4256	default.dat.exe
4256	default.dat.exe
4256	default.dat.exe
4256	default.dat.exe
4256	default.dat.exe
4256	default.dat.exe
4256	default.dat.exe
4256	default.dat.exe
4256	default.dat.exe
4256	default.dat.exe
4256	default.dat.exe

Executes a command shell one-liner 1 TTPs 12 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2760	cmd.exe
3392	cmd.exe
3320	cmd.exe
1648	cmd.exe
2700	cmd.exe
3564	cmd.exe
2440	cmd.exe
256	cmd.exe
1336	cmd.exe
1996	cmd.exe
5372	cmd.exe
6044	cmd.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
4256	default.dat.exe
4256	default.dat.exe
3596	powershell.exe
3596	powershell.exe
692	powershell.exe
692	powershell.exe
692	powershell.exe
3568	powershell.exe
3568	powershell.exe
3568	powershell.exe
5856	powershell.exe
5856	powershell.exe
5856	powershell.exe
1572	powershell.exe
1572	powershell.exe
1572	powershell.exe
5676	powershell.exe
5676	powershell.exe
5676	powershell.exe
956	powershell.exe
956	powershell.exe
956	powershell.exe
4340	powershell.exe
4340	powershell.exe
4340	powershell.exe
4108	powershell.exe
4108	powershell.exe
4108	powershell.exe
3292	powershell.exe
3292	powershell.exe
3292	powershell.exe
2828	powershell.exe
2828	powershell.exe
2828	powershell.exe
3896	powershell.exe
3896	powershell.exe
3896	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4256	default.dat.exe
Token: SeDebugPrivilege	3596	powershell.exe
Token: SeIncreaseQuotaPrivilege	3596	powershell.exe
Token: SeSecurityPrivilege	3596	powershell.exe
Token: SeTakeOwnershipPrivilege	3596	powershell.exe
Token: SeLoadDriverPrivilege	3596	powershell.exe
Token: SeSystemProfilePrivilege	3596	powershell.exe
Token: SeSystemtimePrivilege	3596	powershell.exe
Token: SeProfSingleProcessPrivilege	3596	powershell.exe
Token: SeIncBasePriorityPrivilege	3596	powershell.exe
Token: SeCreatePagefilePrivilege	3596	powershell.exe
Token: SeBackupPrivilege	3596	powershell.exe
Token: SeRestorePrivilege	3596	powershell.exe
Token: SeShutdownPrivilege	3596	powershell.exe
Token: SeDebugPrivilege	3596	powershell.exe
Token: SeSystemEnvironmentPrivilege	3596	powershell.exe
Token: SeRemoteShutdownPrivilege	3596	powershell.exe
Token: SeUndockPrivilege	3596	powershell.exe
Token: SeManageVolumePrivilege	3596	powershell.exe
Token: 33	3596	powershell.exe
Token: 34	3596	powershell.exe
Token: 35	3596	powershell.exe
Token: 36	3596	powershell.exe
Token: SeDebugPrivilege	692	powershell.exe
Token: SeIncreaseQuotaPrivilege	692	powershell.exe
Token: SeSecurityPrivilege	692	powershell.exe
Token: SeTakeOwnershipPrivilege	692	powershell.exe
Token: SeLoadDriverPrivilege	692	powershell.exe
Token: SeSystemProfilePrivilege	692	powershell.exe
Token: SeSystemtimePrivilege	692	powershell.exe
Token: SeProfSingleProcessPrivilege	692	powershell.exe
Token: SeIncBasePriorityPrivilege	692	powershell.exe
Token: SeCreatePagefilePrivilege	692	powershell.exe
Token: SeBackupPrivilege	692	powershell.exe
Token: SeRestorePrivilege	692	powershell.exe
Token: SeShutdownPrivilege	692	powershell.exe
Token: SeDebugPrivilege	692	powershell.exe
Token: SeSystemEnvironmentPrivilege	692	powershell.exe
Token: SeRemoteShutdownPrivilege	692	powershell.exe
Token: SeUndockPrivilege	692	powershell.exe
Token: SeManageVolumePrivilege	692	powershell.exe
Token: 33	692	powershell.exe
Token: 34	692	powershell.exe
Token: 35	692	powershell.exe
Token: 36	692	powershell.exe
Token: SeDebugPrivilege	3568	powershell.exe
Token: SeIncreaseQuotaPrivilege	3568	powershell.exe
Token: SeSecurityPrivilege	3568	powershell.exe
Token: SeTakeOwnershipPrivilege	3568	powershell.exe
Token: SeLoadDriverPrivilege	3568	powershell.exe
Token: SeSystemProfilePrivilege	3568	powershell.exe
Token: SeSystemtimePrivilege	3568	powershell.exe
Token: SeProfSingleProcessPrivilege	3568	powershell.exe
Token: SeIncBasePriorityPrivilege	3568	powershell.exe
Token: SeCreatePagefilePrivilege	3568	powershell.exe
Token: SeBackupPrivilege	3568	powershell.exe
Token: SeRestorePrivilege	3568	powershell.exe
Token: SeShutdownPrivilege	3568	powershell.exe
Token: SeDebugPrivilege	3568	powershell.exe
Token: SeSystemEnvironmentPrivilege	3568	powershell.exe
Token: SeRemoteShutdownPrivilege	3568	powershell.exe
Token: SeUndockPrivilege	3568	powershell.exe
Token: SeManageVolumePrivilege	3568	powershell.exe
Token: 33	3568	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2516 wrote to memory of 4256	2516	default.dat.exe	89
PID 4256 wrote to memory of 2760	4256	default.dat.exe	90
PID 2760 wrote to memory of 3596	2760	cmd.exe	92
PID 4256 wrote to memory of 3392	4256	default.dat.exe	94
PID 3392 wrote to memory of 692	3392	cmd.exe	96
PID 4256 wrote to memory of 3320	4256	default.dat.exe	97
PID 3320 wrote to memory of 3568	3320	cmd.exe	99
PID 4256 wrote to memory of 2440	4256	default.dat.exe	100
PID 2440 wrote to memory of 5856	2440	cmd.exe	102
PID 4256 wrote to memory of 256	4256	default.dat.exe	103
PID 256 wrote to memory of 1572	256	cmd.exe	105
PID 4256 wrote to memory of 1336	4256	default.dat.exe	106
PID 1336 wrote to memory of 5676	1336	cmd.exe	108
PID 4256 wrote to memory of 1648	4256	default.dat.exe	109
PID 1648 wrote to memory of 956	1648	cmd.exe	111
PID 4256 wrote to memory of 2700	4256	default.dat.exe	112
PID 2700 wrote to memory of 4340	2700	cmd.exe	114
PID 4256 wrote to memory of 1996	4256	default.dat.exe	115
PID 1996 wrote to memory of 4108	1996	cmd.exe	117
PID 4256 wrote to memory of 5372	4256	default.dat.exe	118
PID 5372 wrote to memory of 3292	5372	cmd.exe	120
PID 4256 wrote to memory of 3564	4256	default.dat.exe	121
PID 3564 wrote to memory of 2828	3564	cmd.exe	123
PID 4256 wrote to memory of 6044	4256	default.dat.exe	124
PID 6044 wrote to memory of 3896	6044	cmd.exe	126

C:\Users\Admin\AppData\Local\Temp\default.dat.exe
"C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2516
- C:\Users\Admin\AppData\Local\Temp\default.dat.exe
  "C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4256
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2760
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3596
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\dusunuk'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3392
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\dusunuk'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:692
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3320
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3568
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2440
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5856
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:256
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1572
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1336
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5676
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1648
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:956
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2700
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4340
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1996
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4108
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5372
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3292
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3564
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2828
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6044
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3896

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact