366e52b6d95d9478a73ffcd659a1807bdea901a0737b7b2532fe11145be03925

Analysis

max time kernel
149s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 01:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
default.dat.exe
Size 13.6MB
Sample260723-can5jszakd
SHA256 366e52b6d95d9478a73ffcd659a1807bdea901a0737b7b2532fe11145be03925
MD5 a20052c78501ce91feba8ce56a3aa665
SHA1 18b3741afc2712dafb56505b1c1822372b35cc0b
SHA512 555e208c115334068f8aa92e2d4772da5555744b3c3b18d655054cebe8aaaeaba3e46a35ab70b316802d3abf196d92b15832525a4c12de91869474e04e033811
SSDEEP 393216:zupEl/NSiZOZcjsSAWWXMCHWUjXZcuI3/PGTAI:zus/NSisejsSAWWXMb8XuH/O7
TLSH
T1A8E63308A6E041FEE9B241BDEDD161C2E4A1B4F64B76C5EF0B449B611D132E1C83EB63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3856	powershell.exe
6100	powershell.exe
4164	powershell.exe
4320	powershell.exe
4284	powershell.exe
2508	powershell.exe
4124	powershell.exe
3012	powershell.exe
4324	powershell.exe
1992	powershell.exe
5908	powershell.exe
3676	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
2912	default.dat.exe
2912	default.dat.exe
2912	default.dat.exe
2912	default.dat.exe
2912	default.dat.exe
2912	default.dat.exe
2912	default.dat.exe
2912	default.dat.exe
2912	default.dat.exe
2912	default.dat.exe
2912	default.dat.exe
2912	default.dat.exe
2912	default.dat.exe
2912	default.dat.exe
2912	default.dat.exe

Executes a command shell one-liner 1 TTPs 12 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5364	cmd.exe
5160	cmd.exe
5320	cmd.exe
1780	cmd.exe
4848	cmd.exe
6116	cmd.exe
2388	cmd.exe
3440	cmd.exe
2964	cmd.exe
5984	cmd.exe
616	cmd.exe
4984	cmd.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
2912	default.dat.exe
2912	default.dat.exe
3856	powershell.exe
3856	powershell.exe
4324	powershell.exe
4324	powershell.exe
4324	powershell.exe
6100	powershell.exe
6100	powershell.exe
6100	powershell.exe
1992	powershell.exe
1992	powershell.exe
1992	powershell.exe
4164	powershell.exe
4164	powershell.exe
4164	powershell.exe
4320	powershell.exe
4320	powershell.exe
4320	powershell.exe
4284	powershell.exe
4284	powershell.exe
4284	powershell.exe
5908	powershell.exe
5908	powershell.exe
5908	powershell.exe
2508	powershell.exe
2508	powershell.exe
2508	powershell.exe
4124	powershell.exe
4124	powershell.exe
4124	powershell.exe
3012	powershell.exe
3012	powershell.exe
3012	powershell.exe
3676	powershell.exe
3676	powershell.exe
3676	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2912	default.dat.exe
Token: SeDebugPrivilege	3856	powershell.exe
Token: SeIncreaseQuotaPrivilege	3856	powershell.exe
Token: SeSecurityPrivilege	3856	powershell.exe
Token: SeTakeOwnershipPrivilege	3856	powershell.exe
Token: SeLoadDriverPrivilege	3856	powershell.exe
Token: SeSystemProfilePrivilege	3856	powershell.exe
Token: SeSystemtimePrivilege	3856	powershell.exe
Token: SeProfSingleProcessPrivilege	3856	powershell.exe
Token: SeIncBasePriorityPrivilege	3856	powershell.exe
Token: SeCreatePagefilePrivilege	3856	powershell.exe
Token: SeBackupPrivilege	3856	powershell.exe
Token: SeRestorePrivilege	3856	powershell.exe
Token: SeShutdownPrivilege	3856	powershell.exe
Token: SeDebugPrivilege	3856	powershell.exe
Token: SeSystemEnvironmentPrivilege	3856	powershell.exe
Token: SeRemoteShutdownPrivilege	3856	powershell.exe
Token: SeUndockPrivilege	3856	powershell.exe
Token: SeManageVolumePrivilege	3856	powershell.exe
Token: 33	3856	powershell.exe
Token: 34	3856	powershell.exe
Token: 35	3856	powershell.exe
Token: 36	3856	powershell.exe
Token: SeDebugPrivilege	4324	powershell.exe
Token: SeIncreaseQuotaPrivilege	4324	powershell.exe
Token: SeSecurityPrivilege	4324	powershell.exe
Token: SeTakeOwnershipPrivilege	4324	powershell.exe
Token: SeLoadDriverPrivilege	4324	powershell.exe
Token: SeSystemProfilePrivilege	4324	powershell.exe
Token: SeSystemtimePrivilege	4324	powershell.exe
Token: SeProfSingleProcessPrivilege	4324	powershell.exe
Token: SeIncBasePriorityPrivilege	4324	powershell.exe
Token: SeCreatePagefilePrivilege	4324	powershell.exe
Token: SeBackupPrivilege	4324	powershell.exe
Token: SeRestorePrivilege	4324	powershell.exe
Token: SeShutdownPrivilege	4324	powershell.exe
Token: SeDebugPrivilege	4324	powershell.exe
Token: SeSystemEnvironmentPrivilege	4324	powershell.exe
Token: SeRemoteShutdownPrivilege	4324	powershell.exe
Token: SeUndockPrivilege	4324	powershell.exe
Token: SeManageVolumePrivilege	4324	powershell.exe
Token: 33	4324	powershell.exe
Token: 34	4324	powershell.exe
Token: 35	4324	powershell.exe
Token: 36	4324	powershell.exe
Token: SeDebugPrivilege	6100	powershell.exe
Token: SeIncreaseQuotaPrivilege	6100	powershell.exe
Token: SeSecurityPrivilege	6100	powershell.exe
Token: SeTakeOwnershipPrivilege	6100	powershell.exe
Token: SeLoadDriverPrivilege	6100	powershell.exe
Token: SeSystemProfilePrivilege	6100	powershell.exe
Token: SeSystemtimePrivilege	6100	powershell.exe
Token: SeProfSingleProcessPrivilege	6100	powershell.exe
Token: SeIncBasePriorityPrivilege	6100	powershell.exe
Token: SeCreatePagefilePrivilege	6100	powershell.exe
Token: SeBackupPrivilege	6100	powershell.exe
Token: SeRestorePrivilege	6100	powershell.exe
Token: SeShutdownPrivilege	6100	powershell.exe
Token: SeDebugPrivilege	6100	powershell.exe
Token: SeSystemEnvironmentPrivilege	6100	powershell.exe
Token: SeRemoteShutdownPrivilege	6100	powershell.exe
Token: SeUndockPrivilege	6100	powershell.exe
Token: SeManageVolumePrivilege	6100	powershell.exe
Token: 33	6100	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 3284 wrote to memory of 2912	3284	default.dat.exe	88
PID 2912 wrote to memory of 3440	2912	default.dat.exe	89
PID 3440 wrote to memory of 3856	3440	cmd.exe	91
PID 2912 wrote to memory of 5160	2912	default.dat.exe	93
PID 5160 wrote to memory of 4324	5160	cmd.exe	95
PID 2912 wrote to memory of 2964	2912	default.dat.exe	96
PID 2964 wrote to memory of 6100	2964	cmd.exe	98
PID 2912 wrote to memory of 5984	2912	default.dat.exe	99
PID 5984 wrote to memory of 1992	5984	cmd.exe	101
PID 2912 wrote to memory of 5320	2912	default.dat.exe	102
PID 5320 wrote to memory of 4164	5320	cmd.exe	104
PID 2912 wrote to memory of 616	2912	default.dat.exe	105
PID 616 wrote to memory of 4320	616	cmd.exe	107
PID 2912 wrote to memory of 1780	2912	default.dat.exe	108
PID 1780 wrote to memory of 4284	1780	cmd.exe	110
PID 2912 wrote to memory of 4984	2912	default.dat.exe	111
PID 4984 wrote to memory of 5908	4984	cmd.exe	113
PID 2912 wrote to memory of 5364	2912	default.dat.exe	114
PID 5364 wrote to memory of 2508	5364	cmd.exe	116
PID 2912 wrote to memory of 4848	2912	default.dat.exe	117
PID 4848 wrote to memory of 4124	4848	cmd.exe	119
PID 2912 wrote to memory of 6116	2912	default.dat.exe	120
PID 6116 wrote to memory of 3012	6116	cmd.exe	122
PID 2912 wrote to memory of 2388	2912	default.dat.exe	123
PID 2388 wrote to memory of 3676	2388	cmd.exe	125

C:\Users\Admin\AppData\Local\Temp\default.dat.exe
"C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3284
- C:\Users\Admin\AppData\Local\Temp\default.dat.exe
  "C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2912
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3440
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3856
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\bihutap'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5160
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\bihutap'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4324
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2964
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:6100
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5984
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1992
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5320
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4164
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:616
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4320
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1780
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4284
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4984
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5908
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5364
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2508
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4848
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6116
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3012
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2388
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3676

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact