56091719eeba4881f3db1f837feaa9d47a5a275bff6218186d97614e252e6d21

Analysis

max time kernel
150s
max time network
118s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 02:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
default.dat.exe
Size 13.6MB
Sample260723-dc1rssvxdx
SHA256 56091719eeba4881f3db1f837feaa9d47a5a275bff6218186d97614e252e6d21
MD5 9f3955f8be35326246e2551754bd6d5e
SHA1 432375fba1147d8880a98b149fe7f8f2e4f78d1a
SHA512 abd9ea25fcb9b9c542550f964375557d3e8a9e6696b5a3530103d42f8fbfec8fb49c87f244e9ed140a4974541bbcd2dd29aad01a8cc16c4cb18f12d952fbcafe
SSDEEP 393216:nqU8Ms95fojtvz7q1IaKt9m3vXMCHWUjXDcuI3/PGTAI:nqXrfo5rm1Jam/XMb8XgH/O7
TLSH
T111E63328ABE011EFF5B3827CDEE215E1E571B0369B72C5CB576493652E032F08D3961A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1608	powershell.exe
4216	powershell.exe
3516	powershell.exe
5916	powershell.exe
1500	powershell.exe
5780	powershell.exe
3372	powershell.exe
2368	powershell.exe
3436	powershell.exe
3888	powershell.exe
5464	powershell.exe
2544	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
3536	default.dat.exe
3536	default.dat.exe
3536	default.dat.exe
3536	default.dat.exe
3536	default.dat.exe
3536	default.dat.exe
3536	default.dat.exe
3536	default.dat.exe
3536	default.dat.exe
3536	default.dat.exe
3536	default.dat.exe
3536	default.dat.exe
3536	default.dat.exe
3536	default.dat.exe
3536	default.dat.exe

Executes a command shell one-liner 1 TTPs 12 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2476	cmd.exe
1448	cmd.exe
1096	cmd.exe
4388	cmd.exe
3268	cmd.exe
3088	cmd.exe
4248	cmd.exe
4192	cmd.exe
2416	cmd.exe
5656	cmd.exe
2960	cmd.exe
4788	cmd.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
3536	default.dat.exe
3536	default.dat.exe
3516	powershell.exe
3516	powershell.exe
5916	powershell.exe
5916	powershell.exe
1500	powershell.exe
1500	powershell.exe
5780	powershell.exe
5780	powershell.exe
3372	powershell.exe
3372	powershell.exe
3888	powershell.exe
3888	powershell.exe
2368	powershell.exe
2368	powershell.exe
5464	powershell.exe
5464	powershell.exe
2544	powershell.exe
2544	powershell.exe
3436	powershell.exe
3436	powershell.exe
1608	powershell.exe
1608	powershell.exe
4216	powershell.exe
4216	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3536	default.dat.exe
Token: SeDebugPrivilege	3516	powershell.exe
Token: SeIncreaseQuotaPrivilege	3516	powershell.exe
Token: SeSecurityPrivilege	3516	powershell.exe
Token: SeTakeOwnershipPrivilege	3516	powershell.exe
Token: SeLoadDriverPrivilege	3516	powershell.exe
Token: SeSystemProfilePrivilege	3516	powershell.exe
Token: SeSystemtimePrivilege	3516	powershell.exe
Token: SeProfSingleProcessPrivilege	3516	powershell.exe
Token: SeIncBasePriorityPrivilege	3516	powershell.exe
Token: SeCreatePagefilePrivilege	3516	powershell.exe
Token: SeBackupPrivilege	3516	powershell.exe
Token: SeRestorePrivilege	3516	powershell.exe
Token: SeShutdownPrivilege	3516	powershell.exe
Token: SeDebugPrivilege	3516	powershell.exe
Token: SeSystemEnvironmentPrivilege	3516	powershell.exe
Token: SeRemoteShutdownPrivilege	3516	powershell.exe
Token: SeUndockPrivilege	3516	powershell.exe
Token: SeManageVolumePrivilege	3516	powershell.exe
Token: 33	3516	powershell.exe
Token: 34	3516	powershell.exe
Token: 35	3516	powershell.exe
Token: 36	3516	powershell.exe
Token: SeDebugPrivilege	5916	powershell.exe
Token: SeIncreaseQuotaPrivilege	5916	powershell.exe
Token: SeSecurityPrivilege	5916	powershell.exe
Token: SeTakeOwnershipPrivilege	5916	powershell.exe
Token: SeLoadDriverPrivilege	5916	powershell.exe
Token: SeSystemProfilePrivilege	5916	powershell.exe
Token: SeSystemtimePrivilege	5916	powershell.exe
Token: SeProfSingleProcessPrivilege	5916	powershell.exe
Token: SeIncBasePriorityPrivilege	5916	powershell.exe
Token: SeCreatePagefilePrivilege	5916	powershell.exe
Token: SeBackupPrivilege	5916	powershell.exe
Token: SeRestorePrivilege	5916	powershell.exe
Token: SeShutdownPrivilege	5916	powershell.exe
Token: SeDebugPrivilege	5916	powershell.exe
Token: SeSystemEnvironmentPrivilege	5916	powershell.exe
Token: SeRemoteShutdownPrivilege	5916	powershell.exe
Token: SeUndockPrivilege	5916	powershell.exe
Token: SeManageVolumePrivilege	5916	powershell.exe
Token: 33	5916	powershell.exe
Token: 34	5916	powershell.exe
Token: 35	5916	powershell.exe
Token: 36	5916	powershell.exe
Token: SeDebugPrivilege	1500	powershell.exe
Token: SeIncreaseQuotaPrivilege	1500	powershell.exe
Token: SeSecurityPrivilege	1500	powershell.exe
Token: SeTakeOwnershipPrivilege	1500	powershell.exe
Token: SeLoadDriverPrivilege	1500	powershell.exe
Token: SeSystemProfilePrivilege	1500	powershell.exe
Token: SeSystemtimePrivilege	1500	powershell.exe
Token: SeProfSingleProcessPrivilege	1500	powershell.exe
Token: SeIncBasePriorityPrivilege	1500	powershell.exe
Token: SeCreatePagefilePrivilege	1500	powershell.exe
Token: SeBackupPrivilege	1500	powershell.exe
Token: SeRestorePrivilege	1500	powershell.exe
Token: SeShutdownPrivilege	1500	powershell.exe
Token: SeDebugPrivilege	1500	powershell.exe
Token: SeSystemEnvironmentPrivilege	1500	powershell.exe
Token: SeRemoteShutdownPrivilege	1500	powershell.exe
Token: SeUndockPrivilege	1500	powershell.exe
Token: SeManageVolumePrivilege	1500	powershell.exe
Token: 33	1500	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 3248 wrote to memory of 3536	3248	default.dat.exe	89
PID 3536 wrote to memory of 5656	3536	default.dat.exe	90
PID 5656 wrote to memory of 3516	5656	cmd.exe	92
PID 3536 wrote to memory of 3268	3536	default.dat.exe	94
PID 3268 wrote to memory of 5916	3268	cmd.exe	96
PID 3536 wrote to memory of 3088	3536	default.dat.exe	97
PID 3088 wrote to memory of 1500	3088	cmd.exe	99
PID 3536 wrote to memory of 2960	3536	default.dat.exe	100
PID 2960 wrote to memory of 5780	2960	cmd.exe	102
PID 3536 wrote to memory of 4248	3536	default.dat.exe	103
PID 4248 wrote to memory of 3372	4248	cmd.exe	105
PID 3536 wrote to memory of 4788	3536	default.dat.exe	106
PID 4788 wrote to memory of 3888	4788	cmd.exe	108
PID 3536 wrote to memory of 2476	3536	default.dat.exe	109
PID 2476 wrote to memory of 2368	2476	cmd.exe	111
PID 3536 wrote to memory of 1448	3536	default.dat.exe	112
PID 1448 wrote to memory of 5464	1448	cmd.exe	114
PID 3536 wrote to memory of 1096	3536	default.dat.exe	115
PID 1096 wrote to memory of 2544	1096	cmd.exe	117
PID 3536 wrote to memory of 4192	3536	default.dat.exe	118
PID 4192 wrote to memory of 3436	4192	cmd.exe	120
PID 3536 wrote to memory of 2416	3536	default.dat.exe	121
PID 2416 wrote to memory of 1608	2416	cmd.exe	123
PID 3536 wrote to memory of 4388	3536	default.dat.exe	124
PID 4388 wrote to memory of 4216	4388	cmd.exe	126

C:\Users\Admin\AppData\Local\Temp\default.dat.exe
"C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3248
- C:\Users\Admin\AppData\Local\Temp\default.dat.exe
  "C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3536
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5656
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3516
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\bihutap'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3268
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\bihutap'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5916
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3088
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1500
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2960
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5780
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4248
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3372
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4788
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3888
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2476
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2368
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1448
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1096
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2544
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4192
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3436
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2416
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1608
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4388
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4216

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact