fbe8582b193be1657f0576d7435763d426cf4bff6661b081a3bf75462d7477dc

Analysis

max time kernel
150s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 07:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
default.dat.exe
Size 13.6MB
Sample260730-jq71xsxthv
SHA256 fbe8582b193be1657f0576d7435763d426cf4bff6661b081a3bf75462d7477dc
MD5 c19c39bfb745bd7d584ddf9cd937d6a0
SHA1 61ab1c7c4e9e773ccb73d80590eb7e9710d8a14b
SHA512 5595ca97c12a4f78a6cb8072db6b63d34d3d14813d09c0e61b332fea2c88b225afd28e0dfbb26261030adee59e409eb5de37060f8e0ecd26fe0b8b2353ee3dac
SSDEEP 393216:emmn1EohNC8K4y4UofgjExFGjdXMCHWUjX/cuI3/PGTAI:emm1PhK4y4UoIjwFiXMb8XUH/O7
TLSH
T196E633986AD001FDD6B3113CADE626ADE47C70A60B32CED76B6893641D531D08D3EE27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4800	powershell.exe
1068	powershell.exe
4556	powershell.exe
4956	powershell.exe
5688	powershell.exe
1500	powershell.exe
2516	powershell.exe
1532	powershell.exe
5076	powershell.exe
2612	powershell.exe
3124	powershell.exe
508	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
4948	default.dat.exe
4948	default.dat.exe
4948	default.dat.exe
4948	default.dat.exe
4948	default.dat.exe
4948	default.dat.exe
4948	default.dat.exe
4948	default.dat.exe
4948	default.dat.exe
4948	default.dat.exe
4948	default.dat.exe
4948	default.dat.exe
4948	default.dat.exe
4948	default.dat.exe
4948	default.dat.exe

Executes a command shell one-liner 1 TTPs 12 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3968	cmd.exe
2008	cmd.exe
4364	cmd.exe
2832	cmd.exe
1492	cmd.exe
2596	cmd.exe
5344	cmd.exe
1216	cmd.exe
4132	cmd.exe
4936	cmd.exe
3424	cmd.exe
4348	cmd.exe

Suspicious behavior: EnumeratesProcesses 38 IoCs

pid	Process
4948	default.dat.exe
4948	default.dat.exe
2612	powershell.exe
2612	powershell.exe
2612	powershell.exe
4556	powershell.exe
4556	powershell.exe
4556	powershell.exe
4956	powershell.exe
4956	powershell.exe
4956	powershell.exe
3124	powershell.exe
3124	powershell.exe
3124	powershell.exe
5688	powershell.exe
5688	powershell.exe
5688	powershell.exe
1500	powershell.exe
1500	powershell.exe
1500	powershell.exe
508	powershell.exe
508	powershell.exe
508	powershell.exe
4800	powershell.exe
4800	powershell.exe
4800	powershell.exe
1068	powershell.exe
1068	powershell.exe
1068	powershell.exe
2516	powershell.exe
2516	powershell.exe
2516	powershell.exe
1532	powershell.exe
1532	powershell.exe
1532	powershell.exe
5076	powershell.exe
5076	powershell.exe
5076	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4948	default.dat.exe
Token: SeDebugPrivilege	2612	powershell.exe
Token: SeIncreaseQuotaPrivilege	2612	powershell.exe
Token: SeSecurityPrivilege	2612	powershell.exe
Token: SeTakeOwnershipPrivilege	2612	powershell.exe
Token: SeLoadDriverPrivilege	2612	powershell.exe
Token: SeSystemProfilePrivilege	2612	powershell.exe
Token: SeSystemtimePrivilege	2612	powershell.exe
Token: SeProfSingleProcessPrivilege	2612	powershell.exe
Token: SeIncBasePriorityPrivilege	2612	powershell.exe
Token: SeCreatePagefilePrivilege	2612	powershell.exe
Token: SeBackupPrivilege	2612	powershell.exe
Token: SeRestorePrivilege	2612	powershell.exe
Token: SeShutdownPrivilege	2612	powershell.exe
Token: SeDebugPrivilege	2612	powershell.exe
Token: SeSystemEnvironmentPrivilege	2612	powershell.exe
Token: SeRemoteShutdownPrivilege	2612	powershell.exe
Token: SeUndockPrivilege	2612	powershell.exe
Token: SeManageVolumePrivilege	2612	powershell.exe
Token: 33	2612	powershell.exe
Token: 34	2612	powershell.exe
Token: 35	2612	powershell.exe
Token: 36	2612	powershell.exe
Token: SeDebugPrivilege	4556	powershell.exe
Token: SeIncreaseQuotaPrivilege	4556	powershell.exe
Token: SeSecurityPrivilege	4556	powershell.exe
Token: SeTakeOwnershipPrivilege	4556	powershell.exe
Token: SeLoadDriverPrivilege	4556	powershell.exe
Token: SeSystemProfilePrivilege	4556	powershell.exe
Token: SeSystemtimePrivilege	4556	powershell.exe
Token: SeProfSingleProcessPrivilege	4556	powershell.exe
Token: SeIncBasePriorityPrivilege	4556	powershell.exe
Token: SeCreatePagefilePrivilege	4556	powershell.exe
Token: SeBackupPrivilege	4556	powershell.exe
Token: SeRestorePrivilege	4556	powershell.exe
Token: SeShutdownPrivilege	4556	powershell.exe
Token: SeDebugPrivilege	4556	powershell.exe
Token: SeSystemEnvironmentPrivilege	4556	powershell.exe
Token: SeRemoteShutdownPrivilege	4556	powershell.exe
Token: SeUndockPrivilege	4556	powershell.exe
Token: SeManageVolumePrivilege	4556	powershell.exe
Token: 33	4556	powershell.exe
Token: 34	4556	powershell.exe
Token: 35	4556	powershell.exe
Token: 36	4556	powershell.exe
Token: SeDebugPrivilege	4956	powershell.exe
Token: SeIncreaseQuotaPrivilege	4956	powershell.exe
Token: SeSecurityPrivilege	4956	powershell.exe
Token: SeTakeOwnershipPrivilege	4956	powershell.exe
Token: SeLoadDriverPrivilege	4956	powershell.exe
Token: SeSystemProfilePrivilege	4956	powershell.exe
Token: SeSystemtimePrivilege	4956	powershell.exe
Token: SeProfSingleProcessPrivilege	4956	powershell.exe
Token: SeIncBasePriorityPrivilege	4956	powershell.exe
Token: SeCreatePagefilePrivilege	4956	powershell.exe
Token: SeBackupPrivilege	4956	powershell.exe
Token: SeRestorePrivilege	4956	powershell.exe
Token: SeShutdownPrivilege	4956	powershell.exe
Token: SeDebugPrivilege	4956	powershell.exe
Token: SeSystemEnvironmentPrivilege	4956	powershell.exe
Token: SeRemoteShutdownPrivilege	4956	powershell.exe
Token: SeUndockPrivilege	4956	powershell.exe
Token: SeManageVolumePrivilege	4956	powershell.exe
Token: 33	4956	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4300 wrote to memory of 4948	4300	default.dat.exe	90
PID 4948 wrote to memory of 3424	4948	default.dat.exe	91
PID 3424 wrote to memory of 2612	3424	cmd.exe	93
PID 4948 wrote to memory of 2832	4948	default.dat.exe	95
PID 2832 wrote to memory of 4556	2832	cmd.exe	97
PID 4948 wrote to memory of 4348	4948	default.dat.exe	98
PID 4348 wrote to memory of 4956	4348	cmd.exe	100
PID 4948 wrote to memory of 1492	4948	default.dat.exe	101
PID 1492 wrote to memory of 3124	1492	cmd.exe	103
PID 4948 wrote to memory of 2596	4948	default.dat.exe	104
PID 2596 wrote to memory of 5688	2596	cmd.exe	106
PID 4948 wrote to memory of 3968	4948	default.dat.exe	107
PID 3968 wrote to memory of 1500	3968	cmd.exe	109
PID 4948 wrote to memory of 5344	4948	default.dat.exe	110
PID 5344 wrote to memory of 508	5344	cmd.exe	112
PID 4948 wrote to memory of 1216	4948	default.dat.exe	113
PID 1216 wrote to memory of 4800	1216	cmd.exe	115
PID 4948 wrote to memory of 4132	4948	default.dat.exe	116
PID 4132 wrote to memory of 1068	4132	cmd.exe	118
PID 4948 wrote to memory of 2008	4948	default.dat.exe	119
PID 2008 wrote to memory of 2516	2008	cmd.exe	121
PID 4948 wrote to memory of 4364	4948	default.dat.exe	122
PID 4364 wrote to memory of 1532	4364	cmd.exe	124
PID 4948 wrote to memory of 4936	4948	default.dat.exe	125
PID 4936 wrote to memory of 5076	4936	cmd.exe	127

C:\Users\Admin\AppData\Local\Temp\default.dat.exe
"C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4300
- C:\Users\Admin\AppData\Local\Temp\default.dat.exe
  "C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4948
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3424
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2612
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\mimiles'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2832
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\mimiles'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4556
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4348
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4956
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1492
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2596
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5688
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3968
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1500
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5344
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:508
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1216
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4800
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4132
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1068
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2008
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2516
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4364
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1532
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4936
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5076

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact