8c6c9763aa586346c2a5a29401d319ef45b737cd4d87c8f786ebc0086ba0ad1f

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 08:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
default.dat.exe
Size 13.6MB
Sample260730-ktbbssfp7z
SHA256 8c6c9763aa586346c2a5a29401d319ef45b737cd4d87c8f786ebc0086ba0ad1f
MD5 074e7aaf96d4a6a89f0233e1a603f935
SHA1 b0a16234fbe002a67cffc2dd5f6273c5d2364689
SHA512 b560041aac315738b84c2d1cf157dde4b5258f9cff5063e1d7833a2cf8d137dd81cc61036c107ed1b92c5ffb43ea3f7470bf5edbec37dc9eafed321b2f668213
SSDEEP 393216:VUeq2GWRwQorZRfIXMCHWUjX8cuI3/PGTAI:VfGWR3ornIXMb8XpH/O7
TLSH
T1DAE6332467D021EBF5B3807CFEE25AE1D29570FA1332C5DF4A9453A26E670C0DD3A626
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4640	powershell.exe
1356	powershell.exe
3272	powershell.exe
1552	powershell.exe
4140	powershell.exe
5200	powershell.exe
6068	powershell.exe
5124	powershell.exe
200	powershell.exe
6140	powershell.exe
4084	powershell.exe
464	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
1108	default.dat.exe
1108	default.dat.exe
1108	default.dat.exe
1108	default.dat.exe
1108	default.dat.exe
1108	default.dat.exe
1108	default.dat.exe
1108	default.dat.exe
1108	default.dat.exe
1108	default.dat.exe
1108	default.dat.exe
1108	default.dat.exe
1108	default.dat.exe
1108	default.dat.exe
1108	default.dat.exe

Executes a command shell one-liner 1 TTPs 12 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4396	cmd.exe
3604	cmd.exe
3120	cmd.exe
5756	cmd.exe
5360	cmd.exe
4844	cmd.exe
1660	cmd.exe
124	cmd.exe
5244	cmd.exe
4176	cmd.exe
1344	cmd.exe
5904	cmd.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
1108	default.dat.exe
1108	default.dat.exe
4084	powershell.exe
4084	powershell.exe
464	powershell.exe
464	powershell.exe
464	powershell.exe
1552	powershell.exe
1552	powershell.exe
1552	powershell.exe
4140	powershell.exe
4140	powershell.exe
4140	powershell.exe
5200	powershell.exe
5200	powershell.exe
5200	powershell.exe
4640	powershell.exe
4640	powershell.exe
4640	powershell.exe
1356	powershell.exe
1356	powershell.exe
1356	powershell.exe
6068	powershell.exe
6068	powershell.exe
6068	powershell.exe
5124	powershell.exe
5124	powershell.exe
5124	powershell.exe
200	powershell.exe
200	powershell.exe
200	powershell.exe
6140	powershell.exe
6140	powershell.exe
6140	powershell.exe
3272	powershell.exe
3272	powershell.exe
3272	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1108	default.dat.exe
Token: SeDebugPrivilege	4084	powershell.exe
Token: SeIncreaseQuotaPrivilege	4084	powershell.exe
Token: SeSecurityPrivilege	4084	powershell.exe
Token: SeTakeOwnershipPrivilege	4084	powershell.exe
Token: SeLoadDriverPrivilege	4084	powershell.exe
Token: SeSystemProfilePrivilege	4084	powershell.exe
Token: SeSystemtimePrivilege	4084	powershell.exe
Token: SeProfSingleProcessPrivilege	4084	powershell.exe
Token: SeIncBasePriorityPrivilege	4084	powershell.exe
Token: SeCreatePagefilePrivilege	4084	powershell.exe
Token: SeBackupPrivilege	4084	powershell.exe
Token: SeRestorePrivilege	4084	powershell.exe
Token: SeShutdownPrivilege	4084	powershell.exe
Token: SeDebugPrivilege	4084	powershell.exe
Token: SeSystemEnvironmentPrivilege	4084	powershell.exe
Token: SeRemoteShutdownPrivilege	4084	powershell.exe
Token: SeUndockPrivilege	4084	powershell.exe
Token: SeManageVolumePrivilege	4084	powershell.exe
Token: 33	4084	powershell.exe
Token: 34	4084	powershell.exe
Token: 35	4084	powershell.exe
Token: 36	4084	powershell.exe
Token: SeDebugPrivilege	464	powershell.exe
Token: SeIncreaseQuotaPrivilege	464	powershell.exe
Token: SeSecurityPrivilege	464	powershell.exe
Token: SeTakeOwnershipPrivilege	464	powershell.exe
Token: SeLoadDriverPrivilege	464	powershell.exe
Token: SeSystemProfilePrivilege	464	powershell.exe
Token: SeSystemtimePrivilege	464	powershell.exe
Token: SeProfSingleProcessPrivilege	464	powershell.exe
Token: SeIncBasePriorityPrivilege	464	powershell.exe
Token: SeCreatePagefilePrivilege	464	powershell.exe
Token: SeBackupPrivilege	464	powershell.exe
Token: SeRestorePrivilege	464	powershell.exe
Token: SeShutdownPrivilege	464	powershell.exe
Token: SeDebugPrivilege	464	powershell.exe
Token: SeSystemEnvironmentPrivilege	464	powershell.exe
Token: SeRemoteShutdownPrivilege	464	powershell.exe
Token: SeUndockPrivilege	464	powershell.exe
Token: SeManageVolumePrivilege	464	powershell.exe
Token: 33	464	powershell.exe
Token: 34	464	powershell.exe
Token: 35	464	powershell.exe
Token: 36	464	powershell.exe
Token: SeDebugPrivilege	1552	powershell.exe
Token: SeIncreaseQuotaPrivilege	1552	powershell.exe
Token: SeSecurityPrivilege	1552	powershell.exe
Token: SeTakeOwnershipPrivilege	1552	powershell.exe
Token: SeLoadDriverPrivilege	1552	powershell.exe
Token: SeSystemProfilePrivilege	1552	powershell.exe
Token: SeSystemtimePrivilege	1552	powershell.exe
Token: SeProfSingleProcessPrivilege	1552	powershell.exe
Token: SeIncBasePriorityPrivilege	1552	powershell.exe
Token: SeCreatePagefilePrivilege	1552	powershell.exe
Token: SeBackupPrivilege	1552	powershell.exe
Token: SeRestorePrivilege	1552	powershell.exe
Token: SeShutdownPrivilege	1552	powershell.exe
Token: SeDebugPrivilege	1552	powershell.exe
Token: SeSystemEnvironmentPrivilege	1552	powershell.exe
Token: SeRemoteShutdownPrivilege	1552	powershell.exe
Token: SeUndockPrivilege	1552	powershell.exe
Token: SeManageVolumePrivilege	1552	powershell.exe
Token: 33	1552	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 800 wrote to memory of 1108	800	default.dat.exe	89
PID 1108 wrote to memory of 4396	1108	default.dat.exe	90
PID 4396 wrote to memory of 4084	4396	cmd.exe	92
PID 1108 wrote to memory of 3604	1108	default.dat.exe	94
PID 3604 wrote to memory of 464	3604	cmd.exe	96
PID 1108 wrote to memory of 5244	1108	default.dat.exe	97
PID 5244 wrote to memory of 1552	5244	cmd.exe	99
PID 1108 wrote to memory of 3120	1108	default.dat.exe	100
PID 3120 wrote to memory of 4140	3120	cmd.exe	102
PID 1108 wrote to memory of 4176	1108	default.dat.exe	103
PID 4176 wrote to memory of 5200	4176	cmd.exe	105
PID 1108 wrote to memory of 5756	1108	default.dat.exe	106
PID 5756 wrote to memory of 4640	5756	cmd.exe	108
PID 1108 wrote to memory of 1344	1108	default.dat.exe	109
PID 1344 wrote to memory of 1356	1344	cmd.exe	111
PID 1108 wrote to memory of 5904	1108	default.dat.exe	112
PID 5904 wrote to memory of 6068	5904	cmd.exe	114
PID 1108 wrote to memory of 5360	1108	default.dat.exe	115
PID 5360 wrote to memory of 5124	5360	cmd.exe	117
PID 1108 wrote to memory of 4844	1108	default.dat.exe	118
PID 4844 wrote to memory of 200	4844	cmd.exe	120
PID 1108 wrote to memory of 1660	1108	default.dat.exe	121
PID 1660 wrote to memory of 6140	1660	cmd.exe	123
PID 1108 wrote to memory of 124	1108	default.dat.exe	124
PID 124 wrote to memory of 3272	124	cmd.exe	126

C:\Users\Admin\AppData\Local\Temp\default.dat.exe
"C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:800
- C:\Users\Admin\AppData\Local\Temp\default.dat.exe
  "C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1108
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4396
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4084
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\mimiles'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3604
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\mimiles'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5244
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1552
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3120
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4140
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4176
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5200
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5756
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4640
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1344
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1356
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5904
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:6068
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5360
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4844
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:200
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1660
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:6140
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:124
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3272

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact