4c3084e6f337e867f335f4b04937350f150e82888f391ca63427f8eafa76c978

Analysis

max time kernel
149s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 11:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
default.dat.exe
Size 13.6MB
Sample260730-n2hydsxajd
SHA256 4c3084e6f337e867f335f4b04937350f150e82888f391ca63427f8eafa76c978
MD5 29e642bacb450b90b4d54e26ec5fb5d7
SHA1 d56030b16c703001cf6525387afe3afe8d4067c3
SHA512 f8d2e1ae8ce8401d54630153aa5d31a686d287728ffbc767459b3468c52497529b748f120f332479468a1cb538725afc023f2ec84297870f55384eb5ba72b1f6
SSDEEP 393216:rVJOs6KFgvKqbAx6LsyXMCHWUjXscuI3/PGTAI:rDYKKZsx6LpXMb8X5H/O7
TLSH
T1C9E6334499E822FDF73BC13AD9D19696D462B0B24732C5DB93B842A16D233E18E3D713
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3156	powershell.exe
2784	powershell.exe
1668	powershell.exe
1848	powershell.exe
5900	powershell.exe
4620	powershell.exe
3348	powershell.exe
6056	powershell.exe
3580	powershell.exe
1312	powershell.exe
3416	powershell.exe
5744	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
3300	default.dat.exe
3300	default.dat.exe
3300	default.dat.exe
3300	default.dat.exe
3300	default.dat.exe
3300	default.dat.exe
3300	default.dat.exe
3300	default.dat.exe
3300	default.dat.exe
3300	default.dat.exe
3300	default.dat.exe
3300	default.dat.exe
3300	default.dat.exe
3300	default.dat.exe
3300	default.dat.exe

Executes a command shell one-liner 1 TTPs 12 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3192	cmd.exe
5512	cmd.exe
3260	cmd.exe
5428	cmd.exe
2904	cmd.exe
5820	cmd.exe
1828	cmd.exe
4316	cmd.exe
5656	cmd.exe
3648	cmd.exe
4996	cmd.exe
2120	cmd.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
3300	default.dat.exe
3300	default.dat.exe
3156	powershell.exe
3156	powershell.exe
3348	powershell.exe
3348	powershell.exe
6056	powershell.exe
6056	powershell.exe
2784	powershell.exe
2784	powershell.exe
3580	powershell.exe
3580	powershell.exe
3580	powershell.exe
1668	powershell.exe
1668	powershell.exe
1668	powershell.exe
1848	powershell.exe
1848	powershell.exe
1848	powershell.exe
5900	powershell.exe
5900	powershell.exe
5900	powershell.exe
1312	powershell.exe
1312	powershell.exe
1312	powershell.exe
4620	powershell.exe
4620	powershell.exe
4620	powershell.exe
3416	powershell.exe
3416	powershell.exe
3416	powershell.exe
5744	powershell.exe
5744	powershell.exe
5744	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3300	default.dat.exe
Token: SeDebugPrivilege	3156	powershell.exe
Token: SeIncreaseQuotaPrivilege	3156	powershell.exe
Token: SeSecurityPrivilege	3156	powershell.exe
Token: SeTakeOwnershipPrivilege	3156	powershell.exe
Token: SeLoadDriverPrivilege	3156	powershell.exe
Token: SeSystemProfilePrivilege	3156	powershell.exe
Token: SeSystemtimePrivilege	3156	powershell.exe
Token: SeProfSingleProcessPrivilege	3156	powershell.exe
Token: SeIncBasePriorityPrivilege	3156	powershell.exe
Token: SeCreatePagefilePrivilege	3156	powershell.exe
Token: SeBackupPrivilege	3156	powershell.exe
Token: SeRestorePrivilege	3156	powershell.exe
Token: SeShutdownPrivilege	3156	powershell.exe
Token: SeDebugPrivilege	3156	powershell.exe
Token: SeSystemEnvironmentPrivilege	3156	powershell.exe
Token: SeRemoteShutdownPrivilege	3156	powershell.exe
Token: SeUndockPrivilege	3156	powershell.exe
Token: SeManageVolumePrivilege	3156	powershell.exe
Token: 33	3156	powershell.exe
Token: 34	3156	powershell.exe
Token: 35	3156	powershell.exe
Token: 36	3156	powershell.exe
Token: SeDebugPrivilege	3348	powershell.exe
Token: SeIncreaseQuotaPrivilege	3348	powershell.exe
Token: SeSecurityPrivilege	3348	powershell.exe
Token: SeTakeOwnershipPrivilege	3348	powershell.exe
Token: SeLoadDriverPrivilege	3348	powershell.exe
Token: SeSystemProfilePrivilege	3348	powershell.exe
Token: SeSystemtimePrivilege	3348	powershell.exe
Token: SeProfSingleProcessPrivilege	3348	powershell.exe
Token: SeIncBasePriorityPrivilege	3348	powershell.exe
Token: SeCreatePagefilePrivilege	3348	powershell.exe
Token: SeBackupPrivilege	3348	powershell.exe
Token: SeRestorePrivilege	3348	powershell.exe
Token: SeShutdownPrivilege	3348	powershell.exe
Token: SeDebugPrivilege	3348	powershell.exe
Token: SeSystemEnvironmentPrivilege	3348	powershell.exe
Token: SeRemoteShutdownPrivilege	3348	powershell.exe
Token: SeUndockPrivilege	3348	powershell.exe
Token: SeManageVolumePrivilege	3348	powershell.exe
Token: 33	3348	powershell.exe
Token: 34	3348	powershell.exe
Token: 35	3348	powershell.exe
Token: 36	3348	powershell.exe
Token: SeDebugPrivilege	6056	powershell.exe
Token: SeIncreaseQuotaPrivilege	6056	powershell.exe
Token: SeSecurityPrivilege	6056	powershell.exe
Token: SeTakeOwnershipPrivilege	6056	powershell.exe
Token: SeLoadDriverPrivilege	6056	powershell.exe
Token: SeSystemProfilePrivilege	6056	powershell.exe
Token: SeSystemtimePrivilege	6056	powershell.exe
Token: SeProfSingleProcessPrivilege	6056	powershell.exe
Token: SeIncBasePriorityPrivilege	6056	powershell.exe
Token: SeCreatePagefilePrivilege	6056	powershell.exe
Token: SeBackupPrivilege	6056	powershell.exe
Token: SeRestorePrivilege	6056	powershell.exe
Token: SeShutdownPrivilege	6056	powershell.exe
Token: SeDebugPrivilege	6056	powershell.exe
Token: SeSystemEnvironmentPrivilege	6056	powershell.exe
Token: SeRemoteShutdownPrivilege	6056	powershell.exe
Token: SeUndockPrivilege	6056	powershell.exe
Token: SeManageVolumePrivilege	6056	powershell.exe
Token: 33	6056	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 3548 wrote to memory of 3300	3548	default.dat.exe	89
PID 3300 wrote to memory of 3192	3300	default.dat.exe	90
PID 3192 wrote to memory of 3156	3192	cmd.exe	92
PID 3300 wrote to memory of 5512	3300	default.dat.exe	94
PID 5512 wrote to memory of 3348	5512	cmd.exe	96
PID 3300 wrote to memory of 3260	3300	default.dat.exe	97
PID 3260 wrote to memory of 6056	3260	cmd.exe	99
PID 3300 wrote to memory of 5428	3300	default.dat.exe	100
PID 5428 wrote to memory of 2784	5428	cmd.exe	102
PID 3300 wrote to memory of 2904	3300	default.dat.exe	103
PID 2904 wrote to memory of 3580	2904	cmd.exe	105
PID 3300 wrote to memory of 5656	3300	default.dat.exe	106
PID 5656 wrote to memory of 1668	5656	cmd.exe	108
PID 3300 wrote to memory of 3648	3300	default.dat.exe	109
PID 3648 wrote to memory of 1848	3648	cmd.exe	111
PID 3300 wrote to memory of 4996	3300	default.dat.exe	112
PID 4996 wrote to memory of 5900	4996	cmd.exe	114
PID 3300 wrote to memory of 5820	3300	default.dat.exe	115
PID 5820 wrote to memory of 1312	5820	cmd.exe	117
PID 3300 wrote to memory of 1828	3300	default.dat.exe	118
PID 1828 wrote to memory of 4620	1828	cmd.exe	120
PID 3300 wrote to memory of 2120	3300	default.dat.exe	121
PID 2120 wrote to memory of 3416	2120	cmd.exe	123
PID 3300 wrote to memory of 4316	3300	default.dat.exe	124
PID 4316 wrote to memory of 5744	4316	cmd.exe	126

C:\Users\Admin\AppData\Local\Temp\default.dat.exe
"C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3548
- C:\Users\Admin\AppData\Local\Temp\default.dat.exe
  "C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3300
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3192
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3156
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\mimiles'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5512
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\mimiles'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3348
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3260
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:6056
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5428
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2904
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3580
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5656
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1668
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3648
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1848
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4996
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5900
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5820
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1312
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1828
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4620
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2120
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3416
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4316
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5744

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact