b8e46b0ece6c02f2b6069a9cbe9686ce595d7ca59494214cc6d6ebaa9b5d072a

Analysis

max time kernel
149s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 13:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
default.dat.exe
Size 13.6MB
Sample260730-q6rgfaae63
SHA256 b8e46b0ece6c02f2b6069a9cbe9686ce595d7ca59494214cc6d6ebaa9b5d072a
MD5 4be121d6585848c9bd316f1aad94e383
SHA1 7d4bbf2b3d993c1d50730c65e2e05ccf697aff7c
SHA512 03fb94257e284561e2530dea38ece48ab1b9748044244420a4334ed19266bc2d22248c741e8816632d932eb2d337e5c0ea0e2351ab35500be0566338df485480
SSDEEP 393216:1Gz0LjbfvGaQOA9Jbv9GhtZ8XMCHWUjXUcuI3/PGTAI:1Pvbf+aQrbStWXMb8XBH/O7
TLSH
T126E6331496E111EEDA93823DAEE202A5F5B534F20772C4CF47AC4BA47C672E21D3D627
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4776	powershell.exe
1284	powershell.exe
560	powershell.exe
5980	powershell.exe
5752	powershell.exe
2896	powershell.exe
5236	powershell.exe
1620	powershell.exe
3336	powershell.exe
4876	powershell.exe
4768	powershell.exe
4548	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
2284	default.dat.exe
2284	default.dat.exe
2284	default.dat.exe
2284	default.dat.exe
2284	default.dat.exe
2284	default.dat.exe
2284	default.dat.exe
2284	default.dat.exe
2284	default.dat.exe
2284	default.dat.exe
2284	default.dat.exe
2284	default.dat.exe
2284	default.dat.exe
2284	default.dat.exe
2284	default.dat.exe

Executes a command shell one-liner 1 TTPs 12 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6084	cmd.exe
2908	cmd.exe
1500	cmd.exe
1864	cmd.exe
1056	cmd.exe
4892	cmd.exe
996	cmd.exe
4504	cmd.exe
5700	cmd.exe
3540	cmd.exe
1240	cmd.exe
5844	cmd.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
2284	default.dat.exe
2284	default.dat.exe
1284	powershell.exe
1284	powershell.exe
2896	powershell.exe
2896	powershell.exe
2896	powershell.exe
5236	powershell.exe
5236	powershell.exe
5236	powershell.exe
560	powershell.exe
560	powershell.exe
560	powershell.exe
1620	powershell.exe
1620	powershell.exe
1620	powershell.exe
3336	powershell.exe
3336	powershell.exe
3336	powershell.exe
4876	powershell.exe
4876	powershell.exe
4876	powershell.exe
5980	powershell.exe
5980	powershell.exe
5980	powershell.exe
4548	powershell.exe
4548	powershell.exe
4548	powershell.exe
5752	powershell.exe
5752	powershell.exe
5752	powershell.exe
4776	powershell.exe
4776	powershell.exe
4776	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2284	default.dat.exe
Token: SeDebugPrivilege	1284	powershell.exe
Token: SeIncreaseQuotaPrivilege	1284	powershell.exe
Token: SeSecurityPrivilege	1284	powershell.exe
Token: SeTakeOwnershipPrivilege	1284	powershell.exe
Token: SeLoadDriverPrivilege	1284	powershell.exe
Token: SeSystemProfilePrivilege	1284	powershell.exe
Token: SeSystemtimePrivilege	1284	powershell.exe
Token: SeProfSingleProcessPrivilege	1284	powershell.exe
Token: SeIncBasePriorityPrivilege	1284	powershell.exe
Token: SeCreatePagefilePrivilege	1284	powershell.exe
Token: SeBackupPrivilege	1284	powershell.exe
Token: SeRestorePrivilege	1284	powershell.exe
Token: SeShutdownPrivilege	1284	powershell.exe
Token: SeDebugPrivilege	1284	powershell.exe
Token: SeSystemEnvironmentPrivilege	1284	powershell.exe
Token: SeRemoteShutdownPrivilege	1284	powershell.exe
Token: SeUndockPrivilege	1284	powershell.exe
Token: SeManageVolumePrivilege	1284	powershell.exe
Token: 33	1284	powershell.exe
Token: 34	1284	powershell.exe
Token: 35	1284	powershell.exe
Token: 36	1284	powershell.exe
Token: SeDebugPrivilege	2896	powershell.exe
Token: SeIncreaseQuotaPrivilege	2896	powershell.exe
Token: SeSecurityPrivilege	2896	powershell.exe
Token: SeTakeOwnershipPrivilege	2896	powershell.exe
Token: SeLoadDriverPrivilege	2896	powershell.exe
Token: SeSystemProfilePrivilege	2896	powershell.exe
Token: SeSystemtimePrivilege	2896	powershell.exe
Token: SeProfSingleProcessPrivilege	2896	powershell.exe
Token: SeIncBasePriorityPrivilege	2896	powershell.exe
Token: SeCreatePagefilePrivilege	2896	powershell.exe
Token: SeBackupPrivilege	2896	powershell.exe
Token: SeRestorePrivilege	2896	powershell.exe
Token: SeShutdownPrivilege	2896	powershell.exe
Token: SeDebugPrivilege	2896	powershell.exe
Token: SeSystemEnvironmentPrivilege	2896	powershell.exe
Token: SeRemoteShutdownPrivilege	2896	powershell.exe
Token: SeUndockPrivilege	2896	powershell.exe
Token: SeManageVolumePrivilege	2896	powershell.exe
Token: 33	2896	powershell.exe
Token: 34	2896	powershell.exe
Token: 35	2896	powershell.exe
Token: 36	2896	powershell.exe
Token: SeDebugPrivilege	5236	powershell.exe
Token: SeIncreaseQuotaPrivilege	5236	powershell.exe
Token: SeSecurityPrivilege	5236	powershell.exe
Token: SeTakeOwnershipPrivilege	5236	powershell.exe
Token: SeLoadDriverPrivilege	5236	powershell.exe
Token: SeSystemProfilePrivilege	5236	powershell.exe
Token: SeSystemtimePrivilege	5236	powershell.exe
Token: SeProfSingleProcessPrivilege	5236	powershell.exe
Token: SeIncBasePriorityPrivilege	5236	powershell.exe
Token: SeCreatePagefilePrivilege	5236	powershell.exe
Token: SeBackupPrivilege	5236	powershell.exe
Token: SeRestorePrivilege	5236	powershell.exe
Token: SeShutdownPrivilege	5236	powershell.exe
Token: SeDebugPrivilege	5236	powershell.exe
Token: SeSystemEnvironmentPrivilege	5236	powershell.exe
Token: SeRemoteShutdownPrivilege	5236	powershell.exe
Token: SeUndockPrivilege	5236	powershell.exe
Token: SeManageVolumePrivilege	5236	powershell.exe
Token: 33	5236	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4304 wrote to memory of 2284	4304	default.dat.exe	89
PID 2284 wrote to memory of 6084	2284	default.dat.exe	90
PID 6084 wrote to memory of 1284	6084	cmd.exe	92
PID 2284 wrote to memory of 2908	2284	default.dat.exe	94
PID 2908 wrote to memory of 2896	2908	cmd.exe	96
PID 2284 wrote to memory of 5700	2284	default.dat.exe	97
PID 5700 wrote to memory of 5236	5700	cmd.exe	99
PID 2284 wrote to memory of 1500	2284	default.dat.exe	100
PID 1500 wrote to memory of 560	1500	cmd.exe	102
PID 2284 wrote to memory of 1864	2284	default.dat.exe	103
PID 1864 wrote to memory of 1620	1864	cmd.exe	105
PID 2284 wrote to memory of 1056	2284	default.dat.exe	106
PID 1056 wrote to memory of 3336	1056	cmd.exe	108
PID 2284 wrote to memory of 4892	2284	default.dat.exe	109
PID 4892 wrote to memory of 4876	4892	cmd.exe	111
PID 2284 wrote to memory of 996	2284	default.dat.exe	112
PID 996 wrote to memory of 5980	996	cmd.exe	114
PID 2284 wrote to memory of 3540	2284	default.dat.exe	115
PID 3540 wrote to memory of 4768	3540	cmd.exe	117
PID 2284 wrote to memory of 4504	2284	default.dat.exe	118
PID 4504 wrote to memory of 4548	4504	cmd.exe	120
PID 2284 wrote to memory of 1240	2284	default.dat.exe	121
PID 1240 wrote to memory of 5752	1240	cmd.exe	123
PID 2284 wrote to memory of 5844	2284	default.dat.exe	124
PID 5844 wrote to memory of 4776	5844	cmd.exe	126

C:\Users\Admin\AppData\Local\Temp\default.dat.exe
"C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4304
- C:\Users\Admin\AppData\Local\Temp\default.dat.exe
  "C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2284
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6084
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1284
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\mimiles'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2908
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\mimiles'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2896
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5700
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1500
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1864
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1620
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1056
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3336
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4892
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4876
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:996
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5980
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3540
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4504
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4548
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1240
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5752
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5844
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4776

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact