9b681ff5ddc95eb019ff7a102bde6454459802808e0982d0bd4ba1164219acaa

Analysis

max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 16:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
composer.dat.exe
Size 13.6MB
Sample260804-vdn8tsdh33
SHA256 9b681ff5ddc95eb019ff7a102bde6454459802808e0982d0bd4ba1164219acaa
MD5 b4cd1898418f4e505a2cecde7a85afae
SHA1 8a7cc64227e24ff2ab144b84acb01864c55e0660
SHA512 4ea7e71c294beccf439d67e7497fe84b1d6028b7e0ac00adb8dcb2538d0021b50eb70e21610516c7d1078d5603c9eca8087185775760d1d01a3968afd5d84342
SSDEEP 393216:rGmhjWynxndABoVsQxGB5aiXMCHWUjScuI3/PGTAI:rG0jWynJdLxGKiXMb8vH/O7
TLSH
T1EDE6331CB6E001EDCAB3827CE9D109E6E261F8B14731C9D78BE896615E132E09D3D677
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4532	powershell.exe
5116	powershell.exe
4404	powershell.exe
1804	powershell.exe
1152	powershell.exe
5960	powershell.exe
1572	powershell.exe
4356	powershell.exe
6124	powershell.exe
4940	powershell.exe
2108	powershell.exe
1308	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
4260	composer.dat.exe
4260	composer.dat.exe
4260	composer.dat.exe
4260	composer.dat.exe
4260	composer.dat.exe
4260	composer.dat.exe
4260	composer.dat.exe
4260	composer.dat.exe
4260	composer.dat.exe
4260	composer.dat.exe
4260	composer.dat.exe
4260	composer.dat.exe
4260	composer.dat.exe
4260	composer.dat.exe
4260	composer.dat.exe

Executes a command shell one-liner 1 TTPs 12 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4672	cmd.exe
2532	cmd.exe
5012	cmd.exe
664	cmd.exe
3264	cmd.exe
4272	cmd.exe
5424	cmd.exe
6000	cmd.exe
4872	cmd.exe
3124	cmd.exe
3368	cmd.exe
1668	cmd.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
4260	composer.dat.exe
4260	composer.dat.exe
1152	powershell.exe
1152	powershell.exe
5960	powershell.exe
5960	powershell.exe
1572	powershell.exe
1572	powershell.exe
4356	powershell.exe
4356	powershell.exe
2108	powershell.exe
2108	powershell.exe
6124	powershell.exe
6124	powershell.exe
1308	powershell.exe
1308	powershell.exe
4532	powershell.exe
4532	powershell.exe
5116	powershell.exe
5116	powershell.exe
4404	powershell.exe
4404	powershell.exe
1804	powershell.exe
1804	powershell.exe
4940	powershell.exe
4940	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4260	composer.dat.exe
Token: SeDebugPrivilege	1152	powershell.exe
Token: SeIncreaseQuotaPrivilege	1152	powershell.exe
Token: SeSecurityPrivilege	1152	powershell.exe
Token: SeTakeOwnershipPrivilege	1152	powershell.exe
Token: SeLoadDriverPrivilege	1152	powershell.exe
Token: SeSystemProfilePrivilege	1152	powershell.exe
Token: SeSystemtimePrivilege	1152	powershell.exe
Token: SeProfSingleProcessPrivilege	1152	powershell.exe
Token: SeIncBasePriorityPrivilege	1152	powershell.exe
Token: SeCreatePagefilePrivilege	1152	powershell.exe
Token: SeBackupPrivilege	1152	powershell.exe
Token: SeRestorePrivilege	1152	powershell.exe
Token: SeShutdownPrivilege	1152	powershell.exe
Token: SeDebugPrivilege	1152	powershell.exe
Token: SeSystemEnvironmentPrivilege	1152	powershell.exe
Token: SeRemoteShutdownPrivilege	1152	powershell.exe
Token: SeUndockPrivilege	1152	powershell.exe
Token: SeManageVolumePrivilege	1152	powershell.exe
Token: 33	1152	powershell.exe
Token: 34	1152	powershell.exe
Token: 35	1152	powershell.exe
Token: 36	1152	powershell.exe
Token: SeDebugPrivilege	5960	powershell.exe
Token: SeIncreaseQuotaPrivilege	5960	powershell.exe
Token: SeSecurityPrivilege	5960	powershell.exe
Token: SeTakeOwnershipPrivilege	5960	powershell.exe
Token: SeLoadDriverPrivilege	5960	powershell.exe
Token: SeSystemProfilePrivilege	5960	powershell.exe
Token: SeSystemtimePrivilege	5960	powershell.exe
Token: SeProfSingleProcessPrivilege	5960	powershell.exe
Token: SeIncBasePriorityPrivilege	5960	powershell.exe
Token: SeCreatePagefilePrivilege	5960	powershell.exe
Token: SeBackupPrivilege	5960	powershell.exe
Token: SeRestorePrivilege	5960	powershell.exe
Token: SeShutdownPrivilege	5960	powershell.exe
Token: SeDebugPrivilege	5960	powershell.exe
Token: SeSystemEnvironmentPrivilege	5960	powershell.exe
Token: SeRemoteShutdownPrivilege	5960	powershell.exe
Token: SeUndockPrivilege	5960	powershell.exe
Token: SeManageVolumePrivilege	5960	powershell.exe
Token: 33	5960	powershell.exe
Token: 34	5960	powershell.exe
Token: 35	5960	powershell.exe
Token: 36	5960	powershell.exe
Token: SeDebugPrivilege	1572	powershell.exe
Token: SeIncreaseQuotaPrivilege	1572	powershell.exe
Token: SeSecurityPrivilege	1572	powershell.exe
Token: SeTakeOwnershipPrivilege	1572	powershell.exe
Token: SeLoadDriverPrivilege	1572	powershell.exe
Token: SeSystemProfilePrivilege	1572	powershell.exe
Token: SeSystemtimePrivilege	1572	powershell.exe
Token: SeProfSingleProcessPrivilege	1572	powershell.exe
Token: SeIncBasePriorityPrivilege	1572	powershell.exe
Token: SeCreatePagefilePrivilege	1572	powershell.exe
Token: SeBackupPrivilege	1572	powershell.exe
Token: SeRestorePrivilege	1572	powershell.exe
Token: SeShutdownPrivilege	1572	powershell.exe
Token: SeDebugPrivilege	1572	powershell.exe
Token: SeSystemEnvironmentPrivilege	1572	powershell.exe
Token: SeRemoteShutdownPrivilege	1572	powershell.exe
Token: SeUndockPrivilege	1572	powershell.exe
Token: SeManageVolumePrivilege	1572	powershell.exe
Token: 33	1572	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 408 wrote to memory of 4260	408	composer.dat.exe	89
PID 4260 wrote to memory of 4672	4260	composer.dat.exe	90
PID 4672 wrote to memory of 1152	4672	cmd.exe	92
PID 4260 wrote to memory of 6000	4260	composer.dat.exe	94
PID 6000 wrote to memory of 5960	6000	cmd.exe	96
PID 4260 wrote to memory of 4872	4260	composer.dat.exe	97
PID 4872 wrote to memory of 1572	4872	cmd.exe	99
PID 4260 wrote to memory of 2532	4260	composer.dat.exe	100
PID 2532 wrote to memory of 4356	2532	cmd.exe	102
PID 4260 wrote to memory of 5012	4260	composer.dat.exe	103
PID 5012 wrote to memory of 2108	5012	cmd.exe	105
PID 4260 wrote to memory of 3124	4260	composer.dat.exe	106
PID 3124 wrote to memory of 6124	3124	cmd.exe	108
PID 4260 wrote to memory of 664	4260	composer.dat.exe	109
PID 664 wrote to memory of 1308	664	cmd.exe	111
PID 4260 wrote to memory of 3264	4260	composer.dat.exe	112
PID 3264 wrote to memory of 4532	3264	cmd.exe	114
PID 4260 wrote to memory of 4272	4260	composer.dat.exe	115
PID 4272 wrote to memory of 5116	4272	cmd.exe	117
PID 4260 wrote to memory of 3368	4260	composer.dat.exe	118
PID 3368 wrote to memory of 4404	3368	cmd.exe	120
PID 4260 wrote to memory of 1668	4260	composer.dat.exe	122
PID 1668 wrote to memory of 1804	1668	cmd.exe	124
PID 4260 wrote to memory of 5424	4260	composer.dat.exe	125
PID 5424 wrote to memory of 4940	5424	cmd.exe	127

C:\Users\Admin\AppData\Local\Temp\composer.dat.exe
"C:\Users\Admin\AppData\Local\Temp\composer.dat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:408
- C:\Users\Admin\AppData\Local\Temp\composer.dat.exe
  "C:\Users\Admin\AppData\Local\Temp\composer.dat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4672
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1152
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\folimug'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6000
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\folimug'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5960
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4872
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1572
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2532
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4356
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5012
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2108
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3124
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:6124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:664
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1308
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3264
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4532
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4272
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3368
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4404
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1668
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1804
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5424
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4940

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact