f0a9123f4a672c76a6c61a47b8ef4d991b398526c0b072f909ccc2630e0eb2de

Analysis

max time kernel
151s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 02:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
composer.dat.exe
Size 13.6MB
Sample260805-dc2dbsaj6y
SHA256 f0a9123f4a672c76a6c61a47b8ef4d991b398526c0b072f909ccc2630e0eb2de
MD5 6c7970a95086dc63e2c9262e7c195eff
SHA1 f6739b4ad55b2377afa8a6299e81a94a03bfa71f
SHA512 32c79f9b8effd6e97ee0048eee49a088ac9b4d3ea44653ee828b36700e925be561a66cec3cf9094b5da9dda20c77377d018da49397c42ded9aec05869865f35c
SSDEEP 393216:cGmnP3gEQTMzhP56AXMCHWUjfcuI3/PGTAI:cGNEQTMNPdXMb80H/O7
TLSH
T113E6334869D423EEDAF3857C8DC208AAE179B4764732CAEB1BB867971D531E08D3D701
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4220	powershell.exe
3624	powershell.exe
2576	powershell.exe
2612	powershell.exe
3860	powershell.exe
1608	powershell.exe
460	powershell.exe
3124	powershell.exe
2680	powershell.exe
5124	powershell.exe
1048	powershell.exe
1672	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
2908	composer.dat.exe
2908	composer.dat.exe
2908	composer.dat.exe
2908	composer.dat.exe
2908	composer.dat.exe
2908	composer.dat.exe
2908	composer.dat.exe
2908	composer.dat.exe
2908	composer.dat.exe
2908	composer.dat.exe
2908	composer.dat.exe
2908	composer.dat.exe
2908	composer.dat.exe
2908	composer.dat.exe
2908	composer.dat.exe

Executes a command shell one-liner 1 TTPs 12 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2828	cmd.exe
1076	cmd.exe
3796	cmd.exe
5564	cmd.exe
3052	cmd.exe
1068	cmd.exe
4444	cmd.exe
5764	cmd.exe
4716	cmd.exe
204	cmd.exe
1628	cmd.exe
1348	cmd.exe

Suspicious behavior: EnumeratesProcesses 38 IoCs

pid	Process
2908	composer.dat.exe
2908	composer.dat.exe
2576	powershell.exe
2576	powershell.exe
2576	powershell.exe
2612	powershell.exe
2612	powershell.exe
2612	powershell.exe
5124	powershell.exe
5124	powershell.exe
5124	powershell.exe
1048	powershell.exe
1048	powershell.exe
1048	powershell.exe
3860	powershell.exe
3860	powershell.exe
3860	powershell.exe
1672	powershell.exe
1672	powershell.exe
1672	powershell.exe
1608	powershell.exe
1608	powershell.exe
1608	powershell.exe
460	powershell.exe
460	powershell.exe
460	powershell.exe
4220	powershell.exe
4220	powershell.exe
4220	powershell.exe
3124	powershell.exe
3124	powershell.exe
3124	powershell.exe
2680	powershell.exe
2680	powershell.exe
2680	powershell.exe
3624	powershell.exe
3624	powershell.exe
3624	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2908	composer.dat.exe
Token: SeDebugPrivilege	2576	powershell.exe
Token: SeIncreaseQuotaPrivilege	2576	powershell.exe
Token: SeSecurityPrivilege	2576	powershell.exe
Token: SeTakeOwnershipPrivilege	2576	powershell.exe
Token: SeLoadDriverPrivilege	2576	powershell.exe
Token: SeSystemProfilePrivilege	2576	powershell.exe
Token: SeSystemtimePrivilege	2576	powershell.exe
Token: SeProfSingleProcessPrivilege	2576	powershell.exe
Token: SeIncBasePriorityPrivilege	2576	powershell.exe
Token: SeCreatePagefilePrivilege	2576	powershell.exe
Token: SeBackupPrivilege	2576	powershell.exe
Token: SeRestorePrivilege	2576	powershell.exe
Token: SeShutdownPrivilege	2576	powershell.exe
Token: SeDebugPrivilege	2576	powershell.exe
Token: SeSystemEnvironmentPrivilege	2576	powershell.exe
Token: SeRemoteShutdownPrivilege	2576	powershell.exe
Token: SeUndockPrivilege	2576	powershell.exe
Token: SeManageVolumePrivilege	2576	powershell.exe
Token: 33	2576	powershell.exe
Token: 34	2576	powershell.exe
Token: 35	2576	powershell.exe
Token: 36	2576	powershell.exe
Token: SeDebugPrivilege	2612	powershell.exe
Token: SeIncreaseQuotaPrivilege	2612	powershell.exe
Token: SeSecurityPrivilege	2612	powershell.exe
Token: SeTakeOwnershipPrivilege	2612	powershell.exe
Token: SeLoadDriverPrivilege	2612	powershell.exe
Token: SeSystemProfilePrivilege	2612	powershell.exe
Token: SeSystemtimePrivilege	2612	powershell.exe
Token: SeProfSingleProcessPrivilege	2612	powershell.exe
Token: SeIncBasePriorityPrivilege	2612	powershell.exe
Token: SeCreatePagefilePrivilege	2612	powershell.exe
Token: SeBackupPrivilege	2612	powershell.exe
Token: SeRestorePrivilege	2612	powershell.exe
Token: SeShutdownPrivilege	2612	powershell.exe
Token: SeDebugPrivilege	2612	powershell.exe
Token: SeSystemEnvironmentPrivilege	2612	powershell.exe
Token: SeRemoteShutdownPrivilege	2612	powershell.exe
Token: SeUndockPrivilege	2612	powershell.exe
Token: SeManageVolumePrivilege	2612	powershell.exe
Token: 33	2612	powershell.exe
Token: 34	2612	powershell.exe
Token: 35	2612	powershell.exe
Token: 36	2612	powershell.exe
Token: SeDebugPrivilege	5124	powershell.exe
Token: SeIncreaseQuotaPrivilege	5124	powershell.exe
Token: SeSecurityPrivilege	5124	powershell.exe
Token: SeTakeOwnershipPrivilege	5124	powershell.exe
Token: SeLoadDriverPrivilege	5124	powershell.exe
Token: SeSystemProfilePrivilege	5124	powershell.exe
Token: SeSystemtimePrivilege	5124	powershell.exe
Token: SeProfSingleProcessPrivilege	5124	powershell.exe
Token: SeIncBasePriorityPrivilege	5124	powershell.exe
Token: SeCreatePagefilePrivilege	5124	powershell.exe
Token: SeBackupPrivilege	5124	powershell.exe
Token: SeRestorePrivilege	5124	powershell.exe
Token: SeShutdownPrivilege	5124	powershell.exe
Token: SeDebugPrivilege	5124	powershell.exe
Token: SeSystemEnvironmentPrivilege	5124	powershell.exe
Token: SeRemoteShutdownPrivilege	5124	powershell.exe
Token: SeUndockPrivilege	5124	powershell.exe
Token: SeManageVolumePrivilege	5124	powershell.exe
Token: 33	5124	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2488 wrote to memory of 2908	2488	composer.dat.exe	89
PID 2908 wrote to memory of 5564	2908	composer.dat.exe	90
PID 5564 wrote to memory of 2576	5564	cmd.exe	92
PID 2908 wrote to memory of 1348	2908	composer.dat.exe	94
PID 1348 wrote to memory of 2612	1348	cmd.exe	96
PID 2908 wrote to memory of 3052	2908	composer.dat.exe	97
PID 3052 wrote to memory of 5124	3052	cmd.exe	99
PID 2908 wrote to memory of 2828	2908	composer.dat.exe	100
PID 2828 wrote to memory of 1048	2828	cmd.exe	102
PID 2908 wrote to memory of 1068	2908	composer.dat.exe	103
PID 1068 wrote to memory of 3860	1068	cmd.exe	105
PID 2908 wrote to memory of 1076	2908	composer.dat.exe	106
PID 1076 wrote to memory of 1672	1076	cmd.exe	108
PID 2908 wrote to memory of 4444	2908	composer.dat.exe	109
PID 4444 wrote to memory of 1608	4444	cmd.exe	111
PID 2908 wrote to memory of 5764	2908	composer.dat.exe	112
PID 5764 wrote to memory of 460	5764	cmd.exe	114
PID 2908 wrote to memory of 4716	2908	composer.dat.exe	115
PID 4716 wrote to memory of 4220	4716	cmd.exe	117
PID 2908 wrote to memory of 204	2908	composer.dat.exe	118
PID 204 wrote to memory of 3124	204	cmd.exe	120
PID 2908 wrote to memory of 1628	2908	composer.dat.exe	121
PID 1628 wrote to memory of 2680	1628	cmd.exe	123
PID 2908 wrote to memory of 3796	2908	composer.dat.exe	124
PID 3796 wrote to memory of 3624	3796	cmd.exe	126

C:\Users\Admin\AppData\Local\Temp\composer.dat.exe
"C:\Users\Admin\AppData\Local\Temp\composer.dat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Users\Admin\AppData\Local\Temp\composer.dat.exe
  "C:\Users\Admin\AppData\Local\Temp\composer.dat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2908
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5564
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2576
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\cimeqog'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1348
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\cimeqog'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2612
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3052
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2828
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1048
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1068
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3860
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1076
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1672
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4444
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1608
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5764
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:460
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4716
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4220
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:204
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1628
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2680
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3796
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3624

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact