c5125a9712a4bece5cc1d53da1914ec5ac7ba147ab37242b03ce488bc2909137

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 21:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
composer.dat.exe
Size 13.6MB
Sample260807-1rtclathnb
SHA256 c5125a9712a4bece5cc1d53da1914ec5ac7ba147ab37242b03ce488bc2909137
MD5 e9c8477a7011ac3fdc936f8b57ae9344
SHA1 8a7ad515a23953f1dc2eebd140f434e7a61cda9d
SHA512 9afd01968f9643b42e2a0d5bac62be4bb0149d54b0278b7771f577016d30411f59ab4ff609e52444dc1ff5c38d4da024b83c601c20fb6688b552afed35562b7f
SSDEEP 393216:ubGmCCSCWPWaDSgvk644NL7fXMCHWUjwcuI3/PGTAI:ubGhCSWRuksvXMb8lH/O7
TLSH
T123E6334C9AC152BBEAB3817CBDD26094E07C78661362C9EB5BE843651CA74E04D3BB17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2848	powershell.exe
5004	powershell.exe
3700	powershell.exe
2820	powershell.exe
1524	powershell.exe
1480	powershell.exe
3708	powershell.exe
3452	powershell.exe
4348	powershell.exe
2424	powershell.exe
1740	powershell.exe
1620	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
2824	composer.dat.exe
2824	composer.dat.exe
2824	composer.dat.exe
2824	composer.dat.exe
2824	composer.dat.exe
2824	composer.dat.exe
2824	composer.dat.exe
2824	composer.dat.exe
2824	composer.dat.exe
2824	composer.dat.exe
2824	composer.dat.exe
2824	composer.dat.exe
2824	composer.dat.exe
2824	composer.dat.exe
2824	composer.dat.exe

Executes a command shell one-liner 1 TTPs 12 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1400	cmd.exe
2556	cmd.exe
5160	cmd.exe
4620	cmd.exe
1420	cmd.exe
4324	cmd.exe
3408	cmd.exe
1432	cmd.exe
2212	cmd.exe
4272	cmd.exe
5072	cmd.exe
796	cmd.exe

Suspicious behavior: EnumeratesProcesses 38 IoCs

pid	Process
2824	composer.dat.exe
2824	composer.dat.exe
1480	powershell.exe
1480	powershell.exe
1480	powershell.exe
3708	powershell.exe
3708	powershell.exe
3708	powershell.exe
2424	powershell.exe
2424	powershell.exe
2424	powershell.exe
3452	powershell.exe
3452	powershell.exe
3452	powershell.exe
4348	powershell.exe
4348	powershell.exe
4348	powershell.exe
1740	powershell.exe
1740	powershell.exe
1740	powershell.exe
1620	powershell.exe
1620	powershell.exe
1620	powershell.exe
2848	powershell.exe
2848	powershell.exe
2848	powershell.exe
5004	powershell.exe
5004	powershell.exe
5004	powershell.exe
3700	powershell.exe
3700	powershell.exe
3700	powershell.exe
2820	powershell.exe
2820	powershell.exe
2820	powershell.exe
1524	powershell.exe
1524	powershell.exe
1524	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2824	composer.dat.exe
Token: SeDebugPrivilege	1480	powershell.exe
Token: SeIncreaseQuotaPrivilege	1480	powershell.exe
Token: SeSecurityPrivilege	1480	powershell.exe
Token: SeTakeOwnershipPrivilege	1480	powershell.exe
Token: SeLoadDriverPrivilege	1480	powershell.exe
Token: SeSystemProfilePrivilege	1480	powershell.exe
Token: SeSystemtimePrivilege	1480	powershell.exe
Token: SeProfSingleProcessPrivilege	1480	powershell.exe
Token: SeIncBasePriorityPrivilege	1480	powershell.exe
Token: SeCreatePagefilePrivilege	1480	powershell.exe
Token: SeBackupPrivilege	1480	powershell.exe
Token: SeRestorePrivilege	1480	powershell.exe
Token: SeShutdownPrivilege	1480	powershell.exe
Token: SeDebugPrivilege	1480	powershell.exe
Token: SeSystemEnvironmentPrivilege	1480	powershell.exe
Token: SeRemoteShutdownPrivilege	1480	powershell.exe
Token: SeUndockPrivilege	1480	powershell.exe
Token: SeManageVolumePrivilege	1480	powershell.exe
Token: 33	1480	powershell.exe
Token: 34	1480	powershell.exe
Token: 35	1480	powershell.exe
Token: 36	1480	powershell.exe
Token: SeDebugPrivilege	3708	powershell.exe
Token: SeIncreaseQuotaPrivilege	3708	powershell.exe
Token: SeSecurityPrivilege	3708	powershell.exe
Token: SeTakeOwnershipPrivilege	3708	powershell.exe
Token: SeLoadDriverPrivilege	3708	powershell.exe
Token: SeSystemProfilePrivilege	3708	powershell.exe
Token: SeSystemtimePrivilege	3708	powershell.exe
Token: SeProfSingleProcessPrivilege	3708	powershell.exe
Token: SeIncBasePriorityPrivilege	3708	powershell.exe
Token: SeCreatePagefilePrivilege	3708	powershell.exe
Token: SeBackupPrivilege	3708	powershell.exe
Token: SeRestorePrivilege	3708	powershell.exe
Token: SeShutdownPrivilege	3708	powershell.exe
Token: SeDebugPrivilege	3708	powershell.exe
Token: SeSystemEnvironmentPrivilege	3708	powershell.exe
Token: SeRemoteShutdownPrivilege	3708	powershell.exe
Token: SeUndockPrivilege	3708	powershell.exe
Token: SeManageVolumePrivilege	3708	powershell.exe
Token: 33	3708	powershell.exe
Token: 34	3708	powershell.exe
Token: 35	3708	powershell.exe
Token: 36	3708	powershell.exe
Token: SeDebugPrivilege	2424	powershell.exe
Token: SeIncreaseQuotaPrivilege	2424	powershell.exe
Token: SeSecurityPrivilege	2424	powershell.exe
Token: SeTakeOwnershipPrivilege	2424	powershell.exe
Token: SeLoadDriverPrivilege	2424	powershell.exe
Token: SeSystemProfilePrivilege	2424	powershell.exe
Token: SeSystemtimePrivilege	2424	powershell.exe
Token: SeProfSingleProcessPrivilege	2424	powershell.exe
Token: SeIncBasePriorityPrivilege	2424	powershell.exe
Token: SeCreatePagefilePrivilege	2424	powershell.exe
Token: SeBackupPrivilege	2424	powershell.exe
Token: SeRestorePrivilege	2424	powershell.exe
Token: SeShutdownPrivilege	2424	powershell.exe
Token: SeDebugPrivilege	2424	powershell.exe
Token: SeSystemEnvironmentPrivilege	2424	powershell.exe
Token: SeRemoteShutdownPrivilege	2424	powershell.exe
Token: SeUndockPrivilege	2424	powershell.exe
Token: SeManageVolumePrivilege	2424	powershell.exe
Token: 33	2424	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 3208 wrote to memory of 2824	3208	composer.dat.exe	89
PID 2824 wrote to memory of 3408	2824	composer.dat.exe	90
PID 3408 wrote to memory of 1480	3408	cmd.exe	92
PID 2824 wrote to memory of 1432	2824	composer.dat.exe	94
PID 1432 wrote to memory of 3708	1432	cmd.exe	96
PID 2824 wrote to memory of 2212	2824	composer.dat.exe	97
PID 2212 wrote to memory of 2424	2212	cmd.exe	99
PID 2824 wrote to memory of 4272	2824	composer.dat.exe	100
PID 4272 wrote to memory of 3452	4272	cmd.exe	102
PID 2824 wrote to memory of 5072	2824	composer.dat.exe	103
PID 5072 wrote to memory of 4348	5072	cmd.exe	105
PID 2824 wrote to memory of 796	2824	composer.dat.exe	106
PID 796 wrote to memory of 1740	796	cmd.exe	108
PID 2824 wrote to memory of 5160	2824	composer.dat.exe	109
PID 5160 wrote to memory of 1620	5160	cmd.exe	111
PID 2824 wrote to memory of 4620	2824	composer.dat.exe	112
PID 4620 wrote to memory of 2848	4620	cmd.exe	114
PID 2824 wrote to memory of 1420	2824	composer.dat.exe	115
PID 1420 wrote to memory of 5004	1420	cmd.exe	117
PID 2824 wrote to memory of 4324	2824	composer.dat.exe	118
PID 4324 wrote to memory of 3700	4324	cmd.exe	120
PID 2824 wrote to memory of 1400	2824	composer.dat.exe	122
PID 1400 wrote to memory of 2820	1400	cmd.exe	124
PID 2824 wrote to memory of 2556	2824	composer.dat.exe	125
PID 2556 wrote to memory of 1524	2556	cmd.exe	127

C:\Users\Admin\AppData\Local\Temp\composer.dat.exe
"C:\Users\Admin\AppData\Local\Temp\composer.dat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3208
- C:\Users\Admin\AppData\Local\Temp\composer.dat.exe
  "C:\Users\Admin\AppData\Local\Temp\composer.dat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3408
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1480
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\jecafoh'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1432
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\jecafoh'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3708
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2212
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2424
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4272
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3452
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5072
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4348
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:796
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5160
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1620
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4620
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2848
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1420
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5004
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4324
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3700
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1400
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2820
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2556
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1524

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact