599584e6e42436721a66c2d3fbc29fe0d9be0b0e3f9e0f5f0333293e293920fc

Analysis

max time kernel
149s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/08/2026, 03:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
composer.dat.exe
Size 13.6MB
Sample260808-efvkmasycs
SHA256 599584e6e42436721a66c2d3fbc29fe0d9be0b0e3f9e0f5f0333293e293920fc
MD5 cb7a54e77e833e0cfd984ef4a9c49a3a
SHA1 7277302b2aff555f45fa7839aef63797dfd958de
SHA512 f2ac700ad9074d8a88210a6eadbbc1981afb0d499ec219c2e75879b56bec240daaa1d1a65ab4edc6984f72d1ec82d98925dcec259668e28b22c40ba9453198f1
SSDEEP 393216:/GmlE2rAcCDTstHAXMCHWUjlcuI3/PGTAI:/GKhuXMb8SH/O7
TLSH
T1C8E63309B7D015FEE6A3923CEEE22224D4A674B42331C9CB53E846E26D573D05C7DB26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
840	powershell.exe
4576	powershell.exe
4708	powershell.exe
3212	powershell.exe
2740	powershell.exe
3692	powershell.exe
5108	powershell.exe
2124	powershell.exe
4884	powershell.exe
3328	powershell.exe
4404	powershell.exe
3544	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
4768	composer.dat.exe
4768	composer.dat.exe
4768	composer.dat.exe
4768	composer.dat.exe
4768	composer.dat.exe
4768	composer.dat.exe
4768	composer.dat.exe
4768	composer.dat.exe
4768	composer.dat.exe
4768	composer.dat.exe
4768	composer.dat.exe
4768	composer.dat.exe
4768	composer.dat.exe
4768	composer.dat.exe
4768	composer.dat.exe

Executes a command shell one-liner 1 TTPs 12 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4532	cmd.exe
740	cmd.exe
508	cmd.exe
1228	cmd.exe
2296	cmd.exe
1436	cmd.exe
4132	cmd.exe
1432	cmd.exe
1796	cmd.exe
648	cmd.exe
4452	cmd.exe
4992	cmd.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
4768	composer.dat.exe
4768	composer.dat.exe
4768	composer.dat.exe
4768	composer.dat.exe
4768	composer.dat.exe
4768	composer.dat.exe
840	powershell.exe
840	powershell.exe
2740	powershell.exe
2740	powershell.exe
3692	powershell.exe
3692	powershell.exe
5108	powershell.exe
5108	powershell.exe
2124	powershell.exe
2124	powershell.exe
4884	powershell.exe
4884	powershell.exe
4576	powershell.exe
4576	powershell.exe
3328	powershell.exe
3328	powershell.exe
4708	powershell.exe
4708	powershell.exe
4404	powershell.exe
4404	powershell.exe
3544	powershell.exe
3544	powershell.exe
3212	powershell.exe
3212	powershell.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	4768	composer.dat.exe
Token: SeDebugPrivilege	840	powershell.exe
Token: SeDebugPrivilege	2740	powershell.exe
Token: SeDebugPrivilege	3692	powershell.exe
Token: SeDebugPrivilege	5108	powershell.exe
Token: SeDebugPrivilege	2124	powershell.exe
Token: SeDebugPrivilege	4884	powershell.exe
Token: SeDebugPrivilege	4576	powershell.exe
Token: SeDebugPrivilege	3328	powershell.exe
Token: SeDebugPrivilege	4708	powershell.exe
Token: SeDebugPrivilege	4404	powershell.exe
Token: SeDebugPrivilege	3544	powershell.exe
Token: SeDebugPrivilege	3212	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 3956 wrote to memory of 4768	3956	composer.dat.exe	86
PID 4768 wrote to memory of 4532	4768	composer.dat.exe	87
PID 4532 wrote to memory of 840	4532	cmd.exe	89
PID 4768 wrote to memory of 1432	4768	composer.dat.exe	90
PID 1432 wrote to memory of 2740	1432	cmd.exe	92
PID 4768 wrote to memory of 1796	4768	composer.dat.exe	93
PID 1796 wrote to memory of 3692	1796	cmd.exe	95
PID 4768 wrote to memory of 740	4768	composer.dat.exe	96
PID 740 wrote to memory of 5108	740	cmd.exe	98
PID 4768 wrote to memory of 508	4768	composer.dat.exe	99
PID 508 wrote to memory of 2124	508	cmd.exe	101
PID 4768 wrote to memory of 1228	4768	composer.dat.exe	102
PID 1228 wrote to memory of 4884	1228	cmd.exe	104
PID 4768 wrote to memory of 648	4768	composer.dat.exe	105
PID 648 wrote to memory of 4576	648	cmd.exe	107
PID 4768 wrote to memory of 2296	4768	composer.dat.exe	108
PID 2296 wrote to memory of 3328	2296	cmd.exe	110
PID 4768 wrote to memory of 1436	4768	composer.dat.exe	111
PID 1436 wrote to memory of 4708	1436	cmd.exe	113
PID 4768 wrote to memory of 4132	4768	composer.dat.exe	114
PID 4132 wrote to memory of 4404	4132	cmd.exe	116
PID 4768 wrote to memory of 4452	4768	composer.dat.exe	117
PID 4452 wrote to memory of 3544	4452	cmd.exe	119
PID 4768 wrote to memory of 4992	4768	composer.dat.exe	120
PID 4992 wrote to memory of 3212	4992	cmd.exe	122

C:\Users\Admin\AppData\Local\Temp\composer.dat.exe
"C:\Users\Admin\AppData\Local\Temp\composer.dat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3956
- C:\Users\Admin\AppData\Local\Temp\composer.dat.exe
  "C:\Users\Admin\AppData\Local\Temp\composer.dat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4532
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:840
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\tegiheh'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1432
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\tegiheh'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1796
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3692
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:740
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5108
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:508
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1228
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4884
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:648
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4576
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2296
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3328
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1436
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4708
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4132
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4404
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4452
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3544
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4992
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3212

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...