599584e6e42436721a66c2d3fbc29fe0d9be0b0e3f9e0f5f0333293e293920fc

Analysis

max time kernel
149s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 03:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
composer.dat.exe
Size 13.6MB
Sample260808-efvkmasycs
SHA256 599584e6e42436721a66c2d3fbc29fe0d9be0b0e3f9e0f5f0333293e293920fc
MD5 cb7a54e77e833e0cfd984ef4a9c49a3a
SHA1 7277302b2aff555f45fa7839aef63797dfd958de
SHA512 f2ac700ad9074d8a88210a6eadbbc1981afb0d499ec219c2e75879b56bec240daaa1d1a65ab4edc6984f72d1ec82d98925dcec259668e28b22c40ba9453198f1
SSDEEP 393216:/GmlE2rAcCDTstHAXMCHWUjlcuI3/PGTAI:/GKhuXMb8SH/O7
TLSH
T1C8E63309B7D015FEE6A3923CEEE22224D4A674B42331C9CB53E846E26D573D05C7DB26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1196	powershell.exe
1484	powershell.exe
4876	powershell.exe
2164	powershell.exe
4704	powershell.exe
3496	powershell.exe
3216	powershell.exe
900	powershell.exe
1440	powershell.exe
2780	powershell.exe
5276	powershell.exe
1084	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
2184	composer.dat.exe
2184	composer.dat.exe
2184	composer.dat.exe
2184	composer.dat.exe
2184	composer.dat.exe
2184	composer.dat.exe
2184	composer.dat.exe
2184	composer.dat.exe
2184	composer.dat.exe
2184	composer.dat.exe
2184	composer.dat.exe
2184	composer.dat.exe
2184	composer.dat.exe
2184	composer.dat.exe
2184	composer.dat.exe

Executes a command shell one-liner 1 TTPs 12 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4820	cmd.exe
5744	cmd.exe
1312	cmd.exe
5380	cmd.exe
2816	cmd.exe
4424	cmd.exe
5668	cmd.exe
2076	cmd.exe
3964	cmd.exe
1796	cmd.exe
1260	cmd.exe
5488	cmd.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
2184	composer.dat.exe
2184	composer.dat.exe
1440	powershell.exe
1440	powershell.exe
2780	powershell.exe
2780	powershell.exe
5276	powershell.exe
5276	powershell.exe
1084	powershell.exe
1084	powershell.exe
1196	powershell.exe
1196	powershell.exe
1484	powershell.exe
1484	powershell.exe
4876	powershell.exe
4876	powershell.exe
2164	powershell.exe
2164	powershell.exe
4704	powershell.exe
4704	powershell.exe
3496	powershell.exe
3496	powershell.exe
3216	powershell.exe
3216	powershell.exe
900	powershell.exe
900	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2184	composer.dat.exe
Token: SeDebugPrivilege	1440	powershell.exe
Token: SeIncreaseQuotaPrivilege	1440	powershell.exe
Token: SeSecurityPrivilege	1440	powershell.exe
Token: SeTakeOwnershipPrivilege	1440	powershell.exe
Token: SeLoadDriverPrivilege	1440	powershell.exe
Token: SeSystemProfilePrivilege	1440	powershell.exe
Token: SeSystemtimePrivilege	1440	powershell.exe
Token: SeProfSingleProcessPrivilege	1440	powershell.exe
Token: SeIncBasePriorityPrivilege	1440	powershell.exe
Token: SeCreatePagefilePrivilege	1440	powershell.exe
Token: SeBackupPrivilege	1440	powershell.exe
Token: SeRestorePrivilege	1440	powershell.exe
Token: SeShutdownPrivilege	1440	powershell.exe
Token: SeDebugPrivilege	1440	powershell.exe
Token: SeSystemEnvironmentPrivilege	1440	powershell.exe
Token: SeRemoteShutdownPrivilege	1440	powershell.exe
Token: SeUndockPrivilege	1440	powershell.exe
Token: SeManageVolumePrivilege	1440	powershell.exe
Token: 33	1440	powershell.exe
Token: 34	1440	powershell.exe
Token: 35	1440	powershell.exe
Token: 36	1440	powershell.exe
Token: SeDebugPrivilege	2780	powershell.exe
Token: SeIncreaseQuotaPrivilege	2780	powershell.exe
Token: SeSecurityPrivilege	2780	powershell.exe
Token: SeTakeOwnershipPrivilege	2780	powershell.exe
Token: SeLoadDriverPrivilege	2780	powershell.exe
Token: SeSystemProfilePrivilege	2780	powershell.exe
Token: SeSystemtimePrivilege	2780	powershell.exe
Token: SeProfSingleProcessPrivilege	2780	powershell.exe
Token: SeIncBasePriorityPrivilege	2780	powershell.exe
Token: SeCreatePagefilePrivilege	2780	powershell.exe
Token: SeBackupPrivilege	2780	powershell.exe
Token: SeRestorePrivilege	2780	powershell.exe
Token: SeShutdownPrivilege	2780	powershell.exe
Token: SeDebugPrivilege	2780	powershell.exe
Token: SeSystemEnvironmentPrivilege	2780	powershell.exe
Token: SeRemoteShutdownPrivilege	2780	powershell.exe
Token: SeUndockPrivilege	2780	powershell.exe
Token: SeManageVolumePrivilege	2780	powershell.exe
Token: 33	2780	powershell.exe
Token: 34	2780	powershell.exe
Token: 35	2780	powershell.exe
Token: 36	2780	powershell.exe
Token: SeDebugPrivilege	5276	powershell.exe
Token: SeIncreaseQuotaPrivilege	5276	powershell.exe
Token: SeSecurityPrivilege	5276	powershell.exe
Token: SeTakeOwnershipPrivilege	5276	powershell.exe
Token: SeLoadDriverPrivilege	5276	powershell.exe
Token: SeSystemProfilePrivilege	5276	powershell.exe
Token: SeSystemtimePrivilege	5276	powershell.exe
Token: SeProfSingleProcessPrivilege	5276	powershell.exe
Token: SeIncBasePriorityPrivilege	5276	powershell.exe
Token: SeCreatePagefilePrivilege	5276	powershell.exe
Token: SeBackupPrivilege	5276	powershell.exe
Token: SeRestorePrivilege	5276	powershell.exe
Token: SeShutdownPrivilege	5276	powershell.exe
Token: SeDebugPrivilege	5276	powershell.exe
Token: SeSystemEnvironmentPrivilege	5276	powershell.exe
Token: SeRemoteShutdownPrivilege	5276	powershell.exe
Token: SeUndockPrivilege	5276	powershell.exe
Token: SeManageVolumePrivilege	5276	powershell.exe
Token: 33	5276	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4644 wrote to memory of 2184	4644	composer.dat.exe	89
PID 2184 wrote to memory of 2076	2184	composer.dat.exe	90
PID 2076 wrote to memory of 1440	2076	cmd.exe	92
PID 2184 wrote to memory of 4820	2184	composer.dat.exe	94
PID 4820 wrote to memory of 2780	4820	cmd.exe	96
PID 2184 wrote to memory of 5744	2184	composer.dat.exe	97
PID 5744 wrote to memory of 5276	5744	cmd.exe	99
PID 2184 wrote to memory of 1312	2184	composer.dat.exe	100
PID 1312 wrote to memory of 1084	1312	cmd.exe	102
PID 2184 wrote to memory of 5380	2184	composer.dat.exe	103
PID 5380 wrote to memory of 1196	5380	cmd.exe	105
PID 2184 wrote to memory of 3964	2184	composer.dat.exe	106
PID 3964 wrote to memory of 1484	3964	cmd.exe	108
PID 2184 wrote to memory of 2816	2184	composer.dat.exe	109
PID 2816 wrote to memory of 4876	2816	cmd.exe	111
PID 2184 wrote to memory of 1796	2184	composer.dat.exe	112
PID 1796 wrote to memory of 2164	1796	cmd.exe	114
PID 2184 wrote to memory of 1260	2184	composer.dat.exe	115
PID 1260 wrote to memory of 4704	1260	cmd.exe	117
PID 2184 wrote to memory of 4424	2184	composer.dat.exe	118
PID 4424 wrote to memory of 3496	4424	cmd.exe	120
PID 2184 wrote to memory of 5488	2184	composer.dat.exe	121
PID 5488 wrote to memory of 3216	5488	cmd.exe	123
PID 2184 wrote to memory of 5668	2184	composer.dat.exe	124
PID 5668 wrote to memory of 900	5668	cmd.exe	126

C:\Users\Admin\AppData\Local\Temp\composer.dat.exe
"C:\Users\Admin\AppData\Local\Temp\composer.dat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4644
- C:\Users\Admin\AppData\Local\Temp\composer.dat.exe
  "C:\Users\Admin\AppData\Local\Temp\composer.dat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2184
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2076
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1440
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\tegiheh'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4820
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\tegiheh'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2780
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5744
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5276
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1312
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1084
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5380
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1196
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3964
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1484
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2816
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4876
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1796
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2164
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1260
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4704
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4424
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3496
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5488
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3216
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5668
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact