e2a6e93cf04fdeafa93bb6e541107f5bfcf78ab79d92f1bf51c69de1d4f55433

Analysis

max time kernel
149s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 22:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
composer.dat.exe
Size 13.6MB
Sample260809-2tpymawhrf
SHA256 e2a6e93cf04fdeafa93bb6e541107f5bfcf78ab79d92f1bf51c69de1d4f55433
MD5 46a756241e8102202f1b88f2c0e7f3ad
SHA1 0ac690713b39aaff48f6ec5f7fc359ab107898ee
SHA512 e475baf72c14a714621a9797a6cd7ebbfc9ab9357424d32ce7f7ac6f703987751845351c170b2725962b0ec0812219b2177a1a20b36fb011174172a8c8abddc9
SSDEEP 393216:OGmToWNkwTEQ8asYJzU8FezXMCHWUjCLcuI3/PGTAI:OG8Au78u+oezXMb8CoH/O7
TLSH
T13DE6338877E11AFEC9B7D03DEDE02210F5B5B8265B71C9E74B6497A62C231D04938B63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4152	powershell.exe
2812	powershell.exe
1500	powershell.exe
2556	powershell.exe
4892	powershell.exe
4712	powershell.exe
620	powershell.exe
5204	powershell.exe
1008	powershell.exe
596	powershell.exe
2012	powershell.exe
5108	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
3776	composer.dat.exe
3776	composer.dat.exe
3776	composer.dat.exe
3776	composer.dat.exe
3776	composer.dat.exe
3776	composer.dat.exe
3776	composer.dat.exe
3776	composer.dat.exe
3776	composer.dat.exe
3776	composer.dat.exe
3776	composer.dat.exe
3776	composer.dat.exe
3776	composer.dat.exe
3776	composer.dat.exe
3776	composer.dat.exe

Executes a command shell one-liner 1 TTPs 12 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2992	cmd.exe
756	cmd.exe
2532	cmd.exe
1332	cmd.exe
5344	cmd.exe
4556	cmd.exe
1396	cmd.exe
2420	cmd.exe
2572	cmd.exe
5348	cmd.exe
5340	cmd.exe
3492	cmd.exe

Suspicious behavior: EnumeratesProcesses 29 IoCs

pid	Process
3776	composer.dat.exe
3776	composer.dat.exe
1008	powershell.exe
1008	powershell.exe
2812	powershell.exe
2812	powershell.exe
1500	powershell.exe
1500	powershell.exe
1500	powershell.exe
2556	powershell.exe
2556	powershell.exe
596	powershell.exe
596	powershell.exe
2012	powershell.exe
2012	powershell.exe
5108	powershell.exe
5108	powershell.exe
4892	powershell.exe
4892	powershell.exe
4152	powershell.exe
4152	powershell.exe
4712	powershell.exe
4712	powershell.exe
4712	powershell.exe
620	powershell.exe
620	powershell.exe
5204	powershell.exe
5204	powershell.exe
5204	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3776	composer.dat.exe
Token: SeDebugPrivilege	1008	powershell.exe
Token: SeIncreaseQuotaPrivilege	1008	powershell.exe
Token: SeSecurityPrivilege	1008	powershell.exe
Token: SeTakeOwnershipPrivilege	1008	powershell.exe
Token: SeLoadDriverPrivilege	1008	powershell.exe
Token: SeSystemProfilePrivilege	1008	powershell.exe
Token: SeSystemtimePrivilege	1008	powershell.exe
Token: SeProfSingleProcessPrivilege	1008	powershell.exe
Token: SeIncBasePriorityPrivilege	1008	powershell.exe
Token: SeCreatePagefilePrivilege	1008	powershell.exe
Token: SeBackupPrivilege	1008	powershell.exe
Token: SeRestorePrivilege	1008	powershell.exe
Token: SeShutdownPrivilege	1008	powershell.exe
Token: SeDebugPrivilege	1008	powershell.exe
Token: SeSystemEnvironmentPrivilege	1008	powershell.exe
Token: SeRemoteShutdownPrivilege	1008	powershell.exe
Token: SeUndockPrivilege	1008	powershell.exe
Token: SeManageVolumePrivilege	1008	powershell.exe
Token: 33	1008	powershell.exe
Token: 34	1008	powershell.exe
Token: 35	1008	powershell.exe
Token: 36	1008	powershell.exe
Token: SeDebugPrivilege	2812	powershell.exe
Token: SeIncreaseQuotaPrivilege	2812	powershell.exe
Token: SeSecurityPrivilege	2812	powershell.exe
Token: SeTakeOwnershipPrivilege	2812	powershell.exe
Token: SeLoadDriverPrivilege	2812	powershell.exe
Token: SeSystemProfilePrivilege	2812	powershell.exe
Token: SeSystemtimePrivilege	2812	powershell.exe
Token: SeProfSingleProcessPrivilege	2812	powershell.exe
Token: SeIncBasePriorityPrivilege	2812	powershell.exe
Token: SeCreatePagefilePrivilege	2812	powershell.exe
Token: SeBackupPrivilege	2812	powershell.exe
Token: SeRestorePrivilege	2812	powershell.exe
Token: SeShutdownPrivilege	2812	powershell.exe
Token: SeDebugPrivilege	2812	powershell.exe
Token: SeSystemEnvironmentPrivilege	2812	powershell.exe
Token: SeRemoteShutdownPrivilege	2812	powershell.exe
Token: SeUndockPrivilege	2812	powershell.exe
Token: SeManageVolumePrivilege	2812	powershell.exe
Token: 33	2812	powershell.exe
Token: 34	2812	powershell.exe
Token: 35	2812	powershell.exe
Token: 36	2812	powershell.exe
Token: SeDebugPrivilege	1500	powershell.exe
Token: SeIncreaseQuotaPrivilege	1500	powershell.exe
Token: SeSecurityPrivilege	1500	powershell.exe
Token: SeTakeOwnershipPrivilege	1500	powershell.exe
Token: SeLoadDriverPrivilege	1500	powershell.exe
Token: SeSystemProfilePrivilege	1500	powershell.exe
Token: SeSystemtimePrivilege	1500	powershell.exe
Token: SeProfSingleProcessPrivilege	1500	powershell.exe
Token: SeIncBasePriorityPrivilege	1500	powershell.exe
Token: SeCreatePagefilePrivilege	1500	powershell.exe
Token: SeBackupPrivilege	1500	powershell.exe
Token: SeRestorePrivilege	1500	powershell.exe
Token: SeShutdownPrivilege	1500	powershell.exe
Token: SeDebugPrivilege	1500	powershell.exe
Token: SeSystemEnvironmentPrivilege	1500	powershell.exe
Token: SeRemoteShutdownPrivilege	1500	powershell.exe
Token: SeUndockPrivilege	1500	powershell.exe
Token: SeManageVolumePrivilege	1500	powershell.exe
Token: 33	1500	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2668 wrote to memory of 3776	2668	composer.dat.exe	89
PID 3776 wrote to memory of 2572	3776	composer.dat.exe	90
PID 2572 wrote to memory of 1008	2572	cmd.exe	92
PID 3776 wrote to memory of 1332	3776	composer.dat.exe	94
PID 1332 wrote to memory of 2812	1332	cmd.exe	96
PID 3776 wrote to memory of 5344	3776	composer.dat.exe	97
PID 5344 wrote to memory of 1500	5344	cmd.exe	99
PID 3776 wrote to memory of 5348	3776	composer.dat.exe	100
PID 5348 wrote to memory of 2556	5348	cmd.exe	102
PID 3776 wrote to memory of 5340	3776	composer.dat.exe	103
PID 5340 wrote to memory of 596	5340	cmd.exe	105
PID 3776 wrote to memory of 3492	3776	composer.dat.exe	106
PID 3492 wrote to memory of 2012	3492	cmd.exe	108
PID 3776 wrote to memory of 2992	3776	composer.dat.exe	109
PID 2992 wrote to memory of 5108	2992	cmd.exe	111
PID 3776 wrote to memory of 756	3776	composer.dat.exe	112
PID 756 wrote to memory of 4892	756	cmd.exe	114
PID 3776 wrote to memory of 4556	3776	composer.dat.exe	115
PID 4556 wrote to memory of 4152	4556	cmd.exe	117
PID 3776 wrote to memory of 1396	3776	composer.dat.exe	118
PID 1396 wrote to memory of 4712	1396	cmd.exe	120
PID 3776 wrote to memory of 2532	3776	composer.dat.exe	121
PID 2532 wrote to memory of 620	2532	cmd.exe	123
PID 3776 wrote to memory of 2420	3776	composer.dat.exe	124
PID 2420 wrote to memory of 5204	2420	cmd.exe	126

C:\Users\Admin\AppData\Local\Temp\composer.dat.exe
"C:\Users\Admin\AppData\Local\Temp\composer.dat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2668
- C:\Users\Admin\AppData\Local\Temp\composer.dat.exe
  "C:\Users\Admin\AppData\Local\Temp\composer.dat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3776
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2572
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1008
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\cosojad'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1332
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\cosojad'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2812
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5344
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1500
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5348
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2556
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5340
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:596
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3492
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2012
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2992
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5108
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:756
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4892
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4556
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4152
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1396
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4712
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2532
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:620
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2420
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5204

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact