568d546ffe4d204289950f208306c8998a9fe58f98d5d33a81d2706471a1e6bc

Analysis

max time kernel
149s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 20:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
composer.dat.exe
Size 13.4MB
Sample260810-zphyeaybjd
SHA256 568d546ffe4d204289950f208306c8998a9fe58f98d5d33a81d2706471a1e6bc
MD5 727bafb1b47d4696d628c2ea4ca3fb0e
SHA1 2d709a82c45f74d5630553a9747ca92455c54674
SHA512 bac759891b03bf2b58a074aca4e69ab9c7f4362acf77b292bee7a7e237f5a6f95726b6d8ab006e5d9680d5aa1db28097fd59cbee5ce58c4b44c80e7750f1d58f
SSDEEP 393216:HpZ3SUUO1TshtK9g8xXMCHWUjPcuI3/PGTAI:HpZCUmhtK9g8xXMb8EH/O7
TLSH
T1B1E6330C76D025EED9A3A53DECE111D2DA26B47207B6C8DB979843E2AD135E44C3E723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3044	powershell.exe
5840	powershell.exe
3068	powershell.exe
2792	powershell.exe
5520	powershell.exe
2888	powershell.exe
4272	powershell.exe
5996	powershell.exe
3120	powershell.exe
5044	powershell.exe
4332	powershell.exe
4676	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
4596	composer.dat.exe
4596	composer.dat.exe
4596	composer.dat.exe
4596	composer.dat.exe
4596	composer.dat.exe
4596	composer.dat.exe
4596	composer.dat.exe
4596	composer.dat.exe
4596	composer.dat.exe
4596	composer.dat.exe
4596	composer.dat.exe
4596	composer.dat.exe
4596	composer.dat.exe
4596	composer.dat.exe
4596	composer.dat.exe

Executes a command shell one-liner 1 TTPs 12 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3380	cmd.exe
4376	cmd.exe
4988	cmd.exe
3112	cmd.exe
2892	cmd.exe
2936	cmd.exe
6120	cmd.exe
2272	cmd.exe
3644	cmd.exe
5280	cmd.exe
1776	cmd.exe
2560	cmd.exe

Suspicious behavior: EnumeratesProcesses 33 IoCs

pid	Process
4596	composer.dat.exe
4596	composer.dat.exe
5996	powershell.exe
5996	powershell.exe
3120	powershell.exe
3120	powershell.exe
3044	powershell.exe
3044	powershell.exe
5840	powershell.exe
5840	powershell.exe
5840	powershell.exe
5044	powershell.exe
5044	powershell.exe
4332	powershell.exe
4332	powershell.exe
3068	powershell.exe
3068	powershell.exe
3068	powershell.exe
2792	powershell.exe
2792	powershell.exe
2792	powershell.exe
4676	powershell.exe
4676	powershell.exe
4676	powershell.exe
5520	powershell.exe
5520	powershell.exe
5520	powershell.exe
2888	powershell.exe
2888	powershell.exe
2888	powershell.exe
4272	powershell.exe
4272	powershell.exe
4272	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4596	composer.dat.exe
Token: SeDebugPrivilege	5996	powershell.exe
Token: SeIncreaseQuotaPrivilege	5996	powershell.exe
Token: SeSecurityPrivilege	5996	powershell.exe
Token: SeTakeOwnershipPrivilege	5996	powershell.exe
Token: SeLoadDriverPrivilege	5996	powershell.exe
Token: SeSystemProfilePrivilege	5996	powershell.exe
Token: SeSystemtimePrivilege	5996	powershell.exe
Token: SeProfSingleProcessPrivilege	5996	powershell.exe
Token: SeIncBasePriorityPrivilege	5996	powershell.exe
Token: SeCreatePagefilePrivilege	5996	powershell.exe
Token: SeBackupPrivilege	5996	powershell.exe
Token: SeRestorePrivilege	5996	powershell.exe
Token: SeShutdownPrivilege	5996	powershell.exe
Token: SeDebugPrivilege	5996	powershell.exe
Token: SeSystemEnvironmentPrivilege	5996	powershell.exe
Token: SeRemoteShutdownPrivilege	5996	powershell.exe
Token: SeUndockPrivilege	5996	powershell.exe
Token: SeManageVolumePrivilege	5996	powershell.exe
Token: 33	5996	powershell.exe
Token: 34	5996	powershell.exe
Token: 35	5996	powershell.exe
Token: 36	5996	powershell.exe
Token: SeDebugPrivilege	3120	powershell.exe
Token: SeIncreaseQuotaPrivilege	3120	powershell.exe
Token: SeSecurityPrivilege	3120	powershell.exe
Token: SeTakeOwnershipPrivilege	3120	powershell.exe
Token: SeLoadDriverPrivilege	3120	powershell.exe
Token: SeSystemProfilePrivilege	3120	powershell.exe
Token: SeSystemtimePrivilege	3120	powershell.exe
Token: SeProfSingleProcessPrivilege	3120	powershell.exe
Token: SeIncBasePriorityPrivilege	3120	powershell.exe
Token: SeCreatePagefilePrivilege	3120	powershell.exe
Token: SeBackupPrivilege	3120	powershell.exe
Token: SeRestorePrivilege	3120	powershell.exe
Token: SeShutdownPrivilege	3120	powershell.exe
Token: SeDebugPrivilege	3120	powershell.exe
Token: SeSystemEnvironmentPrivilege	3120	powershell.exe
Token: SeRemoteShutdownPrivilege	3120	powershell.exe
Token: SeUndockPrivilege	3120	powershell.exe
Token: SeManageVolumePrivilege	3120	powershell.exe
Token: 33	3120	powershell.exe
Token: 34	3120	powershell.exe
Token: 35	3120	powershell.exe
Token: 36	3120	powershell.exe
Token: SeDebugPrivilege	3044	powershell.exe
Token: SeIncreaseQuotaPrivilege	3044	powershell.exe
Token: SeSecurityPrivilege	3044	powershell.exe
Token: SeTakeOwnershipPrivilege	3044	powershell.exe
Token: SeLoadDriverPrivilege	3044	powershell.exe
Token: SeSystemProfilePrivilege	3044	powershell.exe
Token: SeSystemtimePrivilege	3044	powershell.exe
Token: SeProfSingleProcessPrivilege	3044	powershell.exe
Token: SeIncBasePriorityPrivilege	3044	powershell.exe
Token: SeCreatePagefilePrivilege	3044	powershell.exe
Token: SeBackupPrivilege	3044	powershell.exe
Token: SeRestorePrivilege	3044	powershell.exe
Token: SeShutdownPrivilege	3044	powershell.exe
Token: SeDebugPrivilege	3044	powershell.exe
Token: SeSystemEnvironmentPrivilege	3044	powershell.exe
Token: SeRemoteShutdownPrivilege	3044	powershell.exe
Token: SeUndockPrivilege	3044	powershell.exe
Token: SeManageVolumePrivilege	3044	powershell.exe
Token: 33	3044	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4844 wrote to memory of 4596	4844	composer.dat.exe	89
PID 4596 wrote to memory of 6120	4596	composer.dat.exe	90
PID 6120 wrote to memory of 5996	6120	cmd.exe	92
PID 4596 wrote to memory of 2560	4596	composer.dat.exe	94
PID 2560 wrote to memory of 3120	2560	cmd.exe	96
PID 4596 wrote to memory of 3380	4596	composer.dat.exe	97
PID 3380 wrote to memory of 3044	3380	cmd.exe	99
PID 4596 wrote to memory of 2272	4596	composer.dat.exe	100
PID 2272 wrote to memory of 5840	2272	cmd.exe	102
PID 4596 wrote to memory of 4376	4596	composer.dat.exe	103
PID 4376 wrote to memory of 5044	4376	cmd.exe	105
PID 4596 wrote to memory of 4988	4596	composer.dat.exe	106
PID 4988 wrote to memory of 4332	4988	cmd.exe	108
PID 4596 wrote to memory of 3644	4596	composer.dat.exe	109
PID 3644 wrote to memory of 3068	3644	cmd.exe	111
PID 4596 wrote to memory of 5280	4596	composer.dat.exe	112
PID 5280 wrote to memory of 2792	5280	cmd.exe	114
PID 4596 wrote to memory of 3112	4596	composer.dat.exe	115
PID 3112 wrote to memory of 4676	3112	cmd.exe	117
PID 4596 wrote to memory of 2892	4596	composer.dat.exe	118
PID 2892 wrote to memory of 5520	2892	cmd.exe	120
PID 4596 wrote to memory of 2936	4596	composer.dat.exe	121
PID 2936 wrote to memory of 2888	2936	cmd.exe	123
PID 4596 wrote to memory of 1776	4596	composer.dat.exe	125
PID 1776 wrote to memory of 4272	1776	cmd.exe	127

C:\Users\Admin\AppData\Local\Temp\composer.dat.exe
"C:\Users\Admin\AppData\Local\Temp\composer.dat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4844
- C:\Users\Admin\AppData\Local\Temp\composer.dat.exe
  "C:\Users\Admin\AppData\Local\Temp\composer.dat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4596
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6120
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5996
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Accounts\xunikaq'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2560
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Accounts\xunikaq'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3120
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3380
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2272
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5840
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4376
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4988
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4332
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3644
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3068
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5280
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2792
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3112
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4676
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2892
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5520
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2936
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2888
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1776
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4272

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact