62372c7464bcdfd03129aed0a9aa1d6dd892695f39e3fbb911d88b1d93019f77

Analysis

max time kernel
149s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/08/2026, 01:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
composer.dat.exe
Size 13.4MB
Sample260811-ca61csshle
SHA256 62372c7464bcdfd03129aed0a9aa1d6dd892695f39e3fbb911d88b1d93019f77
MD5 2cefe539eb25c4730b0af2d05058f695
SHA1 e2c6da60a9a11054dde3b572567c95fd73d044c0
SHA512 b5133d4a3c6926763bac650f4ed9f43f3a5edd69b0edc6945a5231137350ba5e906cdfa1c32f4630856207efe54949269ac8a0b3b5809d42d9a227e13b4eed99
SSDEEP 393216:WkTUTyaT3RJ3XMkZZaopSrxdGFLnTwC11SD0R0XMCHWUj6cuI3/PGTAI:WkAOaTB5XFZcopSHG5911SYR0XMb83Hm
TLSH
T153E6330C6AE016EADCA3917DFEC265B1F199F8A61372C5DB87AC07216E531A05C3E713
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1480	powershell.exe
1200	powershell.exe
2664	powershell.exe
2044	powershell.exe
2036	powershell.exe
2092	powershell.exe
6140	powershell.exe
1556	powershell.exe
2084	powershell.exe
2776	powershell.exe
5448	powershell.exe
1120	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
4628	composer.dat.exe
4628	composer.dat.exe
4628	composer.dat.exe
4628	composer.dat.exe
4628	composer.dat.exe
4628	composer.dat.exe
4628	composer.dat.exe
4628	composer.dat.exe
4628	composer.dat.exe
4628	composer.dat.exe
4628	composer.dat.exe
4628	composer.dat.exe
4628	composer.dat.exe
4628	composer.dat.exe
4628	composer.dat.exe

Executes a command shell one-liner 1 TTPs 12 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2568	cmd.exe
5196	cmd.exe
1632	cmd.exe
2704	cmd.exe
2296	cmd.exe
5868	cmd.exe
2972	cmd.exe
4304	cmd.exe
3532	cmd.exe
5096	cmd.exe
3632	cmd.exe
3744	cmd.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
4628	composer.dat.exe
4628	composer.dat.exe
2776	powershell.exe
2776	powershell.exe
2036	powershell.exe
2036	powershell.exe
2036	powershell.exe
5448	powershell.exe
5448	powershell.exe
5448	powershell.exe
2092	powershell.exe
2092	powershell.exe
2092	powershell.exe
1120	powershell.exe
1120	powershell.exe
1120	powershell.exe
1480	powershell.exe
1480	powershell.exe
1480	powershell.exe
6140	powershell.exe
6140	powershell.exe
6140	powershell.exe
1556	powershell.exe
1556	powershell.exe
2084	powershell.exe
2084	powershell.exe
1200	powershell.exe
1200	powershell.exe
2664	powershell.exe
2664	powershell.exe
2044	powershell.exe
2044	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4628	composer.dat.exe
Token: SeDebugPrivilege	2776	powershell.exe
Token: SeIncreaseQuotaPrivilege	2776	powershell.exe
Token: SeSecurityPrivilege	2776	powershell.exe
Token: SeTakeOwnershipPrivilege	2776	powershell.exe
Token: SeLoadDriverPrivilege	2776	powershell.exe
Token: SeSystemProfilePrivilege	2776	powershell.exe
Token: SeSystemtimePrivilege	2776	powershell.exe
Token: SeProfSingleProcessPrivilege	2776	powershell.exe
Token: SeIncBasePriorityPrivilege	2776	powershell.exe
Token: SeCreatePagefilePrivilege	2776	powershell.exe
Token: SeBackupPrivilege	2776	powershell.exe
Token: SeRestorePrivilege	2776	powershell.exe
Token: SeShutdownPrivilege	2776	powershell.exe
Token: SeDebugPrivilege	2776	powershell.exe
Token: SeSystemEnvironmentPrivilege	2776	powershell.exe
Token: SeRemoteShutdownPrivilege	2776	powershell.exe
Token: SeUndockPrivilege	2776	powershell.exe
Token: SeManageVolumePrivilege	2776	powershell.exe
Token: 33	2776	powershell.exe
Token: 34	2776	powershell.exe
Token: 35	2776	powershell.exe
Token: 36	2776	powershell.exe
Token: SeDebugPrivilege	2036	powershell.exe
Token: SeIncreaseQuotaPrivilege	2036	powershell.exe
Token: SeSecurityPrivilege	2036	powershell.exe
Token: SeTakeOwnershipPrivilege	2036	powershell.exe
Token: SeLoadDriverPrivilege	2036	powershell.exe
Token: SeSystemProfilePrivilege	2036	powershell.exe
Token: SeSystemtimePrivilege	2036	powershell.exe
Token: SeProfSingleProcessPrivilege	2036	powershell.exe
Token: SeIncBasePriorityPrivilege	2036	powershell.exe
Token: SeCreatePagefilePrivilege	2036	powershell.exe
Token: SeBackupPrivilege	2036	powershell.exe
Token: SeRestorePrivilege	2036	powershell.exe
Token: SeShutdownPrivilege	2036	powershell.exe
Token: SeDebugPrivilege	2036	powershell.exe
Token: SeSystemEnvironmentPrivilege	2036	powershell.exe
Token: SeRemoteShutdownPrivilege	2036	powershell.exe
Token: SeUndockPrivilege	2036	powershell.exe
Token: SeManageVolumePrivilege	2036	powershell.exe
Token: 33	2036	powershell.exe
Token: 34	2036	powershell.exe
Token: 35	2036	powershell.exe
Token: 36	2036	powershell.exe
Token: SeDebugPrivilege	5448	powershell.exe
Token: SeIncreaseQuotaPrivilege	5448	powershell.exe
Token: SeSecurityPrivilege	5448	powershell.exe
Token: SeTakeOwnershipPrivilege	5448	powershell.exe
Token: SeLoadDriverPrivilege	5448	powershell.exe
Token: SeSystemProfilePrivilege	5448	powershell.exe
Token: SeSystemtimePrivilege	5448	powershell.exe
Token: SeProfSingleProcessPrivilege	5448	powershell.exe
Token: SeIncBasePriorityPrivilege	5448	powershell.exe
Token: SeCreatePagefilePrivilege	5448	powershell.exe
Token: SeBackupPrivilege	5448	powershell.exe
Token: SeRestorePrivilege	5448	powershell.exe
Token: SeShutdownPrivilege	5448	powershell.exe
Token: SeDebugPrivilege	5448	powershell.exe
Token: SeSystemEnvironmentPrivilege	5448	powershell.exe
Token: SeRemoteShutdownPrivilege	5448	powershell.exe
Token: SeUndockPrivilege	5448	powershell.exe
Token: SeManageVolumePrivilege	5448	powershell.exe
Token: 33	5448	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 3332 wrote to memory of 4628	3332	composer.dat.exe	89
PID 4628 wrote to memory of 3532	4628	composer.dat.exe	90
PID 3532 wrote to memory of 2776	3532	cmd.exe	92
PID 4628 wrote to memory of 5096	4628	composer.dat.exe	94
PID 5096 wrote to memory of 2036	5096	cmd.exe	96
PID 4628 wrote to memory of 2704	4628	composer.dat.exe	97
PID 2704 wrote to memory of 5448	2704	cmd.exe	99
PID 4628 wrote to memory of 2296	4628	composer.dat.exe	100
PID 2296 wrote to memory of 2092	2296	cmd.exe	102
PID 4628 wrote to memory of 3632	4628	composer.dat.exe	103
PID 3632 wrote to memory of 1120	3632	cmd.exe	105
PID 4628 wrote to memory of 3744	4628	composer.dat.exe	106
PID 3744 wrote to memory of 1480	3744	cmd.exe	108
PID 4628 wrote to memory of 2568	4628	composer.dat.exe	109
PID 2568 wrote to memory of 6140	2568	cmd.exe	111
PID 4628 wrote to memory of 5868	4628	composer.dat.exe	112
PID 5868 wrote to memory of 1556	5868	cmd.exe	114
PID 4628 wrote to memory of 5196	4628	composer.dat.exe	115
PID 5196 wrote to memory of 2084	5196	cmd.exe	117
PID 4628 wrote to memory of 2972	4628	composer.dat.exe	118
PID 2972 wrote to memory of 1200	2972	cmd.exe	120
PID 4628 wrote to memory of 4304	4628	composer.dat.exe	121
PID 4304 wrote to memory of 2664	4304	cmd.exe	123
PID 4628 wrote to memory of 1632	4628	composer.dat.exe	124
PID 1632 wrote to memory of 2044	1632	cmd.exe	126

C:\Users\Admin\AppData\Local\Temp\composer.dat.exe
"C:\Users\Admin\AppData\Local\Temp\composer.dat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3332
- C:\Users\Admin\AppData\Local\Temp\composer.dat.exe
  "C:\Users\Admin\AppData\Local\Temp\composer.dat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4628
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3532
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2776
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Accounts\tategig'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5096
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Accounts\tategig'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2036
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2704
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5448
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2296
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3632
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1120
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3744
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1480
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2568
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:6140
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5868
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1556
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5196
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2084
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2972
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1200
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4304
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2664
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1632
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2044

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact