35affffe7d3ef594249fd4f657ff616180e864285d89f389c296e51465db514b

Analysis

max time kernel
150s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/08/2026, 08:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
composer.dat.exe
Size 13.4MB
Sample260811-ktw89swset
SHA256 35affffe7d3ef594249fd4f657ff616180e864285d89f389c296e51465db514b
MD5 3f65f2e2a66c01de0b412b236f23ce81
SHA1 271f04c53aa001742acdae512b6fa179681a0bd1
SHA512 8e79448ba5635dac2a3c9dde426441a8c5a544303eee6422f5b4cf60f39208a22b2c4f0454e2eae6b831da2acc4c00d3e6f9ff687b1e69518cb2d316459c49e8
SSDEEP 393216:hxmga8cNJ2BVMMQ91r6eGHRSQPXMCHWUj9cuI3/PGTAI:hxpyYnMM+4RSQPXMb8KH/O7
TLSH
T16EE6334CA2D016FEEDB30438DFE51861D935B8764B72C2EF5BA897523D231C05A3AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3028	powershell.exe
4756	powershell.exe
2860	powershell.exe
5616	powershell.exe
3052	powershell.exe
5412	powershell.exe
4704	powershell.exe
4820	powershell.exe
2404	powershell.exe
420	powershell.exe
2896	powershell.exe
2364	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
6116	composer.dat.exe
6116	composer.dat.exe
6116	composer.dat.exe
6116	composer.dat.exe
6116	composer.dat.exe
6116	composer.dat.exe
6116	composer.dat.exe
6116	composer.dat.exe
6116	composer.dat.exe
6116	composer.dat.exe
6116	composer.dat.exe
6116	composer.dat.exe
6116	composer.dat.exe
6116	composer.dat.exe
6116	composer.dat.exe

Executes a command shell one-liner 1 TTPs 12 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2568	cmd.exe
3584	cmd.exe
2956	cmd.exe
4808	cmd.exe
4732	cmd.exe
2100	cmd.exe
1416	cmd.exe
5540	cmd.exe
5528	cmd.exe
2516	cmd.exe
6128	cmd.exe
3484	cmd.exe

Suspicious behavior: EnumeratesProcesses 38 IoCs

pid	Process
6116	composer.dat.exe
6116	composer.dat.exe
3028	powershell.exe
3028	powershell.exe
3028	powershell.exe
4756	powershell.exe
4756	powershell.exe
4756	powershell.exe
2860	powershell.exe
2860	powershell.exe
2860	powershell.exe
4704	powershell.exe
4704	powershell.exe
4704	powershell.exe
5616	powershell.exe
5616	powershell.exe
5616	powershell.exe
4820	powershell.exe
4820	powershell.exe
4820	powershell.exe
3052	powershell.exe
3052	powershell.exe
3052	powershell.exe
5412	powershell.exe
5412	powershell.exe
5412	powershell.exe
2404	powershell.exe
2404	powershell.exe
2404	powershell.exe
420	powershell.exe
420	powershell.exe
420	powershell.exe
2896	powershell.exe
2896	powershell.exe
2896	powershell.exe
2364	powershell.exe
2364	powershell.exe
2364	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	6116	composer.dat.exe
Token: SeDebugPrivilege	3028	powershell.exe
Token: SeIncreaseQuotaPrivilege	3028	powershell.exe
Token: SeSecurityPrivilege	3028	powershell.exe
Token: SeTakeOwnershipPrivilege	3028	powershell.exe
Token: SeLoadDriverPrivilege	3028	powershell.exe
Token: SeSystemProfilePrivilege	3028	powershell.exe
Token: SeSystemtimePrivilege	3028	powershell.exe
Token: SeProfSingleProcessPrivilege	3028	powershell.exe
Token: SeIncBasePriorityPrivilege	3028	powershell.exe
Token: SeCreatePagefilePrivilege	3028	powershell.exe
Token: SeBackupPrivilege	3028	powershell.exe
Token: SeRestorePrivilege	3028	powershell.exe
Token: SeShutdownPrivilege	3028	powershell.exe
Token: SeDebugPrivilege	3028	powershell.exe
Token: SeSystemEnvironmentPrivilege	3028	powershell.exe
Token: SeRemoteShutdownPrivilege	3028	powershell.exe
Token: SeUndockPrivilege	3028	powershell.exe
Token: SeManageVolumePrivilege	3028	powershell.exe
Token: 33	3028	powershell.exe
Token: 34	3028	powershell.exe
Token: 35	3028	powershell.exe
Token: 36	3028	powershell.exe
Token: SeDebugPrivilege	4756	powershell.exe
Token: SeIncreaseQuotaPrivilege	4756	powershell.exe
Token: SeSecurityPrivilege	4756	powershell.exe
Token: SeTakeOwnershipPrivilege	4756	powershell.exe
Token: SeLoadDriverPrivilege	4756	powershell.exe
Token: SeSystemProfilePrivilege	4756	powershell.exe
Token: SeSystemtimePrivilege	4756	powershell.exe
Token: SeProfSingleProcessPrivilege	4756	powershell.exe
Token: SeIncBasePriorityPrivilege	4756	powershell.exe
Token: SeCreatePagefilePrivilege	4756	powershell.exe
Token: SeBackupPrivilege	4756	powershell.exe
Token: SeRestorePrivilege	4756	powershell.exe
Token: SeShutdownPrivilege	4756	powershell.exe
Token: SeDebugPrivilege	4756	powershell.exe
Token: SeSystemEnvironmentPrivilege	4756	powershell.exe
Token: SeRemoteShutdownPrivilege	4756	powershell.exe
Token: SeUndockPrivilege	4756	powershell.exe
Token: SeManageVolumePrivilege	4756	powershell.exe
Token: 33	4756	powershell.exe
Token: 34	4756	powershell.exe
Token: 35	4756	powershell.exe
Token: 36	4756	powershell.exe
Token: SeDebugPrivilege	2860	powershell.exe
Token: SeIncreaseQuotaPrivilege	2860	powershell.exe
Token: SeSecurityPrivilege	2860	powershell.exe
Token: SeTakeOwnershipPrivilege	2860	powershell.exe
Token: SeLoadDriverPrivilege	2860	powershell.exe
Token: SeSystemProfilePrivilege	2860	powershell.exe
Token: SeSystemtimePrivilege	2860	powershell.exe
Token: SeProfSingleProcessPrivilege	2860	powershell.exe
Token: SeIncBasePriorityPrivilege	2860	powershell.exe
Token: SeCreatePagefilePrivilege	2860	powershell.exe
Token: SeBackupPrivilege	2860	powershell.exe
Token: SeRestorePrivilege	2860	powershell.exe
Token: SeShutdownPrivilege	2860	powershell.exe
Token: SeDebugPrivilege	2860	powershell.exe
Token: SeSystemEnvironmentPrivilege	2860	powershell.exe
Token: SeRemoteShutdownPrivilege	2860	powershell.exe
Token: SeUndockPrivilege	2860	powershell.exe
Token: SeManageVolumePrivilege	2860	powershell.exe
Token: 33	2860	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2560 wrote to memory of 6116	2560	composer.dat.exe	88
PID 6116 wrote to memory of 2516	6116	composer.dat.exe	89
PID 2516 wrote to memory of 3028	2516	cmd.exe	91
PID 6116 wrote to memory of 6128	6116	composer.dat.exe	93
PID 6128 wrote to memory of 4756	6128	cmd.exe	95
PID 6116 wrote to memory of 3484	6116	composer.dat.exe	96
PID 3484 wrote to memory of 2860	3484	cmd.exe	98
PID 6116 wrote to memory of 2568	6116	composer.dat.exe	99
PID 2568 wrote to memory of 4704	2568	cmd.exe	101
PID 6116 wrote to memory of 2100	6116	composer.dat.exe	102
PID 2100 wrote to memory of 5616	2100	cmd.exe	104
PID 6116 wrote to memory of 3584	6116	composer.dat.exe	105
PID 3584 wrote to memory of 4820	3584	cmd.exe	107
PID 6116 wrote to memory of 2956	6116	composer.dat.exe	108
PID 2956 wrote to memory of 3052	2956	cmd.exe	110
PID 6116 wrote to memory of 1416	6116	composer.dat.exe	111
PID 1416 wrote to memory of 5412	1416	cmd.exe	113
PID 6116 wrote to memory of 4808	6116	composer.dat.exe	114
PID 4808 wrote to memory of 2404	4808	cmd.exe	116
PID 6116 wrote to memory of 5540	6116	composer.dat.exe	117
PID 5540 wrote to memory of 420	5540	cmd.exe	119
PID 6116 wrote to memory of 4732	6116	composer.dat.exe	120
PID 4732 wrote to memory of 2896	4732	cmd.exe	122
PID 6116 wrote to memory of 5528	6116	composer.dat.exe	123
PID 5528 wrote to memory of 2364	5528	cmd.exe	125

C:\Users\Admin\AppData\Local\Temp\composer.dat.exe
"C:\Users\Admin\AppData\Local\Temp\composer.dat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2560
- C:\Users\Admin\AppData\Local\Temp\composer.dat.exe
  "C:\Users\Admin\AppData\Local\Temp\composer.dat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:6116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2516
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3028
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Accounts\tategig'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6128
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Accounts\tategig'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4756
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3484
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2860
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2568
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4704
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2100
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5616
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3584
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4820
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2956
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3052
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1416
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4808
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2404
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5540
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4732
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2896
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5528
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2364

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact