defendnot | f5c9e4ad8ca1843aaa87eb0e3ea160e8256c5da50349ac186bb7ee83704224f2

Analysis

max time kernel
148s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 21:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
592482_vcomp140_12652a425a.exe
Size 11.1MB
Sample260925-1mryzazzcs
SHA256 f5c9e4ad8ca1843aaa87eb0e3ea160e8256c5da50349ac186bb7ee83704224f2
MD5 a3dc49c98a65d1be73b6239ef879f119
SHA1 e43bcdcd1db7aab0af5cab1fac4a714244fa4dde
SHA512 c1fd269c8f56c9357ac17bdc37b859a3ff1bd828296886d3d3ab0f581ab959c431dbce3b6c3b13a1447443064e6d5c08aa24b37377a58f385947e96b196d9b93
SSDEEP 98304:kEBBm3eksOLFo0Auxn2BJcdf0m+ApQJneLpxRAE2bKRPNqQ5hLLJ/slTlXT+mYV5:khetOxrncncOApmneSrbnQ5Z5sTjVYH
TLSH
T1ADC69D03ECA545E9C1ADE5358A669263BB717C480F2523D33B90F3282F76BD06EB6750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution defendnot hacktool persistence

Malware Config

Signatures

Family: Defendnot
Defendnot is a tool designed to disable Microsoft Defender.
hacktool defendnot

Detects Defendnot 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c527-46.dat	family_defendnot

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2056	powershell.exe
4880	powershell.exe
3868	powershell.exe

Executes dropped EXE 3 IoCs

pid	Process
1180	defendnot-loader.exe
3808	updater_CyAhxCQo.exe
4300	defendnot-loader.exe

Loads dropped DLL 2 IoCs

pid	Process
5508	Taskmgr.exe
5624	Taskmgr.exe

Enumerates connected drives 3 TTPs 3 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\ModifiableWindowsApps\hydraueroocts.txt	updater_CyAhxCQo.exe
File opened for modification	C:\Program Files\stevedore\irtyiunn.dat	updater_CyAhxCQo.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SzMoTeu1\defendnot.dll	592482_vcomp140_12652a425a.exe
File opened for modification	C:\Windows\SzMoTeu1\defendnot-loader.exe	592482_vcomp140_12652a425a.exe
File created	C:\Windows\SzMoTeu1\ctx.bin	defendnot-loader.exe
File opened for modification	C:\Windows\SzMoTeu1\ctx.bin	defendnot-loader.exe
File opened for modification	C:\Windows\SERVIC~1\LOCALS~1\AppData\Local\Temp\MpCmdRun.log	MpCmdRun.exe
File opened for modification	C:\Windows\SzMoTeu1\defendnot-loader.pdb	592482_vcomp140_12652a425a.exe
File opened for modification	C:\Windows\SzMoTeu1\defendnot.pdb	592482_vcomp140_12652a425a.exe
File opened for modification	C:\Windows\SzMoTeu1\extra-strip.bat	592482_vcomp140_12652a425a.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3548	cmd.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2056	powershell.exe
2056	powershell.exe
4880	powershell.exe
4880	powershell.exe
3868	powershell.exe
3868	powershell.exe
3868	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5748	explorer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2056	powershell.exe
Token: SeIncreaseQuotaPrivilege	2056	powershell.exe
Token: SeSecurityPrivilege	2056	powershell.exe
Token: SeTakeOwnershipPrivilege	2056	powershell.exe
Token: SeLoadDriverPrivilege	2056	powershell.exe
Token: SeSystemProfilePrivilege	2056	powershell.exe
Token: SeSystemtimePrivilege	2056	powershell.exe
Token: SeProfSingleProcessPrivilege	2056	powershell.exe
Token: SeIncBasePriorityPrivilege	2056	powershell.exe
Token: SeCreatePagefilePrivilege	2056	powershell.exe
Token: SeBackupPrivilege	2056	powershell.exe
Token: SeRestorePrivilege	2056	powershell.exe
Token: SeShutdownPrivilege	2056	powershell.exe
Token: SeDebugPrivilege	2056	powershell.exe
Token: SeSystemEnvironmentPrivilege	2056	powershell.exe
Token: SeRemoteShutdownPrivilege	2056	powershell.exe
Token: SeUndockPrivilege	2056	powershell.exe
Token: SeManageVolumePrivilege	2056	powershell.exe
Token: 33	2056	powershell.exe
Token: 34	2056	powershell.exe
Token: 35	2056	powershell.exe
Token: 36	2056	powershell.exe
Token: SeDebugPrivilege	4880	powershell.exe
Token: SeIncreaseQuotaPrivilege	4880	powershell.exe
Token: SeSecurityPrivilege	4880	powershell.exe
Token: SeTakeOwnershipPrivilege	4880	powershell.exe
Token: SeLoadDriverPrivilege	4880	powershell.exe
Token: SeSystemProfilePrivilege	4880	powershell.exe
Token: SeSystemtimePrivilege	4880	powershell.exe
Token: SeProfSingleProcessPrivilege	4880	powershell.exe
Token: SeIncBasePriorityPrivilege	4880	powershell.exe
Token: SeCreatePagefilePrivilege	4880	powershell.exe
Token: SeBackupPrivilege	4880	powershell.exe
Token: SeRestorePrivilege	4880	powershell.exe
Token: SeShutdownPrivilege	4880	powershell.exe
Token: SeDebugPrivilege	4880	powershell.exe
Token: SeSystemEnvironmentPrivilege	4880	powershell.exe
Token: SeRemoteShutdownPrivilege	4880	powershell.exe
Token: SeUndockPrivilege	4880	powershell.exe
Token: SeManageVolumePrivilege	4880	powershell.exe
Token: 33	4880	powershell.exe
Token: 34	4880	powershell.exe
Token: 35	4880	powershell.exe
Token: 36	4880	powershell.exe
Token: SeDebugPrivilege	3868	powershell.exe
Token: SeShutdownPrivilege	5748	explorer.exe
Token: SeCreatePagefilePrivilege	5748	explorer.exe
Token: SeShutdownPrivilege	5748	explorer.exe
Token: SeCreatePagefilePrivilege	5748	explorer.exe
Token: SeShutdownPrivilege	5748	explorer.exe
Token: SeCreatePagefilePrivilege	5748	explorer.exe
Token: SeShutdownPrivilege	5748	explorer.exe
Token: SeCreatePagefilePrivilege	5748	explorer.exe
Token: SeShutdownPrivilege	5748	explorer.exe
Token: SeCreatePagefilePrivilege	5748	explorer.exe
Token: SeShutdownPrivilege	5748	explorer.exe
Token: SeCreatePagefilePrivilege	5748	explorer.exe
Token: SeShutdownPrivilege	5748	explorer.exe
Token: SeCreatePagefilePrivilege	5748	explorer.exe
Token: SeShutdownPrivilege	5748	explorer.exe
Token: SeCreatePagefilePrivilege	5748	explorer.exe
Token: SeShutdownPrivilege	5748	explorer.exe
Token: SeCreatePagefilePrivilege	5748	explorer.exe
Token: SeShutdownPrivilege	5748	explorer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3808	updater_CyAhxCQo.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3112 wrote to memory of 2056	3112	592482_vcomp140_12652a425a.exe	90
PID 3112 wrote to memory of 4880	3112	592482_vcomp140_12652a425a.exe	93
PID 3112 wrote to memory of 1180	3112	592482_vcomp140_12652a425a.exe	95
PID 3112 wrote to memory of 3868	3112	592482_vcomp140_12652a425a.exe	96
PID 1180 wrote to memory of 5508	1180	defendnot-loader.exe	98
PID 3112 wrote to memory of 3808	3112	592482_vcomp140_12652a425a.exe	99
PID 3808 wrote to memory of 5748	3808	updater_CyAhxCQo.exe	81
PID 5748 wrote to memory of 5952	5748	explorer.exe
PID 4300 wrote to memory of 5624	4300	defendnot-loader.exe	103
PID 4300 wrote to memory of 3548	4300	defendnot-loader.exe	106

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5748
- C:\Users\Admin\AppData\Local\Temp\592482_vcomp140_12652a425a.exe
  "C:\Users\Admin\AppData\Local\Temp\592482_vcomp140_12652a425a.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:3112
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Microsoft
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2056
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command Add-MpPreference -ExclusionPath C:\Windows
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4880
- - C:\Windows\SzMoTeu1\defendnot-loader.exe
    C:\Windows\SzMoTeu1\defendnot-loader.exe --silent
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:1180
  - - C:\Windows\SYSTEM32\Taskmgr.exe
      Taskmgr.exe
      4⤵
      Loads dropped DLL
      PID:5508
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -Command C:\Users\Admin\AppData\Local\Temp\dn-814976089.ps1
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3868
- - C:\Users\Admin\AppData\Local\Microsoft\updater_CyAhxCQo.exe
    C:\Users\Admin\AppData\Local\Microsoft\updater_CyAhxCQo.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3808

C:\Windows\SzMoTeu1\defendnot-loader.exe
C:\Windows\SzMoTeu1\defendnot-loader.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4300
- C:\Windows\SYSTEM32\Taskmgr.exe
  Taskmgr.exe
  2⤵
  - Loads dropped DLL
  PID:5624
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  - Executes a command shell one-liner
  PID:3548

C:\Program Files\Windows Defender\MpCmdRun.exe
"C:\Program Files\Windows Defender\MpCmdRun.exe" -wdenable
1⤵
- Drops file in Windows directory
PID:5384

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
MD5 acbc65123954839a819fa2495d239bf7
SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
TLSH
T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 ff8134d404f9b6eaa0e6d6731b432723534ff3daf6ccad150dba45e172df12a5
MD5 a68b9d1d59578a28e76d2b43897c5a64
SHA1 1a461d4df9e645217ad82f6c6137878b250ea4a1
SHA512 6a0664bb44517029aa08e1d3a0c900d630fc3988a1d3251b8e8e9446e3e5c99bb6be8aafb7692962fa88027fd1cb8820e60af1cf928ffabe2d71a702c5cd93a1
TLSH
T11A216833B3DD8624C89A413A10CDAC1036B6C7DB41DECFAB6B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

updater_CyAhxCQo.exe

Path C:\Users\Admin\AppData\Local\Microsoft\updater_CyAhxCQo.exe
Size 778KB
SHA256 ef54c39c5433ab9e782ad8933d8120ac10ff4ea53788e26ab366a1b24cb1d0e5
MD5 386e9d4b5312e0e33a86bd37e380810e
SHA1 d7e5b30e0f486e819cfd4dbb19bcd5b6323c9f67
SHA512 8c8f36ed13a85ee61ee6ff99440a2c4581468f10e2923432545a39efec8808b6168f0ca987987054342dfa73a68a1cce24eab4b21eb371bf1c82397492c07743
SSDEEP 12288:WY7NxlDWRoizlYBJdWB/SpOaQiuDcP3okpWlfdamn8jO3rxI0NetyWSz:LNxbUYTOasDcvokGn8A60NU
TLSH
T1E205010D6ABD42FBC452213C845146033AA4BC8543F8DFFB079B40673E769A94A7DEE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_yvkkkgxs.px2.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yvkkkgxs.px2.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

dn-814976089.ps1

Path C:\Users\Admin\AppData\Local\Temp\dn-814976089.ps1
Size 2KB
SHA256 3888ffb268a0251bf49d7b140349006359e457a6e823e1d742da0d3057994578
MD5 4416740f2b112f9a574b79a729c37ee0
SHA1 4f5d2ad1b99f26af5064f5ed03dc5e82714d276d
SHA512 76cebb19d61ccdd0993d02d2709641f2bd2cbd3cd0d3d0fbceaf681a282c26359d01f82857736d98aa9421b9abecb3f77bf0c96364c42b73cfe2320807509127
TLSH
T17D41EF48F699C27055BA5708ED5B0A879C9F243B0202ED2073E9D3CABFE4537C2962C7
MD5 SHA1 SHA512 TLSH

Submit Download

ctx.bin

Path C:\Windows\SzMoTeu1\ctx.bin
Size 132B
SHA256 cf8c05d4e7620cd4ba0a049f96978e9fec37ef4bab51720053cf318a66670014
MD5 6419d9e96a2a134a8dd59401ee0af98e
SHA1 200d2f402a19272649da8de8b6fc5cfd1f6f64c4
SHA512 e011e53a2709a08ecd2a0ffee73db21abe59cb8cea668562da80002b0f01d627e313b862e8c46392af81a1db508f7d76611b2283a7e5f43928a1ea417af732bc
MD5 SHA1 SHA512

Submit Download

defendnot-loader.exe

Path C:\Windows\SzMoTeu1\defendnot-loader.exe
Size 581KB
SHA256 f57a4dd3bd3ce82eaf6d7143e837b3fa59a0accdac76fd3dc053433efdd50e5e
MD5 aa636642fb9c479c7a9763d18862b12e
SHA1 100d02103379ba284c465933394af8b55a90d0b1
SHA512 b03126a3ff4809511388c787bdf6c65f22306840d8b1887924bc5ac0d1e52571cb832771260decbf6e115386aec8bda0b4434086d2b3f07f47f347f768a6db82
SSDEEP 6144:iQbKLBXMhgqo62sYoFJqiE3Wy13avn7aC8xmph0lhSMXlBXBWnlgh7RB9PCn:/1sriq13UaZxmph0lhSMXli4v9m
TLSH
T14BC49D26B7A940F9E1A7C27889930A16EA737C4643516BCF03E44A675F236E04F3FB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

defendnot.dll

Path C:\Windows\SzMoTeu1\defendnot.dll
Size 426KB
SHA256 b0870e105c7ad37fb0bdcb9305279b2943810d55300e8721eb64bdaa588cc84e
MD5 a9283ba8a7afa573b616856fcd00d597
SHA1 904a26e329804812ea42e4a1bb2d62f9eaafcac2
SHA512 81f47b5f5323b099e3c8b2b92576f41cfdde1a3204880f9bf5692dd04b6867ac79dd93c53b830afba5cebd4aeef20a1bee37a4cf57bedfcf67f551ac1f485e5b
SSDEEP 6144:JJnzyCQ6dPBn6KjhoKUpMoAOOLph0lhSMXlBXBWnH7sLBQX1wLj:OCFJUHAOOLph0lhSMXliHoLSXS
TLSH
T11494AE15B7A590B9E16B8274C8570A05EB737C414791EBCF03A4DAB26F237D16B3EB02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2056-7-0x00007FFF868C0000-0x00007FFF87264000-memory.dmp

Download

memory/2056-12-0x00007FFF868C0000-0x00007FFF87264000-memory.dmp

Download

memory/2056-14-0x00007FFF868C0000-0x00007FFF87264000-memory.dmp

Download

memory/2056-15-0x00007FFF868C0000-0x00007FFF87264000-memory.dmp

Download

memory/2056-18-0x00007FFF868C0000-0x00007FFF87264000-memory.dmp

Download

memory/2056-17-0x00007FFF868C0000-0x00007FFF87264000-memory.dmp

Download

memory/2056-19-0x0000021ED74D9000-0x0000021ED74DF000-memory.dmp

Download

memory/2056-13-0x0000021ED7610000-0x0000021ED761A000-memory.dmp

Download

memory/2056-10-0x0000021ED7530000-0x0000021ED754E000-memory.dmp

Download

memory/2056-11-0x0000021ED7550000-0x0000021ED7602000-memory.dmp

Download

memory/2056-6-0x00007FFF868C0000-0x00007FFF87264000-memory.dmp

Download

memory/2056-5-0x00007FFF868C0000-0x00007FFF87264000-memory.dmp

Download

memory/2056-0-0x00007FFF86A4F000-0x00007FFF86A50000-memory.dmp

Download

memory/2056-4-0x0000021ED74E0000-0x0000021ED7502000-memory.dmp

Download

memory/2056-1-0x00007FFF868C0000-0x00007FFF87264000-memory.dmp

Download

memory/4880-26-0x00007FFF868C0000-0x00007FFF87264000-memory.dmp

Download

memory/4880-32-0x00007FFF868C0000-0x00007FFF87264000-memory.dmp

Download

memory/4880-33-0x00007FFF868C0000-0x00007FFF87264000-memory.dmp

Download

memory/4880-34-0x00007FFF868C0000-0x00007FFF87264000-memory.dmp

Download

memory/4880-35-0x00007FFF868C0000-0x00007FFF87264000-memory.dmp

Download

memory/4880-36-0x00007FFF868C0000-0x00007FFF87264000-memory.dmp

Download

memory/4880-37-0x00007FFF868C0000-0x00007FFF87264000-memory.dmp

Download

memory/4880-39-0x00007FFF868C0000-0x00007FFF87264000-memory.dmp

Download

memory/4880-31-0x00007FFF868C0000-0x00007FFF87264000-memory.dmp

Download

memory/4880-28-0x00007FFF868C0000-0x00007FFF87264000-memory.dmp

Download

memory/4880-27-0x00007FFF868C0000-0x00007FFF87264000-memory.dmp

Download

memory/4880-25-0x00007FFF868C0000-0x00007FFF87264000-memory.dmp

Download

memory/4880-24-0x00007FFF868C0000-0x00007FFF87264000-memory.dmp

Download

memory/4880-20-0x00007FFF868C0000-0x00007FFF87264000-memory.dmp

Download

memory/5748-64-0x00000000034E0000-0x0000000003577000-memory.dmp

Download

memory/5748-63-0x00000000034E0000-0x0000000003577000-memory.dmp

Download

memory/5748-62-0x00000000034E0000-0x0000000003577000-memory.dmp

Download

memory/5748-65-0x00000000034E0000-0x0000000003577000-memory.dmp

Download

memory/5748-66-0x00000000009A0000-0x00000000009A1000-memory.dmp

Download