6c51cc4d75ff8f93cd76235d53fa3d5dfc06722f384c2ff8bd239752d088e76e

Analysis

user interaction
yes
max time kernel
54s
max time network
55s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 17:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
CDAT1.26.exe
Size 2.3MB
Sample260930-vxetha1x6q
SHA256 6c51cc4d75ff8f93cd76235d53fa3d5dfc06722f384c2ff8bd239752d088e76e
MD5 bcc6387dcbf8430fa1b99fa9330b2655
SHA1 93ee409e081f6ad2ed4f4afa48281c31a36062b9
SHA512 516d467a80e9978a8343f2656308cf826dd046aef24b8a0d3315a8b86ce22268ededa4a717ca72bf9d67313474afdaf2b546b84769d14008dd9978716bfbe2e7
SSDEEP 12288:+VOgg3pUQ0cyOZ4fbPblTKmpRqdaiTpI052irRBWTykIbvs47mxoMGW:Lj0aZ4fbPbZKmp/iTq05BrRAaUrRGW
TLSH
T16FB5605E498DC405E1F5AB3809F0E48D4A67AD4926E8F67CB28DF4ED3B37A178C28351
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2064	powershell.exe
2836	powershell.exe
3772	powershell.exe

Enumerates connected drives 3 TTPs 12 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2332	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	CDAT1.26.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	CDAT1.26.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
816	systeminfo.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	CDAT1.26.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
2724	powershell.exe
2724	powershell.exe
2724	powershell.exe
2836	powershell.exe
2836	powershell.exe
2836	powershell.exe
3772	powershell.exe
3772	powershell.exe
3772	powershell.exe
4780	powershell.exe
4780	powershell.exe
4780	powershell.exe
644	powershell.exe
644	powershell.exe
644	powershell.exe
4976	powershell.exe
4976	powershell.exe
4976	powershell.exe
3068	powershell.exe
3068	powershell.exe
3068	powershell.exe
2300	powershell.exe
2300	powershell.exe
2300	powershell.exe
4164	powershell.exe
4164	powershell.exe
4164	powershell.exe
1920	powershell.exe
1920	powershell.exe
1920	powershell.exe
2064	powershell.exe
2064	powershell.exe
2064	powershell.exe
5008	powershell.exe
5008	powershell.exe
5008	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1524	CDAT1.26.exe
Token: SeDebugPrivilege	2724	powershell.exe
Token: SeDebugPrivilege	2836	powershell.exe
Token: SeIncreaseQuotaPrivilege	2836	powershell.exe
Token: SeSecurityPrivilege	2836	powershell.exe
Token: SeTakeOwnershipPrivilege	2836	powershell.exe
Token: SeLoadDriverPrivilege	2836	powershell.exe
Token: SeSystemProfilePrivilege	2836	powershell.exe
Token: SeSystemtimePrivilege	2836	powershell.exe
Token: SeProfSingleProcessPrivilege	2836	powershell.exe
Token: SeIncBasePriorityPrivilege	2836	powershell.exe
Token: SeCreatePagefilePrivilege	2836	powershell.exe
Token: SeBackupPrivilege	2836	powershell.exe
Token: SeRestorePrivilege	2836	powershell.exe
Token: SeShutdownPrivilege	2836	powershell.exe
Token: SeDebugPrivilege	2836	powershell.exe
Token: SeSystemEnvironmentPrivilege	2836	powershell.exe
Token: SeRemoteShutdownPrivilege	2836	powershell.exe
Token: SeUndockPrivilege	2836	powershell.exe
Token: SeManageVolumePrivilege	2836	powershell.exe
Token: 33	2836	powershell.exe
Token: 34	2836	powershell.exe
Token: 35	2836	powershell.exe
Token: 36	2836	powershell.exe
Token: SeDebugPrivilege	3772	powershell.exe
Token: SeIncreaseQuotaPrivilege	3772	powershell.exe
Token: SeSecurityPrivilege	3772	powershell.exe
Token: SeTakeOwnershipPrivilege	3772	powershell.exe
Token: SeLoadDriverPrivilege	3772	powershell.exe
Token: SeSystemProfilePrivilege	3772	powershell.exe
Token: SeSystemtimePrivilege	3772	powershell.exe
Token: SeProfSingleProcessPrivilege	3772	powershell.exe
Token: SeIncBasePriorityPrivilege	3772	powershell.exe
Token: SeCreatePagefilePrivilege	3772	powershell.exe
Token: SeBackupPrivilege	3772	powershell.exe
Token: SeRestorePrivilege	3772	powershell.exe
Token: SeShutdownPrivilege	3772	powershell.exe
Token: SeDebugPrivilege	3772	powershell.exe
Token: SeSystemEnvironmentPrivilege	3772	powershell.exe
Token: SeRemoteShutdownPrivilege	3772	powershell.exe
Token: SeUndockPrivilege	3772	powershell.exe
Token: SeManageVolumePrivilege	3772	powershell.exe
Token: 33	3772	powershell.exe
Token: 34	3772	powershell.exe
Token: 35	3772	powershell.exe
Token: 36	3772	powershell.exe
Token: SeDebugPrivilege	4780	powershell.exe
Token: SeDebugPrivilege	644	powershell.exe
Token: SeDebugPrivilege	4976	powershell.exe
Token: SeDebugPrivilege	3068	powershell.exe
Token: SeDebugPrivilege	2300	powershell.exe
Token: SeDebugPrivilege	4164	powershell.exe
Token: SeDebugPrivilege	1920	powershell.exe
Token: SeDebugPrivilege	2064	powershell.exe
Token: SeDebugPrivilege	5008	powershell.exe
Token: SeIncreaseQuotaPrivilege	5008	powershell.exe
Token: SeSecurityPrivilege	5008	powershell.exe
Token: SeTakeOwnershipPrivilege	5008	powershell.exe
Token: SeLoadDriverPrivilege	5008	powershell.exe
Token: SeSystemProfilePrivilege	5008	powershell.exe
Token: SeSystemtimePrivilege	5008	powershell.exe
Token: SeProfSingleProcessPrivilege	5008	powershell.exe
Token: SeIncBasePriorityPrivilege	5008	powershell.exe
Token: SeCreatePagefilePrivilege	5008	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1524	CDAT1.26.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1524 wrote to memory of 2724	1524	CDAT1.26.exe	109
PID 1524 wrote to memory of 2836	1524	CDAT1.26.exe	111
PID 1524 wrote to memory of 3772	1524	CDAT1.26.exe	115
PID 1524 wrote to memory of 4780	1524	CDAT1.26.exe	117
PID 1524 wrote to memory of 644	1524	CDAT1.26.exe	119
PID 1524 wrote to memory of 4976	1524	CDAT1.26.exe	121
PID 1524 wrote to memory of 3068	1524	CDAT1.26.exe	123
PID 1524 wrote to memory of 2300	1524	CDAT1.26.exe	125
PID 1524 wrote to memory of 4164	1524	CDAT1.26.exe	127
PID 1524 wrote to memory of 1920	1524	CDAT1.26.exe	129
PID 1524 wrote to memory of 2332	1524	CDAT1.26.exe	131
PID 2332 wrote to memory of 816	2332	cmd.exe	133
PID 1524 wrote to memory of 2064	1524	CDAT1.26.exe	136
PID 1524 wrote to memory of 5008	1524	CDAT1.26.exe	138

C:\Users\Admin\AppData\Local\Temp\CDAT1.26.exe
"C:\Users\Admin\AppData\Local\Temp\CDAT1.26.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1524
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Test-path 'HKLM:\SOFTWARE\WOW6432Node\Lenovo\MachineInfo'
  2⤵
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2724
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" ((Get-CimInstance -NameSpace root/WMI -ClassName MSSmBios_RawSMBiosTables -ErrorAction SilentlyContinue).SmbiosMajorVersion)
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2836
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" ((Get-CimInstance -NameSpace root/WMI -ClassName MSSmBios_RawSMBiosTables -ErrorAction SilentlyContinue).SmbiosMinorVersion)
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3772
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" (Get-WmiObject Win32_USBControllerDevice -ErrorAction Stop | ForEach-Object { [wmi]($_.Dependent) } | Where-Object {$_.Name -eq 'ThinkPad Thunderbolt 4 Dock USB Audio'}).Name
  2⤵
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4780
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" (Get-WmiObject Win32_USBControllerDevice -ErrorAction Stop | ForEach-Object { [wmi]($_.Dependent) } | Where-Object {$_.Name -eq 'ThinkPad Thunderbolt 3 Dock USB Audio'}).Name
  2⤵
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:644
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" (Get-WmiObject Win32_USBControllerDevice -ErrorAction Stop | ForEach-Object { [wmi]($_.Dependent) } | Where-Object {$_.Name -eq 'ThinkPad USB-C Dock Gen2 USB Audio'}).Name
  2⤵
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4976
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" (Get-WmiObject Win32_USBControllerDevice -ErrorAction Stop | ForEach-Object { [wmi]($_.Dependent) } | Where-Object {$_.Name -eq 'Lenovo Thunderbolt 3 ES Dock USB Audio'}).Name
  2⤵
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3068
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" (Get-WmiObject Win32_USBControllerDevice -ErrorAction Stop | ForEach-Object { [wmi]($_.Dependent) } | Where-Object {$_.Name -eq 'Lenovo USB-C Mini Dock'}).Name
  2⤵
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2300
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" (Get-WmiObject Win32_USBControllerDevice -ErrorAction Stop | ForEach-Object { [wmi]($_.Dependent) } | Where-Object {$_.Name -eq 'ThinkPad Dock USB Audio'}).Name
  2⤵
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4164
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" (Get-WmiObject win32_computersystem).Manufacturer
  2⤵
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1920
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c systeminfo
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2332
- - C:\Windows\system32\systeminfo.exe
    systeminfo
    3⤵
    - Gathers system information
    PID:816
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" ((Get-ItemProperty -path 'HKLM:System\CurrentControlSet\Control\Session Manager\Power').FwPOSTTime /1000 )
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2064
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" $((get-date) - (gcim Win32_OperatingSystem).LastBootUpTime) | select-object Days, Hours, Minutes, seconds | format-table
  2⤵
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5008

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...