Analysis
- user interaction
yes - max time kernel
868s - max time network
429s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
15/04/2026, 15:05
General
- Target agent-windows-amd64(1).qa_DBdkY.exe
- Size 10.0MB
- Sample260415-sf73lsds6v
- SHA256 0f59e7711c5f17402d728527d5108512d49bb15a86cd25d8830aaa7e34b75136
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- Drops startup file 2 IoCs
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\agent-windows-amd64(1).qa_DBdkY.exe"C:\Users\Admin\AppData\Local\Temp\agent-windows-amd64(1).qa_DBdkY.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$a = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\discord-updater.exe'; $t = New-ScheduledTaskTrigger -AtLogOn; $s = New-ScheduledTaskSettingsSet -ExecutionTimeLimit ([TimeSpan]::Zero) -StartWhenAvailable; $p = New-ScheduledTaskPrincipal -UserId $env:USERNAME -RunLevel Highest; Register-ScheduledTask -TaskName 'discord-updater_131f88fc' -Action $a -Trigger $t -Settings $s -Principal $p -Force | Out-Null"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\discord-updater.exe"C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\discord-updater.exe"1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$a = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\discord-updater.exe'; $t = New-ScheduledTaskTrigger -AtLogOn; $s = New-ScheduledTaskSettingsSet -ExecutionTimeLimit ([TimeSpan]::Zero) -StartWhenAvailable; $p = New-ScheduledTaskPrincipal -UserId $env:USERNAME -RunLevel Highest; Register-ScheduledTask -TaskName 'discord-updater_131f88fc' -Action $a -Trigger $t -Settings $s -Principal $p -Force | Out-Null"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_k4a2rziu.suz.ps1
agent-3926219813.tmp
memory/1100-60-0x00000001C1F20000-0x00000001C4CAD000-memory.dmp
memory/1100-63-0x00000001C1F20000-0x00000001C4CAD000-memory.dmp
memory/1100-71-0x00007FF7114C0000-0x00007FF713FA1000-memory.dmp
memory/1100-66-0x00000001C1F20000-0x00000001C4CAD000-memory.dmp
memory/1100-65-0x00007FF7114C0000-0x00007FF713FA1000-memory.dmp
memory/1100-64-0x00000001C1F20000-0x00000001C4CAD000-memory.dmp
memory/1100-35-0x00007FF7114C0000-0x00007FF713FA1000-memory.dmp
memory/1100-38-0x00000001C1F20000-0x00000001C4CAD000-memory.dmp
memory/1100-62-0x00000001C1F20000-0x00000001C4CAD000-memory.dmp
memory/1100-61-0x00000001C1F20000-0x00000001C4CAD000-memory.dmp
memory/3144-29-0x000001C47BC50000-0x000001C47BC5C000-memory.dmp
memory/3144-7-0x000001C47C360000-0x000001C47C370000-memory.dmp
memory/3144-6-0x000001C47C360000-0x000001C47C370000-memory.dmp
memory/3144-8-0x000001C47C3A0000-0x000001C47C3C2000-memory.dmp
memory/3280-33-0x000001A8D3470000-0x000001A8D347C000-memory.dmp
memory/4272-34-0x00007FF6AD040000-0x00007FF6AFB21000-memory.dmp