Analysis
- max time kernel
149s - max time network
156s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
15/04/2026, 15:05
General
- Target agent-windows-amd64(1).qa_DBdkY.exe
- Size 10.0MB
- Sample260415-sf73lsds6v
- SHA256 0f59e7711c5f17402d728527d5108512d49bb15a86cd25d8830aaa7e34b75136
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- Drops startup file 2 IoCs
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\agent-windows-amd64(1).qa_DBdkY.exe"C:\Users\Admin\AppData\Local\Temp\agent-windows-amd64(1).qa_DBdkY.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$a = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\discord-updater.exe'; $t = New-ScheduledTaskTrigger -AtLogOn; $s = New-ScheduledTaskSettingsSet -ExecutionTimeLimit ([TimeSpan]::Zero) -StartWhenAvailable; $p = New-ScheduledTaskPrincipal -UserId $env:USERNAME -RunLevel Highest; Register-ScheduledTask -TaskName 'discord-updater_131f88fc' -Action $a -Trigger $t -Settings $s -Principal $p -Force | Out-Null"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\discord-updater.exe"C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\discord-updater.exe"1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$a = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\discord-updater.exe'; $t = New-ScheduledTaskTrigger -AtLogOn; $s = New-ScheduledTaskSettingsSet -ExecutionTimeLimit ([TimeSpan]::Zero) -StartWhenAvailable; $p = New-ScheduledTaskPrincipal -UserId $env:USERNAME -RunLevel Highest; Register-ScheduledTask -TaskName 'discord-updater_131f88fc' -Action $a -Trigger $t -Settings $s -Principal $p -Force | Out-Null"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_n0txnbq2.4wy.ps1
agent-2374177492.tmp
memory/1404-52-0x000001CDF55C0000-0x000001CDF55CC000-memory.dmp
memory/1404-55-0x000001CDF6590000-0x000001CDF6598000-memory.dmp
memory/1404-53-0x000001CDF5CE0000-0x000001CDF648E000-memory.dmp
memory/1404-54-0x000001CDF6490000-0x000001CDF64A2000-memory.dmp
memory/4316-24-0x000001EEB8CA0000-0x000001EEB8CAA000-memory.dmp
memory/4316-25-0x000001EEB8E20000-0x000001EEB8E3C000-memory.dmp
memory/4316-42-0x000001EEB80C0000-0x000001EEB80D0000-memory.dmp
memory/4316-45-0x000001EE9F940000-0x000001EE9F94C000-memory.dmp
memory/4316-48-0x000001EEB8A90000-0x000001EEB8A98000-memory.dmp
memory/4316-47-0x000001EE9FE50000-0x000001EE9FE62000-memory.dmp
memory/4316-46-0x000001EEB80D0000-0x000001EEB887E000-memory.dmp
memory/4316-23-0x000001EEB8AE0000-0x000001EEB8B93000-memory.dmp
memory/4316-22-0x000001EEB8AA0000-0x000001EEB8ABC000-memory.dmp
memory/4316-15-0x00007FF471B90000-0x00007FF471BA0000-memory.dmp
memory/4316-8-0x000001EEB8020000-0x000001EEB8042000-memory.dmp
memory/4316-7-0x000001EEB80C0000-0x000001EEB80D0000-memory.dmp
memory/4316-6-0x000001EEB80C0000-0x000001EEB80D0000-memory.dmp
memory/4568-89-0x00000001C1F20000-0x00000001C4CAD000-memory.dmp
memory/4568-59-0x0000028464620000-0x00000284646BE000-memory.dmp
memory/4568-58-0x00007FF73B370000-0x00007FF73DE51000-memory.dmp
memory/4568-64-0x00000001C1F20000-0x00000001C4CAD000-memory.dmp
memory/4568-86-0x00000001C1F20000-0x00000001C4CAD000-memory.dmp
memory/4568-87-0x00000001C1F20000-0x00000001C4CAD000-memory.dmp
memory/4568-88-0x00000001C1F20000-0x00000001C4CAD000-memory.dmp
memory/4568-90-0x00000001C1F20000-0x00000001C4CAD000-memory.dmp
memory/4568-94-0x00000001C1F20000-0x00000001C4CAD000-memory.dmp
memory/4568-96-0x00007FF73B370000-0x00007FF73DE51000-memory.dmp
memory/4572-56-0x00007FF7EECB0000-0x00007FF7F1791000-memory.dmp
memory/4572-57-0x00000207E44F0000-0x00000207E458E000-memory.dmp