dce424d89cf5ac40b85a829d49a4040f887c07cc877049ba5efe777047dfb3f6

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/06/2026, 15:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Debug.exe
Size 172.4MB
Sample260622-tc7s4set71
SHA256 dce424d89cf5ac40b85a829d49a4040f887c07cc877049ba5efe777047dfb3f6
MD5 6683c00fa6fe41a8a9195e8be22daefe
SHA1 458dc2436a0ec524cb26fde438f4e7de1df77b31
SHA512 fb6d324359d8ffe67020eb760f9e20e58a5a6ba4d3aa268fb6ebea60a22e9c5ec0a3f46c11d5f73c0d4c55d64192c4f05984ebdfa0859fb0ec4f59540b257a2e
SSDEEP 1572864:57NR7Rm1DKEM9Lx4vpOzDE0Yyb5IcIZBVAM9gjMdCjWqgXVbRgTsndR0aL/9eO:QVxsOcY7TR79T
TLSH
T167889C03E29A40D9E01DD1B58B9B9233EE71B8494B29B6DF275407522F77EE42B3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
14	discord.com
13	discord.com

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4064	Debug.exe
4064	Debug.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4752	Debug.exe
Token: SeCreatePagefilePrivilege	4752	Debug.exe
Token: SeShutdownPrivilege	4752	Debug.exe
Token: SeCreatePagefilePrivilege	4752	Debug.exe
Token: SeShutdownPrivilege	4752	Debug.exe
Token: SeCreatePagefilePrivilege	4752	Debug.exe
Token: SeShutdownPrivilege	4752	Debug.exe
Token: SeCreatePagefilePrivilege	4752	Debug.exe
Token: SeShutdownPrivilege	4752	Debug.exe
Token: SeCreatePagefilePrivilege	4752	Debug.exe
Token: SeShutdownPrivilege	4752	Debug.exe
Token: SeCreatePagefilePrivilege	4752	Debug.exe
Token: SeShutdownPrivilege	4752	Debug.exe
Token: SeCreatePagefilePrivilege	4752	Debug.exe
Token: SeShutdownPrivilege	4752	Debug.exe
Token: SeCreatePagefilePrivilege	4752	Debug.exe
Token: SeShutdownPrivilege	4752	Debug.exe
Token: SeCreatePagefilePrivilege	4752	Debug.exe
Token: SeShutdownPrivilege	4752	Debug.exe
Token: SeCreatePagefilePrivilege	4752	Debug.exe
Token: SeShutdownPrivilege	4752	Debug.exe
Token: SeCreatePagefilePrivilege	4752	Debug.exe
Token: SeShutdownPrivilege	4752	Debug.exe
Token: SeCreatePagefilePrivilege	4752	Debug.exe
Token: SeShutdownPrivilege	4752	Debug.exe
Token: SeCreatePagefilePrivilege	4752	Debug.exe
Token: SeShutdownPrivilege	4752	Debug.exe
Token: SeCreatePagefilePrivilege	4752	Debug.exe
Token: SeShutdownPrivilege	4752	Debug.exe
Token: SeCreatePagefilePrivilege	4752	Debug.exe
Token: SeShutdownPrivilege	4752	Debug.exe
Token: SeCreatePagefilePrivilege	4752	Debug.exe
Token: SeShutdownPrivilege	4752	Debug.exe
Token: SeCreatePagefilePrivilege	4752	Debug.exe
Token: SeShutdownPrivilege	4752	Debug.exe
Token: SeCreatePagefilePrivilege	4752	Debug.exe
Token: SeShutdownPrivilege	4752	Debug.exe
Token: SeCreatePagefilePrivilege	4752	Debug.exe
Token: SeShutdownPrivilege	4752	Debug.exe
Token: SeCreatePagefilePrivilege	4752	Debug.exe
Token: SeShutdownPrivilege	4752	Debug.exe
Token: SeCreatePagefilePrivilege	4752	Debug.exe
Token: SeShutdownPrivilege	4752	Debug.exe
Token: SeCreatePagefilePrivilege	4752	Debug.exe
Token: SeShutdownPrivilege	4752	Debug.exe
Token: SeCreatePagefilePrivilege	4752	Debug.exe
Token: SeShutdownPrivilege	4752	Debug.exe
Token: SeCreatePagefilePrivilege	4752	Debug.exe
Token: SeShutdownPrivilege	4752	Debug.exe
Token: SeCreatePagefilePrivilege	4752	Debug.exe
Token: SeShutdownPrivilege	4752	Debug.exe
Token: SeCreatePagefilePrivilege	4752	Debug.exe
Token: SeShutdownPrivilege	4752	Debug.exe
Token: SeCreatePagefilePrivilege	4752	Debug.exe
Token: SeShutdownPrivilege	4752	Debug.exe
Token: SeCreatePagefilePrivilege	4752	Debug.exe
Token: SeShutdownPrivilege	4752	Debug.exe
Token: SeCreatePagefilePrivilege	4752	Debug.exe
Token: SeShutdownPrivilege	4752	Debug.exe
Token: SeCreatePagefilePrivilege	4752	Debug.exe
Token: SeShutdownPrivilege	4752	Debug.exe
Token: SeCreatePagefilePrivilege	4752	Debug.exe
Token: SeShutdownPrivilege	4752	Debug.exe
Token: SeCreatePagefilePrivilege	4752	Debug.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4752 wrote to memory of 4544	4752	Debug.exe	86
PID 4752 wrote to memory of 4544	4752	Debug.exe	86
PID 4752 wrote to memory of 3972	4752	Debug.exe	87
PID 4752 wrote to memory of 4064	4752	Debug.exe	96

C:\Users\Admin\AppData\Local\Temp\Debug.exe
"C:\Users\Admin\AppData\Local\Temp\Debug.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4752
- C:\Users\Admin\AppData\Local\Temp\Debug.exe
  "C:\Users\Admin\AppData\Local\Temp\Debug.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Debug" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1884,i,17189150694786382109,5509385679292083022,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1876 /prefetch:2
  2⤵
  PID:4544
- C:\Users\Admin\AppData\Local\Temp\Debug.exe
  "C:\Users\Admin\AppData\Local\Temp\Debug.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Debug" --field-trial-handle=2064,i,17189150694786382109,5509385679292083022,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2060 /prefetch:3
  2⤵
  PID:3972
- C:\Users\Admin\AppData\Local\Temp\Debug.exe
  "C:\Users\Admin\AppData\Local\Temp\Debug.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\Debug" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2536,i,17189150694786382109,5509385679292083022,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2532 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4064

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4064-5-0x0000029214A60000-0x0000029214A61000-memory.dmp

Download

memory/4064-7-0x0000029214A60000-0x0000029214A61000-memory.dmp

Download

memory/4064-6-0x0000029214A60000-0x0000029214A61000-memory.dmp

Download

memory/4064-11-0x0000029214A60000-0x0000029214A61000-memory.dmp

Download

memory/4064-14-0x0000029214A60000-0x0000029214A61000-memory.dmp

Download

memory/4064-17-0x0000029214A60000-0x0000029214A61000-memory.dmp

Download

memory/4064-16-0x0000029214A60000-0x0000029214A61000-memory.dmp

Download

memory/4064-15-0x0000029214A60000-0x0000029214A61000-memory.dmp

Download

memory/4064-13-0x0000029214A60000-0x0000029214A61000-memory.dmp

Download

memory/4064-12-0x0000029214A60000-0x0000029214A61000-memory.dmp

Download