Overview

overview

7

Static

static

3

Discord.Bo....0.exe

windows10-ltsc_2021-x64

7

Discord.Bo....0.exe

windows11-21h2-x64

7

Analysis

  • user interaction
    yes
  • max time kernel
    37s
  • max time network
    29s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    05/07/2026, 00:43

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Discord.Bot.Client.1.0.0.exe
  • Size 41.0MB
  • Sample260705-a2173sfx4s
  • SHA256 0409f2d3c5cda96547ad5a2a7d361e7b318d520f11cbfef9687da5d0eade69a2
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoveryspywaretrojan

Malware Config

Signatures

  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 12 IoCs
  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

    defense_evasion
  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 1 IoCs
  • Modifies system certificate store 2 TTPs 1 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Discord.Bot.Client.1.0.0.exe
    "C:\Users\Admin\AppData\Local\Temp\Discord.Bot.Client.1.0.0.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5324
    • C:\Users\Admin\AppData\Local\Temp\2B7SbwheeSlrAfwSDUtyrAmS7G3\Discord Bot Client.exe
      "C:\Users\Admin\AppData\Local\Temp\2B7SbwheeSlrAfwSDUtyrAmS7G3\Discord Bot Client.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4296
      • C:\Users\Admin\AppData\Local\Temp\2B7SbwheeSlrAfwSDUtyrAmS7G3\Discord Bot Client.exe
        "C:\Users\Admin\AppData\Local\Temp\2B7SbwheeSlrAfwSDUtyrAmS7G3\Discord Bot Client.exe" --type=gpu-process --field-trial-handle=1620,2556193523911180148,6242392643095080550,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1644 /prefetch:2
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:2292
      • C:\Users\Admin\AppData\Local\Temp\2B7SbwheeSlrAfwSDUtyrAmS7G3\Discord Bot Client.exe
        "C:\Users\Admin\AppData\Local\Temp\2B7SbwheeSlrAfwSDUtyrAmS7G3\Discord Bot Client.exe" --type=utility --field-trial-handle=1620,2556193523911180148,6242392643095080550,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2244 /prefetch:8
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies trusted root certificate store through registry
        • System Location Discovery: System Language Discovery
        • Modifies system certificate store
        • Suspicious behavior: EnumeratesProcesses
        PID:796
      • C:\Users\Admin\AppData\Local\Temp\2B7SbwheeSlrAfwSDUtyrAmS7G3\Discord Bot Client.exe
        "C:\Users\Admin\AppData\Local\Temp\2B7SbwheeSlrAfwSDUtyrAmS7G3\Discord Bot Client.exe" --type=renderer --field-trial-handle=1620,2556193523911180148,6242392643095080550,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --lang=en-US --app-path="C:\Users\Admin\AppData\Local\Temp\2B7SbwheeSlrAfwSDUtyrAmS7G3\resources\app.asar" --no-sandbox --no-zygote --context-isolation --background-color=#fff --enable-spellcheck --enable-websql --disable-electron-site-instance-overrides --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2792 /prefetch:1
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:5340
      • C:\Users\Admin\AppData\Local\Temp\2B7SbwheeSlrAfwSDUtyrAmS7G3\Discord Bot Client.exe
        "C:\Users\Admin\AppData\Local\Temp\2B7SbwheeSlrAfwSDUtyrAmS7G3\Discord Bot Client.exe" --type=utility --field-trial-handle=1620,2556193523911180148,6242392643095080550,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3076 /prefetch:8
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:5700
      • C:\Users\Admin\AppData\Local\Temp\2B7SbwheeSlrAfwSDUtyrAmS7G3\Discord Bot Client.exe
        "C:\Users\Admin\AppData\Local\Temp\2B7SbwheeSlrAfwSDUtyrAmS7G3\Discord Bot Client.exe" --type=utility --field-trial-handle=1620,2556193523911180148,6242392643095080550,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3100 /prefetch:8
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        PID:5964
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x00000000000004AC 0x00000000000004E0
    1⤵
      PID:3388

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          D3DCompiler_47.dll
          • Path C:\Users\Admin\AppData\Local\Temp\2B7SbwheeSlrAfwSDUtyrAmS7G3\D3DCompiler_47.dll
          • Size 3.5MB
          • SHA256 7d0d1290382ea0e44a3178446a0c202696237e27dbb5f8f0827691092b8f2228
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          chrome_100_percent.pak
          • Path C:\Users\Admin\AppData\Local\Temp\2B7SbwheeSlrAfwSDUtyrAmS7G3\chrome_100_percent.pak
          • Size 175KB
          • SHA256 419cfcc6dc5f38b2e0c970ebd4fad1ef55054579d5c0db2521d7ae494996aac3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          chrome_200_percent.pak
          • Path C:\Users\Admin\AppData\Local\Temp\2B7SbwheeSlrAfwSDUtyrAmS7G3\chrome_200_percent.pak
          • Size 312KB
          • SHA256 edecf8e1ac353bfdae534e42507e5a59973cb4cab76fbb1ff1a470363e725bc4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ffmpeg.dll
          • Path C:\Users\Admin\AppData\Local\Temp\2B7SbwheeSlrAfwSDUtyrAmS7G3\ffmpeg.dll
          • Size 2.5MB
          • SHA256 6f14dbd131f63e5904e33a91a3327550dc97d563404e46d0cadc606ebf0cc020
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          icudtl.dat
          • Path C:\Users\Admin\AppData\Local\Temp\2B7SbwheeSlrAfwSDUtyrAmS7G3\icudtl.dat
          • Size 10.0MB
          • SHA256 594637e10b8f5c97157413528f0cbf5bc65b4ab9e79f5fa34fe268092655ec57
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          en-US.pak
          • Path C:\Users\Admin\AppData\Local\Temp\2B7SbwheeSlrAfwSDUtyrAmS7G3\locales\en-US.pak
          • Size 79KB
          • SHA256 35adc5aeeebfe440e295b88d2a4089360ada33c353843b1f5438f4118501878b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          resources.pak
          • Path C:\Users\Admin\AppData\Local\Temp\2B7SbwheeSlrAfwSDUtyrAmS7G3\resources.pak
          • Size 4.6MB
          • SHA256 ddc85d749b19cbabae11a0b8f7114daf75900179a2147280dd0f9f8faee7d65c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          app.asar
          • Path C:\Users\Admin\AppData\Local\Temp\2B7SbwheeSlrAfwSDUtyrAmS7G3\resources\app.asar
          • Size 210KB
          • SHA256 76b509211b64c83522028be4b5626444f5e1654376540193aa44ba9936454c3e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libEGL.dll
          • Path C:\Users\Admin\AppData\Local\Temp\2B7SbwheeSlrAfwSDUtyrAmS7G3\swiftshader\libEGL.dll
          • Size 325KB
          • SHA256 1ee05c4c7549f8384eaa6306a5a6efc22faf683354e8240eaec8c17d8f980280
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libglesv2.dll
          • Path C:\Users\Admin\AppData\Local\Temp\2B7SbwheeSlrAfwSDUtyrAmS7G3\swiftshader\libglesv2.dll
          • Size 2.9MB
          • SHA256 34f7ae8e30ec3dfc67927341b3cb0a88b226b6ac6c6f006a43d828e6d8248c9d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          v8_context_snapshot.bin
          • Path C:\Users\Admin\AppData\Local\Temp\2B7SbwheeSlrAfwSDUtyrAmS7G3\v8_context_snapshot.bin
          • Size 166KB
          • SHA256 2bcc2b2c1f5f3a705a00b26550ba177debffb3bdc2b359b5018661869c51c44a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          StdUtils.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nscE56F.tmp\StdUtils.dll
          • Size 100KB
          • SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nscE56F.tmp\System.dll
          • Size 12KB
          • SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          nsis7z.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nscE56F.tmp\nsis7z.dll
          • Size 424KB
          • SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          temp-index
          • Path C:\Users\Admin\AppData\Roaming\Discord Bot Client\Code Cache\js\index-dir\temp-index
          • Size 96B
          • SHA256 d4f2d58fa180b89c11cfbd7d0c1529a7348e775c508b0a9b68c3496515ad6d7d
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          the-real-index
          • Path C:\Users\Admin\AppData\Roaming\Discord Bot Client\Code Cache\js\index-dir\the-real-index
          • Size 48B
          • SHA256 3f4d8418c5caed20f152345b1cbb302220279c149a9a37e92615916af26d8ed1
          • MD5 SHA1 SHA512
          Submit Download

          CURRENT
          • Path C:\Users\Admin\AppData\Roaming\Discord Bot Client\Session Storage\CURRENT
          • Size 16B
          • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
          • MD5 SHA1 SHA512
          Submit Download

          TransportSecurity~RFe585e28.TMP
          • Path C:\Users\Admin\AppData\Roaming\Discord Bot Client\TransportSecurity~RFe585e28.TMP
          • Size 627B
          • SHA256 519f4c6ebadb195ed2b6728b9b56b63751a7423b319e63f0c6ff2ea8fffbeecc
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          fcce5ed2-d4c2-49c5-ac7b-b2025bf8dc04.tmp
          • Path C:\Users\Admin\AppData\Roaming\Discord Bot Client\fcce5ed2-d4c2-49c5-ac7b-b2025bf8dc04.tmp
          • Size 627B
          • SHA256 9531813080a0773dfcbb8987c69a387c422e2fef30c454c730d2de7a8c1dfda2
          • MD5 SHA1 SHA512 TLSH
          Submit Download