Analysis
- user interaction
yes - max time kernel
53s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
09/08/2026, 01:28
General
- Target Discord.exe
- Size 5.7MB
- Sample260809-bvxrragc23
- SHA256 2aa6a3e610004ea1d6124e1a23f64ebba4baeaa26d88508e01c8ddd48de35a0b
Malware Config
Signatures
- Executes dropped EXE 12 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of WriteProcessMemory 11 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Discord.exe"C:\Users\Admin\AppData\Local\Temp\Discord.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Discord_8678c8" /tr "'C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\du_8678c8aeea08\Discord.exe'" /sc onlogon /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Discord\Update_8678c8.exe"C:\Users\Admin\AppData\Local\Discord\Update_8678c8.exe" --smart-watch2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Spotify\SpotifyWebHelper_8678c8.exe"C:\Users\Admin\AppData\Local\Spotify\SpotifyWebHelper_8678c8.exe" --smart-watch3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Telegram Desktop\Updater_8678c8.exe"C:\Users\Admin\AppData\Local\Telegram Desktop\Updater_8678c8.exe" --smart-watch4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\OneDrive\OneDriveStandaloneUpdater_8678c8.exe"C:\Users\Admin\AppData\Roaming\Microsoft\OneDrive\OneDriveStandaloneUpdater_8678c8.exe" --smart-watch5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome_proxy_8678c8.exe"C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome_proxy_8678c8.exe" --smart-watch6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate_8678c8.exe"C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate_8678c8.exe" --smart-watch7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Steam\bin\SteamService_8678c8.exe"C:\Users\Admin\AppData\Local\Steam\bin\SteamService_8678c8.exe" --smart-watch8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Dropbox\bin\DropboxUpdate_8678c8.exe"C:\Users\Admin\AppData\Roaming\Dropbox\bin\DropboxUpdate_8678c8.exe" --smart-watch9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\NVIDIA Corporation\NvBackend\NVIDIA Web Helper_8678c8.exe"C:\Users\Admin\AppData\Local\NVIDIA Corporation\NvBackend\NVIDIA Web Helper_8678c8.exe" --smart-watch10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Adobe\ARM\AdobeGCClient\AdobeGCInvoker_8678c8.exe"C:\ProgramData\Adobe\ARM\AdobeGCClient\AdobeGCInvoker_8678c8.exe" --smart-watch11⤵
- Executes dropped EXE
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\du_8678c8aeea08\Discord.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\du_8678c8aeea08\Discord.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Discord\Update_8678c8.exe"C:\Users\Admin\AppData\Local\Discord\Update_8678c8.exe"1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
Update_8678c8.exe
Discord.exe
smart_8678c8aeea08.dat
memory/1944-26-0x00007FFA38EA0000-0x00007FFA39844000-memory.dmp
memory/1944-101-0x000001A1F4E50000-0x000001A1F4F02000-memory.dmp
memory/1944-5-0x000001A1F4B90000-0x000001A1F4BC2000-memory.dmp
memory/1944-6-0x000001A1F4BE0000-0x000001A1F4BFA000-memory.dmp
memory/1944-7-0x00007FFA38EA0000-0x00007FFA39844000-memory.dmp
memory/1944-8-0x00007FFA38EA0000-0x00007FFA39844000-memory.dmp
memory/1944-9-0x00007FFA38EA0000-0x00007FFA39844000-memory.dmp
memory/1944-10-0x00007FFA38EA0000-0x00007FFA39844000-memory.dmp
memory/1944-3-0x00007FFA38EA0000-0x00007FFA39844000-memory.dmp
memory/1944-0-0x00007FFA3902F000-0x00007FFA39030000-memory.dmp
memory/1944-2-0x00007FFA38EA0000-0x00007FFA39844000-memory.dmp
memory/1944-108-0x00007FFA38EA0000-0x00007FFA39844000-memory.dmp
memory/1944-1-0x000001A1F20A0000-0x000001A1F2656000-memory.dmp
memory/1944-106-0x00007FFA38EA0000-0x00007FFA39844000-memory.dmp
memory/1944-104-0x000001A1F4F00000-0x000001A1F4F34000-memory.dmp
memory/1944-103-0x000001A1F2B80000-0x000001A1F2B94000-memory.dmp
memory/1944-4-0x000001A1F4470000-0x000001A1F44BE000-memory.dmp
memory/1944-102-0x000001A1F4F80000-0x000001A1F4FF6000-memory.dmp
memory/2824-68-0x00007FFA38EA0000-0x00007FFA39844000-memory.dmp
memory/2824-67-0x00007FFA38EA0000-0x00007FFA39844000-memory.dmp
memory/2824-58-0x00007FFA38EA0000-0x00007FFA39844000-memory.dmp
memory/2824-109-0x00007FFA38EA0000-0x00007FFA39844000-memory.dmp
memory/4340-72-0x00000121170E0000-0x0000012117650000-memory.dmp