1599c9215aa9c0e6ccbdb2a7b19ea97f1da2836716b936029fbcbdb7ee981fba

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/08/2026, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DiscordLookup.exe
Size 986KB
Sample260822-sdw8bsfd25
SHA256 1599c9215aa9c0e6ccbdb2a7b19ea97f1da2836716b936029fbcbdb7ee981fba
MD5 82d4b4675d3a27e8c297191e795538e6
SHA1 790e1f53fcf3f9183b8f2bb1b36fabcbbe6a7261
SHA512 d5409aab6b88ed6fa0fe43f16d5aa9dcc5833832841f51aa7bfb87bfceb6c15abd200c76c39803ef5f4b26882aa9bfe4d7dbf7aa215c3693cc99ce3c603ff3b9
SSDEEP 12288:0y+qSDlFukjZoc2TPDupdPQxE/1w5bWEmatnCuXfpYHN7:Z/ctLp9nEmatCofpYHN7
TLSH
T12E255A47B3E48EEACC5A663994DB2709B734FCA017939AC7571042315E03AE98E7FB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 7 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	4464	powershell.exe
8	4464	powershell.exe
15	4464	powershell.exe
20	4464	powershell.exe
22	4464	powershell.exe
44	4464	powershell.exe
49	4464	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4464	powershell.exe

Loads dropped DLL 1 IoCs

pid	Process
1144	DiscordLookup.exe

ConfuserEx .NET packer 1 IoCs

Detects ConfuserEx .NET packer.

resource	yara_rule
behavioral1/memory/4464-15-0x0000025F1AE70000-0x0000025F1AE8C000-memory.dmp	ConfuserEx

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4464	powershell.exe
4464	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4464	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1144	DiscordLookup.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1144 wrote to memory of 4464	1144	DiscordLookup.exe	87
PID 4464 wrote to memory of 3640	4464	powershell.exe	90

C:\Users\Admin\AppData\Local\Temp\DiscordLookup.exe
"C:\Users\Admin\AppData\Local\Temp\DiscordLookup.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1144
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\5bcb3e12.ps1"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4464
- - C:\Windows\SYSTEM32\tar.exe
    "tar" -xf "C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\python.zip" -C "C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex"
    3⤵
    PID:3640

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

python.zip

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\python.zip
Size 10.6MB
SHA256 0d57bb6cb078b74d23dbfe91f77d6780d45bed328911609f1f7ee2ba1606bf44
MD5 4c0a5a44d4ca1d0bc76fe08ea8b76adc
SHA1 1ff2a617e13a30190d4513acaf30db4acd905115
SHA512 2f67a8487a9edece26b73aab27e75249e538938ad976d371a9411b54dbae20afeac82b406ad4eeee38b1cf6f407e7620679d30c0fff82ec8e8ae62268c322d59
SSDEEP 196608:3ulykp18gQUx6C3yltcocU8/fqMD2Tb1Tvk968ewCP/q09DdZmY0T0Ip:3ulyG18Gl3ecoAf2tTvktDEBm
TLSH
T126B63393CFC45E8704F723358273E58A2A02AFB7B0A4EF9911B545C4747E7DB2AA6407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python312._pth

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\python312._pth
Size 79B
SHA256 9fe5713a8c85777f99d941d14409946124df1f322e987485ed30600f4f0afde1
MD5 7041e9d1a887a01277a3c4430b67ae63
SHA1 5fd0f4ce8e71e509f339c7c5639a757a04672e58
SHA512 ea7566282012bab16a78b1a525d2d37b82a9c9470e20d7dd6798fda3c4418ba5713070142cc8f1a170852a753142188f666b552615770a8f638fd7353eee7837
TLSH
T185A002121AA71090067471E83FD021F99F727348AB55665D98D56E394611E30AAE212F
MD5 SHA1 SHA512 TLSH

Submit Download

5bcb3e12.ps1

Path C:\Users\Admin\AppData\Local\Temp\5bcb3e12.ps1
Size 97KB
SHA256 af6d7803f11419d40a03fe687e346e8d7e7631dac526b3b1d746b2524c17b8af
MD5 8d1ea39f8b326b7d6aa1d01a717ee650
SHA1 e4500ba3a28ce2065ebfcc7e2e955a1aa39053aa
SHA512 30854b8db6fc0ce04c0a02f7700c8fe514d787202268b8d2b41dbbd5ab3ddc67dbcd80825bdcb2091d81acd09f33cf0bbf723436947686d176ea599acfe67e41
SSDEEP 3072:btLFtNZnYnNwnkHWfDxjFx0bri3N6ARc3ev:pR5nNnkHWVD0buj
TLSH
T1EDA3123136A43572BEF2D4DBC2789ECD1A53B2CC48316CD34708650AA9A3F6217CB61B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_amwqj2xj.v4j.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_amwqj2xj.v4j.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

lch40DC.tmp

Path C:\Users\Admin\AppData\Local\Temp\lch40DC.tmp
Size 108KB
SHA256 f10b26f670993f7377b8ac18eff8a40e6059f929f3206707bb75a97ff7362c46
MD5 fce2d9305116369b06cb2c9d19e80154
SHA1 1994437507a29e8d2ea7197422e9198fc9bc3fc4
SHA512 322ebafcc379db60e4584792c4d4eff51b99eb6245255ee4d22f3f52f0dea1c71e9c1bac118a7f8199787fcff3b95f80dba9791194d9607008cf06157df6e5a3
SSDEEP 1536:oYRFiuIMiw4Y5Qo/ANg0lG5k6VczavDD/4U3tbqvs5JIlJztfv5flTPerMB:oTuMwd5Qo/Avl0RDD/gUc3/flA+
TLSH
T181B30281EB9709C6C155113A5483DC81BE2E38C17BC68AD7ABF4B71E0C74BC45E352AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4464-5-0x0000025F7E9D0000-0x0000025F7E9E0000-memory.dmp

Download

memory/4464-4-0x0000025F7E9D0000-0x0000025F7E9E0000-memory.dmp

Download

memory/4464-11-0x0000025F7E890000-0x0000025F7E8B2000-memory.dmp

Download

memory/4464-15-0x0000025F1AE70000-0x0000025F1AE8C000-memory.dmp

Download

memory/4464-16-0x0000025F1AE90000-0x0000025F1AE96000-memory.dmp

Download

memory/4464-56-0x0000025F7E9D0000-0x0000025F7E9E0000-memory.dmp

Download

memory/4464-57-0x0000025F7E9D0000-0x0000025F7E9E0000-memory.dmp

Download