Overview
overview
10Static
static
10discord-im...er.bat
windows7-x64
4discord-im...er.bat
windows10-2004-x64
10discord-im...bug.py
windows7-x64
3discord-im...bug.py
windows10-2004-x64
3discord-im...ers.py
windows7-x64
3discord-im...ers.py
windows10-2004-x64
3discord-im...ken.py
windows7-x64
3discord-im...ken.py
windows10-2004-x64
3discord-im...ion.py
windows7-x64
3discord-im...ion.py
windows10-2004-x64
3discord-im...tup.py
windows7-x64
3discord-im...tup.py
windows10-2004-x64
3discord-im...nfo.py
windows7-x64
3discord-im...nfo.py
windows10-2004-x64
3discord-im...fig.py
windows7-x64
3discord-im...fig.py
windows10-2004-x64
3discord-im...ain.py
windows7-x64
3discord-im...ain.py
windows10-2004-x64
3Analysis
-
max time kernel
16s -
max time network
20s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
04-06-2024 17:31
Behavioral task
behavioral1
Sample
discord-image-logger-main/builder.bat
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
discord-image-logger-main/builder.bat
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
discord-image-logger-main/src/components/antidebug.py
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
discord-image-logger-main/src/components/antidebug.py
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
discord-image-logger-main/src/components/browsers.py
Resource
win7-20231129-en
Behavioral task
behavioral6
Sample
discord-image-logger-main/src/components/browsers.py
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
discord-image-logger-main/src/components/discordtoken.py
Resource
win7-20240419-en
Behavioral task
behavioral8
Sample
discord-image-logger-main/src/components/discordtoken.py
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
discord-image-logger-main/src/components/injection.py
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
discord-image-logger-main/src/components/injection.py
Resource
win10v2004-20240426-en
Behavioral task
behavioral11
Sample
discord-image-logger-main/src/components/startup.py
Resource
win7-20240508-en
Behavioral task
behavioral12
Sample
discord-image-logger-main/src/components/startup.py
Resource
win10v2004-20240426-en
Behavioral task
behavioral13
Sample
discord-image-logger-main/src/components/systeminfo.py
Resource
win7-20240508-en
Behavioral task
behavioral14
Sample
discord-image-logger-main/src/components/systeminfo.py
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
discord-image-logger-main/src/config.py
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
discord-image-logger-main/src/config.py
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
discord-image-logger-main/src/main.py
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
discord-image-logger-main/src/main.py
Resource
win10v2004-20240426-en
General
-
Target
discord-image-logger-main/builder.bat
-
Size
14.9MB
-
MD5
70a53c5ec35eefae927a0c413a89937a
-
SHA1
1bc9a22903968bfc05b87c1082a5c4242802d4dd
-
SHA256
a7aa6fa77e4931544a6966ef435400c52a79af300a548aca4e9c67f72218ac2d
-
SHA512
c712f2b98b0eb8c4808e4abcee0cc6100fc3e7d445f40208da0429b754148f190083ce247f183bb112083c15b06f466cbe573fe01f47de3d7958d8624e8d9aae
-
SSDEEP
49152:QYwuS617ST7nN2d57VTqUTm0AmK0jEHD5FQ/9gsyuEgPXiGncZwPnzLO1WtJHFi7:S
Malware Config
Signatures
-
Drops file in Windows directory 2 IoCs
Processes:
cmd.exedescription ioc process File created C:\Windows\$sxr-seroxen2\$sxr-Uni.bat cmd.exe File opened for modification C:\Windows\$sxr-seroxen2\$sxr-Uni.bat cmd.exe -
Runs net.exe
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
cmd.exenet.exedescription pid process target process PID 1384 wrote to memory of 2220 1384 cmd.exe net.exe PID 1384 wrote to memory of 2220 1384 cmd.exe net.exe PID 1384 wrote to memory of 2220 1384 cmd.exe net.exe PID 2220 wrote to memory of 2812 2220 net.exe net1.exe PID 2220 wrote to memory of 2812 2220 net.exe net1.exe PID 2220 wrote to memory of 2812 2220 net.exe net1.exe
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\discord-image-logger-main\builder.bat"1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net.exenet session2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session3⤵
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵