Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

26/01/2025, 06:17 UTC

250126-g134lswjbr 10

26/01/2025, 00:44 UTC

250126-a3vrpawkay 10

25/01/2025, 07:43 UTC

250125-jkl69ssqat 10

25/01/2025, 06:18 UTC

250125-g2zsks1nck 10

07/11/2024, 17:59 UTC

241107-wksehawmb1 10

06/11/2024, 11:31 UTC

241106-nm7m7szapg 10

05/11/2024, 22:04 UTC

241105-1y6aqsynhv 10

05/11/2024, 21:53 UTC

241105-1rm6ksyhqe 10

04/11/2024, 20:03 UTC

241104-ysp1fsvrfz 10

Analysis

  • max time kernel
    15s
  • max time network
    19s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    04/11/2024, 20:03 UTC

General

  • Target

    ImageLogger-cleaned.exe

  • Size

    78KB

  • MD5

    8460a2ac97b2c6d2658664c718f84533

  • SHA1

    110f9849759ff8b034fdf0eb36445c37187858af

  • SHA256

    6a88e4cd73a6a4b7768b1df63aa7ff54d911568d3cd62d88c4b447cec1cb1ff2

  • SHA512

    2286e4429ac1e829150db13b9896c9f6db7d6da4b2003742c831edfd2a21e29565e87bd97a9ef98802f20239d9c89139c5026a331506d4f24da4bd8f4a19affe

  • SSDEEP

    1536:2a/yGXNiPw3iU8Bz/oNrfxCXhRoKV6+V+kPIZ:lEzgNrmAE+4IZ

Malware Config

Extracted

Family

discordrat

Attributes
  • discord_token

    MTI5NzUzOTkxNjAxNTg2NTkwNw.Gfdmm0.1DHqcqM266sEW3k8XieYxIORIkysBrFHb6r-3Q

  • server_id

    1297365710649036921

Signatures

  • Discord RAT

    A RAT written in C# using Discord as a C2.

  • Discordrat family
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ImageLogger-cleaned.exe
    "C:\Users\Admin\AppData\Local\Temp\ImageLogger-cleaned.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1240
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 1240 -s 596
      2⤵
        PID:2680

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1240-0-0x000007FEF5573000-0x000007FEF5574000-memory.dmp

      Filesize

      4KB

    • memory/1240-1-0x000000013F910000-0x000000013F928000-memory.dmp

      Filesize

      96KB

    • memory/1240-2-0x000007FEF5570000-0x000007FEF5F5C000-memory.dmp

      Filesize

      9.9MB

    • memory/1240-3-0x000007FEF5570000-0x000007FEF5F5C000-memory.dmp

      Filesize

      9.9MB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.