Overview
overview
10Static
static
10discord-im...er.bat
windows7-x64
10discord-im...er.bat
windows10-2004-x64
10discord-im...bug.py
windows7-x64
3discord-im...bug.py
windows10-2004-x64
3discord-im...ers.py
windows7-x64
3discord-im...ers.py
windows10-2004-x64
3discord-im...ken.py
windows7-x64
3discord-im...ken.py
windows10-2004-x64
3discord-im...ion.py
windows7-x64
3discord-im...ion.py
windows10-2004-x64
3discord-im...tup.py
windows7-x64
3discord-im...tup.py
windows10-2004-x64
3discord-im...nfo.py
windows7-x64
3discord-im...nfo.py
windows10-2004-x64
3discord-im...fig.py
windows7-x64
3discord-im...fig.py
windows10-2004-x64
3discord-im...ain.py
windows7-x64
3discord-im...ain.py
windows10-2004-x64
3Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19/03/2025, 22:07
Behavioral task
behavioral1
Sample
discord-image-logger-main/builder.bat
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
discord-image-logger-main/builder.bat
Resource
win10v2004-20250314-en
Behavioral task
behavioral3
Sample
discord-image-logger-main/src/components/antidebug.py
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
discord-image-logger-main/src/components/antidebug.py
Resource
win10v2004-20250314-en
Behavioral task
behavioral5
Sample
discord-image-logger-main/src/components/browsers.py
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
discord-image-logger-main/src/components/browsers.py
Resource
win10v2004-20250314-en
Behavioral task
behavioral7
Sample
discord-image-logger-main/src/components/discordtoken.py
Resource
win7-20241010-en
Behavioral task
behavioral8
Sample
discord-image-logger-main/src/components/discordtoken.py
Resource
win10v2004-20250313-en
Behavioral task
behavioral9
Sample
discord-image-logger-main/src/components/injection.py
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
discord-image-logger-main/src/components/injection.py
Resource
win10v2004-20250314-en
Behavioral task
behavioral11
Sample
discord-image-logger-main/src/components/startup.py
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
discord-image-logger-main/src/components/startup.py
Resource
win10v2004-20250314-en
Behavioral task
behavioral13
Sample
discord-image-logger-main/src/components/systeminfo.py
Resource
win7-20241023-en
Behavioral task
behavioral14
Sample
discord-image-logger-main/src/components/systeminfo.py
Resource
win10v2004-20250314-en
Behavioral task
behavioral15
Sample
discord-image-logger-main/src/config.py
Resource
win7-20241010-en
Behavioral task
behavioral16
Sample
discord-image-logger-main/src/config.py
Resource
win10v2004-20250314-en
Behavioral task
behavioral17
Sample
discord-image-logger-main/src/main.py
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
discord-image-logger-main/src/main.py
Resource
win10v2004-20250314-en
General
-
Target
discord-image-logger-main/src/main.py
-
Size
848B
-
MD5
c7e2a6f36eead941802e707eb246da84
-
SHA1
4406272e8c7a9b8cb5684373c43f3368b2cb44dd
-
SHA256
eff558ffa171814712d1605c72fe8eba833f1682ef7efc8285dcf5303f4c5f41
-
SHA512
a6191c28c66c9c33d7bf070b36b5cb6ace45e06593cf4368cfd60e10a28bc846100be7efa025e1e12f5b4c3e0217ae5ec185142d1a4ea5db7aa1a5d585afdbeb
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_Classes\Local Settings rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2632 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2632 AcroRd32.exe 2632 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2980 wrote to memory of 2196 2980 cmd.exe 31 PID 2980 wrote to memory of 2196 2980 cmd.exe 31 PID 2980 wrote to memory of 2196 2980 cmd.exe 31 PID 2196 wrote to memory of 2632 2196 rundll32.exe 32 PID 2196 wrote to memory of 2632 2196 rundll32.exe 32 PID 2196 wrote to memory of 2632 2196 rundll32.exe 32 PID 2196 wrote to memory of 2632 2196 rundll32.exe 32
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\discord-image-logger-main\src\main.py1⤵
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\discord-image-logger-main\src\main.py2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\discord-image-logger-main\src\main.py"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2632
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5e84ca0c79432d15e400ad043309fcc65
SHA12893b971a8cec0778de92dd185ca5180d1a3f187
SHA256488ae774567dbe7c36d3550b1e66c1449b59e6d1a08c9b05095e8b15d11cfa8e
SHA51214fed8c42f4cb7aacb63a75058587981a5b0f46e860dedcb08822e950a3be86ff5e6127b3a854db9559e45e054f08236f5e131784d028440c0043b3111d69ffd