Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
296s -
max time network
300s -
platform
windows10-1703_x64 -
resource
win10-20231215-ja -
resource tags
arch:x64arch:x86image:win10-20231215-jalocale:ja-jpos:windows10-1703-x64systemwindows -
submitted
11/02/2024, 14:03
Behavioral task
behavioral1
Sample
batexe.exe
Resource
win10-20231215-ja
Behavioral task
behavioral2
Sample
batexe.exe
Resource
win10v2004-20231215-ja
General
-
Target
batexe.exe
-
Size
9.4MB
-
MD5
cdc9eacffc6d2bf43153815043064427
-
SHA1
d05101f265f6ea87e18793ab0071f5c99edf363f
-
SHA256
73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
-
SHA512
fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
-
SSDEEP
196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 3692 b2e.exe 1352 cpuminer-sse2.exe -
Loads dropped DLL 5 IoCs
pid Process 1352 cpuminer-sse2.exe 1352 cpuminer-sse2.exe 1352 cpuminer-sse2.exe 1352 cpuminer-sse2.exe 1352 cpuminer-sse2.exe -
resource yara_rule behavioral1/memory/4572-6-0x0000000000400000-0x000000000393A000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4572 wrote to memory of 3692 4572 batexe.exe 74 PID 4572 wrote to memory of 3692 4572 batexe.exe 74 PID 4572 wrote to memory of 3692 4572 batexe.exe 74 PID 3692 wrote to memory of 3704 3692 b2e.exe 75 PID 3692 wrote to memory of 3704 3692 b2e.exe 75 PID 3692 wrote to memory of 3704 3692 b2e.exe 75 PID 3704 wrote to memory of 1352 3704 cmd.exe 78 PID 3704 wrote to memory of 1352 3704 cmd.exe 78
Processes
-
C:\Users\Admin\AppData\Local\Temp\batexe.exe"C:\Users\Admin\AppData\Local\Temp\batexe.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\B47B.tmp\b2e.exe"C:\Users\Admin\AppData\Local\Temp\B47B.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\B47B.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BA09.tmp\batchfile.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.execpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1352
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
768KB
MD541acb3c7c35169437c8e50c36e39f5a5
SHA16b7a95c8fb404247edb7430b46e931495eeba0d1
SHA25677003c5f07279f31ace3879feb99ce0568a05bc7bc56ecd5707bc0581cb6016a
SHA512670b258078f3ccd9e3e710a994d95d406094dab87b4e4e11e3b312a7883631877ea896bc53150cb8b9bb8a0500df129005973212fce0541978df505edbe7d145
-
Filesize
512KB
MD5e4d2817f5e794155ac4a8a1445b9d728
SHA107f6972ab84878cee3a3e158cf9b0b27c8ad175d
SHA25624781b2a837565d59faae5eff35a839726a5aa2f952f46e5e5b593f53ab6774b
SHA5129ed2839db8465f9eb07d9bb2d29e1a35cc1c2e0b8c8f52007248752df018c899135e6d3f944e7e1363b3d5fe4928ccb71725fcaafedfd3cd496307619cf164f6
-
Filesize
136B
MD58ea7ac72a10251ecfb42ef4a88bd330a
SHA1c30f6af73a42c0cc89bd20fe95f9159d6f0756c5
SHA25665e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9
SHA512a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0
-
Filesize
2.3MB
MD54c04147c386ba8792ac6a03069572a8a
SHA1dda67789fc1d0f2469ca95f01a5c81034853ca6a
SHA256c7739a1e940a282703d06eccda7110426d306f390e97fdbbd9df18472fd132cd
SHA512a8b5a0b878a9a7d30cb38feff814e1f4dce24d000158edc10a43ee9a89920bedf7adc92eb7e3913098b6aab7fbd0531f56fc09f508b5c2769992a94e55d153db
-
Filesize
448KB
MD5ca0b33f54480aa9c590d09f72e3feb31
SHA1d50dc7dd964feb0d7516c3037e7dc7e008420ae5
SHA25667833a9e63d8b7469a3a3415124a2426893a6174ce2bd88bea520c68319d182d
SHA512266dcd9c5bfe2b117fda6bf7c4250a908233d8474bd0b09596a0bd0fa2e5bc75446a20b46cb7e516ef75b5661bbe16c714e8dcc5962a0f481cbaecdf6135affd
-
Filesize
384KB
MD5d1d1f36cdbccda3b96e8c164afb74526
SHA191bafcd404c8568c9a195ec8cbf9592ea9e17e8b
SHA256ea6e726150aa9a8dcf9ccb6a991440b451f9f2dcc46d93cb35971556879d1d03
SHA5122306e6578ba2217b4f32913e1ac35e0547723b873c11244e96affd05457945373c621ea16a82e1e3aa1a177e3059efc40c8585118c63a3ea145524c51d1d18c9
-
Filesize
448KB
MD58185100383d0fe360c9198e5a883b08d
SHA1ab398c469573f8e84d3cfcef01287a0604d6ab5f
SHA25605ef7288b0d559bf67c3d69c201da9bdcaed0b49ecc538640f7b96c5b82eb538
SHA51224930ef0caa1f2db2ed60f7dfdb832a172cf7747b0a336b051f73c0087a5f2fabff721487cb49cf5a3bc2be5426554b0a3a0e51541b6a4ca735646af24f1404a
-
Filesize
448KB
MD5ca123cec7f705c0af114e462349dc686
SHA175f90b4d95f6774b2f66e4ba790755ef118ab222
SHA2567f141cdc0be9c965e21310bcfb0484b20d31ffd8a6a970f8b5a53c0e8974798a
SHA512650125faa9ae6733f1118caf3101ca6850473f78f9bfc3a87e908eac1c69935e3bc269ffb5de4dd6e867429c1af35c7f3b9e62eb698fa7c9695d68e7115f3f1c
-
Filesize
244KB
MD5455e12ccc189bc4523f60e6ba6ca511c
SHA1c27885dc8cfa20d332aef7cd186449332cc62b6f
SHA256f10def8a6486538586a9e7898a1b8bad91a19a5d7d65abae3f3597cad080671c
SHA5129d7969ea2504494f4d8dd43fa6cce40fe630990a3c41e4a5d24e5e06e23cf1a8a67d914b644277e461cf4db0a7cf6b6aa8cc580eaf93c7697cfba672954e2ee7
-
Filesize
256KB
MD511e8812bfa1d698cdeb73a16c1d7c963
SHA1e8708fd452ab5946b380d0c353ac26acf289e548
SHA256e0f9ddf8afd30511763f0cf792369e32c955f15d9529c00c5fe9298a80d74402
SHA512fd54c9c6f3520b2ced6b42235ebfce6d8b622c53f1fbf810baace657a7d44430968b5ff90cd1d860dbdf7550dd8cd467636c862ff0dd0832f25145efccc7731e
-
Filesize
192KB
MD5d73b46cd072058efc54c4b3885f47e13
SHA184771c2c4f5736ac08497737cba2a8634d9e9178
SHA2563f62bb203bdcca4e489401897e0558cf33ad6fe890a9987f90f5c3894b965b34
SHA512519c91b5b5a82c5a755d7d4295c040cfb6b0f029eb088a6bfc428db11e30d7f954ea6fd6de9b083d1781e1142737ea39572866ab5f669848dff7ef0ce34c79c7
-
Filesize
64KB
MD5e98583e2f3157ea2561f40a91a79b195
SHA1770932f48dbea7a78a3b21e3df65e329a27313ff
SHA256f6b3de2ac1e9c449daf82a3bd6fa52d2ed60e73e8cdd25d5d2194586a8d10de2
SHA512cfa97067447a389dc5439dc42ca467f97947fa7010314cad0b99655688361721720bb33e34a1c7b22c93d807327b756109f63d15a40df5aaec620b0d0e1acc7f
-
Filesize
256KB
MD5eca0c37eee65c31b869788d5d0bf00cd
SHA133a5c0cd2f0a7296a5c0169699ed8e065b57e5e8
SHA2561d2b7bd4ddd99d627d5111252baadf028dc9910cf414892867502e5951de962e
SHA5125f302da7772fca0a6d03ffd8732850f526acf5fcc33e189d2d906a33101454d970d5cca2f829a006d15c4a857341d72c7876cb2e7af84ada4f158695aba5a4dc