Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
293s -
max time network
295s -
platform
windows10-1703_x64 -
resource
win10-20231215-ja -
resource tags
arch:x64arch:x86image:win10-20231215-jalocale:ja-jpos:windows10-1703-x64systemwindows -
submitted
12/02/2024, 13:07
Behavioral task
behavioral1
Sample
batexe.exe
Resource
win10-20231215-ja
Behavioral task
behavioral2
Sample
batexe.exe
Resource
win10v2004-20231215-ja
General
-
Target
batexe.exe
-
Size
9.4MB
-
MD5
cdc9eacffc6d2bf43153815043064427
-
SHA1
d05101f265f6ea87e18793ab0071f5c99edf363f
-
SHA256
73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
-
SHA512
fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
-
SSDEEP
196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 5012 b2e.exe 1276 cpuminer-sse2.exe -
Loads dropped DLL 5 IoCs
pid Process 1276 cpuminer-sse2.exe 1276 cpuminer-sse2.exe 1276 cpuminer-sse2.exe 1276 cpuminer-sse2.exe 1276 cpuminer-sse2.exe -
resource yara_rule behavioral1/memory/2580-4-0x0000000000400000-0x000000000393A000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2580 wrote to memory of 5012 2580 batexe.exe 74 PID 2580 wrote to memory of 5012 2580 batexe.exe 74 PID 2580 wrote to memory of 5012 2580 batexe.exe 74 PID 5012 wrote to memory of 4288 5012 b2e.exe 75 PID 5012 wrote to memory of 4288 5012 b2e.exe 75 PID 5012 wrote to memory of 4288 5012 b2e.exe 75 PID 4288 wrote to memory of 1276 4288 cmd.exe 78 PID 4288 wrote to memory of 1276 4288 cmd.exe 78
Processes
-
C:\Users\Admin\AppData\Local\Temp\batexe.exe"C:\Users\Admin\AppData\Local\Temp\batexe.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\8FDC.tmp\b2e.exe"C:\Users\Admin\AppData\Local\Temp\8FDC.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\8FDC.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\91A1.tmp\batchfile.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.execpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1276
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD5d267a907581bdc51a2f7175e1bd4c6fa
SHA1b21837d20f42b5cf1ac310b0811c76b8ef041659
SHA256b79a8a130dba8d18e44ff8c5102435d8f9dcc66c17244af5b43e76dd91371a4d
SHA51299c529e2ce4c55d02d5e4c4c9a2f90f429d7a7d7578e1381303234a4335f4f21a4245260bde3f2e270085fa13697d800e6d6dbc9969812b88931274576dbaef8
-
Filesize
3.4MB
MD51379d0bfe563f2d8467dded41bd83815
SHA1b063ec1bdaa5a4cc65de92b97d7eb4d8e90b27c8
SHA25603c55c1d06ac254d1ffaca78f6db24a219e5a761fc8b00b5d4bd9468a9b09c74
SHA51257e48178e16b763c30dccb14af0d8d1b6a73d5389e89dd44021cbc60e3de05cba679ff14c360c0a2e0db2b88b87c7c1506964b544a02f2dd42acbff8b9796e9f
-
Filesize
136B
MD58ea7ac72a10251ecfb42ef4a88bd330a
SHA1c30f6af73a42c0cc89bd20fe95f9159d6f0756c5
SHA25665e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9
SHA512a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0
-
Filesize
799KB
MD56b1d16bfa136ef0ff5892cc795dffcba
SHA1206090342e1c43959892e44195f2f96340a32441
SHA256c62605ec9007a1d843a115cad1d2473afdcbd2f8b5e58bff2bfd063edebd68b1
SHA512f9e80f99b48768301f57462a1dbf9b3d45a76f82c2161d9dee33c9e3a6b949a1e13395b392c9bf642aac7ee29052aac974af7bf930880806b94cde439a486632
-
Filesize
951KB
MD54775a1d63fe1bd0c7a81c84457091d4d
SHA14f4b2dbf7f31219e7f0dbc269d3150580cb5400d
SHA256dc1d64d7cac7c9061df28730f60d445bebea61903ccaea3b0b1c2696547720bb
SHA51292b39d87281f9cdb655c120ca60201291d1f2c0ab7719573c83968def78b612e8d12ef071f9d4d20c09453e8f3c677b0c70770564a847bb0f715ac9c354009fd
-
Filesize
795KB
MD53de558240a803a16b1ef5dc4409f5789
SHA1d6c55481cd18423d923227c9ed6dfe470a12d804
SHA25609fb18408a67427f94841371872f614595713893140dea139d1ec092bc76c92f
SHA512d622ff3aa7fe86ddacf3146e77c403330eb096fc785f785606cc250c1882d84a2e696f72a0ef0961ec919807579c506b82f249db20839257c3a32460de1f8c37
-
Filesize
903KB
MD5b37472c269e8e3a118f82ba874f2136c
SHA11e3f01ac21cfe64cda42d3ac51d7f0ae29b0916b
SHA256652b8928395f6ef5e8f8df3fae5c11cfd24d72ce40916fe68af3a61877ef23ba
SHA5125a1bb0801d9477448c004f4d8449a0102a5a84d8b3f4f0e145d05ea9ebbcf152cf83b4c5786d7d6abe39bbc2599a50578c5db8577f7197110c926610d222e6ce
-
Filesize
740KB
MD55d48fea0e32930739332961be5fd3f53
SHA185e42404aff96cc0498bfc6e931bedb31db7a5ca
SHA2562655a5a55e3c5d621ea829fd4a4d1d5725bf00f1737429dc323143590d1e07b9
SHA512251b7bf7a3034edebe34d969f64f39b06a15bc9f5c5eeb8c94ee62790da4fa940b3dcd8c41a866733fdfafa73c3e2115394001cb76421f59c3f26826deb79dff
-
Filesize
836KB
MD5aeab40ed9a8e627ea7cefc1f5cf9bf7a
SHA15e2e8ca2881b9bf9edfa3c4fdcec6da1efa102d8
SHA256218cfc4073bab4eddf0de0804f96b204687311e20a9e97994bff54c9b0e01ee9
SHA512c0a67616fa01fdc351015212a718faf70da6612fbb3ec13da28dd7af9a507c56882fb7c3eea6fbc37d4d63b970157199d16d0756dbe3cb3bc2223e215cb104d8
-
Filesize
808KB
MD5db13a6951d2c05e75036211be00e62e3
SHA1299e3a0840019aaec7ceb297f18ff294fe9657c8
SHA25603dc9b5c658a285d314b6d1c169033ee10f9a08576214ffae2b51868f1d796de
SHA512cf402d0bc735e43cff3d8f48ef0fc3fb425e4e13c958ad396badc47c859fe723b5bee29cb708ddb8ecd9383d02202d25b7c42577da170a74eddc689d35a5271a
-
Filesize
958KB
MD55db5b8654a42beb313810af353c4901a
SHA176ef66c780592deea2f0fd11fa377c52bc76073a
SHA256c4ae4e6a7419467d4480a4553804e965549f511646f3e9fd91cf76cf2bcca164
SHA512b86f6e654695ebaae7ad8647470fe89eebd24448bde5dba8650a45292a46bf67f540cf8b4058eece176ad64d768f1f4a9492baf92b217fa04552062d13c88847
-
Filesize
1.0MB
MD551e87ddfb0f7e57d90a1ae7e60bc3c8d
SHA1a339a44b75949f0c925ddfe838e2120c42988a78
SHA25665919faa79e507db8a3e8246d521829456c8adf25c31c3a4285cccedb8983b2f
SHA5123cea02c31efc6cf8d0a29853b884296185858ed5022b1415d2eb22f8ed2c419ab418053e95c26c56ea58c1cb89a2f8293877c8f5bf0e2b7ed913a7b001919bb5
-
Filesize
606KB
MD5585efec1bc1d4d916a4402c9875dff75
SHA1d209613666ccac9d0ddab29a3bc59aa00a0968fa
SHA2562f9984c591a5654434c53e8b4d0c5c187f1fd0bab95247d5c9bc1c0bd60e6232
SHA512b93163cba4601ed999a7a7d1887113792e846c36850c6d84f2d505727dc06524bb959469f9df12928769f4535dc6074a6b3599b788a4844353e466742ce1e770