Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
292s -
max time network
296s -
platform
windows10-1703_x64 -
resource
win10-20231215-ja -
resource tags
arch:x64arch:x86image:win10-20231215-jalocale:ja-jpos:windows10-1703-x64systemwindows -
submitted
13/02/2024, 05:22
Behavioral task
behavioral1
Sample
batexe.exe
Resource
win10-20231215-ja
Behavioral task
behavioral2
Sample
batexe.exe
Resource
win10v2004-20231215-ja
General
-
Target
batexe.exe
-
Size
9.4MB
-
MD5
cdc9eacffc6d2bf43153815043064427
-
SHA1
d05101f265f6ea87e18793ab0071f5c99edf363f
-
SHA256
73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
-
SHA512
fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
-
SSDEEP
196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2340 b2e.exe 2788 cpuminer-sse2.exe -
Loads dropped DLL 5 IoCs
pid Process 2788 cpuminer-sse2.exe 2788 cpuminer-sse2.exe 2788 cpuminer-sse2.exe 2788 cpuminer-sse2.exe 2788 cpuminer-sse2.exe -
resource yara_rule behavioral1/memory/4700-5-0x0000000000400000-0x000000000393A000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4700 wrote to memory of 2340 4700 batexe.exe 75 PID 4700 wrote to memory of 2340 4700 batexe.exe 75 PID 4700 wrote to memory of 2340 4700 batexe.exe 75 PID 2340 wrote to memory of 4920 2340 b2e.exe 76 PID 2340 wrote to memory of 4920 2340 b2e.exe 76 PID 2340 wrote to memory of 4920 2340 b2e.exe 76 PID 4920 wrote to memory of 2788 4920 cmd.exe 79 PID 4920 wrote to memory of 2788 4920 cmd.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\batexe.exe"C:\Users\Admin\AppData\Local\Temp\batexe.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\94FC.tmp\b2e.exe"C:\Users\Admin\AppData\Local\Temp\94FC.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\94FC.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\972F.tmp\batchfile.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.execpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2788
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.3MB
MD54760de0790c6acbb1c0b67cb9a7897b0
SHA13b34c6584740d59bea686af2bc9e1acec803e55c
SHA256754016fd6c2fd190653e8df2332cf9e34ec6c00e45b1f70e003c7a4292939864
SHA512546edfcd35a706845e94fb746a0ff93e1beadc4e7775c093c82d21a8604783c44cc8f1a472eb1578f1c310800ae90d13e7d1634d331365501ad98e84e6fea422
-
Filesize
3.8MB
MD58914f19b9e333b09fffb538e3064ac2c
SHA12295a527294a91494debeb41959a8022f9f27aec
SHA2563489797e57b29fa12da60287ce86fdff12e4ec1b698e3d8e69a7521dfcc96e4d
SHA51272b6839bb887afbfb605c016fdbabe5b92967e722a57639cedaa64757d8e8f56f34b5728a5d246e1bd35d318d064ce977e4143dcf27aa2eb8df6a5cf9e81cd4b
-
Filesize
136B
MD58ea7ac72a10251ecfb42ef4a88bd330a
SHA1c30f6af73a42c0cc89bd20fe95f9159d6f0756c5
SHA25665e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9
SHA512a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0
-
Filesize
624KB
MD5ce267b4795c07384ac256572763d40cf
SHA1c3207764fe91b4676d93cbe4cafbff31fe85c0e1
SHA25602978e806fc31bd5aec89f4b4ce1d55f30f7a06543ec83cbfb2fc296e91f81f1
SHA512232ef2c38e0a252e01aa34b5c6b4f930b483fb7aaa69004944f76f7ba949684811afb2f6f3b7eafe3d89aa42ebb45805313a02e2bcc3a6d32d4c20232ff12758
-
Filesize
393KB
MD5bf98a3b9300874c11c699cab517d26a6
SHA1b6be0dd20d793fbb75f1a169c1a069efcb695433
SHA256ab192b0f347d238ba16be25a2a7c1b8e715c602a80d920fac0e264f70a7fb92c
SHA512baecf064280a478349f546489ee643b15c77d0ed1ca2be99dd359af13a317139b63599ce8c0bf2fd6c6b56f8f1b034e5f1b31d8e5bc9a9d9bf93ad5f9511c4c2
-
Filesize
328KB
MD5ee4cbd5550e698f26646004250faadb4
SHA199d272a7358cc7ec60539795dc849f8b6226048c
SHA2569688b7cfd90182ff42ef4c595f98d79f3fb721545399f5fa4d611aafa298e5e0
SHA5129198bdbbfd68f750bb6034e431a379a6fa36cc44a6dbdbbbd7e8055ee973f84c3e39d47551be9f5239c92c5b0e8237e43c8b12fd425539ca4a331ed2bf2ce8aa
-
Filesize
382KB
MD5aa456b563ceb2088715de8b1ddf12ccb
SHA1c9428890da471839e6e99903cfef0c37878b8a95
SHA256fb8d2bdd8eb149a449bfed0f8229d91c49893a614264a18af2b89b11e14064d6
SHA512ffbbc419a4b07e39fffa294fea2990ff8fa8b1df3eea8143815cc0bf46462201a198e576d208934f93b234a870773f86426224f9d30e0e7c293d32c2cb99f53c
-
Filesize
742KB
MD5e3d89da3c657ca3a67c1026d25f7ac10
SHA17d8bd6803274b5af8749bc3d93cdbca8b277883c
SHA256682eb9dc3745af127c0c6809d5ea030b459d8eb6ce154e80500f5f1a3c19a656
SHA512758069919edb77a995386fbb8ceeb915a74b1e7219341b12500b756a1b9fa54bb24e63b86ab1d6ae6223faaf583aa6b7094ce9b9e1406c45a50364ef86c780a5
-
Filesize
566KB
MD521c9e2a150e393130eec6da4da373c26
SHA1958c8122b710cb8daa114a75e9665a860faf8de8
SHA256bfef095fa4b40792ee9193d4a0bbbca05d483e84cc95820b04ed9f1466b1e2db
SHA512878aacab022db5c90b1dd3c8b4b870d0070a1eb9ca34c1bb0942b1554ecf6b9d0660120136060c0a2cc0d60f187c651d3a41239ed12db9bd9f36311850a8fe9c
-
Filesize
414KB
MD5970af5dd2a9c0e4ae0871d4a382fc0d4
SHA1e17a3a2295fb795d389b9d344bd5126605b04f2a
SHA2568d11d1ab67cc865f8dd81c38d56e246d14c0f12e76cbe59f71203e332b32f793
SHA512c9efb717a062154ac06b8ef66723d20066dd02c15fda2713bc765590d7f9fb4a6e87d8b0fc66a70d81ba8870849c962e2e67362de5b9817290fc4572d6c4bf39
-
Filesize
708KB
MD515e1480ecf113cea9d3e43374b29a99d
SHA1895e24fb324ff5c09e4a6ce02d41c40f851f7023
SHA256f4c0af188f9e4412fde787736de0fcd270c9193d027128e904c89ee1dcccc3f1
SHA512727c19ef10b821bdd268c32e2090c359112aca6536308229259ad68a282a17f22a43b7d28c9dee26783f5d3319f93d1d7754b5f0d11954f073de9f7c5fffabd3
-
Filesize
519KB
MD5ed54fd6bb472b1f3044e29d5f1569fb5
SHA1b4b0180897b8ce6405b4a2b86c29725c01227458
SHA256547d5bd930ae1e111a0f45007f1ebdf9f2a75a6128301661f0909724d8925318
SHA5126f596b43c2b0f81fc8d2eaa249cdc6e8995d492ebfa8f4c4e4f9b1359da88bc7eae403ce1aa54b0592ef9e45ad71f76fb8ff525370f8dbf971e1eae4d828cfe5
-
Filesize
508KB
MD500d5677bdb31c83896d535a97f1b0a37
SHA1d113f9e485cf5d094dbbac53e92eaac239726486
SHA256be394b6ddac052c69cd83e092f440c24912aa762c3bf0a867c1b280133627a46
SHA5127da4f235c75117bb850de7414d34100e8d1c28a6ce1826c971206eb1293b0acedba14468670f1aee472a60200dc771b4d866bf053968b5ab55cfc4748ad8b623
-
Filesize
467KB
MD596cac776c1ee69ccc9d5abe439364032
SHA135b2c9b219055641cce634e9c1966b604a0c00c7
SHA256754cd052c1279b4f32059cd0ae8b375b0eda9c93e1acf931d15f78d57095d7cf
SHA5127d9e193c1f1ade7583bfbf5866e863bb34e3102daf07dcb836e6b0bb5f23d9fdd2720936a273797dfb8682978b86d9c5c83152d9e1bccb92b19309c1f5f40188