Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
293s -
max time network
301s -
platform
windows10-1703_x64 -
resource
win10-20231220-ja -
resource tags
arch:x64arch:x86image:win10-20231220-jalocale:ja-jpos:windows10-1703-x64systemwindows -
submitted
13/02/2024, 07:16
Behavioral task
behavioral1
Sample
batexe.exe
Resource
win10-20231220-ja
Behavioral task
behavioral2
Sample
batexe.exe
Resource
win10v2004-20231222-ja
General
-
Target
batexe.exe
-
Size
9.4MB
-
MD5
cdc9eacffc6d2bf43153815043064427
-
SHA1
d05101f265f6ea87e18793ab0071f5c99edf363f
-
SHA256
73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
-
SHA512
fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
-
SSDEEP
196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 4448 b2e.exe 2892 cpuminer-sse2.exe -
Loads dropped DLL 5 IoCs
pid Process 2892 cpuminer-sse2.exe 2892 cpuminer-sse2.exe 2892 cpuminer-sse2.exe 2892 cpuminer-sse2.exe 2892 cpuminer-sse2.exe -
resource yara_rule behavioral1/memory/2348-5-0x0000000000400000-0x000000000393A000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2348 wrote to memory of 4448 2348 batexe.exe 39 PID 2348 wrote to memory of 4448 2348 batexe.exe 39 PID 2348 wrote to memory of 4448 2348 batexe.exe 39 PID 4448 wrote to memory of 3268 4448 b2e.exe 53 PID 4448 wrote to memory of 3268 4448 b2e.exe 53 PID 4448 wrote to memory of 3268 4448 b2e.exe 53 PID 3268 wrote to memory of 2892 3268 cmd.exe 51 PID 3268 wrote to memory of 2892 3268 cmd.exe 51
Processes
-
C:\Users\Admin\AppData\Local\Temp\batexe.exe"C:\Users\Admin\AppData\Local\Temp\batexe.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\9337.tmp\b2e.exe"C:\Users\Admin\AppData\Local\Temp\9337.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\9337.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\951C.tmp\batchfile.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:3268
-
-
-
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.execpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2892
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
355KB
MD5e88364659d153c4c6875159f4e3edef6
SHA14cbca5c28781ceb23e3ffd889443204ba7e71041
SHA2569c1696ee37c02fe61410049915a97b3a0f67c3fd35eec94048d29bedbc281f62
SHA51222a4c9bab84c42518e8a9bdec8bc9737518584cee2fa1889df94d634339f3c735cb02ac09df285cf16a76db39a0ad9478d6cc35f74121c2e68988f3c879dacaa
-
Filesize
435KB
MD5b55e1900845add9155a86978b8747e66
SHA108d8a32fd53bf403ab57aa5d1eb032fa242d046e
SHA2566ee85a6943ecc5e2783382913479e0b16dd62398c7031a537e4f5a46af0fe9d5
SHA512610b4ce48a9f3c4a1cb75e1b32e7e1b0ce5d7909aa947665d30f7393675e44310cf50136e2d9e4c043c32383867e61a7c0ddcf54801d3b5289f3eaa87b608ad7
-
Filesize
136B
MD58ea7ac72a10251ecfb42ef4a88bd330a
SHA1c30f6af73a42c0cc89bd20fe95f9159d6f0756c5
SHA25665e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9
SHA512a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0
-
Filesize
349KB
MD53b2a0ee66595ce5cc05c340f4178ba96
SHA163181b8a5715343e1e0c78908b293508fd83a5dd
SHA256cdcb9a07a27d2ca048047b7a183ba5fcd5f2a4287bcc9c52f0919d15bad3e076
SHA5124637d8424ef1e2b8c89b5b40409bb1c2f2c923e48abbe83675850a0a05a7d498f67635bc0f0ad698b9b594e82620289e41a9f4549f7cdef1933c92cfa3e23ab0
-
Filesize
286KB
MD546743aaf2d5a417a062c552a2d354cae
SHA14e3c484b52f0e193c2728a1b019cf5f146fd37e6
SHA256e35426c715b61bf3c90d91dece68b122529ad80fcff9c5659e1832c23e562b3a
SHA5126dd8ebee4b4b710c89da010d2bb3a5c15e01ba1f96e911fb8ec18738ac88bde13773ce7c0674ca0210dbb5ae6d33dc915d6b09e3e3905ca64bab556023b403ea
-
Filesize
260KB
MD596a2306f1fce6b8c407f9e2566a5fc05
SHA111e64005ceb7cc4c5154e62503fe8daa1b98501b
SHA256784c10489e0bcd09d156179c349f258d8980481d9274e1c684f04ddfdbf0b46e
SHA512a821cf85b3e888a46514859b659fe086140299be967c9f31201f37acb1cfbac2164ce935809cc0878b0e386abf5f15e10b0a9889a324648c701f59ee3a1943ec
-
Filesize
328KB
MD5f2061ef24b6df7c7dec2ba941ca22f44
SHA1794172b5b1ece61487df40eccd2a8cb8c519d655
SHA256958054dccf785675f26fa8ead9091bf5f720ba9d8eacbf95cfd880e5b4c305ab
SHA512d49fe7c5079b50d29bd916fff3d75d46266ada42d1a1c5358e9524affc5967aee9df68888ca59b9adbbf37cb4f55c8f8aa3992154797308bd9aaea477cf956e5
-
Filesize
275KB
MD5bc95d14a2e9afa3b4d5ba7be6caae648
SHA1186addffed01eaa9f9b8869c5eabe25db20e8f1e
SHA256b2ea3f2fde4c2b59e8496da8359fb21b332ada4daf6a6e39f9901fb9829a33ea
SHA5125ebd55a1fe1e173f66ca60d7689f7745686ed36b241f365f950fe2680e597ae93edb311552551969c8cc3e0041d92c7ff0aaf9b6b91c8be8aee2ca0c66daf17c
-
Filesize
234KB
MD5c4b41effa3dff39b555a58fbb848daf2
SHA156798d75a3b6da86311c1cc252e40e2e3a3afe4e
SHA2567ce1578da88968966ec0dfdee202532c993dea232367d180daaa56307bcc2fdf
SHA51282680cc34c69a30fb081fd1f27dcc01e4e0fbe7f28d054959f46412c446ba744b6eee84037e2ea756672d3c2c5f8a713f3b3de9d8987fc0697072b318f898892
-
Filesize
351KB
MD5738b3a065cf1798e4792758533704028
SHA1ebf34b1fc6df61a8bfcbb8851b434f409cacfef5
SHA2564a39bca004b34bf43bc4d03d2b74985413ba866965aaf9c1ca698c9cf8e3c662
SHA512b4d6bebc1aa6649ea28b539df2ece476bcb82b4aa152f95cff4319f3855dc1427b95dde25bd685efe283c72d0413b07e4e3bab445727e492a9df5f68d9e5b5e5
-
Filesize
333KB
MD5adc6f77a6f295c2de29b8a05185be4bf
SHA1bb844aac890db06f8605968e3a07cde269cc5dd0
SHA256f05795c93b24cb41f778fa9e0fdca410c8101ca16fc13edd0904886e237a8c99
SHA512f8732aedf5d1b4e6d5473bfb728dd67b829497678d144f831457eba220c71d07501deafaaae25707577dec439d9f9accccf6c0fa93aa88ea10a16001e1a328ce
-
Filesize
290KB
MD5bcde67c2f0a477696b1c0241e07ded1b
SHA1335edec06342779857ae3efced2cfa197f262e5d
SHA256c0ff7367afc498bf125e623a5e5fa92a0cff4800eef6e88b2e40200c7b2def77
SHA5125d63216372b3f27a7320aa02ab8ec1d8f9bf7a489601cb865012c04e0f5c82896313b9a84f865cbf5b09d5eeffdd0b81cec74f3d8c9f6fee884f659824be71e6
-
Filesize
249KB
MD586ffadde930bea9610b3e3dd835f3b4f
SHA18b21f4e4054119af07cecb58a79940c6e3536ece
SHA256a534979641372f3eab8f0543c207075fd4e2fb21b1c05710de94f9e5d51c6263
SHA512146b8aa9b6757f27028ed8cfb563994f5346fd6459738fba658fa7a91d5527fcb167c323165ce2df5f126946502f966acf115647399a16bea606097cc8377236
-
Filesize
214KB
MD5528c42230ccfb22c1e57174e9e6cba01
SHA11d0e7c6c498251573b8947daca8b0419b67d51b2
SHA2564e8dab94302b0b76c5484d4c8e38d18e666ac37ac7c8893a58d777f7b397c28b
SHA51219f0097968668b6c0511f85f111f0025198e4f54e5715c48f8308f16944386ec163a6e1d9b17fa6510040dbcdc90f2d923199c18f38b6ba9495efbb7ce1bfb61