Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
293s -
max time network
297s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-ja -
resource tags
arch:x64arch:x86image:win10v2004-20231215-jalocale:ja-jpos:windows10-2004-x64systemwindows -
submitted
13/02/2024, 11:48
Behavioral task
behavioral1
Sample
batexe.exe
Resource
win10-20231215-ja
Behavioral task
behavioral2
Sample
batexe.exe
Resource
win10v2004-20231215-ja
General
-
Target
batexe.exe
-
Size
9.4MB
-
MD5
cdc9eacffc6d2bf43153815043064427
-
SHA1
d05101f265f6ea87e18793ab0071f5c99edf363f
-
SHA256
73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
-
SHA512
fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
-
SSDEEP
196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation batexe.exe Key value queried \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation b2e.exe -
Executes dropped EXE 2 IoCs
pid Process 2228 b2e.exe 1064 cpuminer-sse2.exe -
Loads dropped DLL 5 IoCs
pid Process 1064 cpuminer-sse2.exe 1064 cpuminer-sse2.exe 1064 cpuminer-sse2.exe 1064 cpuminer-sse2.exe 1064 cpuminer-sse2.exe -
resource yara_rule behavioral2/memory/3500-7-0x0000000000400000-0x000000000393A000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3500 wrote to memory of 2228 3500 batexe.exe 85 PID 3500 wrote to memory of 2228 3500 batexe.exe 85 PID 3500 wrote to memory of 2228 3500 batexe.exe 85 PID 2228 wrote to memory of 3016 2228 b2e.exe 86 PID 2228 wrote to memory of 3016 2228 b2e.exe 86 PID 2228 wrote to memory of 3016 2228 b2e.exe 86 PID 3016 wrote to memory of 1064 3016 cmd.exe 89 PID 3016 wrote to memory of 1064 3016 cmd.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\batexe.exe"C:\Users\Admin\AppData\Local\Temp\batexe.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Users\Admin\AppData\Local\Temp\5F46.tmp\b2e.exe"C:\Users\Admin\AppData\Local\Temp\5F46.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\5F46.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\6234.tmp\batchfile.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.execpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1064
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
17.2MB
MD542a79ae5a2f7d4cd1b2b879ff2aa69ae
SHA1d2acb09cc1a5577ea67621e4ab171d6da5283a6e
SHA2567aab9724126b8ae273e688a9721d1113c220bbf326fd6f0ab8ec4652daf987e8
SHA512168ec363d39d68a3e7137528aa07fba1ab9ad2ade4be5663f7e667e8a72cfb942b6acb2c0b41c4519e73335b12c33ba46047aac0d60ccd8a62a44ee1197c025b
-
Filesize
7.3MB
MD5f92e9750004ad01876fbdd308d251d71
SHA1ca1801e1bcdd39fb94efbe4d97436035105963dc
SHA256844df9d1c2405529bd026472d99ef77d1480e1ee73e8ecd7fa9bb60903965f09
SHA5120e9bc773e9c2db8e360f2604987ed5af04c10034003545af7675c94421fb35c6bf95bc6c8e8592cd55e6852697c3d46410665e8db4e12080490021f72d1ae9e4
-
Filesize
9.6MB
MD5fe303ed1a6cad96bc09955e2e8449cea
SHA1238d320c24cef831964a75d479771294c027a6ba
SHA256f56712fd024c95dbfad1f36e76d19938b7c33e56bd22d6c6119500284d28bc35
SHA51292084bb9d3f37be8f121d6c453d02773774c26829bcae1b6ff7ef1c6a144757756552aa5b4292f139d471df5f8f040a710a26c424e0678ae318f0d1816a4c790
-
Filesize
136B
MD58ea7ac72a10251ecfb42ef4a88bd330a
SHA1c30f6af73a42c0cc89bd20fe95f9159d6f0756c5
SHA25665e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9
SHA512a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0
-
Filesize
2.3MB
MD54c04147c386ba8792ac6a03069572a8a
SHA1dda67789fc1d0f2469ca95f01a5c81034853ca6a
SHA256c7739a1e940a282703d06eccda7110426d306f390e97fdbbd9df18472fd132cd
SHA512a8b5a0b878a9a7d30cb38feff814e1f4dce24d000158edc10a43ee9a89920bedf7adc92eb7e3913098b6aab7fbd0531f56fc09f508b5c2769992a94e55d153db
-
Filesize
836KB
MD5aeab40ed9a8e627ea7cefc1f5cf9bf7a
SHA15e2e8ca2881b9bf9edfa3c4fdcec6da1efa102d8
SHA256218cfc4073bab4eddf0de0804f96b204687311e20a9e97994bff54c9b0e01ee9
SHA512c0a67616fa01fdc351015212a718faf70da6612fbb3ec13da28dd7af9a507c56882fb7c3eea6fbc37d4d63b970157199d16d0756dbe3cb3bc2223e215cb104d8
-
Filesize
1.2MB
MD57cf672bee2afba2dcd0c031ff985958e
SHA16b82a205db080ffdcb4a4470fce85a14413f3217
SHA256c82f84171b9246d1cac261100b2199789c96c37b03b375f33b2c72afab060b05
SHA5123e90d1c1efe0200cb3cc7b51d04783a3cce8391faa6ce554cff8b23dac60be9f8e4f980a8ac005fd9dff8ea4bdcb02311f7649c5be28eb32dcc26417fc4090e5
-
Filesize
5.4MB
MD5b69b2b567106989129ddd1f281a2dbfc
SHA1f920cdbab8e8093c517e2fe6f927532e18f4f230
SHA2567cb5d6cab0fa416105b593d2b5a12d9f87fbd74ee6ab856b7771060dddcfe0cc
SHA5129757224357a416619e6f265b7d470794aa4da7a0c33d0bd2809a9288dd629258357b3c799fcc2663a08bfcb254e00233b9c8d36f0c3188e95a1ffa1ee1334578
-
Filesize
5.5MB
MD5a52b98fdc3aaca7e1de2fde7c6bd3384
SHA18464b1f9fe04e8b39080dff29d21b72a1bd5f89e
SHA2560b35c1d352ebdaa09a774c6e980168ee876483086007fe5035dd721ade07bb56
SHA512ff18fdaea6ba4a6a1b6820ebba838675e10827b4b18f4dad4805ee7b3ab01f3a0b6686eabe9e4fb8c442da9fe3aba1fa3ec291e567ee0a68f407fced80c5b8da
-
Filesize
5.9MB
MD5a8e5a03ab63e36ad6c3a6ac96208c957
SHA10b1d4949f6f583708a937a5d4a0781e3c58408e3
SHA256e6bc08fffeab2284c92991e8b0013cb81918add62aaa8b8b415487ac74741292
SHA512359fda43807d525e506d375a4ab2fe15d67c9e55473985f7ef3e06885c85158b7aecbf5293c82740dcd0b6d8c5d17b36310f34145d71392f454cbe89db8071e3
-
Filesize
606KB
MD5585efec1bc1d4d916a4402c9875dff75
SHA1d209613666ccac9d0ddab29a3bc59aa00a0968fa
SHA2562f9984c591a5654434c53e8b4d0c5c187f1fd0bab95247d5c9bc1c0bd60e6232
SHA512b93163cba4601ed999a7a7d1887113792e846c36850c6d84f2d505727dc06524bb959469f9df12928769f4535dc6074a6b3599b788a4844353e466742ce1e770