Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
296s -
max time network
299s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-ja -
resource tags
arch:x64arch:x86image:win10v2004-20231222-jalocale:ja-jpos:windows10-2004-x64systemwindows -
submitted
13/02/2024, 13:18
Behavioral task
behavioral1
Sample
batexe.exe
Resource
win10-20231220-ja
Behavioral task
behavioral2
Sample
batexe.exe
Resource
win10v2004-20231222-ja
General
-
Target
batexe.exe
-
Size
9.4MB
-
MD5
cdc9eacffc6d2bf43153815043064427
-
SHA1
d05101f265f6ea87e18793ab0071f5c99edf363f
-
SHA256
73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
-
SHA512
fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
-
SSDEEP
196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation batexe.exe Key value queried \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation b2e.exe -
Executes dropped EXE 2 IoCs
pid Process 3520 b2e.exe 4140 cpuminer-sse2.exe -
Loads dropped DLL 5 IoCs
pid Process 4140 cpuminer-sse2.exe 4140 cpuminer-sse2.exe 4140 cpuminer-sse2.exe 4140 cpuminer-sse2.exe 4140 cpuminer-sse2.exe -
resource yara_rule behavioral2/memory/5712-7-0x0000000000400000-0x000000000393A000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 5712 wrote to memory of 3520 5712 batexe.exe 83 PID 5712 wrote to memory of 3520 5712 batexe.exe 83 PID 5712 wrote to memory of 3520 5712 batexe.exe 83 PID 3520 wrote to memory of 5388 3520 b2e.exe 84 PID 3520 wrote to memory of 5388 3520 b2e.exe 84 PID 3520 wrote to memory of 5388 3520 b2e.exe 84 PID 5388 wrote to memory of 4140 5388 cmd.exe 87 PID 5388 wrote to memory of 4140 5388 cmd.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\batexe.exe"C:\Users\Admin\AppData\Local\Temp\batexe.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5712 -
C:\Users\Admin\AppData\Local\Temp\6C47.tmp\b2e.exe"C:\Users\Admin\AppData\Local\Temp\6C47.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\6C47.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\700F.tmp\batchfile.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:5388 -
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.execpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4140
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
27.7MB
MD52389363e8902429636562b9d54779141
SHA1c64be9786d977fd55128c427ef2dc8afc243fba5
SHA2568e44f31e472c5e9d03c2503f156af18285d76d2a9f16c4d9702304199007b50e
SHA512f875672899aeaf6e857dd07436f34f54db7dd215f589728d3f46e87b96e3f2cb021a7f578199a1c54062ab298508f72bcdf1e464c65f390f4fc5be6e33f5b339
-
Filesize
13.2MB
MD5ea3b5c434a12dbf1fa46d6a32b71e904
SHA1de7174c8a3ed8433fad02b30492726e2fa1e73c4
SHA256f4152200d3c8a8374c1384f4ba0ae81db2e8e23c81beba2a1f2cb270653f9a90
SHA512cbcd7b84b44b9fffc2cecd50e2cdb04c915868098c4fb44ee9a13efc2c3b2f28e6c24a05d533d8cdf8b5eb9748ebec4fb91024442039a88d03d60dc04595c3fb
-
Filesize
14.2MB
MD50be70aba50ff45d020d64b2200f3abd2
SHA15aded247f8a6dae70a301f4bd10267389228eca7
SHA256a07cd6a1e146339e242e283f7dbc888caedbaac841f1f8b4a7d866e08e8cebf9
SHA5126ca1de74c65dcc80b30f53469fa9fced4f222083e03b51e611a0dcc275da6dc3f02dcdf609ff5c452b23b6fc0ada2ca89f48a04f841129d9883e26fec5166208
-
Filesize
136B
MD58ea7ac72a10251ecfb42ef4a88bd330a
SHA1c30f6af73a42c0cc89bd20fe95f9159d6f0756c5
SHA25665e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9
SHA512a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0
-
Filesize
1.3MB
MD56c10d9c8e7d91dcf8eb8b30088027c61
SHA14d2698832344acabb120af403fa081779b1df33b
SHA256186f5fa7d41c6922b30a2756f60386190d1e86617696144a8cc1cf53960f80c9
SHA51279353fcdaeb98732da7ec4df9d2279368c22e078a7efd0494f677ae043a068f7e5cf994b74d3680542485812ba51f6e86dbed1c544a1c3938336cbc317d4fea1
-
Filesize
1.4MB
MD52ef40d5c3b964c66392be6a3db51bf84
SHA1391a644aa11504129db4b42007b054f2c3bf5414
SHA2560ef835e2576ba8fbfcd733a66284579607cc8dafdc2b26fe3c0091dc66d8e707
SHA5120b568c8b5ef88af49c00801cd5eaf3e7262367d2a3356f1a685d36e3c1dff63babb5dd049d5a1e7fbe214cab35e6f271d0a105e073a1fb2c281bb5c0279b7107
-
Filesize
836KB
MD5aeab40ed9a8e627ea7cefc1f5cf9bf7a
SHA15e2e8ca2881b9bf9edfa3c4fdcec6da1efa102d8
SHA256218cfc4073bab4eddf0de0804f96b204687311e20a9e97994bff54c9b0e01ee9
SHA512c0a67616fa01fdc351015212a718faf70da6612fbb3ec13da28dd7af9a507c56882fb7c3eea6fbc37d4d63b970157199d16d0756dbe3cb3bc2223e215cb104d8
-
Filesize
1.2MB
MD57cf672bee2afba2dcd0c031ff985958e
SHA16b82a205db080ffdcb4a4470fce85a14413f3217
SHA256c82f84171b9246d1cac261100b2199789c96c37b03b375f33b2c72afab060b05
SHA5123e90d1c1efe0200cb3cc7b51d04783a3cce8391faa6ce554cff8b23dac60be9f8e4f980a8ac005fd9dff8ea4bdcb02311f7649c5be28eb32dcc26417fc4090e5
-
Filesize
870KB
MD523c26c69b9fff2673be37c6d8cfcda62
SHA16511a024d6274d4a987ba1e369ea5afc29ce4ee0
SHA256a1797fd30ef08cc29bbed2c79504cb8694afe5b74a2bf4a1d15450b748acb2a5
SHA5126d72312d67ca72bd6aad2c2adc766b5a1ac7595e3c9c7d135a3a96e33bef59cfab016e6b1a71a114275712f093cb8068466cdbf8b767fce41866bab43bfeb7b7
-
Filesize
1.3MB
MD56eba6c23d507e696ed84a2cd35898e4b
SHA1e09a9cafa4924b493d1ea070d56e5ef3f204807d
SHA256444438d00d69dd836dcdc2825790df2b7fdc3a062053f7ea164b7b1a3c9e97a0
SHA5127ea1632bf80dab466d7b1f4c711112b4823c1ccffe6ce4037590cdcba95a0b19ae172782cdbe8e4fb0e044f44470890ad4a942db072ec6eb08ba71f0e5a94ec0
-
Filesize
1.0MB
MD543f7bf8d32ec578fcb5658c5081f479a
SHA121ac8fee4afcae6ac2d3fe62e6daa44b38df2841
SHA256936ae3f5369aa31de997e364f7325591359b9bcbf11c5bb74083e0ce0343e2ac
SHA51272e2347e942689024aeac54c042e53ad6e807b2100d5c709ab147c128afcc0fb877e93f17d2af1eda15f1164a5425e8ebba4338648d07ef07d3d060abe23f23d
-
Filesize
1.1MB
MD50f293622e3be08c5c4c92f099a2e3b93
SHA16049dd91d8cd9ac85f88013f163f80e2f432f80a
SHA2561af75d5fcc2c1abd6e48a58103648ffc925e4f6e310d01a8e09b57121c156d19
SHA512b163adbc167d87db81f46e293185778a25524770a09a52df954ea2aff86dc8e2226f038be6ec99ce7b3ee98381cef720a51eaa5a79ea75aa34ad74451d59433e
-
Filesize
606KB
MD5585efec1bc1d4d916a4402c9875dff75
SHA1d209613666ccac9d0ddab29a3bc59aa00a0968fa
SHA2562f9984c591a5654434c53e8b4d0c5c187f1fd0bab95247d5c9bc1c0bd60e6232
SHA512b93163cba4601ed999a7a7d1887113792e846c36850c6d84f2d505727dc06524bb959469f9df12928769f4535dc6074a6b3599b788a4844353e466742ce1e770