Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
295s -
max time network
302s -
platform
windows10-1703_x64 -
resource
win10-20231215-ja -
resource tags
arch:x64arch:x86image:win10-20231215-jalocale:ja-jpos:windows10-1703-x64systemwindows -
submitted
13/02/2024, 18:38
Behavioral task
behavioral1
Sample
batexe.exe
Resource
win10-20231215-ja
Behavioral task
behavioral2
Sample
batexe.exe
Resource
win10v2004-20231222-ja
General
-
Target
batexe.exe
-
Size
9.4MB
-
MD5
cdc9eacffc6d2bf43153815043064427
-
SHA1
d05101f265f6ea87e18793ab0071f5c99edf363f
-
SHA256
73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
-
SHA512
fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
-
SSDEEP
196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 4828 b2e.exe 2324 cpuminer-sse2.exe -
Loads dropped DLL 5 IoCs
pid Process 2324 cpuminer-sse2.exe 2324 cpuminer-sse2.exe 2324 cpuminer-sse2.exe 2324 cpuminer-sse2.exe 2324 cpuminer-sse2.exe -
resource yara_rule behavioral1/memory/4200-6-0x0000000000400000-0x000000000393A000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4200 wrote to memory of 4828 4200 batexe.exe 74 PID 4200 wrote to memory of 4828 4200 batexe.exe 74 PID 4200 wrote to memory of 4828 4200 batexe.exe 74 PID 4828 wrote to memory of 2692 4828 b2e.exe 75 PID 4828 wrote to memory of 2692 4828 b2e.exe 75 PID 4828 wrote to memory of 2692 4828 b2e.exe 75 PID 2692 wrote to memory of 2324 2692 cmd.exe 78 PID 2692 wrote to memory of 2324 2692 cmd.exe 78
Processes
-
C:\Users\Admin\AppData\Local\Temp\batexe.exe"C:\Users\Admin\AppData\Local\Temp\batexe.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\12A8.tmp\b2e.exe"C:\Users\Admin\AppData\Local\Temp\12A8.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\12A8.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\1884.tmp\batchfile.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.execpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2324
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD58dd82e4327456b2bfab3bd6ad0fb2972
SHA1317813472e8610c7b9d652439f69646327cdaa4f
SHA256f3c2e8100ce012851007ff561bc1727ddaac9e209d7ea9c5fb88f9002de7df03
SHA51276225cd4de6e88b0e7e0af7f17bfa985d5794e4c5a5cb6f18f3341124f7ef36d8a2be321f631b302c613d8b3a19f6059867bafbd3f0c4f3734762bd8bf5d29d7
-
Filesize
2.2MB
MD527ff08d7b8957e322178a11a4b74230b
SHA14d20118b8862a3a00ee42881d1c8f9e16a6dbd3f
SHA256beea1d0a0c9d07bc25ad119ab2c3336a2a81bec384de6e4f8b3603ff143f8b36
SHA512149c43f4a908e924fd0ebf8d59aaf12478175f00fa57001aad4b7c74d12f3c5025c469f840c1e6623a1468fabc4e570df7846226dc35d3c27fadb1409b32f083
-
Filesize
136B
MD58ea7ac72a10251ecfb42ef4a88bd330a
SHA1c30f6af73a42c0cc89bd20fe95f9159d6f0756c5
SHA25665e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9
SHA512a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0
-
Filesize
1.1MB
MD57c2c36461f846a19f85f5f9fcecc5d1e
SHA1042bcb991d3c36c88674e2632f7567a16675c30e
SHA2563d9c8790d3f42a724849740a382b3d906f6b0fb71f8421b1897cd5582b8b4544
SHA5124d1860d75db9b491068206b9545454ae315179a254a7126b6785dd152e9a23824a91f5d7767519931c29b436def1c5f27c82114f10e57148e7e3f7a07676c7dd
-
Filesize
972KB
MD55958ca1d5a5e908ab92d939f3542c0ae
SHA17f5d0a09cf10278255e6187c09f8cc51ad5f7720
SHA256a24f0a54d18d64f9a201a534f06faf20307aeca58eaf0a4441f65e4a5111a2e2
SHA512a6a4a737e4d7756012d4f35c8fc5131e32b9b1caf70a3c88e2b54a1e4ba8cfb72edf4eb63f836c750e908c4b9056be109852868a6bccf603b4243a8de70c93dc
-
Filesize
836KB
MD5aeab40ed9a8e627ea7cefc1f5cf9bf7a
SHA15e2e8ca2881b9bf9edfa3c4fdcec6da1efa102d8
SHA256218cfc4073bab4eddf0de0804f96b204687311e20a9e97994bff54c9b0e01ee9
SHA512c0a67616fa01fdc351015212a718faf70da6612fbb3ec13da28dd7af9a507c56882fb7c3eea6fbc37d4d63b970157199d16d0756dbe3cb3bc2223e215cb104d8
-
Filesize
804KB
MD58164bed5d9d7f25f41604eef0e9f3f19
SHA105f01b3af37efe0d1e5c9aceb804e488ca0c7b61
SHA2567b6f6abc4f26cc32799d8386c7435eab5adeea61c7512097bf4a4a06d15b2152
SHA512120a41f48df61b8b2299e61a5bf329d8c813125ae69c2bf4c94b64f7495a6503f9fb8d854becaab098794b94d11a5d1cc0b6d54b7a1c4b87699f8dd2712ac71f
-
Filesize
267KB
MD56b2df9280f9304bf0c4680bedbddf1cf
SHA1abd25bc9f86aa20c52bf0a8d22878cb13d5fbddc
SHA25651c5549d86a9af7331d0e133d94e7156cc12386d4b86671f7aeddf7e69182a43
SHA512075f2dc331bf058595badf02925090538235e319750f29de7a76e287f4e4e74189b0b146ac3dfb8cfdeea4e2c1e02a1aeecf49907a25948dabbade8bcbd60749
-
Filesize
606KB
MD5585efec1bc1d4d916a4402c9875dff75
SHA1d209613666ccac9d0ddab29a3bc59aa00a0968fa
SHA2562f9984c591a5654434c53e8b4d0c5c187f1fd0bab95247d5c9bc1c0bd60e6232
SHA512b93163cba4601ed999a7a7d1887113792e846c36850c6d84f2d505727dc06524bb959469f9df12928769f4535dc6074a6b3599b788a4844353e466742ce1e770
-
Filesize
744KB
MD554382237761ee03ed066e146ddd55bca
SHA19959ba81cbca3617f60f0c82e4572de2ed2e9920
SHA25673b09e566e2dd844f23a130e91210a31df7ba9c8541eaac816253ac29b291095
SHA512465b7972a7e9f360353ec797c335f7149afd7df45e88117e5384029ff6391530ba53a6632510d2ee75fc0979d70c55f813def4908dc23a78be7b122ed7e30018
-
Filesize
645KB
MD51fad81d56acbe543f2f282b0f8c8781f
SHA1400fd4f94c2386fa752bdf18db822aaa2da7f7b1
SHA25672f403945e5d7c16a51d5027e73bc1ee107426decf1eada4bafeaf20fb661c71
SHA512cba6290a304533eb5a6e5e422b945c86b00a49185e7c8457c655156500fa6563ddc36d021334504fca0936aec5922baf3653ef369ebdbaedc56e11eb7b11c844
-
Filesize
656KB
MD5d8909168e058c9bfbbb69aa2fb49a97e
SHA1606b40d4eb229467ca9b4e84bbfcbe905ffe787e
SHA256324f03489fb03d7addc68e108f59f0e956dd9a23b31430d00786cc66c3beb93b
SHA5129814e1a2448e97a98966f8236e7b3d1c78d71b006c8c641e5177b8574a4e6816ead1ed142ad687fc14de03a97da92682df791ed354070f75bfaacbf1cab691c5
-
Filesize
879KB
MD5162e9a6256398d8725ff571fa9ea5282
SHA13b8d8f58c5f0fbe1fd2c56272bcaf055e51bcabe
SHA256c4d47ed4d2c9dd016a23b7390ab9d4a3eae5cff5bdd27d951dae2f2468220930
SHA512bab3075d0ba0be9dd3379cfee166b3e6ea2542b293a133bb2a58ded72ab87be3fa56667f551489732e000a0415441ec402ad527e8380ec61c674833a45616c4e