Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
291s -
max time network
301s -
platform
windows10-1703_x64 -
resource
win10-20231215-ja -
resource tags
arch:x64arch:x86image:win10-20231215-jalocale:ja-jpos:windows10-1703-x64systemwindows -
submitted
14/02/2024, 08:14
Behavioral task
behavioral1
Sample
batexe.exe
Resource
win10-20231215-ja
Behavioral task
behavioral2
Sample
batexe.exe
Resource
win10v2004-20231215-ja
General
-
Target
batexe.exe
-
Size
9.4MB
-
MD5
cdc9eacffc6d2bf43153815043064427
-
SHA1
d05101f265f6ea87e18793ab0071f5c99edf363f
-
SHA256
73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
-
SHA512
fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
-
SSDEEP
196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 376 b2e.exe 3652 cpuminer-sse2.exe -
Loads dropped DLL 5 IoCs
pid Process 3652 cpuminer-sse2.exe 3652 cpuminer-sse2.exe 3652 cpuminer-sse2.exe 3652 cpuminer-sse2.exe 3652 cpuminer-sse2.exe -
resource yara_rule behavioral1/memory/4784-5-0x0000000000400000-0x000000000393A000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4784 wrote to memory of 376 4784 batexe.exe 73 PID 4784 wrote to memory of 376 4784 batexe.exe 73 PID 4784 wrote to memory of 376 4784 batexe.exe 73 PID 376 wrote to memory of 4556 376 b2e.exe 74 PID 376 wrote to memory of 4556 376 b2e.exe 74 PID 376 wrote to memory of 4556 376 b2e.exe 74 PID 4556 wrote to memory of 3652 4556 cmd.exe 77 PID 4556 wrote to memory of 3652 4556 cmd.exe 77
Processes
-
C:\Users\Admin\AppData\Local\Temp\batexe.exe"C:\Users\Admin\AppData\Local\Temp\batexe.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\AC0F.tmp\b2e.exe"C:\Users\Admin\AppData\Local\Temp\AC0F.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\AC0F.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\B14E.tmp\batchfile.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.execpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3652
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
950KB
MD51b8c11d658b5dce94eda26b651d942cc
SHA10e5f6808af311600b9305f8126634045e728c195
SHA25600082c273d12a9b597bacaf9b417231305b68d90c534d6609e77df48eb67b317
SHA512769804f5162cfed56b911ff1f478c0dd811662e17b69fcacdb15f038463a02d778c9acd18eb297ed83f3c44ac096b2e0206212aff33a8da335367e8ba633147d
-
Filesize
128KB
MD5272c54a9b6cdfa558e23cc257343048a
SHA17f26d86cf2a3625ce3e70c9cfc9b0cc075b8d5aa
SHA2561d7e7ea2934d091cb7ab81c31e31b4015e05a9f86b213f9d78b0297c88fb3415
SHA5125139de29262ba7091e5ab0529232912aea9ca34fdeb16165021d3ccaba1d351abc59f2130eaa6af8c3c0510db5f649095f7043ea837267dc9eb4ce0169fa18ba
-
Filesize
136B
MD58ea7ac72a10251ecfb42ef4a88bd330a
SHA1c30f6af73a42c0cc89bd20fe95f9159d6f0756c5
SHA25665e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9
SHA512a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0
-
Filesize
2.3MB
MD54c04147c386ba8792ac6a03069572a8a
SHA1dda67789fc1d0f2469ca95f01a5c81034853ca6a
SHA256c7739a1e940a282703d06eccda7110426d306f390e97fdbbd9df18472fd132cd
SHA512a8b5a0b878a9a7d30cb38feff814e1f4dce24d000158edc10a43ee9a89920bedf7adc92eb7e3913098b6aab7fbd0531f56fc09f508b5c2769992a94e55d153db
-
Filesize
64KB
MD5e7317a0a343dc63f3fa3bf9ca6e93ff0
SHA10d48881feb76cf81fc46614bebfa3c134cada128
SHA256277a43f17ccc4f0fba87c710212de61a41383bcb94410fa093b50ebd50347a63
SHA51284ef51472db00cd4e90df3062a3cbc29a994c5cf470e54300d4a2f103ba8fb8279ec87b0561625ea1bccd80a7ad664c63457831b4eb919a7608099430b98a3d9
-
Filesize
1.2MB
MD57cf672bee2afba2dcd0c031ff985958e
SHA16b82a205db080ffdcb4a4470fce85a14413f3217
SHA256c82f84171b9246d1cac261100b2199789c96c37b03b375f33b2c72afab060b05
SHA5123e90d1c1efe0200cb3cc7b51d04783a3cce8391faa6ce554cff8b23dac60be9f8e4f980a8ac005fd9dff8ea4bdcb02311f7649c5be28eb32dcc26417fc4090e5
-
Filesize
9.8MB
MD5a755fe04efd52e017eebd17f04d00626
SHA13f54902c02c058685ecacaa3aae9d1631437dec0
SHA256179f5ab9ae1fc5d832306347b69ffec281d2ce9964b1acca3568bd5f63dc69f2
SHA51251ee98b6d7f1787feda7772c811de37ba8b59bb6d81917eb3dcf8b56f655042fe2585809edac730c35a85c6a71d3e944966661a5671b3cd032679435450f4a7c
-
Filesize
64KB
MD56cccf65bd7d7ff5b53aeb882e15c462c
SHA1a9822b63ad70c6085ed1deda0fbe4bc5fe555f3d
SHA2561379cd6111c2c37cf16f2dd9b325118513e85c35543ba45e79deb504dd4c01d2
SHA512c174b5f8615131c2b86c57aee166744ee1fe02ff7c916195f2fde06684f467545a3fa4f88083335e2045d12727d774279dc8672ec352de3095b729aa5d1dedcb
-
Filesize
320KB
MD5c911df8bf8c66277e14360319b0b93b7
SHA1598c59c0e7cbecb788ee676db218dc0faaa39bdc
SHA2564c53941f04ddeae2179047a1c7f8c7f7f46af0f08c424ab66d61f2316f2ee77d
SHA51213aeae87ee52f22d1c928c99c66e116254cde630c09f90b146962fa61276af13fef653b7a66184d00d614f0379750e641c2e62326ebb5588ca632e56c935d77c
-
Filesize
448KB
MD58185100383d0fe360c9198e5a883b08d
SHA1ab398c469573f8e84d3cfcef01287a0604d6ab5f
SHA25605ef7288b0d559bf67c3d69c201da9bdcaed0b49ecc538640f7b96c5b82eb538
SHA51224930ef0caa1f2db2ed60f7dfdb832a172cf7747b0a336b051f73c0087a5f2fabff721487cb49cf5a3bc2be5426554b0a3a0e51541b6a4ca735646af24f1404a
-
Filesize
5.3MB
MD5e20443f31a4f32d4fc054241b8970f10
SHA11111e0670976ee70c92032babf696faf7d1b9dde
SHA256b9e3121dd765551bee5e2bded58c8d69cce72f36257737e78645a17a8d2235ef
SHA512c49aeaab7583c07a1f47997e94f7a152a3e45bc540dcee105e793d94bbe25f7652ed80492b9ad098040157b25b9fff91c69f3cf797d8a4062717a616ce72f95a
-
Filesize
14KB
MD55c37dcf3e37dbc99177c5bcf977be61c
SHA144b8d5a15e30792b04ebbcd38b18779b66b5c07e
SHA25629d05cc85bfba5e047fa07d67fd4832259ed2cd8e651e1d0719d6d1fe4ab1c5c
SHA5127653829956b1e040b59d78d1b8d3efae81a65c906be1a5538d0ec6167af3fce5f0cfeaa506290d3ab23d192ff971a408c5b4a74736c83ba3ee9e6faa6b611d7d
-
Filesize
14KB
MD557bc28e77ba7f02252d5d1c6ebeb7e33
SHA103d31966e052d14ff5f92d69ceacf8fc886e003c
SHA256094b3dcb3308d87ee8c065d27dc1e0ee818c68d37312bdbc03af9c88f20914aa
SHA512c11bdf493da9bac705cf4d31330ad4bfe2e93c5aa6c0812c47906645e441981880cd651ab20b53e0e9770053d8e3b5a7acdd515ec74f6e16a8c2cdccf49229d4