Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    295s
  • max time network
    305s
  • platform
    windows10-1703_x64
  • resource
    win10-20231215-ja
  • resource tags

    arch:x64arch:x86image:win10-20231215-jalocale:ja-jpos:windows10-1703-x64systemwindows
  • submitted
    14/02/2024, 09:49 UTC

General

  • Target

    batexe.exe

  • Size

    9.4MB

  • MD5

    cdc9eacffc6d2bf43153815043064427

  • SHA1

    d05101f265f6ea87e18793ab0071f5c99edf363f

  • SHA256

    73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72

  • SHA512

    fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6

  • SSDEEP

    196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv

Score
7/10
upx

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 5 IoCs
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\batexe.exe
    "C:\Users\Admin\AppData\Local\Temp\batexe.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3272
    • C:\Users\Admin\AppData\Local\Temp\77C6.tmp\b2e.exe
      "C:\Users\Admin\AppData\Local\Temp\77C6.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\77C6.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3312
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7CA8.tmp\batchfile.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4740
        • C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe
          cpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 3
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4908

Network

  • flag-us
    DNS
    yespower.sea.mine.zpool.ca
    cpuminer-sse2.exe
    Remote address:
    8.8.8.8:53
    Request
    yespower.sea.mine.zpool.ca
    IN A
    Response
    yespower.sea.mine.zpool.ca
    IN A
    198.50.168.213
  • flag-us
    DNS
    213.168.50.198.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    213.168.50.198.in-addr.arpa
    IN PTR
    Response
    213.168.50.198.in-addr.arpa
    IN PTR
    minezpoolca
  • flag-us
    DNS
    23.236.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    23.236.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    23.173.189.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    23.173.189.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    187.178.17.96.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    187.178.17.96.in-addr.arpa
    IN PTR
    Response
    187.178.17.96.in-addr.arpa
    IN PTR
    a96-17-178-187deploystaticakamaitechnologiescom
  • flag-us
    DNS
    240.221.184.93.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    240.221.184.93.in-addr.arpa
    IN PTR
    Response
  • 10.127.0.1:12000
    46 B
    40 B
    1
    1
  • 198.50.168.213:6234
    yespower.sea.mine.zpool.ca
    cpuminer-sse2.exe
    8.5kB
    10.8kB
    90
    91
  • 127.0.0.1:49824
    cpuminer-sse2.exe
  • 127.0.0.1:49826
    cpuminer-sse2.exe
  • 8.8.8.8:53
    yespower.sea.mine.zpool.ca
    dns
    cpuminer-sse2.exe
    72 B
    88 B
    1
    1

    DNS Request

    yespower.sea.mine.zpool.ca

    DNS Response

    198.50.168.213

  • 8.8.8.8:53
    213.168.50.198.in-addr.arpa
    dns
    73 B
    100 B
    1
    1

    DNS Request

    213.168.50.198.in-addr.arpa

  • 8.8.8.8:53
    23.236.111.52.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    23.236.111.52.in-addr.arpa

  • 8.8.8.8:53
    23.173.189.20.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    23.173.189.20.in-addr.arpa

  • 8.8.8.8:53
    187.178.17.96.in-addr.arpa
    dns
    72 B
    137 B
    1
    1

    DNS Request

    187.178.17.96.in-addr.arpa

  • 8.8.8.8:53
    240.221.184.93.in-addr.arpa
    dns
    73 B
    144 B
    1
    1

    DNS Request

    240.221.184.93.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\77C6.tmp\b2e.exe

    Filesize

    1.1MB

    MD5

    c8ddb9a1b99b955d28ce987616dc783a

    SHA1

    6a50a41aac042de84cbe5fe9cfa8ef171c1a15ba

    SHA256

    d42d045c7eaec84a0576fa2d1e67566cd65686605e6f66217c2da6ec9faa060a

    SHA512

    8804aa717bb5d9a88543175afd4ed3363ae6d1ff9846379f9bbfb7ff1b49cf0031fd6b1cbb0b1491a94d1158663021c8bf56c47050f3192b62a0c5bb5499d397

  • C:\Users\Admin\AppData\Local\Temp\77C6.tmp\b2e.exe

    Filesize

    1.4MB

    MD5

    fe4bc2bb4397eea601e0fa6c45cc20c6

    SHA1

    35477fc0a38f9db357a70f9b0573537fca582a9b

    SHA256

    8852fb3a8294753e6b088d458547feaf54685068ed6bc0dece93f608ab44afa7

    SHA512

    3759f54232069d2efba631954ff86bbf5ef58a616e4e0109c9ad5fcd632ee97ddf169ebddbe58237dbee36951c8d2e176312abe4e142f636398bff8fc2973bbf

  • C:\Users\Admin\AppData\Local\Temp\7CA8.tmp\batchfile.bat

    Filesize

    136B

    MD5

    8ea7ac72a10251ecfb42ef4a88bd330a

    SHA1

    c30f6af73a42c0cc89bd20fe95f9159d6f0756c5

    SHA256

    65e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9

    SHA512

    a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0

  • C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe

    Filesize

    2.3MB

    MD5

    4c04147c386ba8792ac6a03069572a8a

    SHA1

    dda67789fc1d0f2469ca95f01a5c81034853ca6a

    SHA256

    c7739a1e940a282703d06eccda7110426d306f390e97fdbbd9df18472fd132cd

    SHA512

    a8b5a0b878a9a7d30cb38feff814e1f4dce24d000158edc10a43ee9a89920bedf7adc92eb7e3913098b6aab7fbd0531f56fc09f508b5c2769992a94e55d153db

  • C:\Users\Admin\AppData\Local\Temp\libcurl-4.dll

    Filesize

    836KB

    MD5

    aeab40ed9a8e627ea7cefc1f5cf9bf7a

    SHA1

    5e2e8ca2881b9bf9edfa3c4fdcec6da1efa102d8

    SHA256

    218cfc4073bab4eddf0de0804f96b204687311e20a9e97994bff54c9b0e01ee9

    SHA512

    c0a67616fa01fdc351015212a718faf70da6612fbb3ec13da28dd7af9a507c56882fb7c3eea6fbc37d4d63b970157199d16d0756dbe3cb3bc2223e215cb104d8

  • C:\Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll

    Filesize

    1.2MB

    MD5

    7cf672bee2afba2dcd0c031ff985958e

    SHA1

    6b82a205db080ffdcb4a4470fce85a14413f3217

    SHA256

    c82f84171b9246d1cac261100b2199789c96c37b03b375f33b2c72afab060b05

    SHA512

    3e90d1c1efe0200cb3cc7b51d04783a3cce8391faa6ce554cff8b23dac60be9f8e4f980a8ac005fd9dff8ea4bdcb02311f7649c5be28eb32dcc26417fc4090e5

  • C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

    Filesize

    9.1MB

    MD5

    37628ab3d96678d193332272ad1e9482

    SHA1

    c51563f4e5c32828d2a264a11598281259f121b5

    SHA256

    bc36a1e33edae7081df567ce21c5434d4b46ae41267372a204d7df8814543e45

    SHA512

    8cdd46892a450b55586bf0151ddb9a49090eddae1b407c2f5e96c6778df56d8ef4807f2ff917a4910acf45f6dc10698c2f934ff74008792a0bce5f72676708ae

  • C:\Users\Admin\AppData\Local\Temp\libwinpthread-1.dll

    Filesize

    606KB

    MD5

    585efec1bc1d4d916a4402c9875dff75

    SHA1

    d209613666ccac9d0ddab29a3bc59aa00a0968fa

    SHA256

    2f9984c591a5654434c53e8b4d0c5c187f1fd0bab95247d5c9bc1c0bd60e6232

    SHA512

    b93163cba4601ed999a7a7d1887113792e846c36850c6d84f2d505727dc06524bb959469f9df12928769f4535dc6074a6b3599b788a4844353e466742ce1e770

  • \Users\Admin\AppData\Local\Temp\libstdc++-6.dll

    Filesize

    10.4MB

    MD5

    7e9acd09fe50274ed18b32b3bdc5fd31

    SHA1

    080d6ad8f2213754c8e7c16c2257bf153030af03

    SHA256

    72a28b1e5a409baab668a46b6ba8957408c903e939de8b51c0cd10c4e17804af

    SHA512

    cee909008faf40775dc4c01f51819001c7da6585e9c6ee0dc508e36d22b1d116ca4a2136c4ab16da62263e72585bae4592fb1f1128d6050b871e31c978720a83

  • \Users\Admin\AppData\Local\Temp\libstdc++-6.dll

    Filesize

    6.4MB

    MD5

    57a75e741d74a678f8db01c1c6b24fae

    SHA1

    8a1ff698ba80f079b5a344ca2deb847b017b7c3e

    SHA256

    779dc03026bb9f5c1c5555a5c10ca95e163a5127ce092992558add4585fa085b

    SHA512

    8296f9d2b82aa0ed7e5bcab47935e6c536d661e2db9a5c44e07c4ed78df13ba2651c3a64a4c0219f7273ea565e1614f50fe15d3e4005a2ce22e625cc527120c0

  • memory/3272-5-0x0000000000400000-0x000000000393A000-memory.dmp

    Filesize

    53.2MB

  • memory/3312-50-0x0000000000400000-0x0000000000405000-memory.dmp

    Filesize

    20KB

  • memory/3312-4-0x0000000000400000-0x0000000000405000-memory.dmp

    Filesize

    20KB

  • memory/4908-40-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/4908-43-0x0000000061440000-0x000000006156B000-memory.dmp

    Filesize

    1.2MB

  • memory/4908-42-0x0000000050210000-0x00000000502A8000-memory.dmp

    Filesize

    608KB

  • memory/4908-44-0x0000000001140000-0x00000000029F5000-memory.dmp

    Filesize

    24.7MB

  • memory/4908-41-0x0000000070800000-0x00000000708BC000-memory.dmp

    Filesize

    752KB

  • memory/4908-51-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/4908-56-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/4908-66-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/4908-71-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/4908-76-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/4908-81-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/4908-91-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.