Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
294s -
max time network
296s -
platform
windows10-1703_x64 -
resource
win10-20231220-ja -
resource tags
arch:x64arch:x86image:win10-20231220-jalocale:ja-jpos:windows10-1703-x64systemwindows -
submitted
14/02/2024, 11:14
Behavioral task
behavioral1
Sample
batexe.exe
Resource
win10-20231220-ja
Behavioral task
behavioral2
Sample
batexe.exe
Resource
win10v2004-20231215-ja
General
-
Target
batexe.exe
-
Size
9.4MB
-
MD5
cdc9eacffc6d2bf43153815043064427
-
SHA1
d05101f265f6ea87e18793ab0071f5c99edf363f
-
SHA256
73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
-
SHA512
fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
-
SSDEEP
196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2136 b2e.exe 4584 cpuminer-sse2.exe -
Loads dropped DLL 5 IoCs
pid Process 4584 cpuminer-sse2.exe 4584 cpuminer-sse2.exe 4584 cpuminer-sse2.exe 4584 cpuminer-sse2.exe 4584 cpuminer-sse2.exe -
resource yara_rule behavioral1/memory/220-4-0x0000000000400000-0x000000000393A000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 220 wrote to memory of 2136 220 batexe.exe 75 PID 220 wrote to memory of 2136 220 batexe.exe 75 PID 220 wrote to memory of 2136 220 batexe.exe 75 PID 2136 wrote to memory of 4724 2136 b2e.exe 77 PID 2136 wrote to memory of 4724 2136 b2e.exe 77 PID 2136 wrote to memory of 4724 2136 b2e.exe 77 PID 4724 wrote to memory of 4584 4724 cmd.exe 79 PID 4724 wrote to memory of 4584 4724 cmd.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\batexe.exe"C:\Users\Admin\AppData\Local\Temp\batexe.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Users\Admin\AppData\Local\Temp\9961.tmp\b2e.exe"C:\Users\Admin\AppData\Local\Temp\9961.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\9961.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\9BF2.tmp\batchfile.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.execpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4584
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
MD5ff327262d6dab722aeb9d7cf0c64cd46
SHA1eccf7a4afaf177a96ccdeed9b06fb3de3736e287
SHA256a2307272b825c5c9c5fe9df70ab9d9f37e75ec1d024c3a176961f2151c4a1628
SHA512846b5cf7d874ae85742a7228338573da89dbb7ba15a4c3fe79ec415bebe20277a611c65716bc2649bfffd36eb0a1bc533b867332e2b0ff668b3a7bf5da51b751
-
Filesize
1.7MB
MD5777590e37f844c16d7b6d1e8466928d3
SHA1ec607aa160a7771ea53244fb55f8e279584b866f
SHA2562c4364599a003ddc0ad9d5d9a91a04de577aea6746f964b2d45b51af179230b3
SHA5121794aeb5cbd6f8f26d9cb5f6297d9dfc608d879c04129a1d5adedefcefa4c3c22d846bc18910963b10d7ad871723aef79fbbc4432176e30f486bdc76c2e19c24
-
Filesize
136B
MD58ea7ac72a10251ecfb42ef4a88bd330a
SHA1c30f6af73a42c0cc89bd20fe95f9159d6f0756c5
SHA25665e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9
SHA512a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0
-
Filesize
208KB
MD5c7d603496599b1859b4cb34a9ff73b76
SHA1f04313a32e9c46698ad7199579ebd80c5e6094e4
SHA256f790092f98fe14cbe65513570fdc05f4763f4b95a75b98755abdd2b98932d618
SHA512086d82048a242ca17bead1870d2e34627e3859c9d92e2dbcd7c52c150e3bf3838a43cc8739c941534f015b9d71c3a5a3ba3b6c26646bf86aec5e40ae17096df7
-
Filesize
179KB
MD5eca183ed72e94df5d0f7d49a1ce2be56
SHA153253617b7234d8af3d0bc200d61d388236d5c7b
SHA256f4932e0fe7d8c94725ec210ff00982526e87acf49bcbab40fb6efd76d1877d20
SHA512059fab95db71a0982db0bd644a5218617097d437aa5a76f62be3875ad556e0b9998b5bc14a5e91644f012787b007839192caccc490546006d8c661da1d5640aa
-
Filesize
149KB
MD57635d4f6569224e241d1262eb987a832
SHA1543e3300747ac247a53c08b8d449c28a57f8448e
SHA256bb56037a9dc2298712acd04aadbb2988941511a7ae23e53669df707e245fcd45
SHA5121923c648f4c53fda55bbc30f954ec7eef99e2f963520fd1e286415e02688e6771d7611a4d9a5ad2e02604e94506d54bb5e4d2ebc12c2a144b3ae5ae096bc0b65
-
Filesize
95KB
MD53329d74797725a37084bca829d0d0ad8
SHA15fbedfe63896dc1d6e1f6230064ae8bbda04d220
SHA25679e7d3864d9b81cbaeb2a4d01776c5d9cf517aa8fefac61c502044fca04ecf78
SHA512237242c716362dab2d5fdc742c1e7a836d5be7d4cbcabbc796a830002c5de7874ed408220bb0e5df421ef68a9d92e540ac74f79664385efe92905f156a72d05b
-
Filesize
183KB
MD514f1199fa2e5023a52cc4105b20cd82a
SHA1795019ae88cae5ba42fc7676d4eafd0a1a54502d
SHA256b0b9dce90de50dbc5478e382d61a565832a562b8132c66237c07b640157becc6
SHA5120b4b3ab1165e20179d15171ccb01239ec8dd8564d52c97cfebdbe58aca8b35438229411800602ff264dc308f4d7fa9389a53dacf23d78d2c83da835b1eef8c8b
-
Filesize
27KB
MD5784788fde139a5bdaa740e98af4caa2e
SHA17aea4ee5785b0639062ecf22364ca2bcc1b2218e
SHA2562ee5da5b05625351344c448985ddcd2ad5de39861f71d7157632960fdbad5a65
SHA5128e11f77eb97fef5a2a17bcccbf925e0bb4b890d6b48dc810f30bbbe30e194e916bf0047665e76d6c93c9dffb0ae8e4120fba340ea6c13250b344f718b6373ea0
-
Filesize
138KB
MD5eb3d2f88d5b9184f85a685ee2af0a65f
SHA10939f5a851cede9d7626c0e0b5510c4e84455c1e
SHA256dacb0c1e1ff2dfc46d714cb1a7338e1bfa8770da08cc99a21a1fb2eecc90680b
SHA5128692cd29cf64e3f5fd90ffa24c2882bd7afb8938036445acf3843917282d91463e0cfb71f40ca36ed414b7158872516b4a60e57827530ae88be937d3bfaa34c2
-
Filesize
69KB
MD52d5e82a67c8f949c74c7eb716a266da5
SHA125ee673c49bc710ee6093bf7751f85aba76510d7
SHA2561856c5641b20806f8fd2eee08ca6b61548e522dc17ac6e6efc99f267d2181ef8
SHA512f7375460901123623d6bbdc4cb9bd9f301679444bc4b673b156c436c93a075d3d7df93ee536e5aa0d07a3c96c4b317233bc2bf91fb204e2f7cd1a2af9ff6d054
-
Filesize
148KB
MD5c24d908a3ccb2988971fa19a4fc69663
SHA1f988826d47fa8f92ef5db73f983762e4d2c6ffc0
SHA256d773f65c87eb490ee795508b72adda526f2a30471fb72a651873e2ada1b60baa
SHA512f9a749ff24956f1cf85475b380b0c41c670d9816233abd5021860bc525b093002e9b8fc9387d43d6150f74719e6c8ca6ac7b4ecc8aa612083b3c5aa6ea7b01a0
-
Filesize
103KB
MD5c1c3decf93185f30cf6530e85cd76233
SHA129a3607797fce026e826437ef06e1918c180a66a
SHA25696dd43e4d42db8e5d09f441d8813c5f71210b78b06b553033da659eccdbfd959
SHA512b64313ca5fc029d18e400eb74afa34676402551f37414e911431439bae9b9ee629a26df21e47de551a06ee50f2e270c7d35495ef3c0b3fc39f2a22bba0a56c96
-
Filesize
118KB
MD575e453a5c41a6e0e5007cf975a92e1cd
SHA13428a0dde2180bcbe31abc9872374f1277b09928
SHA256faf34af68f1a16bf7d227770d03d32a6d69c5e9d118429612ea66ba1e5fc44d9
SHA512370938ef144f5ba2ffc4a6da4623843f67d61fb36aaf0802dd16b4a0e19e089cb50fd29376ced85214eb36023a483caae584cdc3c1ef080835622be29403eebe