Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
295s -
max time network
304s -
platform
windows10-1703_x64 -
resource
win10-20231215-ja -
resource tags
arch:x64arch:x86image:win10-20231215-jalocale:ja-jpos:windows10-1703-x64systemwindows -
submitted
14/02/2024, 16:26
Behavioral task
behavioral1
Sample
batexe.exe
Resource
win10-20231215-ja
Behavioral task
behavioral2
Sample
batexe.exe
Resource
win10v2004-20231222-ja
General
-
Target
batexe.exe
-
Size
9.4MB
-
MD5
cdc9eacffc6d2bf43153815043064427
-
SHA1
d05101f265f6ea87e18793ab0071f5c99edf363f
-
SHA256
73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
-
SHA512
fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
-
SSDEEP
196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 3052 b2e.exe 4296 cpuminer-sse2.exe -
Loads dropped DLL 5 IoCs
pid Process 4296 cpuminer-sse2.exe 4296 cpuminer-sse2.exe 4296 cpuminer-sse2.exe 4296 cpuminer-sse2.exe 4296 cpuminer-sse2.exe -
resource yara_rule behavioral1/memory/1588-5-0x0000000000400000-0x000000000393A000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1588 wrote to memory of 3052 1588 batexe.exe 73 PID 1588 wrote to memory of 3052 1588 batexe.exe 73 PID 1588 wrote to memory of 3052 1588 batexe.exe 73 PID 3052 wrote to memory of 1592 3052 b2e.exe 76 PID 3052 wrote to memory of 1592 3052 b2e.exe 76 PID 3052 wrote to memory of 1592 3052 b2e.exe 76 PID 1592 wrote to memory of 4296 1592 cmd.exe 77 PID 1592 wrote to memory of 4296 1592 cmd.exe 77
Processes
-
C:\Users\Admin\AppData\Local\Temp\batexe.exe"C:\Users\Admin\AppData\Local\Temp\batexe.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\A9CD.tmp\b2e.exe"C:\Users\Admin\AppData\Local\Temp\A9CD.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\A9CD.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ADD4.tmp\batchfile.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.execpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4296
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
500KB
MD558e41dd16b624c4dd0189a5ded94d9fb
SHA18f7e7e747a40cf06800f72e37a47f8ed41b4c382
SHA256528a28b61bdb9637a58b7593f10fc58deee0ba4c420c330bc91851d069e9a9d2
SHA512d627930b619d3610ab8a73a948fe56cc9914b9ff6533a59e79e8d0320f057d7dfc62d1b7ceefac85ed7d43a6ce3ebf789f7f0c6db86b917e5ae68ebc5de3c57f
-
Filesize
1024KB
MD555d3fcf113506e85b6cf485f08b11290
SHA1539d601fdd7e37fe22412d8c73023e21293ac62c
SHA256519083ea4de496637895b9c3dd7fa5d9fc1140325272570f09aa0d2bad46f2d3
SHA51262c0dc6a36ef819eede73c8b041fbdf579ec0ae399654a73a4628555bb84c4e1fdcf314deb659f41986204e2d92acd886dd8735a24a150a309d4035b58a33ee4
-
Filesize
136B
MD58ea7ac72a10251ecfb42ef4a88bd330a
SHA1c30f6af73a42c0cc89bd20fe95f9159d6f0756c5
SHA25665e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9
SHA512a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0
-
Filesize
367KB
MD532e8c5dc88bcad74fe435a6d9effe266
SHA13790cf238d247de3aa619ce22e4bc9108b547695
SHA2564fe8b825971cbf4a9a0fe500788896f91cf81bc29c02efbeed4d3495558b6441
SHA512407d2359d2868f6b1f18d08f1a58fa0140e2f59580b1fe3d546386b80049443a011a7dca523d35f490d32e78730827f43b69a391df271f7855cb6f73f4c4ab83
-
Filesize
500KB
MD5dc4f2651bc8b1801415ebcaaf236546a
SHA1ba76c0098dc22d46710364f960c047a2fded9d00
SHA25652b73f3f1cab59701f6676c27fa6de168c6ba4fda444805dd80a9f4848e4d668
SHA5121658e5da5d7bba40eb017741d76380d44fdd83296ce59557eeb941609ccd8c007c11281dd54882b8d788dfdf359a7dff2553c5f2a2eb3ab81ac7a57f82535fb8
-
Filesize
291KB
MD53dd0596d0d5900a3688a7900148198d1
SHA116245a3d5bc9013017346ba6a4efd4f9f5e24783
SHA256475b71c62622cf5cde63e5c8d03aff8eb27ad75ff7c5565080c749a73c7c988e
SHA51216c589023967375d6d6ab30d1dbd1fee84262890dd6dda58223c5868138003d756658ba492ff0b0235e174b529d7d88e0cf3fa1628003994d281f3298c86dfe2
-
Filesize
613KB
MD501a872e599ef1852a79058234635a47b
SHA1de96a29b9ea16e359c3b5f70132fd1d743d9fe1b
SHA25658e21bf23e6f725c3f1b9d09e5ddbabbe2a5cd24f9ff2f1294595f8864098476
SHA512984f633b3a0f2cae6c9d51888988bff4ddb07bc275580d261fda9bff8f06d4bb7d938ecd098972e5e5dbc1f77d14568288a8171e156cae2cbcc1c60a96b7496f
-
Filesize
411KB
MD5332581596c7f70482ff8b35feff0f474
SHA12d3ec11426cc761df57a6a1d05e05b8d37a59988
SHA256ee52ef2744deaf6358b0bb3e979747aa4bc636adc0eda210b9a4effa21c797c6
SHA512bff241f820167f133ef0b171910dc4b5278e7909bf28e22f16d877a48bc8036cafdeccc9f6be6a4b9afca9d2d86e02563b490cbab92fe8c98812df34b1855b33
-
Filesize
311KB
MD587d486006cf612a54c0d0f3e5e92c11e
SHA1fdfae4d44dd889880567631bcf64aab7000d74b9
SHA25627e46c5fa3db5184ace8ab03a2ab92fbdf6046bfea265838a22a362edabddce8
SHA5120e155b64e6a43a1713ecc212bc5e00bf4bfd5f618bfb1e73f64b3ddb434d60a29bf46b32358e53ed8c63abd3649fae6dca2962d194f26af019beb4650c211d3c
-
Filesize
397KB
MD5561ba001e04193f4c77eefda8475b930
SHA189f61e0cdef26a6ee7a1688ac7d78ae341d481df
SHA25668306d21f9060c6b7b9c7ff6c5e561d86d49c6af8eebe94078b9da7cabd0d9b3
SHA512d5b899442e7ca09f3cfcc4a7a73ee4643f21d0f5de7459b0b1322a18baa20f29019acdf9c1f3f3ecb4ea83e944be5106e9da0625f39071ffa5974738cf84141d
-
Filesize
419KB
MD5ced76636ec6b122f743e2a72b139d85d
SHA11b4a688082ebde831e60451742716078b8476c67
SHA256e6b876538e82d3909d87ab00428e670249a2c9dcecb4da29a7f4a9576151f179
SHA512d26a1ac9c68b23206fb282985ddac9bd83d946904203756935eeeca51433d2c20f70eba7b83cbc91a938e6eb8d78f204a21c3d035ca9437690d6728a7eecbd25
-
Filesize
366KB
MD50dfaf234aa2b1d86c8cf6675be3d8f48
SHA1ca6dcf8ce5e4ec954c3e513eef85ff79c285b5ec
SHA256cc3d5afee5f5c7478b9dd54384d6cbff061b4bcc252f696d666cdad129ab46fa
SHA5125bf7b02a7beba0f19b7c18db99f85061508a20a60cebb7792032294a3413b8ff28db973480704c0821b4156c5e426c0f6a5c63d2950631a9dcdcbfd7f2217d5d
-
Filesize
444KB
MD5aed1a1e3329bc2b286318eff5206965c
SHA1af7b3de949eaaa32b14b2959c60a6fb6bc890ce4
SHA2562927f33ef83a417ed434affc3662dfd44595cf69c127dbae0234d01bb8f876c3
SHA512d12f4a606ec78e8f36d2be0b9b38100029246db02f81a281c4dbeb50be652fbcb34fb8c829e4d168328efdee3dcbcfe7434561f3dbdbd686dad6bc275936421d
-
Filesize
338KB
MD51c34fb94253f81ce9b0d2fb82ed70fdd
SHA18b2c51cdaa29c256770c47c9e850e692a1b7c1e9
SHA2565e446b9ca6971310fe10d3f3396cc040dd92346322ffab6680068a600f84faba
SHA5123a8486c7f7d2982caef1ccb7cea641085749837a71ab8d8d0a8e42344eb7467fa28615d062f7e761f85dd0e22a4c7a9c4207a143db44822706403c6d93e174bd