Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    293s
  • max time network
    295s
  • platform
    windows10-1703_x64
  • resource
    win10-20240214-ja
  • resource tags

    arch:x64arch:x86image:win10-20240214-jalocale:ja-jpos:windows10-1703-x64systemwindows
  • submitted
    17/02/2024, 09:12 UTC

General

  • Target

    batexe.exe

  • Size

    9.4MB

  • MD5

    cdc9eacffc6d2bf43153815043064427

  • SHA1

    d05101f265f6ea87e18793ab0071f5c99edf363f

  • SHA256

    73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72

  • SHA512

    fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6

  • SSDEEP

    196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv

Score
7/10
upx

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 5 IoCs
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\batexe.exe
    "C:\Users\Admin\AppData\Local\Temp\batexe.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4020
    • C:\Users\Admin\AppData\Local\Temp\94DD.tmp\b2e.exe
      "C:\Users\Admin\AppData\Local\Temp\94DD.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\94DD.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3444
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\96A2.tmp\batchfile.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3400
        • C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe
          cpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 3
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:428

Network

  • flag-us
    DNS
    yespower.sea.mine.zpool.ca
    cpuminer-sse2.exe
    Remote address:
    8.8.8.8:53
    Request
    yespower.sea.mine.zpool.ca
    IN A
    Response
    yespower.sea.mine.zpool.ca
    IN A
    198.50.168.213
  • flag-us
    DNS
    213.168.50.198.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    213.168.50.198.in-addr.arpa
    IN PTR
    Response
    213.168.50.198.in-addr.arpa
    IN PTR
    minezpoolca
  • flag-us
    DNS
    11.227.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    11.227.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    168.253.116.51.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    168.253.116.51.in-addr.arpa
    IN PTR
    Response
  • 10.127.0.1:12000
    46 B
    40 B
    1
    1
  • 198.50.168.213:6234
    yespower.sea.mine.zpool.ca
    cpuminer-sse2.exe
    8.0kB
    7.5kB
    81
    83
  • 10.127.0.1:12000
    46 B
    416 B
    1
    1
  • 127.0.0.1:49818
    cpuminer-sse2.exe
  • 127.0.0.1:49820
    cpuminer-sse2.exe
  • 8.8.8.8:53
    yespower.sea.mine.zpool.ca
    dns
    cpuminer-sse2.exe
    72 B
    88 B
    1
    1

    DNS Request

    yespower.sea.mine.zpool.ca

    DNS Response

    198.50.168.213

  • 8.8.8.8:53
    213.168.50.198.in-addr.arpa
    dns
    73 B
    100 B
    1
    1

    DNS Request

    213.168.50.198.in-addr.arpa

  • 8.8.8.8:53
    11.227.111.52.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    11.227.111.52.in-addr.arpa

  • 8.8.8.8:53
    168.253.116.51.in-addr.arpa
    dns
    73 B
    159 B
    1
    1

    DNS Request

    168.253.116.51.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\94DD.tmp\b2e.exe

    Filesize

    20.4MB

    MD5

    77ba81cd89087f326b747fbd27b0924c

    SHA1

    bb8e5a4129385743f5cfdbfbf84fe6e1ade80116

    SHA256

    52a511650bc8cb511cc73e8a6e67c279a58897774be36eabdc00a3ed46d5bbe0

    SHA512

    2241e0e0e80d725c6a2b6ca35fb0e9eac2895143a10488203db0e82b91cb4444fe2edcc4d010a8fdc069c5b21d560e327064bc04e661e3df184b43db5ff975d2

  • C:\Users\Admin\AppData\Local\Temp\94DD.tmp\b2e.exe

    Filesize

    10.3MB

    MD5

    4f65746c5155649200369e0bb0d744a4

    SHA1

    6c845da6c8d584aacc6f83bb97fd7110e22450fb

    SHA256

    110537d50246e0bba7ffd6e8df34c7fdf3f3a9b8ada51be535b1502df4d20efb

    SHA512

    44af6588ab1eca0ada4584dc51f5604f9656097bd52ba59bfde5604c3a57735e9dba28a0943564c2069482a764f264dfcb162b90c21c6e2fa267144d099dadca

  • C:\Users\Admin\AppData\Local\Temp\96A2.tmp\batchfile.bat

    Filesize

    136B

    MD5

    8ea7ac72a10251ecfb42ef4a88bd330a

    SHA1

    c30f6af73a42c0cc89bd20fe95f9159d6f0756c5

    SHA256

    65e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9

    SHA512

    a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0

  • C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe

    Filesize

    2.3MB

    MD5

    4c04147c386ba8792ac6a03069572a8a

    SHA1

    dda67789fc1d0f2469ca95f01a5c81034853ca6a

    SHA256

    c7739a1e940a282703d06eccda7110426d306f390e97fdbbd9df18472fd132cd

    SHA512

    a8b5a0b878a9a7d30cb38feff814e1f4dce24d000158edc10a43ee9a89920bedf7adc92eb7e3913098b6aab7fbd0531f56fc09f508b5c2769992a94e55d153db

  • C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

    Filesize

    1.8MB

    MD5

    1e63aeff640440bf986d13d8b0c48810

    SHA1

    091da435ab5ef9374e6f7f2e514e0ce36acb24d7

    SHA256

    1635faa381d14b7b59a378cf8cd31667cb0ad8ee1ef10028148fb9ad06e5afc2

    SHA512

    fbc59b1d7de68be3dcd528702bbb5a2a4c9afa718d90c25805c971f4163ad0c4930e55be86bab72a3f1ca2644d9d6cf92dbbb9e85f767c5fa887530675826a89

  • C:\Users\Admin\AppData\Local\Temp\libwinpthread-1.dll

    Filesize

    606KB

    MD5

    585efec1bc1d4d916a4402c9875dff75

    SHA1

    d209613666ccac9d0ddab29a3bc59aa00a0968fa

    SHA256

    2f9984c591a5654434c53e8b4d0c5c187f1fd0bab95247d5c9bc1c0bd60e6232

    SHA512

    b93163cba4601ed999a7a7d1887113792e846c36850c6d84f2d505727dc06524bb959469f9df12928769f4535dc6074a6b3599b788a4844353e466742ce1e770

  • \Users\Admin\AppData\Local\Temp\libcurl-4.dll

    Filesize

    836KB

    MD5

    aeab40ed9a8e627ea7cefc1f5cf9bf7a

    SHA1

    5e2e8ca2881b9bf9edfa3c4fdcec6da1efa102d8

    SHA256

    218cfc4073bab4eddf0de0804f96b204687311e20a9e97994bff54c9b0e01ee9

    SHA512

    c0a67616fa01fdc351015212a718faf70da6612fbb3ec13da28dd7af9a507c56882fb7c3eea6fbc37d4d63b970157199d16d0756dbe3cb3bc2223e215cb104d8

  • \Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll

    Filesize

    1.2MB

    MD5

    7cf672bee2afba2dcd0c031ff985958e

    SHA1

    6b82a205db080ffdcb4a4470fce85a14413f3217

    SHA256

    c82f84171b9246d1cac261100b2199789c96c37b03b375f33b2c72afab060b05

    SHA512

    3e90d1c1efe0200cb3cc7b51d04783a3cce8391faa6ce554cff8b23dac60be9f8e4f980a8ac005fd9dff8ea4bdcb02311f7649c5be28eb32dcc26417fc4090e5

  • \Users\Admin\AppData\Local\Temp\libstdc++-6.dll

    Filesize

    2.4MB

    MD5

    0e082edf0ae64005a62f8720b1578d08

    SHA1

    ac302cae9180f6d53e39d7e110cc6e6990966963

    SHA256

    c3a06b2bd55646433aaaf90b94c27c9b1cd4d30fa4b85afed3dd2fb834b1dbdd

    SHA512

    a13a727b822d5d22abd95942bf760cb627b9ec415110273f874556af546d8fa006a64df2e5266dbba1c64f29c0ecc6a0b55d95b002d4ec0df247bd083027c7da

  • \Users\Admin\AppData\Local\Temp\libstdc++-6.dll

    Filesize

    2.3MB

    MD5

    260a31c87da8229bd4423a62f74a5386

    SHA1

    0d1853267cde9837e9b8b40666f217ae87e5509d

    SHA256

    9b3ef50f9bfed7c79641978c0e9379949dfb30a76c2f3cedb78461066a439bc2

    SHA512

    015386dfed23fd44bb0e89966cfcd1f14a4b64e580ebf10c1f2916816ea2421b9ac1643712153d9652821abe5da770d83d372e7f2a9510dc6cc50b497afda708

  • memory/428-42-0x0000000061440000-0x000000006156B000-memory.dmp

    Filesize

    1.2MB

  • memory/428-56-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/428-40-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/428-41-0x0000000070800000-0x00000000708BC000-memory.dmp

    Filesize

    752KB

  • memory/428-101-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/428-43-0x0000000074ED0000-0x0000000074F68000-memory.dmp

    Filesize

    608KB

  • memory/428-44-0x0000000000E10000-0x00000000026C5000-memory.dmp

    Filesize

    24.7MB

  • memory/428-96-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/428-51-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/428-91-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/428-66-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/428-71-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/428-76-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/428-81-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/428-86-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/3444-50-0x0000000000400000-0x0000000000405000-memory.dmp

    Filesize

    20KB

  • memory/3444-4-0x0000000000400000-0x0000000000405000-memory.dmp

    Filesize

    20KB

  • memory/4020-6-0x0000000000400000-0x000000000393A000-memory.dmp

    Filesize

    53.2MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.