Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    299s
  • max time network
    296s
  • platform
    windows10-1703_x64
  • resource
    win10-20240214-ja
  • resource tags

    arch:x64arch:x86image:win10-20240214-jalocale:ja-jpos:windows10-1703-x64systemwindows
  • submitted
    17/02/2024, 10:55 UTC

General

  • Target

    batexe.exe

  • Size

    9.4MB

  • MD5

    cdc9eacffc6d2bf43153815043064427

  • SHA1

    d05101f265f6ea87e18793ab0071f5c99edf363f

  • SHA256

    73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72

  • SHA512

    fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6

  • SSDEEP

    196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv

Score
7/10
upx

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 5 IoCs
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\batexe.exe
    "C:\Users\Admin\AppData\Local\Temp\batexe.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:212
    • C:\Users\Admin\AppData\Local\Temp\BBFD.tmp\b2e.exe
      "C:\Users\Admin\AppData\Local\Temp\BBFD.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\BBFD.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1224
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BDF1.tmp\batchfile.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5112
        • C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe
          cpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 3
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2312

Network

  • flag-us
    DNS
    yespower.sea.mine.zpool.ca
    cpuminer-sse2.exe
    Remote address:
    8.8.8.8:53
    Request
    yespower.sea.mine.zpool.ca
    IN A
    Response
    yespower.sea.mine.zpool.ca
    IN A
    198.50.168.213
  • flag-us
    DNS
    213.168.50.198.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    213.168.50.198.in-addr.arpa
    IN PTR
    Response
    213.168.50.198.in-addr.arpa
    IN PTR
    minezpoolca
  • flag-us
    DNS
    22.236.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    22.236.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    170.117.168.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    170.117.168.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    180.178.17.96.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    180.178.17.96.in-addr.arpa
    IN PTR
    Response
    180.178.17.96.in-addr.arpa
    IN PTR
    a96-17-178-180deploystaticakamaitechnologiescom
  • 10.127.0.1:12000
    46 B
    40 B
    1
    1
  • 198.50.168.213:6234
    yespower.sea.mine.zpool.ca
    cpuminer-sse2.exe
    9.0kB
    10.5kB
    90
    92
  • 127.0.0.1:49819
    cpuminer-sse2.exe
  • 127.0.0.1:49821
    cpuminer-sse2.exe
  • 8.8.8.8:53
    yespower.sea.mine.zpool.ca
    dns
    cpuminer-sse2.exe
    72 B
    88 B
    1
    1

    DNS Request

    yespower.sea.mine.zpool.ca

    DNS Response

    198.50.168.213

  • 8.8.8.8:53
    213.168.50.198.in-addr.arpa
    dns
    73 B
    100 B
    1
    1

    DNS Request

    213.168.50.198.in-addr.arpa

  • 8.8.8.8:53
    22.236.111.52.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    22.236.111.52.in-addr.arpa

  • 8.8.8.8:53
    170.117.168.52.in-addr.arpa
    dns
    73 B
    147 B
    1
    1

    DNS Request

    170.117.168.52.in-addr.arpa

  • 8.8.8.8:53
    180.178.17.96.in-addr.arpa
    dns
    72 B
    137 B
    1
    1

    DNS Request

    180.178.17.96.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\BBFD.tmp\b2e.exe

    Filesize

    11.4MB

    MD5

    c0bfb54fda3a07b1b9cec91a9aee1195

    SHA1

    5d036120a965d946b386e7396456a5f40795a9a4

    SHA256

    f2ac6bc4a217461393927d7df0b46c0d957133de2556d06996eea3d78d13e9dd

    SHA512

    4430dd2285e79ba0071db51e90aa5540f8f5d83fe77068a16abfe540dc467c258fd44f3d15e97fefea4675c8115c57a438eec5b4caf774b5a7854364b039fed1

  • C:\Users\Admin\AppData\Local\Temp\BBFD.tmp\b2e.exe

    Filesize

    14.7MB

    MD5

    759824068d42e5538499019b9fb2775e

    SHA1

    5918acd8149cb3f0c49125bd975cb7db7b5b964c

    SHA256

    77b1e8343bdd71e4d20c8448c49828afd717d642ee4cce89f8a2c135878bec02

    SHA512

    6bd2a2c310859a786b01bbb46e753f3198a40f9eefe60652a481fbd7c263993e63431f917cd02e7d0f75a9132911b6753dadbf63770a7cff55feffdbad1e07b1

  • C:\Users\Admin\AppData\Local\Temp\BDF1.tmp\batchfile.bat

    Filesize

    136B

    MD5

    8ea7ac72a10251ecfb42ef4a88bd330a

    SHA1

    c30f6af73a42c0cc89bd20fe95f9159d6f0756c5

    SHA256

    65e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9

    SHA512

    a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0

  • C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe

    Filesize

    448KB

    MD5

    ca0b33f54480aa9c590d09f72e3feb31

    SHA1

    d50dc7dd964feb0d7516c3037e7dc7e008420ae5

    SHA256

    67833a9e63d8b7469a3a3415124a2426893a6174ce2bd88bea520c68319d182d

    SHA512

    266dcd9c5bfe2b117fda6bf7c4250a908233d8474bd0b09596a0bd0fa2e5bc75446a20b46cb7e516ef75b5661bbe16c714e8dcc5962a0f481cbaecdf6135affd

  • C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe

    Filesize

    2.3MB

    MD5

    4c04147c386ba8792ac6a03069572a8a

    SHA1

    dda67789fc1d0f2469ca95f01a5c81034853ca6a

    SHA256

    c7739a1e940a282703d06eccda7110426d306f390e97fdbbd9df18472fd132cd

    SHA512

    a8b5a0b878a9a7d30cb38feff814e1f4dce24d000158edc10a43ee9a89920bedf7adc92eb7e3913098b6aab7fbd0531f56fc09f508b5c2769992a94e55d153db

  • C:\Users\Admin\AppData\Local\Temp\libcurl-4.dll

    Filesize

    836KB

    MD5

    aeab40ed9a8e627ea7cefc1f5cf9bf7a

    SHA1

    5e2e8ca2881b9bf9edfa3c4fdcec6da1efa102d8

    SHA256

    218cfc4073bab4eddf0de0804f96b204687311e20a9e97994bff54c9b0e01ee9

    SHA512

    c0a67616fa01fdc351015212a718faf70da6612fbb3ec13da28dd7af9a507c56882fb7c3eea6fbc37d4d63b970157199d16d0756dbe3cb3bc2223e215cb104d8

  • C:\Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll

    Filesize

    1.2MB

    MD5

    7cf672bee2afba2dcd0c031ff985958e

    SHA1

    6b82a205db080ffdcb4a4470fce85a14413f3217

    SHA256

    c82f84171b9246d1cac261100b2199789c96c37b03b375f33b2c72afab060b05

    SHA512

    3e90d1c1efe0200cb3cc7b51d04783a3cce8391faa6ce554cff8b23dac60be9f8e4f980a8ac005fd9dff8ea4bdcb02311f7649c5be28eb32dcc26417fc4090e5

  • C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

    Filesize

    4.8MB

    MD5

    9b7005b0cd65f4de09b2b360f9c17ec5

    SHA1

    bf6e47256a84284f189fb4fde155ae10b18bd97d

    SHA256

    e2eee45e4abd2dc2f6a2c29b2012ce2e52f312dcc55056adef11d4678329fe2e

    SHA512

    9283de9512760a1bf98e90b18cf794d0e717b9b9d26739e7b80c77c93ad3dae30c58254c909ea45d0b483c4a41359efe3ece7d1407a81c43c582023cc45d705a

  • \Users\Admin\AppData\Local\Temp\libstdc++-6.dll

    Filesize

    7.4MB

    MD5

    a278ab7f08f5ac64358de22bf1c44adf

    SHA1

    726e78e0f0db6b2d832d4abdbaa8b71b31a50994

    SHA256

    776a269e11cc3916ce822a24ddd81b5fa5d1fe892c520047b86ce1994fcd8ab7

    SHA512

    aabaaf7819c8d588b29643fc40151cbd4b5e815c52838c44e7208a421fd1e1146f75a8ed68f4168811d141fc5bda9596b2fb34af2da6bf5b799a59887556d3de

  • \Users\Admin\AppData\Local\Temp\libstdc++-6.dll

    Filesize

    6.2MB

    MD5

    a2f7333bc282df8bebb04e06fae20627

    SHA1

    da49034b6f27c43bc5a0b429cb6e8f4847b42b26

    SHA256

    340a1d9a1c1cd4236cac42ceb3a808d5689acd0010020c3e868b8670508ec181

    SHA512

    8b8bc61e213741df85cdd9a8b765f572b3527e304f3b9224e40f10fca92be196973ca704bad413613e53df390374cbff3db7fc0a6474ebc30079e036e5f9ef5b

  • \Users\Admin\AppData\Local\Temp\libwinpthread-1.dll

    Filesize

    606KB

    MD5

    585efec1bc1d4d916a4402c9875dff75

    SHA1

    d209613666ccac9d0ddab29a3bc59aa00a0968fa

    SHA256

    2f9984c591a5654434c53e8b4d0c5c187f1fd0bab95247d5c9bc1c0bd60e6232

    SHA512

    b93163cba4601ed999a7a7d1887113792e846c36850c6d84f2d505727dc06524bb959469f9df12928769f4535dc6074a6b3599b788a4844353e466742ce1e770

  • memory/212-6-0x0000000000400000-0x000000000393A000-memory.dmp

    Filesize

    53.2MB

  • memory/1224-4-0x0000000000400000-0x0000000000405000-memory.dmp

    Filesize

    20KB

  • memory/1224-50-0x0000000000400000-0x0000000000405000-memory.dmp

    Filesize

    20KB

  • memory/2312-41-0x0000000061440000-0x000000006156B000-memory.dmp

    Filesize

    1.2MB

  • memory/2312-56-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/2312-42-0x0000000070800000-0x00000000708BC000-memory.dmp

    Filesize

    752KB

  • memory/2312-44-0x0000000001090000-0x0000000002945000-memory.dmp

    Filesize

    24.7MB

  • memory/2312-45-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/2312-40-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/2312-51-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/2312-43-0x0000000073DA0000-0x0000000073E38000-memory.dmp

    Filesize

    608KB

  • memory/2312-61-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/2312-71-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/2312-76-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/2312-81-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/2312-91-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/2312-96-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/2312-101-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.