Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
294s -
max time network
301s -
platform
windows10-1703_x64 -
resource
win10-20240214-ja -
resource tags
arch:x64arch:x86image:win10-20240214-jalocale:ja-jpos:windows10-1703-x64systemwindows -
submitted
17/02/2024, 14:58
Behavioral task
behavioral1
Sample
batexe.exe
Resource
win10-20240214-ja
Behavioral task
behavioral2
Sample
batexe.exe
Resource
win10v2004-20231215-ja
General
-
Target
batexe.exe
-
Size
9.4MB
-
MD5
cdc9eacffc6d2bf43153815043064427
-
SHA1
d05101f265f6ea87e18793ab0071f5c99edf363f
-
SHA256
73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
-
SHA512
fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
-
SSDEEP
196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 4880 b2e.exe 2808 cpuminer-sse2.exe -
Loads dropped DLL 5 IoCs
pid Process 2808 cpuminer-sse2.exe 2808 cpuminer-sse2.exe 2808 cpuminer-sse2.exe 2808 cpuminer-sse2.exe 2808 cpuminer-sse2.exe -
resource yara_rule behavioral1/memory/2576-4-0x0000000000400000-0x000000000393A000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2576 wrote to memory of 4880 2576 batexe.exe 74 PID 2576 wrote to memory of 4880 2576 batexe.exe 74 PID 2576 wrote to memory of 4880 2576 batexe.exe 74 PID 4880 wrote to memory of 4124 4880 b2e.exe 75 PID 4880 wrote to memory of 4124 4880 b2e.exe 75 PID 4880 wrote to memory of 4124 4880 b2e.exe 75 PID 4124 wrote to memory of 2808 4124 cmd.exe 78 PID 4124 wrote to memory of 2808 4124 cmd.exe 78
Processes
-
C:\Users\Admin\AppData\Local\Temp\batexe.exe"C:\Users\Admin\AppData\Local\Temp\batexe.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\CC58.tmp\b2e.exe"C:\Users\Admin\AppData\Local\Temp\CC58.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\CC58.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\D179.tmp\batchfile.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.execpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2808
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1024KB
MD555d3fcf113506e85b6cf485f08b11290
SHA1539d601fdd7e37fe22412d8c73023e21293ac62c
SHA256519083ea4de496637895b9c3dd7fa5d9fc1140325272570f09aa0d2bad46f2d3
SHA51262c0dc6a36ef819eede73c8b041fbdf579ec0ae399654a73a4628555bb84c4e1fdcf314deb659f41986204e2d92acd886dd8735a24a150a309d4035b58a33ee4
-
Filesize
2.6MB
MD5f845d6b8c0beb43591f7ebc96344f81b
SHA15bcb9d96f6589b559060e11d6d5a0bf73d91c80e
SHA256841b8431f27f5e631d37c605530e6ce5430559c96fa9a6ddebc7e9dd63ad04b2
SHA5128de293211ad14117c9ecb797c78c738c91b691f3dc861401d537cc72c9ba05a40340c452938bd6d72bf400efa1fffb7bb387f204035697b8a229a29288d5d357
-
Filesize
136B
MD58ea7ac72a10251ecfb42ef4a88bd330a
SHA1c30f6af73a42c0cc89bd20fe95f9159d6f0756c5
SHA25665e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9
SHA512a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0
-
Filesize
896KB
MD59f9a8fea08bacf3a1d155567fead5940
SHA19d9ba8746c585446f53f442b800e1eb28a0df86a
SHA256a22f9d8fb953e4f6bc93cdcc8aa650a5a093f1dd400fdc501d5aa7b00bee0289
SHA512d41a048619373832c616d48f919595ac50dfbbd68095aec008b30adde91ceeeb86326c7d412ab20d937bab7096fb8165d3da8b4fdc40a03cc32da9ee3e9dc2a2
-
Filesize
1.3MB
MD523d79e5c9aab672f8f60c5eebe49095a
SHA1a104fcef7239607ddf1efe7b2c23e746dfbd0dcf
SHA256698e05c0e81105d7f7175ef33574ef428340bd4729564a58f6190349283e636a
SHA51203fbe3b84107563ea0e7b6b345b4cb4a3bd09153068643c1a96e53bf7504b004458859dfea0c66da065defc293436f3449e568b922f1796f33850f145f8a07eb
-
Filesize
836KB
MD5aeab40ed9a8e627ea7cefc1f5cf9bf7a
SHA15e2e8ca2881b9bf9edfa3c4fdcec6da1efa102d8
SHA256218cfc4073bab4eddf0de0804f96b204687311e20a9e97994bff54c9b0e01ee9
SHA512c0a67616fa01fdc351015212a718faf70da6612fbb3ec13da28dd7af9a507c56882fb7c3eea6fbc37d4d63b970157199d16d0756dbe3cb3bc2223e215cb104d8
-
Filesize
1.2MB
MD57cf672bee2afba2dcd0c031ff985958e
SHA16b82a205db080ffdcb4a4470fce85a14413f3217
SHA256c82f84171b9246d1cac261100b2199789c96c37b03b375f33b2c72afab060b05
SHA5123e90d1c1efe0200cb3cc7b51d04783a3cce8391faa6ce554cff8b23dac60be9f8e4f980a8ac005fd9dff8ea4bdcb02311f7649c5be28eb32dcc26417fc4090e5
-
Filesize
1.1MB
MD503ae1346c99a66fcbd06c3a56898820a
SHA1cf57878eb1c3523d08468ba3e9e65a063c24d902
SHA256bdb28d28d4f6093c2bbf0cbdf1b2edaf325ad34c214cde4123437896488dc445
SHA512b1e6f93db804c65f996ae29123a601ee95830391d9f5b73608962cbcd25a9082f1b1f9a6e732e5f84bfa3bd7207101edf9d076445370150ae58c9dcace634260
-
Filesize
768KB
MD5e3f15c79f945604229fa814f57c79274
SHA119a7015dfbe622ab86c48693ee1605b26112a3fa
SHA2567b09ee53447ccf77a0f2d7bfe25908f963d681433d3cba5a16c7f45646c42175
SHA51212dc1df8a947caee13a12eca5a976feffd7408402b0495e4971d4bd7181e8d353ebc17da044d2ce6d1c273bb05a0ca5ddf7492394b355786d8b14b0997de162c
-
Filesize
832KB
MD5d33f0e6bb5e8d2b9e111a90544790dc8
SHA1df4e81d22638d511e761744e886c33bc12096c48
SHA25640729edf62213c039a1818c9adb9478aa0284bb26dd071bd1ac4de1da2470048
SHA512ce4ebeae054117d4de8b3fe2403d95a6d819483269f851618958e864887e9b2f42fc9c893e1aa207dfa2d94900c8f4214a67796ddeb2a80ce655d69ec290d629
-
Filesize
704KB
MD5ceb1ee23d68e973e400b41e7324c71b6
SHA10ad5540864cf9bcbf52870ba72566625ca54e67a
SHA25666f2f5bd30986e28a4c43ed44264cc56f63bd7a3ecd6aeb5845ac7bcd724aeee
SHA51251ce4a101517339cb1f5c23fc953dde73f871cec2bde8ea5c9fad9376366d7b8aadaa8668ef2f7bf9d873e8817345e4e337a7a94c42c3ddf6a168377af060e9c
-
Filesize
606KB
MD5585efec1bc1d4d916a4402c9875dff75
SHA1d209613666ccac9d0ddab29a3bc59aa00a0968fa
SHA2562f9984c591a5654434c53e8b4d0c5c187f1fd0bab95247d5c9bc1c0bd60e6232
SHA512b93163cba4601ed999a7a7d1887113792e846c36850c6d84f2d505727dc06524bb959469f9df12928769f4535dc6074a6b3599b788a4844353e466742ce1e770