Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
298s -
max time network
302s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-ja -
resource tags
arch:x64arch:x86image:win10v2004-20231215-jalocale:ja-jpos:windows10-2004-x64systemwindows -
submitted
18/02/2024, 10:17
Behavioral task
behavioral1
Sample
batexe.exe
Resource
win10-20240214-ja
Behavioral task
behavioral2
Sample
batexe.exe
Resource
win10v2004-20231215-ja
General
-
Target
batexe.exe
-
Size
9.4MB
-
MD5
cdc9eacffc6d2bf43153815043064427
-
SHA1
d05101f265f6ea87e18793ab0071f5c99edf363f
-
SHA256
73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
-
SHA512
fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
-
SSDEEP
196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Control Panel\International\Geo\Nation batexe.exe Key value queried \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Control Panel\International\Geo\Nation b2e.exe -
Executes dropped EXE 2 IoCs
pid Process 1760 b2e.exe 4724 cpuminer-sse2.exe -
Loads dropped DLL 5 IoCs
pid Process 4724 cpuminer-sse2.exe 4724 cpuminer-sse2.exe 4724 cpuminer-sse2.exe 4724 cpuminer-sse2.exe 4724 cpuminer-sse2.exe -
resource yara_rule behavioral2/memory/1956-9-0x0000000000400000-0x000000000393A000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1956 wrote to memory of 1760 1956 batexe.exe 84 PID 1956 wrote to memory of 1760 1956 batexe.exe 84 PID 1956 wrote to memory of 1760 1956 batexe.exe 84 PID 1760 wrote to memory of 5004 1760 b2e.exe 85 PID 1760 wrote to memory of 5004 1760 b2e.exe 85 PID 1760 wrote to memory of 5004 1760 b2e.exe 85 PID 5004 wrote to memory of 4724 5004 cmd.exe 88 PID 5004 wrote to memory of 4724 5004 cmd.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\batexe.exe"C:\Users\Admin\AppData\Local\Temp\batexe.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\96F0.tmp\b2e.exe"C:\Users\Admin\AppData\Local\Temp\96F0.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\96F0.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\A086.tmp\batchfile.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.execpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4724
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
18.9MB
MD59f15c2e83e1d929c05155737ed8cd9c4
SHA156d20f537458afc9e7baccc50ae51a18a8a4f019
SHA256c7942d6811ec85cca30971a1b49c583e84f835101794c808ec50e87a3a4ee4ac
SHA5121d8506537ce089453eef3b1da3c3eecb4c94fae11f0f4e682714e4a2cd72bef02f93351b663b7412cece72c819dc1098e228da69cba590bbc5710b88a758f3ee
-
Filesize
1.2MB
MD505f6765e8266a1a7d81a80da7788444e
SHA1e7afd0bf0dce889a026f4233c6705907083e6e23
SHA2563256219f071d9bbeb2b3483abc7e647cbb550c0b74c415ace444bd8a334df9e8
SHA512417d266a6eae32d630cf1322d3ab78f8547b09254ba3b5e2e544a7fd294de819754ab2f104ba2f3cab59a1fcfe7b0ea6f622712736079b7eec12a242b914293c
-
Filesize
2.2MB
MD55c330a3617b8796ebba9f78c23357ca7
SHA11f715231e72f296743d366459c6d637cce84c667
SHA2560bcf30ad06e878108fae03ffdac40d7b5898d6185daf4bf1f609c2c45d0204cb
SHA512af275f2528d4f30db82e311a02409916cc4423d7eca0608d5cf511bd936a1d704e715a6aa5f7d14eaaa60579309b672de32d557a28bab22db8e4825c143cb00f
-
Filesize
136B
MD58ea7ac72a10251ecfb42ef4a88bd330a
SHA1c30f6af73a42c0cc89bd20fe95f9159d6f0756c5
SHA25665e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9
SHA512a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0
-
Filesize
384KB
MD5eb8ea4d2595402528f73410e2c8651ed
SHA123abb385032a9317d00c826eb21e0fe6fc802c50
SHA256fc3c5c1787c58c465ea47ab132afc59d209b1f7d319ae80a7913ed5c39157017
SHA5127f4485a662859bdec898bb4f9675c8a834ab570ae7f4df2b6e95a9f5ab45f8fba612d04f0edfe22dc4bdcd3011af0536ed200731262056cd7bec332ce4b18573
-
Filesize
320KB
MD5c911df8bf8c66277e14360319b0b93b7
SHA1598c59c0e7cbecb788ee676db218dc0faaa39bdc
SHA2564c53941f04ddeae2179047a1c7f8c7f7f46af0f08c424ab66d61f2316f2ee77d
SHA51213aeae87ee52f22d1c928c99c66e116254cde630c09f90b146962fa61276af13fef653b7a66184d00d614f0379750e641c2e62326ebb5588ca632e56c935d77c
-
Filesize
128KB
MD50cfc533c46d2f160fc8d8483706228cf
SHA10d13ced09eeed5fc3879f418bda0410a742ab6a1
SHA256510a6af4547083718b32dc00d4711cfff2aec0e7b936d4199feaaf32a7d5d3a6
SHA51211e35867688e7814881981298b6f6948fceaf254d154f5429e5a82c43397b1894bd35fe7fb586b26e4272d8371c3b8e96c20c71ab05b9df3e851291444702a79
-
Filesize
1.2MB
MD57cf672bee2afba2dcd0c031ff985958e
SHA16b82a205db080ffdcb4a4470fce85a14413f3217
SHA256c82f84171b9246d1cac261100b2199789c96c37b03b375f33b2c72afab060b05
SHA5123e90d1c1efe0200cb3cc7b51d04783a3cce8391faa6ce554cff8b23dac60be9f8e4f980a8ac005fd9dff8ea4bdcb02311f7649c5be28eb32dcc26417fc4090e5
-
Filesize
115KB
MD5ab6c8fa29ab83605d108b4b658b2e50c
SHA1cf79c820530e0b4026b10c719ea9f18b2f02d64e
SHA256b58919862b734dc6ec5cfdbc9eb6368805853e264fbe009835ffa7c7293c4510
SHA512bc86325d2c7d771335076c32ba1c1dc06d9dda944a081dbd35094c817edc31fbd1c9ea90623739ea8055834c0220c1b939949966662c106d77af4e4f472a9afe
-
Filesize
4.2MB
MD5911f4bf949aa891b94a71a1fc6c49974
SHA11c04242f8a5ff76e924830243651d5724c0e1674
SHA256c8f5f57839528f3b2189512449bb428ec7a9c73ad16afc0f76088a817406d071
SHA512ae6eb57d944ba91812a442c9cfe7e36ff291b1a688e61ecd11d86a8dab838c2d0948b8f1e4ebbe28bb74133f7171dc39914f58e029c98d41b315dbcde29fbeda
-
Filesize
128KB
MD59746d1ac79c8b499d8b2224394581fa7
SHA136b1985eabfd8131ad9f2b7f69c903a3fce67629
SHA25677941fbe96e0c797e6cf5419ee32bd3fcee69629cba37750146656a660c37182
SHA51261a6174e2aced5b85cd614ad2f9d3da24c6b91e1fc04e10ff818222c4323cd043a59708bd35af0de84b004bf492fbc157d72907cd1e7ddf7082fc2a3563ef183
-
Filesize
126KB
MD5cea9866363a0a8d00b1f42701844cdea
SHA16484d642482d3203033fb0d983a03de3245eb513
SHA2562fca9af355bb7e4272be985e5d2c2b337ce8d4263c1a638a1a17bed438ab435c
SHA512b0d609240409ae03213ee0faadb30aefd7c119ceb322315d3d995d2076e9587a96bea27e1d1428d88e8ecd415c915fcea7290d56b6ca9aa6e1e00e1a37ad324b
-
Filesize
128KB
MD58d949f4e279a9a80f50d7c2e0c7bff36
SHA192e29300716211895b2d8cd4cf010452f0132152
SHA2562e87614d15e62262c8b0a0c65e302b15e971b591469f3c679e7e516934cf621f
SHA51236565dc0a3290ac8c5e0fd0a2756764ce8e49a7ef52a437caad549c7ea1ac3ac7dfe05cd4951ed6b17051768fd9733c94365d85832092c429b0b74ab62a338fb