Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
297s -
max time network
306s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-ja -
resource tags
arch:x64arch:x86image:win10v2004-20231215-jalocale:ja-jpos:windows10-2004-x64systemwindows -
submitted
18/02/2024, 16:42
Behavioral task
behavioral1
Sample
batexe.exe
Resource
win10-20240214-ja
Behavioral task
behavioral2
Sample
batexe.exe
Resource
win10v2004-20231215-ja
General
-
Target
batexe.exe
-
Size
9.4MB
-
MD5
cdc9eacffc6d2bf43153815043064427
-
SHA1
d05101f265f6ea87e18793ab0071f5c99edf363f
-
SHA256
73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
-
SHA512
fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
-
SSDEEP
196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Control Panel\International\Geo\Nation batexe.exe Key value queried \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Control Panel\International\Geo\Nation b2e.exe -
Executes dropped EXE 2 IoCs
pid Process 3260 b2e.exe 4092 cpuminer-sse2.exe -
Loads dropped DLL 5 IoCs
pid Process 4092 cpuminer-sse2.exe 4092 cpuminer-sse2.exe 4092 cpuminer-sse2.exe 4092 cpuminer-sse2.exe 4092 cpuminer-sse2.exe -
resource yara_rule behavioral2/memory/2216-9-0x0000000000400000-0x000000000393A000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2216 wrote to memory of 3260 2216 batexe.exe 83 PID 2216 wrote to memory of 3260 2216 batexe.exe 83 PID 2216 wrote to memory of 3260 2216 batexe.exe 83 PID 3260 wrote to memory of 1340 3260 b2e.exe 84 PID 3260 wrote to memory of 1340 3260 b2e.exe 84 PID 3260 wrote to memory of 1340 3260 b2e.exe 84 PID 1340 wrote to memory of 4092 1340 cmd.exe 87 PID 1340 wrote to memory of 4092 1340 cmd.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\batexe.exe"C:\Users\Admin\AppData\Local\Temp\batexe.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\8F40.tmp\b2e.exe"C:\Users\Admin\AppData\Local\Temp\8F40.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\8F40.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\99FE.tmp\batchfile.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.execpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4092
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11.3MB
MD56687381524eb0ae8bde1a2b980931fa7
SHA1919e15e60592c9bc1069e81f914ae8b6f871ea9c
SHA256ec644f3ea897c9595af83232391865430ea6deecb899f45937ba961292aaba9f
SHA5129cd3d27e8a8ab1882688070c122b2c92e9fdf5a66100c2e77316fa8698b524ed60c995e4eb18c80004db14946b09552787bb1d55474e61a17a956ed4c8a4b08d
-
Filesize
3.2MB
MD51e60e473db0b9bcb64c06efeecf96801
SHA1fcdc665d51f58b9d6954c4016f2c779ea0028dc1
SHA2563cc7150b95e2679b0d2bf6005f0be950e672884a43822f3f7343330fdc68d386
SHA512b42096884ee5694093c1f4519eced92785309cfd9bbc7a9f0e3295546b9d2de64793e9775256008bebf25bb02873ebbbcf8888b55ddffaa344289c6e5dac4223
-
Filesize
3.1MB
MD53f29666ce7a29a024a887160e5b30881
SHA10b193c20d6d035560844f0734e7f9724ea7d8a9e
SHA256e9c7a780654014f67e2031f9c0ce9dcc4119bf69b9e05ddf8e346f985b667c8c
SHA512d9d672a5a6257112d421063802da5c8dbf14e79c0ff6ca81caa8841a30bd58527c54b31f4f6c29f1684ea5ee1911504815f3925a9a08e5b124777b82d9c2e4e4
-
Filesize
136B
MD58ea7ac72a10251ecfb42ef4a88bd330a
SHA1c30f6af73a42c0cc89bd20fe95f9159d6f0756c5
SHA25665e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9
SHA512a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0
-
Filesize
1.5MB
MD54ff74831f154773ce0f6437abfd0ba4f
SHA1b9ac1e63975ff7494e0f0ffb5146be8ed86d6e2c
SHA256df9b335bb9a475519b633674179aa216bf844b371df7b3c5823bae50d892e7ec
SHA512b972dda46990ebe84c68988a927ce74d57c0d75ba297d5ef1f938cd10eb8135a74e0dd5f97e0eea7a8301e6376ca90cab6782a8c8f3c7ef4abfef1eb3a08a524
-
Filesize
1.2MB
MD5f1ca0e4f8c80894a61a5945f2fc27c61
SHA15d8469a5db2409fefd4dd907e3f4e21d888212d2
SHA25685a6a3bf0a70ef299bf81f721b492de7d5dc9a8f73a7157c6c41bd4d8bf2957e
SHA5121859c39c68c69f7d76e987b8593932f0a059fcb48d5be21bb8bb8649bcafcd4f1951043c70be114484650d08deaa1b90bd35510db7ee6a1af1cda75b6af9f3c1
-
Filesize
836KB
MD5aeab40ed9a8e627ea7cefc1f5cf9bf7a
SHA15e2e8ca2881b9bf9edfa3c4fdcec6da1efa102d8
SHA256218cfc4073bab4eddf0de0804f96b204687311e20a9e97994bff54c9b0e01ee9
SHA512c0a67616fa01fdc351015212a718faf70da6612fbb3ec13da28dd7af9a507c56882fb7c3eea6fbc37d4d63b970157199d16d0756dbe3cb3bc2223e215cb104d8
-
Filesize
1.1MB
MD5c92c77f1a0ac6f5dc252a0e6187d8345
SHA1f7814840f3adb7a5f510c3cd772682d5542880d4
SHA2562fc1c2da730cdbdf707f77739c0a6ccd5f598b75d7dcff31eed0f68549f1e043
SHA512dcc271087d055c897b6f5ca858da460861a32f18100a211d794b57778f1c51b06f627e979ecb7e0c9fd06c2f41e4dbcfc168a21611810f867b14d033aab74111
-
Filesize
1024KB
MD5c6151ba2a5a47dc2053b8becbd8a0b68
SHA11f6d6821cc72fdc279db6c9ac0a4fbeec236f2f3
SHA2561e2b0b487fca221e8095a470e0aeadf8151b008c54ec5f4c7a5b30582d88b90e
SHA512c4ad99b39c67ce00f245da976fbddf54d6171b8fc33a60fc2fdaeedbf7b8615085de99069dc087c6b1890ad7a7486f559a2412dac7ab0cd301fe24867ebc1d25
-
Filesize
896KB
MD54ece07a08273d0d0db84220926c3d32f
SHA1d90712e2e643311a963676e87f6afad0c421d895
SHA256d82c02350e5ca5ebe35d4349a16c3c9986aaecd8be71c05a00b1af09039a4cf3
SHA512fa010b4c3c0e6d38bb281b4541c0e8b124e05d2feaa6dc11cb6e9c1d85145d5885a5cd61c1bca283f2d9f30295b197343311306acc9d5393aef64793067cdcab
-
Filesize
832KB
MD52bfa2b9803bf342837d2cfe9b2b57f64
SHA1e89eec3559c4904ce523943fed97f3fa2534ab39
SHA25638710a4ce8976e3e452fe43563f28f9a8259165fd68ca94f5d64f5f4a299b6ab
SHA512d099f07ca1cb598bdd6f563d917fe3ddcf3f6f37b589f68da987426e416492acf3dbfb2e18387d9afb168308d55c9acfb568c3d31735ab307fc070ff4da93793
-
Filesize
606KB
MD5585efec1bc1d4d916a4402c9875dff75
SHA1d209613666ccac9d0ddab29a3bc59aa00a0968fa
SHA2562f9984c591a5654434c53e8b4d0c5c187f1fd0bab95247d5c9bc1c0bd60e6232
SHA512b93163cba4601ed999a7a7d1887113792e846c36850c6d84f2d505727dc06524bb959469f9df12928769f4535dc6074a6b3599b788a4844353e466742ce1e770