Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
299s -
max time network
301s -
platform
windows10-1703_x64 -
resource
win10-20240214-ja -
resource tags
arch:x64arch:x86image:win10-20240214-jalocale:ja-jpos:windows10-1703-x64systemwindows -
submitted
18/02/2024, 18:04
Behavioral task
behavioral1
Sample
batexe.exe
Resource
win10-20240214-ja
Behavioral task
behavioral2
Sample
batexe.exe
Resource
win10v2004-20231215-ja
General
-
Target
batexe.exe
-
Size
9.4MB
-
MD5
cdc9eacffc6d2bf43153815043064427
-
SHA1
d05101f265f6ea87e18793ab0071f5c99edf363f
-
SHA256
73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
-
SHA512
fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
-
SSDEEP
196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 1892 b2e.exe 2492 cpuminer-sse2.exe -
Loads dropped DLL 5 IoCs
pid Process 2492 cpuminer-sse2.exe 2492 cpuminer-sse2.exe 2492 cpuminer-sse2.exe 2492 cpuminer-sse2.exe 2492 cpuminer-sse2.exe -
resource yara_rule behavioral1/memory/4012-4-0x0000000000400000-0x000000000393A000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4012 wrote to memory of 1892 4012 batexe.exe 73 PID 4012 wrote to memory of 1892 4012 batexe.exe 73 PID 4012 wrote to memory of 1892 4012 batexe.exe 73 PID 1892 wrote to memory of 4892 1892 b2e.exe 74 PID 1892 wrote to memory of 4892 1892 b2e.exe 74 PID 1892 wrote to memory of 4892 1892 b2e.exe 74 PID 4892 wrote to memory of 2492 4892 cmd.exe 77 PID 4892 wrote to memory of 2492 4892 cmd.exe 77
Processes
-
C:\Users\Admin\AppData\Local\Temp\batexe.exe"C:\Users\Admin\AppData\Local\Temp\batexe.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4012 -
C:\Users\Admin\AppData\Local\Temp\5D7.tmp\b2e.exe"C:\Users\Admin\AppData\Local\Temp\5D7.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\5D7.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BF2.tmp\batchfile.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.execpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2492
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.4MB
MD5f1e2dcebb97a85948916d3bad725bd5f
SHA123b710369075c10de442b55459c6bc292a47ecb0
SHA2565290860743d90b1a9ed84a1af76d94907df48a000b511326d93cd1dbc16dcb89
SHA5120ae204f46a4036d31f94e307a210cedf2e7a69fb664c9aece261e5d1be66620b85d4569c11a5d9cfb058aa5f1182c19c08e12015b60bc5c8da6e76610e1d363d
-
Filesize
4.1MB
MD555075aad2654558e78c79389d328bd6c
SHA13c49741995c4eedb25ab33cc269abeed7e5a00b8
SHA256778ee0f65897dd81fdfe44499a01fd879b1c237acb9015a4b8afe1020809e440
SHA5120060002f1ddd8ba3d108c627afb31818998a107e866db7bf1de6ce534e4974c520e8a4a34a0925c1ecac868c5f85543afd169b1ad77b81521b88049bf784ec5f
-
Filesize
136B
MD58ea7ac72a10251ecfb42ef4a88bd330a
SHA1c30f6af73a42c0cc89bd20fe95f9159d6f0756c5
SHA25665e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9
SHA512a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0
-
Filesize
832KB
MD543dd8ab1a0fd7f177db516faa81a9635
SHA166a8b6940797f3396a4f1a6deafca1fda5bffcdd
SHA256d4b58fa7e09511b58f312b57e2067823a7f31ff5cd6369cbf5ef3667c27b60ea
SHA512064753e38fb6e2d64a8ce067a52c24b55eb11cf714a534f3557a0e2bd2f5fba16030d8496c7787f4b272ae6a696f4b017d99771488832d12711a7158c927f772
-
Filesize
768KB
MD5e3f15c79f945604229fa814f57c79274
SHA119a7015dfbe622ab86c48693ee1605b26112a3fa
SHA2567b09ee53447ccf77a0f2d7bfe25908f963d681433d3cba5a16c7f45646c42175
SHA51212dc1df8a947caee13a12eca5a976feffd7408402b0495e4971d4bd7181e8d353ebc17da044d2ce6d1c273bb05a0ca5ddf7492394b355786d8b14b0997de162c
-
Filesize
832KB
MD5d33f0e6bb5e8d2b9e111a90544790dc8
SHA1df4e81d22638d511e761744e886c33bc12096c48
SHA25640729edf62213c039a1818c9adb9478aa0284bb26dd071bd1ac4de1da2470048
SHA512ce4ebeae054117d4de8b3fe2403d95a6d819483269f851618958e864887e9b2f42fc9c893e1aa207dfa2d94900c8f4214a67796ddeb2a80ce655d69ec290d629
-
Filesize
640KB
MD51b7339cbcb5b756c15c05fe0cc6443f3
SHA1abdba01c4526a9bbbb7fd3853e09bce3cbb5287d
SHA2565fcf0fb116f77206758e3a669ec4fa52648fae431a5c2aa2d7ee69944142e019
SHA5127661b5e8413e74432a00089b1556b2f49e268b6b5c8cefd839cbe19074bffd138c18e8078627420f4082f579a9e3f8d02b199507ae36380b5375162a4d4ba439
-
Filesize
704KB
MD5903e2cfee96d720dd5200a922b637d07
SHA1f6d639d7b6bb586abcb5f97b1b212252ed6c85b2
SHA256443ef0fe0e5e9cff04e267b1bbbbc98b547e5bd38a853eb79d06a43a8e7d17f2
SHA512c9c357be28d1d97bd5255d88bc64255f452867407c3aa4c99b286913286780da1204691a0344514f070b8bad391980a88b165eb1e8e9ee97f77ef02eb85071c2
-
Filesize
704KB
MD5538d0a2af59454daf4418e27268ec013
SHA1dd5e047f232d3827ba6f9c1da4f17928557dd6e6
SHA256ef618dca52a4f65f6fd72fd721744185c44cfeff6ff90928f56481969eab4126
SHA5121c958d315013726aa6ebc24552fb4d712a30ad6e5621db0f9037924ccb8cdf45063a01ed6da3aa50485ad084248a9c67c3513aabecf9d324eacaaa2b75f0a7c2
-
Filesize
5.2MB
MD57f357fdbc9d564be37f0755874b679f7
SHA106a282598b4f14960024264b4390517b87fe8565
SHA256600a518d56f34c313dda50eb6400563ff69348c6c4a101e8108b9dab75b51d65
SHA512d158e1265afc9c684a328510242907975ab7d9395345231d4c2b09e71a54e751861d49d253a96f7455661ff0f3b50069aa39b5ffaa89d5f7d88e001d86c07651
-
Filesize
7.3MB
MD5ec1c0af627c5e09937b87fb68d244367
SHA119f925f931a867c7bc218cadc696e97c4d9e73c6
SHA256ff30ef64ba22c3ad16a4dcdebf42480f69800bad22eacf31be1be5e69a6e8644
SHA512aad8993eca64720d98e07434a2006ef771c4a7037c577ea31eb012cc7ea915ca54d473f97a26df18cc15f9b7aadfe20e1c87164785224188db91ee407d4d636d
-
Filesize
606KB
MD5585efec1bc1d4d916a4402c9875dff75
SHA1d209613666ccac9d0ddab29a3bc59aa00a0968fa
SHA2562f9984c591a5654434c53e8b4d0c5c187f1fd0bab95247d5c9bc1c0bd60e6232
SHA512b93163cba4601ed999a7a7d1887113792e846c36850c6d84f2d505727dc06524bb959469f9df12928769f4535dc6074a6b3599b788a4844353e466742ce1e770