Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
293s -
max time network
296s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-ja -
resource tags
arch:x64arch:x86image:win10v2004-20231222-jalocale:ja-jpos:windows10-2004-x64systemwindows -
submitted
20/02/2024, 05:23
Behavioral task
behavioral1
Sample
batexe.exe
Resource
win10-20240214-ja
Behavioral task
behavioral2
Sample
batexe.exe
Resource
win10v2004-20231222-ja
General
-
Target
batexe.exe
-
Size
9.4MB
-
MD5
cdc9eacffc6d2bf43153815043064427
-
SHA1
d05101f265f6ea87e18793ab0071f5c99edf363f
-
SHA256
73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
-
SHA512
fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
-
SSDEEP
196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation batexe.exe Key value queried \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation b2e.exe -
Executes dropped EXE 2 IoCs
pid Process 2240 b2e.exe 5600 cpuminer-sse2.exe -
Loads dropped DLL 5 IoCs
pid Process 5600 cpuminer-sse2.exe 5600 cpuminer-sse2.exe 5600 cpuminer-sse2.exe 5600 cpuminer-sse2.exe 5600 cpuminer-sse2.exe -
resource yara_rule behavioral2/memory/4876-9-0x0000000000400000-0x000000000393A000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4876 wrote to memory of 2240 4876 batexe.exe 84 PID 4876 wrote to memory of 2240 4876 batexe.exe 84 PID 4876 wrote to memory of 2240 4876 batexe.exe 84 PID 2240 wrote to memory of 6012 2240 b2e.exe 85 PID 2240 wrote to memory of 6012 2240 b2e.exe 85 PID 2240 wrote to memory of 6012 2240 b2e.exe 85 PID 6012 wrote to memory of 5600 6012 cmd.exe 88 PID 6012 wrote to memory of 5600 6012 cmd.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\batexe.exe"C:\Users\Admin\AppData\Local\Temp\batexe.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\954B.tmp\b2e.exe"C:\Users\Admin\AppData\Local\Temp\954B.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\954B.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\9819.tmp\batchfile.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:6012 -
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.execpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5600
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
13.0MB
MD53ad9c230b4a546880316c8590fe21140
SHA19f6088017d90971480883da99359b337c3e7a87e
SHA256763b4f331878d87771b112b842bd7c9522f2147cb8da72f4fe00d180797eb6a3
SHA51205cbe1dbc97aef4da7c8d09a0a24223f8c401f55161caf21160432d8d5692663e7ec01b14651c67be848a4f73631d8fc9e8a2bb8a8a8f2dc2df6b17b6a27e2f4
-
Filesize
5.3MB
MD5233a06c017b2c356703417af18246c69
SHA1eca42488baf26bbcab1ef4ae1b1695082b1872ca
SHA2561696afebd5b1c0829ac3ed32241a74c03fcad8b0dc6d3c86444ebf02e6e23da2
SHA5122d66f65d393ba654cc6a784761cee77fbe40dfd43fa93fa146187985f05014da6a635283de13f4f1bbfc16700cf486ab723073afbfd66d079c8e59584b71b7b7
-
Filesize
5.6MB
MD5d009ea00d4e481b5cc36d8b9902ebaed
SHA19ed7f0293eb58a29c6bbb5b93a18f4c030c63212
SHA25622b6a093155754f8007ea4e1814e299a927d3a32187eaece9cbf13b228b48bbd
SHA5128f98ab491d94d63d9841a7ab7cc0c4842cae342938fa710dafe00cab6c8b6e044b1bd1b58df7854c08672529febdf225dbde5a3c71733f7d91ba9185dd4a5fc4
-
Filesize
136B
MD58ea7ac72a10251ecfb42ef4a88bd330a
SHA1c30f6af73a42c0cc89bd20fe95f9159d6f0756c5
SHA25665e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9
SHA512a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0
-
Filesize
1.1MB
MD5ff1db76268ad93f71e0fbf4845976afb
SHA1d3c6d2787007a3d71e9f35ee65aa82d5bf5cf970
SHA256c1f10a19764c5ec170503b618f741db950ebf3e7c397c2a8de483482366abb1d
SHA512c20ddcc7a598c04561494ed9d5045bd0dc9d8fb6e7df4b3f9651b5d53ce5772eadf33538171f5c642355c099772e4d2f8d8aea528bb3610eeec74bb76f51d050
-
Filesize
1.3MB
MD58ad58df4f04e6e0a8df08a95cbe1abb5
SHA1ae54ab7f6a4af6fca1c8f6572bdf2594791489c9
SHA2560ff2dc589db160c982d9747e4322f05cef74d865a53f1735f2f178f128d6aed7
SHA5127839396dcb4e1b18bc1e0a2002989fc3c85834aa40b59e44a963b5ed92cd2a6a181ee959579a44ed1aec478a89d897ae3f315d1e861499e88cdc72cd97a9aff4
-
Filesize
681KB
MD515d4a28e0faa09d6bcf767088bedc13d
SHA15b7598750a54ba7fa604dd148c0def8c697102d6
SHA256736907854295d2cb19c51ff037b59e798b5b10d62de48f5442b293f8462ee89c
SHA51253bd97b5896bdf5db40f882aaac66232ccb93197b0089b861e50e8c79c7da0e6a3aca4c63b2370082984bfc6df500d2f7736dec508a25c05346923aee04659b5
-
Filesize
836KB
MD5aeab40ed9a8e627ea7cefc1f5cf9bf7a
SHA15e2e8ca2881b9bf9edfa3c4fdcec6da1efa102d8
SHA256218cfc4073bab4eddf0de0804f96b204687311e20a9e97994bff54c9b0e01ee9
SHA512c0a67616fa01fdc351015212a718faf70da6612fbb3ec13da28dd7af9a507c56882fb7c3eea6fbc37d4d63b970157199d16d0756dbe3cb3bc2223e215cb104d8
-
Filesize
1.2MB
MD57cf672bee2afba2dcd0c031ff985958e
SHA16b82a205db080ffdcb4a4470fce85a14413f3217
SHA256c82f84171b9246d1cac261100b2199789c96c37b03b375f33b2c72afab060b05
SHA5123e90d1c1efe0200cb3cc7b51d04783a3cce8391faa6ce554cff8b23dac60be9f8e4f980a8ac005fd9dff8ea4bdcb02311f7649c5be28eb32dcc26417fc4090e5
-
Filesize
865KB
MD5d5c1592aab1da99bb966d9eff4a6fec5
SHA101c1a717d997ac051d56fe7e0a24dad2845a254a
SHA25602c02ed2a1b921ce5ecbc1d23c833823a6e17dceaa1fa0950cab3c3ff0533e01
SHA512e2e3d8a9fac3b0556f874ca18a417fbdeeba7f673fcd093f292cf3d4738ee8e5116b8034c5f3f7f9a0ab10217e3efdb7b5678e3a2fe31560b6ff24ac696cb466
-
Filesize
1010KB
MD5380607dbe40621703c2b89e2a885806b
SHA1e2423b5c6733e7b411fbc5a4ea91f8f704045b1d
SHA25616a8a87d9beebfca828783f811c000fb76dcb106e8fb3814fa5779ee9603759a
SHA5122bb644a52b201876daa8841342ba250d1bd431b8a0f69aa7998f40a983650fcc0e369ec8236ef67c30ace49b53b0cdcb073c2e891e894c9ace62509cd981027c
-
Filesize
1.1MB
MD5d6bee7746cc24fa35eeac2e7108e7cbe
SHA1f8774ecf90d45571681bd477bd31933f1ff742c1
SHA256a5ee5396c8c54efb722650270ee022abfc0761f967c4dad3fa797408e87317b8
SHA512f699ec198b9403ba3ddc6551479e9e49c245a752fe6654df5b27280b9c8ff9d7b34c0230870a185c9304fa5eba88c373a930f4901c75d7463dc99610a024b191
-
Filesize
501KB
MD583dee2b20630ee0a209eda8fdec52dcf
SHA1e82657d2be7b62b00cbff51a9914845a0473128f
SHA256ed4c6cb85da627b6f2fb126982cf68af12b9a88ff3dfefe8856ab65a3003e703
SHA51268c0869cdf0d863bbd29f0cf58e86871d92a3c42390cacbf5fd335fde7c2bec10bbc3a16a05dd0208a281280c878f3243ce015a098d32c07d07fe2a9c004ea98
-
Filesize
606KB
MD5585efec1bc1d4d916a4402c9875dff75
SHA1d209613666ccac9d0ddab29a3bc59aa00a0968fa
SHA2562f9984c591a5654434c53e8b4d0c5c187f1fd0bab95247d5c9bc1c0bd60e6232
SHA512b93163cba4601ed999a7a7d1887113792e846c36850c6d84f2d505727dc06524bb959469f9df12928769f4535dc6074a6b3599b788a4844353e466742ce1e770