Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
295s -
max time network
306s -
platform
windows10-1703_x64 -
resource
win10-20240214-ja -
resource tags
arch:x64arch:x86image:win10-20240214-jalocale:ja-jpos:windows10-1703-x64systemwindows -
submitted
20/02/2024, 12:15
Behavioral task
behavioral1
Sample
batexe.exe
Resource
win10-20240214-ja
Behavioral task
behavioral2
Sample
batexe.exe
Resource
win10v2004-20231215-ja
General
-
Target
batexe.exe
-
Size
9.4MB
-
MD5
cdc9eacffc6d2bf43153815043064427
-
SHA1
d05101f265f6ea87e18793ab0071f5c99edf363f
-
SHA256
73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
-
SHA512
fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
-
SSDEEP
196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 4652 b2e.exe 812 cpuminer-sse2.exe -
Loads dropped DLL 5 IoCs
pid Process 812 cpuminer-sse2.exe 812 cpuminer-sse2.exe 812 cpuminer-sse2.exe 812 cpuminer-sse2.exe 812 cpuminer-sse2.exe -
resource yara_rule behavioral1/memory/1552-5-0x0000000000400000-0x000000000393A000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1552 wrote to memory of 4652 1552 batexe.exe 73 PID 1552 wrote to memory of 4652 1552 batexe.exe 73 PID 1552 wrote to memory of 4652 1552 batexe.exe 73 PID 4652 wrote to memory of 968 4652 b2e.exe 74 PID 4652 wrote to memory of 968 4652 b2e.exe 74 PID 4652 wrote to memory of 968 4652 b2e.exe 74 PID 968 wrote to memory of 812 968 cmd.exe 77 PID 968 wrote to memory of 812 968 cmd.exe 77
Processes
-
C:\Users\Admin\AppData\Local\Temp\batexe.exe"C:\Users\Admin\AppData\Local\Temp\batexe.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\26EC.tmp\b2e.exe"C:\Users\Admin\AppData\Local\Temp\26EC.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\26EC.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\2C5A.tmp\batchfile.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:968 -
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.execpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:812
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.5MB
MD52a089e8bf6578017b5c976d0dacec1b8
SHA1111f721c4eb9edb2555114a6c8d95d0bac6bf333
SHA2567c38ff410d155d55353f7c8d0ccda5c2f63a97eadff37a99228b2cff8efddb50
SHA5125efbe1daa3034284f68f7045fbbd4e26276165f60dca93d455772d5727deaf9ebc059a8b7b0763c6d00243fc8bbff9a197556837e71a1ecfd71e6919b8a7ecfe
-
Filesize
1.2MB
MD57b0f4c1d8506067fce25df5de733bcb7
SHA1053b618c2012c6895e9709696395951acf15c165
SHA256dd9a3eca69a73709146ebc228a433e0fef43ab6c12c2280725d798c7b494216a
SHA51245ca44d04c436082073475b0bec73cdd3df1f0cc670d9a3d5dd77fc2b3b60ef870af5912d27269107222850b07234060eefb2d272b96de1367ff544cac506618
-
Filesize
136B
MD58ea7ac72a10251ecfb42ef4a88bd330a
SHA1c30f6af73a42c0cc89bd20fe95f9159d6f0756c5
SHA25665e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9
SHA512a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0
-
Filesize
385KB
MD5d1dc4440cf1fe9f42f7a5caf77de782f
SHA181dddf9aa8bc5c0c574d16fdc426afa2937bf0a8
SHA256095b3d6081ca9d9c721260eb1d4d7d4f3adfa6c5ee9a77b4330e77a71f460c77
SHA512dadbdd8a04aefe8dd018520e101865ccd175eaa7e8b5660c6fb4a59bf7bfdfc228b4a5f21814f7067ce4033508853dccf0c3a3ed72f4ef2db367aec93eef371b
-
Filesize
588KB
MD5d9b54c00514d5a8c9d44bd002442d80d
SHA111d8247a92fa953155c656f773aec2ac0d8bc52d
SHA2564cfcdeb0550e64356b31dcee97f29d0c4ceaf55d3c4d33e137f74a3ffdf4c1fe
SHA512f37c94e57f7f68f6374ea599c5900475d7a105311a504c2386b726a242b821eaa90b8c695fa71e473149f56c64452087aca107c7ce4d59ed2b48f44469179992
-
Filesize
531KB
MD5d0574e5228f45951e9a207aa603d0733
SHA1d3a09ec5b32e4528f528a2d1fb4ef6e3803ef7a5
SHA25602e21e698fbd563efab7f3756defe40db4759964a13f806bab8c87bb264bb72f
SHA5122a3a89d09f6e928f765771a23008ee268022cea219e7787989b13d9e0c1851cf9a4a3fa7bb1e41ad05d25ba5bbd8a15886c5b0ec2934b922f5f6a3476fcba854
-
Filesize
349KB
MD5e725b965f56c8a6329b2ea930913047f
SHA17b007705802dbc0eb67af88beed0bc00b7663837
SHA256aeaefd5acad5b8973d1c442ba909083252141200cc17d6ac6a48f334e7710658
SHA512dd355af0d9bb44e75ff9e45a3e13417877ce7e413eb5850aa96979d6aeb8699bfb2c4dceab46b6a0bfbdc8d943f7e2645d1d06e72362443c4e4c420a342f4f99
-
Filesize
507KB
MD5feec4df722f9744ebdab5e47e2d0d567
SHA1b77bd6341a25a79817ac1c9aee7f88b1cca20850
SHA2566419b0be4e22d509bb52f08cc207d5f5fb2ba356b44ec41b7c00ed400660bf57
SHA512841616fbc2079aabf6c9746b30187af848be387e5705bf811eb8ddce4970145f6c79c1fae80a009a881b07f9a2f890c32372cf60931fad1859a92748b906ff89
-
Filesize
384KB
MD5eec15153c344f43f1919cb379b9ee2f9
SHA13e4a09390ac885ea2797209603bcfa1ec6ff0cc6
SHA2564e4d7ecae87e8e656c61af89ef17146baf33fbf09ffbde6ae971d04e8e8f9222
SHA5127cdf3552341d14979838f8fedf9ac63482152f193ab8f7e0af281ec50b2a43312d78c0e22e79989818c5041538fa69769350e1e6cf0789a165be1eb11ee29908
-
Filesize
589KB
MD5896778e805fd9e72373aab3c43df9237
SHA10ed9dfedce62922b1cd2023c4078ea97d642f756
SHA256f2bd126fb14059a46f3f2a5ae811aebad60c86acbcbdd66b82886f102ad681f1
SHA512d64ecf52922b1fa9e68280f6ce252b71fb59005a749fe7c1b5de4782d4f507ac1e50c52b8fec4b460e288948cf0cce385f4b819b1c842fd85c7147d3ef436d40
-
Filesize
477KB
MD5f15212540a65077c284979bdbdd8e3b3
SHA16f6b48e3f7e36d59f63ab872b3a8636c3ffd3156
SHA2568b689f4686d36d4d13921904ecf3a10078060fdca92c96cdd5f18bfd1807461e
SHA512ea003d4cbc7b248da56287d899090dba3111279c771e68bf97360a2db241f6361cf38fbdc22865ac1d4432c7e2ccc484e61980d89c27754561fd0bc7e8ace2e3
-
Filesize
645KB
MD5eb94894d2f7486226b31ff1041a4cb7d
SHA159cd6910c33d6b6e452918d8dd26edb16b496f22
SHA256df47f42a36a60d622259f310e96a7ba13d386f3e718eea887b8f6f450c1eb583
SHA512f65e91cee6ed3c012162d97d30beb136966675bb82eca5e3c15dd817ec739202ebc7455eab26cd8e85486525cb4f578b06450cb0cb16219a55f377c3922b9e1c
-
Filesize
267KB
MD580041d729d8dec5efe00998dd0ed9267
SHA14eac87819ac7d620fc37c8eba3330dc707089455
SHA256e4414ab9cd1ebf1ebf2fd9a07a97617be5f2b5bfb33f0ceb3959ff8b6a4c225b
SHA512f2a03a78bb600a191d42a13eeed64eb97c7b79f4b65548f92d8746565c14adea595710af162221eb152d27308cd490107795be9b0b2be723b8ee83a3cbf0cf85
-
Filesize
350KB
MD5f8fb5aed8c112ee9f1cf94290eef67e0
SHA175f26e036e92d231fbac7a79ebdb09d2feb83edc
SHA256d3c41f3179fc8fc60ac1532300bffc28a9f8c1d5da05f4280ddffa57417faf0f
SHA5120104731192490a84637cc0e467577e4f4acc1220a3adb59f5a5c01368e731f2c22aea18336d0aa98575c9620990362c841047e3ebb1a5843cb8a4d4d60931a2f