Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
295s -
max time network
297s -
platform
windows10-1703_x64 -
resource
win10-20240214-ja -
resource tags
arch:x64arch:x86image:win10-20240214-jalocale:ja-jpos:windows10-1703-x64systemwindows -
submitted
20/02/2024, 17:00
Behavioral task
behavioral1
Sample
batexe.exe
Resource
win10-20240214-ja
Behavioral task
behavioral2
Sample
batexe.exe
Resource
win10v2004-20231215-ja
General
-
Target
batexe.exe
-
Size
9.4MB
-
MD5
cdc9eacffc6d2bf43153815043064427
-
SHA1
d05101f265f6ea87e18793ab0071f5c99edf363f
-
SHA256
73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
-
SHA512
fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
-
SSDEEP
196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2480 b2e.exe 3892 cpuminer-sse2.exe -
Loads dropped DLL 5 IoCs
pid Process 3892 cpuminer-sse2.exe 3892 cpuminer-sse2.exe 3892 cpuminer-sse2.exe 3892 cpuminer-sse2.exe 3892 cpuminer-sse2.exe -
resource yara_rule behavioral1/memory/1596-6-0x0000000000400000-0x000000000393A000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1596 wrote to memory of 2480 1596 batexe.exe 73 PID 1596 wrote to memory of 2480 1596 batexe.exe 73 PID 1596 wrote to memory of 2480 1596 batexe.exe 73 PID 2480 wrote to memory of 4448 2480 b2e.exe 74 PID 2480 wrote to memory of 4448 2480 b2e.exe 74 PID 2480 wrote to memory of 4448 2480 b2e.exe 74 PID 4448 wrote to memory of 3892 4448 cmd.exe 77 PID 4448 wrote to memory of 3892 4448 cmd.exe 77
Processes
-
C:\Users\Admin\AppData\Local\Temp\batexe.exe"C:\Users\Admin\AppData\Local\Temp\batexe.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\25E2.tmp\b2e.exe"C:\Users\Admin\AppData\Local\Temp\25E2.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\25E2.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\2B8F.tmp\batchfile.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.execpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3892
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.5MB
MD58641866a5b1ecfad5b32eda6dbb995aa
SHA1e5681c6066957cc93dcb7b27e1a5ce00131f6ef1
SHA256a538d9fcebeece05f2a0fcae86166047ff6c2506fc4db77ec91ce6f98d4a2695
SHA512ed707312261de9d39037e71a630cf8e1671134815535f3216ba7cccb3659d1cfaadc990b7524859b419a47fbc5c073576933fe9e3c4e5b611c0eaf1987b0b590
-
Filesize
1.6MB
MD532403a0f0a3cc3d7458ccc3777359930
SHA1d96420ee45115464ad67426c1b6d1a1bbbc2aa8c
SHA256c7a759fdd30b72a98d859b284ac06468d924e7250ea5e0c494cf483fafbc8a30
SHA512b698abeff4efa20a18a90098a2c87c0989a912464900a70d4d285716282e715f2cd828698c64742e8525d22a924b563daf95578a7aa4958fef4470c301c945b6
-
Filesize
136B
MD58ea7ac72a10251ecfb42ef4a88bd330a
SHA1c30f6af73a42c0cc89bd20fe95f9159d6f0756c5
SHA25665e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9
SHA512a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0
-
Filesize
62KB
MD58c6d0df9d5f5a18f599c8b6b3d784b05
SHA1692d57efb286474dad9e3fcd6088d7a2512bb2e9
SHA25636fe1224c9439a6a13c950ca3b938e014f921e01f2db7c26952d68c0de5d754f
SHA51287749f444c89f51c3c4fe7bfacd2117fc8c5d6a3934218d9e62941cbba47b8fb9af6952a782d89ae13f755691349143de3fcb098dc59d63c33a4099186c2760f
-
Filesize
593KB
MD5bd9e585f378b30753e3c370163fb62ae
SHA1a474e9467d15c08cae49bcef4e078462ed193d40
SHA2566a5d435854ce3020fa4f1f7724a169f191bd8f6fbdd5d7dc3608e5f68b1a9751
SHA512668a48cea9e82ced152db41c83f1aaa32c8f4f7b71a7a722e2fe31fce5ef191d93863c1d8dccebc87758a0d41f8d67c4e796b867f20aedc1e765bcdad0bca1ac
-
Filesize
528KB
MD5034a913710afe2b515d1539c0bd9fb1e
SHA1084c55f2796d8c34fc3d283ca6439fb053eefd70
SHA256b050ae160b2b34492c40597bc064b501bb03928e3b6b3dad2c98cba7e2b7d125
SHA512d32e16ec5063a6b42813819ba27bf19d3227acf73d46dd61dca6475b81792287755417ac91982459a5aadd186c4ef5e5964a2ee764dc67ca678671c931f830f2
-
Filesize
471KB
MD50d6f224d6e71dee638264b6ba75ad93c
SHA16ecf9a5106c280da007e4073da999f7b33307c92
SHA2561c2c2822bc10045522336ea5cdacf0dd74b7a5f944b34f5609e90a57ce5c4b92
SHA512f804316abebfc6d49a76b2e63a23e0e7744385fc0da128b405e268d1e18b2954bf4c8aa841a745401ff59ea382c1fd2f020203968f61b778782557c18a1304f2
-
Filesize
363KB
MD5e73b8b463157675401fe5c7324dbfa66
SHA14b726df127db19e2e08dac088809b75bf9867b01
SHA25642d669c9fb7881d97ba58c46997f69e31c01107999187b86f317ea34e9cd6aff
SHA512bb56a7e2b17f08a1c57a020ff9644a5ffe3ede6c0280f2a5d5451249ce5e4a2dadca0e7e939eb72f8335580703d5d78a029216c6e88fefe631da94d690851a35
-
Filesize
458KB
MD5d3ba66995c3fb0df4c69e9031b50a7db
SHA1a754bb8bce484b500cee87715969aed22049d761
SHA2569a6222e5e5974a1fd1a087070fd3f83404f6861263c90dc61aab9784abf964c9
SHA51269835e1df98dce3da9680c08e2653495482df7c29a8008d8c44933c1913132c08a40155d13482a4a69808c87e4aaa4817cdf00ed1394e924e34f3a415adeccfe
-
Filesize
497KB
MD572d6fdeed6480d3be9cf2aa8d581d6c5
SHA16f8eeb4f3c2618393817ee874fe2197c4110c32c
SHA256e2867bc57e8b55bd8146160dfce1d6eb67f6c94b89bc0c075f272bdd70f2d4a7
SHA5121e4dfe10780f67529c50f61199baa9b5305c30bb90c2d87943ccc6a7dcb64afb60de66b6e9f6673c342c1b3ce84248058c5bfe11d62cc53960f84121b51e6f0c
-
Filesize
598KB
MD57ccab725f0ff5affd0c8828918aff8fc
SHA170b226ceaf866cc948fc87b9a0cccf9e5299ccd1
SHA256e62cc19ab764e53db81ed94de5ffb1b706e5628a70aeb3f652ac9f58ddcffa2c
SHA512ae2f2ea3b499508f1eadded7545953eb6f05ef61db43a49ee731adb19836b8298f7b65a448ec190959f7cf07b200a2e459c5b6b199506a768e915112f1c5a8ba
-
Filesize
415KB
MD51e1bcf8aeedd6528851c64f28e062206
SHA1bfd261d850c582413033d03cb4efc0093b97e6b7
SHA256d87ddd7fde4a4ba028ba89bfe5ac8802d394edc619eff503fb6d89bdbb858619
SHA512b6239b45f709808f3f64d4ee6a690c809a66f408c98fadcc9b64299d4c4c547c6eeae00029b920d9d5d04006aaa1dcc367954d7f5616ebd03b3abda200820cdb
-
Filesize
677KB
MD56daa123d4e3edd30947ef65a72f773cb
SHA103f8ba3d7f8ec15c470e88daf63f5e7b6d0facd9
SHA256eb9e0fc6241592fda3794f63e9950c69581b1ce6648cfb53bbdacf0ac7692dad
SHA512f00a7a0a60cc62018b56e166ff6853ef75b2bd36e14e90bb0972758dae8d73749127a575e2b8c869a3984b0da165dbd2439677ef48655c346bd38cf8fba87833
-
Filesize
606KB
MD5585efec1bc1d4d916a4402c9875dff75
SHA1d209613666ccac9d0ddab29a3bc59aa00a0968fa
SHA2562f9984c591a5654434c53e8b4d0c5c187f1fd0bab95247d5c9bc1c0bd60e6232
SHA512b93163cba4601ed999a7a7d1887113792e846c36850c6d84f2d505727dc06524bb959469f9df12928769f4535dc6074a6b3599b788a4844353e466742ce1e770