Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
298s -
max time network
293s -
platform
windows10-1703_x64 -
resource
win10-20240214-ja -
resource tags
arch:x64arch:x86image:win10-20240214-jalocale:ja-jpos:windows10-1703-x64systemwindows -
submitted
22/02/2024, 03:16
Behavioral task
behavioral1
Sample
batexe.exe
Resource
win10-20240214-ja
Behavioral task
behavioral2
Sample
batexe.exe
Resource
win10v2004-20240221-ja
General
-
Target
batexe.exe
-
Size
9.4MB
-
MD5
cdc9eacffc6d2bf43153815043064427
-
SHA1
d05101f265f6ea87e18793ab0071f5c99edf363f
-
SHA256
73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
-
SHA512
fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
-
SSDEEP
196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 3220 b2e.exe 5096 cpuminer-sse2.exe -
Loads dropped DLL 5 IoCs
pid Process 5096 cpuminer-sse2.exe 5096 cpuminer-sse2.exe 5096 cpuminer-sse2.exe 5096 cpuminer-sse2.exe 5096 cpuminer-sse2.exe -
resource yara_rule behavioral1/memory/4648-6-0x0000000000400000-0x000000000393A000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4648 wrote to memory of 3220 4648 batexe.exe 74 PID 4648 wrote to memory of 3220 4648 batexe.exe 74 PID 4648 wrote to memory of 3220 4648 batexe.exe 74 PID 3220 wrote to memory of 3884 3220 b2e.exe 75 PID 3220 wrote to memory of 3884 3220 b2e.exe 75 PID 3220 wrote to memory of 3884 3220 b2e.exe 75 PID 3884 wrote to memory of 5096 3884 cmd.exe 78 PID 3884 wrote to memory of 5096 3884 cmd.exe 78
Processes
-
C:\Users\Admin\AppData\Local\Temp\batexe.exe"C:\Users\Admin\AppData\Local\Temp\batexe.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\D31F.tmp\b2e.exe"C:\Users\Admin\AppData\Local\Temp\D31F.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\D31F.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\D5DE.tmp\batchfile.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.execpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5096
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16.0MB
MD55a80831f858541d2813357b3eccfca93
SHA16a7ee6b37154c4e4bcc1d7a985adf006df4885c1
SHA256de474b47958f0c44df02bca6d471c57803b4921574d80782381007d3c8005a42
SHA512ba82abaf7e8547c56b7dbdb65efe369865e6701a4c9650f2e146826be6c04fb08b9a6b4639d82ec03c410e9971a0f21638a4af8fd6a7f4bc99d369fc82f7cf16
-
Filesize
11.8MB
MD5a132b15ca428dd9af883c530355ef778
SHA1bfb8de637f523aa2c1aa2031f5446fae8040e857
SHA256d26d6611457d0ee7bcf19cfb11161a1dc4513e7d54a058441e12068d454507df
SHA512cb12dd3f84aa6947015b295abdf89b65124b9217fb466ecf6441dd139289408adbb78473a007f2b4d215b46aa19df4a1dc566b087acb4b9082e5391010e8f8a0
-
Filesize
136B
MD58ea7ac72a10251ecfb42ef4a88bd330a
SHA1c30f6af73a42c0cc89bd20fe95f9159d6f0756c5
SHA25665e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9
SHA512a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0
-
Filesize
768KB
MD57511ee8c66d17030a4f24226caa425c7
SHA1aa5bb6b2306f01ac82133f54ec36ca2491fb1911
SHA256e9ad1acfa96a3be152713809498617dacb74878ed3ac3ed4e5b1455cf1fa5ac5
SHA5124838197b397552aa7c22ca54d27ec420df0629689e111c40068480f5e37879bfbc89c84245ae8b0a6b4a16ee7d75197403153151eccbbe468b252f508e8466ac
-
Filesize
320KB
MD559d36bdd941feb6c770ec68a37e8c21b
SHA11191d1e478164cd720974ea1ad2bc248999a8d45
SHA256d5227dca74d9be12116b359c9d61265b102c0986eb6196e269cc3e3b895c0293
SHA512b1620dd0763f2f7c263ae69c71eba7cba29d89f1bb551356abb7073e4e7013347345c43f2bad3c4733300c5b98feecf2fd91db2a363c9e5dcdd87f170edbe406
-
Filesize
448KB
MD58185100383d0fe360c9198e5a883b08d
SHA1ab398c469573f8e84d3cfcef01287a0604d6ab5f
SHA25605ef7288b0d559bf67c3d69c201da9bdcaed0b49ecc538640f7b96c5b82eb538
SHA51224930ef0caa1f2db2ed60f7dfdb832a172cf7747b0a336b051f73c0087a5f2fabff721487cb49cf5a3bc2be5426554b0a3a0e51541b6a4ca735646af24f1404a
-
Filesize
384KB
MD54cb3a8d3af58faf78da4dd33a03029db
SHA15356e4fb04a7047f6fc82a4e071e4803f97a0f3d
SHA25686df790940bd442466ea58a434a31aaaadd1d23a9e9bf5e6fe625ff49049d620
SHA512244237f4a13a7666e9f9592451dbb8bb18ca1f828d66f97e2890fa8f6be690d8890848102a8be253542c9f4b154d9f0e1aeeee5a867c866b78b64f9949f48c89
-
Filesize
320KB
MD51ae43cc09627ff82d15527ea2693fd76
SHA1c39ffa1a4b80c29fa1f5caed3e7d091253266c66
SHA256b63980c9d592a6d0d8521f74bd4c6f7cc4ae5f8c3320d2bd63764c56648ac45f
SHA51221945e4e2fad3ee2b2a19d19bbbc1ada832c33a0d3bf499d6ac8f093b39021323ea0f7df3d54167a3456cbaf01ff126a6e6abbe17dd4eb8d5a24ca000888c271
-
Filesize
448KB
MD519a61444b6e2d01755ede80960bca19c
SHA1e0c7222784d3e2b3329ec3280648b17fd60ef209
SHA25613fd488b38f3b75438e9ad0a033df005cd397f3c92f43275714a0a7eb3fb4db8
SHA512bc02c82bdac19f10f3e3a93d3f507bb7838c9255b7cff5af6e3a7f3b471dae9c45c52728c3c23857b3402dd1702cb51a20f225a4da992c26a997c26d86b6b1d9
-
Filesize
320KB
MD5e63bf5df87e2ea807dc353cc5aa9aab1
SHA169fc94bbebe878711cb133c3a1affb80c0bdecff
SHA2562c9d6315f90367b959d3c32badd99bbc03eb808e4a46db72ccf2e81788b41533
SHA51270f2b2a8a4c8ab23d81266cd23b75c27ced29a1eab8c80d95c57b595b10254b7229cc03b637716edbfad2a83827f2c557847b98d1de80256beec05c9512ee4bd
-
Filesize
192KB
MD562069650d62f76a4cdf0e81172d99993
SHA13b20ec5b4a4320ee15b0f7b9715a9ab90f68346e
SHA256779a5590c667d9a704b79e159259c0646737394fd66a9c0b12d13f9445ca091c
SHA512ae1954a84fb7543465e77a4cd5cc1bdeee0cf848592958633e6c51702b42131daae64c302d5c9537c59a9b3ba9498e5bf913d1f6f757ccdb8c4183b33224852b
-
Filesize
256KB
MD5eca0c37eee65c31b869788d5d0bf00cd
SHA133a5c0cd2f0a7296a5c0169699ed8e065b57e5e8
SHA2561d2b7bd4ddd99d627d5111252baadf028dc9910cf414892867502e5951de962e
SHA5125f302da7772fca0a6d03ffd8732850f526acf5fcc33e189d2d906a33101454d970d5cca2f829a006d15c4a857341d72c7876cb2e7af84ada4f158695aba5a4dc