Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
293s -
max time network
301s -
platform
windows10-1703_x64 -
resource
win10-20240214-ja -
resource tags
arch:x64arch:x86image:win10-20240214-jalocale:ja-jpos:windows10-1703-x64systemwindows -
submitted
23/02/2024, 04:40
Behavioral task
behavioral1
Sample
batexe.exe
Resource
win10-20240214-ja
Behavioral task
behavioral2
Sample
batexe.exe
Resource
win10v2004-20240221-ja
General
-
Target
batexe.exe
-
Size
9.4MB
-
MD5
cdc9eacffc6d2bf43153815043064427
-
SHA1
d05101f265f6ea87e18793ab0071f5c99edf363f
-
SHA256
73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
-
SHA512
fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
-
SSDEEP
196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 3372 b2e.exe 4660 cpuminer-sse2.exe -
Loads dropped DLL 5 IoCs
pid Process 4660 cpuminer-sse2.exe 4660 cpuminer-sse2.exe 4660 cpuminer-sse2.exe 4660 cpuminer-sse2.exe 4660 cpuminer-sse2.exe -
resource yara_rule behavioral1/memory/424-5-0x0000000000400000-0x000000000393A000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 424 wrote to memory of 3372 424 batexe.exe 74 PID 424 wrote to memory of 3372 424 batexe.exe 74 PID 424 wrote to memory of 3372 424 batexe.exe 74 PID 3372 wrote to memory of 820 3372 b2e.exe 75 PID 3372 wrote to memory of 820 3372 b2e.exe 75 PID 3372 wrote to memory of 820 3372 b2e.exe 75 PID 820 wrote to memory of 4660 820 cmd.exe 78 PID 820 wrote to memory of 4660 820 cmd.exe 78
Processes
-
C:\Users\Admin\AppData\Local\Temp\batexe.exe"C:\Users\Admin\AppData\Local\Temp\batexe.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:424 -
C:\Users\Admin\AppData\Local\Temp\B277.tmp\b2e.exe"C:\Users\Admin\AppData\Local\Temp\B277.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\B277.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\B546.tmp\batchfile.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:820 -
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.execpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4660
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.4MB
MD5515295c525ed629d7669467e7cb2f43d
SHA10efd58352ce49e026e48dbf41afa0cbcbf727164
SHA256ddc77744adc32f9c072f785aeb015274c25a71f8c4858c57290ae80523cbc0ba
SHA512f18ccf4acd419248c2f5d3fc1f2df5d8bb9deece8cc35dcabecb80900aa970f2d03176b1945b5c62b76eb04bf169b3a9403251871671030ec2c7d93ae4d3b601
-
Filesize
896KB
MD51f22d8bf5f6c3dda3e880ea1ba0417d4
SHA12a8dbf2319999a894714bdea650eb5be32c64c19
SHA256afb7da96abe31529f462178372c48627a7e681e3c18cd2196aec8beee07f5b96
SHA512217b89f6a74039807c135539482b1a769d715190f7756e2b0162a33da3d8ada909b80ca3fc1596e542f163f6a45726282997f4e52a36c352cc89b9e58c1e6e05
-
Filesize
136B
MD58ea7ac72a10251ecfb42ef4a88bd330a
SHA1c30f6af73a42c0cc89bd20fe95f9159d6f0756c5
SHA25665e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9
SHA512a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0
-
Filesize
1.2MB
MD5d320092317674fcd03cc503215ee7032
SHA103cc6954b1b3ccf65dad9877b803e8f09900b3f2
SHA256f577772d997044bea2772e4c6f223cb8e2da3f067e82fadeecbf9d8ef7181406
SHA512af544eb5eaef39851cd88eaa72140c8e5dda36c84308f235de1ba9958a16cb3805bd46b0d4b0c8bba4931ff5bc854e7ad9ae77220c19ad7a1da1a4c7f42c08ca
-
Filesize
836KB
MD5aeab40ed9a8e627ea7cefc1f5cf9bf7a
SHA15e2e8ca2881b9bf9edfa3c4fdcec6da1efa102d8
SHA256218cfc4073bab4eddf0de0804f96b204687311e20a9e97994bff54c9b0e01ee9
SHA512c0a67616fa01fdc351015212a718faf70da6612fbb3ec13da28dd7af9a507c56882fb7c3eea6fbc37d4d63b970157199d16d0756dbe3cb3bc2223e215cb104d8
-
Filesize
1.2MB
MD57cf672bee2afba2dcd0c031ff985958e
SHA16b82a205db080ffdcb4a4470fce85a14413f3217
SHA256c82f84171b9246d1cac261100b2199789c96c37b03b375f33b2c72afab060b05
SHA5123e90d1c1efe0200cb3cc7b51d04783a3cce8391faa6ce554cff8b23dac60be9f8e4f980a8ac005fd9dff8ea4bdcb02311f7649c5be28eb32dcc26417fc4090e5
-
Filesize
1018KB
MD5e9a22bc1f3ecb5e2b7cb926cb9716b18
SHA12e5da4946647b60e3b13aa4291eb9f76c2290129
SHA2564944600f5b2a338b78eacef3beb8f80af83883c125e306dd73d64fe676df53a9
SHA512a203b49e75eebfd2f205eb42599c755e1b4af0d165da5d1d94146a7f09104356b9c44b129f15fa83f072de43411990c73f096d4377b003022f1d12eb2a0644ce
-
Filesize
1.0MB
MD52bcbecdbc1c56b2a3620957dc5c81ad7
SHA1cc389bedd9d2230891da422d7d9cad706980390b
SHA2565f82dc711de5b78e7532d1be93d21143679e1ade8140d60002b09652493996f4
SHA512d8a3ee6fad099709d44249c5b25b6c1fafe68b3223dea62f224a0788c47e495e23556baa01983af03276ccccd95b9a93da4e5e9403d5a970c83c6b9853effd94
-
Filesize
1024KB
MD561f1013547dc4ad24f8c5338c41931c3
SHA14a9f72fe7e71046ecd3d5af6443f195a6051430b
SHA2562a65749eaa95c5c90be12d11587a82432933aabd60e8854868bc7168a36150ee
SHA5126604219c7e5d583e8cc6a1f407e9964ab39791026857d17c9de25d3a4a8bb0272d491c6c019643eeeee8a2bd3451f3e0b75298e043777d44b8f3a161582c9b40
-
Filesize
1011KB
MD523a6e6de35e8cda9ea56fb990d716006
SHA1edd8355ef80aa43a4d17e11413a25bc82dfd3094
SHA2569e025eca76188c31bfa964c89f0cfdae59341bc002dbeee8c1e653d778a0c550
SHA512e1fae3693a6342c37bb9fb00766761a2a2a98b0334be2b886b388bb146253288477d1e911ae15b0adf9d45e01fb7825babd6d64b55b5ab579532adf076918b37
-
Filesize
606KB
MD5585efec1bc1d4d916a4402c9875dff75
SHA1d209613666ccac9d0ddab29a3bc59aa00a0968fa
SHA2562f9984c591a5654434c53e8b4d0c5c187f1fd0bab95247d5c9bc1c0bd60e6232
SHA512b93163cba4601ed999a7a7d1887113792e846c36850c6d84f2d505727dc06524bb959469f9df12928769f4535dc6074a6b3599b788a4844353e466742ce1e770