Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
298s -
max time network
303s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-ja -
resource tags
arch:x64arch:x86image:win10v2004-20240221-jalocale:ja-jpos:windows10-2004-x64systemwindows -
submitted
23/02/2024, 06:02
Behavioral task
behavioral1
Sample
batexe.exe
Resource
win10-20240221-ja
Behavioral task
behavioral2
Sample
batexe.exe
Resource
win10v2004-20240221-ja
General
-
Target
batexe.exe
-
Size
9.4MB
-
MD5
cdc9eacffc6d2bf43153815043064427
-
SHA1
d05101f265f6ea87e18793ab0071f5c99edf363f
-
SHA256
73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
-
SHA512
fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
-
SSDEEP
196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2828415587-3732861812-1919322417-1000\Control Panel\International\Geo\Nation batexe.exe Key value queried \REGISTRY\USER\S-1-5-21-2828415587-3732861812-1919322417-1000\Control Panel\International\Geo\Nation b2e.exe -
Executes dropped EXE 2 IoCs
pid Process 2996 b2e.exe 5812 cpuminer-sse2.exe -
Loads dropped DLL 5 IoCs
pid Process 5812 cpuminer-sse2.exe 5812 cpuminer-sse2.exe 5812 cpuminer-sse2.exe 5812 cpuminer-sse2.exe 5812 cpuminer-sse2.exe -
resource yara_rule behavioral2/memory/5088-8-0x0000000000400000-0x000000000393A000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 5088 wrote to memory of 2996 5088 batexe.exe 86 PID 5088 wrote to memory of 2996 5088 batexe.exe 86 PID 5088 wrote to memory of 2996 5088 batexe.exe 86 PID 2996 wrote to memory of 5816 2996 b2e.exe 88 PID 2996 wrote to memory of 5816 2996 b2e.exe 88 PID 2996 wrote to memory of 5816 2996 b2e.exe 88 PID 5816 wrote to memory of 5812 5816 cmd.exe 91 PID 5816 wrote to memory of 5812 5816 cmd.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\batexe.exe"C:\Users\Admin\AppData\Local\Temp\batexe.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\9B17.tmp\b2e.exe"C:\Users\Admin\AppData\Local\Temp\9B17.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\9B17.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\A1CE.tmp\batchfile.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:5816 -
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.execpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5812
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.0MB
MD5e74800cc7ac1c8cd226ac0d2f9265f4f
SHA104ff71a9ec13cca7403c667717d50b09aba72975
SHA256bc5af6b83f6a4c9e3297e0f389fc73fd3c073b2346a4a2baadf15311e69714e6
SHA51263c91452844800e525d9a5abee57f1048bbf3b18e8ceb01cc4e2c0c877a5389bddd0889dd2402948e65c8f8dfd035dc277d6b6dd4e2766cc3368d66ad45d3706
-
Filesize
3.8MB
MD58782954c8b6aac082ecc8b96cb0fa380
SHA12fe2dfb712df083d04ef662151f7a323078cdbaf
SHA256472a521487323090d233b2931089d485be932bb7b1df7cc096c8b498ff04a73b
SHA512d8a809cff6a7fa2b0762724eabda592db73e20311c184937574671be8cdff033ed4b9886992aa225aa923449c5a5a7949bcd5194ac26972001b95349506beb31
-
Filesize
8.4MB
MD5ba4fbe613508bfe8ac6238466ba6b2c9
SHA1877f1b18a118f5d5c6450c721e9843c4ae5fea31
SHA256f6fdb67a67aafccbeeb8742f0c7e8cf003662871a07d7fd982bdf82a045eba03
SHA512323bc06a632d2bd64214907360208c903760dd6924821ffc434385d667cd1618dd75343d44335d66cdf9ebd5f115c2350a0b2e01412d35ef5355a66b1b4ec37d
-
Filesize
136B
MD58ea7ac72a10251ecfb42ef4a88bd330a
SHA1c30f6af73a42c0cc89bd20fe95f9159d6f0756c5
SHA25665e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9
SHA512a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0
-
Filesize
807KB
MD5ed4c24855bf149d4f3f11eccc2d31484
SHA121c86aa9d43cae6bb0d6ef6ea2973019ab1e452a
SHA256ee81e8f7b521d58369ba72995eba181fd5dfbfa23733d8e9c3cdbdb0c7185a30
SHA5129f2c8c5c32f60017c51d82d05f58c019eeba7e026bc296ab99c4cc7e2a3620e85fe58efce225db5ccddc6052f0f626fd7b8b693007a3aa271370d07c8764fd24
-
Filesize
576KB
MD56e18fc4eda8ed0e6aa6ed56f84803ab3
SHA1e4a0a4432fcf3184baae1b01a8cb771ed580dbe2
SHA256f51cf1f35d722b4af4bde30de5008d67d7256d271953eeb2ff63780978f4a53f
SHA51225f97a3a07fd0aed4a5e6bd58e4cc3ebc2c56c0a314103536e9342ee10aa3c01baa24b459fb58d7154808594203e2b4fddc23f6c424182e2e8bb3a978b4dc256
-
Filesize
512KB
MD5a5993c0dd7587f1716037dcfe1f63091
SHA19a4d23ce36f5fc5791692b47d977c0bf92842879
SHA256568cec1e1bdccf401232a78c8ecf2081fdaea221f0a7c777a69ec61307cca3e3
SHA512c5457590162dc1a0fd6b179ba94f19e6265e2ca226ea1ec553358f568690bbc158335ee92c297ce699b2928d44702733269f82640d86bb499c1981a5903afc12
-
Filesize
448KB
MD519a61444b6e2d01755ede80960bca19c
SHA1e0c7222784d3e2b3329ec3280648b17fd60ef209
SHA25613fd488b38f3b75438e9ad0a033df005cd397f3c92f43275714a0a7eb3fb4db8
SHA512bc02c82bdac19f10f3e3a93d3f507bb7838c9255b7cff5af6e3a7f3b471dae9c45c52728c3c23857b3402dd1702cb51a20f225a4da992c26a997c26d86b6b1d9
-
Filesize
512KB
MD56162b21c54b88c5c990e82aee951ebb4
SHA1477384ab8ebe5f5a5d5a91603736d9ef53c12fd4
SHA256462eb68967c7205145d0b92e4f3b69297f616187b07a189178f35f288063aff4
SHA5126264ee49c4b8a6eaa69241e10ff9ab39445f85a57b756b8bc0530b45d77827d05e669dc06b689d4693db34e4161ef11b2cfe6f1954b0b90bcd434e81a938a40d
-
Filesize
384KB
MD5b91f7bb5508b343188ec32dcc7880611
SHA1fe2ae7ba4a1bbb2a5df7b73f21a0b8fc745cc11f
SHA25647881756cdfcb302e63efb2016c122a1bb61574d81186275aef3d5a9fb72b84b
SHA512a5b91bc653cbf28219b6f169d5d849fb53eced9a932b8edf468c9092544795ee8120d5c76f0c45f27b7a2464c328f5bffcabf3e83d2e7236263ea930cf92eea0
-
Filesize
448KB
MD5ca123cec7f705c0af114e462349dc686
SHA175f90b4d95f6774b2f66e4ba790755ef118ab222
SHA2567f141cdc0be9c965e21310bcfb0484b20d31ffd8a6a970f8b5a53c0e8974798a
SHA512650125faa9ae6733f1118caf3101ca6850473f78f9bfc3a87e908eac1c69935e3bc269ffb5de4dd6e867429c1af35c7f3b9e62eb698fa7c9695d68e7115f3f1c
-
Filesize
384KB
MD54cb3a8d3af58faf78da4dd33a03029db
SHA15356e4fb04a7047f6fc82a4e071e4803f97a0f3d
SHA25686df790940bd442466ea58a434a31aaaadd1d23a9e9bf5e6fe625ff49049d620
SHA512244237f4a13a7666e9f9592451dbb8bb18ca1f828d66f97e2890fa8f6be690d8890848102a8be253542c9f4b154d9f0e1aeeee5a867c866b78b64f9949f48c89
-
Filesize
448KB
MD59d1a04f05f75671a5a3ffeb995176c52
SHA1a45018bb6a5dd52b310c1eb77262354365925a76
SHA256c777e9d786f5d1d13f78a925453804bf53ee430a38f893f115c2d1ac0f2f07ff
SHA512d19ea63c26c1d41edd5947d0c5ae70e2461c876563c2baeb1fd4a3986254f7919f8d4c32a9d6b9f4c51c4d5a23ffa90a2011d293a106a0a8813295b2bee06e1f