Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
295s -
max time network
300s -
platform
windows10-1703_x64 -
resource
win10-20240214-ja -
resource tags
arch:x64arch:x86image:win10-20240214-jalocale:ja-jpos:windows10-1703-x64systemwindows -
submitted
23/02/2024, 15:56
Behavioral task
behavioral1
Sample
batexe.exe
Resource
win10-20240214-ja
Behavioral task
behavioral2
Sample
batexe.exe
Resource
win10v2004-20240221-ja
General
-
Target
batexe.exe
-
Size
9.4MB
-
MD5
cdc9eacffc6d2bf43153815043064427
-
SHA1
d05101f265f6ea87e18793ab0071f5c99edf363f
-
SHA256
73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
-
SHA512
fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
-
SSDEEP
196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 4652 b2e.exe 1152 cpuminer-sse2.exe -
Loads dropped DLL 5 IoCs
pid Process 1152 cpuminer-sse2.exe 1152 cpuminer-sse2.exe 1152 cpuminer-sse2.exe 1152 cpuminer-sse2.exe 1152 cpuminer-sse2.exe -
resource yara_rule behavioral1/memory/2180-4-0x0000000000400000-0x000000000393A000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2180 wrote to memory of 4652 2180 batexe.exe 74 PID 2180 wrote to memory of 4652 2180 batexe.exe 74 PID 2180 wrote to memory of 4652 2180 batexe.exe 74 PID 4652 wrote to memory of 4992 4652 b2e.exe 75 PID 4652 wrote to memory of 4992 4652 b2e.exe 75 PID 4652 wrote to memory of 4992 4652 b2e.exe 75 PID 4992 wrote to memory of 1152 4992 cmd.exe 78 PID 4992 wrote to memory of 1152 4992 cmd.exe 78
Processes
-
C:\Users\Admin\AppData\Local\Temp\batexe.exe"C:\Users\Admin\AppData\Local\Temp\batexe.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\BC89.tmp\b2e.exe"C:\Users\Admin\AppData\Local\Temp\BC89.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\BC89.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BFC6.tmp\batchfile.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.execpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1152
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD5c8ddb9a1b99b955d28ce987616dc783a
SHA16a50a41aac042de84cbe5fe9cfa8ef171c1a15ba
SHA256d42d045c7eaec84a0576fa2d1e67566cd65686605e6f66217c2da6ec9faa060a
SHA5128804aa717bb5d9a88543175afd4ed3363ae6d1ff9846379f9bbfb7ff1b49cf0031fd6b1cbb0b1491a94d1158663021c8bf56c47050f3192b62a0c5bb5499d397
-
Filesize
1.2MB
MD505f6765e8266a1a7d81a80da7788444e
SHA1e7afd0bf0dce889a026f4233c6705907083e6e23
SHA2563256219f071d9bbeb2b3483abc7e647cbb550c0b74c415ace444bd8a334df9e8
SHA512417d266a6eae32d630cf1322d3ab78f8547b09254ba3b5e2e544a7fd294de819754ab2f104ba2f3cab59a1fcfe7b0ea6f622712736079b7eec12a242b914293c
-
Filesize
136B
MD58ea7ac72a10251ecfb42ef4a88bd330a
SHA1c30f6af73a42c0cc89bd20fe95f9159d6f0756c5
SHA25665e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9
SHA512a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0
-
Filesize
704KB
MD5ce5f200d2d48a057722a957d5acc6426
SHA1e7a8d4c0dc7b561dfa26e3fddaff015716187305
SHA256cb450c8c0a952560f35f4b93f14357fc3856ee0b016eabf8bb4d20e9504d82df
SHA512e7d3b203cc96d08b6d000f6845bbeb5777cd08babadbcb86266193ca68d8183973b3a92f5cf587df1f26bf04a182fa51001b7317c9a9e7ba868d1e26b897ee9b
-
Filesize
512KB
MD5a879c5fd4613dca566d5b1a782690dd5
SHA141c6063b0f0dee953e99713a5326856b55e08366
SHA2563ee76359d6802a8fe11c5b144e18ffd3833bc7b49d66f190621d41e41ea0fc20
SHA512e20f8f40822ca215c75767b8d4102583cfb3812c74dbc064a8619f214c164ab94da6bee0ae42c794a0af1847ff30c295b34d3015f87bfe597dba80339871ea96
-
Filesize
256KB
MD511e8812bfa1d698cdeb73a16c1d7c963
SHA1e8708fd452ab5946b380d0c353ac26acf289e548
SHA256e0f9ddf8afd30511763f0cf792369e32c955f15d9529c00c5fe9298a80d74402
SHA512fd54c9c6f3520b2ced6b42235ebfce6d8b622c53f1fbf810baace657a7d44430968b5ff90cd1d860dbdf7550dd8cd467636c862ff0dd0832f25145efccc7731e
-
Filesize
317KB
MD5ee0679036f5a3b4fc0b92e1653e9a444
SHA1279481a31cc908cd24799529d989e612f266739f
SHA256cd234d4fde22f87a66762a0f10106395a78f2c72f6ef9c7d235f07782deb62be
SHA51250d4f5df9592aa2c3112c74dfa0be7de274ba8f5bc854f8f2656df39566c2a76e39af66817e602b93f47a5be717e055f906fdf35fb677707e64e383a0cf0d138
-
Filesize
256KB
MD51d86b9560854472453237bcbaa2e253f
SHA15a03a7902d250377a3e9f746badcb696e2c98228
SHA2561493703a430c68bdcedcb4078486daca39a02820199e7b72017c7b1af66e1c8d
SHA512afbc3d7f8e06e41db25d666999f4d162af7054a66b17a651ac8a7f092f83580a067bfa2f558be65ace5966dffaa8735fe7a579e88bf42b34eaa3e72cdec96699
-
Filesize
64KB
MD5e7317a0a343dc63f3fa3bf9ca6e93ff0
SHA10d48881feb76cf81fc46614bebfa3c134cada128
SHA256277a43f17ccc4f0fba87c710212de61a41383bcb94410fa093b50ebd50347a63
SHA51284ef51472db00cd4e90df3062a3cbc29a994c5cf470e54300d4a2f103ba8fb8279ec87b0561625ea1bccd80a7ad664c63457831b4eb919a7608099430b98a3d9
-
Filesize
192KB
MD5d73b46cd072058efc54c4b3885f47e13
SHA184771c2c4f5736ac08497737cba2a8634d9e9178
SHA2563f62bb203bdcca4e489401897e0558cf33ad6fe890a9987f90f5c3894b965b34
SHA512519c91b5b5a82c5a755d7d4295c040cfb6b0f029eb088a6bfc428db11e30d7f954ea6fd6de9b083d1781e1142737ea39572866ab5f669848dff7ef0ce34c79c7
-
Filesize
128KB
MD59746d1ac79c8b499d8b2224394581fa7
SHA136b1985eabfd8131ad9f2b7f69c903a3fce67629
SHA25677941fbe96e0c797e6cf5419ee32bd3fcee69629cba37750146656a660c37182
SHA51261a6174e2aced5b85cd614ad2f9d3da24c6b91e1fc04e10ff818222c4323cd043a59708bd35af0de84b004bf492fbc157d72907cd1e7ddf7082fc2a3563ef183
-
Filesize
606KB
MD5585efec1bc1d4d916a4402c9875dff75
SHA1d209613666ccac9d0ddab29a3bc59aa00a0968fa
SHA2562f9984c591a5654434c53e8b4d0c5c187f1fd0bab95247d5c9bc1c0bd60e6232
SHA512b93163cba4601ed999a7a7d1887113792e846c36850c6d84f2d505727dc06524bb959469f9df12928769f4535dc6074a6b3599b788a4844353e466742ce1e770