Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
295s -
max time network
301s -
platform
windows10-1703_x64 -
resource
win10-20240221-ja -
resource tags
arch:x64arch:x86image:win10-20240221-jalocale:ja-jpos:windows10-1703-x64systemwindows -
submitted
23/02/2024, 20:49
Behavioral task
behavioral1
Sample
batexe.exe
Resource
win10-20240221-ja
Behavioral task
behavioral2
Sample
batexe.exe
Resource
win10v2004-20240221-ja
General
-
Target
batexe.exe
-
Size
9.4MB
-
MD5
cdc9eacffc6d2bf43153815043064427
-
SHA1
d05101f265f6ea87e18793ab0071f5c99edf363f
-
SHA256
73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
-
SHA512
fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
-
SSDEEP
196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 4996 b2e.exe 5016 cpuminer-sse2.exe -
Loads dropped DLL 5 IoCs
pid Process 5016 cpuminer-sse2.exe 5016 cpuminer-sse2.exe 5016 cpuminer-sse2.exe 5016 cpuminer-sse2.exe 5016 cpuminer-sse2.exe -
resource yara_rule behavioral1/memory/4328-6-0x0000000000400000-0x000000000393A000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4328 wrote to memory of 4996 4328 batexe.exe 73 PID 4328 wrote to memory of 4996 4328 batexe.exe 73 PID 4328 wrote to memory of 4996 4328 batexe.exe 73 PID 4996 wrote to memory of 1692 4996 b2e.exe 74 PID 4996 wrote to memory of 1692 4996 b2e.exe 74 PID 4996 wrote to memory of 1692 4996 b2e.exe 74 PID 1692 wrote to memory of 5016 1692 cmd.exe 77 PID 1692 wrote to memory of 5016 1692 cmd.exe 77
Processes
-
C:\Users\Admin\AppData\Local\Temp\batexe.exe"C:\Users\Admin\AppData\Local\Temp\batexe.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\99BF.tmp\b2e.exe"C:\Users\Admin\AppData\Local\Temp\99BF.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\99BF.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\9EA1.tmp\batchfile.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.execpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5016
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD5c5e09858066f182b7f5bdcb61d9b36fc
SHA17a1de79ffcfa17a7a86a01f8d5046eaf970b8905
SHA256b5ede4ee58898940fa268a8aa17da9fc31eae634a8c95afcb2412ae199e8f4b6
SHA51270e4e7cf5ec9df418480b0773c325e489749cbf6b5af491b24f6a6b2298cb043f681689531e70666787d42723d096d57012f1bccf317367908ce68a1420a6dfd
-
Filesize
256KB
MD518c91665349cf71648d4af5d21843ea9
SHA16be582f8587a42e96d73bf174cb6d6345761c192
SHA256979d6a944f61f2cde2dea724ce5e0297005602c15fbbbcb917540ec1b1f3f937
SHA512544d110b9bde470b9411a91f9195bf5e6914c1e5c59ec4485be08acaecd0e519d1c932181cf5a76d5241dedc362beb56f2fb407d808d554e43d408b34a621d48
-
Filesize
136B
MD58ea7ac72a10251ecfb42ef4a88bd330a
SHA1c30f6af73a42c0cc89bd20fe95f9159d6f0756c5
SHA25665e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9
SHA512a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0
-
Filesize
936KB
MD528fcaf4cf15d5e0a390053c616507e93
SHA1333af2b6789e200f228b2cc30c2c3ff574d73ba7
SHA2562636c755be8f8b76f27cccebe63e511b65e8115c850663cfadfcf142c75c60a5
SHA512a0bffb1e9a612d2010afd6514907dbc3462731978e1a86f958a645edb3acabb072b7d8a96910bd57d9379acfc1e20ef07ba77ceb2b96841c884add6b605ce5d0
-
Filesize
1.5MB
MD54c34295812720534fe756fdaa461974a
SHA18193ebd5d1564f2eaaa3d44dcf2322d7f6934510
SHA256ee402c453009493391fe1b52d24ab316dbe61e5b5736143da720e225a681639a
SHA5125a46a43ca8eb26bcc2aefaaad481cde516272b5b8c2e9ea39b1514cc4801a71818d5e20ea63bb0104c572b02b8eed1afedb0860440c13c76afbaee14a50eba16
-
Filesize
836KB
MD5aeab40ed9a8e627ea7cefc1f5cf9bf7a
SHA15e2e8ca2881b9bf9edfa3c4fdcec6da1efa102d8
SHA256218cfc4073bab4eddf0de0804f96b204687311e20a9e97994bff54c9b0e01ee9
SHA512c0a67616fa01fdc351015212a718faf70da6612fbb3ec13da28dd7af9a507c56882fb7c3eea6fbc37d4d63b970157199d16d0756dbe3cb3bc2223e215cb104d8
-
Filesize
1.2MB
MD57cf672bee2afba2dcd0c031ff985958e
SHA16b82a205db080ffdcb4a4470fce85a14413f3217
SHA256c82f84171b9246d1cac261100b2199789c96c37b03b375f33b2c72afab060b05
SHA5123e90d1c1efe0200cb3cc7b51d04783a3cce8391faa6ce554cff8b23dac60be9f8e4f980a8ac005fd9dff8ea4bdcb02311f7649c5be28eb32dcc26417fc4090e5
-
Filesize
688KB
MD5ecc66ad1e4654ca82bac2e31a98e8fac
SHA1d3f59841c3a85f1757330d4d747fed829565a183
SHA256d0fe00282459a1156e1646e98ebe1382bfa6a7e88012b67dcde7e7f5b711f996
SHA512cb9a503448c8b5a303ccaf749113d5ccce96de9aa38b889a8bec17454da1f57b1db879f50389d45a34968a13d8a8e1b62b670d4e9180c3475e5b80db24ad6bf2
-
Filesize
606KB
MD5585efec1bc1d4d916a4402c9875dff75
SHA1d209613666ccac9d0ddab29a3bc59aa00a0968fa
SHA2562f9984c591a5654434c53e8b4d0c5c187f1fd0bab95247d5c9bc1c0bd60e6232
SHA512b93163cba4601ed999a7a7d1887113792e846c36850c6d84f2d505727dc06524bb959469f9df12928769f4535dc6074a6b3599b788a4844353e466742ce1e770
-
Filesize
1.1MB
MD5effece008ceeadd157267e11450d5f53
SHA17895bdf38bc87fbe83023d07b37a261e9e55364b
SHA25695ff7237fc2459a9e3b32b28bfcc59bfa92d479b754021369e65ba9d04bff075
SHA512e4f00f9cc90ea1a8da89561cca7a609e1a42f18a2af73e39ae2e3df435fcb9481453c219b34af101b61b38ea311250092ffbfdddf8349851c30bb89df4120f35
-
Filesize
983KB
MD5228ed65f10749a6edea77c2f33c65587
SHA1dbd809328a75fda2089ff14f57751670491329a6
SHA2568a2e614e6de406a5268d5fc8b471f5d4166a66352c7ffd905920adffdd226da5
SHA51282ddc576101fc3f2ca7608057c43501b66321f42b8163cbc62c388771adca14813f3d626ea894a7a36e11e2a8304e20ad766a07d1b5bbad6877e21470eb09fb6
-
Filesize
1.0MB
MD554b24c3132cadabde406b209866e4652
SHA107f7065a2289b64d15629bc40a35ac08ecaba30e
SHA256a6daa22f68d20ca7e294fd3b2782be9ba56205187e4614160641f3f47e30aa22
SHA512c0b8e4bcd89f7048c8a9e64747125df1d3d06d0a0b58c1cc554545e2c496468ddba085e5b62729523263fe042939aadaff251ba39d5badb4f4db7351079610c7