Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
300s -
max time network
304s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-ja -
resource tags
arch:x64arch:x86image:win10v2004-20240221-jalocale:ja-jpos:windows10-2004-x64systemwindows -
submitted
24/02/2024, 03:27
Behavioral task
behavioral1
Sample
batexe.exe
Resource
win10-20240214-ja
Behavioral task
behavioral2
Sample
batexe.exe
Resource
win10v2004-20240221-ja
General
-
Target
batexe.exe
-
Size
9.4MB
-
MD5
cdc9eacffc6d2bf43153815043064427
-
SHA1
d05101f265f6ea87e18793ab0071f5c99edf363f
-
SHA256
73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
-
SHA512
fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
-
SSDEEP
196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000\Control Panel\International\Geo\Nation batexe.exe Key value queried \REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000\Control Panel\International\Geo\Nation b2e.exe -
Executes dropped EXE 2 IoCs
pid Process 1420 b2e.exe 3916 cpuminer-sse2.exe -
Loads dropped DLL 5 IoCs
pid Process 3916 cpuminer-sse2.exe 3916 cpuminer-sse2.exe 3916 cpuminer-sse2.exe 3916 cpuminer-sse2.exe 3916 cpuminer-sse2.exe -
resource yara_rule behavioral2/memory/1724-9-0x0000000000400000-0x000000000393A000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1724 wrote to memory of 1420 1724 batexe.exe 87 PID 1724 wrote to memory of 1420 1724 batexe.exe 87 PID 1724 wrote to memory of 1420 1724 batexe.exe 87 PID 1420 wrote to memory of 4296 1420 b2e.exe 88 PID 1420 wrote to memory of 4296 1420 b2e.exe 88 PID 1420 wrote to memory of 4296 1420 b2e.exe 88 PID 4296 wrote to memory of 3916 4296 cmd.exe 91 PID 4296 wrote to memory of 3916 4296 cmd.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\batexe.exe"C:\Users\Admin\AppData\Local\Temp\batexe.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\9DF5.tmp\b2e.exe"C:\Users\Admin\AppData\Local\Temp\9DF5.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\9DF5.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\A45E.tmp\batchfile.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.execpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3916
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.6MB
MD5815f6eb59e479890b0650cc38e4bed3f
SHA14905f38c769b3ae275eaaade6302ca780c4774b6
SHA256519fbdb977c2805bbd46830d20d1b960d48fb25eb8449b59bc975fa114c7bb23
SHA5124bb3f6b5b6751066c4ec338b4d57b8dc92309948216abbf6a007be7c228ff6f8932b530929dba78c7d59755bc74d46fbcd31ad1fb8d949a9a3718e64416ed917
-
Filesize
7.9MB
MD5566465d086aeb2dfc4d6e02d7d21b779
SHA10bb08763955ddd25b61b0f7be6248ccc94ccf2cc
SHA256493a16da0174b183a63a63cb4d62e603ef4de902d65ef5420bd193b2009c06a3
SHA51248e14f1f66483daeb14a14e2705f2514a0211a1a6348af6406293b6e5362aaffcbb6c360a6ce03e7c91c9ed2512941154af299466245c5bde2f4ad3ef3414fa6
-
Filesize
4.8MB
MD515bedbacfa4eca51d4f266ed8af73745
SHA1e5fce71e9deb0d2615f73a905bf1c0717fbfdcc7
SHA2565182c5eea9112884f9e8c96b583b56928cf0a4cb42e289bda727625b26df58b8
SHA5123460446dcb9085e55bae0d8e5b13d98b57f195f371c9724194238219d92f80052013b5fc5d3c038362abb12970fcdd33f0e4e741f9a377d1d5f1365800663ce7
-
Filesize
136B
MD58ea7ac72a10251ecfb42ef4a88bd330a
SHA1c30f6af73a42c0cc89bd20fe95f9159d6f0756c5
SHA25665e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9
SHA512a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0
-
Filesize
2.1MB
MD51d224a4c57a729ccdbd4f9d13656ca0b
SHA1bb8939539de49ee41d4a11caf9ec81b9ea1cea1c
SHA256dde910e3ba7aad77b66e776c724f11cc17956df4c1f64f901566c7a4c2a70532
SHA512034af5693d5d4f322cd722f2ee3afc1e9036f8f6ef1339eaaf81d1f6faebcf3afbe7ef4265678c7e361772928c2d730ad4c10434a167356455b2fb4b2327f4e7
-
Filesize
2.0MB
MD5c3d8cd8f8528fd7e6fd62c51fd1d9058
SHA194047a6308f2e3bc22aaf74d5ba5b15c438757a4
SHA25680d1ee1f1ad59a18ea733f1cb2aca8ddce62d4104d4e9346be90055b9b95cf22
SHA512fea1e9c4ccc27b987bed71bc85988574ca7b41cbd96468ce7f62fabc96b75d4a3d34d27615e598578047b959c9b233736786c5e3cfeeffb162de991709e751cf
-
Filesize
836KB
MD5aeab40ed9a8e627ea7cefc1f5cf9bf7a
SHA15e2e8ca2881b9bf9edfa3c4fdcec6da1efa102d8
SHA256218cfc4073bab4eddf0de0804f96b204687311e20a9e97994bff54c9b0e01ee9
SHA512c0a67616fa01fdc351015212a718faf70da6612fbb3ec13da28dd7af9a507c56882fb7c3eea6fbc37d4d63b970157199d16d0756dbe3cb3bc2223e215cb104d8
-
Filesize
1.2MB
MD57cf672bee2afba2dcd0c031ff985958e
SHA16b82a205db080ffdcb4a4470fce85a14413f3217
SHA256c82f84171b9246d1cac261100b2199789c96c37b03b375f33b2c72afab060b05
SHA5123e90d1c1efe0200cb3cc7b51d04783a3cce8391faa6ce554cff8b23dac60be9f8e4f980a8ac005fd9dff8ea4bdcb02311f7649c5be28eb32dcc26417fc4090e5
-
Filesize
1.4MB
MD56209d231684a8f2e5e435f52c37246d1
SHA1b86fbebd13d623ebc5765543b2ef075f41e57c7c
SHA256d63535da6cdab2c1a2fe1620c6a418ba16e60f52545f5719bb88e7313f63de9c
SHA5129d4d2d39827ebd76373a3cb02ccdc6b70737b4842aa9e9949f3c411502feda78d8c60e0612261f2b0491c928f3807c5d43030fae8d7192f265cd42fa356c9f09
-
Filesize
1.4MB
MD514d44de2a376b1198061fc01858e2b2d
SHA18a1b58e76c5e430eb5ff096dbf2a38f26dca3374
SHA2568f5659ad955880f7cab780654c4de0e32e7891d156f9c13162c7eca5a930da70
SHA512bd606f91db78afeee442dca17ee6d96d49af8498d746e622e882ce5350dbe170d089fe9c3e3d58ac533e05a49c97a685087395e74d28499aaf28deef66c3486c
-
Filesize
606KB
MD5585efec1bc1d4d916a4402c9875dff75
SHA1d209613666ccac9d0ddab29a3bc59aa00a0968fa
SHA2562f9984c591a5654434c53e8b4d0c5c187f1fd0bab95247d5c9bc1c0bd60e6232
SHA512b93163cba4601ed999a7a7d1887113792e846c36850c6d84f2d505727dc06524bb959469f9df12928769f4535dc6074a6b3599b788a4844353e466742ce1e770