Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
292s -
max time network
300s -
platform
windows10-1703_x64 -
resource
win10-20240221-ja -
resource tags
arch:x64arch:x86image:win10-20240221-jalocale:ja-jpos:windows10-1703-x64systemwindows -
submitted
24/02/2024, 04:27
Behavioral task
behavioral1
Sample
batexe.exe
Resource
win10-20240221-ja
Behavioral task
behavioral2
Sample
batexe.exe
Resource
win10v2004-20240221-ja
General
-
Target
batexe.exe
-
Size
9.4MB
-
MD5
cdc9eacffc6d2bf43153815043064427
-
SHA1
d05101f265f6ea87e18793ab0071f5c99edf363f
-
SHA256
73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
-
SHA512
fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
-
SSDEEP
196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 4520 b2e.exe 4712 cpuminer-sse2.exe -
Loads dropped DLL 5 IoCs
pid Process 4712 cpuminer-sse2.exe 4712 cpuminer-sse2.exe 4712 cpuminer-sse2.exe 4712 cpuminer-sse2.exe 4712 cpuminer-sse2.exe -
resource yara_rule behavioral1/memory/3584-6-0x0000000000400000-0x000000000393A000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3584 wrote to memory of 4520 3584 batexe.exe 75 PID 3584 wrote to memory of 4520 3584 batexe.exe 75 PID 3584 wrote to memory of 4520 3584 batexe.exe 75 PID 4520 wrote to memory of 1924 4520 b2e.exe 76 PID 4520 wrote to memory of 1924 4520 b2e.exe 76 PID 4520 wrote to memory of 1924 4520 b2e.exe 76 PID 1924 wrote to memory of 4712 1924 cmd.exe 79 PID 1924 wrote to memory of 4712 1924 cmd.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\batexe.exe"C:\Users\Admin\AppData\Local\Temp\batexe.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3584 -
C:\Users\Admin\AppData\Local\Temp\7C83.tmp\b2e.exe"C:\Users\Admin\AppData\Local\Temp\7C83.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\7C83.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7E67.tmp\batchfile.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.execpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4712
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.0MB
MD5a0f40a1f69f2cff6507c4f478a43c190
SHA11a329f7c78f8067945a946d55a0f6d49e0093009
SHA2564cd3e56b90cf436ca84a3c66ee412033032b5f521f463834ae308c88fa3ddecf
SHA512583a8074c53831856fd86f23ff2e8a541259024445c9b2c74f9253a9802ce659ff4997489c9dd3ab32aaae287cec0c6c5c471034d15d5ff583a745322f5a251c
-
Filesize
3.8MB
MD576f68b3a48d98fee00bd53b2433e664b
SHA193ac86c7ea44114347d8fdd12170144f9596144d
SHA2563f3f634c0b974bb20a1041cfd64ea1b9d7ea05480931122b79c50d5a6cc4ef18
SHA5127e458caaa1de737e8ea9ae344f905fb487704582fdc25f4019dd9fee9b168e4fc77cf14233892023b8439ea2c79f642741b19a514fe116f1b6ec8051a727e9c5
-
Filesize
136B
MD58ea7ac72a10251ecfb42ef4a88bd330a
SHA1c30f6af73a42c0cc89bd20fe95f9159d6f0756c5
SHA25665e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9
SHA512a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0
-
Filesize
825KB
MD582ae454ac86317a9ef3a0caa87ca9592
SHA11bc45555394557af72637a4eab6c048cbbeb3d2f
SHA25680c7960fc73fff95bc2c54004c8a1ca644ab22ebc7b2e8f51404509b15b772c7
SHA512ba8c68e3f363d1b8bb432ae8c799309f179a245990994bb7304e0a7ad1ff3a5e435b1fb15899b49beff74aa7d9d158c5f8c40cfe48aeaa3dbb435ffa49d687cd
-
Filesize
992KB
MD53b9bfde354a771df4b1d7a8e72f9e346
SHA1003822863e8c688b931e8cdfc921d34ad15fd832
SHA256741d8454660b831756fabde26101a0e991626539e86c1c8012a954276c64d5f6
SHA51294ea338e8cb28e73a24973dddf47042d565ddc6e9a2fcaf87ca547a6795b0067103beab3efa34a0192716359c7cfba5b642a7ebea2f1b5716001a04f89e2adba
-
Filesize
743KB
MD59d4b8c8e12c49209f6660afaf4d457e6
SHA111149203a82a735e9701930cfe138d86208970f5
SHA25674bc9ebb33adef692384490fbf91b43210b24ca5948151aef93df9c817d7c870
SHA5126d59b34e7d385ab9a6d4f86fb00f5f43f2184a04079051e5f20cd1a44269211108d98e6e8ff5698cb1984155bd8a35a114574960b2c7b55f7f6a34b86eb60289
-
Filesize
652KB
MD5fa8eb3bf688c1d64815d2c650f3b87e5
SHA1d8e5488e3eed41184931480270a4dffaed9158fa
SHA25632c62fd981eb763553345be2c0b252eacf7f91410ced586607d43825775d9573
SHA51230b815e65a633368204175881d99e32df791a0b30d9a7e39e284b6375d837dfca05c31664ace657e1effca9d034a94fa8862d828cab584fff385856907df68bf
-
Filesize
442KB
MD52824b7ca71d2183bd6685cbd98776385
SHA19692e404666ffeea2d1b709adf717257037c6466
SHA25674132b91e8f67b7af3d860a65c49b2d68d605bd592357981f6945eb66785d2dd
SHA51250b502068446555b894a6a5a0daa7d0db3e29eff78bb3d71115b27d4994eae9e7d701e1097b895b78617dc39184f35c6a18e14f0a43eddb6c1c471354205becf
-
Filesize
583KB
MD5ca9c69c28d8c7554e29e0a43b884fdda
SHA1cc606e20d734a6133878e1cb9bc7dc0a54c40744
SHA2564fb67263d78020a47b608e5a9cbc67178b55c13b3251b709f97370eaf62cc3cc
SHA5121c6a3948c3d36a9c09ddf5346f2aced661ea7a7de705b06c98ebeef050184e0404025a3e2a44df4e538b1b064198fec13e7d66f81d19336c2c54cbd79fded68a
-
Filesize
663KB
MD5041c10b58786e686b2972a16af6f4357
SHA1c98b4b6ba9aa5bc42dea83fab4e3d9eed2eac112
SHA256f3417f0f185e40cd0b7e85296246af970ad82ab27efa547f7215ca1a9591bdaa
SHA512f35cbe3674cdc62855001251986789f85e410d91b50c9050dce08d056212383e4a546c9fa2b5b5e6da180efec0d6c912ee3130e21a182822818a114f2d3c51fc
-
Filesize
431KB
MD5edadeae0205d7a289f388a5ef56904e7
SHA1f31c2714be382ebe020a5df0b8b2062edd5eb02b
SHA256e0bcce594716e209a26c7385a004fcb5aebaf1f5d415938eb1eabf9292c80fbb
SHA5123f48da2a82f6e0491924c134cbcf6eabe423a4c5c8eb5efc89ca3d9bd0291a1114afaeb21cf517a8810891c6bc2ced8df64885273c48f518f1f167eb3e5348e3
-
Filesize
540KB
MD55b7a73185ccdd1e7963ef15168d49aec
SHA10fcb08449746789e1725cac42f1bf2a3916edfe1
SHA2565ad11565247b7a9dd46f849c828b1131ca19cff0fa698396d78a317c72e0c538
SHA512a968181a2dc06f31a74112ddd918b3172eceb4df0ad606624c2b57658235b68159a97ad524ded6c010b7e5b28e0e9359e5e942f71d344c1abc70a1e6e7bbc837
-
Filesize
441KB
MD55eea03637b50165b92325328026b85ec
SHA19ad1838afe7c5cf68e37366a030d2d1cd2a1ac41
SHA25670e1a4056ee69603101e7432159140f4050feb9f3b833ca7cb79bdd917867104
SHA51218bd8175074ead0d684a1d362f5a8de6ab75e67d7bfbb3096481eca1ba3ce001489a3b88e8bfa662d515daa47394fb477112456b0eab59b889b924b76d883ec5
-
Filesize
522KB
MD5fa9f8d1ac87b0edfb7cf05c2b463ad82
SHA1a7bb3677acf9c2d337416a01719ccdefecf37f65
SHA2560f32a2a2ab27b7af8cf9c79c1f4a9ae6e0de314cceef2ebce68885521b93a206
SHA5126d43c3dca4107d3f439cbdc09885749b8e857bb5c3485e74d7432edd0fb444315ae70bc17877885c9012214f926eaafba3a03c1b8d208f59c4d65f80188bcf6d