Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
294s -
max time network
300s -
platform
windows10-1703_x64 -
resource
win10-20240221-ja -
resource tags
arch:x64arch:x86image:win10-20240221-jalocale:ja-jpos:windows10-1703-x64systemwindows -
submitted
24/02/2024, 04:08
Behavioral task
behavioral1
Sample
batexe.exe
Resource
win10-20240221-ja
Behavioral task
behavioral2
Sample
batexe.exe
Resource
win10v2004-20240221-ja
General
-
Target
batexe.exe
-
Size
9.4MB
-
MD5
cdc9eacffc6d2bf43153815043064427
-
SHA1
d05101f265f6ea87e18793ab0071f5c99edf363f
-
SHA256
73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
-
SHA512
fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
-
SSDEEP
196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2404 b2e.exe 2232 cpuminer-sse2.exe -
Loads dropped DLL 5 IoCs
pid Process 2232 cpuminer-sse2.exe 2232 cpuminer-sse2.exe 2232 cpuminer-sse2.exe 2232 cpuminer-sse2.exe 2232 cpuminer-sse2.exe -
resource yara_rule behavioral1/memory/192-5-0x0000000000400000-0x000000000393A000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 192 wrote to memory of 2404 192 batexe.exe 74 PID 192 wrote to memory of 2404 192 batexe.exe 74 PID 192 wrote to memory of 2404 192 batexe.exe 74 PID 2404 wrote to memory of 3544 2404 b2e.exe 75 PID 2404 wrote to memory of 3544 2404 b2e.exe 75 PID 2404 wrote to memory of 3544 2404 b2e.exe 75 PID 3544 wrote to memory of 2232 3544 cmd.exe 78 PID 3544 wrote to memory of 2232 3544 cmd.exe 78
Processes
-
C:\Users\Admin\AppData\Local\Temp\batexe.exe"C:\Users\Admin\AppData\Local\Temp\batexe.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:192 -
C:\Users\Admin\AppData\Local\Temp\7A70.tmp\b2e.exe"C:\Users\Admin\AppData\Local\Temp\7A70.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\7A70.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7CF0.tmp\batchfile.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.execpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2232
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.4MB
MD5593dd135058709ac82125729a00adeb9
SHA13746be39e33b3cdc767922d3423244e3e6f96c9f
SHA256f694e070421e15f273fbe4a6db87353edebbb895f5760182b2237e446767e065
SHA51266b257507c6aa9d85e6ab1782dfc0dece807d34ef7fd75a070642baa4c0a2b8230c2f3da3333708508a0aad06f6dc80f2b3f9f06782e815c5cc2c92782d18cb4
-
Filesize
1.7MB
MD5aa471fbc0dfab0f8778d3407e8cb8e5b
SHA149ab339bbb0e81adc5ab152ebe5845fe8c801d0c
SHA2560c0ca371d9b3e35402cba34f2f114df8706c70454f995c00f11e59f0126a935d
SHA512c65bbb51adb517216c3cd778302f3b06d7fe8e27205680025c49a091918b8861117471f39f68f029a9ab70c9a1792dd9c52e94f52fa789456d6350ce3954b41f
-
Filesize
136B
MD58ea7ac72a10251ecfb42ef4a88bd330a
SHA1c30f6af73a42c0cc89bd20fe95f9159d6f0756c5
SHA25665e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9
SHA512a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0
-
Filesize
99KB
MD571f3b472b9b04ebfcc7dfd35a2d1a983
SHA18f16fc00b3f90e4ce8db4b29cc4aefc69788e42b
SHA256c7dffa9477787d158176dd30b7d06ad281aab14aec2479e4ac2d563322753add
SHA512f8dd65c6b6fc8f50ff01e80a04cd674def8d7ba0887ea99026b04837a932ecb7218010dbb11ccab40af2403a5a85a331760bf22da443e3bf52a8223b8f6546f8
-
Filesize
113KB
MD55869ae6c2874d91c6eb3f3cd79bc670f
SHA1172deba6018b9da60747a0a8541f7ae1808dae03
SHA25660d9f8434055de0dce9f3648c7031c8190ad761e77fdf0c9c8fe6c5f4f8349dd
SHA512b6473d7a43692d7e9ec984d61d021e46ebdb9595442f4635ac61805507d781583b7153d1eb85234932db9e602131ef6701886a03dda2082c9353edac97cac612
-
Filesize
138KB
MD5ab314745f1ba3c11fca2ae0fc813474c
SHA1338a6b0af19af43397e958587a30ebfd159024a2
SHA256d17a34f98dd12fd127b1a99c22f33f0f686c321d169c27bc8c45083a1c283455
SHA512059ff93587d55e02a44b8a116708ed064b8c653dc1dadb46a80cf771ac84693a27fc48774f4f95d510622989a6572f383d6ebe46f0d09a7c9890ac3abfe2ea3c
-
Filesize
81KB
MD552f4318b563823855e60ae911ebd42cc
SHA166272d08937862008b12e7dd7b650d2580293268
SHA2560ceb7efaec5f2fe2e645c3f7a9cef86596c05456c48a6fe602a20b1d6223aba7
SHA5121105ba912f91a147bc4fa419e58025a693e34e5152f7ce1c7f270548930b4615041c05f397645744b32da87708e4fefd23473a61c9de815f8bd5df81e3a94042
-
Filesize
147KB
MD5fba31f6e2a54e01ff73cb0845cb53e62
SHA14834587b38fe1db43fe487a1caa2a4a2c128d5ce
SHA2566e7e607cbf25f6f875ae5a42f7273d60f4dfc397f918a2fa4f7ebe9d6b528849
SHA51224a8f90f5ae49a407db7a8a2cb7d687a585201c9eb89a46c2266bb0bfca14c56880986d375f3a9c7e2a0654974854ab20dc3f2ffb7bb5142e26988f0a5314344
-
Filesize
129KB
MD5ca49da3a9ce127263c96adec96ea72ab
SHA13242185e1804ec290ce3e82666f59f7e3f90ab82
SHA25632bacc4f05b06ddf4f567883328d3e5367a7ca25b472d8fc1f60eb36fdff36ba
SHA51297f6dc33c729abbf9db262803ef8f22e598dbaa8fb1f930d07dc3367b3e6b577a8ace0dd89a7f680d60aae05b1df23b74ca6d7fb16e340bdf17173b72ffa3293
-
Filesize
101KB
MD5b518f4ed42f5fab5fbcf9dd8fe347ac3
SHA1fcb4e3e7cc11a46b04b94a65726619aad703ea9d
SHA2562b0cfba989472becc02e28479553e5fbadc83ed5ea7052389253df933298c4db
SHA5124688dd5fd7dce4f496ecc2c46087ca46d55c642d6cb04d86e3da015c003ec1c1354eafe843e8a71169532b3c423d0592c79f7e741a45cd94ee4de1c7bb979cfc
-
Filesize
93KB
MD51f8372e06b3e8b8319cf53ddf93f9fcc
SHA1c237ec621968f7d377b87a8230907a9c126e81d0
SHA256562bb3c8d15614d0ef19c507611f86a972664822b03e312ed02111aaa7bdbd11
SHA51253245d363d5018d9ba722832e620d338ffc641db78b21b82c8260272441b82cef13d38828bb34a7be1a4fffdb498b90038d7223ee2fd79280acba7cd8c88a5a4
-
Filesize
72KB
MD5261fa530a7ee057cf821195b5a7e5db5
SHA10e63557404772417e19b0c9889a9643fa3499337
SHA2562bce73bdd3f9556573ed30e7aa069388b7eb4336cafbe4271a24797c031202a0
SHA512d481934843254fe37183dbbe1ca3e168d7cf7eb4ff57987b2a286b3c4623416d755ccf25ae45d555bef152a0ba7753ecb3746a46b2f52ac5f40384c22fc40cd0
-
Filesize
66KB
MD504e89c46e60eefac12569fe22c2df25d
SHA13d99c26f5d86e630b3940a85e74d9b9722c54735
SHA2569a413e3d8f2271b7a7660221a398bcfbedd1053b156ef280d9c653c3f3c93478
SHA512a39e7c0bcdef16297a8f7f759e75dd3c62851f19f846c96f68663d919c5f68171e165bf33d11eda7481994d8259ccf5c791b241a93d6854ffbac65143b29c823
-
Filesize
150KB
MD5b9618aefb298d1724fa0d574d28e2013
SHA1d65dab47ce86ff3f859dd284f9b3758930d13086
SHA256e06d48cd4961d5bb760cc3e8e6d03e7ce55f13ceecac0aa858423e523c229a5a
SHA5127cc706895d2a0afc1bda34a1da25046c2e8f2acfc06626f173645a9387b42f5113304ecdda88530599dcdc22a934f76c8c841b35110b3ca8e1fb9f1f8a4a572e