Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
297s -
max time network
305s -
platform
windows10-1703_x64 -
resource
win10-20240221-ja -
resource tags
arch:x64arch:x86image:win10-20240221-jalocale:ja-jpos:windows10-1703-x64systemwindows -
submitted
24/02/2024, 13:05
Behavioral task
behavioral1
Sample
batexe.exe
Resource
win10-20240221-ja
Behavioral task
behavioral2
Sample
batexe.exe
Resource
win10v2004-20240221-ja
General
-
Target
batexe.exe
-
Size
9.4MB
-
MD5
cdc9eacffc6d2bf43153815043064427
-
SHA1
d05101f265f6ea87e18793ab0071f5c99edf363f
-
SHA256
73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
-
SHA512
fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
-
SSDEEP
196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 1396 b2e.exe 4004 cpuminer-sse2.exe -
Loads dropped DLL 5 IoCs
pid Process 4004 cpuminer-sse2.exe 4004 cpuminer-sse2.exe 4004 cpuminer-sse2.exe 4004 cpuminer-sse2.exe 4004 cpuminer-sse2.exe -
resource yara_rule behavioral1/memory/320-5-0x0000000000400000-0x000000000393A000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 320 wrote to memory of 1396 320 batexe.exe 75 PID 320 wrote to memory of 1396 320 batexe.exe 75 PID 320 wrote to memory of 1396 320 batexe.exe 75 PID 1396 wrote to memory of 4060 1396 b2e.exe 76 PID 1396 wrote to memory of 4060 1396 b2e.exe 76 PID 1396 wrote to memory of 4060 1396 b2e.exe 76 PID 4060 wrote to memory of 4004 4060 cmd.exe 79 PID 4060 wrote to memory of 4004 4060 cmd.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\batexe.exe"C:\Users\Admin\AppData\Local\Temp\batexe.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:320 -
C:\Users\Admin\AppData\Local\Temp\1B72.tmp\b2e.exe"C:\Users\Admin\AppData\Local\Temp\1B72.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\1B72.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\219C.tmp\batchfile.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.execpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4004
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD5c8ddb9a1b99b955d28ce987616dc783a
SHA16a50a41aac042de84cbe5fe9cfa8ef171c1a15ba
SHA256d42d045c7eaec84a0576fa2d1e67566cd65686605e6f66217c2da6ec9faa060a
SHA5128804aa717bb5d9a88543175afd4ed3363ae6d1ff9846379f9bbfb7ff1b49cf0031fd6b1cbb0b1491a94d1158663021c8bf56c47050f3192b62a0c5bb5499d397
-
Filesize
371KB
MD5732e5052669f4970886a25916831473b
SHA1d9a27bf4a4a63766481259c6f21dff04d9e7e800
SHA256df90e32a79d8940bb69bb734f4d5a355c78add1c62266e0099a643d47f400304
SHA51200a6d7ce257372a17c0692be7646c91395ce968a696f1f6208957d9b10c84e9934d487be9b5301269386ba380253232607a35182f724a4b37f5f46aa5bcda862
-
Filesize
136B
MD58ea7ac72a10251ecfb42ef4a88bd330a
SHA1c30f6af73a42c0cc89bd20fe95f9159d6f0756c5
SHA25665e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9
SHA512a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0
-
Filesize
243KB
MD565e999850429137cc6c20136a07bc16b
SHA1d3ebe98b57a7d18f44ac05c094210657b10cadd9
SHA256febc14ef44656a8c79bb960e9d871c435ebe0a5e795d50d1364ead7cefe16e0b
SHA512f2ec8238f0544efc50d711c4f0d8716acef1cfd9487370b5654bbd27a9d1d39f70d39843b20a641b4997fd692c8baf3178ab71ace1ceb857b2678fdb1735f30f
-
Filesize
286KB
MD55ae24d45e1410a88e25ec23d9c810a08
SHA1d8f8d9b4a8cd9370e55c5206eace8db7309b0738
SHA256c12b289c91453952f57285f3280c914102edcc7430713aadeee49e2b9c888d6f
SHA512114141559671b5f290bc252f8a0b722dead6f1c846fd5d458ce75b893013b6cffed18d72f5b6944d421d760ce407f4df4e375a6a552fe0283a25f081042c4ae6
-
Filesize
171KB
MD5a0efde88076f0698e567708e917755dc
SHA1f89e2fda164ea81a9a2b229c524f4bcda98e488b
SHA256b2f74b66cad562769409646ff64afcea85ddc3271c7c10d4b492d1e02b4ed311
SHA512379cac12824171b2b26ec4872d8575ee592c0e0e87dbcd161535d48eba5218409ea95a4291facdfcaec6eda2959550d07a2865cc6377d26b8bd9288430932a93
-
Filesize
349KB
MD50db9870ca08aa04d43748a41b9a2b7c6
SHA1f8bc79c6a38929d92e6d5f3ecda8e78fce7bd32f
SHA256ca01a9b9968f187cfb529dba2e78462cae6ded7440cd7ddf51b4574bc962aaff
SHA5120b98d4a022d67a3bfe410f64179aa4ccc2ec679cf7ff49ed997a02ce7c663c9d5ce2d12b2f1e049cdc3fc9fac1bec3376aad2cf15a5c2090ff28d6ad7fd5f5bb
-
Filesize
222KB
MD575eb3e29369c1ab7740e209b03e0616c
SHA1b573e274ffcf5103a94d3723c75fe279fa8c1526
SHA256fbc0193dfa450349e371993771e69fca3d6fdb0873684da655a94f3948c2932c
SHA5121ba81f6aee35b78c7f5a42375c4a912f9553d4ecb98320cf75ed804e265721853f173cb6d6b1b840b05940d2e380c468cf637c626b49fe4d0ae03fa88b228d47
-
Filesize
174KB
MD55dfacf0014196c93102438bc28964dbc
SHA103974ec84d00ea568a33898f08e78d97af2892bc
SHA256854a2bb130afd91493de2775f2cc372a2ce10b27435a5a4c4d4b52d95e840540
SHA5126026f585b80942a3b2f9c80853061b49b86ae0e75917e964ff5d26aa0678e6cbee1192405ac0c4e933ddcd418ab01c18edc08e78bb56744b8b189b21799618ce
-
Filesize
333KB
MD51c8942ea4c1beaa7b7d59c4beb31ea5d
SHA1d184fa2830636b51294c51a789f9a27802fe79f8
SHA2565fad0281131af1474ecd0fb4632d0a105956e6ca12c0122de7e9dd93601aa51d
SHA51215a52037b97a7c32de96c4a79df3726ad0af4f6e20a6a3bbb08b9657beb057b5d7c007636b898972d1bd8071080eef112d370a6aa120fbb21bc626336e22f873
-
Filesize
415KB
MD58dde3f1deda58f0889904a637268d156
SHA1309a6ae666605d7988419a61782c8a1ef5980230
SHA256c481d0461e2e2b3d5202d5b957de15b091c955a5c74f63514d1b99f867bf9e07
SHA512fe4f6f19697e4b9affe538ef1a2a713d6c2d8322aaac23dafcd1662c68490ef875a1536c6b3fd06a5c6682281b5415f0ca1aa3a23a71ce5b3d6f27ab3d699411
-
Filesize
196KB
MD578061a81b865369e65ed66a9a8484311
SHA14d2ed0600791813c33bba30e572a52b8767b8bec
SHA256494d001d1fdf0f10da228bded371e8178750243525c8a594fc01619ad65486f0
SHA512c8ff848933f4e3723847c87c89c721806189041c74a93c4e160af952eaca9ccc098b8156788a0b29b60be1c7218d88b803b66a3b7de1c1cfc2b861ee16ee1e06
-
Filesize
147KB
MD5d9e5447a432b3ef127c4a313713b512b
SHA18ccd2477c1d62bbf43440a377218ada19058d516
SHA256a81c5169d28cca0b36e5259233f2816dc26a676aff454877b1544f16af092f77
SHA512f5ff793b7ffe56926b86299c9aab3e0ef30903f04704a0ccfe5c500cde49639ece7ecc4ed9c05bfaa38b626d576bba60d86b11a0e2901351a8a7ae6c9993f6b0
-
Filesize
606KB
MD5585efec1bc1d4d916a4402c9875dff75
SHA1d209613666ccac9d0ddab29a3bc59aa00a0968fa
SHA2562f9984c591a5654434c53e8b4d0c5c187f1fd0bab95247d5c9bc1c0bd60e6232
SHA512b93163cba4601ed999a7a7d1887113792e846c36850c6d84f2d505727dc06524bb959469f9df12928769f4535dc6074a6b3599b788a4844353e466742ce1e770