73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72

Analysis

max time kernel
294s
max time network
306s
platform
windows10-2004_x64
resource
win10v2004-20231215-ja
resource tags

arch:x64arch:x86image:win10v2004-20231215-jalocale:ja-jpos:windows10-2004-x64systemwindows
submitted
11/02/2024, 17:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

batexe.exe
Size

9.4MB
MD5

cdc9eacffc6d2bf43153815043064427
SHA1

d05101f265f6ea87e18793ab0071f5c99edf363f
SHA256

73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
SHA512

fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
SSDEEP

196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv

Score

7^/10

upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	batexe.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	b2e.exe

Executes dropped EXE 2 IoCs

pid	Process
3656	b2e.exe
8	cpuminer-sse2.exe

Loads dropped DLL 6 IoCs

pid	Process
8	cpuminer-sse2.exe
8	cpuminer-sse2.exe
8	cpuminer-sse2.exe
8	cpuminer-sse2.exe
8	cpuminer-sse2.exe
8	cpuminer-sse2.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5472-9-0x0000000000400000-0x000000000393A000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5472 wrote to memory of 3656	5472	batexe.exe	85
PID 5472 wrote to memory of 3656	5472	batexe.exe	85
PID 5472 wrote to memory of 3656	5472	batexe.exe	85
PID 3656 wrote to memory of 2448	3656	b2e.exe	86
PID 3656 wrote to memory of 2448	3656	b2e.exe	86
PID 3656 wrote to memory of 2448	3656	b2e.exe	86
PID 2448 wrote to memory of 8	2448	cmd.exe	89
PID 2448 wrote to memory of 8	2448	cmd.exe	89

C:\Users\Admin\AppData\Local\Temp\batexe.exe
"C:\Users\Admin\AppData\Local\Temp\batexe.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5472
- C:\Users\Admin\AppData\Local\Temp\3F46.tmp\b2e.exe
  "C:\Users\Admin\AppData\Local\Temp\3F46.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\3F46.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3656
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\52CE.tmp\batchfile.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2448
  - - C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe
      cpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 3
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:8

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3F46.tmp\b2e.exe

Filesize
4.9MB

MD5
c0cdecff8414799c19bd9cb66221a641

SHA1
f541cad29836b6bab2af869e2d43e2db517924cb

SHA256
ccaa37653f8dae9f12ebc097ebb7bfab1d83dde8ef265227746dc09d9b9b0265

SHA512
9dd1ad3d8866507ada0f912c31ff5a2f6876674ff3cac1e40a60059b0e93c34f8d744391f502a740d43c4740c9710f0089514420eaf6c1824c451d8ab06e8bc0

Download Submit
C:\Users\Admin\AppData\Local\Temp\3F46.tmp\b2e.exe

Filesize
2.9MB

MD5
b874660e0a17a7bd000483e12ae6acbc

SHA1
0378744c345d90da443614e8073ddf2777226dc0

SHA256
ca4265e55ed331ac1d57dcb78f72557723b6123fc1ef7f5cdcdb358ce489741f

SHA512
f7b467ddca49e0f6c568a1017a57bc445be187f1ab473adf2f545488d7f43673c4038ee33c6bbec7d3c65cacf8961f8e05aa4a1b3a651db502ba3ac4edc73766

Download Submit
C:\Users\Admin\AppData\Local\Temp\3F46.tmp\b2e.exe

Filesize
3.7MB

MD5
284d92e7278570d1a0062ca7a3459a17

SHA1
dc53ba0f4ba608235b2461a3a69cb47b4d2d57b5

SHA256
63d67c8182b1cb49f5d6a268f4ba7c6a5ed1eabe9e646d661bcbbe61bd0555e1

SHA512
ee623c21545550447ce404c030301bb38140b1ef9b966ba28765897ee9070abcbfbefc316f3f8cdcca8c7f76ddc9fff29519922fd1e0dc8ed6bbd77df18d33fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\52CE.tmp\batchfile.bat

Filesize
136B

MD5
8ea7ac72a10251ecfb42ef4a88bd330a

SHA1
c30f6af73a42c0cc89bd20fe95f9159d6f0756c5

SHA256
65e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9

SHA512
a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0

Download Submit
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe

Filesize
473KB

MD5
a776b351e923c0dc26268705bf51672c

SHA1
732bc8517e1e2d024610846d4c2ba76306702888

SHA256
95194045921a05f2c515db6db802fb1b609e1b8fe8253195a2e7efb438cff5c8

SHA512
771a85d77030e9012054fa8d3d6f6717875cde455ed652ff61eb3569f06b5f3d4c0ee8d809ed75d167e4e2d22413bf997c3b4a842c78eb99e5bcfa9064c34791

Download Submit
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe

Filesize
449KB

MD5
18d4cd3302a437008f294edc5fe06bd8

SHA1
0d3c52ef2ac2ddfde3b9bdfbe856694d8492ff61

SHA256
4bc0138cadb07a80d8234dd2d2dc122a664278331427009ebc80e0ca96dd112c

SHA512
50635e38b092ac80d7cc941fea90f352fb88c62f08460ce1d479ef8d99bc28e3c2475b69f0790114619b38c2bc33f5b47e27b779a4ff80b8e5a5d0db79508a02

Download Submit
C:\Users\Admin\AppData\Local\Temp\libcurl-4.dll

Filesize
415KB

MD5
2116185758e7dc453f5830e42e104edf

SHA1
6c7faf9e86c2876f6ce1d95c6d2f82b96f7faf81

SHA256
62e123331c56e67b95de53ee2d24691c6dee032613a4846902ec988c6e23ef7b

SHA512
d226a8c13e63a27f0ca88c44681294154bf9be8f604c92c5da01bc9fb40cc59da7fae0ac5bb6e56e65cde5d02c2b90c40b3243e62cf3d6e271a5b28d6cb87fa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\libcurl-4.dll

Filesize
443KB

MD5
f10110275641791bd63c82f3362443b7

SHA1
955c7740654b6ed1d881da06b0d7e978e6c9a96d

SHA256
265067ea3fd931d7d75de4ae7f7161b9a8cc9c1131efe0b0f38bd7f095d1cedc

SHA512
615adf64f75b04bf2b765de903708bd13cc33e78929a5bbca502dda94682284dcb5b7d894f91b08324fcf25ab010a7bc79a3ee92f7fb05ad5b27cb978940272a

Download Submit
C:\Users\Admin\AppData\Local\Temp\libcurl-4.dll

Filesize
836KB

MD5
aeab40ed9a8e627ea7cefc1f5cf9bf7a

SHA1
5e2e8ca2881b9bf9edfa3c4fdcec6da1efa102d8

SHA256
218cfc4073bab4eddf0de0804f96b204687311e20a9e97994bff54c9b0e01ee9

SHA512
c0a67616fa01fdc351015212a718faf70da6612fbb3ec13da28dd7af9a507c56882fb7c3eea6fbc37d4d63b970157199d16d0756dbe3cb3bc2223e215cb104d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll

Filesize
424KB

MD5
ca4c0f0a1b8e9c418cf4785441eab912

SHA1
dc39ef8bd261b12cc2ad38f2f89d968b5a9ba5bd

SHA256
eb035077460b64b69a20ff712d17f31379f3533256c961bea28a1350c2afa682

SHA512
b975fbeb069f06239431ac98b22b14970ca30c323142b16023215e10dceb49bccca7e4c6a4855ebe9ec09587ab619b597d165d9ab47404ee48e04e06cb65d513

Download Submit
C:\Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll

Filesize
1.2MB

MD5
7cf672bee2afba2dcd0c031ff985958e

SHA1
6b82a205db080ffdcb4a4470fce85a14413f3217

SHA256
c82f84171b9246d1cac261100b2199789c96c37b03b375f33b2c72afab060b05

SHA512
3e90d1c1efe0200cb3cc7b51d04783a3cce8391faa6ce554cff8b23dac60be9f8e4f980a8ac005fd9dff8ea4bdcb02311f7649c5be28eb32dcc26417fc4090e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

Filesize
450KB

MD5
aa53ee20f8e930bfa8dbf382e551ef50

SHA1
7eb1c17a10d6fb370d4d921f6ff737eee214ec2c

SHA256
d4726f3133a1fc5143340a5bd9d74d27b8ce81973c98ccc8e37d4a30c7201fe8

SHA512
c0ae7f77defd224ef307a751dd6a464a577bf452bc04dce28b461f759a545ab33c4758aeb6b8315e0cbe53b8ab0333df45b376c0df6912b816be82a5b06fac58

Download Submit
C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

Filesize
337KB

MD5
07e19793e10453861ade45978765307a

SHA1
de7aa3a7f94d446a5f9775a7eeadf784b64b5f11

SHA256
35638bef2d148269c76fc7d6288f052c8b5118192416b2fbc3391196469e9ff8

SHA512
b372cf1e1741e595cfe2ced73156eba33474501227cf90201ddcbc9e73a39ad538262e520c43b97bcc5688ca4b71839d99629fa2c50bd891aaaa551b18d252fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\libwinpthread-1.dll

Filesize
606KB

MD5
585efec1bc1d4d916a4402c9875dff75

SHA1
d209613666ccac9d0ddab29a3bc59aa00a0968fa

SHA256
2f9984c591a5654434c53e8b4d0c5c187f1fd0bab95247d5c9bc1c0bd60e6232

SHA512
b93163cba4601ed999a7a7d1887113792e846c36850c6d84f2d505727dc06524bb959469f9df12928769f4535dc6074a6b3599b788a4844353e466742ce1e770

Download Submit
memory/8-42-0x0000000000F40000-0x0000000000FFC000-memory.dmp

Filesize
752KB

Download
memory/8-91-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/8-106-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/8-45-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/8-46-0x000000006FC40000-0x00000000714F5000-memory.dmp

Filesize
24.7MB

Download
memory/8-47-0x0000000061440000-0x000000006156B000-memory.dmp

Filesize
1.2MB

Download
memory/8-49-0x0000000065FD0000-0x0000000066068000-memory.dmp

Filesize
608KB

Download
memory/8-48-0x0000000000F40000-0x0000000000FFC000-memory.dmp

Filesize
752KB

Download
memory/8-50-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/8-101-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/8-61-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/8-66-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/8-81-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/8-96-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/3656-55-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/3656-7-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/5472-9-0x0000000000400000-0x000000000393A000-memory.dmp

Filesize
53.2MB

Download