73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72

Analysis

max time kernel
299s
max time network
301s
platform
windows10-2004_x64
resource
win10v2004-20231215-ja
resource tags

arch:x64arch:x86image:win10v2004-20231215-jalocale:ja-jpos:windows10-2004-x64systemwindows
submitted
11/02/2024, 20:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
batexe.exe
Size 9.4MB
Sample240211-ysmv4aba8t
SHA256 73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
MD5 cdc9eacffc6d2bf43153815043064427
SHA1 d05101f265f6ea87e18793ab0071f5c99edf363f
SHA512 fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
SSDEEP 196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Control Panel\International\Geo\Nation	batexe.exe
Key value queried	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Control Panel\International\Geo\Nation	b2e.exe

Executes dropped EXE 2 IoCs

pid	Process
2852	b2e.exe
2884	cpuminer-sse2.exe

Loads dropped DLL 5 IoCs

pid	Process
2884	cpuminer-sse2.exe
2884	cpuminer-sse2.exe
2884	cpuminer-sse2.exe
2884	cpuminer-sse2.exe
2884	cpuminer-sse2.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3280-9-0x0000000000400000-0x000000000393A000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3280 wrote to memory of 2852	3280	batexe.exe	82
PID 3280 wrote to memory of 2852	3280	batexe.exe	82
PID 3280 wrote to memory of 2852	3280	batexe.exe	82
PID 2852 wrote to memory of 1764	2852	b2e.exe	83
PID 2852 wrote to memory of 1764	2852	b2e.exe	83
PID 2852 wrote to memory of 1764	2852	b2e.exe	83
PID 1764 wrote to memory of 2884	1764	cmd.exe	86
PID 1764 wrote to memory of 2884	1764	cmd.exe	86

C:\Users\Admin\AppData\Local\Temp\batexe.exe
"C:\Users\Admin\AppData\Local\Temp\batexe.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3280
- C:\Users\Admin\AppData\Local\Temp\8C32.tmp\b2e.exe
  "C:\Users\Admin\AppData\Local\Temp\8C32.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\8C32.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2852
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\97FA.tmp\batchfile.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1764
  - - C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe
      cpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 3
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

b2e.exe

Path C:\Users\Admin\AppData\Local\Temp\8C32.tmp\b2e.exe
Size 23.5MB
SHA256 235dd62507a66e9a4511fba8730889fe585c2dfdb4a9f5aca779c18db3a06357
MD5 32601fa8ea74fad321fc699435393a35
SHA1 39aa5d3563c9dbdee669138fb11d376216f46af1
SHA512 2097456c8da80827f202ff8beed57c3ee4818e17d70fff92e34eff9579b75eae57d4f7a6d057d1246f7e0909766dae511777ef9e590a58c46f0a1674b37b0e98
SSDEEP 196608:wWrJQ9CuKdIncRBGvwPHD/bfOqjJjMr2XHjXnXHdfz/x1BJ:nSCRdIJv0j1BJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

b2e.exe

Path C:\Users\Admin\AppData\Local\Temp\8C32.tmp\b2e.exe
Size 4.6MB
SHA256 c7efdafed754c736cb119eda9bd96403396eeb4c9a503c957a01e72fb625759c
MD5 d916da47cf1a8b13b07ad9c8ffdcca78
SHA1 28eec211eb4856cc3790f4830484c9ab03923d16
SHA512 ff3c3d54df6d4cd08f07aebbfc4878d945f79cf5dd993abb47443b11c89f87dfacf7beb9d8352b9175d1c2e01ad994374a48c4556e1286231a729c405c97313b
SSDEEP 49152:HWVh7Fj/WrXYcatDRddBuqw/LLpGokJsThPz8rJG9nSti9/KKJSusjtZPPxtSVJx:2Vh7J/WrocAdkmBtKCLaDrd
MD5 SHA1 SHA512 SSDEEP

Submit Download

b2e.exe

Path C:\Users\Admin\AppData\Local\Temp\8C32.tmp\b2e.exe
Size 4.8MB
SHA256 85c1626cff0144af9c2e9020913306b9edcf47bbb62ba8dd71cc22f3c7d3ee66
MD5 aa501b6c9131f6086e93f1d4907379ef
SHA1 0c87e59a6f1c983ef7037836315565ccbfc40639
SHA512 bb1cf036d3f876387f72893562a7fb3d6c03ff3f390cf8a9708ad3341e9aed6087ef31d4a67d500076f39b72e7a26f3606220f9ba17236cb0ae19e83fe04fc7b
SSDEEP 49152:HWVh7Fj/WrXYcatDRddBuqw/LLpGokJsThPz8rJG9nSti9/KKJSusjtZPPxtSVJe:2Vh7J/WrocAdkmBtKCLaDr/4QG
MD5 SHA1 SHA512 SSDEEP

Submit Download

batchfile.bat

Path C:\Users\Admin\AppData\Local\Temp\97FA.tmp\batchfile.bat
Size 136B
SHA256 65e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9
MD5 8ea7ac72a10251ecfb42ef4a88bd330a
SHA1 c30f6af73a42c0cc89bd20fe95f9159d6f0756c5
SHA512 a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0
MD5 SHA1 SHA512

Submit Download

cpuminer-sse2.exe

Path C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe
Size 1024KB
SHA256 2a0237405f10841de2c9a5d337e1ae7ef626e562194dc6d096d92ae81e88aea6
MD5 1ad6167569badab73bb51c7109b56693
SHA1 85c80eff3810728aeb4af1cdfc6984facaeeb6c0
SHA512 e219d97f0dc3b5f94798dc75f5328b4e7282c420fbb4ed1b44fb1e17941486f244fa28ccd73f55fcaa299a9b2526395a6a81d20a7ff26d9fe02bad77fec68648
SSDEEP 24576:WbAAkXZfeqVZoq/QpmN/TDjzshtmB1kbQ34igDlnRJ:Wkpplb/LHkmgDlP
MD5 SHA1 SHA512 SSDEEP

Submit Download

cpuminer-sse2.exe

Path C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe
Size 512KB
SHA256 3ee76359d6802a8fe11c5b144e18ffd3833bc7b49d66f190621d41e41ea0fc20
MD5 a879c5fd4613dca566d5b1a782690dd5
SHA1 41c6063b0f0dee953e99713a5326856b55e08366
SHA512 e20f8f40822ca215c75767b8d4102583cfb3812c74dbc064a8619f214c164ab94da6bee0ae42c794a0af1847ff30c295b34d3015f87bfe597dba80339871ea96
SSDEEP 12288:WRtMPAkXZ9Zeql/DZoq/Qphj2XVgQ7N/TiojFZi9lGbZGh8:WbAAkXZfeqVZoq/QpmN/TDjzsh8
MD5 SHA1 SHA512 SSDEEP

Submit Download

libcurl-4.dll

Path C:\Users\Admin\AppData\Local\Temp\libcurl-4.dll
Size 576KB
SHA256 81f3865864af4f5ae909e3cb60ec0e0fd028e37909315b0e3de8663a34391be4
MD5 bfba8ef054be5bee0da072ed080beac4
SHA1 090e6e60a6f0f1e351978e91b99e8dce8e63413f
SHA512 85a8d0b74341c10b3563209566415727a1d1503433908c26c3e861592c397a66afe3cc25bcb31119ec64e15fa078db361bc308474de1ec3f1a8c367d37c622b6
SSDEEP 12288:xup7YufLe62F2G1TdLN7/g4hHdLIn8cUlO4:xufMF9VdLNrjhHdLI8cUlO4
MD5 SHA1 SHA512 SSDEEP

Submit Download

libcurl-4.dll

Path C:\Users\Admin\AppData\Local\Temp\libcurl-4.dll
Size 531KB
SHA256 7cd357497230ab9eccfc5f5613ed82aaa2f0fbced15be72f09e30cae0ad7569b
MD5 e2fd081c49e5fd9da7fedeb14a3bb4cb
SHA1 1b8ce19b5759af726cd9c9cfa1e9720ba5e4b97b
SHA512 03bf652780521cd6f184f407618b354d4baa5330430a01b250dc63d0e6cbcd1555644592a27daa6c61e2bafefc4e908bd72d912c73b5c91084b8e11f1c94099c
SSDEEP 12288:xup7YufLe62F2G1TdLN7/g4hHdLIn8cUc:xufMF9VdLNrjhHdLI8cUc
MD5 SHA1 SHA512 SSDEEP

Submit Download

libgcc_s_seh-1.dll

Path C:\Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll
Size 512KB
SHA256 462eb68967c7205145d0b92e4f3b69297f616187b07a189178f35f288063aff4
MD5 6162b21c54b88c5c990e82aee951ebb4
SHA1 477384ab8ebe5f5a5d5a91603736d9ef53c12fd4
SHA512 6264ee49c4b8a6eaa69241e10ff9ab39445f85a57b756b8bc0530b45d77827d05e669dc06b689d4693db34e4161ef11b2cfe6f1954b0b90bcd434e81a938a40d
SSDEEP 12288:ynYk4yH15191n1q1x1c1vw6t8a1/hKhbhdhvh3hY6Dhch3hhCZ1c1eCJ1MC1+1MT:mnKtg
MD5 SHA1 SHA512 SSDEEP

Submit Download

libstdc++-6.dll

Path C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll
Size 448KB
SHA256 7f141cdc0be9c965e21310bcfb0484b20d31ffd8a6a970f8b5a53c0e8974798a
MD5 ca123cec7f705c0af114e462349dc686
SHA1 75f90b4d95f6774b2f66e4ba790755ef118ab222
SHA512 650125faa9ae6733f1118caf3101ca6850473f78f9bfc3a87e908eac1c69935e3bc269ffb5de4dd6e867429c1af35c7f3b9e62eb698fa7c9695d68e7115f3f1c
SSDEEP 6144:qKRa5s+G7mCiqxo2LhDX9mKm1xWQzyAyMxYATdriIvhFGYGV:9Rgs+Gatqxo2LvmKmOmVriIvhS
MD5 SHA1 SHA512 SSDEEP

Submit Download

libstdc++-6.dll

Path C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll
Size 256KB
SHA256 1493703a430c68bdcedcb4078486daca39a02820199e7b72017c7b1af66e1c8d
MD5 1d86b9560854472453237bcbaa2e253f
SHA1 5a03a7902d250377a3e9f746badcb696e2c98228
SHA512 afbc3d7f8e06e41db25d666999f4d162af7054a66b17a651ac8a7f092f83580a067bfa2f558be65ace5966dffaa8735fe7a579e88bf42b34eaa3e72cdec96699
SSDEEP 3072:OEOWd4lAhRoZuXCFUf2yaYuT4V+Gk3UmCQoUxKN3Kbso2Qo1B2JmDX9mKmxMGx8p:qKRa5s+G7mCiqxo2LhDX9mKm1xWQzyj
MD5 SHA1 SHA512 SSDEEP

Submit Download

libwinpthread-1.dll

Path C:\Users\Admin\AppData\Local\Temp\libwinpthread-1.dll
Size 384KB
SHA256 4e4d7ecae87e8e656c61af89ef17146baf33fbf09ffbde6ae971d04e8e8f9222
MD5 eec15153c344f43f1919cb379b9ee2f9
SHA1 3e4a09390ac885ea2797209603bcfa1ec6ff0cc6
SHA512 7cdf3552341d14979838f8fedf9ac63482152f193ab8f7e0af281ec50b2a43312d78c0e22e79989818c5041538fa69769350e1e6cf0789a165be1eb11ee29908
SSDEEP 6144:g9rAim3YMr6mjmrYGf4qt2zQi/XaWqDqLrwGjqlK+Ge4e+2OliKpKCkZ2cny+6F9:IrAim3Y9lrzf34z//KRwwtkIr1PznEc2
MD5 SHA1 SHA512 SSDEEP

Submit Download

libwinpthread-1.dll

Path C:\Users\Admin\AppData\Local\Temp\libwinpthread-1.dll
Size 256KB
SHA256 1d2b7bd4ddd99d627d5111252baadf028dc9910cf414892867502e5951de962e
MD5 eca0c37eee65c31b869788d5d0bf00cd
SHA1 33a5c0cd2f0a7296a5c0169699ed8e065b57e5e8
SHA512 5f302da7772fca0a6d03ffd8732850f526acf5fcc33e189d2d906a33101454d970d5cca2f829a006d15c4a857341d72c7876cb2e7af84ada4f158695aba5a4dc
SSDEEP 6144:g9rAim3YMr6mjmrYGf4qt2zQi/XaWqDqLrwGjqlK+Ge4e+2OliKpKB:IrAim3Y9lrzf34z//KRwwtkIr1PzB
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2852-53-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/2852-8-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/2884-44-0x0000000070800000-0x00000000708BC000-memory.dmp

Download

memory/2884-64-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/2884-45-0x0000000061440000-0x000000006156B000-memory.dmp

Download

memory/2884-46-0x0000000072160000-0x00000000721F8000-memory.dmp

Download

memory/2884-47-0x0000000001020000-0x00000000028D5000-memory.dmp

Download

memory/2884-48-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/2884-104-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/2884-54-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/2884-59-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/2884-43-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/2884-69-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/2884-79-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/2884-84-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/2884-89-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/2884-94-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/2884-99-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/3280-9-0x0000000000400000-0x000000000393A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads