Analysis
-
max time kernel
299s -
max time network
308s -
platform
windows10-1703_x64 -
resource
win10-20231215-ja -
resource tags
arch:x64arch:x86image:win10-20231215-jalocale:ja-jpos:windows10-1703-x64systemwindows -
submitted
12/02/2024, 05:34
Behavioral task
behavioral1
Sample
batexe.exe
Resource
win10-20231215-ja
Behavioral task
behavioral2
Sample
batexe.exe
Resource
win10v2004-20231215-ja
General
-
Target
batexe.exe
-
Size
9.4MB
-
MD5
cdc9eacffc6d2bf43153815043064427
-
SHA1
d05101f265f6ea87e18793ab0071f5c99edf363f
-
SHA256
73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
-
SHA512
fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
-
SSDEEP
196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2928 b2e.exe 4940 cpuminer-sse2.exe -
Loads dropped DLL 5 IoCs
pid Process 4940 cpuminer-sse2.exe 4940 cpuminer-sse2.exe 4940 cpuminer-sse2.exe 4940 cpuminer-sse2.exe 4940 cpuminer-sse2.exe -
resource yara_rule behavioral1/memory/3824-5-0x0000000000400000-0x000000000393A000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3824 wrote to memory of 2928 3824 batexe.exe 74 PID 3824 wrote to memory of 2928 3824 batexe.exe 74 PID 3824 wrote to memory of 2928 3824 batexe.exe 74 PID 2928 wrote to memory of 4108 2928 b2e.exe 77 PID 2928 wrote to memory of 4108 2928 b2e.exe 77 PID 2928 wrote to memory of 4108 2928 b2e.exe 77 PID 4108 wrote to memory of 4940 4108 cmd.exe 78 PID 4108 wrote to memory of 4940 4108 cmd.exe 78
Processes
-
C:\Users\Admin\AppData\Local\Temp\batexe.exe"C:\Users\Admin\AppData\Local\Temp\batexe.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\Users\Admin\AppData\Local\Temp\ACF9.tmp\b2e.exe"C:\Users\Admin\AppData\Local\Temp\ACF9.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\ACF9.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\B15E.tmp\batchfile.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.execpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4940
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7.7MB
MD55686510951dd6a21de967e4aae5cdc50
SHA1c085e1a4361e26919e8f82e04ba256e415396503
SHA25685df9f70fe4ba1d12a9d5c4de57597263555c0a4e2c41a7aabfe270c2042b03e
SHA512e0a1a86e1e11139fdc6e4366002ec1469d92f8cf52492ef9323d73d32011e6005b9b8c9e7d1824f5ebac39719cbb51169c5874f8dc223c1e08fce473b759d6df
-
Filesize
8.6MB
MD5962895566149e3ba069e848b788fc26d
SHA19707e4728751f02f130f28b4bb2978e8cad68e8c
SHA2567c544c1e74627614357505557f028e1f08b163e78b9d230169fcd746083f5aff
SHA512fda892854a462a005fd842c67085f56d67410403e92056afd3174711817ae30a9dab7f4b1e055277aa5dcbfc8e4df55b8aefe7ddfc8c70ad894c7751665fee4b
-
Filesize
136B
MD58ea7ac72a10251ecfb42ef4a88bd330a
SHA1c30f6af73a42c0cc89bd20fe95f9159d6f0756c5
SHA25665e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9
SHA512a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0
-
Filesize
2.3MB
MD54c04147c386ba8792ac6a03069572a8a
SHA1dda67789fc1d0f2469ca95f01a5c81034853ca6a
SHA256c7739a1e940a282703d06eccda7110426d306f390e97fdbbd9df18472fd132cd
SHA512a8b5a0b878a9a7d30cb38feff814e1f4dce24d000158edc10a43ee9a89920bedf7adc92eb7e3913098b6aab7fbd0531f56fc09f508b5c2769992a94e55d153db
-
Filesize
192KB
MD58c933a591c8d0c1fec1da393587d09c9
SHA165f4672c0e0a6a20436fbaba57dac8c1a5fc5e51
SHA256c22ca427c0e65a0bb3e011afeba5244dd5a6e9c0327cfc7d15c4875083206b10
SHA51296b84267fd9b7c5587c74e30d5f647acabbf6b09feac19784de4e046619fcae78f2e6aa98eb7f06fe13197bfd9207b9044b09d5248480421ceb23cb01d511881
-
Filesize
5.4MB
MD5b69b2b567106989129ddd1f281a2dbfc
SHA1f920cdbab8e8093c517e2fe6f927532e18f4f230
SHA2567cb5d6cab0fa416105b593d2b5a12d9f87fbd74ee6ab856b7771060dddcfe0cc
SHA5129757224357a416619e6f265b7d470794aa4da7a0c33d0bd2809a9288dd629258357b3c799fcc2663a08bfcb254e00233b9c8d36f0c3188e95a1ffa1ee1334578
-
Filesize
128KB
MD58d949f4e279a9a80f50d7c2e0c7bff36
SHA192e29300716211895b2d8cd4cf010452f0132152
SHA2562e87614d15e62262c8b0a0c65e302b15e971b591469f3c679e7e516934cf621f
SHA51236565dc0a3290ac8c5e0fd0a2756764ce8e49a7ef52a437caad549c7ea1ac3ac7dfe05cd4951ed6b17051768fd9733c94365d85832092c429b0b74ab62a338fb
-
Filesize
128KB
MD50cfc533c46d2f160fc8d8483706228cf
SHA10d13ced09eeed5fc3879f418bda0410a742ab6a1
SHA256510a6af4547083718b32dc00d4711cfff2aec0e7b936d4199feaaf32a7d5d3a6
SHA51211e35867688e7814881981298b6f6948fceaf254d154f5429e5a82c43397b1894bd35fe7fb586b26e4272d8371c3b8e96c20c71ab05b9df3e851291444702a79
-
Filesize
1.2MB
MD57cf672bee2afba2dcd0c031ff985958e
SHA16b82a205db080ffdcb4a4470fce85a14413f3217
SHA256c82f84171b9246d1cac261100b2199789c96c37b03b375f33b2c72afab060b05
SHA5123e90d1c1efe0200cb3cc7b51d04783a3cce8391faa6ce554cff8b23dac60be9f8e4f980a8ac005fd9dff8ea4bdcb02311f7649c5be28eb32dcc26417fc4090e5
-
Filesize
64KB
MD5e98583e2f3157ea2561f40a91a79b195
SHA1770932f48dbea7a78a3b21e3df65e329a27313ff
SHA256f6b3de2ac1e9c449daf82a3bd6fa52d2ed60e73e8cdd25d5d2194586a8d10de2
SHA512cfa97067447a389dc5439dc42ca467f97947fa7010314cad0b99655688361721720bb33e34a1c7b22c93d807327b756109f63d15a40df5aaec620b0d0e1acc7f