73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72

Analysis

max time kernel
294s
max time network
291s
platform
windows10-2004_x64
resource
win10v2004-20231215-ja
resource tags

arch:x64arch:x86image:win10v2004-20231215-jalocale:ja-jpos:windows10-2004-x64systemwindows
submitted
13-02-2024 04:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

batexe.exe
Size

9.4MB
MD5

cdc9eacffc6d2bf43153815043064427
SHA1

d05101f265f6ea87e18793ab0071f5c99edf363f
SHA256

73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
SHA512

fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
SSDEEP

196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv

Score

7^/10

upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	batexe.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	b2e.exe

Executes dropped EXE 2 IoCs

pid	Process
1124	b2e.exe
32	cpuminer-sse2.exe

Loads dropped DLL 5 IoCs

pid	Process
32	cpuminer-sse2.exe
32	cpuminer-sse2.exe
32	cpuminer-sse2.exe
32	cpuminer-sse2.exe
32	cpuminer-sse2.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2192-9-0x0000000000400000-0x000000000393A000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 1124	2192	batexe.exe	85
PID 2192 wrote to memory of 1124	2192	batexe.exe	85
PID 2192 wrote to memory of 1124	2192	batexe.exe	85
PID 1124 wrote to memory of 4676	1124	b2e.exe	86
PID 1124 wrote to memory of 4676	1124	b2e.exe	86
PID 1124 wrote to memory of 4676	1124	b2e.exe	86
PID 4676 wrote to memory of 32	4676	cmd.exe	89
PID 4676 wrote to memory of 32	4676	cmd.exe	89

C:\Users\Admin\AppData\Local\Temp\batexe.exe
"C:\Users\Admin\AppData\Local\Temp\batexe.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Users\Admin\AppData\Local\Temp\787C.tmp\b2e.exe
  "C:\Users\Admin\AppData\Local\Temp\787C.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\787C.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1124
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7C64.tmp\batchfile.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4676
  - - C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe
      cpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 3
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:32

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\787C.tmp\b2e.exe

Filesize
17.2MB

MD5
69d71dd00d3a53f59ce5d5f2dbdbd6a2

SHA1
a1a9e5fb6511d3fbbfdf9a5456e00025f2e64a6c

SHA256
c0444ab61b3dad19f46b10e1972f5bc2f043e46ded555cae72da87c126bd5dea

SHA512
5572987bad146cda0c984d3c6bbaccef87d3e1af05800723d087c460933a8e0700d15354bdf35a83cc748b6a00893b8462b09a5bccd598e39835f2c8014efce4

Download Submit
C:\Users\Admin\AppData\Local\Temp\787C.tmp\b2e.exe

Filesize
4.2MB

MD5
2ee2b1b1883532ee566515bf6e3f73b6

SHA1
f9be3d6f47f2bd122f566cd82481feb1c4077bd1

SHA256
f322f9a71151bb838b10232949730a6d685b63c84bebab772d3186a91e66a55d

SHA512
f2b299705da84bed40c1e30dce0e63733bc27c066f05794d4bc27a5001ca5aa69a1b1744060a6bb793d763376f055032fb9bb6c2e285c0a45f0cd89de9077f2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\787C.tmp\b2e.exe

Filesize
5.3MB

MD5
6e99a1f49e1692e84d5649665df356e0

SHA1
0d4c0415531103a66768a6ccdacb453478d25716

SHA256
b33c5745eb9141e0b76eb198a68b5c6ff13d1b857bfa559fbe4bc5ac6a23d474

SHA512
e10df00c1b66a14026935f8fc066273a10e5a4afc4bca70d173aa609b837780fb7f3b3c26d02b570973938ba740b429b7dc00aae3b8d589d0c056360663fa552

Download Submit
C:\Users\Admin\AppData\Local\Temp\7C64.tmp\batchfile.bat

Filesize
136B

MD5
8ea7ac72a10251ecfb42ef4a88bd330a

SHA1
c30f6af73a42c0cc89bd20fe95f9159d6f0756c5

SHA256
65e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9

SHA512
a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0

Download Submit
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe

Filesize
2.3MB

MD5
4c04147c386ba8792ac6a03069572a8a

SHA1
dda67789fc1d0f2469ca95f01a5c81034853ca6a

SHA256
c7739a1e940a282703d06eccda7110426d306f390e97fdbbd9df18472fd132cd

SHA512
a8b5a0b878a9a7d30cb38feff814e1f4dce24d000158edc10a43ee9a89920bedf7adc92eb7e3913098b6aab7fbd0531f56fc09f508b5c2769992a94e55d153db

Download Submit
C:\Users\Admin\AppData\Local\Temp\libcurl-4.dll

Filesize
836KB

MD5
aeab40ed9a8e627ea7cefc1f5cf9bf7a

SHA1
5e2e8ca2881b9bf9edfa3c4fdcec6da1efa102d8

SHA256
218cfc4073bab4eddf0de0804f96b204687311e20a9e97994bff54c9b0e01ee9

SHA512
c0a67616fa01fdc351015212a718faf70da6612fbb3ec13da28dd7af9a507c56882fb7c3eea6fbc37d4d63b970157199d16d0756dbe3cb3bc2223e215cb104d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll

Filesize
1.2MB

MD5
7cf672bee2afba2dcd0c031ff985958e

SHA1
6b82a205db080ffdcb4a4470fce85a14413f3217

SHA256
c82f84171b9246d1cac261100b2199789c96c37b03b375f33b2c72afab060b05

SHA512
3e90d1c1efe0200cb3cc7b51d04783a3cce8391faa6ce554cff8b23dac60be9f8e4f980a8ac005fd9dff8ea4bdcb02311f7649c5be28eb32dcc26417fc4090e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

Filesize
2.7MB

MD5
226b19279742fddc05d59c2dac4fadfe

SHA1
95e77e044699732e06c8272f5946d4d6526f625a

SHA256
806fa420987ecd28275689f308ee6d372af626939619f75c75a4c417a2c2d852

SHA512
026860ddef060d277abae0c67fccbd87468d4af8ff4cb8cda6e0753aad3d79e634fc8f52138f205316492db364152c302fced65931647d79d79fecc11c19a708

Download Submit
C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

Filesize
4.2MB

MD5
24b54b84df8204cc6be4522d9ccc6530

SHA1
c882203f4ebf7289bd1b5d39532cd541703fe653

SHA256
975ea32050fc9830c51dee1d90c57fb713e508c9c03dac2a40fb6698858a3930

SHA512
0bff598f0e99a40ff9325364fa737c8d3dd28a420849fd8d5c180fa2697bd90901433ad53fc61e40832df18fe67f7a082c4c17cb871a9661272b7bb57c2987fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

Filesize
3.6MB

MD5
cb3a6a28626fe9da4d84189e07c87567

SHA1
96564353f069d76d9a8831b02ae88c28260724ec

SHA256
aed07cc14265bc2ac08c579702d058860f605853b3f70a37c182fa9d8fee0f1b

SHA512
4c73b4e8780f3fe4cfd848f64db0611939d97cffe7e263fabfb5cdb18cf0692d49b4758ead3f3a68cabd47d01b99444a5eaed74b9ac301cf5858fba05747f385

Download Submit
C:\Users\Admin\AppData\Local\Temp\libwinpthread-1.dll

Filesize
606KB

MD5
585efec1bc1d4d916a4402c9875dff75

SHA1
d209613666ccac9d0ddab29a3bc59aa00a0968fa

SHA256
2f9984c591a5654434c53e8b4d0c5c187f1fd0bab95247d5c9bc1c0bd60e6232

SHA512
b93163cba4601ed999a7a7d1887113792e846c36850c6d84f2d505727dc06524bb959469f9df12928769f4535dc6074a6b3599b788a4844353e466742ce1e770

Download Submit
memory/32-45-0x000000005BE40000-0x000000005BED8000-memory.dmp

Filesize
608KB

Download
memory/32-59-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/32-43-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/32-99-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/32-44-0x0000000070800000-0x00000000708BC000-memory.dmp

Filesize
752KB

Download
memory/32-46-0x0000000061440000-0x000000006156B000-memory.dmp

Filesize
1.2MB

Download
memory/32-47-0x0000000000E50000-0x0000000002705000-memory.dmp

Filesize
24.7MB

Download
memory/32-89-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/32-54-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/32-84-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/32-64-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/32-69-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/32-74-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/32-79-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/1124-53-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/1124-8-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/2192-9-0x0000000000400000-0x000000000393A000-memory.dmp

Filesize
53.2MB

Download