73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72

Analysis

max time kernel
304s
max time network
309s
platform
windows10-2004_x64
resource
win10v2004-20231215-ja
resource tags

arch:x64arch:x86image:win10v2004-20231215-jalocale:ja-jpos:windows10-2004-x64systemwindows
submitted
13-02-2024 09:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

batexe.exe
Size

9.4MB
MD5

cdc9eacffc6d2bf43153815043064427
SHA1

d05101f265f6ea87e18793ab0071f5c99edf363f
SHA256

73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
SHA512

fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
SSDEEP

196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv

Score

7^/10

upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	batexe.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	b2e.exe

Executes dropped EXE 2 IoCs

pid	Process
6092	b2e.exe
452	cpuminer-sse2.exe

Loads dropped DLL 6 IoCs

pid	Process
452	cpuminer-sse2.exe
452	cpuminer-sse2.exe
452	cpuminer-sse2.exe
452	cpuminer-sse2.exe
452	cpuminer-sse2.exe
452	cpuminer-sse2.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3120-9-0x0000000000400000-0x000000000393A000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3120 wrote to memory of 6092	3120	batexe.exe	85
PID 3120 wrote to memory of 6092	3120	batexe.exe	85
PID 3120 wrote to memory of 6092	3120	batexe.exe	85
PID 6092 wrote to memory of 464	6092	b2e.exe	86
PID 6092 wrote to memory of 464	6092	b2e.exe	86
PID 6092 wrote to memory of 464	6092	b2e.exe	86
PID 464 wrote to memory of 452	464	cmd.exe	89
PID 464 wrote to memory of 452	464	cmd.exe	89

C:\Users\Admin\AppData\Local\Temp\batexe.exe
"C:\Users\Admin\AppData\Local\Temp\batexe.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3120
- C:\Users\Admin\AppData\Local\Temp\3BDB.tmp\b2e.exe
  "C:\Users\Admin\AppData\Local\Temp\3BDB.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\3BDB.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:6092
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\4A14.tmp\batchfile.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:464
  - - C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe
      cpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 3
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3BDB.tmp\b2e.exe

Filesize
5.5MB

MD5
17334807d7629756b100c6c1f54041e0

SHA1
28bea3232261b14e8a047e69627fab7662b81219

SHA256
deee344fbcd7d5a8e450daad50ac2a5e118b36e6869576faf0d61a214b44b5e8

SHA512
844bfc139b286d977af72e328ac01ceadf0689b91540ed2aaf49d16985c3a150e21021b54582827e8b580e62fa7ed5cfe8f4419014b61c1497868874a4202b4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\3BDB.tmp\b2e.exe

Filesize
3.1MB

MD5
e6a998796edb208d11efbfc8ee56f813

SHA1
a35e54a57b5d461ee0bd492807b3b78004d69ec2

SHA256
22161d804184330e03ae68aabee84a3a6263b4b5933efd40184e7cc669c34e05

SHA512
ca8ddbc31e992a41a1bca608560dbb6f528cef8b5ff4ffdfceed8e76f09702a13d408d7b302c847a20105b04b639edbfa8b4fd5d7ae6f291c540df1bbafb6566

Download Submit
C:\Users\Admin\AppData\Local\Temp\3BDB.tmp\b2e.exe

Filesize
4.0MB

MD5
45b0716186ef0c08a368c8afd2e767d0

SHA1
8a0aeb822ace83ed8271586e44cdbffd5f031858

SHA256
2bca53fbff93efd4e6ffe18eccdde4837043f4338ae02057dccaae70eee876fa

SHA512
733fcdfd595f16476b654d6f1c69636969e0b371db2b305e1a953a8bec9c0ab5bc67265674b46dbe7b260afeeea394e903e87e235a0e7983ce1eec8243e71b0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\4A14.tmp\batchfile.bat

Filesize
136B

MD5
8ea7ac72a10251ecfb42ef4a88bd330a

SHA1
c30f6af73a42c0cc89bd20fe95f9159d6f0756c5

SHA256
65e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9

SHA512
a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0

Download Submit
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe

Filesize
113KB

MD5
a25de14a22503ecb23eee72f6847e479

SHA1
5de370b9cdf522197873db01ac12a5f7aceef968

SHA256
4e4b4568588191b9c1c1a502ec2c04e71a3603629cfa3e79025ea85ac3d24d99

SHA512
c90496665196561eefe6f6b780a2f709045f356afc084ab4f271e2bfb78fd991da2ab4bddf3505ddc08a74193a00cfd976399fa569caf0b49f316e4579956b00

Download Submit
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe

Filesize
1.0MB

MD5
aac365cf91d4e5c7a3184fbe75f6887d

SHA1
c3cc1c3c717208be7b6d90df22ba88aa461c7056

SHA256
b549fa010f79467df954ca69041223018037ed9e352e13c7dacec0a92e0b11dc

SHA512
a2a1e60d2df990513962c87eb65aa92f8aed15a87c464c948e49642c4f3b4567b513ef58a492c0b691fa1eeacba91846f330085d8fb6925936c2a6841c0dc18c

Download Submit
C:\Users\Admin\AppData\Local\Temp\libcurl-4.dll

Filesize
73KB

MD5
3a9b8f3f5874cd6d82803656949f881b

SHA1
9c887dacc0d29747487f9b9b1343c613e81e89f2

SHA256
99c4408aad5f8344ef971638b4576d8572c509a7a0a8bf236fe11af409cc3f92

SHA512
87838e47d17c7330908e7ccb15b4d85551a8a972fa377ed8d0b5461f96fbf436206c440244916c53cb71a112a14fa19fddd7eafc20437377e717037c2bf7fa19

Download Submit
C:\Users\Admin\AppData\Local\Temp\libcurl-4.dll

Filesize
15KB

MD5
24b8a6c4f1aab2ed69a85ae8f600b03a

SHA1
f4d0b935a671d313907f8ae77eabcc4f8c967fba

SHA256
db14a1f3fbe5bf75ca0d767f23bd21b7a18554204ed4a244b9c4a2236087c46b

SHA512
d4387a3b43703be9b0c8f57548173365ebb8156367d0d5f1854262d65595e0bd810926c19c24dc6a9d1e2d4a7df32e87a22cf07a4b4e89507c90e035b4103bc6

Download Submit
C:\Users\Admin\AppData\Local\Temp\libcurl-4.dll

Filesize
14KB

MD5
e08bc25b7143f5ad438a38a95d383599

SHA1
d9aeb555ee1bf78f0af69d576bb3dd1139f3b973

SHA256
999d6a9cc1ee5d8aafccee247c9ad40e8783473af3107fee43681284822076fd

SHA512
6ea8acad6df52e0e1c873c7ec66ae425ba783595f4253dab80cc343edd5ee60a999f9dd7fceb77f4cf273e1e89e0e0c8ce0505a65aab6b10fd09a82df081de22

Download Submit
C:\Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll

Filesize
810KB

MD5
02ee569b3758024269bb3c057eee2692

SHA1
fa4a7f2f84c85eb7786f8aa5bb781ada639a3064

SHA256
c9dd7a484c055508350f1f1c1c9eedfa75d3ea967f91cb51a9213228e7cdde46

SHA512
c1a73ff6c44a2bd106d83faa444547a46978c383dec5c26d7c0654cccb2cdad9a28e2103fc994baa811e279a5f62fefdf9b44293b82ca4a09756ee6d6429a090

Download Submit
C:\Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll

Filesize
158KB

MD5
cefec4e0991537e02773338470e36693

SHA1
98337238ba39675ec046eaf3be0b19a03398c8ef

SHA256
ff8aa536ea0c8dfbe89e7e9fe2ae97aa205691ca0727dabe6b19b53abdf08467

SHA512
34f17ea55ce66f0d344f9d8eb6749359623e9115aee6ad41678d08df5e1601e51a64c499a658ff6a7bbd5e18b583ffd27431ac67874f4d83cd8002c4e4127a10

Download Submit
C:\Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll

Filesize
134KB

MD5
e64747e48789e8d4a1d4d7632baddb0f

SHA1
320e6abaa7e11d06dd578fc82afb01f3777efae4

SHA256
1d834e1e8dfa287aa4474fa769450e4dca74b95473a349e87b582ebb3dd7910f

SHA512
173921c9f323346e8e9182fbc01cd68d5caf7db3c3a58a65ccd53d6b9a99b7645fddec52bf5a7149f5c7f43d1e9f3990a2eedc4830835af42d7fe0e1a5479677

Download Submit
C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

Filesize
125KB

MD5
a31b53fb563529d0bd4cab8ad4e437c3

SHA1
c05f05ca538b8aeb2150a1ddcd1b322a4ec666d2

SHA256
d72da6ba484ab04f4a8c8716b09371e50e659fd905a45c2c0191a5ba1a485960

SHA512
47e1c228640925d50270906d10cca38d9b207da1fe7fe6003ce2e70de05cd856340104508d3cb4dd18d1709e5bf3abff2e09605e5e0a87e1ea6c32c03c2dca0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

Filesize
125KB

MD5
f2541b996b853bb7489579f86f1f8dfb

SHA1
c207dc9213bd55f75cbe2fea360b17a89bd9685f

SHA256
7c5dff6138f2e175a939e91c2d94fdbc66e1f31bcab83879cbda2bc200f16c29

SHA512
404ee25b6e072918ea4e97062c8f80cf984c32bfd5599cbf77265c057676f80765bd6a353372d633574cee45580d82f684a42d349acf0d9b0cc33d325f8897f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\libwinpthread-1.dll

Filesize
425KB

MD5
8b203b381d059501764ae6f7fc43f05b

SHA1
30c6abe0879998cdb47983203ace22af3936b433

SHA256
53134c5cd7ca71146d74544d1ffaf2e0fe4fa06ee53e03ff5439ea4f75091fa0

SHA512
15e38266e3a7adb7efbd7e6b09fa26119c9642ae57e454a263eb3dc67b19220c20cd6e4bd73ef37ea46eeb5124561d30c0fcb1d437a27f4a689dd5b6e03c8ef1

Download Submit
C:\Users\Admin\AppData\Local\Temp\libwinpthread-1.dll

Filesize
606KB

MD5
585efec1bc1d4d916a4402c9875dff75

SHA1
d209613666ccac9d0ddab29a3bc59aa00a0968fa

SHA256
2f9984c591a5654434c53e8b4d0c5c187f1fd0bab95247d5c9bc1c0bd60e6232

SHA512
b93163cba4601ed999a7a7d1887113792e846c36850c6d84f2d505727dc06524bb959469f9df12928769f4535dc6074a6b3599b788a4844353e466742ce1e770

Download Submit
memory/452-50-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/452-49-0x0000000065FD0000-0x0000000066068000-memory.dmp

Filesize
608KB

Download
memory/452-101-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/452-45-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/452-42-0x0000000000F40000-0x0000000000FFC000-memory.dmp

Filesize
752KB

Download
memory/452-47-0x0000000061440000-0x000000006156B000-memory.dmp

Filesize
1.2MB

Download
memory/452-91-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/452-48-0x0000000000F40000-0x0000000000FFC000-memory.dmp

Filesize
752KB

Download
memory/452-46-0x000000006FC40000-0x00000000714F5000-memory.dmp

Filesize
24.7MB

Download
memory/452-86-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/452-61-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/452-71-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/452-76-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/3120-9-0x0000000000400000-0x000000000393A000-memory.dmp

Filesize
53.2MB

Download
memory/6092-55-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/6092-7-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download