Analysis
-
max time kernel
294s -
max time network
306s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-ja -
resource tags
arch:x64arch:x86image:win10v2004-20231215-jalocale:ja-jpos:windows10-2004-x64systemwindows -
submitted
14/02/2024, 10:07
Behavioral task
behavioral1
Sample
batexe.exe
Resource
win10-20231220-ja
Behavioral task
behavioral2
Sample
batexe.exe
Resource
win10v2004-20231215-ja
General
-
Target
batexe.exe
-
Size
9.4MB
-
MD5
cdc9eacffc6d2bf43153815043064427
-
SHA1
d05101f265f6ea87e18793ab0071f5c99edf363f
-
SHA256
73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
-
SHA512
fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
-
SSDEEP
196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation batexe.exe Key value queried \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation b2e.exe -
Executes dropped EXE 2 IoCs
pid Process 2912 b2e.exe 1440 cpuminer-sse2.exe -
Loads dropped DLL 5 IoCs
pid Process 1440 cpuminer-sse2.exe 1440 cpuminer-sse2.exe 1440 cpuminer-sse2.exe 1440 cpuminer-sse2.exe 1440 cpuminer-sse2.exe -
resource yara_rule behavioral2/memory/884-9-0x0000000000400000-0x000000000393A000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 884 wrote to memory of 2912 884 batexe.exe 84 PID 884 wrote to memory of 2912 884 batexe.exe 84 PID 884 wrote to memory of 2912 884 batexe.exe 84 PID 2912 wrote to memory of 1520 2912 b2e.exe 85 PID 2912 wrote to memory of 1520 2912 b2e.exe 85 PID 2912 wrote to memory of 1520 2912 b2e.exe 85 PID 1520 wrote to memory of 1440 1520 cmd.exe 88 PID 1520 wrote to memory of 1440 1520 cmd.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\batexe.exe"C:\Users\Admin\AppData\Local\Temp\batexe.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:884 -
C:\Users\Admin\AppData\Local\Temp\8DC9.tmp\b2e.exe"C:\Users\Admin\AppData\Local\Temp\8DC9.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\8DC9.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\9635.tmp\batchfile.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.execpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1440
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD51182cf120ba0f67526c5a3d161bdcb80
SHA1a27260358994db862a828750992fded8b21c8631
SHA25681fdb14e30cb2e79f126aee70c3586fbadc0311f02bafbb34baab8477540875b
SHA512f23e04af05da1a961dd63510da031839f93061b0198a02c6aa1e2812883ba88dd6d267e50b9abe7e490a42afed9009bfe84db929b3d944f7067111ee36dad411
-
Filesize
2.6MB
MD5f845d6b8c0beb43591f7ebc96344f81b
SHA15bcb9d96f6589b559060e11d6d5a0bf73d91c80e
SHA256841b8431f27f5e631d37c605530e6ce5430559c96fa9a6ddebc7e9dd63ad04b2
SHA5128de293211ad14117c9ecb797c78c738c91b691f3dc861401d537cc72c9ba05a40340c452938bd6d72bf400efa1fffb7bb387f204035697b8a229a29288d5d357
-
Filesize
3.7MB
MD51159e61025af4499c4aee245391fbaa7
SHA16941af22b356ba5b630cd97791029006a9ac5fa4
SHA25609acfb4f01e9780934a8a94c5fc693816d92723dbcad062494742a9d0168ce8e
SHA5124413550ea82a8f3ffccb42094a208abfc0c4b033e646e7766ed6610e82eadceec6961af17c5302770a3cfa7185b72e9170a0f21de157628c4f7303cb03c452bf
-
Filesize
136B
MD58ea7ac72a10251ecfb42ef4a88bd330a
SHA1c30f6af73a42c0cc89bd20fe95f9159d6f0756c5
SHA25665e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9
SHA512a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0
-
Filesize
832KB
MD543dd8ab1a0fd7f177db516faa81a9635
SHA166a8b6940797f3396a4f1a6deafca1fda5bffcdd
SHA256d4b58fa7e09511b58f312b57e2067823a7f31ff5cd6369cbf5ef3667c27b60ea
SHA512064753e38fb6e2d64a8ce067a52c24b55eb11cf714a534f3557a0e2bd2f5fba16030d8496c7787f4b272ae6a696f4b017d99771488832d12711a7158c927f772
-
Filesize
896KB
MD59f9a8fea08bacf3a1d155567fead5940
SHA19d9ba8746c585446f53f442b800e1eb28a0df86a
SHA256a22f9d8fb953e4f6bc93cdcc8aa650a5a093f1dd400fdc501d5aa7b00bee0289
SHA512d41a048619373832c616d48f919595ac50dfbbd68095aec008b30adde91ceeeb86326c7d412ab20d937bab7096fb8165d3da8b4fdc40a03cc32da9ee3e9dc2a2
-
Filesize
256KB
MD511e8812bfa1d698cdeb73a16c1d7c963
SHA1e8708fd452ab5946b380d0c353ac26acf289e548
SHA256e0f9ddf8afd30511763f0cf792369e32c955f15d9529c00c5fe9298a80d74402
SHA512fd54c9c6f3520b2ced6b42235ebfce6d8b622c53f1fbf810baace657a7d44430968b5ff90cd1d860dbdf7550dd8cd467636c862ff0dd0832f25145efccc7731e
-
Filesize
768KB
MD5e3f15c79f945604229fa814f57c79274
SHA119a7015dfbe622ab86c48693ee1605b26112a3fa
SHA2567b09ee53447ccf77a0f2d7bfe25908f963d681433d3cba5a16c7f45646c42175
SHA51212dc1df8a947caee13a12eca5a976feffd7408402b0495e4971d4bd7181e8d353ebc17da044d2ce6d1c273bb05a0ca5ddf7492394b355786d8b14b0997de162c
-
Filesize
832KB
MD5d33f0e6bb5e8d2b9e111a90544790dc8
SHA1df4e81d22638d511e761744e886c33bc12096c48
SHA25640729edf62213c039a1818c9adb9478aa0284bb26dd071bd1ac4de1da2470048
SHA512ce4ebeae054117d4de8b3fe2403d95a6d819483269f851618958e864887e9b2f42fc9c893e1aa207dfa2d94900c8f4214a67796ddeb2a80ce655d69ec290d629
-
Filesize
640KB
MD51bff0defeeb9f4bc5cf01e916a8d1379
SHA1bdb668928be0a339e01e3aeeac813fd26b44b950
SHA256d7f49e1dd346940049b753b856759608013f611624432c7ea57b0872239d35c0
SHA512edb3e22bb4d6f3376d73ccd538a61292c5a086fc8ef9b8038b663c93d9ec991bdca297e3c6febb9d18fd16f5304e4fa532d603c68739598f4b65af320ffb3878
-
Filesize
832KB
MD52bfa2b9803bf342837d2cfe9b2b57f64
SHA1e89eec3559c4904ce523943fed97f3fa2534ab39
SHA25638710a4ce8976e3e452fe43563f28f9a8259165fd68ca94f5d64f5f4a299b6ab
SHA512d099f07ca1cb598bdd6f563d917fe3ddcf3f6f37b589f68da987426e416492acf3dbfb2e18387d9afb168308d55c9acfb568c3d31735ab307fc070ff4da93793
-
Filesize
576KB
MD513746f79a51eb8ce3107de99ffc6b56a
SHA164a00c99a805f8775f08cda4e4d06e1150195347
SHA2562c04d5960f13e859d49c78a8858bdcb0c53914306eba52746105a76d98f5d205
SHA512d0e69c6cf0078c858e8258a4038098e644d611b544b6588b2b1c9d2d2937ade0472edc96257545f5935514bfa18970f5762eb393def612c5a7027727397ca8d7
-
Filesize
606KB
MD5585efec1bc1d4d916a4402c9875dff75
SHA1d209613666ccac9d0ddab29a3bc59aa00a0968fa
SHA2562f9984c591a5654434c53e8b4d0c5c187f1fd0bab95247d5c9bc1c0bd60e6232
SHA512b93163cba4601ed999a7a7d1887113792e846c36850c6d84f2d505727dc06524bb959469f9df12928769f4535dc6074a6b3599b788a4844353e466742ce1e770