Analysis

  • max time kernel
    294s
  • max time network
    306s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-ja
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-jalocale:ja-jpos:windows10-2004-x64systemwindows
  • submitted
    14/02/2024, 10:07

General

  • Target

    batexe.exe

  • Size

    9.4MB

  • MD5

    cdc9eacffc6d2bf43153815043064427

  • SHA1

    d05101f265f6ea87e18793ab0071f5c99edf363f

  • SHA256

    73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72

  • SHA512

    fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6

  • SSDEEP

    196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv

Score
7/10
upx

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 5 IoCs
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\batexe.exe
    "C:\Users\Admin\AppData\Local\Temp\batexe.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:884
    • C:\Users\Admin\AppData\Local\Temp\8DC9.tmp\b2e.exe
      "C:\Users\Admin\AppData\Local\Temp\8DC9.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\8DC9.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2912
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\9635.tmp\batchfile.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1520
        • C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe
          cpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 3
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:1440

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\8DC9.tmp\b2e.exe

    Filesize

    1.3MB

    MD5

    1182cf120ba0f67526c5a3d161bdcb80

    SHA1

    a27260358994db862a828750992fded8b21c8631

    SHA256

    81fdb14e30cb2e79f126aee70c3586fbadc0311f02bafbb34baab8477540875b

    SHA512

    f23e04af05da1a961dd63510da031839f93061b0198a02c6aa1e2812883ba88dd6d267e50b9abe7e490a42afed9009bfe84db929b3d944f7067111ee36dad411

  • C:\Users\Admin\AppData\Local\Temp\8DC9.tmp\b2e.exe

    Filesize

    2.6MB

    MD5

    f845d6b8c0beb43591f7ebc96344f81b

    SHA1

    5bcb9d96f6589b559060e11d6d5a0bf73d91c80e

    SHA256

    841b8431f27f5e631d37c605530e6ce5430559c96fa9a6ddebc7e9dd63ad04b2

    SHA512

    8de293211ad14117c9ecb797c78c738c91b691f3dc861401d537cc72c9ba05a40340c452938bd6d72bf400efa1fffb7bb387f204035697b8a229a29288d5d357

  • C:\Users\Admin\AppData\Local\Temp\8DC9.tmp\b2e.exe

    Filesize

    3.7MB

    MD5

    1159e61025af4499c4aee245391fbaa7

    SHA1

    6941af22b356ba5b630cd97791029006a9ac5fa4

    SHA256

    09acfb4f01e9780934a8a94c5fc693816d92723dbcad062494742a9d0168ce8e

    SHA512

    4413550ea82a8f3ffccb42094a208abfc0c4b033e646e7766ed6610e82eadceec6961af17c5302770a3cfa7185b72e9170a0f21de157628c4f7303cb03c452bf

  • C:\Users\Admin\AppData\Local\Temp\9635.tmp\batchfile.bat

    Filesize

    136B

    MD5

    8ea7ac72a10251ecfb42ef4a88bd330a

    SHA1

    c30f6af73a42c0cc89bd20fe95f9159d6f0756c5

    SHA256

    65e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9

    SHA512

    a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0

  • C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe

    Filesize

    832KB

    MD5

    43dd8ab1a0fd7f177db516faa81a9635

    SHA1

    66a8b6940797f3396a4f1a6deafca1fda5bffcdd

    SHA256

    d4b58fa7e09511b58f312b57e2067823a7f31ff5cd6369cbf5ef3667c27b60ea

    SHA512

    064753e38fb6e2d64a8ce067a52c24b55eb11cf714a534f3557a0e2bd2f5fba16030d8496c7787f4b272ae6a696f4b017d99771488832d12711a7158c927f772

  • C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe

    Filesize

    896KB

    MD5

    9f9a8fea08bacf3a1d155567fead5940

    SHA1

    9d9ba8746c585446f53f442b800e1eb28a0df86a

    SHA256

    a22f9d8fb953e4f6bc93cdcc8aa650a5a093f1dd400fdc501d5aa7b00bee0289

    SHA512

    d41a048619373832c616d48f919595ac50dfbbd68095aec008b30adde91ceeeb86326c7d412ab20d937bab7096fb8165d3da8b4fdc40a03cc32da9ee3e9dc2a2

  • C:\Users\Admin\AppData\Local\Temp\libcurl-4.dll

    Filesize

    256KB

    MD5

    11e8812bfa1d698cdeb73a16c1d7c963

    SHA1

    e8708fd452ab5946b380d0c353ac26acf289e548

    SHA256

    e0f9ddf8afd30511763f0cf792369e32c955f15d9529c00c5fe9298a80d74402

    SHA512

    fd54c9c6f3520b2ced6b42235ebfce6d8b622c53f1fbf810baace657a7d44430968b5ff90cd1d860dbdf7550dd8cd467636c862ff0dd0832f25145efccc7731e

  • C:\Users\Admin\AppData\Local\Temp\libcurl-4.dll

    Filesize

    768KB

    MD5

    e3f15c79f945604229fa814f57c79274

    SHA1

    19a7015dfbe622ab86c48693ee1605b26112a3fa

    SHA256

    7b09ee53447ccf77a0f2d7bfe25908f963d681433d3cba5a16c7f45646c42175

    SHA512

    12dc1df8a947caee13a12eca5a976feffd7408402b0495e4971d4bd7181e8d353ebc17da044d2ce6d1c273bb05a0ca5ddf7492394b355786d8b14b0997de162c

  • C:\Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll

    Filesize

    832KB

    MD5

    d33f0e6bb5e8d2b9e111a90544790dc8

    SHA1

    df4e81d22638d511e761744e886c33bc12096c48

    SHA256

    40729edf62213c039a1818c9adb9478aa0284bb26dd071bd1ac4de1da2470048

    SHA512

    ce4ebeae054117d4de8b3fe2403d95a6d819483269f851618958e864887e9b2f42fc9c893e1aa207dfa2d94900c8f4214a67796ddeb2a80ce655d69ec290d629

  • C:\Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll

    Filesize

    640KB

    MD5

    1bff0defeeb9f4bc5cf01e916a8d1379

    SHA1

    bdb668928be0a339e01e3aeeac813fd26b44b950

    SHA256

    d7f49e1dd346940049b753b856759608013f611624432c7ea57b0872239d35c0

    SHA512

    edb3e22bb4d6f3376d73ccd538a61292c5a086fc8ef9b8038b663c93d9ec991bdca297e3c6febb9d18fd16f5304e4fa532d603c68739598f4b65af320ffb3878

  • C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

    Filesize

    832KB

    MD5

    2bfa2b9803bf342837d2cfe9b2b57f64

    SHA1

    e89eec3559c4904ce523943fed97f3fa2534ab39

    SHA256

    38710a4ce8976e3e452fe43563f28f9a8259165fd68ca94f5d64f5f4a299b6ab

    SHA512

    d099f07ca1cb598bdd6f563d917fe3ddcf3f6f37b589f68da987426e416492acf3dbfb2e18387d9afb168308d55c9acfb568c3d31735ab307fc070ff4da93793

  • C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

    Filesize

    576KB

    MD5

    13746f79a51eb8ce3107de99ffc6b56a

    SHA1

    64a00c99a805f8775f08cda4e4d06e1150195347

    SHA256

    2c04d5960f13e859d49c78a8858bdcb0c53914306eba52746105a76d98f5d205

    SHA512

    d0e69c6cf0078c858e8258a4038098e644d611b544b6588b2b1c9d2d2937ade0472edc96257545f5935514bfa18970f5762eb393def612c5a7027727397ca8d7

  • C:\Users\Admin\AppData\Local\Temp\libwinpthread-1.dll

    Filesize

    606KB

    MD5

    585efec1bc1d4d916a4402c9875dff75

    SHA1

    d209613666ccac9d0ddab29a3bc59aa00a0968fa

    SHA256

    2f9984c591a5654434c53e8b4d0c5c187f1fd0bab95247d5c9bc1c0bd60e6232

    SHA512

    b93163cba4601ed999a7a7d1887113792e846c36850c6d84f2d505727dc06524bb959469f9df12928769f4535dc6074a6b3599b788a4844353e466742ce1e770

  • memory/884-9-0x0000000000400000-0x000000000393A000-memory.dmp

    Filesize

    53.2MB

  • memory/1440-64-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/1440-59-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/1440-44-0x0000000070800000-0x00000000708BC000-memory.dmp

    Filesize

    752KB

  • memory/1440-45-0x000000006FEB0000-0x000000006FF48000-memory.dmp

    Filesize

    608KB

  • memory/1440-46-0x0000000061440000-0x000000006156B000-memory.dmp

    Filesize

    1.2MB

  • memory/1440-47-0x0000000000F40000-0x00000000027F5000-memory.dmp

    Filesize

    24.7MB

  • memory/1440-48-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/1440-53-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/1440-104-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/1440-43-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/1440-94-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/1440-69-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/1440-79-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/1440-84-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/1440-89-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/2912-7-0x0000000000400000-0x0000000000405000-memory.dmp

    Filesize

    20KB

  • memory/2912-58-0x0000000000400000-0x0000000000405000-memory.dmp

    Filesize

    20KB