73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72

Analysis

max time kernel
301s
max time network
303s
platform
windows10-2004_x64
resource
win10v2004-20231215-ja
resource tags

arch:x64arch:x86image:win10v2004-20231215-jalocale:ja-jpos:windows10-2004-x64systemwindows
submitted
17/02/2024, 13:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

batexe.exe
Size

9.4MB
MD5

cdc9eacffc6d2bf43153815043064427
SHA1

d05101f265f6ea87e18793ab0071f5c99edf363f
SHA256

73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
SHA512

fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
SSDEEP

196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv

Score

7^/10

upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	batexe.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	b2e.exe

Executes dropped EXE 2 IoCs

pid	Process
2172	b2e.exe
2524	cpuminer-sse2.exe

Loads dropped DLL 5 IoCs

pid	Process
2524	cpuminer-sse2.exe
2524	cpuminer-sse2.exe
2524	cpuminer-sse2.exe
2524	cpuminer-sse2.exe
2524	cpuminer-sse2.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5420-9-0x0000000000400000-0x000000000393A000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5420 wrote to memory of 2172	5420	batexe.exe	81
PID 5420 wrote to memory of 2172	5420	batexe.exe	81
PID 5420 wrote to memory of 2172	5420	batexe.exe	81
PID 2172 wrote to memory of 5132	2172	b2e.exe	82
PID 2172 wrote to memory of 5132	2172	b2e.exe	82
PID 2172 wrote to memory of 5132	2172	b2e.exe	82
PID 5132 wrote to memory of 2524	5132	cmd.exe	85
PID 5132 wrote to memory of 2524	5132	cmd.exe	85

C:\Users\Admin\AppData\Local\Temp\batexe.exe
"C:\Users\Admin\AppData\Local\Temp\batexe.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5420
- C:\Users\Admin\AppData\Local\Temp\FA8C.tmp\b2e.exe
  "C:\Users\Admin\AppData\Local\Temp\FA8C.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\FA8C.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2172
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\6C1.tmp\batchfile.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5132
  - - C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe
      cpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 3
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\6C1.tmp\batchfile.bat

Filesize
136B

MD5
8ea7ac72a10251ecfb42ef4a88bd330a

SHA1
c30f6af73a42c0cc89bd20fe95f9159d6f0756c5

SHA256
65e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9

SHA512
a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0

Download Submit
C:\Users\Admin\AppData\Local\Temp\FA8C.tmp\b2e.exe

Filesize
1.5MB

MD5
3b865edba29311b96d9d6515191d984a

SHA1
ee6ffc68321516195ed72090e1c78d3b3e5b54a0

SHA256
b09e6bbdc593897c6d1793ab4ca2d93787c79e75e95556adfc120e25e93d4a2b

SHA512
26bdb7ec1d7b642ae0129418a7dcef9b56ffdba9a1fc155f291e744296cad9cb590494097bfe3550a9a979794d6c328ffd0a8dde38d122ba4f626759818aaada

Download Submit
C:\Users\Admin\AppData\Local\Temp\FA8C.tmp\b2e.exe

Filesize
3.6MB

MD5
beb6a1c06aab183b5ad12d5c7915f712

SHA1
376030e3dad3648c24139fb1b5daeb82d7110311

SHA256
eb58c85d8b6deed585303834aff46da13ad2d7abae8bfc625263e49997357813

SHA512
b4bd377b0ade7207aaf390f2c154525a663e219ed999737fb55aafb324a3299bc21e51a074d37333fd4e048c7ce2d2638ed2a589967f4516c9f8b852f8a82632

Download Submit
C:\Users\Admin\AppData\Local\Temp\FA8C.tmp\b2e.exe

Filesize
2.7MB

MD5
8bf8f5c9d34334938bf32fc15bc9404d

SHA1
fc6b04c193ad23f74ea2a395d67fabfd9ac4aeae

SHA256
176555a7e230054dfb5acb067e8b9306657c5c574f903e67fec1ffe8ecd0a372

SHA512
47658beffb531e00acbd6e1949d549fc8a936f8af46020fb94f6664bac9d153137fdbd2a9b8fb0a5747a06810949cada5de0a014bfcb1928819904c906293dce

Download Submit
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe

Filesize
1.2MB

MD5
112f1a7d4132b6afed35ae8471e78277

SHA1
b6c1b7e74b510b6996f51e72d24cc882a8e0dbcd

SHA256
cc9c234dcbb05bea61594bc251d0975052080783a53285a25b34b6bea11ab210

SHA512
d7980193a51d973e92ba1fdae09dcc5bf9efc0638b5de9b7c1d745a9909f051a995cb5c0be2e94d36725f08c3d9c17e33794809f333ba855edc6d858e5797064

Download Submit
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe

Filesize
1.3MB

MD5
79986aaa88df4c9c5424c269cf618930

SHA1
38c5da9b8204e96588f63e7980431113bc51abec

SHA256
881ef2e2cc66e9ed578ec04b76fb09759d323cd006553714dbdcb2cd3c68451c

SHA512
02e821f128e9dc5c92b3cb11a188632956ac83106f9abc9ec7202fbbb769f1b8221562d7b3f8ffbadf10251476f555223ec3166cdc83c62c3a6810aaa3de650c

Download Submit
C:\Users\Admin\AppData\Local\Temp\libcurl-4.dll

Filesize
836KB

MD5
aeab40ed9a8e627ea7cefc1f5cf9bf7a

SHA1
5e2e8ca2881b9bf9edfa3c4fdcec6da1efa102d8

SHA256
218cfc4073bab4eddf0de0804f96b204687311e20a9e97994bff54c9b0e01ee9

SHA512
c0a67616fa01fdc351015212a718faf70da6612fbb3ec13da28dd7af9a507c56882fb7c3eea6fbc37d4d63b970157199d16d0756dbe3cb3bc2223e215cb104d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll

Filesize
1.2MB

MD5
7cf672bee2afba2dcd0c031ff985958e

SHA1
6b82a205db080ffdcb4a4470fce85a14413f3217

SHA256
c82f84171b9246d1cac261100b2199789c96c37b03b375f33b2c72afab060b05

SHA512
3e90d1c1efe0200cb3cc7b51d04783a3cce8391faa6ce554cff8b23dac60be9f8e4f980a8ac005fd9dff8ea4bdcb02311f7649c5be28eb32dcc26417fc4090e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

Filesize
1.4MB

MD5
24b53684a11e2f93a077f73388d85473

SHA1
55146ca4b4d73cddc96ab885d0428e581965820e

SHA256
89e9c4599503092b76b4e5076b2cd8b105983819a05ecf999ddc88d265e8c78d

SHA512
76347d845651f883257e61a3a959caafa73a8373ae996e0d60e118c6b3185ff39a74073f64e6818dd40e51f63fef2b4f344c521b8542338ce86decc3e1cece1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

Filesize
2.0MB

MD5
b7d0263470e978f23f3ff71901cd8113

SHA1
f38e278bebd27b437f82c41ff8072f1f0e10b2dd

SHA256
2cab3f6e3c97ad07c3cfd802683b5b6c1b7ffac0be8f5362f763f10055932ca5

SHA512
012604356ab166b6d3f8bfe6fc3f9f9d878b2934928fbe08325ad0e8c2192c64f373a1713485606f0bd4136f50526c88773372611092c0b6d81cedc2fcc39737

Download Submit
C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

Filesize
1.1MB

MD5
23d4d68475ed4b25ab1bab1f9f07c3ec

SHA1
fc92c4d0c781a7ce39bffe0d7c0fc31a6e75b52f

SHA256
312e58f619dfacb39bce9db7ce119248bd009130dde33d0bb464c2d5a10e05ce

SHA512
d9cb5fd7b57eb7febbfe7950c73069cf8f014f8700c83857db458c83d07c0ef081a2a141984968b814765d435e7f36b5b38fb354dd887546c4d8f34b6bec9326

Download Submit
C:\Users\Admin\AppData\Local\Temp\libwinpthread-1.dll

Filesize
606KB

MD5
585efec1bc1d4d916a4402c9875dff75

SHA1
d209613666ccac9d0ddab29a3bc59aa00a0968fa

SHA256
2f9984c591a5654434c53e8b4d0c5c187f1fd0bab95247d5c9bc1c0bd60e6232

SHA512
b93163cba4601ed999a7a7d1887113792e846c36850c6d84f2d505727dc06524bb959469f9df12928769f4535dc6074a6b3599b788a4844353e466742ce1e770

Download Submit
memory/2172-53-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/2172-7-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/2524-43-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/2524-59-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/2524-45-0x0000000061440000-0x000000006156B000-memory.dmp

Filesize
1.2MB

Download
memory/2524-46-0x00000000635D0000-0x0000000063668000-memory.dmp

Filesize
608KB

Download
memory/2524-47-0x0000000000F40000-0x00000000027F5000-memory.dmp

Filesize
24.7MB

Download
memory/2524-99-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/2524-54-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/2524-44-0x0000000070800000-0x00000000708BC000-memory.dmp

Filesize
752KB

Download
memory/2524-64-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/2524-69-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/2524-79-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/2524-84-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/2524-94-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/5420-9-0x0000000000400000-0x000000000393A000-memory.dmp

Filesize
53.2MB

Download