73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72

Analysis

max time kernel
293s
max time network
301s
platform
windows10-1703_x64
resource
win10-20240214-ja
resource tags

arch:x64arch:x86image:win10-20240214-jalocale:ja-jpos:windows10-1703-x64systemwindows
submitted
17/02/2024, 18:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

batexe.exe
Size

9.4MB
MD5

cdc9eacffc6d2bf43153815043064427
SHA1

d05101f265f6ea87e18793ab0071f5c99edf363f
SHA256

73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
SHA512

fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
SSDEEP

196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
168	b2e.exe
4516	cpuminer-sse2.exe

Loads dropped DLL 5 IoCs

pid	Process
4516	cpuminer-sse2.exe
4516	cpuminer-sse2.exe
4516	cpuminer-sse2.exe
4516	cpuminer-sse2.exe
4516	cpuminer-sse2.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/4608-5-0x0000000000400000-0x000000000393A000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4608 wrote to memory of 168	4608	batexe.exe	74
PID 4608 wrote to memory of 168	4608	batexe.exe	74
PID 4608 wrote to memory of 168	4608	batexe.exe	74
PID 168 wrote to memory of 1072	168	b2e.exe	75
PID 168 wrote to memory of 1072	168	b2e.exe	75
PID 168 wrote to memory of 1072	168	b2e.exe	75
PID 1072 wrote to memory of 4516	1072	cmd.exe	78
PID 1072 wrote to memory of 4516	1072	cmd.exe	78

C:\Users\Admin\AppData\Local\Temp\batexe.exe
"C:\Users\Admin\AppData\Local\Temp\batexe.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4608
- C:\Users\Admin\AppData\Local\Temp\8D2C.tmp\b2e.exe
  "C:\Users\Admin\AppData\Local\Temp\8D2C.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\8D2C.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:168
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\8ED2.tmp\batchfile.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1072
  - - C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe
      cpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 3
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\8D2C.tmp\b2e.exe

Filesize
3.3MB

MD5
980f311c1f7750d81432f563838931fa

SHA1
9cea867412ac992d396f1d8b588d2c6af5b067c9

SHA256
0453b7de27ef88e0383cabd357e8a954a55ab47c5d89eca48672a01c0d602f43

SHA512
b2ec0da1748060aa7699fcce99bbe3088bd3e0472171b7137e6e2541eddfbcb3884cfa81f1d1ff5823e24411c16693cfcfd576c1e1b336656b8bc5bb2821a9e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\8D2C.tmp\b2e.exe

Filesize
4.8MB

MD5
d16ce1aa1ff74448fe461bf6ce40d221

SHA1
04951039681ff20678f4cd0a6a5580b6df757500

SHA256
b281ce9ed34d19d925bf794974d69982eda37206f530a3aea1409f7e8913f065

SHA512
8e8e7c6a9ca9130afa314865b88a131a7b8b2621b9b78138847be9d912f711b5ef8557eb235f9795f893139fbeb8b596ed0de79b49b68c5fafddd7980d9f346c

Download Submit
C:\Users\Admin\AppData\Local\Temp\8ED2.tmp\batchfile.bat

Filesize
136B

MD5
8ea7ac72a10251ecfb42ef4a88bd330a

SHA1
c30f6af73a42c0cc89bd20fe95f9159d6f0756c5

SHA256
65e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9

SHA512
a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0

Download Submit
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe

Filesize
1.7MB

MD5
2968dad2fb5179d7b81cb3e33fc31942

SHA1
37f695a5b9d41e7d04cc792a11ebefdedd46f4f9

SHA256
66c916189a95b38886d1bdd7121e39ceec54853cdef5da3ae04595291eab4226

SHA512
1387203142899fa02991d37053e8275c0244c10f3f9fb9ab66a128679ee4bf88206627158602c422e4acb41b5f0a5d2a7951c68e57e3ebedabb87f8cdeb2f726

Download Submit
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe

Filesize
1.9MB

MD5
7ec0d94be3340f6d60c3b52500a58d31

SHA1
940789420aaf57cd0adb537868b7fadcbf9484b7

SHA256
6f0b5b70f2d673a2521f2732e1e106441e62ba04f5acca4294cf2067c23c240e

SHA512
04ed245c644b0e4596fec2d0c8b22e95c5b7b5f373976ea0603d0d728059c83f7d60fdcdeb77799a7dbe9b5f575e6d1b2f0b5fbeb2468dfd43348c1a15314de1

Download Submit
C:\Users\Admin\AppData\Local\Temp\libcurl-4.dll

Filesize
836KB

MD5
aeab40ed9a8e627ea7cefc1f5cf9bf7a

SHA1
5e2e8ca2881b9bf9edfa3c4fdcec6da1efa102d8

SHA256
218cfc4073bab4eddf0de0804f96b204687311e20a9e97994bff54c9b0e01ee9

SHA512
c0a67616fa01fdc351015212a718faf70da6612fbb3ec13da28dd7af9a507c56882fb7c3eea6fbc37d4d63b970157199d16d0756dbe3cb3bc2223e215cb104d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll

Filesize
1.2MB

MD5
7cf672bee2afba2dcd0c031ff985958e

SHA1
6b82a205db080ffdcb4a4470fce85a14413f3217

SHA256
c82f84171b9246d1cac261100b2199789c96c37b03b375f33b2c72afab060b05

SHA512
3e90d1c1efe0200cb3cc7b51d04783a3cce8391faa6ce554cff8b23dac60be9f8e4f980a8ac005fd9dff8ea4bdcb02311f7649c5be28eb32dcc26417fc4090e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

Filesize
1.9MB

MD5
eec43a368f7c52dab52246033a2bf506

SHA1
9de906829aef06ae60bd305bad246448bd7d7b27

SHA256
1385223e9291b45e32f2abd30f00bffe20b0a1d561858c7a2c8ea7f258e6d5c4

SHA512
14fb689fb93eefa7c177da22012be016c0240bccb8d7d6aeb386f0cc5de699bbede2e6403bdef025617a46e4bff368e0a2418a82258020d724df6e2226486843

Download Submit
\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

Filesize
1.8MB

MD5
20b7da6202364d560c81589418add42d

SHA1
c001c6d96781de6c73f9bbeebc403993447a17ff

SHA256
09511a3cd15673d532345a1efc5bf170a4cd7ca8f53a34ad6f99d0f50f7a5454

SHA512
6275346cc4cfde894e2292064c537e1ef598f8cf6d0430a7d010fa3cba99fcc47c19cd334511921b7f5216a8681dafd46d8762ee8ac8c4afed43d0c524ae356f

Download Submit
\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

Filesize
1.5MB

MD5
b1a9c41ebe265a6b6b217dfeb7fd0363

SHA1
62b38ff488ce02fd62031782e81b2368d1e97bb5

SHA256
6d484f8e9adac44fbbafe0451a53d9bc9d92250e3daa42faa9fd07c5afab2db3

SHA512
6b492b634f1bd04441b7eb2ce4db11a728330d7594699fd951126fab660260609da8ac527f5b03ece8ebc639a34004e3e1b3d8edde27645873b8151a69ece1d7

Download Submit
\Users\Admin\AppData\Local\Temp\libwinpthread-1.dll

Filesize
606KB

MD5
585efec1bc1d4d916a4402c9875dff75

SHA1
d209613666ccac9d0ddab29a3bc59aa00a0968fa

SHA256
2f9984c591a5654434c53e8b4d0c5c187f1fd0bab95247d5c9bc1c0bd60e6232

SHA512
b93163cba4601ed999a7a7d1887113792e846c36850c6d84f2d505727dc06524bb959469f9df12928769f4535dc6074a6b3599b788a4844353e466742ce1e770

Download Submit
memory/168-50-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/168-6-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/4516-41-0x0000000061440000-0x000000006156B000-memory.dmp

Filesize
1.2MB

Download
memory/4516-56-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4516-42-0x0000000070800000-0x00000000708BC000-memory.dmp

Filesize
752KB

Download
memory/4516-43-0x00000000550B0000-0x0000000055148000-memory.dmp

Filesize
608KB

Download
memory/4516-44-0x0000000001010000-0x00000000028C5000-memory.dmp

Filesize
24.7MB

Download
memory/4516-101-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4516-51-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4516-40-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4516-61-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4516-71-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4516-76-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4516-81-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4516-86-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4516-96-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4608-5-0x0000000000400000-0x000000000393A000-memory.dmp

Filesize
53.2MB

Download