Analysis

  • max time kernel
    293s
  • max time network
    298s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-ja
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-jalocale:ja-jpos:windows10-2004-x64systemwindows
  • submitted
    18/02/2024, 01:48

General

  • Target

    batexe.exe

  • Size

    9.4MB

  • MD5

    cdc9eacffc6d2bf43153815043064427

  • SHA1

    d05101f265f6ea87e18793ab0071f5c99edf363f

  • SHA256

    73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72

  • SHA512

    fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6

  • SSDEEP

    196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv

Score
7/10
upx

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 5 IoCs
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\batexe.exe
    "C:\Users\Admin\AppData\Local\Temp\batexe.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:868
    • C:\Users\Admin\AppData\Local\Temp\6AA1.tmp\b2e.exe
      "C:\Users\Admin\AppData\Local\Temp\6AA1.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\6AA1.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:216
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\6D02.tmp\batchfile.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4300
        • C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe
          cpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 3
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2712

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\6AA1.tmp\b2e.exe

          Filesize

          11.9MB

          MD5

          04d50cbb43d10f6fe96d0598bc8cc6bb

          SHA1

          a0cf4634ad63f62a0207ac0290241565baf29667

          SHA256

          d715c6d19d83e735ba8d0578eef43397c18770b40f46adfb58a8fa0061d6fb61

          SHA512

          1117949820b865112f59bd4d6d13b3b7f936d2d792a875de529015fa1717cc8d8107d0be738ac2c0dbb92b05e3f0052a9ecdb4eb6154c3960ffbcb41ec4810cd

        • C:\Users\Admin\AppData\Local\Temp\6AA1.tmp\b2e.exe

          Filesize

          4.3MB

          MD5

          488b1d388cfc8d7e477b523a4e83c2d4

          SHA1

          7f6ead04e74c7b9c27ab4650ef1c8b1714f3fc33

          SHA256

          8d118ab251b9809fcd2d50c93fa40bf1605b74defde3847ba0fd5a3ddfaf4c30

          SHA512

          22341d61480c28baaf98fa14e2a14da4d20e3883a89c39acb799146de844348d4fa5ffef8ae1a82efbbfaeab34d0027f1d9b6ed15d95ab851ae4577b50718ab0

        • C:\Users\Admin\AppData\Local\Temp\6AA1.tmp\b2e.exe

          Filesize

          4.6MB

          MD5

          04c61763ad17939a23d8ad7aa71aebfa

          SHA1

          c75b2fe8a5feaf3496830bf1db4f59dbee98c700

          SHA256

          6244da0e26e9f3004a57fca59841b3694762d266616d400f29e82c27041bef97

          SHA512

          65268394a4b2c178104361a72f6da469f36291d0d791f2f98569e0179c59075a2c149763058c2d6a64120fee8eb56a06537f781ec742b10b61f2ec933372ef70

        • C:\Users\Admin\AppData\Local\Temp\6D02.tmp\batchfile.bat

          Filesize

          136B

          MD5

          8ea7ac72a10251ecfb42ef4a88bd330a

          SHA1

          c30f6af73a42c0cc89bd20fe95f9159d6f0756c5

          SHA256

          65e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9

          SHA512

          a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0

        • C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe

          Filesize

          2.1MB

          MD5

          e7321383474adcd1baf061e706338aaf

          SHA1

          25f3982e006ad22f106d31de2693da22f9f8cf49

          SHA256

          4e6b508fb7e3bd8c3674abfe282a4caebb6219cf92f9b72e4a8e1e34c14e8447

          SHA512

          f905d3ddc8331e99f96fd94d4f74a3833d32d77919dd5eff59799629d7059aa30c94ddfccd634d3a4b3a7c0737fe9e84826165e6fae4fabea53ff6ab6f7aa816

        • C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe

          Filesize

          1.9MB

          MD5

          7a701e450f2c5b17c78643adadf2edd1

          SHA1

          b497b2b01bbaed68fba7eefb313bf5339cfe01ae

          SHA256

          0e3348980689174da9e0bb8d6235effb48ea5c2cc982f7b30cfacd0f29f0985b

          SHA512

          24dd757535289b3fabce786df5e13cd544445b10066f22dbcf6c88d5217c903a595e352459ecc33f5d9c90720cab0ed6e6ec61468ce2e503da06c7316055e883

        • C:\Users\Admin\AppData\Local\Temp\libcurl-4.dll

          Filesize

          836KB

          MD5

          aeab40ed9a8e627ea7cefc1f5cf9bf7a

          SHA1

          5e2e8ca2881b9bf9edfa3c4fdcec6da1efa102d8

          SHA256

          218cfc4073bab4eddf0de0804f96b204687311e20a9e97994bff54c9b0e01ee9

          SHA512

          c0a67616fa01fdc351015212a718faf70da6612fbb3ec13da28dd7af9a507c56882fb7c3eea6fbc37d4d63b970157199d16d0756dbe3cb3bc2223e215cb104d8

        • C:\Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll

          Filesize

          1.2MB

          MD5

          7cf672bee2afba2dcd0c031ff985958e

          SHA1

          6b82a205db080ffdcb4a4470fce85a14413f3217

          SHA256

          c82f84171b9246d1cac261100b2199789c96c37b03b375f33b2c72afab060b05

          SHA512

          3e90d1c1efe0200cb3cc7b51d04783a3cce8391faa6ce554cff8b23dac60be9f8e4f980a8ac005fd9dff8ea4bdcb02311f7649c5be28eb32dcc26417fc4090e5

        • C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

          Filesize

          1.7MB

          MD5

          ee1a8e57086a01ac92e32b613ff2d7c0

          SHA1

          57a3de69342eee1fde97ef700a37bf25a196e167

          SHA256

          e37d62b1b39505ecafa8ab48dcb46668e6e4ed5283ec0db8a5ec8df60998c887

          SHA512

          4e29c15c6b59c7d9c99231541d2026e2549483798798545cd73848a27d7553b33ba657a70e203b9ed7f69236b5f702e7a8b03db7aaee5cf2866d4c3546df3d9c

        • C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

          Filesize

          1.3MB

          MD5

          cbf8c0f535c6d0d23c1e649fe97d7343

          SHA1

          2b022fae49adf45b1ea6ca0d95eec6d31be89047

          SHA256

          8cd5b6c8ccda9feda379034cb799845964cc80c9dec3099639f8128e71343819

          SHA512

          4c66acfa541708c4351a4b36cfc8d196d1abba5b9fe73a61d3f2e778dae934fb733a8d49582ced379a5badd61fe77603740fdc7a91993e1746feec17f89aeaf0

        • C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

          Filesize

          1.9MB

          MD5

          190a0c6fd2d45f9673bf9bd9c389450b

          SHA1

          fd4b08addcf484e25c0f7fa12cb353f9c669a46e

          SHA256

          40ae626357eb52cd35efe7ec10c3bd388a9bed4da19ca488ce82a8b4ceef3283

          SHA512

          baf1bc5c20827735a139534f4337b33d1a97ad0d3975d215b41c5ee3d802963a151ce8ae31f99ab1733a286bd7a0990f0086bf72990c3a6784d2305dbdfe3e1c

        • C:\Users\Admin\AppData\Local\Temp\libwinpthread-1.dll

          Filesize

          606KB

          MD5

          585efec1bc1d4d916a4402c9875dff75

          SHA1

          d209613666ccac9d0ddab29a3bc59aa00a0968fa

          SHA256

          2f9984c591a5654434c53e8b4d0c5c187f1fd0bab95247d5c9bc1c0bd60e6232

          SHA512

          b93163cba4601ed999a7a7d1887113792e846c36850c6d84f2d505727dc06524bb959469f9df12928769f4535dc6074a6b3599b788a4844353e466742ce1e770

        • memory/216-53-0x0000000000400000-0x0000000000405000-memory.dmp

          Filesize

          20KB

        • memory/216-9-0x0000000000400000-0x0000000000405000-memory.dmp

          Filesize

          20KB

        • memory/868-7-0x0000000000400000-0x000000000393A000-memory.dmp

          Filesize

          53.2MB

        • memory/2712-44-0x0000000070800000-0x00000000708BC000-memory.dmp

          Filesize

          752KB

        • memory/2712-64-0x0000000000400000-0x0000000000667000-memory.dmp

          Filesize

          2.4MB

        • memory/2712-46-0x0000000074D80000-0x0000000074E18000-memory.dmp

          Filesize

          608KB

        • memory/2712-47-0x0000000001090000-0x0000000002945000-memory.dmp

          Filesize

          24.7MB

        • memory/2712-48-0x0000000000400000-0x0000000000667000-memory.dmp

          Filesize

          2.4MB

        • memory/2712-45-0x0000000061440000-0x000000006156B000-memory.dmp

          Filesize

          1.2MB

        • memory/2712-59-0x0000000000400000-0x0000000000667000-memory.dmp

          Filesize

          2.4MB

        • memory/2712-43-0x0000000000400000-0x0000000000667000-memory.dmp

          Filesize

          2.4MB

        • memory/2712-69-0x0000000000400000-0x0000000000667000-memory.dmp

          Filesize

          2.4MB

        • memory/2712-74-0x0000000000400000-0x0000000000667000-memory.dmp

          Filesize

          2.4MB

        • memory/2712-79-0x0000000000400000-0x0000000000667000-memory.dmp

          Filesize

          2.4MB

        • memory/2712-84-0x0000000000400000-0x0000000000667000-memory.dmp

          Filesize

          2.4MB

        • memory/2712-89-0x0000000000400000-0x0000000000667000-memory.dmp

          Filesize

          2.4MB

        • memory/2712-94-0x0000000000400000-0x0000000000667000-memory.dmp

          Filesize

          2.4MB

        • memory/2712-99-0x0000000000400000-0x0000000000667000-memory.dmp

          Filesize

          2.4MB

        • memory/2712-104-0x0000000000400000-0x0000000000667000-memory.dmp

          Filesize

          2.4MB