Analysis
-
max time kernel
299s -
max time network
299s -
platform
windows10-1703_x64 -
resource
win10-20240214-ja -
resource tags
arch:x64arch:x86image:win10-20240214-jalocale:ja-jpos:windows10-1703-x64systemwindows -
submitted
18-02-2024 02:24
Behavioral task
behavioral1
Sample
batexe.exe
Resource
win10-20240214-ja
Behavioral task
behavioral2
Sample
batexe.exe
Resource
win10v2004-20231215-ja
General
-
Target
batexe.exe
-
Size
9.4MB
-
MD5
cdc9eacffc6d2bf43153815043064427
-
SHA1
d05101f265f6ea87e18793ab0071f5c99edf363f
-
SHA256
73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
-
SHA512
fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
-
SSDEEP
196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2316 b2e.exe 4880 cpuminer-sse2.exe -
Loads dropped DLL 5 IoCs
pid Process 4880 cpuminer-sse2.exe 4880 cpuminer-sse2.exe 4880 cpuminer-sse2.exe 4880 cpuminer-sse2.exe 4880 cpuminer-sse2.exe -
resource yara_rule behavioral1/memory/4856-5-0x0000000000400000-0x000000000393A000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4856 wrote to memory of 2316 4856 batexe.exe 75 PID 4856 wrote to memory of 2316 4856 batexe.exe 75 PID 4856 wrote to memory of 2316 4856 batexe.exe 75 PID 2316 wrote to memory of 2572 2316 b2e.exe 76 PID 2316 wrote to memory of 2572 2316 b2e.exe 76 PID 2316 wrote to memory of 2572 2316 b2e.exe 76 PID 2572 wrote to memory of 4880 2572 cmd.exe 79 PID 2572 wrote to memory of 4880 2572 cmd.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\batexe.exe"C:\Users\Admin\AppData\Local\Temp\batexe.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\B9CA.tmp\b2e.exe"C:\Users\Admin\AppData\Local\Temp\B9CA.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\B9CA.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BC4B.tmp\batchfile.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.execpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4880
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8.1MB
MD50074ed732dd43fb06aacde6b570db0f2
SHA154ba96d0307d98c8f2ebdd1dc6dcc82060cc89ec
SHA256527d16c30d1cfd8d9292982d67be8cfdf8f4421bd0d5f0ac2b82668648d91a67
SHA5125caa64cd68509e69356a987b996f06ca3228ced3e946c048a88aff2270c826ccb88b153a96a0c1b323e3facda5df387274435a259312ab2ae9a96152ad873630
-
Filesize
11.3MB
MD565f1fc4e2a92797804173c91f260bec4
SHA1a9a97b4c3a885c2895cf0f3be2a5ffba62c74572
SHA256fa0bfd51a1380bba94a9b57b4037d1c6155ec6f5ced8d374e7c14e5bcfe80522
SHA512b64fa7eccbe0d9f447a2c276805e48447802c5942d558cf70a839bae2d0cd4119b54af399530b8799dc61a6fadee5ce6ecc072ebd01872afcc061d55aace830b
-
Filesize
136B
MD58ea7ac72a10251ecfb42ef4a88bd330a
SHA1c30f6af73a42c0cc89bd20fe95f9159d6f0756c5
SHA25665e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9
SHA512a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0
-
Filesize
1.5MB
MD54ff74831f154773ce0f6437abfd0ba4f
SHA1b9ac1e63975ff7494e0f0ffb5146be8ed86d6e2c
SHA256df9b335bb9a475519b633674179aa216bf844b371df7b3c5823bae50d892e7ec
SHA512b972dda46990ebe84c68988a927ce74d57c0d75ba297d5ef1f938cd10eb8135a74e0dd5f97e0eea7a8301e6376ca90cab6782a8c8f3c7ef4abfef1eb3a08a524
-
Filesize
1.4MB
MD5ef2a8cfd375c9841a77919e69521f6b5
SHA16cf84ddcde10dac793e7df344eaab568e96422cb
SHA256e25aea50619b437e9856470d920fbdab4aef95e2b261446d802b30dbfc666f93
SHA5122712e4ac3d175efff3f5131caacee9fc618170a78a6ddfd2424122337f8ed1b332161ed5ee3b829b166bacf17dbdea1b3f64a4540e78ee99cedcff41ab5e6075
-
Filesize
836KB
MD5aeab40ed9a8e627ea7cefc1f5cf9bf7a
SHA15e2e8ca2881b9bf9edfa3c4fdcec6da1efa102d8
SHA256218cfc4073bab4eddf0de0804f96b204687311e20a9e97994bff54c9b0e01ee9
SHA512c0a67616fa01fdc351015212a718faf70da6612fbb3ec13da28dd7af9a507c56882fb7c3eea6fbc37d4d63b970157199d16d0756dbe3cb3bc2223e215cb104d8
-
Filesize
1.6MB
MD555c5d1c7c76a7c549ef5df717d5a5003
SHA1c72d816745cfe972ca774f0d15158735cdcae8a0
SHA2566878cdc15edaa690864397553cefce6fb5179106fa15304894c9930a8676391b
SHA51285ed457bd3103bf349ef02dd45a7b9b6b678427643b9b4f41cf3ce6a2c9947f10151325b22655cf486a1ecf88217a6b5688123544cfcb81135a04ecfd972772f
-
Filesize
1.2MB
MD57cf672bee2afba2dcd0c031ff985958e
SHA16b82a205db080ffdcb4a4470fce85a14413f3217
SHA256c82f84171b9246d1cac261100b2199789c96c37b03b375f33b2c72afab060b05
SHA5123e90d1c1efe0200cb3cc7b51d04783a3cce8391faa6ce554cff8b23dac60be9f8e4f980a8ac005fd9dff8ea4bdcb02311f7649c5be28eb32dcc26417fc4090e5
-
Filesize
2.1MB
MD5e3fc324d836873f4d821179e18f332ac
SHA1a31ddb7ed89a7e4cf781c17c0f192bcf7ddca7a0
SHA2561b803b3cc3029795b581061842ed8c7405e6df8bfa4e1b1e25ee89665f2c611a
SHA512725344b2417de080ad733b5abdc9fbdb3f4d11f82a947427513063505e1670ae9c92ee72ca2aad9fbf576a5060363650704f1a914d82c96da8be07ad3c64ac3b
-
Filesize
1.8MB
MD540977e6c64a76b0c5f4aa1795785749b
SHA10dbfa1a124ab946d0ce13fe5a063b5bd1d9063d5
SHA256642c7ea72b59ed8c2539718ad3d65a83fa68e713b1df5ca9532ef14ec4233fde
SHA5123c745839376108d58c2865073a770e1220a30196140d758b11b23b6b58ce50e7c780e9ed1bd2ee171c3d0cda1234b4779db09671f1347a9bfcba8d2beb17bf70
-
Filesize
606KB
MD5585efec1bc1d4d916a4402c9875dff75
SHA1d209613666ccac9d0ddab29a3bc59aa00a0968fa
SHA2562f9984c591a5654434c53e8b4d0c5c187f1fd0bab95247d5c9bc1c0bd60e6232
SHA512b93163cba4601ed999a7a7d1887113792e846c36850c6d84f2d505727dc06524bb959469f9df12928769f4535dc6074a6b3599b788a4844353e466742ce1e770