73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72

Analysis

max time kernel
292s
max time network
295s
platform
windows10-1703_x64
resource
win10-20240214-ja
resource tags

arch:x64arch:x86image:win10-20240214-jalocale:ja-jpos:windows10-1703-x64systemwindows
submitted
18/02/2024, 07:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

batexe.exe
Size

9.4MB
MD5

cdc9eacffc6d2bf43153815043064427
SHA1

d05101f265f6ea87e18793ab0071f5c99edf363f
SHA256

73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
SHA512

fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
SSDEEP

196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2108	b2e.exe
4636	cpuminer-sse2.exe

Loads dropped DLL 5 IoCs

pid	Process
4636	cpuminer-sse2.exe
4636	cpuminer-sse2.exe
4636	cpuminer-sse2.exe
4636	cpuminer-sse2.exe
4636	cpuminer-sse2.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/4020-6-0x0000000000400000-0x000000000393A000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4020 wrote to memory of 2108	4020	batexe.exe	75
PID 4020 wrote to memory of 2108	4020	batexe.exe	75
PID 4020 wrote to memory of 2108	4020	batexe.exe	75
PID 2108 wrote to memory of 4324	2108	b2e.exe	76
PID 2108 wrote to memory of 4324	2108	b2e.exe	76
PID 2108 wrote to memory of 4324	2108	b2e.exe	76
PID 4324 wrote to memory of 4636	4324	cmd.exe	79
PID 4324 wrote to memory of 4636	4324	cmd.exe	79

C:\Users\Admin\AppData\Local\Temp\batexe.exe
"C:\Users\Admin\AppData\Local\Temp\batexe.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4020
- C:\Users\Admin\AppData\Local\Temp\94DD.tmp\b2e.exe
  "C:\Users\Admin\AppData\Local\Temp\94DD.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\94DD.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2108
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\96C2.tmp\batchfile.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4324
  - - C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe
      cpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 3
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\94DD.tmp\b2e.exe

Filesize
4.4MB

MD5
af4dd71e65e85e586c7f67dffed2ceb9

SHA1
288efa7a1be06629561f3af3973509bf5ddb1bb3

SHA256
dac2b55c5aefc319839cce33505c7dfe8b9a0c8b55cefdd1085b25083d0bc54c

SHA512
9382bb316a43c9b1b9b3a588bb377f511a81e3aacf9c167e02030ac07d8c5dfc10fea2958f80250ce107da080f9996ba51e1bac6df52bb9c673f228c1ded4b9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\94DD.tmp\b2e.exe

Filesize
3.5MB

MD5
fe8aa4aa2caed04ae539d5bfeac4ab62

SHA1
07abca9214c8de78c165a8a2252d7b4efcd3ebcd

SHA256
0355adb045f30dfd5332d5be88f35f8f36caa9989ca62367c86b10c7dd433b3f

SHA512
b6368e08971627f518b45cbdd97f11f93eac244c028c280d8c45d8b3eee5be3c0401737dbb4908fb51289ada23655246cca99ad99488af52bd4f1eef7406bee9

Download Submit
C:\Users\Admin\AppData\Local\Temp\96C2.tmp\batchfile.bat

Filesize
136B

MD5
8ea7ac72a10251ecfb42ef4a88bd330a

SHA1
c30f6af73a42c0cc89bd20fe95f9159d6f0756c5

SHA256
65e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9

SHA512
a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0

Download Submit
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe

Filesize
1.4MB

MD5
7f3c18669b98b7197c86f14af3d6774f

SHA1
73ae668e6afd5bd85a9e2493a8c3b88c0285bf34

SHA256
1359e6e1df7ac00abbe9ebc67da295fa21030b46c19f593ce060db2b5f66e01d

SHA512
20b1aeba2aae19cfcf4a12e288a1acd2b4d480040c524dab4a2fc8f2d189c8e20ff15f80d7e73acb79ddc8d7e4da49e7aabbb52c3c4d0d1750691742dc0dcfb9

Download Submit
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe

Filesize
1.7MB

MD5
c90330d33252d0e3ecebf0dcf52e5dc7

SHA1
9f82de9d56dace5aa8f9af13b1e41a10a56c5ab8

SHA256
6c62bf7517e797dc7e7f853ed1e4a38e721ca6df74649bfda422b34a92222456

SHA512
d8f577e89ab85fdeda50e682a4996332b71c45e3aee9453c7972550041b40682bef55303b74ef62f8eae58a1e2d216e1a935a02d56e6e9137423a97825ae9db8

Download Submit
C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

Filesize
2.0MB

MD5
07379e1f2bd318541ac42efcf22c6a99

SHA1
08888edae4d4d59787eec586da0e27ef50b20287

SHA256
de24fa4e9c291088fe2d0161f286c9f28ef552d79900e126f325edeee22bc44d

SHA512
afc07d46abae95e73ac2cde47a306797e0b009ff2a88dd9bf597502fd40ddd5901b0b4dcd5759344c8fcef5a20a9f4b05f69492211d4e73d995aeebfe6bdf3d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\libwinpthread-1.dll

Filesize
606KB

MD5
585efec1bc1d4d916a4402c9875dff75

SHA1
d209613666ccac9d0ddab29a3bc59aa00a0968fa

SHA256
2f9984c591a5654434c53e8b4d0c5c187f1fd0bab95247d5c9bc1c0bd60e6232

SHA512
b93163cba4601ed999a7a7d1887113792e846c36850c6d84f2d505727dc06524bb959469f9df12928769f4535dc6074a6b3599b788a4844353e466742ce1e770

Download Submit
\Users\Admin\AppData\Local\Temp\libcurl-4.dll

Filesize
836KB

MD5
aeab40ed9a8e627ea7cefc1f5cf9bf7a

SHA1
5e2e8ca2881b9bf9edfa3c4fdcec6da1efa102d8

SHA256
218cfc4073bab4eddf0de0804f96b204687311e20a9e97994bff54c9b0e01ee9

SHA512
c0a67616fa01fdc351015212a718faf70da6612fbb3ec13da28dd7af9a507c56882fb7c3eea6fbc37d4d63b970157199d16d0756dbe3cb3bc2223e215cb104d8

Download Submit
\Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll

Filesize
1.2MB

MD5
7cf672bee2afba2dcd0c031ff985958e

SHA1
6b82a205db080ffdcb4a4470fce85a14413f3217

SHA256
c82f84171b9246d1cac261100b2199789c96c37b03b375f33b2c72afab060b05

SHA512
3e90d1c1efe0200cb3cc7b51d04783a3cce8391faa6ce554cff8b23dac60be9f8e4f980a8ac005fd9dff8ea4bdcb02311f7649c5be28eb32dcc26417fc4090e5

Download Submit
\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

Filesize
1.2MB

MD5
a91fa605de7a05e8ee51c83a560e8db9

SHA1
a27bf979911663dc967c6d72c512e7ed6fc0946b

SHA256
e800fedb52928ec28106ad0f5a9fc59cde0408eb2c6d7085684ee4b7aaf58a79

SHA512
0502b1f0e813de634acd4302cba17c5adf5715166b195a3a389e89d7028eda9a2916b9e88017b64b1243365e66f24b135ecbeb8408b48362a67b75b12d848ab2

Download Submit
\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

Filesize
1.4MB

MD5
466d357ecd97e03317f30c44ac06f63e

SHA1
6009d982099ec7064707889efa943e2666f07fc5

SHA256
b17cd3aaee37ca008765446af8e1c534fcfdcab854152de6a49aa9d2593ca37d

SHA512
7c75c72b97e87fbdb7736153882084773f08c5030dfc49427c417a78a932df723e1e1d6283c5e5f3c90fba846b434c3ffdf3d450fb6d00c47a59cfcea0ef8e0d

Download Submit
memory/2108-5-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/2108-50-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/4020-6-0x0000000000400000-0x000000000393A000-memory.dmp

Filesize
53.2MB

Download
memory/4636-41-0x0000000070800000-0x00000000708BC000-memory.dmp

Filesize
752KB

Download
memory/4636-61-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4636-42-0x0000000061440000-0x000000006156B000-memory.dmp

Filesize
1.2MB

Download
memory/4636-44-0x0000000001080000-0x0000000002935000-memory.dmp

Filesize
24.7MB

Download
memory/4636-40-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4636-51-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4636-56-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4636-43-0x0000000074ED0000-0x0000000074F68000-memory.dmp

Filesize
608KB

Download
memory/4636-66-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4636-76-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4636-81-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4636-86-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4636-91-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4636-96-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4636-101-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download