73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72

Analysis

max time kernel
296s
max time network
301s
platform
windows10-1703_x64
resource
win10-20240214-ja
resource tags

arch:x64arch:x86image:win10-20240214-jalocale:ja-jpos:windows10-1703-x64systemwindows
submitted
18/02/2024, 14:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

batexe.exe
Size

9.4MB
MD5

cdc9eacffc6d2bf43153815043064427
SHA1

d05101f265f6ea87e18793ab0071f5c99edf363f
SHA256

73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
SHA512

fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
SSDEEP

196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4492	b2e.exe
4800	cpuminer-sse2.exe

Loads dropped DLL 5 IoCs

pid	Process
4800	cpuminer-sse2.exe
4800	cpuminer-sse2.exe
4800	cpuminer-sse2.exe
4800	cpuminer-sse2.exe
4800	cpuminer-sse2.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1596-5-0x0000000000400000-0x000000000393A000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1596 wrote to memory of 4492	1596	batexe.exe	73
PID 1596 wrote to memory of 4492	1596	batexe.exe	73
PID 1596 wrote to memory of 4492	1596	batexe.exe	73
PID 4492 wrote to memory of 4268	4492	b2e.exe	74
PID 4492 wrote to memory of 4268	4492	b2e.exe	74
PID 4492 wrote to memory of 4268	4492	b2e.exe	74
PID 4268 wrote to memory of 4800	4268	cmd.exe	77
PID 4268 wrote to memory of 4800	4268	cmd.exe	77

C:\Users\Admin\AppData\Local\Temp\batexe.exe
"C:\Users\Admin\AppData\Local\Temp\batexe.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1596
- C:\Users\Admin\AppData\Local\Temp\27C7.tmp\b2e.exe
  "C:\Users\Admin\AppData\Local\Temp\27C7.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\27C7.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4492
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\2EEB.tmp\batchfile.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4268
  - - C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe
      cpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 3
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\27C7.tmp\b2e.exe

Filesize
2.9MB

MD5
9317cafb85becd9011ca213e7be3a2bc

SHA1
1c84c389734da0532809700191b96dc61527e382

SHA256
644eb7fd5f540a11f942d00b2233e715a40b8548294924fc054db1e08b293090

SHA512
65120a9f1410f4b9350788c5898557be3d3b195f03b3425895748764fc052048f38998bb455cef4f25f748c696821a9a4622c8f09f6ae4603dcd6882be451684

Download Submit
C:\Users\Admin\AppData\Local\Temp\27C7.tmp\b2e.exe

Filesize
4.1MB

MD5
31615644f452e96494d7c79c237e2668

SHA1
a07f5b1c3621b3ba6bd25bee5a7a80b7336db2d0

SHA256
0f2fbc74450d43fd8ef9b25c256a81497a4ed67268dbbc4655469eda73445dc3

SHA512
8ba0613bb9c563a7e83b220571da712d290ed6088bb96b7ced84c51fea5f03c6ce68e0e7802a3a4da5cda3047f3a51c18db060a4e64af8b4a3607a308567db54

Download Submit
C:\Users\Admin\AppData\Local\Temp\2EEB.tmp\batchfile.bat

Filesize
136B

MD5
8ea7ac72a10251ecfb42ef4a88bd330a

SHA1
c30f6af73a42c0cc89bd20fe95f9159d6f0756c5

SHA256
65e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9

SHA512
a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0

Download Submit
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe

Filesize
325KB

MD5
9480baeb189c7baaedb971738bf06b51

SHA1
b44ed448e152026ae7a6bc7a32f83d4165db2285

SHA256
12d811f05a353116e3f8899759a501f5447a792160879afd53c65304fa84a95c

SHA512
bf486f450a961e750285edd7456674181e1a7113b1454f296445f74a164ca25dbf9b5f8191ce9f57ce88f9419ab4df705d07f4f31e099a23df268b464d7faea6

Download Submit
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe

Filesize
334KB

MD5
c5de434c1086be7e0aed41eb042a9079

SHA1
b546fc9d51befbf851299c30ec21584faa76b01c

SHA256
a72d6f8b464179e33cfc1e034d1858e233f3dc69592768bfd61b71af97813aa3

SHA512
4a4b5acd5327d6fba485f29a894f146d10e16b1586b2513212bb45e898db8c143c6de8ba845cb4ee70a43a9ca5e7e27a4da402efdd4d07c249da591aa15a9e93

Download Submit
C:\Users\Admin\AppData\Local\Temp\libcurl-4.dll

Filesize
201KB

MD5
a381a58fd542464ec5aaaae771e3e376

SHA1
0b827a9639ca5c4c90652da10bd37f0db37172bf

SHA256
12159489ebd30e47af82797c3718d1e4acb1b21b4ad89fbd8d3b1f04843c7504

SHA512
70726c3c69eda42dbcb67298739c52ba474fa7d77c6ffb69573622bab7f80f2b983236c275611e03d835560409fe647d100dfa5a268c52309ba0c2272c23aad0

Download Submit
C:\Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll

Filesize
167KB

MD5
7701aead253c3cf436bc0f93802cc7d0

SHA1
eb39739bb7e88e8f8bbefbae8299d4d7dd76c6fb

SHA256
18fa7272876bc7d9ee5857f99fad1b7530ce764e115ac3722ad4d4cf910799e5

SHA512
b9dfcf1c4d8af4922d09a2a1a4e8208ee31a82c0d3de4ce2a89a7da688792027d6922388805deeaf7c409d8ac7867f7a59f60d1b4c7aeea76f512c2e00b5398b

Download Submit
C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

Filesize
153KB

MD5
0c75e238ae076f996f0d7c44fb2d70e3

SHA1
d717e6cf7b8be52183cb7f6b5443930da557b0a7

SHA256
04fdb1d8a44332e9f683f236863d7836fb2d4547cbad78d3781c77d7d709dbea

SHA512
cfec00882fffd5a90b7eaec53973c54af8f70c59391b7cf4f5d51d934c469bbc340df31a203c09ed7d2399fcf5a4fe1f231c02f1361a02cea8e5e048e6022df1

Download Submit
C:\Users\Admin\AppData\Local\Temp\libwinpthread-1.dll

Filesize
236KB

MD5
96276d6479d77133f42fdbe419c25f24

SHA1
24a6cdae197eed8fbf55959fb9125399e084f1e2

SHA256
dbc24e816e98a7461665cacf2bf4eb47425e43bfb65704491db221b8dbb39fc9

SHA512
874d0121e4d89d8ac823e70b5f69dd78ff7d351cf7c3cf2f4a0c8117d7f55e9beb4838e9dc47d7ba133495cb72ce520f2aac3bdbd0113ec6d880b59d9c8ef659

Download Submit
\Users\Admin\AppData\Local\Temp\libcurl-4.dll

Filesize
137KB

MD5
ce47701fe7ecfe1b82caeb3c36bc3d29

SHA1
cfddbee9eb2727ab2e153564b711b288b1a14295

SHA256
3adce3c7f0b389c32d18191f48d1b81e557ff558edefa42cb5eb9408465a2214

SHA512
0d68389903153996c54c807cbecbe84a01d1c97f66eafc67ecf2cb5ef981754a54e86e0365c08057e88f6d7202036ff462f4c5ab23fbdccfdff0a6ea7a2494a3

Download Submit
\Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll

Filesize
128KB

MD5
2437b0b7704445e4826153cd47ae7da2

SHA1
da58ff819438d0d1602ec3da04d651495e0bfa59

SHA256
186b2280e7bb0b7a7c91ed2631fee8ae7891fda40df5c15cca8b123a590aafa8

SHA512
bffb6ac6404d1488422d6113c0398e04b1452f3df041d0e0c4e1fe45e57efee7d040e1c8da166c73ec743c6c5d1a660fa23b43b765c14a4deaf53f8fd5c19a50

Download Submit
\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

Filesize
245KB

MD5
e9a5c5cab45f639c1aaf78c713e0f8da

SHA1
54990f01462c449485bf6100f46f7220c2ac1ae9

SHA256
105ae7881b2d63502e194ec68e3c6e2de443c325175f6c37ae0674cf3f44c8c4

SHA512
3f3a08093a37f218845b089b1f96be68459a23b485a3a9f1141c20752cb927716aaaa39c7ffe28e2a3a9fc273972299e99e18613a52d6a08565ec810b0e47c8d

Download Submit
\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

Filesize
298KB

MD5
e56bef975e55a9a7019c660e20705fc4

SHA1
4f5e8f8a8117c0ee565d15a7a5d7674bf4cef8e9

SHA256
a9ebc6540f6e9f67aa532a07f2849a542404153c3d9ace234a1eb85852dee724

SHA512
91129655452350937d6cd5a8089d939817c1a507e154f460420afc48b3eed020c495fe51c1feb32f129f96158771ed5173e3931167e1f33a6df920209131d101

Download Submit
\Users\Admin\AppData\Local\Temp\libwinpthread-1.dll

Filesize
163KB

MD5
2f7c17de1500f6a59da8b597b08c503e

SHA1
4486753b2194b25f1a1084e564be8edaf384708a

SHA256
aaf33dad9f60fd2de9c6e525a007a410f9195f04b8c7d47197aa70ad5157ce43

SHA512
5122ef128daaed26ea418072290fd3b1f629c4ac8ebc88167e201a6d1e1f827c7d0eb81c0e76e97858f41e597bd9298b1a60ebe679d2a9e351e028050320b142

Download Submit
memory/1596-5-0x0000000000400000-0x000000000393A000-memory.dmp

Filesize
53.2MB

Download
memory/4492-50-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/4492-6-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/4800-40-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4800-42-0x000000005D8A0000-0x000000005D938000-memory.dmp

Filesize
608KB

Download
memory/4800-43-0x0000000061440000-0x000000006156B000-memory.dmp

Filesize
1.2MB

Download
memory/4800-44-0x00000000010E0000-0x0000000002995000-memory.dmp

Filesize
24.7MB

Download
memory/4800-45-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4800-41-0x0000000070800000-0x00000000708BC000-memory.dmp

Filesize
752KB

Download
memory/4800-51-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4800-56-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4800-61-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4800-66-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4800-71-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4800-76-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4800-86-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4800-91-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4800-101-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download