73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72

Analysis

max time kernel
293s
max time network
302s
platform
windows10-1703_x64
resource
win10-20240214-ja
resource tags

arch:x64arch:x86image:win10-20240214-jalocale:ja-jpos:windows10-1703-x64systemwindows
submitted
19/02/2024, 14:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

batexe.exe
Size

9.4MB
MD5

cdc9eacffc6d2bf43153815043064427
SHA1

d05101f265f6ea87e18793ab0071f5c99edf363f
SHA256

73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
SHA512

fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
SSDEEP

196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2780	b2e.exe
1568	cpuminer-sse2.exe

Loads dropped DLL 5 IoCs

pid	Process
1568	cpuminer-sse2.exe
1568	cpuminer-sse2.exe
1568	cpuminer-sse2.exe
1568	cpuminer-sse2.exe
1568	cpuminer-sse2.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3172-5-0x0000000000400000-0x000000000393A000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3172 wrote to memory of 2780	3172	batexe.exe	76
PID 3172 wrote to memory of 2780	3172	batexe.exe	76
PID 3172 wrote to memory of 2780	3172	batexe.exe	76
PID 2780 wrote to memory of 376	2780	b2e.exe	77
PID 2780 wrote to memory of 376	2780	b2e.exe	77
PID 2780 wrote to memory of 376	2780	b2e.exe	77
PID 376 wrote to memory of 1568	376	cmd.exe	80
PID 376 wrote to memory of 1568	376	cmd.exe	80

C:\Users\Admin\AppData\Local\Temp\batexe.exe
"C:\Users\Admin\AppData\Local\Temp\batexe.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3172
- C:\Users\Admin\AppData\Local\Temp\9385.tmp\b2e.exe
  "C:\Users\Admin\AppData\Local\Temp\9385.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\9385.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2780
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\95C8.tmp\batchfile.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:376
  - - C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe
      cpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 3
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\9385.tmp\b2e.exe

Filesize
5.1MB

MD5
4c9cac3a3d33a252fc43548cefc00f3f

SHA1
fa02c8e5038b81e1440aaa82abd4db3de346e590

SHA256
40bc9c843a9731322bec85bb15bf9bfe129bfe2c024e67b6b844172d7cdfa8e9

SHA512
ce170fbe59b9824d914f681d94907f027a4c4f49a0de363f8b566f569f7ea2bb18df303c861ff68206d38a5b91fbf8ac0af659a9bb917ec8feea245e487b5f34

Download Submit
C:\Users\Admin\AppData\Local\Temp\9385.tmp\b2e.exe

Filesize
4.6MB

MD5
7d7868459691a2c328873b785a431e5c

SHA1
6c3ff9e0d21a95df0900c498d1bd6b29b6a780d9

SHA256
fc1461f288f8798085b382f92a49c1f41127d18a15ff96d5c772f58a34c032c5

SHA512
e6cd8ff58d9b05ea241678f213047b679b1df9787d5f3608015764a4bf3b46bfb6c76e6b6c7407cde0c1200d5c95720a602a857710b3fe615990f4cab5269b63

Download Submit
C:\Users\Admin\AppData\Local\Temp\95C8.tmp\batchfile.bat

Filesize
136B

MD5
8ea7ac72a10251ecfb42ef4a88bd330a

SHA1
c30f6af73a42c0cc89bd20fe95f9159d6f0756c5

SHA256
65e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9

SHA512
a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0

Download Submit
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe

Filesize
1.2MB

MD5
7d89b4964ecce228af0ca7d5a7ab6668

SHA1
bf9e71687b0bf8bc34bed2578de0e9863a596463

SHA256
77acdf9c0889aeb5289c7504ef852c06c9b34386b855382802d0833276b559a3

SHA512
78c695cb01449dcb3b832438696de153925106107c255f01fafdad190d657ee67bf856de65b9e356b62de6cc8ddb44e9001e74e0540691fb83e7f17350aeaa55

Download Submit
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe

Filesize
1009KB

MD5
b97a6b02214b5d68acce4b199c452eb8

SHA1
d2d348604974fc5f940bb63e5cdc8c3a8991672e

SHA256
82bfdedce156aa5ad7ca48bdb3a0f3d33b83541c51116c22d913bd55a3d8ff22

SHA512
0ef1ffb918cedc7451c44257a7853a26eb069685643cd28cdec5ccd1febd0430543dc3735a64698b1f8e63b0ae56ef71ff33fd77ca45ee0a01021ad9bc9ce50e

Download Submit
C:\Users\Admin\AppData\Local\Temp\libcurl-4.dll

Filesize
836KB

MD5
aeab40ed9a8e627ea7cefc1f5cf9bf7a

SHA1
5e2e8ca2881b9bf9edfa3c4fdcec6da1efa102d8

SHA256
218cfc4073bab4eddf0de0804f96b204687311e20a9e97994bff54c9b0e01ee9

SHA512
c0a67616fa01fdc351015212a718faf70da6612fbb3ec13da28dd7af9a507c56882fb7c3eea6fbc37d4d63b970157199d16d0756dbe3cb3bc2223e215cb104d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

Filesize
1.5MB

MD5
846df378b9eb01f0d04b745d77b1cfa3

SHA1
7b1bd326ceeb586d4503abe51489052f6a7b210e

SHA256
064feaa87c274231174cd1a04acf74e827362801509ac4b8fa2a865a2a2c0c9f

SHA512
87507681eb09786d3b7fbb9b47d05dc164c6ea7607cf061efb8315f387fdd87c66edcc94a14c3f13d11f4648656969407725b6e5bbcf566c19a991d76a969cb3

Download Submit
\Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll

Filesize
1.2MB

MD5
7cf672bee2afba2dcd0c031ff985958e

SHA1
6b82a205db080ffdcb4a4470fce85a14413f3217

SHA256
c82f84171b9246d1cac261100b2199789c96c37b03b375f33b2c72afab060b05

SHA512
3e90d1c1efe0200cb3cc7b51d04783a3cce8391faa6ce554cff8b23dac60be9f8e4f980a8ac005fd9dff8ea4bdcb02311f7649c5be28eb32dcc26417fc4090e5

Download Submit
\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

Filesize
1.6MB

MD5
6ce7c34abfe1a98f6bbae8a7e4b7d9b9

SHA1
3a5b11d5e1e6f45f34dcb27d014a5fe4322028e1

SHA256
823042b1c583aa5ef3d4bcd7c9262a8d9d159fcd559a4e60fb21be6fcc0eec8a

SHA512
91d1fe1555f7a90016cfd6e719783ed3454cb2b2d7b2c0b6fbb315b0c8e053b7b042bf642667622591ced277ee49adf0caed1fe60aed200ba9fcefc2ca8bbbe4

Download Submit
\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

Filesize
1.7MB

MD5
904cd4d71f90f8b18854a3225f8cb488

SHA1
cf1e0f0e315b7fc573dec4e120853876dbc9a1a9

SHA256
6f5d4c8407f910471a2f1203a6861d9d7f230e73cbc26cdcce6b80875fbca03a

SHA512
43a82b183cc306e4bd85e1d244f9f14e64ed3ba55ae9293ae3f1f655e378b7c1b7f69fb51c1e927bddf05ee2e7d2cb70d6b97d6e3cb6004d52bf13d77a3caa63

Download Submit
\Users\Admin\AppData\Local\Temp\libwinpthread-1.dll

Filesize
606KB

MD5
585efec1bc1d4d916a4402c9875dff75

SHA1
d209613666ccac9d0ddab29a3bc59aa00a0968fa

SHA256
2f9984c591a5654434c53e8b4d0c5c187f1fd0bab95247d5c9bc1c0bd60e6232

SHA512
b93163cba4601ed999a7a7d1887113792e846c36850c6d84f2d505727dc06524bb959469f9df12928769f4535dc6074a6b3599b788a4844353e466742ce1e770

Download Submit
memory/1568-41-0x0000000061440000-0x000000006156B000-memory.dmp

Filesize
1.2MB

Download
memory/1568-51-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/1568-40-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/1568-101-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/1568-42-0x0000000070800000-0x00000000708BC000-memory.dmp

Filesize
752KB

Download
memory/1568-43-0x0000000057CA0000-0x0000000057D38000-memory.dmp

Filesize
608KB

Download
memory/1568-44-0x0000000001100000-0x00000000029B5000-memory.dmp

Filesize
24.7MB

Download
memory/1568-45-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/1568-96-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/1568-91-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/1568-56-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/1568-66-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/1568-71-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/1568-76-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/1568-81-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/1568-86-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/2780-50-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/2780-4-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/3172-5-0x0000000000400000-0x000000000393A000-memory.dmp

Filesize
53.2MB

Download