73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72

Analysis

max time kernel
293s
max time network
295s
platform
windows10-1703_x64
resource
win10-20240214-ja
resource tags

arch:x64arch:x86image:win10-20240214-jalocale:ja-jpos:windows10-1703-x64systemwindows
submitted
19/02/2024, 16:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

batexe.exe
Size

9.4MB
MD5

cdc9eacffc6d2bf43153815043064427
SHA1

d05101f265f6ea87e18793ab0071f5c99edf363f
SHA256

73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
SHA512

fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
SSDEEP

196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2304	b2e.exe
1956	cpuminer-sse2.exe

Loads dropped DLL 5 IoCs

pid	Process
1956	cpuminer-sse2.exe
1956	cpuminer-sse2.exe
1956	cpuminer-sse2.exe
1956	cpuminer-sse2.exe
1956	cpuminer-sse2.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/308-5-0x0000000000400000-0x000000000393A000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 308 wrote to memory of 2304	308	batexe.exe	75
PID 308 wrote to memory of 2304	308	batexe.exe	75
PID 308 wrote to memory of 2304	308	batexe.exe	75
PID 2304 wrote to memory of 1608	2304	b2e.exe	76
PID 2304 wrote to memory of 1608	2304	b2e.exe	76
PID 2304 wrote to memory of 1608	2304	b2e.exe	76
PID 1608 wrote to memory of 1956	1608	cmd.exe	79
PID 1608 wrote to memory of 1956	1608	cmd.exe	79

C:\Users\Admin\AppData\Local\Temp\batexe.exe
"C:\Users\Admin\AppData\Local\Temp\batexe.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:308
- C:\Users\Admin\AppData\Local\Temp\93D4.tmp\b2e.exe
  "C:\Users\Admin\AppData\Local\Temp\93D4.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\93D4.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2304
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\9664.tmp\batchfile.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1608
  - - C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe
      cpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 3
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\93D4.tmp\b2e.exe

Filesize
1.2MB

MD5
7b0f4c1d8506067fce25df5de733bcb7

SHA1
053b618c2012c6895e9709696395951acf15c165

SHA256
dd9a3eca69a73709146ebc228a433e0fef43ab6c12c2280725d798c7b494216a

SHA512
45ca44d04c436082073475b0bec73cdd3df1f0cc670d9a3d5dd77fc2b3b60ef870af5912d27269107222850b07234060eefb2d272b96de1367ff544cac506618

Download Submit
C:\Users\Admin\AppData\Local\Temp\93D4.tmp\b2e.exe

Filesize
950KB

MD5
1b8c11d658b5dce94eda26b651d942cc

SHA1
0e5f6808af311600b9305f8126634045e728c195

SHA256
00082c273d12a9b597bacaf9b417231305b68d90c534d6609e77df48eb67b317

SHA512
769804f5162cfed56b911ff1f478c0dd811662e17b69fcacdb15f038463a02d778c9acd18eb297ed83f3c44ac096b2e0206212aff33a8da335367e8ba633147d

Download Submit
C:\Users\Admin\AppData\Local\Temp\9664.tmp\batchfile.bat

Filesize
136B

MD5
8ea7ac72a10251ecfb42ef4a88bd330a

SHA1
c30f6af73a42c0cc89bd20fe95f9159d6f0756c5

SHA256
65e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9

SHA512
a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0

Download Submit
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe

Filesize
2.3MB

MD5
2f97fbf4815747f794e2e6529aa05817

SHA1
6408fd7c0473e6dc2a6a537dca688cd95313cae3

SHA256
9f42da68ad02f4c0a7b431b5302fc48309b1e1b727a19ae8d76eb99815aa4225

SHA512
8091d21a9e8340a1c3a101203346d0cf21fcee43eafdadbcf6834f6809d05d9bb0a7c8c84ddedc797a981ad0dcfd5dbd0ba56439088ef0d3696c504c9fdae8af

Download Submit
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe

Filesize
1.5MB

MD5
95c5f0ea072206ff89198a626169743c

SHA1
d731575d9f6ad71f571bb1539d865f06bf870ab8

SHA256
6d364e5e8c7804ad00b37729168e856762088db2efaf7287daf7bf1420887c2f

SHA512
c4f1d17ad2acdbb2a1562b67c93d58f45eb4357d674a29d1a3b8c09e1a313d6c52b72d145b6722050128ae04e7325bdd77d9b175c8f9c4788c342c55c09eea1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\libcurl-4.dll

Filesize
836KB

MD5
aeab40ed9a8e627ea7cefc1f5cf9bf7a

SHA1
5e2e8ca2881b9bf9edfa3c4fdcec6da1efa102d8

SHA256
218cfc4073bab4eddf0de0804f96b204687311e20a9e97994bff54c9b0e01ee9

SHA512
c0a67616fa01fdc351015212a718faf70da6612fbb3ec13da28dd7af9a507c56882fb7c3eea6fbc37d4d63b970157199d16d0756dbe3cb3bc2223e215cb104d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll

Filesize
1.2MB

MD5
7cf672bee2afba2dcd0c031ff985958e

SHA1
6b82a205db080ffdcb4a4470fce85a14413f3217

SHA256
c82f84171b9246d1cac261100b2199789c96c37b03b375f33b2c72afab060b05

SHA512
3e90d1c1efe0200cb3cc7b51d04783a3cce8391faa6ce554cff8b23dac60be9f8e4f980a8ac005fd9dff8ea4bdcb02311f7649c5be28eb32dcc26417fc4090e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

Filesize
1.6MB

MD5
2de79fa1a5342e072dae49f5d765a115

SHA1
37cc1a4b6db72580fffa18e947d4c8c25b9dd0b2

SHA256
3ca981b5639690e62663f9d3f9d4207aac8722944affbb7593b50031ca8c0955

SHA512
6761a97ba2f5e9d4b269c5bc27d69d6ad3cdb6bba702e77e2e47107fb9c0111fc6673356146abc69a5125df587a0f64ec565de673b8753010de60cf65c6ac30d

Download Submit
\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

Filesize
1.8MB

MD5
189f79fd7d6c0efa0089c5c7306e4e10

SHA1
cb2a87b4ba9e47ad44a02697137f380c87dbc4f6

SHA256
b3a674c8afcbab0158f38b38acf4b8db456ac0b0160dbbf5dbe1874df00b84d2

SHA512
9b14572af8dac6ee0733d8ce62f2173b756ef38550460aea0fae6a5c2cce9d840a20daf38cd35059fdc0c1f2dfdf60a6763a072b4a4f7d7cb68995525b474526

Download Submit
\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

Filesize
2.0MB

MD5
351581ddef961ecc737adc8e6c31e0b7

SHA1
a2629c519effde4d7149acb33389a1ed37784c6d

SHA256
e25e44b5bd4c5489873cbf4fec5d340be00761ce054213ec67138da4abef72b9

SHA512
fa03a31ae8f1f19eaa6c33918c39e08a809b92d12a9792abd40d567af27d342a7ab6446f18ed0a34255d385a01feb81af67fef0a038056d1bf7c1e71753ec50e

Download Submit
\Users\Admin\AppData\Local\Temp\libwinpthread-1.dll

Filesize
606KB

MD5
585efec1bc1d4d916a4402c9875dff75

SHA1
d209613666ccac9d0ddab29a3bc59aa00a0968fa

SHA256
2f9984c591a5654434c53e8b4d0c5c187f1fd0bab95247d5c9bc1c0bd60e6232

SHA512
b93163cba4601ed999a7a7d1887113792e846c36850c6d84f2d505727dc06524bb959469f9df12928769f4535dc6074a6b3599b788a4844353e466742ce1e770

Download Submit
memory/308-5-0x0000000000400000-0x000000000393A000-memory.dmp

Filesize
53.2MB

Download
memory/1956-41-0x0000000070800000-0x00000000708BC000-memory.dmp

Filesize
752KB

Download
memory/1956-56-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/1956-101-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/1956-43-0x0000000061440000-0x000000006156B000-memory.dmp

Filesize
1.2MB

Download
memory/1956-42-0x0000000065D00000-0x0000000065D98000-memory.dmp

Filesize
608KB

Download
memory/1956-44-0x0000000000E30000-0x00000000026E5000-memory.dmp

Filesize
24.7MB

Download
memory/1956-45-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/1956-96-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/1956-51-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/1956-40-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/1956-61-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/1956-66-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/1956-76-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/1956-86-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/1956-91-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/2304-50-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/2304-6-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download