73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72

Analysis

max time kernel
294s
max time network
299s
platform
windows10-2004_x64
resource
win10v2004-20231215-ja
resource tags

arch:x64arch:x86image:win10v2004-20231215-jalocale:ja-jpos:windows10-2004-x64systemwindows
submitted
19/02/2024, 16:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
batexe.exe
Size 9.4MB
Sample240219-vf8p9agg2t
SHA256 73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
MD5 cdc9eacffc6d2bf43153815043064427
SHA1 d05101f265f6ea87e18793ab0071f5c99edf363f
SHA512 fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
SSDEEP 196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International\Geo\Nation	batexe.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International\Geo\Nation	b2e.exe

Executes dropped EXE 2 IoCs

pid	Process
3572	b2e.exe
3620	cpuminer-sse2.exe

Loads dropped DLL 5 IoCs

pid	Process
3620	cpuminer-sse2.exe
3620	cpuminer-sse2.exe
3620	cpuminer-sse2.exe
3620	cpuminer-sse2.exe
3620	cpuminer-sse2.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3940-9-0x0000000000400000-0x000000000393A000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3940 wrote to memory of 3572	3940	batexe.exe	84
PID 3940 wrote to memory of 3572	3940	batexe.exe	84
PID 3940 wrote to memory of 3572	3940	batexe.exe	84
PID 3572 wrote to memory of 2716	3572	b2e.exe	85
PID 3572 wrote to memory of 2716	3572	b2e.exe	85
PID 3572 wrote to memory of 2716	3572	b2e.exe	85
PID 2716 wrote to memory of 3620	2716	cmd.exe	88
PID 2716 wrote to memory of 3620	2716	cmd.exe	88

C:\Users\Admin\AppData\Local\Temp\batexe.exe
"C:\Users\Admin\AppData\Local\Temp\batexe.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3940
- C:\Users\Admin\AppData\Local\Temp\5FD3.tmp\b2e.exe
  "C:\Users\Admin\AppData\Local\Temp\5FD3.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\5FD3.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3572
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\631F.tmp\batchfile.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2716
  - - C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe
      cpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 3
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

b2e.exe

Path C:\Users\Admin\AppData\Local\Temp\5FD3.tmp\b2e.exe
Size 8.8MB
SHA256 2722d0f44327f6e838942facc4d3e34f95aa4c8bb53764c962ca145f690d9e6d
MD5 6c55996adebb4de928dfbf05c938a63e
SHA1 186edfdd67d5c088ec4a2e2e12366fd70ea08d5e
SHA512 8c9ee00037426cc986d3e423e68a08a1f3b07f9c25dfe88e3031f2f8d4c81737610796444fa6c61ce72ba318c6521cdaa6350eb4c3c818d53aef7e63e61bce6b
SSDEEP 98304:2Vh7J/WrocAdkmBtKCLaDr/4Q8FD9Ck6jBVFh0uT:wWrJQ9Cua
MD5 SHA1 SHA512 SSDEEP

Submit Download

b2e.exe

Path C:\Users\Admin\AppData\Local\Temp\5FD3.tmp\b2e.exe
Size 3.5MB
SHA256 120368a73380b6697b3aef5e01e2aba24b7d4e349bf2304140c5ef8f67cb024d
MD5 70e7e1875e8f4ec7b64fc4fccf2e8bc8
SHA1 94d5f094636105721308f6eeb5fdab856605dfdd
SHA512 0787baebeaf584f7b6ebaaa48334e22c9a4937dedf573fcb4702995c89756c483863ce92d4c88ba1d6a0374dae9c09f92e570eb153cc473d59a50f4822664e49
SSDEEP 49152:HWVh7Fj/WrXYcatDRddBuqw/LLpGokJsThPz8rJG9nSti9/KKJSusjtZPPxy:2Vh7J/WrocAdkmBtKCL0
MD5 SHA1 SHA512 SSDEEP

Submit Download

b2e.exe

Path C:\Users\Admin\AppData\Local\Temp\5FD3.tmp\b2e.exe
Size 3.6MB
SHA256 9f35cbb3e25b4be6136a8e2f641303813a8435d58c570cae67256df0471a0e24
MD5 6a6654bebfed697c579041ba4edd5045
SHA1 2b05306500b19bb4024cfc9310b52124902441e7
SHA512 e0d42328228f3f61a39c8a435941b22ebf7072292bbd0c46da2db0ace716d239df0a141928b40469a39d1b8b30182cdeecee55658d77a5c0501e2bbb25ad2edd
SSDEEP 49152:HWVh7Fj/WrXYcatDRddBuqw/LLpGokJsThPz8rJG9nSti9/KKJSusjtZPPxtSi:2Vh7J/WrocAdkmBtKCLai
MD5 SHA1 SHA512 SSDEEP

Submit Download

batchfile.bat

Path C:\Users\Admin\AppData\Local\Temp\631F.tmp\batchfile.bat
Size 136B
SHA256 65e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9
MD5 8ea7ac72a10251ecfb42ef4a88bd330a
SHA1 c30f6af73a42c0cc89bd20fe95f9159d6f0756c5
SHA512 a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0
MD5 SHA1 SHA512

Submit Download

cpuminer-sse2.exe

Path C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe
Size 696KB
SHA256 79a9d45fc2c2aa0d4c743cfe5c9aa35a1db94de65e0c956dcea380847b86f6c3
MD5 ecc363dc188014e5a302303780472d3c
SHA1 d592a2a62991d87746d3283acbe89b938f31af64
SHA512 70edeab40068a7d6f0899d9f8aa60824c63811c8d9a39fa7c12a50b60af9be188d674d8c9fd11d04da298e26b4395e5886df4def2b75c5631fb9009903e0f9e6
SSDEEP 12288:WRtMPAkXZ9Zeql/DZoq/Qphj2XVgQ7N/TiojFZi9lGbZGhtvw//ZY1Qwg006RdAm:WbAAkXZfeqVZoq/QpmN/TDjzshtmB1kB
MD5 SHA1 SHA512 SSDEEP

Submit Download

cpuminer-sse2.exe

Path C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe
Size 480KB
SHA256 e43aabe9e7c3d1fd9ca219c242ed460ace3477484bf2118fb9f67ebb806554dc
MD5 5b318bb6fbf9f8ac6f5008c1d63122e2
SHA1 7dbe84475925687eac2eeb581f17e035f142830e
SHA512 e8217d45b49852769587625fb41bdc5cdfe572d888fe6067bc3fb2179cfaf4f2d169ef088fc90e4cca892aaf4387edec9ccec71e727481a76954708b2261b55c
SSDEEP 12288:WRtMPAkXZ9Zeql/DZoq/Qphj2XVgQ7N/TiojFZi9lB:WbAAkXZfeqVZoq/QpmN/TDjc
MD5 SHA1 SHA512 SSDEEP

Submit Download

libcurl-4.dll

Path C:\Users\Admin\AppData\Local\Temp\libcurl-4.dll
Size 836KB
SHA256 218cfc4073bab4eddf0de0804f96b204687311e20a9e97994bff54c9b0e01ee9
MD5 aeab40ed9a8e627ea7cefc1f5cf9bf7a
SHA1 5e2e8ca2881b9bf9edfa3c4fdcec6da1efa102d8
SHA512 c0a67616fa01fdc351015212a718faf70da6612fbb3ec13da28dd7af9a507c56882fb7c3eea6fbc37d4d63b970157199d16d0756dbe3cb3bc2223e215cb104d8
SSDEEP 24576:xufMF9VdLNrjhHdLI8cUlOb1w4yYhJWOrXQB:cfMFhBr19LI87lOb1w4IOrXQB
MD5 SHA1 SHA512 SSDEEP

Submit Download

libgcc_s_seh-1.dll

Path C:\Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll
Size 1004KB
SHA256 d49718ad06997351a5788bfd4df0a780c2acd2208ee1a772397d64539983cd61
MD5 151dfa42eabb228a44426e88e4dcb17e
SHA1 99b1732ab43f6e5422674e2fd6dd106088d35990
SHA512 ee59c2c563a043169e835cd3d5f3d0502a1c116acca76267657029848a76215da716ba86545cb887b1ec2b4ee5b61daaff565906f275df22431a28b7b3e901b4
SSDEEP 12288:ynYk4yH15191n1q1x1c1vw6t8a1/hKhbhdhvh3hY6Dhch3hhCZ1c1eCJ1MC1+1MY:mnKt/wDm1nazZffMMcUvQlRg3J
MD5 SHA1 SHA512 SSDEEP

Submit Download

libgcc_s_seh-1.dll

Path C:\Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll
Size 1.1MB
SHA256 374074a32c3f82a9eda6ae328158520ebdad2dc6e2127f2f040fac5626e1217a
MD5 31fbf4726e4661ed52ba3482e2257679
SHA1 dc86fbf140f62981c2d6a57c62a05adc0ff6d54b
SHA512 a8367e57df4c146c70639fbfcd0200bfe25ec595e1457382837eac942ac771ed3cbe852e976e73d9d7334925916f654eec7ca59eea174f0c27274c92e953e46f
SSDEEP 12288:ynYk4yH15191n1q1x1c1vw6t8a1/hKhbhdhvh3hY6Dhch3hhCZ1c1eCJ1MC1+1MX:mnKt/wDm1nazZffMMcUvQlRg3J6fK
MD5 SHA1 SHA512 SSDEEP

Submit Download

libstdc++-6.dll

Path C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll
Size 983KB
SHA256 5daf28dd80189e8c303a709f7b0277e372b700bbcbef5c1737cf447e79294710
MD5 f00f934c02f33c6cce902017d6cc09d8
SHA1 fae1e72ae8f269c27e37facb9df4afd6f8702e3a
SHA512 3d8f911992f4dc7c8531f140306210b9877b518729c709f25a90cc895bf55db174173a7444828012f2712c5e5cc147fa5f3753d13e069bb53cf01c370cd9dde0
SSDEEP 12288:9Rgs+Gatqxo2LvmKmOmVriIvhr/5yfMVjKBUUaqN01L:Dv+Gatwo2ZyrfvhKBl01L
MD5 SHA1 SHA512 SSDEEP

Submit Download

libstdc++-6.dll

Path C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll
Size 744KB
SHA256 5e70ae73d36d9a96363dc7588b7c180d2372d07b8512d5d9c45fd978552655ee
MD5 a7179f9de3e2d8230fcc64817aa4ae4c
SHA1 e80035f4731a968fce3b55166d1a44f584307025
SHA512 54f4f0b8f6c7fbc4ea0ad6df2bb703770862284a36391bddc3ace39a469cbacde84309370fd8e7406eaea8e9c019226cee585b9fc42abb9fd6dca3161c2c2b69
SSDEEP 12288:9Rgs+Gatqxo2LvmKmOmVriIvhr/5yfMVw:Dv+Gatwo2Zyrfvh8
MD5 SHA1 SHA512 SSDEEP

Submit Download

libstdc++-6.dll

Path C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll
Size 988KB
SHA256 7b8c67dae611b8cded1bf5a2a5c57b96c7491da9f5167877a68aa84ed220cad9
MD5 80d554cca04481fd78ee98540ed8bf6a
SHA1 af36d4e4d7d2c9f3b5833414dea7d32873e90e6d
SHA512 141d660032f47502bd3da1879085b95425fec549ceef00e05a2819872b2a7cdd813be161646b201a8670be2cab288b21a51a32555409d625cfabe3e8b29b6e6a
SSDEEP 12288:9Rgs+Gatqxo2LvmKmOmVriIvhr/5yfMVjKBUUaqN01P:Dv+Gatwo2ZyrfvhKBl01P
MD5 SHA1 SHA512 SSDEEP

Submit Download

libwinpthread-1.dll

Path C:\Users\Admin\AppData\Local\Temp\libwinpthread-1.dll
Size 573KB
SHA256 085ddf9117c4c3087313ba2aef542b7d229e4c3aa1ed56dc01907b487b1440b5
MD5 261d35ed51716f34ede9b04f4524a338
SHA1 234123cabe051d5c41feff340dcd660aef88c9c3
SHA512 3b31c6fc305919b3837d8b8265ab475c8f737876bf94fde0715571dbaeca402730a648792601def24ecaf48c1691a282e2fdc23aa25d6816d6af5c41df483cad
SSDEEP 12288:IrAim3Y9lrzf34z//KRwwtkIr1PznEcyJwV2Zugw:IrAim3Y9lrzf34z//KRwwtkIr1PzEcyY
MD5 SHA1 SHA512 SSDEEP

Submit Download

libwinpthread-1.dll

Path C:\Users\Admin\AppData\Local\Temp\libwinpthread-1.dll
Size 534KB
SHA256 4658dad4740abc19d890c954d628de1002b9bf9c5c3f25eedc3f3d874fcd7bfd
MD5 d7103bfd3d4dae50f09e165b371089b9
SHA1 0964ef236ef6a50cef5cb4c38c2b64fd93eecc34
SHA512 7cc84abd1bdde6ed5abf7fbafb7c17fd1743a76142a5732068435726e4eedfb806911038276fac36ccf11cbcb3d71516e5aa6031354c1cdaa76f183f822dbb42
SSDEEP 12288:IrAim3Y9lrzf34z//KRwwtkIr1PznEcyJwV2ZugP:IrAim3Y9lrzf34z//KRwwtkIr1PzEcy3
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3572-53-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/3572-7-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/3620-47-0x0000000000F40000-0x00000000027F5000-memory.dmp

Download

memory/3620-69-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/3620-44-0x0000000061440000-0x000000006156B000-memory.dmp

Download

memory/3620-43-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/3620-46-0x0000000054CD0000-0x0000000054D68000-memory.dmp

Download

memory/3620-104-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/3620-64-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/3620-45-0x0000000070800000-0x00000000708BC000-memory.dmp

Download

memory/3620-79-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/3620-84-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/3620-89-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/3620-94-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/3620-99-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/3940-9-0x0000000000400000-0x000000000393A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads