Analysis
-
max time kernel
297s -
max time network
301s -
platform
windows10-1703_x64 -
resource
win10-20240214-ja -
resource tags
arch:x64arch:x86image:win10-20240214-jalocale:ja-jpos:windows10-1703-x64systemwindows -
submitted
19/02/2024, 18:20
Behavioral task
behavioral1
Sample
batexe.exe
Resource
win10-20240214-ja
Behavioral task
behavioral2
Sample
batexe.exe
Resource
win10v2004-20231215-ja
General
-
Target
batexe.exe
-
Size
9.4MB
-
MD5
cdc9eacffc6d2bf43153815043064427
-
SHA1
d05101f265f6ea87e18793ab0071f5c99edf363f
-
SHA256
73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
-
SHA512
fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
-
SSDEEP
196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 4848 b2e.exe 3240 cpuminer-sse2.exe -
Loads dropped DLL 5 IoCs
pid Process 3240 cpuminer-sse2.exe 3240 cpuminer-sse2.exe 3240 cpuminer-sse2.exe 3240 cpuminer-sse2.exe 3240 cpuminer-sse2.exe -
resource yara_rule behavioral1/memory/424-5-0x0000000000400000-0x000000000393A000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 424 wrote to memory of 4848 424 batexe.exe 73 PID 424 wrote to memory of 4848 424 batexe.exe 73 PID 424 wrote to memory of 4848 424 batexe.exe 73 PID 4848 wrote to memory of 4992 4848 b2e.exe 74 PID 4848 wrote to memory of 4992 4848 b2e.exe 74 PID 4848 wrote to memory of 4992 4848 b2e.exe 74 PID 4992 wrote to memory of 3240 4992 cmd.exe 77 PID 4992 wrote to memory of 3240 4992 cmd.exe 77
Processes
-
C:\Users\Admin\AppData\Local\Temp\batexe.exe"C:\Users\Admin\AppData\Local\Temp\batexe.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:424 -
C:\Users\Admin\AppData\Local\Temp\B97C.tmp\b2e.exe"C:\Users\Admin\AppData\Local\Temp\B97C.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\B97C.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\C033.tmp\batchfile.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.execpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3240
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11.9MB
MD504d50cbb43d10f6fe96d0598bc8cc6bb
SHA1a0cf4634ad63f62a0207ac0290241565baf29667
SHA256d715c6d19d83e735ba8d0578eef43397c18770b40f46adfb58a8fa0061d6fb61
SHA5121117949820b865112f59bd4d6d13b3b7f936d2d792a875de529015fa1717cc8d8107d0be738ac2c0dbb92b05e3f0052a9ecdb4eb6154c3960ffbcb41ec4810cd
-
Filesize
8.6MB
MD5962895566149e3ba069e848b788fc26d
SHA19707e4728751f02f130f28b4bb2978e8cad68e8c
SHA2567c544c1e74627614357505557f028e1f08b163e78b9d230169fcd746083f5aff
SHA512fda892854a462a005fd842c67085f56d67410403e92056afd3174711817ae30a9dab7f4b1e055277aa5dcbfc8e4df55b8aefe7ddfc8c70ad894c7751665fee4b
-
Filesize
136B
MD58ea7ac72a10251ecfb42ef4a88bd330a
SHA1c30f6af73a42c0cc89bd20fe95f9159d6f0756c5
SHA25665e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9
SHA512a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0
-
Filesize
640KB
MD50f6af9e19fa927d88313e98d54420920
SHA10aff9c72864126107d6c630aafb9ed6512042afd
SHA25671661d7077b93e2a5e53d7093e532bec1b66d34e3929bcb314eab7f431b84734
SHA512bba078e2f4eb5ca45956657356f7419767a81679f34d9991bf28a1d44e412340d1002517f74a15583ffe20b32f1f25b60c47f4581100552dc1e651b3f88547be
-
Filesize
512KB
MD5a879c5fd4613dca566d5b1a782690dd5
SHA141c6063b0f0dee953e99713a5326856b55e08366
SHA2563ee76359d6802a8fe11c5b144e18ffd3833bc7b49d66f190621d41e41ea0fc20
SHA512e20f8f40822ca215c75767b8d4102583cfb3812c74dbc064a8619f214c164ab94da6bee0ae42c794a0af1847ff30c295b34d3015f87bfe597dba80339871ea96
-
Filesize
550KB
MD5efa4a05cebeeb567f67d55b9568ddca9
SHA18464fb7557216fab1b2ef91f977a41f6426c634d
SHA25623ef898de21720694864f2a3bc40732de320bfeca78aed1ba1ec5fcb16edf173
SHA512bf1e7e500606ce41824f64334ba7e8ced7987cc74585112e46fdbb458d68a37ea2334c340a74e13fa9dfb70422d1efe517fe316f6ea2e9befcff5d90bc75b43e
-
Filesize
384KB
MD5b91f7bb5508b343188ec32dcc7880611
SHA1fe2ae7ba4a1bbb2a5df7b73f21a0b8fc745cc11f
SHA25647881756cdfcb302e63efb2016c122a1bb61574d81186275aef3d5a9fb72b84b
SHA512a5b91bc653cbf28219b6f169d5d849fb53eced9a932b8edf468c9092544795ee8120d5c76f0c45f27b7a2464c328f5bffcabf3e83d2e7236263ea930cf92eea0
-
Filesize
448KB
MD5ca123cec7f705c0af114e462349dc686
SHA175f90b4d95f6774b2f66e4ba790755ef118ab222
SHA2567f141cdc0be9c965e21310bcfb0484b20d31ffd8a6a970f8b5a53c0e8974798a
SHA512650125faa9ae6733f1118caf3101ca6850473f78f9bfc3a87e908eac1c69935e3bc269ffb5de4dd6e867429c1af35c7f3b9e62eb698fa7c9695d68e7115f3f1c
-
Filesize
384KB
MD5eec15153c344f43f1919cb379b9ee2f9
SHA13e4a09390ac885ea2797209603bcfa1ec6ff0cc6
SHA2564e4d7ecae87e8e656c61af89ef17146baf33fbf09ffbde6ae971d04e8e8f9222
SHA5127cdf3552341d14979838f8fedf9ac63482152f193ab8f7e0af281ec50b2a43312d78c0e22e79989818c5041538fa69769350e1e6cf0789a165be1eb11ee29908
-
Filesize
448KB
MD519a61444b6e2d01755ede80960bca19c
SHA1e0c7222784d3e2b3329ec3280648b17fd60ef209
SHA25613fd488b38f3b75438e9ad0a033df005cd397f3c92f43275714a0a7eb3fb4db8
SHA512bc02c82bdac19f10f3e3a93d3f507bb7838c9255b7cff5af6e3a7f3b471dae9c45c52728c3c23857b3402dd1702cb51a20f225a4da992c26a997c26d86b6b1d9
-
Filesize
320KB
MD5e63bf5df87e2ea807dc353cc5aa9aab1
SHA169fc94bbebe878711cb133c3a1affb80c0bdecff
SHA2562c9d6315f90367b959d3c32badd99bbc03eb808e4a46db72ccf2e81788b41533
SHA51270f2b2a8a4c8ab23d81266cd23b75c27ced29a1eab8c80d95c57b595b10254b7229cc03b637716edbfad2a83827f2c557847b98d1de80256beec05c9512ee4bd
-
Filesize
256KB
MD51d86b9560854472453237bcbaa2e253f
SHA15a03a7902d250377a3e9f746badcb696e2c98228
SHA2561493703a430c68bdcedcb4078486daca39a02820199e7b72017c7b1af66e1c8d
SHA512afbc3d7f8e06e41db25d666999f4d162af7054a66b17a651ac8a7f092f83580a067bfa2f558be65ace5966dffaa8735fe7a579e88bf42b34eaa3e72cdec96699
-
Filesize
277KB
MD5c5e8400694bf165d1acff1094e47bf4f
SHA141dcf89e4ba6384a281125d31b4606bb25970529
SHA2566919cced395fbda702b705133f6b8156dc7d2304a7ac03489dafa70103aea74f
SHA5120f53dd5fe28d246c70b49afb142bcfb0862fc1a84d3ecdf5f9fc9c850e25108d889ee2496d08ee40fd2db7b7f185a7271b0fe6e5476215a3b70bde0666eee66b
-
Filesize
320KB
MD51ae43cc09627ff82d15527ea2693fd76
SHA1c39ffa1a4b80c29fa1f5caed3e7d091253266c66
SHA256b63980c9d592a6d0d8521f74bd4c6f7cc4ae5f8c3320d2bd63764c56648ac45f
SHA51221945e4e2fad3ee2b2a19d19bbbc1ada832c33a0d3bf499d6ac8f093b39021323ea0f7df3d54167a3456cbaf01ff126a6e6abbe17dd4eb8d5a24ca000888c271