73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72

Analysis

max time kernel
297s
max time network
299s
platform
windows10-2004_x64
resource
win10v2004-20231215-ja
resource tags

arch:x64arch:x86image:win10v2004-20231215-jalocale:ja-jpos:windows10-2004-x64systemwindows
submitted
21/02/2024, 05:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
batexe.exe
Size 9.4MB
Sample240221-geeh5acf43
SHA256 73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
MD5 cdc9eacffc6d2bf43153815043064427
SHA1 d05101f265f6ea87e18793ab0071f5c99edf363f
SHA512 fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
SSDEEP 196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Control Panel\International\Geo\Nation	batexe.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Control Panel\International\Geo\Nation	b2e.exe

Executes dropped EXE 2 IoCs

pid	Process
4844	b2e.exe
1908	cpuminer-sse2.exe

Loads dropped DLL 5 IoCs

pid	Process
1908	cpuminer-sse2.exe
1908	cpuminer-sse2.exe
1908	cpuminer-sse2.exe
1908	cpuminer-sse2.exe
1908	cpuminer-sse2.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1584-8-0x0000000000400000-0x000000000393A000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1584 wrote to memory of 4844	1584	batexe.exe	84
PID 1584 wrote to memory of 4844	1584	batexe.exe	84
PID 1584 wrote to memory of 4844	1584	batexe.exe	84
PID 4844 wrote to memory of 4544	4844	b2e.exe	85
PID 4844 wrote to memory of 4544	4844	b2e.exe	85
PID 4844 wrote to memory of 4544	4844	b2e.exe	85
PID 4544 wrote to memory of 1908	4544	cmd.exe	88
PID 4544 wrote to memory of 1908	4544	cmd.exe	88

C:\Users\Admin\AppData\Local\Temp\batexe.exe
"C:\Users\Admin\AppData\Local\Temp\batexe.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1584
- C:\Users\Admin\AppData\Local\Temp\9E24.tmp\b2e.exe
  "C:\Users\Admin\AppData\Local\Temp\9E24.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\9E24.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4844
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\A568.tmp\batchfile.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4544
  - - C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe
      cpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 3
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

b2e.exe

Path C:\Users\Admin\AppData\Local\Temp\9E24.tmp\b2e.exe
Size 6.5MB
SHA256 182865f2b5ef848c05e9b2909acd76f7a26030a4c3cce38c9b8cd7409ee6c85d
MD5 5114ee4c726ffc0dff38bcd73f44c59a
SHA1 a4ff4ff953edc79a98e9f211fdf6e52a394d572b
SHA512 ec0a6daa930c32b0efe37831b59b8b852afe95210a0f43adb0278cdb3b8c093d71f2c4201281a88af6f6736890f2622b96a7baab6b37f709899a8271ed8c738a
SSDEEP 49152:HWVh7Fj/WrXYcatDRddBuqw/LLpGokJsThPz8rJG9nSti9/KKJSusjtZPPxtSVJa:2Vh7J/WrocAdkmBtKCLaDr/4Q8FD9C2
MD5 SHA1 SHA512 SSDEEP

Submit Download

b2e.exe

Path C:\Users\Admin\AppData\Local\Temp\9E24.tmp\b2e.exe
Size 4.3MB
SHA256 23c4e0cec42cfccabe7c01b688e5d50a0d271897860bb8b395ca6e8e6e6fbc13
MD5 225ad63ae4285536842ee1ca4b56e051
SHA1 73d1fcf4006c841ffcfa1269566d8543a5aaf7d2
SHA512 2dbceb2eab4bb328a2f5569013574eb7bb07f0c3539cab08a00e383124a4d08bf414739cc50380b10c8a1079cabc410323d4b1fbe99e61361d3a52372c46d88b
SSDEEP 49152:HWVh7Fj/WrXYcatDRddBuqw/LLpGokJsThPz8rJG9nSti9/KKJSusjtZPPxtSVJj:2Vh7J/WrocAdkmBtKCLaDb
MD5 SHA1 SHA512 SSDEEP

Submit Download

b2e.exe

Path C:\Users\Admin\AppData\Local\Temp\9E24.tmp\b2e.exe
Size 4.0MB
SHA256 166ebfafebd8c644d638123ece63e85a0fc34e6648779cab587d395061939cd9
MD5 61ea0fee94bdec381a28d5a7ef62720f
SHA1 b8688264cb7220151f425b363414d614574561e3
SHA512 08b2a7ef27097f4e81259e4953c460457769898b78e99045ad33061505c1b53a1b8251a2d2d19ef1b1f3eaad8daa44ae29664f84f812d0aba08c79360b7eb17d
SSDEEP 49152:HWVh7Fj/WrXYcatDRddBuqw/LLpGokJsThPz8rJG9nSti9/KKJSusjtZPPxtSVJv:2Vh7J/WrocAdkmBtKCLaD3
MD5 SHA1 SHA512 SSDEEP

Submit Download

batchfile.bat

Path C:\Users\Admin\AppData\Local\Temp\A568.tmp\batchfile.bat
Size 136B
SHA256 65e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9
MD5 8ea7ac72a10251ecfb42ef4a88bd330a
SHA1 c30f6af73a42c0cc89bd20fe95f9159d6f0756c5
SHA512 a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0
MD5 SHA1 SHA512

Submit Download

cpuminer-sse2.exe

Path C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe
Size 2.1MB
SHA256 9452fb0034b4e6ec5c33fff5d2d5ceb75e94904bf4d3a1cc4a88b442c705d4ba
MD5 dc05e579bc637512d5fb931ab6af6ee6
SHA1 55ccc8787f0f379135fd0e16dbac97db4e304f22
SHA512 89a2e00e5306a575dbb8188c2c0b0acb9ace5dbd0edbece5568684ba4e0845c122020c273ae6f20771710ff6003946f4f860f8e2e325002fb5feebda58e44c7c
SSDEEP 49152:Wkpplb/LHkmgDlX3+57Uad1bBLTqgC+JZchTbO8rLH:xvN/LOOh6H
MD5 SHA1 SHA512 SSDEEP

Submit Download

cpuminer-sse2.exe

Path C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe
Size 2.3MB
SHA256 c7739a1e940a282703d06eccda7110426d306f390e97fdbbd9df18472fd132cd
MD5 4c04147c386ba8792ac6a03069572a8a
SHA1 dda67789fc1d0f2469ca95f01a5c81034853ca6a
SHA512 a8b5a0b878a9a7d30cb38feff814e1f4dce24d000158edc10a43ee9a89920bedf7adc92eb7e3913098b6aab7fbd0531f56fc09f508b5c2769992a94e55d153db
SSDEEP 49152:Wkpplb/LHkmgDlX3+57Uad1bBLTqgC+JZchTbO8rLG:xvN/LOOh6
MD5 SHA1 SHA512 SSDEEP

Submit Download

libcurl-4.dll

Path C:\Users\Admin\AppData\Local\Temp\libcurl-4.dll
Size 836KB
SHA256 218cfc4073bab4eddf0de0804f96b204687311e20a9e97994bff54c9b0e01ee9
MD5 aeab40ed9a8e627ea7cefc1f5cf9bf7a
SHA1 5e2e8ca2881b9bf9edfa3c4fdcec6da1efa102d8
SHA512 c0a67616fa01fdc351015212a718faf70da6612fbb3ec13da28dd7af9a507c56882fb7c3eea6fbc37d4d63b970157199d16d0756dbe3cb3bc2223e215cb104d8
SSDEEP 24576:xufMF9VdLNrjhHdLI8cUlOb1w4yYhJWOrXQB:cfMFhBr19LI87lOb1w4IOrXQB
MD5 SHA1 SHA512 SSDEEP

Submit Download

libgcc_s_seh-1.dll

Path C:\Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll
Size 1.2MB
SHA256 c82f84171b9246d1cac261100b2199789c96c37b03b375f33b2c72afab060b05
MD5 7cf672bee2afba2dcd0c031ff985958e
SHA1 6b82a205db080ffdcb4a4470fce85a14413f3217
SHA512 3e90d1c1efe0200cb3cc7b51d04783a3cce8391faa6ce554cff8b23dac60be9f8e4f980a8ac005fd9dff8ea4bdcb02311f7649c5be28eb32dcc26417fc4090e5
SSDEEP 12288:ynYk4yH15191n1q1x1c1vw6t8a1/hKhbhdhvh3hY6Dhch3hhCZ1c1eCJ1MC1+1MH:mnKt/wDm1nazZffMMcUvQlRg3J6f1SGK
MD5 SHA1 SHA512 SSDEEP

Submit Download

libstdc++-6.dll

Path C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll
Size 8.5MB
SHA256 5f478c6ebaccc2aa8bd8a23aaa1f1064a62ad5b77744bc940e763737c698b79e
MD5 901c97f3bb1786c867a104f2dc4fc4fa
SHA1 bb5526b9e8f8fb6eb55b69dd5455bc2d78309210
SHA512 b44181e7d35a56b0d3ed976c8f3404b49910d5e39f7f2bdc75fb9cd8b58a4e52b6b9e5b648dd440077bc0ae84a0dc7aecddc2ac2282c86a07223451c2934fcd0
SSDEEP 98304:DGGvDsCt2HINpzk8sZg920ipTqP3eA9J8a6ina7JdHZnyyqC3cV:DGGvJ3fnM3HZnJK
MD5 SHA1 SHA512 SSDEEP

Submit Download

libstdc++-6.dll

Path C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll
Size 5.2MB
SHA256 55285c7079d570ffa6fcca0b1a6c8e78c45d02ccf96bc59e0636c248453ce5f7
MD5 3da04e0260580c7eaeaa72daabbb2094
SHA1 885ae19850a3735a27422e00b068144682c42e2f
SHA512 7761039c18a08e7fc6fafa0385d2b3a8b87b624a9f2dc1202bc265b5652217247e3ef3777df9f66370ed926ecc8a8a16522bd52d143db55b6b7c2b1733f9a096
SSDEEP 98304:DGGvDsCt2HINpzk8sZg920ipTqP3eA9J8a6inc:DGGvJ3fnc
MD5 SHA1 SHA512 SSDEEP

Submit Download

libwinpthread-1.dll

Path C:\Users\Admin\AppData\Local\Temp\libwinpthread-1.dll
Size 606KB
SHA256 2f9984c591a5654434c53e8b4d0c5c187f1fd0bab95247d5c9bc1c0bd60e6232
MD5 585efec1bc1d4d916a4402c9875dff75
SHA1 d209613666ccac9d0ddab29a3bc59aa00a0968fa
SHA512 b93163cba4601ed999a7a7d1887113792e846c36850c6d84f2d505727dc06524bb959469f9df12928769f4535dc6074a6b3599b788a4844353e466742ce1e770
SSDEEP 12288:IrAim3Y9lrzf34z//KRwwtkIr1PznEcyJwV2Zug8UYWTh4x:IrAim3Y9lrzf34z//KRwwtkIr1PzEcy8
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1584-8-0x0000000000400000-0x000000000393A000-memory.dmp

Download

memory/1908-44-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/1908-55-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/1908-105-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/1908-45-0x0000000061440000-0x000000006156B000-memory.dmp

Download

memory/1908-46-0x000000006FC40000-0x00000000714F5000-memory.dmp

Download

memory/1908-47-0x0000000000F40000-0x0000000000FFC000-memory.dmp

Download

memory/1908-48-0x000000006D880000-0x000000006D918000-memory.dmp

Download

memory/1908-49-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/1908-100-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/1908-41-0x0000000000F40000-0x0000000000FFC000-memory.dmp

Download

memory/1908-60-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/1908-65-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/1908-70-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/1908-80-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/1908-85-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/1908-90-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/1908-95-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/4844-54-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/4844-7-0x0000000000400000-0x0000000000405000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads