Analysis

  • max time kernel
    300s
  • max time network
    302s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-ja
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-jalocale:ja-jpos:windows10-2004-x64systemwindows
  • submitted
    21/02/2024, 06:55

General

  • Target

    batexe.exe

  • Size

    9.4MB

  • MD5

    cdc9eacffc6d2bf43153815043064427

  • SHA1

    d05101f265f6ea87e18793ab0071f5c99edf363f

  • SHA256

    73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72

  • SHA512

    fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6

  • SSDEEP

    196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv

Score
7/10
upx

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 5 IoCs
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\batexe.exe
    "C:\Users\Admin\AppData\Local\Temp\batexe.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1440
    • C:\Users\Admin\AppData\Local\Temp\F51E.tmp\b2e.exe
      "C:\Users\Admin\AppData\Local\Temp\F51E.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\F51E.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:5748
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\2A.tmp\batchfile.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5168
        • C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe
          cpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 3
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2296

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\2A.tmp\batchfile.bat

    Filesize

    136B

    MD5

    8ea7ac72a10251ecfb42ef4a88bd330a

    SHA1

    c30f6af73a42c0cc89bd20fe95f9159d6f0756c5

    SHA256

    65e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9

    SHA512

    a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0

  • C:\Users\Admin\AppData\Local\Temp\F51E.tmp\b2e.exe

    Filesize

    9.2MB

    MD5

    cdae2c8b839e241d83fbf57726460463

    SHA1

    aeb8ef0d96814704b1fd0af343c6734b62d5f5d3

    SHA256

    eb0a255fd2c5917c80c95912e39f5c48b80866edd71c2eb4a187cee37c3c0387

    SHA512

    d55a272189f6de126775094c8b23b779afec9f51240705474388595874480bf038626f1d5480ef5fcc0ab91841f33e166500740c8b3db52ee772c8108aa187d1

  • C:\Users\Admin\AppData\Local\Temp\F51E.tmp\b2e.exe

    Filesize

    3.4MB

    MD5

    cd704f74c47b2a518f96462c06fcf34d

    SHA1

    21814c1827028057dc0653b348994d6a389a03f4

    SHA256

    8a55baa746a12788b9798d78056b68642b5a6a404c92f75cff5a7588fc5a60fb

    SHA512

    10b9cd3337dc23fa559365e11d1f21e731656de668dd48c4d40786303c2278aabceae1a55b8b575b64707556aaed0d06890dae98865cc71de63c258b568fd71d

  • C:\Users\Admin\AppData\Local\Temp\F51E.tmp\b2e.exe

    Filesize

    2.4MB

    MD5

    bb21704c594b150d67625729caf9a09e

    SHA1

    1e691355e6968cc069431746ffbecef07853e116

    SHA256

    66c17bdb3844d2815f16e2d89264de37bea83a8e98071b428a430143d8861f2a

    SHA512

    a8802e396f97c36ec1a02eb8b1e5d94572b63e133f2e3fcb4d2f5b4249c16a82a402749fb52a9c2e8afae593b50396768a1fc9a07262d223569d40e44ada98de

  • C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe

    Filesize

    420KB

    MD5

    a6b8c24b3c8f88650302bc7009896007

    SHA1

    c257e415aa58a128886c737e66c12d61f27f23f6

    SHA256

    b526cc86897db113900876d317893fe5dde4be6fbd4e206bcc69ce11ceef7b9e

    SHA512

    bd6670e631b7e215e21e112fdf1acc6b3f194df70b1433d0146b3f4cf8034abcbf9249743a2f921ddfbdb931352e33aa0431eb8015606b84aada5fdf71c96a56

  • C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe

    Filesize

    399KB

    MD5

    25797bafe5923c0fd274a8900c242471

    SHA1

    7b2a8065b9d7256b3769a5d845f388e39a5de381

    SHA256

    f09751a1b7fca6b0129413cb727bc4f96aac93217b596925aa4aa015384a5245

    SHA512

    a10945e2c08cf3cb03f91855ff341c4190784330395a6f7d65d1dc01e1959b8d6a4520d13804eb4cd2889348dc35b2302ccf4f64cc6a8f0485e5ed27b2b7ee08

  • C:\Users\Admin\AppData\Local\Temp\libcurl-4.dll

    Filesize

    468KB

    MD5

    1f1d29fdb871360581d92303c8d659ea

    SHA1

    89c155a53b2c59e9347f58224ae308eea8b2ff94

    SHA256

    fb57b25c7370d2d3c482241ed70176867b2c5dd021a99caa71b60917340cdda9

    SHA512

    ec6cd0b6f993ee6aa8af54b00150da3b360858fb41915ec89fed61ee51b14b1e32d82110618bb76dcac413d13f8ce727742efb34b45d6f1972b9f5ca06f533fe

  • C:\Users\Admin\AppData\Local\Temp\libcurl-4.dll

    Filesize

    373KB

    MD5

    3135c0b486b3a4ba4c57022a43bf4de8

    SHA1

    6e25491da2456adca792d69d6eb7aa74c8032272

    SHA256

    a443fe0040f89cd862a0705b78e6623483ee9574dcf164fffdb57e67d7210cc9

    SHA512

    c552e3fd6ac1086324ba160caefca38108bcee88f474f78b2eba35b71aa5530dcf38e9e093e88990063db9ab2196de1d1ff71442d808120f9ffd887fc01c7b07

  • C:\Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll

    Filesize

    279KB

    MD5

    b439c90c3b1cc8ba1f8059385ae102c7

    SHA1

    98b1ff970c875bc80df62c7c695d452fec82282d

    SHA256

    6a1650317e9fc1ca877cc362b223294ee3f6863f933442b03de008ed90e1cd87

    SHA512

    dcede47681c48aecb3491357abb6e69ee5680ea9a0cfd6442d1dd5adb838479fa41ba635b640e330f0dd00d62a59d2f0664870294b34de0c54138c4f4de88ff2

  • C:\Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll

    Filesize

    539KB

    MD5

    fb3bf9a27b78e5c47d861a6d4e116515

    SHA1

    dd0651f8792f3d2ff9ac8879e3946d29229ddd16

    SHA256

    50dd736d1fa03b50c1f867b82d56b8896259fe4c0e04844eeac61014c8943865

    SHA512

    5b9c97662fc706d24da66beca59f56db050ecc37dfbcf61f91cb7f217e0a50dac1120bdf5ed479b3940eb45400364dde2c3cbef369373959406bb93c13f9820d

  • C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

    Filesize

    492KB

    MD5

    93207c154f09a1710ff55977e7423ebe

    SHA1

    dd229e929c4f68c6928dd0ee16fa48e77c304dc0

    SHA256

    78a4ed1f38238480e2bb32407083e5f1842aec82c2f02554ac94e30ec9765a7b

    SHA512

    ff580bf4e12f59038c40f48475cad521a0d9e8325847011b9f5f53e31d79c6592cd35c11220c54417c3f6e2c4d1b186a954e3128918920e6b51f21ac577db940

  • C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

    Filesize

    314KB

    MD5

    0c971c901463d58c5116bbd0ce79b690

    SHA1

    999d9722aa999c0cb8d68f4ada3d20dbc4f02aad

    SHA256

    3f53a5792b11feb3b62a0504c33269a633637ef82745cbb3abc0f88f3c2f790b

    SHA512

    708d7f0e91e28f69f97583bc748f006e2e5efc0917f73e9b6bac5a2d2d8e9505d5571b502b904170fa7b8e45a58fa6994a188d5f8155141a29dd7d30456f9132

  • C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

    Filesize

    353KB

    MD5

    0dce86927c0b65e1ce527e828c38d80a

    SHA1

    f176d45a4683d0b3bd976f657936a5927b215be4

    SHA256

    1fa519cf04080925ed957f7c9af21bee4c7e66fcbf892695a7432f7d8ef9f718

    SHA512

    0b1badb419954f19514424a392d23029fbf6c0080e05f20acad5182807fd189b89d20a6a2c70ff2f92042534580136fd596cac6cf59a6000cbc8a24ef6f39e9c

  • C:\Users\Admin\AppData\Local\Temp\libwinpthread-1.dll

    Filesize

    314KB

    MD5

    55c4957b306a718701f05a3996e96720

    SHA1

    984e24ea7bae684dc3f720c2e06aceb6387498d5

    SHA256

    78d1bfaf7f7e3e23e7f1796895dd2784e0f7c8883074d5e1d164c5b06e4a3ddc

    SHA512

    8aeb8305ff7e813a005b9d95d8555b9664fe800860fdb6c8acfb043ec4b8f1e3e0cc0369e829b81a7798c7e94e4abf7b8c589583585e7e784c8fb16328929c3e

  • C:\Users\Admin\AppData\Local\Temp\libwinpthread-1.dll

    Filesize

    479KB

    MD5

    529fa5fc225d361bcd883d5cef69f202

    SHA1

    787abc430e0dbd6105662b43912a31d213c675af

    SHA256

    50c797f93e2b75b62e28a72cd86f0c1122c7771fdcea28870dc6b300b02de4ed

    SHA512

    443c902a707b54398e2bb2b52b76e64fadf5413406d5987289c653e038851fb01f7dcbcd4665006614b80c2ebc2dcb0b1cac4f960d3fe862850d2341cb1c7135

  • memory/1440-27-0x0000000000400000-0x000000000393A000-memory.dmp

    Filesize

    53.2MB

  • memory/2296-47-0x0000000000F40000-0x00000000027F5000-memory.dmp

    Filesize

    24.7MB

  • memory/2296-69-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/2296-45-0x0000000061440000-0x000000006156B000-memory.dmp

    Filesize

    1.2MB

  • memory/2296-44-0x0000000070800000-0x00000000708BC000-memory.dmp

    Filesize

    752KB

  • memory/2296-46-0x00000000635D0000-0x0000000063668000-memory.dmp

    Filesize

    608KB

  • memory/2296-94-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/2296-48-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/2296-89-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/2296-54-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/2296-64-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/2296-43-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/2296-74-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/2296-79-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/2296-84-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/5748-53-0x0000000000400000-0x0000000000405000-memory.dmp

    Filesize

    20KB

  • memory/5748-8-0x0000000000400000-0x0000000000405000-memory.dmp

    Filesize

    20KB