73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72

Analysis

max time kernel
295s
max time network
301s
platform
windows10-1703_x64
resource
win10-20240221-ja
resource tags

arch:x64arch:x86image:win10-20240221-jalocale:ja-jpos:windows10-1703-x64systemwindows
submitted
22/02/2024, 08:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

batexe.exe
Size

9.4MB
MD5

cdc9eacffc6d2bf43153815043064427
SHA1

d05101f265f6ea87e18793ab0071f5c99edf363f
SHA256

73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
SHA512

fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
SSDEEP

196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2424	b2e.exe
4176	cpuminer-sse2.exe

Loads dropped DLL 5 IoCs

pid	Process
4176	cpuminer-sse2.exe
4176	cpuminer-sse2.exe
4176	cpuminer-sse2.exe
4176	cpuminer-sse2.exe
4176	cpuminer-sse2.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/716-6-0x0000000000400000-0x000000000393A000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 716 wrote to memory of 2424	716	batexe.exe	74
PID 716 wrote to memory of 2424	716	batexe.exe	74
PID 716 wrote to memory of 2424	716	batexe.exe	74
PID 2424 wrote to memory of 1712	2424	b2e.exe	75
PID 2424 wrote to memory of 1712	2424	b2e.exe	75
PID 2424 wrote to memory of 1712	2424	b2e.exe	75
PID 1712 wrote to memory of 4176	1712	cmd.exe	78
PID 1712 wrote to memory of 4176	1712	cmd.exe	78

C:\Users\Admin\AppData\Local\Temp\batexe.exe
"C:\Users\Admin\AppData\Local\Temp\batexe.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:716
- C:\Users\Admin\AppData\Local\Temp\1BD0.tmp\b2e.exe
  "C:\Users\Admin\AppData\Local\Temp\1BD0.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\1BD0.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2424
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\20A2.tmp\batchfile.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1712
  - - C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe
      cpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 3
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4176

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1BD0.tmp\b2e.exe

Filesize
4.0MB

MD5
1e26d361237451c31321319fa8fc30f4

SHA1
6347cba59c36b44bdf25f807acf5b6b41e8fd9d6

SHA256
3d218d0d2bf9a46aeba1f812448ca4d2b1e6cbb9051c536cd5ec9d7e6cb5294b

SHA512
8f48b8f07d309314840301d70cb9697b7d7254356c8a3afb93e00670afa93d30aa170a6d90048695a61c4e15f1a1edb7e0dfc8063dbfa97155fde9347a2b2d7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\1BD0.tmp\b2e.exe

Filesize
4.2MB

MD5
a4d49eee5bb1782af7c3b81e4b2c9956

SHA1
7c661fe4615ed08ddbf4d69ef13e27e42666c459

SHA256
d98c2d9a8210ae838169084419bb5f8cb2df69ca19a99b78e8f8ce05b547a82b

SHA512
f0e4e36f702e885ce4f71a42ec4875384a67a25c1ac6c6fbd521efae1c1be503f5d0dad619e910aa506ace14431dfd9c6a68b616af7eacd00dd40170a5333d77

Download Submit
C:\Users\Admin\AppData\Local\Temp\20A2.tmp\batchfile.bat

Filesize
136B

MD5
8ea7ac72a10251ecfb42ef4a88bd330a

SHA1
c30f6af73a42c0cc89bd20fe95f9159d6f0756c5

SHA256
65e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9

SHA512
a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0

Download Submit
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe

Filesize
635KB

MD5
64bea99dea2b5bfd6ff997777042af66

SHA1
7a81b65f119cc3f6b35e361abd576db086695e37

SHA256
de7d4a9fb1a8bc4f577fb81a29e3b266c1f64a840acf1dec17be419713756036

SHA512
6f9569a2b323e1a3372dc082fa0cf600f897def37f4715efdb422f05f409a974ceb7bf724d93dfc19d36fd9123e2a2db57ba2e4978d051781baad07eebeefa53

Download Submit
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe

Filesize
458KB

MD5
e88b62341e4ae568bdf2d02294a59483

SHA1
3bd8b4387aea9ea592dc553b3bf7817a03663fca

SHA256
82cb4033c279025e7da8ca38c87ae134e00f748497456b2170a0c7ac6d2d6280

SHA512
e01d12d478138aaeec0ea72e7f9a343a46e68d6b28085e4e7bfb81ab9abdcece86ed2c941302e088b5c62a45931cf2a88d641743672f280eaf38355820d1aa9a

Download Submit
C:\Users\Admin\AppData\Local\Temp\libcurl-4.dll

Filesize
423KB

MD5
1ee75a57f3a27b34498e56557ae5bd4b

SHA1
8222055943993e73ebbab3239103c4011a196f7c

SHA256
410c1fc0abc37428d6921ba64cc159e758f712b4a287fbb08f59bd7e72f8d697

SHA512
df044bb3403bc35021904a03d86d297cb78cc0eec3fc29e68b3242c26b55986aaaf9d6b88e274d57f9456c8f856f86d09d749e16c290396ef9b95889bc6bf715

Download Submit
C:\Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll

Filesize
557KB

MD5
c3660646d23bc8fec55d8ce9ba8db37c

SHA1
341db5ee3d1ad374f2f9e77aea1a04a9f7e21795

SHA256
32fc343a87df7d9f9e00af7713f48121bc9610b2dfb340e60da32b8d601d9616

SHA512
86529654b517aa418380a1377ca61c8d77b9619db741e92bb1949dcb9c41a9bc6ada19f93f13d3df05317b73ee4d3cae27cb4621d507017757226a5cfe7eeec7

Download Submit
C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

Filesize
549KB

MD5
b8e95c9ebfa47446a6ad83bff383dd36

SHA1
59d81e7d48037f6337669c088c6a1e955bae40fa

SHA256
c1acd80d66762bed36d31f8f2d1e05254771c5f53abd1ff859e26b8397c971e2

SHA512
bbb933579ff03d2e24b05aa99cdf3851046ae313ad3cd2dee2c55b0c1e57425809717f079eecd1f8f7b4fc5b8f94e2abaeddb4261287a7efbdf60d7f498cdcf9

Download Submit
C:\Users\Admin\AppData\Local\Temp\libwinpthread-1.dll

Filesize
389KB

MD5
ed39fd0330051ac3008f7b2c7c3fb9b8

SHA1
cea43ea481a279ebdaf8ac96b20d4cfcf55818ca

SHA256
40534f21f3a2b4b4fa09d627aa165fde93ed1b58533e0a95472936c4a8dac53b

SHA512
540fe867e0e75a85314af37a440f9e349cf4d2d7979dcc626cb99e91d846d470e03051b6c2be11327b86033182aaed228e784d9bc1181e8b7696b0f473800b7f

Download Submit
\Users\Admin\AppData\Local\Temp\libcurl-4.dll

Filesize
310KB

MD5
16b5752e3917bccf0a801f9f258f8991

SHA1
0c847ee234b1d02351f8a704fb0385a738976d6b

SHA256
b31c483cb5c8cdac91706e78b9e55f6d8be461d2fd8e5222cdf22da39d18c331

SHA512
754a79900a94f89159bc2ba346d4b64391e3ccdf330a7007e66cadf02939cc54f5f98f48af0fdd70b2528e8a518e87e42483dd41a56a2e354e2a2a9d2741dca0

Download Submit
\Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll

Filesize
448KB

MD5
8185100383d0fe360c9198e5a883b08d

SHA1
ab398c469573f8e84d3cfcef01287a0604d6ab5f

SHA256
05ef7288b0d559bf67c3d69c201da9bdcaed0b49ecc538640f7b96c5b82eb538

SHA512
24930ef0caa1f2db2ed60f7dfdb832a172cf7747b0a336b051f73c0087a5f2fabff721487cb49cf5a3bc2be5426554b0a3a0e51541b6a4ca735646af24f1404a

Download Submit
\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

Filesize
310KB

MD5
55c6c8a56ec15dd73f19ad0664a8cdc1

SHA1
47827650f414a7a1cddd76af73cb941975b1681c

SHA256
a1144803f9107c4f1856d22e80b6a28bc047fbba4ca4a59bf760dafd07e65292

SHA512
ee341fa33649384c294206f8c14b5568212c8c62017be30a89ad4b072f0c41ed9c90e6a6f3ea4d04b1ef4083bb1f159d238f0483a28fe43facc9b760d0140a2a

Download Submit
\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

Filesize
377KB

MD5
67b2fb9f2eb4e98064ae12078e72ef79

SHA1
d74f15b0985965f4f7466f6c1c48f67b709507f2

SHA256
3341681c6472d33a1ffd444ac9b619796760ff6823b0108f026b7ffaa92c1983

SHA512
d15c9a515a196c54e11e2d1aff404f7087f24a4f8209626721bae7a8fddc77a17a959de563c9ad4ea702ad50124c5185efe3e63c809cc64bc3efeaabab580ec0

Download Submit
\Users\Admin\AppData\Local\Temp\libwinpthread-1.dll

Filesize
606KB

MD5
585efec1bc1d4d916a4402c9875dff75

SHA1
d209613666ccac9d0ddab29a3bc59aa00a0968fa

SHA256
2f9984c591a5654434c53e8b4d0c5c187f1fd0bab95247d5c9bc1c0bd60e6232

SHA512
b93163cba4601ed999a7a7d1887113792e846c36850c6d84f2d505727dc06524bb959469f9df12928769f4535dc6074a6b3599b788a4844353e466742ce1e770

Download Submit
memory/716-6-0x0000000000400000-0x000000000393A000-memory.dmp

Filesize
53.2MB

Download
memory/2424-4-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/2424-50-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/4176-44-0x0000000001070000-0x0000000002925000-memory.dmp

Filesize
24.7MB

Download
memory/4176-56-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4176-43-0x000000006E300000-0x000000006E398000-memory.dmp

Filesize
608KB

Download
memory/4176-41-0x0000000061440000-0x000000006156B000-memory.dmp

Filesize
1.2MB

Download
memory/4176-45-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4176-40-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4176-51-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4176-42-0x0000000070800000-0x00000000708BC000-memory.dmp

Filesize
752KB

Download
memory/4176-66-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4176-81-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4176-86-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4176-91-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4176-96-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4176-101-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download