73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72

Analysis

max time kernel
297s
max time network
307s
platform
windows10-1703_x64
resource
win10-20240221-ja
resource tags

arch:x64arch:x86image:win10-20240221-jalocale:ja-jpos:windows10-1703-x64systemwindows
submitted
22-02-2024 12:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

batexe.exe
Size

9.4MB
MD5

cdc9eacffc6d2bf43153815043064427
SHA1

d05101f265f6ea87e18793ab0071f5c99edf363f
SHA256

73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
SHA512

fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
SSDEEP

196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4172	b2e.exe
3372	cpuminer-sse2.exe

Loads dropped DLL 5 IoCs

pid	Process
3372	cpuminer-sse2.exe
3372	cpuminer-sse2.exe
3372	cpuminer-sse2.exe
3372	cpuminer-sse2.exe
3372	cpuminer-sse2.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/716-5-0x0000000000400000-0x000000000393A000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 716 wrote to memory of 4172	716	batexe.exe	74
PID 716 wrote to memory of 4172	716	batexe.exe	74
PID 716 wrote to memory of 4172	716	batexe.exe	74
PID 4172 wrote to memory of 3736	4172	b2e.exe	75
PID 4172 wrote to memory of 3736	4172	b2e.exe	75
PID 4172 wrote to memory of 3736	4172	b2e.exe	75
PID 3736 wrote to memory of 3372	3736	cmd.exe	78
PID 3736 wrote to memory of 3372	3736	cmd.exe	78

C:\Users\Admin\AppData\Local\Temp\batexe.exe
"C:\Users\Admin\AppData\Local\Temp\batexe.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:716
- C:\Users\Admin\AppData\Local\Temp\1B63.tmp\b2e.exe
  "C:\Users\Admin\AppData\Local\Temp\1B63.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\1B63.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4172
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\20F1.tmp\batchfile.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3736
  - - C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe
      cpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 3
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1B63.tmp\b2e.exe

Filesize
3.1MB

MD5
c7a84aacfe33d008669d7d9c02d01a34

SHA1
af1f84eccd44e2eae1219a40c2bda13031f7b04e

SHA256
e6f9daf24ba0eb1c8f54e58ae0da72c62f806905e9f70833f5e030446ded7ed7

SHA512
d62c539a9f7cc23f65568786285259b1704c00f921c2c83e1712a7c39ee08cfe8b39dc541d3b16ed62bfb7683183734c17c134a3ed2c9b29c973ad5e994d98f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\1B63.tmp\b2e.exe

Filesize
2.6MB

MD5
5f3ce8ddee374613146a3933adbc3fa8

SHA1
a504d5fd90e5240cfe7ae044f066b70a859a56f3

SHA256
dab9e8e16e87c6ab77f05cc6c7e32b2e07af0ac9f9dfd818989e4e95e3f0810a

SHA512
fd33c3d8891751860c3557219ea5c54764f14ecd5dde1413f28b284a5468926a279dda6e3c1e3508569284bc150c1c17e6e320ed829370711e8b9ae022d0fc94

Download Submit
C:\Users\Admin\AppData\Local\Temp\20F1.tmp\batchfile.bat

Filesize
136B

MD5
8ea7ac72a10251ecfb42ef4a88bd330a

SHA1
c30f6af73a42c0cc89bd20fe95f9159d6f0756c5

SHA256
65e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9

SHA512
a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0

Download Submit
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe

Filesize
1.1MB

MD5
803a5c788b69abafb67dc0d25b50a9c0

SHA1
f568bfd04238c06f2c2644e6acc4553f3405ef47

SHA256
b79d5bc2de065ebb885ef60dfccd12713f1207c3fb0b915a85f40d68a55fa2de

SHA512
0a9e15ee360f4db70ddc8cd5f33a39c1c4f9883f9e06dacfcc852e032e2ec4ec9e63cc92f97c5670434246768cdf732bc8dcd901142d8cb7a55fa5a9e529dfa8

Download Submit
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe

Filesize
427KB

MD5
39aa22fb9eaf8f4ead2c57f44696b4f2

SHA1
5811e08e39ca2715a9772870fd4b40b70c0a6a92

SHA256
44182c29b193de14d0fddfcc954ec5b67cd174d8b57bb9424b8b0022ab16a3b3

SHA512
7558641ad622125903f6e3cfa504e37ccdea6f6572e01a8dfd82ff4dbe5c10d944e09699090afd8992c896581a330c695dd5775d68c700f5e5815570958787bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\libcurl-4.dll

Filesize
836KB

MD5
aeab40ed9a8e627ea7cefc1f5cf9bf7a

SHA1
5e2e8ca2881b9bf9edfa3c4fdcec6da1efa102d8

SHA256
218cfc4073bab4eddf0de0804f96b204687311e20a9e97994bff54c9b0e01ee9

SHA512
c0a67616fa01fdc351015212a718faf70da6612fbb3ec13da28dd7af9a507c56882fb7c3eea6fbc37d4d63b970157199d16d0756dbe3cb3bc2223e215cb104d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll

Filesize
873KB

MD5
64a6f55f9d62b757c57d98301b3741de

SHA1
e1e2e75537be175ca8e1a8071fa6073c6ffbbacf

SHA256
d5907529a7a4bbb23e17155bd459de4d3c2af152b54e39b25c6e9ab826a3e13f

SHA512
a4384fe006704ac5bd2f88724185fbaeb21a677c852e28c1e3b80be5c269fd7d0f0947b224671db2d6a1cf36dafa665f5d10a9d45bf063ee2851a6e54f1d6659

Download Submit
C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

Filesize
788KB

MD5
f4b64f007993ba20a70bf226871e1d9f

SHA1
0d1593fbaa4372ab3d95b0280c0e8140bb978e67

SHA256
75d4d8586fc7a28d2af8acff504236e88a3e8d6536d281849b2fa4efa5929ce1

SHA512
28a78910c580374ad6ccef1b6ea5654ddfbaefcc6fc3320d6c090515d2fc140856a496a4801d0284a03b3955754be2a0c937c03c6a9e3b859473f51f809a7ca7

Download Submit
C:\Users\Admin\AppData\Local\Temp\libwinpthread-1.dll

Filesize
606KB

MD5
585efec1bc1d4d916a4402c9875dff75

SHA1
d209613666ccac9d0ddab29a3bc59aa00a0968fa

SHA256
2f9984c591a5654434c53e8b4d0c5c187f1fd0bab95247d5c9bc1c0bd60e6232

SHA512
b93163cba4601ed999a7a7d1887113792e846c36850c6d84f2d505727dc06524bb959469f9df12928769f4535dc6074a6b3599b788a4844353e466742ce1e770

Download Submit
\Users\Admin\AppData\Local\Temp\libcurl-4.dll

Filesize
567KB

MD5
ee248c1cde987152a696daf97164561c

SHA1
e6e74f121b50031d1d1f58e9e7bdf9adfdadd5cb

SHA256
16a3cb9bc8ce9d55a3d98c8d1cd1d8cacdbf80369a22725f9d7d6f20b8eae559

SHA512
45cc5b7c69dfdd6c60e87955ee205873422f11aeac0adcdae0b07d6bd283028cab3e1841c8544a472a5ad53b39b17971d57b4f5f2787282dc45a8e3a37f1c8df

Download Submit
\Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll

Filesize
849KB

MD5
50cbc25cacaabf2b24240f8da2c1ecdb

SHA1
f70bf7e32f6592396b4457077fa09e05d9e28a36

SHA256
faa39c3272c318857a56cf79eb881533230f8107549f075a0bbe9972baa99918

SHA512
3a068bbab13c66b7745cad3867efb0dca860a74fccb010abe8201ede4b7622d0fe01319e8afce324c7e2dc8db4c2528dbcc9a80868a6f1e75dfa5a53a7710500

Download Submit
\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

Filesize
558KB

MD5
6dc45bca600d4ccb00669e43c52dfa0f

SHA1
5b86ebe13b7ebcd76e2047d0c81e72267d9212d7

SHA256
4e13e8e12c23aa5291d19fdefac1559030f947cfe8ca680dd246a4d4a343ac30

SHA512
ffbea06785feb1a3c338e64bc0e47f4ff9b6222049cda782e9b10767ccf2f340d51887fbf9491f6990ed65cdb8b8de489fe9c82bae37bdda86e77a04e5338860

Download Submit
\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

Filesize
633KB

MD5
c4440df871cef95c10aa64f3fdafd691

SHA1
5c6109c851328d4a7df7ac148c4bfc358c916241

SHA256
f0964ea97af2863c97026d717e0286e7f254ef394d35f3120192962933687c38

SHA512
8d250d0c03d84aad5a0a491df121c6ff53854b3300bd28f437b9d02dcbcee23bc68fb13711dc1edfed1cad4ba367e6feb3da5743fc6da43a05bafa982588102c

Download Submit
memory/716-5-0x0000000000400000-0x000000000393A000-memory.dmp

Filesize
53.2MB

Download
memory/3372-43-0x000000006E300000-0x000000006E398000-memory.dmp

Filesize
608KB

Download
memory/3372-40-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/3372-42-0x0000000070800000-0x00000000708BC000-memory.dmp

Filesize
752KB

Download
memory/3372-41-0x0000000061440000-0x000000006156B000-memory.dmp

Filesize
1.2MB

Download
memory/3372-44-0x0000000000F40000-0x00000000027F5000-memory.dmp

Filesize
24.7MB

Download
memory/3372-56-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/3372-66-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/3372-71-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/3372-86-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/3372-101-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4172-4-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/4172-50-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download