73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72

Analysis

max time kernel
296s
max time network
295s
platform
windows10-2004_x64
resource
win10v2004-20240221-ja
resource tags

arch:x64arch:x86image:win10v2004-20240221-jalocale:ja-jpos:windows10-2004-x64systemwindows
submitted
23/02/2024, 15:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
batexe.exe
Size 9.4MB
Sample240223-swvgfsdb3v
SHA256 73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
MD5 cdc9eacffc6d2bf43153815043064427
SHA1 d05101f265f6ea87e18793ab0071f5c99edf363f
SHA512 fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
SSDEEP 196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\Control Panel\International\Geo\Nation	batexe.exe
Key value queried	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\Control Panel\International\Geo\Nation	b2e.exe

Executes dropped EXE 2 IoCs

pid	Process
1088	b2e.exe
552	cpuminer-sse2.exe

Loads dropped DLL 5 IoCs

pid	Process
552	cpuminer-sse2.exe
552	cpuminer-sse2.exe
552	cpuminer-sse2.exe
552	cpuminer-sse2.exe
552	cpuminer-sse2.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3808-8-0x0000000000400000-0x000000000393A000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3808 wrote to memory of 1088	3808	batexe.exe	88
PID 3808 wrote to memory of 1088	3808	batexe.exe	88
PID 3808 wrote to memory of 1088	3808	batexe.exe	88
PID 1088 wrote to memory of 3844	1088	b2e.exe	90
PID 1088 wrote to memory of 3844	1088	b2e.exe	90
PID 1088 wrote to memory of 3844	1088	b2e.exe	90
PID 3844 wrote to memory of 552	3844	cmd.exe	92
PID 3844 wrote to memory of 552	3844	cmd.exe	92

C:\Users\Admin\AppData\Local\Temp\batexe.exe
"C:\Users\Admin\AppData\Local\Temp\batexe.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3808
- C:\Users\Admin\AppData\Local\Temp\5B5E.tmp\b2e.exe
  "C:\Users\Admin\AppData\Local\Temp\5B5E.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\5B5E.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1088
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\5F66.tmp\batchfile.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3844
  - - C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe
      cpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 3
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

b2e.exe

Path C:\Users\Admin\AppData\Local\Temp\5B5E.tmp\b2e.exe
Size 11.4MB
SHA256 b6c2694f6b154511b810fb8dcc3cbcdb80907fba0230298c5e767dc59fb21731
MD5 7d1c574b726ff9c2da598368f8e0fb73
SHA1 4cd13fa777ae3ceaddf39da843ff1daf02657836
SHA512 d1ec6e0998bdda1c680348ae460e2f4f7b8b675f2815c43979e1e040636800a7aa951354486357e18e53457c9a5b8f1d7dc74e6fc2e1e85186bb5b4b3fd5a430
SSDEEP 98304:2Vh7J/WrocAdkmBtKCLaDr/4Q8FD9Ck6jBVFh0ulRm6eqdInEgNf/4+eQhyYv:wWrJQ9CuKdIncS
MD5 SHA1 SHA512 SSDEEP

Submit Download

b2e.exe

Path C:\Users\Admin\AppData\Local\Temp\5B5E.tmp\b2e.exe
Size 12.5MB
SHA256 2d445e0b853f558bd541500fde7822c5971a83a4d23d4fcb2f393ea308f9cbe7
MD5 3d362fdc80611a5f07b44b04afcbb048
SHA1 e14721fdbc1046a2af803e59271d05c60d6ff722
SHA512 c5d7f2b8e57819013c722ad7c032637b48692892783330f28068ed50db65d43391fab66b83b4e6761a9d891db13797934c88d7deab532297a3197bc6420cdbf7
SSDEEP 98304:2Vh7J/WrocAdkmBtKCLaDr/4Q8FD9Ck6jBVFh0ulRm6eqdInEgNf/4+eQhyYlkBt:wWrJQ9CuKdIncRBGi
MD5 SHA1 SHA512 SSDEEP

Submit Download

b2e.exe

Path C:\Users\Admin\AppData\Local\Temp\5B5E.tmp\b2e.exe
Size 10.8MB
SHA256 fbc8d119c5e1f8bb9feb91aa04b0e6dd9fdb3f8b9e4a6ef8d67c45dd1a8efc96
MD5 18de6e664fd3ce345a897f49b897ddd9
SHA1 c75359b977fc570067f97392d66b0024b7de88cf
SHA512 12bc7d2ad4233d5d966e816096c779e4175caa29d20b793704d1c70430fb34347f446b8790e5b575c5f24606f86ef480bbf9bd116b5cc8602682f4c01640e0ec
SSDEEP 98304:2Vh7J/WrocAdkmBtKCLaDr/4Q8FD9Ck6jBVFh0ulRm6eqdInEgNf/4+eQo:wWrJQ9CuKdIns
MD5 SHA1 SHA512 SSDEEP

Submit Download

batchfile.bat

Path C:\Users\Admin\AppData\Local\Temp\5F66.tmp\batchfile.bat
Size 136B
SHA256 65e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9
MD5 8ea7ac72a10251ecfb42ef4a88bd330a
SHA1 c30f6af73a42c0cc89bd20fe95f9159d6f0756c5
SHA512 a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0
MD5 SHA1 SHA512

Submit Download

cpuminer-sse2.exe

Path C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe
Size 831KB
SHA256 6ef6748f8ff7daa845733a1f6b234af9540836cd3cdbab990c1422a0570de975
MD5 a193019ffdc6eb4992f5ae275634788a
SHA1 6593cb59b92e045896b6561f7c6445d75970f856
SHA512 36592e9d51447091e567b7147f160b3993770a99e2b70b0b8777dc86b9d89ce85400482b987daa6775bf1172852cce9c32933006dbf96603ef12b235c4e08233
SSDEEP 24576:WbAAkXZfeqVZoq/QpmN/TDjzshtmB1kbQ3m:Wkpplb/LHk9
MD5 SHA1 SHA512 SSDEEP

Submit Download

cpuminer-sse2.exe

Path C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe
Size 913KB
SHA256 70cf442ef4436822bb3bf3db6d0a255fabbfbc81167012a4935795ca91a037c8
MD5 7d2218d12d976516bd6b55e4d1d54e95
SHA1 f41c4ebf7710a0ad66838e08897026437b63f859
SHA512 0529e4a60d2c6e842a88cff0e4c4249dd054b0bff1707a0db88dc81d12288c6b0cfab085439f39da5690d89492e05f9800f5bb5a852df395bfd200e5abce9957
SSDEEP 24576:WbAAkXZfeqVZoq/QpmN/TDjzshtmB1kbQ34T:Wkpplb/LHkX
MD5 SHA1 SHA512 SSDEEP

Submit Download

libcurl-4.dll

Path C:\Users\Admin\AppData\Local\Temp\libcurl-4.dll
Size 836KB
SHA256 218cfc4073bab4eddf0de0804f96b204687311e20a9e97994bff54c9b0e01ee9
MD5 aeab40ed9a8e627ea7cefc1f5cf9bf7a
SHA1 5e2e8ca2881b9bf9edfa3c4fdcec6da1efa102d8
SHA512 c0a67616fa01fdc351015212a718faf70da6612fbb3ec13da28dd7af9a507c56882fb7c3eea6fbc37d4d63b970157199d16d0756dbe3cb3bc2223e215cb104d8
SSDEEP 24576:xufMF9VdLNrjhHdLI8cUlOb1w4yYhJWOrXQB:cfMFhBr19LI87lOb1w4IOrXQB
MD5 SHA1 SHA512 SSDEEP

Submit Download

libcurl-4.dll

Path C:\Users\Admin\AppData\Local\Temp\libcurl-4.dll
Size 795KB
SHA256 375591c74e5d10734eb79cf86838936a8bb7b69c4290b53b49dea83d3870bbc7
MD5 f0e40bd8bda9920ee11d75e3c2d32a0b
SHA1 d39f34176c84dcbc86cee604d5dd5d9c6aae9d7e
SHA512 cdc7f1e43d410ac1cca8c7992e370bd9342aa4269716fc1ed0942ab72b9186e1b7585c9d4532d5799fa3283ba739d1d3f5e4a0f83497b1e7af7bffbc6570a337
SSDEEP 12288:xup7YufLe62F2G1TdLN7/g4hHdLIn8cUlOb1w4g3Qa:xufMF9VdLNrjhHdLI8cUlOb1w48
MD5 SHA1 SHA512 SSDEEP

Submit Download

libgcc_s_seh-1.dll

Path C:\Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll
Size 832KB
SHA256 40729edf62213c039a1818c9adb9478aa0284bb26dd071bd1ac4de1da2470048
MD5 d33f0e6bb5e8d2b9e111a90544790dc8
SHA1 df4e81d22638d511e761744e886c33bc12096c48
SHA512 ce4ebeae054117d4de8b3fe2403d95a6d819483269f851618958e864887e9b2f42fc9c893e1aa207dfa2d94900c8f4214a67796ddeb2a80ce655d69ec290d629
SSDEEP 12288:ynYk4yH15191n1q1x1c1vw6t8a1/hKhbhdhvh3hY6Dhch3hhCZ1c1eCJ1MC1+1MI:mnKt/wDm1nazZffMMcUvQlRg3Jq
MD5 SHA1 SHA512 SSDEEP

Submit Download

libgcc_s_seh-1.dll

Path C:\Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll
Size 472KB
SHA256 b0de2ef26115e1643a48a6ab6e39688bac2361f057ba48e7c617662d02b9c6b6
MD5 1b1dc243f6e2594ef6ee60fd3a3c8dde
SHA1 c7ff801187c9ea6c0d8ee2ccb635b9089a339bf1
SHA512 05de6690dbf1c22a33543224acfc189093802cb5baa2e2c4c2c9f3df0086cf537fdd306d9fe0f82ab0d64572641bf7f508c139498c9e39a6ed027d64b9686e8d
SSDEEP 12288:ynYk4yH15191n1q1x1c1vw6t8a1/hKhbhdhvh3hY6Dhch3hhCZ1c1eCJ1MC1+1MD:mnKC
MD5 SHA1 SHA512 SSDEEP

Submit Download

libstdc++-6.dll

Path C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll
Size 958KB
SHA256 fb166bd61ba28bc70736563218f6a8a2d7e65eafeb481448fa5b13f306e27fff
MD5 5f23591e760603d2b2249f9428a3d303
SHA1 07a17c675a5e8824efd46933bb9bc83f11a3991f
SHA512 57ce9052448aa134a15978761c63fb1ea384dbd6406a1faaaca64fcf9648d1444fb1b723a2b0086f0b92809ef1b36bc62823b039cb1dbc60c803f37cb5ecdbea
SSDEEP 12288:9Rgs+Gatqxo2LvmKmOmVriIvhr/5yfMVjKBUUaqN01o:Dv+Gatwo2ZyrfvhKBl01o
MD5 SHA1 SHA512 SSDEEP

Submit Download

libstdc++-6.dll

Path C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll
Size 722KB
SHA256 608a2c032708b96977404e4cea98b1c14cf94f8544cf8bd98ad69a5dc866e162
MD5 ad59a256aa1d9084e36b8312ce3f70df
SHA1 05dd94fb998221330bada0718b5a71dd96a26735
SHA512 66e87cae1cd6f2c2e8c510f6dee3f0e2b2e4af0ef95726a88f2418e61b23c45ab8161392c1d44bb91afa3e3a2dd321e3fd69e45a8da2a5550a1fad35849ad768
SSDEEP 12288:9Rgs+Gatqxo2LvmKmOmVriIvhr/5yfMVD:Dv+Gatwo2ZyrfvhP
MD5 SHA1 SHA512 SSDEEP

Submit Download

libstdc++-6.dll

Path C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll
Size 166KB
SHA256 85d4174b67fc3b3e700848ae2aab1e92b00f1cd1093de11b6cf6e9f3dde5084c
MD5 8fb16e7e879bdf1a7b6fa956a2341a2b
SHA1 ab1cb34b14d9a7902abbfbd1ac94d91b034ac1ad
SHA512 9ffcdc07c0af2df1466dd300fc12e925fc424e31714ec89dac95b72e00cb9e9fce2c6e7aa2e1b25d7a05eb71b4a06400087cf2824ce953d7ec91be0b53e368dc
SSDEEP 3072:OEOWd4lAhRoZuXCFUf2yaYuT4V+Gk3UmCQoUxKN3Kbso2Qo1B2Jf:qKRa5s+G7mCiqxo2L8
MD5 SHA1 SHA512 SSDEEP

Submit Download

libwinpthread-1.dll

Path C:\Users\Admin\AppData\Local\Temp\libwinpthread-1.dll
Size 288KB
SHA256 ef6c96f83bf05fdbb114be79080aa2c242df301af1c9918e02c665351e7db825
MD5 a94f031883f3af533485b02bf376ae50
SHA1 931d38244c87140595a33f56b00adb2149f107e5
SHA512 1d89bcbe1566cac847641c0d028214a1f9d72e024dbe9ee7afea2316b4129f5bed0be8b929975fb6b423f5853c3cfea2ed1829d92cff1355c890d30720c7c86d
SSDEEP 6144:g9rAim3YMr6mjmrYGf4qt2zQi/XaWqDqLrwGjqlK+Ge4e+2OliKpKCkZ2cny6:IrAim3Y9lrzf34z//KRwwtkIr1PznEc3
MD5 SHA1 SHA512 SSDEEP

Submit Download

libwinpthread-1.dll

Path C:\Users\Admin\AppData\Local\Temp\libwinpthread-1.dll
Size 592KB
SHA256 836c2c01d8b5a5c8210590f72f7377e781d183b94f05942506dbc89cb0cd9a66
MD5 73bd5ba61ded01b3a0e58f63a8a96bf4
SHA1 626af8bfa379d3131a77bc2bbf1ac23bfd89b52e
SHA512 1d08e1065fa0fe21584fcb11f927a862c49f8568cbd2632fb0eb2426c5d1b8e0937fa8d64e540c7bbd06c8ef1eab9218a3d4a61bdcbb6d5467f9d62c4d2df21c
SSDEEP 12288:IrAim3Y9lrzf34z//KRwwtkIr1PznEcyJwV2Zugc:IrAim3Y9lrzf34z//KRwwtkIr1PzEcyE
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/552-47-0x0000000000F40000-0x00000000027F5000-memory.dmp

Download

memory/552-48-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/552-43-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/552-44-0x0000000070800000-0x00000000708BC000-memory.dmp

Download

memory/552-45-0x0000000061440000-0x000000006156B000-memory.dmp

Download

memory/552-46-0x000000006DDE0000-0x000000006DE78000-memory.dmp

Download

memory/552-104-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/552-89-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/552-74-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/552-54-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/552-59-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/552-64-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/552-69-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/1088-53-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/1088-7-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/3808-8-0x0000000000400000-0x000000000393A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads