Analysis
-
max time kernel
293s -
max time network
300s -
platform
windows10-1703_x64 -
resource
win10-20240221-ja -
resource tags
arch:x64arch:x86image:win10-20240221-jalocale:ja-jpos:windows10-1703-x64systemwindows -
submitted
23/02/2024, 19:12
Behavioral task
behavioral1
Sample
batexe.exe
Resource
win10-20240221-ja
Behavioral task
behavioral2
Sample
batexe.exe
Resource
win10v2004-20240221-ja
General
-
Target
batexe.exe
-
Size
9.4MB
-
MD5
cdc9eacffc6d2bf43153815043064427
-
SHA1
d05101f265f6ea87e18793ab0071f5c99edf363f
-
SHA256
73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
-
SHA512
fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
-
SSDEEP
196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 4472 b2e.exe 4260 cpuminer-sse2.exe -
Loads dropped DLL 5 IoCs
pid Process 4260 cpuminer-sse2.exe 4260 cpuminer-sse2.exe 4260 cpuminer-sse2.exe 4260 cpuminer-sse2.exe 4260 cpuminer-sse2.exe -
resource yara_rule behavioral1/memory/4588-5-0x0000000000400000-0x000000000393A000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4588 wrote to memory of 4472 4588 batexe.exe 72 PID 4588 wrote to memory of 4472 4588 batexe.exe 72 PID 4588 wrote to memory of 4472 4588 batexe.exe 72 PID 4472 wrote to memory of 784 4472 b2e.exe 73 PID 4472 wrote to memory of 784 4472 b2e.exe 73 PID 4472 wrote to memory of 784 4472 b2e.exe 73 PID 784 wrote to memory of 4260 784 cmd.exe 76 PID 784 wrote to memory of 4260 784 cmd.exe 76
Processes
-
C:\Users\Admin\AppData\Local\Temp\batexe.exe"C:\Users\Admin\AppData\Local\Temp\batexe.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\125A.tmp\b2e.exe"C:\Users\Admin\AppData\Local\Temp\125A.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\125A.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\174C.tmp\batchfile.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:784 -
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.execpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4260
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1024KB
MD555d3fcf113506e85b6cf485f08b11290
SHA1539d601fdd7e37fe22412d8c73023e21293ac62c
SHA256519083ea4de496637895b9c3dd7fa5d9fc1140325272570f09aa0d2bad46f2d3
SHA51262c0dc6a36ef819eede73c8b041fbdf579ec0ae399654a73a4628555bb84c4e1fdcf314deb659f41986204e2d92acd886dd8735a24a150a309d4035b58a33ee4
-
Filesize
1.6MB
MD54b3e3a3f84660472fb9714cd8feaba1b
SHA18561afb6ae0a1ab8a4d8364928811b66fcaf9da9
SHA256006513b9e4310066d4cb66a1ea11b6619c10e428f5a1ccc39eab92e1d487f442
SHA512a4ccf4de38da8d27dd065ef09b81a4bca708188c6102211faaa186ddd8f68b87381611da54cb6098758733c799e2a3450cb5cae66b58c29a4264d93f93a1edc2
-
Filesize
136B
MD58ea7ac72a10251ecfb42ef4a88bd330a
SHA1c30f6af73a42c0cc89bd20fe95f9159d6f0756c5
SHA25665e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9
SHA512a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0
-
Filesize
2.3MB
MD54c04147c386ba8792ac6a03069572a8a
SHA1dda67789fc1d0f2469ca95f01a5c81034853ca6a
SHA256c7739a1e940a282703d06eccda7110426d306f390e97fdbbd9df18472fd132cd
SHA512a8b5a0b878a9a7d30cb38feff814e1f4dce24d000158edc10a43ee9a89920bedf7adc92eb7e3913098b6aab7fbd0531f56fc09f508b5c2769992a94e55d153db
-
Filesize
896KB
MD59f9a8fea08bacf3a1d155567fead5940
SHA19d9ba8746c585446f53f442b800e1eb28a0df86a
SHA256a22f9d8fb953e4f6bc93cdcc8aa650a5a093f1dd400fdc501d5aa7b00bee0289
SHA512d41a048619373832c616d48f919595ac50dfbbd68095aec008b30adde91ceeeb86326c7d412ab20d937bab7096fb8165d3da8b4fdc40a03cc32da9ee3e9dc2a2
-
Filesize
128KB
MD50cfc533c46d2f160fc8d8483706228cf
SHA10d13ced09eeed5fc3879f418bda0410a742ab6a1
SHA256510a6af4547083718b32dc00d4711cfff2aec0e7b936d4199feaaf32a7d5d3a6
SHA51211e35867688e7814881981298b6f6948fceaf254d154f5429e5a82c43397b1894bd35fe7fb586b26e4272d8371c3b8e96c20c71ab05b9df3e851291444702a79
-
Filesize
982KB
MD5932249e68c2fed7b79ef6efee7658abd
SHA1200d52d9fe2cb400753406edd8303948cb8d4932
SHA2563fe16b0b50a34c159de7309c79a2fa0617a57a4d7b97da802f929b89ccc29041
SHA5129b4aca6b9da1ad6b9926d10953b7eed8c60f6afbc38af2d7f4ca90ea56b4b2210ef5295c52c64061da1082fd2a189d11018334503c4ca75d2a6569a083f62330
-
Filesize
896KB
MD54ece07a08273d0d0db84220926c3d32f
SHA1d90712e2e643311a963676e87f6afad0c421d895
SHA256d82c02350e5ca5ebe35d4349a16c3c9986aaecd8be71c05a00b1af09039a4cf3
SHA512fa010b4c3c0e6d38bb281b4541c0e8b124e05d2feaa6dc11cb6e9c1d85145d5885a5cd61c1bca283f2d9f30295b197343311306acc9d5393aef64793067cdcab
-
Filesize
836KB
MD5aeab40ed9a8e627ea7cefc1f5cf9bf7a
SHA15e2e8ca2881b9bf9edfa3c4fdcec6da1efa102d8
SHA256218cfc4073bab4eddf0de0804f96b204687311e20a9e97994bff54c9b0e01ee9
SHA512c0a67616fa01fdc351015212a718faf70da6612fbb3ec13da28dd7af9a507c56882fb7c3eea6fbc37d4d63b970157199d16d0756dbe3cb3bc2223e215cb104d8
-
Filesize
960KB
MD5c04202d27a40019b6a699c65c9a0ca4d
SHA19af641c8b836c4523ba780e09954369085e73e28
SHA256e8acfe0c4452c40ff32ba0fa7dac6b8374e9e895be2af35dde5d59e72945a35b
SHA51279c5716eaad6d216871478ee40adce25a762bffbaf0771a9057cad2e54a4df025035cb7d67f010026eba564790812c4659a261506caf361441d31661cf9aa71a
-
Filesize
704KB
MD5ceb1ee23d68e973e400b41e7324c71b6
SHA10ad5540864cf9bcbf52870ba72566625ca54e67a
SHA25666f2f5bd30986e28a4c43ed44264cc56f63bd7a3ecd6aeb5845ac7bcd724aeee
SHA51251ce4a101517339cb1f5c23fc953dde73f871cec2bde8ea5c9fad9376366d7b8aadaa8668ef2f7bf9d873e8817345e4e337a7a94c42c3ddf6a168377af060e9c
-
Filesize
640KB
MD51b7339cbcb5b756c15c05fe0cc6443f3
SHA1abdba01c4526a9bbbb7fd3853e09bce3cbb5287d
SHA2565fcf0fb116f77206758e3a669ec4fa52648fae431a5c2aa2d7ee69944142e019
SHA5127661b5e8413e74432a00089b1556b2f49e268b6b5c8cefd839cbe19074bffd138c18e8078627420f4082f579a9e3f8d02b199507ae36380b5375162a4d4ba439
-
Filesize
606KB
MD5585efec1bc1d4d916a4402c9875dff75
SHA1d209613666ccac9d0ddab29a3bc59aa00a0968fa
SHA2562f9984c591a5654434c53e8b4d0c5c187f1fd0bab95247d5c9bc1c0bd60e6232
SHA512b93163cba4601ed999a7a7d1887113792e846c36850c6d84f2d505727dc06524bb959469f9df12928769f4535dc6074a6b3599b788a4844353e466742ce1e770