73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72

Analysis

max time kernel
300s
max time network
302s
platform
windows10-2004_x64
resource
win10v2004-20240221-ja
resource tags

arch:x64arch:x86image:win10v2004-20240221-jalocale:ja-jpos:windows10-2004-x64systemwindows
submitted
23/02/2024, 19:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

batexe.exe
Size

9.4MB
MD5

cdc9eacffc6d2bf43153815043064427
SHA1

d05101f265f6ea87e18793ab0071f5c99edf363f
SHA256

73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
SHA512

fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
SSDEEP

196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv

Score

7^/10

upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1392040655-2056082574-619088944-1000\Control Panel\International\Geo\Nation	b2e.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1392040655-2056082574-619088944-1000\Control Panel\International\Geo\Nation	batexe.exe

Executes dropped EXE 2 IoCs

pid	Process
5732	b2e.exe
4844	cpuminer-sse2.exe

Loads dropped DLL 5 IoCs

pid	Process
4844	cpuminer-sse2.exe
4844	cpuminer-sse2.exe
4844	cpuminer-sse2.exe
4844	cpuminer-sse2.exe
4844	cpuminer-sse2.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5588-8-0x0000000000400000-0x000000000393A000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5588 wrote to memory of 5732	5588	batexe.exe	92
PID 5588 wrote to memory of 5732	5588	batexe.exe	92
PID 5588 wrote to memory of 5732	5588	batexe.exe	92
PID 5732 wrote to memory of 4672	5732	b2e.exe	93
PID 5732 wrote to memory of 4672	5732	b2e.exe	93
PID 5732 wrote to memory of 4672	5732	b2e.exe	93
PID 4672 wrote to memory of 4844	4672	cmd.exe	96
PID 4672 wrote to memory of 4844	4672	cmd.exe	96

C:\Users\Admin\AppData\Local\Temp\batexe.exe
"C:\Users\Admin\AppData\Local\Temp\batexe.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5588
- C:\Users\Admin\AppData\Local\Temp\540B.tmp\b2e.exe
  "C:\Users\Admin\AppData\Local\Temp\540B.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\540B.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5732
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\569C.tmp\batchfile.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4672
  - - C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe
      cpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 3
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\540B.tmp\b2e.exe

Filesize
1.7MB

MD5
4b0993a8402d203d54b8b8f303c43222

SHA1
cc8468848fc30befadd653684906bee50520f974

SHA256
036e3fbc807c9330130c0683f7327aca646c2c3d53c50d1123992314980bcf2e

SHA512
e606c52967da89c194ef854da22d98277949d071a178a87c3948375d05c090dc3ece27239fb8d429582fcd4d0c60913d052caf3c885065828f81506df0b4477e

Download Submit
C:\Users\Admin\AppData\Local\Temp\540B.tmp\b2e.exe

Filesize
1.1MB

MD5
f5ecee5947c07d97f6389751b91926b2

SHA1
b7b421b8b5fc64675c896bb554ebeec2a528b099

SHA256
8d81b43fba36fd00d7dd8d9a6813b258509f5f58234ba4eb6763ad8d8d5e0218

SHA512
f08baef426951a00d288ba86ba5e68d8c9b2d37768841ee137858a050b7d2e0d533d31152ca6953dc4dc1e403149aa1fa528d876cf8f760c4ec6e84e4261c0fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\540B.tmp\b2e.exe

Filesize
1.1MB

MD5
4f304b41d278002b12d18ff7b5d12908

SHA1
a5d311f567bac410002690a7e0991b4a38631d69

SHA256
7328c0c78663764f893ef864042b8e1408fa311cd9d70fdb8986ccd3bf4a83dc

SHA512
71dd32fb655930cdc7d48bfd107abe28c30c7df3dd66d9643861a7470cb72d00bd2b8dfe16de53343802c5c1d53a97f97bab41e9f2b460fb9fc86ab3d8ac51e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\569C.tmp\batchfile.bat

Filesize
136B

MD5
8ea7ac72a10251ecfb42ef4a88bd330a

SHA1
c30f6af73a42c0cc89bd20fe95f9159d6f0756c5

SHA256
65e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9

SHA512
a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0

Download Submit
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe

Filesize
1.8MB

MD5
138f771fae40171991ac047969e8c65a

SHA1
ac2ff6705eb922dc48c5a4f7e9bbce82923865fd

SHA256
e46603ab6665d419695c51c844febddff82a17f950137cd44a0289252950e9c2

SHA512
1f436b1694e31b590ced707685a205a69093915e2b41c2309a6dde325d8c442dbdfbfff077a6c017b52cec68ab5dbd7c3e585da31357bf5d2ce97805fd6bc891

Download Submit
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe

Filesize
1.4MB

MD5
6386552e7078588fdab3dcbb123c1dbe

SHA1
7ebcea87a42a52cf623c106a9992433fb7fae04c

SHA256
5c63b678310279ed4dad2b1f8b89cbb8a413c163b23145ee8ca3451877b54f95

SHA512
15a8a31dce0c0cec41a1c8778697bed82e0930060b476b0d1f3290ada166ecd10a60bfb0d1c72c234496cbd68477ee9ae2402403293d1c4e9a742804a26fdad1

Download Submit
C:\Users\Admin\AppData\Local\Temp\libcurl-4.dll

Filesize
836KB

MD5
aeab40ed9a8e627ea7cefc1f5cf9bf7a

SHA1
5e2e8ca2881b9bf9edfa3c4fdcec6da1efa102d8

SHA256
218cfc4073bab4eddf0de0804f96b204687311e20a9e97994bff54c9b0e01ee9

SHA512
c0a67616fa01fdc351015212a718faf70da6612fbb3ec13da28dd7af9a507c56882fb7c3eea6fbc37d4d63b970157199d16d0756dbe3cb3bc2223e215cb104d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll

Filesize
1.2MB

MD5
7cf672bee2afba2dcd0c031ff985958e

SHA1
6b82a205db080ffdcb4a4470fce85a14413f3217

SHA256
c82f84171b9246d1cac261100b2199789c96c37b03b375f33b2c72afab060b05

SHA512
3e90d1c1efe0200cb3cc7b51d04783a3cce8391faa6ce554cff8b23dac60be9f8e4f980a8ac005fd9dff8ea4bdcb02311f7649c5be28eb32dcc26417fc4090e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

Filesize
2.1MB

MD5
589f2b8655969f4a090cd0c42b7ad18d

SHA1
fefe8f339ea849dab6a652527f6e2a5371847f2b

SHA256
a0f6686ab42e088b8968e0e4671854d693b2f30d896dad5d225e694b80ff2595

SHA512
eb1bf309b842500484383a10f359a1a2268c04947cf16bc0bba8e793ddc20e698f55f544fffa461883cffd9b7e58dda044c39523e95fae8074509d6ed6c11d98

Download Submit
C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

Filesize
1.5MB

MD5
1c9a7ab6d494667442e6ebab7ee86a91

SHA1
56e3f89dd5d8d2fe7489b8764a070004da5ab29e

SHA256
85aaec64130145900c7951a3a602767dbd54d66301ca0b816d82744a0d4a1bf2

SHA512
9e1d1c4c8f1ce2e2124af48e1062ab5506e981218649c00f935a4fbc8a5e43dd73547237bcc6fb40d325337107f7e79a8088b9f289d4d8f8d4271d337bc0d2fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

Filesize
1.5MB

MD5
195f3050d87cadbdf8947539d1a82682

SHA1
152900aa1c7ea4caf1fc0908b9148d906259e675

SHA256
12c61d12e062afa70c82d4105c2d5e383c3f43b555051f0445f9db37b148e58c

SHA512
77330745f20ceb9cbee4d24224ce3fca62a09615b27443bcff87247e3a15045b28878b9a002bfca0d9e6b1daa1c9322b8363a2df0aea93a63ab29b44bdb9bb77

Download Submit
C:\Users\Admin\AppData\Local\Temp\libwinpthread-1.dll

Filesize
606KB

MD5
585efec1bc1d4d916a4402c9875dff75

SHA1
d209613666ccac9d0ddab29a3bc59aa00a0968fa

SHA256
2f9984c591a5654434c53e8b4d0c5c187f1fd0bab95247d5c9bc1c0bd60e6232

SHA512
b93163cba4601ed999a7a7d1887113792e846c36850c6d84f2d505727dc06524bb959469f9df12928769f4535dc6074a6b3599b788a4844353e466742ce1e770

Download Submit
memory/4844-43-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4844-54-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4844-104-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4844-45-0x0000000070800000-0x00000000708BC000-memory.dmp

Filesize
752KB

Download
memory/4844-44-0x0000000061440000-0x000000006156B000-memory.dmp

Filesize
1.2MB

Download
memory/4844-46-0x000000006D560000-0x000000006D5F8000-memory.dmp

Filesize
608KB

Download
memory/4844-47-0x0000000000F40000-0x00000000027F5000-memory.dmp

Filesize
24.7MB

Download
memory/4844-48-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4844-99-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4844-84-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4844-59-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4844-64-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4844-69-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4844-74-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4844-79-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/5588-8-0x0000000000400000-0x000000000393A000-memory.dmp

Filesize
53.2MB

Download
memory/5732-53-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/5732-9-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download