73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72

Analysis

max time kernel
300s
max time network
301s
platform
windows10-2004_x64
resource
win10v2004-20240221-ja
resource tags

arch:x64arch:x86image:win10v2004-20240221-jalocale:ja-jpos:windows10-2004-x64systemwindows
submitted
23/02/2024, 20:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

batexe.exe
Size

9.4MB
MD5

cdc9eacffc6d2bf43153815043064427
SHA1

d05101f265f6ea87e18793ab0071f5c99edf363f
SHA256

73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
SHA512

fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
SSDEEP

196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv

Score

7^/10

upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1392040655-2056082574-619088944-1000\Control Panel\International\Geo\Nation	b2e.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1392040655-2056082574-619088944-1000\Control Panel\International\Geo\Nation	batexe.exe

Executes dropped EXE 2 IoCs

pid	Process
4664	b2e.exe
4124	cpuminer-sse2.exe

Loads dropped DLL 5 IoCs

pid	Process
4124	cpuminer-sse2.exe
4124	cpuminer-sse2.exe
4124	cpuminer-sse2.exe
4124	cpuminer-sse2.exe
4124	cpuminer-sse2.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4100-9-0x0000000000400000-0x000000000393A000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4100 wrote to memory of 4664	4100	batexe.exe	91
PID 4100 wrote to memory of 4664	4100	batexe.exe	91
PID 4100 wrote to memory of 4664	4100	batexe.exe	91
PID 4664 wrote to memory of 228	4664	b2e.exe	93
PID 4664 wrote to memory of 228	4664	b2e.exe	93
PID 4664 wrote to memory of 228	4664	b2e.exe	93
PID 228 wrote to memory of 4124	228	cmd.exe	95
PID 228 wrote to memory of 4124	228	cmd.exe	95

C:\Users\Admin\AppData\Local\Temp\batexe.exe
"C:\Users\Admin\AppData\Local\Temp\batexe.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4100
- C:\Users\Admin\AppData\Local\Temp\542B.tmp\b2e.exe
  "C:\Users\Admin\AppData\Local\Temp\542B.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\542B.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4664
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\5738.tmp\batchfile.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:228
  - - C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe
      cpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 3
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\542B.tmp\b2e.exe

Filesize
13.1MB

MD5
4b07c1dd7a706492b4896449d44155af

SHA1
e9fe448646d2ed23d834c4fe52dfd0c138e49838

SHA256
c26387efc6970be0f107f2b533d0f7f2e8c348e0e8f7ba3ab0a65ee5a3262351

SHA512
4595d36766056fa455a63985ea6d2340ab4c5bf7c15cedd82784bdd4aba7d997eecf9a99d805fbaeec26b42b38bab545b7cfca5ce6be8c4d71dd1edfe94b9716

Download Submit
C:\Users\Admin\AppData\Local\Temp\542B.tmp\b2e.exe

Filesize
6.0MB

MD5
6df459525c010b5b50e0323c9bb54544

SHA1
8e1cae0475050d941fd33bf3ae9cd85862a1cc9c

SHA256
3cbb4eb4ca32f7532cd415942f2fb7a74b946f2a1575092f4b6b90614979051b

SHA512
a22616738ca25fb4a448b3b6cf3aab3a20a15d9cec40f7135576d8bab7e85869a5710d22ddfe40c9d12f030e19cf8b1db4a778859e59118193438ed986604a36

Download Submit
C:\Users\Admin\AppData\Local\Temp\542B.tmp\b2e.exe

Filesize
4.6MB

MD5
af6b146a2713521648d7e3276b6121e4

SHA1
14f8cb51d3cc6c32427b43bc98776ea21783821a

SHA256
de7a8553d7f099997b54e19029ee70b645641945584bdce3b631898c0f8448aa

SHA512
548be9c176701be3333c1d2851b886b6379fb1baced4600fce3179b838ff17f87ddc6a567c978c30dc8a1628b72ac3b0ea480d4519ecd0c05cfd0bd1cd4760e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\5738.tmp\batchfile.bat

Filesize
136B

MD5
8ea7ac72a10251ecfb42ef4a88bd330a

SHA1
c30f6af73a42c0cc89bd20fe95f9159d6f0756c5

SHA256
65e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9

SHA512
a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0

Download Submit
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe

Filesize
2.0MB

MD5
9666f21e277982c0c69cab7315679d3f

SHA1
551c6da5c2c71143a488cec797f4be4c2fe46d8e

SHA256
191de14b85adb89b02d114edbe0ae5ccebe11d791eed15ff43852f6b02ba2ba5

SHA512
7fb0156ab343ea3f46a82f2b415ee34b179879467350309c264ef7425c5a7da1461864156ae4dac30a4854582e01d376d5c08570231198e1e257d915f9f7938c

Download Submit
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe

Filesize
2.1MB

MD5
6cbd15b34e837d5648e1d8432eb15abd

SHA1
3a7dc19c76721b3676bc1c0a75b3e7b1d86dd6a8

SHA256
da0f0bc7e29a6fcdad70dc4379c55ff6f11191177cb8d641e641a45e06c91815

SHA512
569d98c466d67bbd1a9fc1c7375932a4bdc663bf1f8eb56554fc694be5898934074d61989ed57a0f9d7f58ac2843195db32ebdd4e4e248019d7548455b243a61

Download Submit
C:\Users\Admin\AppData\Local\Temp\libcurl-4.dll

Filesize
836KB

MD5
aeab40ed9a8e627ea7cefc1f5cf9bf7a

SHA1
5e2e8ca2881b9bf9edfa3c4fdcec6da1efa102d8

SHA256
218cfc4073bab4eddf0de0804f96b204687311e20a9e97994bff54c9b0e01ee9

SHA512
c0a67616fa01fdc351015212a718faf70da6612fbb3ec13da28dd7af9a507c56882fb7c3eea6fbc37d4d63b970157199d16d0756dbe3cb3bc2223e215cb104d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll

Filesize
1.2MB

MD5
7cf672bee2afba2dcd0c031ff985958e

SHA1
6b82a205db080ffdcb4a4470fce85a14413f3217

SHA256
c82f84171b9246d1cac261100b2199789c96c37b03b375f33b2c72afab060b05

SHA512
3e90d1c1efe0200cb3cc7b51d04783a3cce8391faa6ce554cff8b23dac60be9f8e4f980a8ac005fd9dff8ea4bdcb02311f7649c5be28eb32dcc26417fc4090e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

Filesize
1.8MB

MD5
7ea30610f692a6b4f62bea94678a06d0

SHA1
73a04b6afbd93b9569e1de7154a4dc9f464de57a

SHA256
e454629329e129922d16403f88cbbdffd310073d2e93c3e5b7f92a02110d598c

SHA512
8e293bde89fa9f12a1d14626751ed2054a19b5bb032059eec38b1764b646bc79a297e02f1b746832c44b407434f1a47dc7df74e2d95667765f9dc2af060d9c54

Download Submit
C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

Filesize
2.4MB

MD5
88a7046d5b5657039b86f5a3c9930e05

SHA1
9f19df7bff401873173d333c27298fe33ab4602a

SHA256
ed23f477dd70242b111c7a82c23c6753a7764aa0e76224ba2c735a858c6ef3f7

SHA512
7ade6b3f4ec920a9ae459069b3429afa1300de4c16f60b5fe3c91cdf0198cc444e80de4423a96fc7f3d793470a1aafef095852ee766965d3f44f533f5d5434f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

Filesize
2.1MB

MD5
48abd0819f3ba3ddc85e3316fda441a3

SHA1
92ac53e2779f39f2f4a44705fb9fee92cde08820

SHA256
b9433b9bd10b323ef76536e9bd10838a409051d2ce0694113f79a4764ff48f6c

SHA512
88ed6d29d15f03f8c70aa7bf6b6ab726a1ecab77ed1e75b64ed8edc4d060999ba210327cd0e2d21495ef728cc55933077ac627f942b2fdefaf9154a46a110d56

Download Submit
C:\Users\Admin\AppData\Local\Temp\libwinpthread-1.dll

Filesize
606KB

MD5
585efec1bc1d4d916a4402c9875dff75

SHA1
d209613666ccac9d0ddab29a3bc59aa00a0968fa

SHA256
2f9984c591a5654434c53e8b4d0c5c187f1fd0bab95247d5c9bc1c0bd60e6232

SHA512
b93163cba4601ed999a7a7d1887113792e846c36850c6d84f2d505727dc06524bb959469f9df12928769f4535dc6074a6b3599b788a4844353e466742ce1e770

Download Submit
memory/4100-9-0x0000000000400000-0x000000000393A000-memory.dmp

Filesize
53.2MB

Download
memory/4124-43-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4124-59-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4124-44-0x0000000061440000-0x000000006156B000-memory.dmp

Filesize
1.2MB

Download
memory/4124-45-0x0000000070800000-0x00000000708BC000-memory.dmp

Filesize
752KB

Download
memory/4124-46-0x000000006E470000-0x000000006E508000-memory.dmp

Filesize
608KB

Download
memory/4124-47-0x00000000010E0000-0x0000000002995000-memory.dmp

Filesize
24.7MB

Download
memory/4124-48-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4124-104-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4124-54-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4124-94-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4124-64-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4124-69-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4124-74-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4124-84-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4124-89-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4664-8-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/4664-53-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download