73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72

Analysis

max time kernel
292s
max time network
300s
platform
windows10-1703_x64
resource
win10-20240221-ja
resource tags

arch:x64arch:x86image:win10-20240221-jalocale:ja-jpos:windows10-1703-x64systemwindows
submitted
24/02/2024, 02:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

batexe.exe
Size

9.4MB
MD5

cdc9eacffc6d2bf43153815043064427
SHA1

d05101f265f6ea87e18793ab0071f5c99edf363f
SHA256

73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
SHA512

fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
SSDEEP

196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
5028	b2e.exe
212	cpuminer-sse2.exe

Loads dropped DLL 5 IoCs

pid	Process
212	cpuminer-sse2.exe
212	cpuminer-sse2.exe
212	cpuminer-sse2.exe
212	cpuminer-sse2.exe
212	cpuminer-sse2.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/872-5-0x0000000000400000-0x000000000393A000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 872 wrote to memory of 5028	872	batexe.exe	76
PID 872 wrote to memory of 5028	872	batexe.exe	76
PID 872 wrote to memory of 5028	872	batexe.exe	76
PID 5028 wrote to memory of 3004	5028	b2e.exe	77
PID 5028 wrote to memory of 3004	5028	b2e.exe	77
PID 5028 wrote to memory of 3004	5028	b2e.exe	77
PID 3004 wrote to memory of 212	3004	cmd.exe	80
PID 3004 wrote to memory of 212	3004	cmd.exe	80

C:\Users\Admin\AppData\Local\Temp\batexe.exe
"C:\Users\Admin\AppData\Local\Temp\batexe.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:872
- C:\Users\Admin\AppData\Local\Temp\852E.tmp\b2e.exe
  "C:\Users\Admin\AppData\Local\Temp\852E.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\852E.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5028
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\8712.tmp\batchfile.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3004
  - - C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe
      cpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 3
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\852E.tmp\b2e.exe

Filesize
384KB

MD5
3c0bec088d86bb620c8b42308d6098b3

SHA1
f486f2b80f76da0966fb3ccbc33fb96a4f890835

SHA256
1dfda8d76528af8231198a0ad4cbb09b05155c5e35f565ca78f81db527841d07

SHA512
bc4a62dacaf7990d21cc1bc04412acdd80659371fb4205065e0e917885076be8615d766f6640683642603c1c0e551efde0236acb3d6a772dc1af263cb1627414

Download Submit
C:\Users\Admin\AppData\Local\Temp\852E.tmp\b2e.exe

Filesize
359KB

MD5
b5dab2bb5e85144e78d39ae10e8e147e

SHA1
40b3143d62084bc76c267b61728523b8393456a4

SHA256
bb2362cb831238b0820e566d217a7b2a4dc9d706ed126112dbb9b3c6b51e0de1

SHA512
b33113edd839f73c9ab95c11dbcd1cfc5ed4c6fe2b0d4292008a27ef1fa893bcab8b308624e781befb90dc57704e3e8a657a5c950cb0a0f199b2b9d97a1aceeb

Download Submit
C:\Users\Admin\AppData\Local\Temp\8712.tmp\batchfile.bat

Filesize
136B

MD5
8ea7ac72a10251ecfb42ef4a88bd330a

SHA1
c30f6af73a42c0cc89bd20fe95f9159d6f0756c5

SHA256
65e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9

SHA512
a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0

Download Submit
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe

Filesize
2.0MB

MD5
ba3d3028904603ea06dd97779dc77eb2

SHA1
1eef267e68b874b84dced0a2b8de8ebbe0fd5d82

SHA256
930e175c6f07786df87f99995c43328dd30b42fb0b9491a177613efa23496340

SHA512
e8a0db55f237ee910864a5a5c234e82c44c30358fe122d36cb073a72a964a7bc3f327052bbcd28bcd7f729e30e6521aa0571c1a2aac90a7d28c94ffecd709b4f

Download Submit
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe

Filesize
1.8MB

MD5
4f55d1246f37798f72b02b3034a2b82e

SHA1
2ac59e456a0b870e8fd889f360edaa828442e2c0

SHA256
3c71380d489fdcc0c331964126a8905938ffaa66694c753b9596d0b8fb5553fc

SHA512
083dce889acf03f5e206772cb05840564163a945432c01523580d8b1bc1925df6fe79bee7545ae933bd33e45a115c5d4b2b408881cd7771527e6cddd10c38e69

Download Submit
C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

Filesize
1.5MB

MD5
ca19759dcc569a7893b03a4f86397089

SHA1
86540005f5422d5f736a65e1f0b76c30b434402e

SHA256
2aa344860132c11f98fb09ffaf68b79229e09fbea58a6360e5cff9d12dc9c262

SHA512
1566507032c9f794e7b4ad525819bb7eb25f7808a35a5d37b7ed6704bf8e61aaef2456227228820883ee6105378f9797acb9a7eff0f059e0bf1e15773b67c70b

Download Submit
\Users\Admin\AppData\Local\Temp\libcurl-4.dll

Filesize
836KB

MD5
aeab40ed9a8e627ea7cefc1f5cf9bf7a

SHA1
5e2e8ca2881b9bf9edfa3c4fdcec6da1efa102d8

SHA256
218cfc4073bab4eddf0de0804f96b204687311e20a9e97994bff54c9b0e01ee9

SHA512
c0a67616fa01fdc351015212a718faf70da6612fbb3ec13da28dd7af9a507c56882fb7c3eea6fbc37d4d63b970157199d16d0756dbe3cb3bc2223e215cb104d8

Download Submit
\Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll

Filesize
1.2MB

MD5
7cf672bee2afba2dcd0c031ff985958e

SHA1
6b82a205db080ffdcb4a4470fce85a14413f3217

SHA256
c82f84171b9246d1cac261100b2199789c96c37b03b375f33b2c72afab060b05

SHA512
3e90d1c1efe0200cb3cc7b51d04783a3cce8391faa6ce554cff8b23dac60be9f8e4f980a8ac005fd9dff8ea4bdcb02311f7649c5be28eb32dcc26417fc4090e5

Download Submit
\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

Filesize
990KB

MD5
74fdddbe1088c0bd0f436dfa6ea7dce9

SHA1
b5fdefc19bbdd6880bb6de1a912c429ba87a4296

SHA256
c18ad3e28ed5458b87ebd212bb97ee120944acd07793ba4533024b5a9ef71553

SHA512
4d2c9142600f9f9c75307c2da170436e204016ee8e7d945203bd600aa9f1564471d93ee0f77b32183f5933e70f195b7ddd4e626514a044276e4f27e0a3b62466

Download Submit
\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

Filesize
1.4MB

MD5
37e07dc2d5781857864497114005f8f1

SHA1
990d6b33e4e8165272e20a1a4e2d21cf8ec826f9

SHA256
c4ccecb9d223a1ca766bb7911aa93f601f54dd13bfc2efd59476d68b30395318

SHA512
046fb0bea74595aae5955618962efe7f2af1d4b257199dbe082f7d392eb1d26ebe90a6a58fc9943dcfbdcec7da6dfc98ea7a11d87aec858f27f657407ad8079b

Download Submit
\Users\Admin\AppData\Local\Temp\libwinpthread-1.dll

Filesize
606KB

MD5
585efec1bc1d4d916a4402c9875dff75

SHA1
d209613666ccac9d0ddab29a3bc59aa00a0968fa

SHA256
2f9984c591a5654434c53e8b4d0c5c187f1fd0bab95247d5c9bc1c0bd60e6232

SHA512
b93163cba4601ed999a7a7d1887113792e846c36850c6d84f2d505727dc06524bb959469f9df12928769f4535dc6074a6b3599b788a4844353e466742ce1e770

Download Submit
memory/212-42-0x0000000061440000-0x000000006156B000-memory.dmp

Filesize
1.2MB

Download
memory/212-56-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/212-43-0x000000005F420000-0x000000005F4B8000-memory.dmp

Filesize
608KB

Download
memory/212-101-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/212-41-0x0000000070800000-0x00000000708BC000-memory.dmp

Filesize
752KB

Download
memory/212-40-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/212-44-0x00000000010B0000-0x0000000002965000-memory.dmp

Filesize
24.7MB

Download
memory/212-86-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/212-51-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/212-81-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/212-61-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/212-66-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/212-71-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/212-76-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/872-5-0x0000000000400000-0x000000000393A000-memory.dmp

Filesize
53.2MB

Download
memory/5028-50-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/5028-6-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download