Analysis

  • max time kernel
    294s
  • max time network
    300s
  • platform
    windows10-1703_x64
  • resource
    win10-20240221-ja
  • resource tags

    arch:x64arch:x86image:win10-20240221-jalocale:ja-jpos:windows10-1703-x64systemwindows
  • submitted
    24/02/2024, 04:08

General

  • Target

    batexe.exe

  • Size

    9.4MB

  • MD5

    cdc9eacffc6d2bf43153815043064427

  • SHA1

    d05101f265f6ea87e18793ab0071f5c99edf363f

  • SHA256

    73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72

  • SHA512

    fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6

  • SSDEEP

    196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv

Score
7/10
upx

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 5 IoCs
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\batexe.exe
    "C:\Users\Admin\AppData\Local\Temp\batexe.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:192
    • C:\Users\Admin\AppData\Local\Temp\7A70.tmp\b2e.exe
      "C:\Users\Admin\AppData\Local\Temp\7A70.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\7A70.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2404
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7CF0.tmp\batchfile.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3544
        • C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe
          cpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 3
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2232

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\7A70.tmp\b2e.exe

    Filesize

    2.4MB

    MD5

    593dd135058709ac82125729a00adeb9

    SHA1

    3746be39e33b3cdc767922d3423244e3e6f96c9f

    SHA256

    f694e070421e15f273fbe4a6db87353edebbb895f5760182b2237e446767e065

    SHA512

    66b257507c6aa9d85e6ab1782dfc0dece807d34ef7fd75a070642baa4c0a2b8230c2f3da3333708508a0aad06f6dc80f2b3f9f06782e815c5cc2c92782d18cb4

  • C:\Users\Admin\AppData\Local\Temp\7A70.tmp\b2e.exe

    Filesize

    1.7MB

    MD5

    aa471fbc0dfab0f8778d3407e8cb8e5b

    SHA1

    49ab339bbb0e81adc5ab152ebe5845fe8c801d0c

    SHA256

    0c0ca371d9b3e35402cba34f2f114df8706c70454f995c00f11e59f0126a935d

    SHA512

    c65bbb51adb517216c3cd778302f3b06d7fe8e27205680025c49a091918b8861117471f39f68f029a9ab70c9a1792dd9c52e94f52fa789456d6350ce3954b41f

  • C:\Users\Admin\AppData\Local\Temp\7CF0.tmp\batchfile.bat

    Filesize

    136B

    MD5

    8ea7ac72a10251ecfb42ef4a88bd330a

    SHA1

    c30f6af73a42c0cc89bd20fe95f9159d6f0756c5

    SHA256

    65e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9

    SHA512

    a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0

  • C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe

    Filesize

    99KB

    MD5

    71f3b472b9b04ebfcc7dfd35a2d1a983

    SHA1

    8f16fc00b3f90e4ce8db4b29cc4aefc69788e42b

    SHA256

    c7dffa9477787d158176dd30b7d06ad281aab14aec2479e4ac2d563322753add

    SHA512

    f8dd65c6b6fc8f50ff01e80a04cd674def8d7ba0887ea99026b04837a932ecb7218010dbb11ccab40af2403a5a85a331760bf22da443e3bf52a8223b8f6546f8

  • C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe

    Filesize

    113KB

    MD5

    5869ae6c2874d91c6eb3f3cd79bc670f

    SHA1

    172deba6018b9da60747a0a8541f7ae1808dae03

    SHA256

    60d9f8434055de0dce9f3648c7031c8190ad761e77fdf0c9c8fe6c5f4f8349dd

    SHA512

    b6473d7a43692d7e9ec984d61d021e46ebdb9595442f4635ac61805507d781583b7153d1eb85234932db9e602131ef6701886a03dda2082c9353edac97cac612

  • C:\Users\Admin\AppData\Local\Temp\libcurl-4.dll

    Filesize

    138KB

    MD5

    ab314745f1ba3c11fca2ae0fc813474c

    SHA1

    338a6b0af19af43397e958587a30ebfd159024a2

    SHA256

    d17a34f98dd12fd127b1a99c22f33f0f686c321d169c27bc8c45083a1c283455

    SHA512

    059ff93587d55e02a44b8a116708ed064b8c653dc1dadb46a80cf771ac84693a27fc48774f4f95d510622989a6572f383d6ebe46f0d09a7c9890ac3abfe2ea3c

  • C:\Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll

    Filesize

    81KB

    MD5

    52f4318b563823855e60ae911ebd42cc

    SHA1

    66272d08937862008b12e7dd7b650d2580293268

    SHA256

    0ceb7efaec5f2fe2e645c3f7a9cef86596c05456c48a6fe602a20b1d6223aba7

    SHA512

    1105ba912f91a147bc4fa419e58025a693e34e5152f7ce1c7f270548930b4615041c05f397645744b32da87708e4fefd23473a61c9de815f8bd5df81e3a94042

  • C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

    Filesize

    147KB

    MD5

    fba31f6e2a54e01ff73cb0845cb53e62

    SHA1

    4834587b38fe1db43fe487a1caa2a4a2c128d5ce

    SHA256

    6e7e607cbf25f6f875ae5a42f7273d60f4dfc397f918a2fa4f7ebe9d6b528849

    SHA512

    24a8f90f5ae49a407db7a8a2cb7d687a585201c9eb89a46c2266bb0bfca14c56880986d375f3a9c7e2a0654974854ab20dc3f2ffb7bb5142e26988f0a5314344

  • C:\Users\Admin\AppData\Local\Temp\libwinpthread-1.dll

    Filesize

    129KB

    MD5

    ca49da3a9ce127263c96adec96ea72ab

    SHA1

    3242185e1804ec290ce3e82666f59f7e3f90ab82

    SHA256

    32bacc4f05b06ddf4f567883328d3e5367a7ca25b472d8fc1f60eb36fdff36ba

    SHA512

    97f6dc33c729abbf9db262803ef8f22e598dbaa8fb1f930d07dc3367b3e6b577a8ace0dd89a7f680d60aae05b1df23b74ca6d7fb16e340bdf17173b72ffa3293

  • \Users\Admin\AppData\Local\Temp\libcurl-4.dll

    Filesize

    101KB

    MD5

    b518f4ed42f5fab5fbcf9dd8fe347ac3

    SHA1

    fcb4e3e7cc11a46b04b94a65726619aad703ea9d

    SHA256

    2b0cfba989472becc02e28479553e5fbadc83ed5ea7052389253df933298c4db

    SHA512

    4688dd5fd7dce4f496ecc2c46087ca46d55c642d6cb04d86e3da015c003ec1c1354eafe843e8a71169532b3c423d0592c79f7e741a45cd94ee4de1c7bb979cfc

  • \Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll

    Filesize

    93KB

    MD5

    1f8372e06b3e8b8319cf53ddf93f9fcc

    SHA1

    c237ec621968f7d377b87a8230907a9c126e81d0

    SHA256

    562bb3c8d15614d0ef19c507611f86a972664822b03e312ed02111aaa7bdbd11

    SHA512

    53245d363d5018d9ba722832e620d338ffc641db78b21b82c8260272441b82cef13d38828bb34a7be1a4fffdb498b90038d7223ee2fd79280acba7cd8c88a5a4

  • \Users\Admin\AppData\Local\Temp\libstdc++-6.dll

    Filesize

    72KB

    MD5

    261fa530a7ee057cf821195b5a7e5db5

    SHA1

    0e63557404772417e19b0c9889a9643fa3499337

    SHA256

    2bce73bdd3f9556573ed30e7aa069388b7eb4336cafbe4271a24797c031202a0

    SHA512

    d481934843254fe37183dbbe1ca3e168d7cf7eb4ff57987b2a286b3c4623416d755ccf25ae45d555bef152a0ba7753ecb3746a46b2f52ac5f40384c22fc40cd0

  • \Users\Admin\AppData\Local\Temp\libstdc++-6.dll

    Filesize

    66KB

    MD5

    04e89c46e60eefac12569fe22c2df25d

    SHA1

    3d99c26f5d86e630b3940a85e74d9b9722c54735

    SHA256

    9a413e3d8f2271b7a7660221a398bcfbedd1053b156ef280d9c653c3f3c93478

    SHA512

    a39e7c0bcdef16297a8f7f759e75dd3c62851f19f846c96f68663d919c5f68171e165bf33d11eda7481994d8259ccf5c791b241a93d6854ffbac65143b29c823

  • \Users\Admin\AppData\Local\Temp\libwinpthread-1.dll

    Filesize

    150KB

    MD5

    b9618aefb298d1724fa0d574d28e2013

    SHA1

    d65dab47ce86ff3f859dd284f9b3758930d13086

    SHA256

    e06d48cd4961d5bb760cc3e8e6d03e7ce55f13ceecac0aa858423e523c229a5a

    SHA512

    7cc706895d2a0afc1bda34a1da25046c2e8f2acfc06626f173645a9387b42f5113304ecdda88530599dcdc22a934f76c8c841b35110b3ca8e1fb9f1f8a4a572e

  • memory/192-5-0x0000000000400000-0x000000000393A000-memory.dmp

    Filesize

    53.2MB

  • memory/2232-45-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/2232-61-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/2232-41-0x0000000070800000-0x00000000708BC000-memory.dmp

    Filesize

    752KB

  • memory/2232-42-0x0000000061440000-0x000000006156B000-memory.dmp

    Filesize

    1.2MB

  • memory/2232-43-0x0000000064A00000-0x0000000064A98000-memory.dmp

    Filesize

    608KB

  • memory/2232-44-0x0000000001080000-0x0000000002935000-memory.dmp

    Filesize

    24.7MB

  • memory/2232-96-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/2232-91-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/2232-51-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/2232-56-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/2232-40-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/2232-66-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/2232-76-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/2232-81-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/2404-50-0x0000000000400000-0x0000000000405000-memory.dmp

    Filesize

    20KB

  • memory/2404-4-0x0000000000400000-0x0000000000405000-memory.dmp

    Filesize

    20KB