73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72

Analysis

max time kernel
295s
max time network
310s
platform
windows10-2004_x64
resource
win10v2004-20240221-ja
resource tags

arch:x64arch:x86image:win10v2004-20240221-jalocale:ja-jpos:windows10-2004-x64systemwindows
submitted
24/02/2024, 14:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

batexe.exe
Size

9.4MB
MD5

cdc9eacffc6d2bf43153815043064427
SHA1

d05101f265f6ea87e18793ab0071f5c99edf363f
SHA256

73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
SHA512

fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
SSDEEP

196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv

Score

7^/10

upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000\Control Panel\International\Geo\Nation	batexe.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000\Control Panel\International\Geo\Nation	b2e.exe

Executes dropped EXE 2 IoCs

pid	Process
4628	b2e.exe
1812	cpuminer-sse2.exe

Loads dropped DLL 5 IoCs

pid	Process
1812	cpuminer-sse2.exe
1812	cpuminer-sse2.exe
1812	cpuminer-sse2.exe
1812	cpuminer-sse2.exe
1812	cpuminer-sse2.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3952-9-0x0000000000400000-0x000000000393A000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3952 wrote to memory of 4628	3952	batexe.exe	87
PID 3952 wrote to memory of 4628	3952	batexe.exe	87
PID 3952 wrote to memory of 4628	3952	batexe.exe	87
PID 4628 wrote to memory of 3616	4628	b2e.exe	88
PID 4628 wrote to memory of 3616	4628	b2e.exe	88
PID 4628 wrote to memory of 3616	4628	b2e.exe	88
PID 3616 wrote to memory of 1812	3616	cmd.exe	91
PID 3616 wrote to memory of 1812	3616	cmd.exe	91

C:\Users\Admin\AppData\Local\Temp\batexe.exe
"C:\Users\Admin\AppData\Local\Temp\batexe.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3952
- C:\Users\Admin\AppData\Local\Temp\84FF.tmp\b2e.exe
  "C:\Users\Admin\AppData\Local\Temp\84FF.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\84FF.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4628
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\9961.tmp\batchfile.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3616
  - - C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe
      cpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 3
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\84FF.tmp\b2e.exe

Filesize
17.4MB

MD5
e6f9b8883b5b66675c5c913409332bc2

SHA1
5c9e8e4fb059976bfa903d80a47609954c63bf9d

SHA256
222ab47e40b79611af56f57425ce1565430a6d8a15280c6d116c842aa6c303d6

SHA512
c8f68ae529ac32ba8ee134573fa71a4cb810cc062c6b15be3c56454cf4bda44424017687413ff244aadb77f6eb1f5b9f9f475b0009e2ab9db26b124983f49642

Download Submit
C:\Users\Admin\AppData\Local\Temp\84FF.tmp\b2e.exe

Filesize
5.8MB

MD5
67881f7d584c0462571ac5d89171b3a5

SHA1
5816530d0d89a96aebee4c6cd666c49eb7bc29c3

SHA256
f9381bfc779f756726f4167dffd1da689e481356849ad061530990a6084a75f4

SHA512
c64d07639489b44513950cb7de0f63cce15880845130cd7186e62bb279041cc01a9d28607909423dbba37ac29537052ab940dedf0a4b1dfb9182f43947d4817f

Download Submit
C:\Users\Admin\AppData\Local\Temp\84FF.tmp\b2e.exe

Filesize
8.4MB

MD5
ba4fbe613508bfe8ac6238466ba6b2c9

SHA1
877f1b18a118f5d5c6450c721e9843c4ae5fea31

SHA256
f6fdb67a67aafccbeeb8742f0c7e8cf003662871a07d7fd982bdf82a045eba03

SHA512
323bc06a632d2bd64214907360208c903760dd6924821ffc434385d667cd1618dd75343d44335d66cdf9ebd5f115c2350a0b2e01412d35ef5355a66b1b4ec37d

Download Submit
C:\Users\Admin\AppData\Local\Temp\9961.tmp\batchfile.bat

Filesize
136B

MD5
8ea7ac72a10251ecfb42ef4a88bd330a

SHA1
c30f6af73a42c0cc89bd20fe95f9159d6f0756c5

SHA256
65e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9

SHA512
a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0

Download Submit
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe

Filesize
671KB

MD5
2459f0e6409545e01a240f8ce4843e2a

SHA1
c067ca42fffed779315c3254104e9abfce5ccece

SHA256
4dcc1a491958e6858fe8f165f5d620ad4d14c05ebfacdaa3480c07acca7f5015

SHA512
70c433ce64dc05f621becfc3280a998be98e564d35b239793b00f595e1019a17dd9238645e8a1a7288a3226fb9722f5a759ccdab14b769d06a58134d849128e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe

Filesize
768KB

MD5
7511ee8c66d17030a4f24226caa425c7

SHA1
aa5bb6b2306f01ac82133f54ec36ca2491fb1911

SHA256
e9ad1acfa96a3be152713809498617dacb74878ed3ac3ed4e5b1455cf1fa5ac5

SHA512
4838197b397552aa7c22ca54d27ec420df0629689e111c40068480f5e37879bfbc89c84245ae8b0a6b4a16ee7d75197403153151eccbbe468b252f508e8466ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\libcurl-4.dll

Filesize
628KB

MD5
f0fcb1b3398dfcc3aab4b7b3cbf3b8ca

SHA1
187587fdcffd96ff6ebaf7f3e8e64add915619d5

SHA256
a5978604a89622e04caf26bb4642c9ae0f7c941a270cd760778f076dc2df45f8

SHA512
6273e1b537e7f235fbe2337b9e139bb562fbfb484dc12addbb6ae0b918ee8f1d86e29ad7884d00e03031ac6a7d61233f4752fd8acdf65a6ad82e541761dc1cdc

Download Submit
C:\Users\Admin\AppData\Local\Temp\libcurl-4.dll

Filesize
512KB

MD5
a5993c0dd7587f1716037dcfe1f63091

SHA1
9a4d23ce36f5fc5791692b47d977c0bf92842879

SHA256
568cec1e1bdccf401232a78c8ecf2081fdaea221f0a7c777a69ec61307cca3e3

SHA512
c5457590162dc1a0fd6b179ba94f19e6265e2ca226ea1ec553358f568690bbc158335ee92c297ce699b2928d44702733269f82640d86bb499c1981a5903afc12

Download Submit
C:\Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll

Filesize
960KB

MD5
c04202d27a40019b6a699c65c9a0ca4d

SHA1
9af641c8b836c4523ba780e09954369085e73e28

SHA256
e8acfe0c4452c40ff32ba0fa7dac6b8374e9e895be2af35dde5d59e72945a35b

SHA512
79c5716eaad6d216871478ee40adce25a762bffbaf0771a9057cad2e54a4df025035cb7d67f010026eba564790812c4659a261506caf361441d31661cf9aa71a

Download Submit
C:\Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll

Filesize
256KB

MD5
f8edb8dd2fb15f1887ace09587589dd4

SHA1
cbf7cbfefc0215d9500a98d9064deb9e86787152

SHA256
0465270288d69a0ec9beb7114707bed76756c14148293237d0d35423abdfc67b

SHA512
aa993112953225280c0bedb1ebd8288298b9c22a6a884a952ba60e48cbd21c4ce60724b7adc961a0528d7c569596e3420fec2670fc47c3eb6c00c691e0378abc

Download Submit
C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

Filesize
640KB

MD5
1b7339cbcb5b756c15c05fe0cc6443f3

SHA1
abdba01c4526a9bbbb7fd3853e09bce3cbb5287d

SHA256
5fcf0fb116f77206758e3a669ec4fa52648fae431a5c2aa2d7ee69944142e019

SHA512
7661b5e8413e74432a00089b1556b2f49e268b6b5c8cefd839cbe19074bffd138c18e8078627420f4082f579a9e3f8d02b199507ae36380b5375162a4d4ba439

Download Submit
C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

Filesize
2.6MB

MD5
900f039078ba5e6be919a20f3130cf91

SHA1
003b83828c9bc2b87dfb187a86fffa2ca05a9526

SHA256
bd96a1af79a360acb15a9f64fcd06bdc6ae2e6ee3d72bc7769630ef53a2bf61c

SHA512
26f10676edc07c00cb5dff8edd039ecdb0976a6bfdb8e152b9b82a1f5f7ed7da8afddf498c93d27214b2755ce60ea33005261cf540f9759bf4437aee2d63c22c

Download Submit
C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

Filesize
2.2MB

MD5
5cb25295334cb63e6b4d195522898229

SHA1
8fc99be1a298e52a48c09274aab7ea913058135e

SHA256
c0c6b1386533fe75d9d5bcaec3c99a788d4ad4e4f6e12650bba07581a94497a7

SHA512
fa957785980889ae7417bfd529197175049fd34d16706bc666e923ea1e7b04743e3c1f9f624f3458b5a5228c31267120453fc4e9729ec16ba9fc8973ed55d6ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\libwinpthread-1.dll

Filesize
384KB

MD5
eec15153c344f43f1919cb379b9ee2f9

SHA1
3e4a09390ac885ea2797209603bcfa1ec6ff0cc6

SHA256
4e4d7ecae87e8e656c61af89ef17146baf33fbf09ffbde6ae971d04e8e8f9222

SHA512
7cdf3552341d14979838f8fedf9ac63482152f193ab8f7e0af281ec50b2a43312d78c0e22e79989818c5041538fa69769350e1e6cf0789a165be1eb11ee29908

Download Submit
C:\Users\Admin\AppData\Local\Temp\libwinpthread-1.dll

Filesize
256KB

MD5
eca0c37eee65c31b869788d5d0bf00cd

SHA1
33a5c0cd2f0a7296a5c0169699ed8e065b57e5e8

SHA256
1d2b7bd4ddd99d627d5111252baadf028dc9910cf414892867502e5951de962e

SHA512
5f302da7772fca0a6d03ffd8732850f526acf5fcc33e189d2d906a33101454d970d5cca2f829a006d15c4a857341d72c7876cb2e7af84ada4f158695aba5a4dc

Download Submit
memory/1812-47-0x00000000010D0000-0x0000000002985000-memory.dmp

Filesize
24.7MB

Download
memory/1812-79-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/1812-43-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/1812-44-0x0000000070800000-0x00000000708BC000-memory.dmp

Filesize
752KB

Download
memory/1812-45-0x0000000061440000-0x000000006156B000-memory.dmp

Filesize
1.2MB

Download
memory/1812-46-0x000000006A2D0000-0x000000006A368000-memory.dmp

Filesize
608KB

Download
memory/1812-104-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/1812-48-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/1812-53-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/1812-99-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/1812-64-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/1812-69-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/1812-74-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/1812-94-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/3952-9-0x0000000000400000-0x000000000393A000-memory.dmp

Filesize
53.2MB

Download
memory/4628-7-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/4628-58-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download