d52b5275d5876aa7de35a894c4dbbb3fc254ba7fde72da94ace7118792cebb2c

Resubmissions

16-07-2023 05:08

230716-fsz7bade5s 7

16-07-2023 05:05

230716-fq1p3ade41 7

Analysis

max time kernel
142s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
16-07-2023 05:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

setup/StartAllBack_3.6.3_setup.exe
Size

1.7MB
MD5

970b9b636f0bdca2d19ebcfd8d214a94
SHA1

d675c14b63f7f619bb05b89bb0ab3c518d11c2e0
SHA256

213c6bdf86674024dbbe5cdf3d84068b4ba9faff8ad484452deddfc149fd6fe2
SHA512

4421aa6dc4ac98c49f248e61782a30825f337c138b705873d13bab4afd7197f65f4d8d26fe0ebe28bffb9a3301acf9da21d7311d182bfdc818983ae07353fef5
SSDEEP

49152:IBLK+0xTePUMne6eYuo5VPLWxENnpYB9hJEoReZ+:IBMeeORVPaQnpQ9hG1Z+

Score

5^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Control Panel\International\Geo\Nation	StartAllBack_3.6.3_setup.exe

Executes dropped EXE 1 IoCs

pid	Process
4640	StartAllBackCfg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4640	StartAllBackCfg.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4196 wrote to memory of 4640	4196	StartAllBack_3.6.3_setup.exe	86
PID 4196 wrote to memory of 4640	4196	StartAllBack_3.6.3_setup.exe	86

C:\Users\Admin\AppData\Local\Temp\setup\StartAllBack_3.6.3_setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup\StartAllBack_3.6.3_setup.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4196
- C:\Users\Admin\AppData\Local\Temp\SIBSFX.74A75064\StartAllBackCfg.exe
  "C:\Users\Admin\AppData\Local\Temp\SIBSFX.74A75064\StartAllBackCfg.exe" /install
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  PID:4640

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\SIBSFX.74A75064\StartAllBackCfg.exe

Filesize
3.2MB

MD5
2bf7044e92a8af4a203debc23e8b40bd

SHA1
93897797171f568e6eb383be071bf8c718e901d0

SHA256
f50e513535ab9017267074b7b5019e529938fe62bf40674a87c69c1537f22a12

SHA512
df7abd33cf9ded9342c45211dd92043e976938289cdcc87f6ba59c258816cf6e7978209ac884e60bdd520124dd224d4216d14a837d0751c26e0889a84ad33fcd

Download Submit
C:\Users\Admin\AppData\Local\Temp\SIBSFX.74A75064\StartAllBackCfg.exe

Filesize
3.2MB

MD5
2bf7044e92a8af4a203debc23e8b40bd

SHA1
93897797171f568e6eb383be071bf8c718e901d0

SHA256
f50e513535ab9017267074b7b5019e529938fe62bf40674a87c69c1537f22a12

SHA512
df7abd33cf9ded9342c45211dd92043e976938289cdcc87f6ba59c258816cf6e7978209ac884e60bdd520124dd224d4216d14a837d0751c26e0889a84ad33fcd

Download Submit
C:\Users\Admin\AppData\Local\Temp\SIBSFX.74A75064\StartAllBackX64.dll

Filesize
778KB

MD5
0decbbd5cb84b30fadc4ccc70c9ab617

SHA1
285ea3113dd88600df2fd373062a1931921150a9

SHA256
0a6079a055f13276fd432fbcc3256935c96474c43221ef11d66e3f3855e9f0ae

SHA512
303c118fc43c95cac60aa85606bf34ce298011f8c01538e075dd530d77d9acf7039e0045f14ddc34798620702f1b255b4b0d7d98ae495ebd518310686644241e

Download Submit
memory/4640-197-0x0000000002330000-0x0000000002331000-memory.dmp

Filesize
4KB

Download
memory/4640-199-0x0000000000400000-0x0000000000744000-memory.dmp

Filesize
3.3MB

Download