f61b7c0bc5f0249a9b5c79cc8fab01f5e3aece1697ab29252c84d1b7f4e6e218

Analysis

user interaction
yes
max time kernel
180s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 19:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
StartAllBack_3.9.24_setup.exe
Size 2.0MB
Sample260805-ye6faavdlb
SHA256 f61b7c0bc5f0249a9b5c79cc8fab01f5e3aece1697ab29252c84d1b7f4e6e218
MD5 052acae242fa45bcfe7a590e8e667690
SHA1 17b62ff3811b469936481e1c01f3f94d4bb53196
SHA512 977ad07be9c788024c0a1cf28896d08a65fa5b32fefc743cbce9122861fcd3bee33f24a10b440bd21f1b7af82cc14ffb79003d87625993733a3460ee518d45f8
SSDEEP 49152:ExTtBKgARhKRMpbOIibSsHPfgMBQcqDKQakX:E3Kz7kM/MFvfg4EDFvX
TLSH
T1E5A523D3C32E8EF8F47D19308446673E429794EE73E342E2515F6D242F8461E2AF66A1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2332	StartAllBackCfg.exe

Loads dropped DLL 1 IoCs

pid	Process
2332	StartAllBackCfg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2332	StartAllBackCfg.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1280 wrote to memory of 2332	1280	StartAllBack_3.9.24_setup.exe	91

C:\Users\Admin\AppData\Local\Temp\StartAllBack_3.9.24_setup.exe
"C:\Users\Admin\AppData\Local\Temp\StartAllBack_3.9.24_setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1280
- C:\Users\Admin\AppData\Local\Temp\SIBSFX.93D5B500\StartAllBackCfg.exe
  "C:\Users\Admin\AppData\Local\Temp\SIBSFX.93D5B500\StartAllBackCfg.exe" /install
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of FindShellTrayWindow
  PID:2332

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartAllBackCfg.exe

Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.93D5B500\StartAllBackCfg.exe
Size 3.4MB
SHA256 cc77050eb8e627e7748c8e14dffb20d8e59e4a414c6842ca2c14826f62c535a6
MD5 cba5bdaa2b02546e7424b97a2a10ac94
SHA1 4753b50e1f2ad16087e24e98053a2b7391698717
SHA512 711edcc394aa1d618d467528fab1d9e0c8576a4d28d49bbb785ce1301649947fb9efb1ad30e3282be695d28d366b19c2b2652b6dfb39055bdf26da9fb8acd0bb
SSDEEP 24576:2NagaJo1yfyuH9h36hoyGSGmhhAUg682B4emrQ7EF+K:2cgaJRTH9hKhoyHhX8i4Pz
TLSH
T199F5A463A7F68128F1BB9B75D9B287604A33BC656FB6C1DF1281014D09B4AC08DB5B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartAllBackX64.dll

Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.93D5B500\StartAllBackX64.dll
Size 1.0MB
SHA256 f7649f12cb34886a8735f5f7f8c974de3eed3386d777761c6f779ba4e97b94b5
MD5 c6fced87905faa8783375cef35e43c5f
SHA1 b6cb4f8171223a7a79e7beb532cb9997d4f7c2cf
SHA512 c362fd5cb81c787cd556c0f39da635761bb7d0e0d81fa52d9dcb0524e41c60802f31d8f4cd815ca4b684bc4485fc0288387ea520dc9fc3a3b7631edcacd97f0c
SSDEEP 24576:aPIHP2gdsGqycTCvGu9c0Zy6+qIQv3OI1:2Iv2gumMCeuiomwn1
TLSH
T107253A0673F80198F1B79679DEB79A17DA72B8922E30D60F1190864D2F33771993A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2332-62-0x0000000002430000-0x0000000002431000-memory.dmp

Download

memory/2332-67-0x0000000002430000-0x0000000002431000-memory.dmp

Download

memory/2332-66-0x0000000000400000-0x0000000000760000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads