2b04a36a6440b7fc9ddc32ce166c95e4ba022fdd61a50a621e9186d865faa62b

General

Target
StartAllBack3.9.27.5412-Stable-Repack.exe
Size 2.1MB
Sample261030-nzd7esyths
SHA256 2b04a36a6440b7fc9ddc32ce166c95e4ba022fdd61a50a621e9186d865faa62b
MD5 68f39dcd0334ba5d428bc40b8dfe15e8
SHA1 f6c0041b24b88db1f056ac96bb26f83f07d5713a
SHA512 72434c995cd70547acc9ad87f4b957d1c3ab6785b7652cc074c0dc32bc78d1b5a7d46b525f14692de541108d5908d798b87f47ee3b9d43dfc120703be80ecb7e
SSDEEP 49152:6gwRZBlNOEBce/cwi/1bbgN2mrRwLsqPqF7wN7L8etBmg8c+5:6gwR5NOEBc2ed4Rr3EqFsYV8e
TLSH
T16AA522C7A385CEF5F1AC14B024826B3E55B78AAE03DB16C3864F9D161F751CD89F029A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Control Panel\International\Geo\Nation	StartAllBackCfg.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Control Panel\International\Geo\Nation	StartAllBack3.9.27.5412-Stable-Repack.exe

Executes dropped EXE 1 IoCs

pid	Process
1316	StartAllBackCfg.exe

Loads dropped DLL 1 IoCs

pid	Process
1316	StartAllBackCfg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1176	cmd.exe
2076	cmd.exe
3152	cmd.exe
4124	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	whoami.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	StartAllBack3.9.27.5412-Stable-Repack.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
1260	taskkill.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1260	taskkill.exe
Token: SeDebugPrivilege	4384	whoami.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1316	StartAllBackCfg.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4348 wrote to memory of 1260	4348	StartAllBack3.9.27.5412-Stable-Repack.exe	84
PID 4348 wrote to memory of 1316	4348	StartAllBack3.9.27.5412-Stable-Repack.exe	87
PID 1316 wrote to memory of 4320	1316	StartAllBackCfg.exe	92
PID 4348 wrote to memory of 3544	4348	StartAllBack3.9.27.5412-Stable-Repack.exe	95
PID 4348 wrote to memory of 1012	4348	StartAllBack3.9.27.5412-Stable-Repack.exe	98
PID 4348 wrote to memory of 1176	4348	StartAllBack3.9.27.5412-Stable-Repack.exe	100
PID 1176 wrote to memory of 2076	1176	cmd.exe	102
PID 2076 wrote to memory of 4384	2076	cmd.exe	103
PID 1176 wrote to memory of 2876	1176	cmd.exe	104
PID 1176 wrote to memory of 2172	1176	cmd.exe	105
PID 4348 wrote to memory of 3152	4348	StartAllBack3.9.27.5412-Stable-Repack.exe	106
PID 3152 wrote to memory of 4124	3152	cmd.exe	108
PID 4124 wrote to memory of 2948	4124	cmd.exe	109
PID 4124 wrote to memory of 1668	4124	cmd.exe	110

C:\Users\Admin\AppData\Local\Temp\StartAllBack3.9.27.5412-Stable-Repack.exe
"C:\Users\Admin\AppData\Local\Temp\StartAllBack3.9.27.5412-Stable-Repack.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4348
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im StartAllBackCfg.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1260
- C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\StartAllBackCfg.exe
  "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\StartAllBackCfg.exe" /install
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1316
- - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\StartAllBackCfg.exe
    "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\StartAllBackCfg.exe" /install /elevated /silent
    3⤵
    PID:4320
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /delete /f /tn "StartAllBack Update"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3544
- C:\Windows\SysWOW64\reg.exe
  "C:\Windows\System32\reg.exe" add "HKCU\Software\StartIsBack" /f /v "DarkMagic" /t REG_DWORD /d "1"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1012
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c for /f "tokens=2 delims=," %s in ('whoami /user /fo csv /nh') do (reg add "HKLM\SOFTWARE\Microsoft\PolicyManager\current\%~s\Connectivity" /f /v "DisableCrossDeviceResume" /t REG_DWORD /d "1" /reg:64 & reg add "HKLM\SOFTWARE\Microsoft\PolicyManager\current\%~s\Connectivity" /f /v "DisableCrossDeviceResume_ProviderSet" /t REG_DWORD /d "1" /reg:64)
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1176
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c whoami /user /fo csv /nh
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2076
  - - C:\Windows\SysWOW64\whoami.exe
      whoami /user /fo csv /nh
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4384
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\PolicyManager\current\S-1-5-21-2101206053-1414382737-268919432-1000\Connectivity" /f /v "DisableCrossDeviceResume" /t REG_DWORD /d "1" /reg:64
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2876
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\PolicyManager\current\S-1-5-21-2101206053-1414382737-268919432-1000\Connectivity" /f /v "DisableCrossDeviceResume_ProviderSet" /t REG_DWORD /d "1" /reg:64
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2172
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c for /f "tokens=*" %k in ('reg query "HKCR\Local Settings\MuiCache" /s ^| findstr /i "AAF68885"') do (reg add "%k" /v "@timedate.cpl,-1189" /t REG_SZ /d 秒 /f)
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3152
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg query "HKCR\Local Settings\MuiCache" /s | findstr /i "AAF68885"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4124
  - - C:\Windows\SysWOW64\reg.exe
      reg query "HKCR\Local Settings\MuiCache" /s
      4⤵
      System Location Discovery: System Language Discovery
      PID:2948
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /i "AAF68885"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1668

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartAllBackCfg.exe

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\StartAllBackCfg.exe
Size 3.3MB
SHA256 b90887ac351333c2d37025734a68914552ccc4eb03d84bb0c74a77978fc7bb03
MD5 ea6ccd4f476359594b3de46524452867
SHA1 39cd2b32d2b6726cbe2b25b6ba002bf2f88807bd
SHA512 fbc319d1797da6ad65f304ea785d4f858b37dbdcb4529dc456ddb6727dcd46c3a1555b38109cd9ab74a8bb118e1972d6b66c9c402edf52d2936b44d458509228
SSDEEP 24576:rNagaJo1yfyuH9h36hoyGSGmhhAUgW0qK4emrfiEP:rcgaJRTH9hKhoyHh30V4P
TLSH
T154F5A463A7F68128F1BB9B75D9B287604A33BC656FB6C1DF1281014D09B4AC08DB5B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartAllBackX64.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\StartAllBackX64.dll
Size 1.0MB
SHA256 56c2dc60eb02ead04613d163c1839ea1658d90ec86fc5572362357b816cd35ab
MD5 566ee35a95a05a5803b9bd6b2c7acda6
SHA1 eabf1fbbcddcaa199b12cf7f72d70095b6b5d456
SHA512 788e243894d424705a5798fa77a179f540ed9e671021f8efcdc385c4f953bba2635b6a5423763c6be86b2bb733371af561048b897f7cc257bd7b467449ab5aab
SSDEEP 24576:7PXxx9i9vtw/LVmhp/6+0GJ4XzinZTxWiVpe3q:7Pf9KvtqYC+pJ4jcZVj6q
TLSH
T14F25390673F80198F1B79675DAB79A17DBB2B8872A30D60F0194864D3F33771993A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1316-129-0x0000000002380000-0x0000000002381000-memory.dmp

Download

memory/1316-133-0x0000000000400000-0x0000000000764000-memory.dmp