c12a4b44613a843c1ce5f6d315397171c17b0e48b7fbd68a07eea9dce2494566

General

Target

GOLAYA-TOPLESS.exe
Size

239KB
MD5

6839c4c1e533bdef312fa9501b7cd622
SHA1

0a4a288e686a64c0d926e5d5c7ddd46ec7eeeaa1
SHA256

5b40e9c2a5bbd190d09eade750b1ce1a48887f6822a3e8a4cf3f927c38088982
SHA512

d0cafe97a7ab0444424d88d6fddbe2bb0bc9d33abaaeec21101388982d40728d5114d30d1d9b3f7b5d0ea77cbfc6f8067256d4cd7613d14de74ccd196a1dd954
SSDEEP

3072:MBAp5XhKpN4eOyVTGfhEClj8jTk+0hYoO/MgjqEWBz+Cgw5CKHy:7bXE9OiTGfhEClq95/MgXJJUy

Score

8^/10

discovery

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
3	556	WScript.exe
4	556	WScript.exe

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	cmd.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	WScript.exe
File opened for modification	C:\Windows\System32\drivers\etc\hîsts	WScript.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 17 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\lop1\piccoloucioamepiacanutella\Dogma.bat	GOLAYA-TOPLESS.exe
File opened for modification	C:\Program Files (x86)\lop1\piccoloucioamepiacanutella\kolitmna.kol	GOLAYA-TOPLESS.exe
File created	C:\Program Files (x86)\lop1\piccoloucioamepiacanutella\xuipizda\1.txt	GOLAYA-TOPLESS.exe
File opened for modification	C:\Program Files (x86)\lop1\piccoloucioamepiacanutella\pizdaxui11.eb	GOLAYA-TOPLESS.exe
File created	C:\Program Files (x86)\lop1\piccoloucioamepiacanutella\olologggg.vbs	cmd.exe
File opened for modification	C:\Program Files (x86)\lop1\piccoloucioamepiacanutella\pizdaxui11.vbs	cmd.exe
File opened for modification	C:\Program Files (x86)\lop1\piccoloucioamepiacanutella\Dogma.bat	GOLAYA-TOPLESS.exe
File created	C:\Program Files (x86)\lop1\piccoloucioamepiacanutella\kolitmna.kol	GOLAYA-TOPLESS.exe
File created	C:\Program Files (x86)\lop1\piccoloucioamepiacanutella\Uninstall.ini	GOLAYA-TOPLESS.exe
File created	C:\Program Files (x86)\lop1\piccoloucioamepiacanutella\Uninstall.exe	GOLAYA-TOPLESS.exe
File opened for modification	C:\Program Files (x86)\lop1\piccoloucioamepiacanutella\Uninstall.exe	GOLAYA-TOPLESS.exe
File created	C:\Program Files (x86)\lop1\piccoloucioamepiacanutella\Twitvid allows you to easily.home	GOLAYA-TOPLESS.exe
File opened for modification	C:\Program Files (x86)\lop1\piccoloucioamepiacanutella\Twitvid allows you to easily.home	GOLAYA-TOPLESS.exe
File opened for modification	C:\Program Files (x86)\lop1\piccoloucioamepiacanutella\xuipizda\1.txt	GOLAYA-TOPLESS.exe
File created	C:\Program Files (x86)\lop1\piccoloucioamepiacanutella\pizdaxui11.eb	GOLAYA-TOPLESS.exe
File opened for modification	C:\Program Files (x86)\lop1\piccoloucioamepiacanutella\olologggg.vbs	cmd.exe
File created	C:\Program Files (x86)\lop1\piccoloucioamepiacanutella\pizdaxui11.vbs	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 932	1104	GOLAYA-TOPLESS.exe	27
PID 1104 wrote to memory of 932	1104	GOLAYA-TOPLESS.exe	27
PID 1104 wrote to memory of 932	1104	GOLAYA-TOPLESS.exe	27
PID 1104 wrote to memory of 932	1104	GOLAYA-TOPLESS.exe	27
PID 1104 wrote to memory of 1636	1104	GOLAYA-TOPLESS.exe	29
PID 1104 wrote to memory of 1636	1104	GOLAYA-TOPLESS.exe	29
PID 1104 wrote to memory of 1636	1104	GOLAYA-TOPLESS.exe	29
PID 1104 wrote to memory of 1636	1104	GOLAYA-TOPLESS.exe	29
PID 1104 wrote to memory of 556	1104	GOLAYA-TOPLESS.exe	30
PID 1104 wrote to memory of 556	1104	GOLAYA-TOPLESS.exe	30
PID 1104 wrote to memory of 556	1104	GOLAYA-TOPLESS.exe	30
PID 1104 wrote to memory of 556	1104	GOLAYA-TOPLESS.exe	30

C:\Users\Admin\AppData\Local\Temp\GOLAYA-TOPLESS.exe
"C:\Users\Admin\AppData\Local\Temp\GOLAYA-TOPLESS.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Program Files (x86)\lop1\piccoloucioamepiacanutella\Dogma.bat" "
  2⤵
  - Drops file in Drivers directory
  - Drops file in Program Files directory
  PID:932
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\lop1\piccoloucioamepiacanutella\olologggg.vbs"
  2⤵
  - Drops file in Drivers directory
  PID:1636
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\lop1\piccoloucioamepiacanutella\pizdaxui11.vbs"
  2⤵
  - Blocklisted process makes network request
  PID:556

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\lop1\piccoloucioamepiacanutella\Dogma.bat

Filesize
1KB

MD5
c116ccc255832c552d663600eb1d142a

SHA1
bfe7637478bbcbee0253df07cd2d20d3e7e5c04c

SHA256
10be330e7e4da276d80edb4123f37610b8284b77b6b5f809fc128558d44a2560

SHA512
00eee11e8efa70bd728c182394d15063c5f192f4e673cd64930a77735c28cd8944062ffe06eaeec4b9e8e5bb259d1d61eaf6074018d2bffa99d9c9641f9a7688

Download Submit
C:\Program Files (x86)\lop1\piccoloucioamepiacanutella\Twitvid allows you to easily.home

Filesize
92B

MD5
119d851aca579cb6d3b3f996209ae746

SHA1
8269aa49847598efea40cd76a43846238da6c791

SHA256
4f8c85a7fc4aaf52afc6fb758ea289640c8dc03d38557b12d5ed92d2c8d9005d

SHA512
244b4535f9af527324977c3cd744912fb56b3946d2a1c3188725ae10753eccc969ed9b3f602b9c13e1e8df268290d7d38a1304213043e79ee2258ccb90ed25fc

Download Submit
C:\Program Files (x86)\lop1\piccoloucioamepiacanutella\kolitmna.kol

Filesize
628B

MD5
3b007c1b75cc2e976187ad8387b31b8a

SHA1
f34230fbb690026536ead92ab51fb97fa4f90f00

SHA256
4cbc257c9ee854c9ea8c39f2d021db2ceea44fb2adee64fcaf7596cb2e03f04b

SHA512
b9d23a4eceeb124f7be3cad975f013344a04656788f7a2ceb160a9e0268631029f963595b5522b7fb6865c74c2b0cdd45652bc2234329eba7f46dafe051e33c8

Download Submit
C:\Program Files (x86)\lop1\piccoloucioamepiacanutella\olologggg.vbs

Filesize
628B

MD5
3b007c1b75cc2e976187ad8387b31b8a

SHA1
f34230fbb690026536ead92ab51fb97fa4f90f00

SHA256
4cbc257c9ee854c9ea8c39f2d021db2ceea44fb2adee64fcaf7596cb2e03f04b

SHA512
b9d23a4eceeb124f7be3cad975f013344a04656788f7a2ceb160a9e0268631029f963595b5522b7fb6865c74c2b0cdd45652bc2234329eba7f46dafe051e33c8

Download Submit
C:\Program Files (x86)\lop1\piccoloucioamepiacanutella\pizdaxui11.eb

Filesize
185B

MD5
b6ca24e2cc23d2c4ab76cff73b6705b9

SHA1
028560ec53255c570a99884061443285f363a9ab

SHA256
dc7ff1cd3688a4332b64cdc31beb07bb3de9e1b578433aae8e1b296aee4385db

SHA512
4ec8a185eb1d7fdf2a6d9d6a59750338649a899ced69097bf494443652ddc8e8177f4b4de7af60d459251cd3ebca6e417164a46388096424ab96c21b39182e26

Download Submit
C:\Program Files (x86)\lop1\piccoloucioamepiacanutella\pizdaxui11.vbs

Filesize
185B

MD5
b6ca24e2cc23d2c4ab76cff73b6705b9

SHA1
028560ec53255c570a99884061443285f363a9ab

SHA256
dc7ff1cd3688a4332b64cdc31beb07bb3de9e1b578433aae8e1b296aee4385db

SHA512
4ec8a185eb1d7fdf2a6d9d6a59750338649a899ced69097bf494443652ddc8e8177f4b4de7af60d459251cd3ebca6e417164a46388096424ab96c21b39182e26

Download Submit
C:\Windows\System32\drivers\etc\hosts

Filesize
1KB

MD5
71d56c63c666019eab63fa6f1cf94f2c

SHA1
e7d92bc7d1d8ce3bcc51f2a0049f21ac1b4f12dc

SHA256
208f28ce8cbf416b8be7beffea105562fffcfdd14cdc370e4519233c46451b53

SHA512
6131b7d16dacf34abaae4426e5507cb5b4df2116145572d3ed2ac0e27ebade53ec0ccc058f353c2519513bf8214d1b822d0d3197fe16bc3c96467dbaa54a1768

Download Submit
memory/1104-54-0x0000000075BB1000-0x0000000075BB3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing