8bd69f694a6a714f54e44051168c0a2d105c758cf3adaa9f322bf17ffb1a3667 | Triage

Sharing

General

Target

8bd69f694a6a714f54e44051168c0a2d105c758cf3adaa9f322bf17ffb1a3667
Size

80KB
Sample

221203-cae7msea35
MD5

81f6e52872ce6e3c4aacfaa6bcc4737d
SHA1

2abe393a4154fb55a7ad150ed37e205b861e1d3d
SHA256

8bd69f694a6a714f54e44051168c0a2d105c758cf3adaa9f322bf17ffb1a3667
SHA512

53a5fb84f9f980d57af67e84140f6742b387d0c92d9bd00a4c4137775b5fb86f50f19e64ffc4a6e840c7b07e1c57966fe2a7da435a10c0262afebc476f7f5d38
SSDEEP

1536:UkDro9Ash6VQZtlRtQlQ7pYw/zQymCJVVBZu3BHp231vcaLCCfVVG6sxaL:XDvsEU8lGpD/NZBZF1vcaLCsT/Mg

Score

8^/10

Malware Config

Targets

- Target
  
  GOLAYA-DEVOCHKA.exe
- Size
  
  180KB
- MD5
  
  731790f96390935dcf6c9451c7b80c68
- SHA1
  
  92e152be11147d807725aa55aea4825675f654f5
- SHA256
  
  58a80f311c14624bf50f9e45db0e62a5a4902ecffeeda120ad0d775ac109d4a9
- SHA512
  
  76de1b2e02c166d79b1a5079219cc7546a61d1e982a3b58e927695001725c9f50216c2cf4bd3d49d009debd2107f68eaf9751c4bdb0408cf3a508658c58af515
- SSDEEP
  
  3072:oBAp5XhKpN4eOyVTGfhEClj8jTk+0hN7+mYnhIAhyYyOK01:fbXE9OiTGfhEClq9s+mYnhIAhy8/1
Score

8^/10
- Blocklisted process makes network request
- Drops file in Drivers directory
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2