b6da583eabc85b01d2d1f2ae3734479dae092143ab6d270d3f66cce3b8f4db37 | Triage

Sharing

General

Target

b6da583eabc85b01d2d1f2ae3734479dae092143ab6d270d3f66cce3b8f4db37
Size

80KB
Sample

221206-ahsftsdf2v
MD5

dce3bf21a10220a10a91c4b21741b831
SHA1

766d6a470e1516898aac8ef7cb91c9f063e52305
SHA256

b6da583eabc85b01d2d1f2ae3734479dae092143ab6d270d3f66cce3b8f4db37
SHA512

e956dad07e038ab7f588857541b1564513bf206d33ac79202002d6fe3caeeb7aaabd6202b7a78792c076c6274ef2faebb64caf87d04434aad5fa990a8ed7c2b2
SSDEEP

1536:WkDro9Ash6VQZtlRtQlQ7pYw/zQymCJVVBZu3BHp231vcaLCCfVVG6sxaZ:9DvsEU8lGpD/NZBZF1vcaLCsT/Mu

Score

8^/10

Malware Config

Targets

- Target
  
  GOLAYA-SEXY.exe
- Size
  
  180KB
- MD5
  
  731790f96390935dcf6c9451c7b80c68
- SHA1
  
  92e152be11147d807725aa55aea4825675f654f5
- SHA256
  
  58a80f311c14624bf50f9e45db0e62a5a4902ecffeeda120ad0d775ac109d4a9
- SHA512
  
  76de1b2e02c166d79b1a5079219cc7546a61d1e982a3b58e927695001725c9f50216c2cf4bd3d49d009debd2107f68eaf9751c4bdb0408cf3a508658c58af515
- SSDEEP
  
  3072:oBAp5XhKpN4eOyVTGfhEClj8jTk+0hN7+mYnhIAhyYyOK01:fbXE9OiTGfhEClq9s+mYnhIAhy8/1
Score

8^/10
- Blocklisted process makes network request
- Drops file in Drivers directory
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2