7e0729cfff5ef8ee916289f40f5bd9c1e9f398ee7bc1571c524f8e9e93b5f693

General

Target
GOLAYA-DEVOCHKA.exe
Size 149KB
Sample231224-28bpjsceh7
SHA256 1fccd0adbb781ba2f3c9dd5340069470ea79410cb57d8d206b29dd011dd5e46e
MD5 f017add0319b24def517032c3b93b06f
SHA1 69aa7ec014e3cab55ef2f4df20e70d6856e76927
SHA512 9cc4a05e4b253f3f285154b82fc8945a1e00a3607feacbd20973480732a6fed210987ce42e32d24f74d582775f1ca045774054f3e4aae5c7b9ca5d41e2950d9c
SSDEEP 3072:lBAp5XhKpN4eOyVTGfhEClj8jTk+0hiY9ruInWRewlt:AbXE9OiTGfhEClq98PWRewlt
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
31	3816	WScript.exe

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	cmd.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	WScript.exe
File opened for modification	C:\Windows\System32\drivers\etc\hîsts	WScript.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation	GOLAYA-DEVOCHKA.exe
Key value queried	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation	cmd.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Company\NewProduct\al99999.vbs	cmd.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\hhhh.txt	GOLAYA-DEVOCHKA.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\al99999.pp	GOLAYA-DEVOCHKA.exe
File created	C:\Program Files (x86)\Company\NewProduct\Uninstall.ini	GOLAYA-DEVOCHKA.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\Uninstall.exe	GOLAYA-DEVOCHKA.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\al99999.vbs	cmd.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\all2.vbs	GOLAYA-DEVOCHKA.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\koollapsa.bat	GOLAYA-DEVOCHKA.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\slonik.po	GOLAYA-DEVOCHKA.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings	GOLAYA-DEVOCHKA.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1060 wrote to memory of 1084	1060	GOLAYA-DEVOCHKA.exe	93
PID 1060 wrote to memory of 1084	1060	GOLAYA-DEVOCHKA.exe	93
PID 1060 wrote to memory of 1084	1060	GOLAYA-DEVOCHKA.exe	93
PID 1084 wrote to memory of 3816	1084	cmd.exe	95
PID 1084 wrote to memory of 3816	1084	cmd.exe	95
PID 1084 wrote to memory of 3816	1084	cmd.exe	95
PID 1060 wrote to memory of 1744	1060	GOLAYA-DEVOCHKA.exe	96
PID 1060 wrote to memory of 1744	1060	GOLAYA-DEVOCHKA.exe	96
PID 1060 wrote to memory of 1744	1060	GOLAYA-DEVOCHKA.exe	96

C:\Users\Admin\AppData\Local\Temp\GOLAYA-DEVOCHKA.exe
"C:\Users\Admin\AppData\Local\Temp\GOLAYA-DEVOCHKA.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1060
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\Company\NewProduct\koollapsa.bat" "
  2⤵
  - Drops file in Drivers directory
  - Checks computer location settings
  - Drops file in Program Files directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1084
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Company\NewProduct\al99999.vbs"
    3⤵
    - Blocklisted process makes network request
    PID:3816
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Company\NewProduct\all2.vbs"
  2⤵
  - Drops file in Drivers directory
  PID:1744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

al99999.vbs

Path C:\Program Files (x86)\Company\NewProduct\al99999.vbs
Size 243B
SHA256 a542c80852ffe78e295d49720db744b464649f7ae4f7d8f8b9bd73b5fb085cf8
MD5 23ef2c7e99fa7dea7ec005939ef9fda2
SHA1 7e283eb07d4c16c6d156b2eeeae96e02c432f7b7
SHA512 55d41334eb10032d05bdfe0789ad0654630b8db0a31adeec10ba6ee881d0ecc95d023d1414a7b82fa1a03e9b6703ac5999439c909bd1193e30b62d28dc3359a5
MD5 SHA1 SHA512

Submit Download

all2.vbs

Path C:\Program Files (x86)\Company\NewProduct\all2.vbs
Size 722B
SHA256 9cd6ea229816f42d86f0fc4373d4db66b9fb863957c0d6ff185b5537f6f9416a
MD5 d8bde056ff79ebdf405042460d71f823
SHA1 798dcc1ab1fa00dfa622daffd32d9c93c5bb68e9
SHA512 657cfd8ff737fe7a203b4f7b1e1d47569ee2ba0aaf306a8eceec8fc83e773662f85a02ae250fe34386675ee766287129da471a66131f3ffe8b29f0cdf98feee8
MD5 SHA1 SHA512

Submit Download

hhhh.txt

Path C:\Program Files (x86)\Company\NewProduct\hhhh.txt
Size 27B
SHA256 9681429a2b00c27fe6cb0453f255024813944a7cd460d18797e3c35e81c53d69
MD5 213c0742081a9007c9093a01760f9f8c
SHA1 df53bb518c732df777b5ce19fc7c02dcb2f9d81b
SHA512 55182c2e353a0027f585535a537b9c309c3bf57f47da54a16e0c415ed6633b725bf40e40a664b1071575feeb7e589d775983516728ec3e51e87a0a29010c4eb9
MD5 SHA1 SHA512

Submit Download

koollapsa.bat

Path C:\Program Files (x86)\Company\NewProduct\koollapsa.bat
Size 2KB
SHA256 2b34b1d6a58969a6a952fb79af1ff1462507cd4c377c610b19f29803c93c724b
MD5 4bef9ea6d5abdcf2238181e5e99a00a3
SHA1 9f56b3419ffc31be534965dccebc7e17cff86209
SHA512 c020899846cc8d2977d886df8d369686087bf9b7db5e2e2897506a3d8f23179642b73852a46a824f9fa2fdb87f98a5c41f488d1041df7310779dd0158ee47cec
MD5 SHA1 SHA512

Submit Download

slonik.po

Path C:\Program Files (x86)\Company\NewProduct\slonik.po
Size 52B
SHA256 2b372c716cacdac185842371da59c1899660584647c627961ff86cf75dcdcce1
MD5 338036b941523ede7d75fb976b9fae0d
SHA1 9c9811337a6aeb90330d3c63de45d5f083b1f4e5
SHA512 c028e06623ec1be9f3d139952cb386b40031fb0b744f88917df6d1a8cc08d0234f38fd90b23c23d5b657ab0143265ab7d1025d102ea402f3ccb746623c635f5e
MD5 SHA1 SHA512

Submit Download

hosts

Path C:\Windows\System32\drivers\etc\hosts
Size 1KB
SHA256 f6c84e7c7fced4ae3ee3ca143fd5e134a183eb1e2f67ab71a6e9a902596be993
MD5 d9a93296f8c62ab96271667c72d7a3b3
SHA1 abcf5a6ed773cfc978fc2176138778ad406c188a
SHA512 f91de9fbc57397c895aa1bda0ed18601711b1da377ceeee9d5a5ff48a4a3ba2e4feaacf3c64475c07daf584d6374e79d8206a49d1e25bc3044b2e4b6c7d4bd02
MD5 SHA1 SHA512

Submit Download

memory/1060-57-0x0000000000400000-0x0000000000422000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads