466ad9710bd7db93434b7238f5b2d05881fba2a7565c8882defcf326776d2132

General

Target
GOLAYA-DEVOCHKA.exe
Size 149KB
Sample231226-ppdctacfd2
SHA256 211901e1229d7b816754146ff8d7167e8a92211afe63dc44eb8056d0b054a12a
MD5 ccca394b1369e766c53346550b481c57
SHA1 47dccd3fc9b7bf7c98f75fa11725089d5a977b4c
SHA512 98625c9dd7cc8b57609ce20f6f295dc8704a75b49cde806ddbbb040cf3832028425bed0cd0da0c501508fabd2cdc59cd1717fa948362281848ed4ba798990712
SSDEEP 3072:lBAp5XhKpN4eOyVTGfhEClj8jTk+0hisUwxgTpLnNq:AbXE9OiTGfhEClq9TwxgJn0
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
3	2460	WScript.exe
7	2460	WScript.exe

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	cmd.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	WScript.exe
File opened for modification	C:\Windows\System32\drivers\etc\hîsts	WScript.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\salst\ogurets\Uninstall.ini	GOLAYA-DEVOCHKA.exe
File opened for modification	C:\Program Files (x86)\salst\ogurets\polenolll.pof	GOLAYA-DEVOCHKA.exe
File opened for modification	C:\Program Files (x86)\salst\ogurets\all3.vbs	GOLAYA-DEVOCHKA.exe
File opened for modification	C:\Program Files (x86)\salst\ogurets\osjovnofr.vbs	GOLAYA-DEVOCHKA.exe
File opened for modification	C:\Program Files (x86)\salst\ogurets\lit.vbs	GOLAYA-DEVOCHKA.exe
File opened for modification	C:\Program Files (x86)\salst\ogurets\122.txt	GOLAYA-DEVOCHKA.exe
File opened for modification	C:\Program Files (x86)\salst\ogurets\Uninstall.exe	GOLAYA-DEVOCHKA.exe
File opened for modification	C:\Program Files (x86)\salst\ogurets\podkati.bat	GOLAYA-DEVOCHKA.exe
File opened for modification	C:\Program Files (x86)\salst\ogurets\stuckja.jol	GOLAYA-DEVOCHKA.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1888 wrote to memory of 2684	1888	GOLAYA-DEVOCHKA.exe	28
PID 1888 wrote to memory of 2684	1888	GOLAYA-DEVOCHKA.exe	28
PID 1888 wrote to memory of 2684	1888	GOLAYA-DEVOCHKA.exe	28
PID 1888 wrote to memory of 2684	1888	GOLAYA-DEVOCHKA.exe	28
PID 2684 wrote to memory of 2460	2684	cmd.exe	30
PID 2684 wrote to memory of 2460	2684	cmd.exe	30
PID 2684 wrote to memory of 2460	2684	cmd.exe	30
PID 2684 wrote to memory of 2460	2684	cmd.exe	30
PID 1888 wrote to memory of 2544	1888	GOLAYA-DEVOCHKA.exe	31
PID 1888 wrote to memory of 2544	1888	GOLAYA-DEVOCHKA.exe	31
PID 1888 wrote to memory of 2544	1888	GOLAYA-DEVOCHKA.exe	31
PID 1888 wrote to memory of 2544	1888	GOLAYA-DEVOCHKA.exe	31

C:\Users\Admin\AppData\Local\Temp\GOLAYA-DEVOCHKA.exe
"C:\Users\Admin\AppData\Local\Temp\GOLAYA-DEVOCHKA.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Program Files (x86)\salst\ogurets\podkati.bat" "
  2⤵
  - Drops file in Drivers directory
  - Suspicious use of WriteProcessMemory
  PID:2684
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\salst\ogurets\all3.vbs"
    3⤵
    - Blocklisted process makes network request
    PID:2460
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\salst\ogurets\osjovnofr.vbs"
  2⤵
  - Drops file in Drivers directory
  PID:2544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

all3.vbs

Path C:\Program Files (x86)\salst\ogurets\all3.vbs
Size 358B
SHA256 51611da1f1bedbfc97fa015b41bc5e5ebfe61b8eb2aca050d440c642dd0c41c6
MD5 559c8ec72bf701870603c0f79907234c
SHA1 f3a809dee961f1f3d6c5c384596504981273fd77
SHA512 6616f4ac087e1b9e6f1bff0e5d844e316cddd5a2409e97b88118410475ab1bb544d59d6006940f74cad176470bc58112608d2b7bc01e71f0b232c6cdfa551a6a
MD5 SHA1 SHA512

Submit Download

osjovnofr.vbs

Path C:\Program Files (x86)\salst\ogurets\osjovnofr.vbs
Size 826B
SHA256 9659ca4ab0f584f9f3bbb5135eb0d12ebc3d24cbbdc719c7d7338f59d401f410
MD5 b0350182dcd735cf07e9c501cff5e7a1
SHA1 6dc80006d0d6e0e1d136826ab0e2a6c9bc61b950
SHA512 3ba96b3082f3a98a3adc452d1f52284bd49b2d035f0fbe960738324b624b8e2a70254bbed7a7f0d29ff6f5cd756f01f29d3fbba75419d9ed652879cdf79312ea
MD5 SHA1 SHA512

Submit Download

podkati.bat

Path C:\Program Files (x86)\salst\ogurets\podkati.bat
Size 3KB
SHA256 72375ee539442bf129b7ad6c3dbc68728b16a2106cef403000f26a833dd12322
MD5 a131962527d3b919e7c23267a2b0cdc4
SHA1 e7d2e84d765b7c2011bb91c78c93da33227dcfc8
SHA512 cfd69e3b434c9b4262b929b02e7616151f2960df56cc632f8c0e4d6e3a2f724c34db7d71e1bc984bccd9cc0a39a77e6da86cc4d675c2af0d3ae09bf981694cbc
MD5 SHA1 SHA512

Submit Download

polenolll.pof

Path C:\Program Files (x86)\salst\ogurets\polenolll.pof
Size 27B
SHA256 9681429a2b00c27fe6cb0453f255024813944a7cd460d18797e3c35e81c53d69
MD5 213c0742081a9007c9093a01760f9f8c
SHA1 df53bb518c732df777b5ce19fc7c02dcb2f9d81b
SHA512 55182c2e353a0027f585535a537b9c309c3bf57f47da54a16e0c415ed6633b725bf40e40a664b1071575feeb7e589d775983516728ec3e51e87a0a29010c4eb9
MD5 SHA1 SHA512

Submit Download

stuckja.jol

Path C:\Program Files (x86)\salst\ogurets\stuckja.jol
Size 64B
SHA256 d0a90a49e36d502e4903b5062712bca9006ae0afd349d4e9a74789eb68189685
MD5 61391af0a6e3c8f6d08b46b623eb3c2e
SHA1 ffe8b74b2c5920b13fabd2f203ab2c6171be663a
SHA512 f98bbbb3602936619714dcf787c3589948291e6e7a0c69f404e8b636a3c7ce608ac400b589b828f31270c550ef28f8a741fc40d8d018e28f0fe4512d50140180
MD5 SHA1 SHA512

Submit Download

hosts

Path C:\Windows\System32\drivers\etc\hosts
Size 1KB
SHA256 d29b19381fbf3494195232c63a36e6a9d38de4e2db3e80ae3f007a36e9674db3
MD5 44ccd2e0f82c735fbef30c341d6bfc10
SHA1 8cc305f7f8fff401380175ae0cc7d0df99b83373
SHA512 8627b9c13415f5d9c917692281f2a33aa4286f0a50b0d08933ca663cd6cc12fb17256a2270ff283dd497661001b6c06f3d16e889215821659fa24ede367dfe07
MD5 SHA1 SHA512

Submit Download

memory/1888-71-0x0000000000400000-0x0000000000422000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads