28ccdc782b4710a937d3b3bb108803e41117a5110b0329c659dae02f3ce72aa1

General

Target

GOLAYA-RUSSKAYA.exe
Size

238KB
MD5

4bf7fbae5d85b68dba3a92e172504238
SHA1

641a659c755e3adafa971a3f32c6e47b4f5f1173
SHA256

2e8efaea895111c02f1efddb99fa07fdd1e9c2318d488ae6c9b27064f6c0feac
SHA512

93e67706c4d5ffd05de586f612c8af211630921e2b91b5ec488a734fa951835caab543da76160f21bec8160473017857bcdd5625440a9247279986d05468e96d
SSDEEP

6144:zbXE9OiTGfhEClq9dqCvR/w/3E616xKJJUm:/U9XiuiURI/ss

Score

8^/10

discovery

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
16	4388	WScript.exe

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	cmd.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	WScript.exe
File opened for modification	C:\Windows\System32\drivers\etc\hîsts	WScript.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Control Panel\International\Geo\Nation	GOLAYA-RUSSKAYA.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 13 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\idol ya poka\no lover simfony\svezee_techenie_cheloveko.bat	GOLAYA-RUSSKAYA.exe
File created	C:\Program Files (x86)\idol ya poka\no lover simfony\xranilise_vsei_figni_tut.bok	GOLAYA-RUSSKAYA.exe
File created	C:\Program Files (x86)\idol ya poka\no lover simfony\nu kak bi vsua hernya.fos	GOLAYA-RUSSKAYA.exe
File opened for modification	C:\Program Files (x86)\idol ya poka\no lover simfony\xranilise_vsei_figni_tut.bok	GOLAYA-RUSSKAYA.exe
File created	C:\Program Files (x86)\idol ya poka\no lover simfony\slooooowthespeedafer.cross	GOLAYA-RUSSKAYA.exe
File created	C:\Program Files (x86)\idol ya poka\no lover simfony\Uninstall.exe	GOLAYA-RUSSKAYA.exe
File created	C:\Program Files (x86)\idol ya poka\no lover simfony\slooooowthespeedafer.vbs	cmd.exe
File opened for modification	C:\Program Files (x86)\idol ya poka\no lover simfony\nu kak bi vsua hernya.fos	GOLAYA-RUSSKAYA.exe
File opened for modification	C:\Program Files (x86)\idol ya poka\no lover simfony\Uninstall.exe	GOLAYA-RUSSKAYA.exe
File created	C:\Program Files (x86)\idol ya poka\no lover simfony\Uninstall.ini	GOLAYA-RUSSKAYA.exe
File opened for modification	C:\Program Files (x86)\idol ya poka\no lover simfony\svezee_techenie_cheloveko.bat	GOLAYA-RUSSKAYA.exe
File opened for modification	C:\Program Files (x86)\idol ya poka\no lover simfony\slooooowthespeedafer.cross	GOLAYA-RUSSKAYA.exe
File opened for modification	C:\Program Files (x86)\idol ya poka\no lover simfony\slooooowthespeedafer.vbs	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000_Classes\Local Settings	GOLAYA-RUSSKAYA.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 3688	1744	GOLAYA-RUSSKAYA.exe	91
PID 1744 wrote to memory of 3688	1744	GOLAYA-RUSSKAYA.exe	91
PID 1744 wrote to memory of 3688	1744	GOLAYA-RUSSKAYA.exe	91
PID 1744 wrote to memory of 4388	1744	GOLAYA-RUSSKAYA.exe	93
PID 1744 wrote to memory of 4388	1744	GOLAYA-RUSSKAYA.exe	93
PID 1744 wrote to memory of 4388	1744	GOLAYA-RUSSKAYA.exe	93

C:\Users\Admin\AppData\Local\Temp\GOLAYA-RUSSKAYA.exe
"C:\Users\Admin\AppData\Local\Temp\GOLAYA-RUSSKAYA.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\idol ya poka\no lover simfony\svezee_techenie_cheloveko.bat" "
  2⤵
  - Drops file in Drivers directory
  - Drops file in Program Files directory
  PID:3688
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\idol ya poka\no lover simfony\slooooowthespeedafer.vbs"
  2⤵
  - Blocklisted process makes network request
  - Drops file in Drivers directory
  PID:4388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\idol ya poka\no lover simfony\slooooowthespeedafer.cross

Filesize
1KB

MD5
528196221bc23381192e61fb6fe20f66

SHA1
2b0ac1a49b0be10f66dc798a6d2c8b20b4c6d179

SHA256
7fc68d1bafcc4d34084104d9ca10498b9e8c974ef19212abb6079ee0bbd07f67

SHA512
6e6512bb9640c7d3978f4b4b7a3b40c8b899ad75778fc8f4bbc136d7376fcec0543451d603d6f4f409dde79ba227040f27f8b96cf7efa5d84eedb13d232c84f1

Download Submit
C:\Program Files (x86)\idol ya poka\no lover simfony\svezee_techenie_cheloveko.bat

Filesize
1KB

MD5
13978e983ba5365f3004dbf68a35d69b

SHA1
2da80dd54cd7df37817b259928f8998466b1f934

SHA256
b57be79eb8e15466c5283e3bf4c1745500365a7fb0b2a6a17ff6d2e5da02ec78

SHA512
3e205c74f5e13bf08913890f149792456666bcdb499803e69c89d500a621bfd2a0967ef525a359fefc319d8e0d7b24a6f4e76061a18a07bd03bcb3db192492ec

Download Submit
C:\Program Files (x86)\idol ya poka\no lover simfony\xranilise_vsei_figni_tut.bok

Filesize
99B

MD5
86dc7199339e9623d9cb19240a752740

SHA1
71cb2333efd767a21c031c23bb5b7e81115aff18

SHA256
c374079002e58508af7c8de08bf7e98b72a0d11b44650dcbb89f31d15e887370

SHA512
eee63bbf12c45ba73cfb543d0069288090410e91ef484587dde79995a585ef510d295d4de19701feb5704167b3d0ba01cf0a40f00c42abf29825e1f2bf917f5d

Download Submit
C:\Windows\System32\drivers\etc\hosts

Filesize
1KB

MD5
4fccb4d0b47dfce4da0002ee30fc74e6

SHA1
e5e9311650e7631800cd404d2aa7df00e4b169d3

SHA256
2554b9fc2dd8cdb75ac6e3650a9b5fe0b90d40a7bb04625b021aaf6d0e1a1499

SHA512
951e1f0a5636052f32b7990201cc1d855d8bef07fd247fe95f87dfc20c314c3945fecb549e402445543fadd60c5c46db4d028391a690c84bd6a8308d335adacd

Download Submit
memory/1744-39-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1744-42-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download

Analysis

Sharing