07859cc42c7c62cee53a80e079db6f18470526719aa4584e3f5001e2b1f3fb40

General

Target

GOLAYA-BABE.exe
Size

238KB
MD5

bd3875791f0a36ed9122352e1b4fe189
SHA1

a3dff7bd641755b5c8b64c4aab59738ec3842d60
SHA256

1973e4168c5aa035cdc9797ffdede9fac7e84064be5019f533a4ac3de2edef0f
SHA512

1709eff81fc9ee3760f3d6128a228655cadd04144d1f877e2c0a04e6ce2215eeb6c2acebca02d741f3a6090a239f1f652547e4c3badcc99db64dc35a8379ff67
SSDEEP

3072:tBAp5XhKpN4eOyVTGfhEClj8jTk+0hd255d5q5hQ2+Cgw5CKHm:obXE9OiTGfhEClq9uk5d5q5hQXJJUm

Score

8^/10

discovery

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
3	2472	WScript.exe
5	2472	WScript.exe

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hîsts	WScript.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	cmd.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	WScript.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\idol ya poka_\no_lover_simp\svezee_techenie_cheloveko.bat	GOLAYA-BABE.exe
File created	C:\Program Files (x86)\idol ya poka_\no_lover_simp\slooooowthespeedafer.cross	GOLAYA-BABE.exe
File opened for modification	C:\Program Files (x86)\idol ya poka_\no_lover_simp\slooooowthespeedafer.cross	GOLAYA-BABE.exe
File created	C:\Program Files (x86)\idol ya poka_\no_lover_simp\nu kak bi vsua hernya.fos	GOLAYA-BABE.exe
File opened for modification	C:\Program Files (x86)\idol ya poka_\no_lover_simp\nu kak bi vsua hernya.fos	GOLAYA-BABE.exe
File opened for modification	C:\Program Files (x86)\idol ya poka_\no_lover_simp\Uninstall.exe	GOLAYA-BABE.exe
File created	C:\Program Files (x86)\idol ya poka_\no_lover_simp\Uninstall.ini	GOLAYA-BABE.exe
File created	C:\Program Files (x86)\idol ya poka_\no_lover_simp\slooooowthespeedafer.vbs	cmd.exe
File created	C:\Program Files (x86)\idol ya poka_\no_lover_simp\svezee_techenie_cheloveko.bat	GOLAYA-BABE.exe
File created	C:\Program Files (x86)\idol ya poka_\no_lover_simp\xranilise_vsei_figni_tut.bok	GOLAYA-BABE.exe
File created	C:\Program Files (x86)\idol ya poka_\no_lover_simp\Uninstall.exe	GOLAYA-BABE.exe
File opened for modification	C:\Program Files (x86)\idol ya poka_\no_lover_simp\slooooowthespeedafer.vbs	cmd.exe
File opened for modification	C:\Program Files (x86)\idol ya poka_\no_lover_simp\xranilise_vsei_figni_tut.bok	GOLAYA-BABE.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 2556	2240	GOLAYA-BABE.exe	28
PID 2240 wrote to memory of 2556	2240	GOLAYA-BABE.exe	28
PID 2240 wrote to memory of 2556	2240	GOLAYA-BABE.exe	28
PID 2240 wrote to memory of 2556	2240	GOLAYA-BABE.exe	28
PID 2240 wrote to memory of 2472	2240	GOLAYA-BABE.exe	30
PID 2240 wrote to memory of 2472	2240	GOLAYA-BABE.exe	30
PID 2240 wrote to memory of 2472	2240	GOLAYA-BABE.exe	30
PID 2240 wrote to memory of 2472	2240	GOLAYA-BABE.exe	30

C:\Users\Admin\AppData\Local\Temp\GOLAYA-BABE.exe
"C:\Users\Admin\AppData\Local\Temp\GOLAYA-BABE.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Program Files (x86)\idol ya poka_\no_lover_simp\svezee_techenie_cheloveko.bat" "
  2⤵
  - Drops file in Drivers directory
  - Drops file in Program Files directory
  PID:2556
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\idol ya poka_\no_lover_simp\slooooowthespeedafer.vbs"
  2⤵
  - Blocklisted process makes network request
  - Drops file in Drivers directory
  PID:2472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\idol ya poka_\no_lover_simp\slooooowthespeedafer.cross

Filesize
1KB

MD5
34d7456a4891f37beb13dcbd036ed75a

SHA1
f64de50386a18592499f36871d7f9aa5f2a94af4

SHA256
286c730af7e132f6e5ce4c421902e6ce9a1155580b4b76f5e79c9540d89bd8fc

SHA512
218cd5e9e416c033451508148af8884c79aa594d8d967b43d749eb608616b775296c03c33844aeff553c65f347f7d2a01af6f2a4369b442ee05798979e7eb6ac

Download Submit
C:\Program Files (x86)\idol ya poka_\no_lover_simp\svezee_techenie_cheloveko.bat

Filesize
1KB

MD5
30c3e9c19b53c874e11ebe892b8e482a

SHA1
7c1691acac06d80bdb9008afe846219e87cddd58

SHA256
620071de936ca49df84e241c96cdc171e048ba34156b2cd82dd3593c7b40e7a4

SHA512
3dbaf16c611e143e93160a91f66e7f4d4e7c974cf7994a8a77d540cd77b18066987fb289f66cd8b088850ba8cf587212655aadb7acb0efa9ea19a402b0998e8a

Download Submit
C:\Program Files (x86)\idol ya poka_\no_lover_simp\xranilise_vsei_figni_tut.bok

Filesize
95B

MD5
c92529232d9a24e2bda875c082a00cc0

SHA1
540ab3f9fe1ff856d8d58ec32edc250514c83c53

SHA256
fd7381efc28d01c97a99fe03bb5d232b56bcdc38faac3a836168e3e10badffab

SHA512
f1f107f715ce91fb4b84e4875532e18b97fde182820ae54eed382250a5f921f2435c73ae5d8cb0c84db7843539e900e71d55740eaa8251b4b25f968ca31149ed

Download Submit
C:\Windows\System32\drivers\etc\hosts

Filesize
1KB

MD5
62f349a8cbe23f76b9a64af91c4901f3

SHA1
27fa28e6e22e320bdaeea11ad9be50ce85f0ae15

SHA256
11d67412a287aa262b5d3dda16a28e27d099186632883beb83d430396ada0536

SHA512
8574b744600558492d36cfcaff66ff344fc51dd7e7947e1b8247311a2ec73d11dd051791c10d864af77f7f7166aa340e6b4a2319f1c42f1f90ac6dff12d0fec4

Download Submit
memory/2240-44-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2240-48-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download

Analysis

Sharing