b385184a00e274bc542ddf7980a5cf665d1c4e71207d8b0d316ce87ad1a8fb17

Analysis

max time kernel
0s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 13:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

GOLAYA-BABE.exe
Size

150KB
MD5

13064a1549e859958c07462c9b2f0a58
SHA1

da6a8be2da028023ad9a350845eae67a64b5bf7e
SHA256

dd8a4e021d917b7085788dcdf7d881c679a17416493fcf45ebbfedbed0df32ea
SHA512

f28a80bb53fbcb0aed10248a69e7dfbb93671d689d3df6f73eb57b6220348c25cfdb3c0cf2f791aedd44267dba4401d5c0392a2da3f460f25b3509260d2fe533
SSDEEP

3072:lBAp5XhKpN4eOyVTGfhEClj8jTk+0hirrmrtA8ujM1jo:AbXE9OiTGfhEClq9dmLsM1E

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	cmd.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\dus_dezodorant\mouyus\zelands.bat	GOLAYA-BABE.exe
File opened for modification	C:\Program Files (x86)\dus_dezodorant\mouyus\90909090.ico	GOLAYA-BABE.exe
File opened for modification	C:\Program Files (x86)\dus_dezodorant\mouyus\readme.txt	GOLAYA-BABE.exe
File opened for modification	C:\Program Files (x86)\dus_dezodorant\mouyus\fifa.vbs	GOLAYA-BABE.exe
File opened for modification	C:\Program Files (x86)\dus_dezodorant\mouyus\drochka_peredrochka.vbs	GOLAYA-BABE.exe
File opened for modification	C:\Program Files (x86)\dus_dezodorant\mouyus\Uninstall.exe	GOLAYA-BABE.exe
File created	C:\Program Files (x86)\dus_dezodorant\mouyus\Uninstall.ini	GOLAYA-BABE.exe
File opened for modification	C:\Program Files (x86)\dus_dezodorant\mouyus\tutunas.nistyak	GOLAYA-BABE.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 2780	2028	GOLAYA-BABE.exe	18
PID 2028 wrote to memory of 2780	2028	GOLAYA-BABE.exe	18
PID 2028 wrote to memory of 2780	2028	GOLAYA-BABE.exe	18
PID 2028 wrote to memory of 2780	2028	GOLAYA-BABE.exe	18

C:\Users\Admin\AppData\Local\Temp\GOLAYA-BABE.exe
"C:\Users\Admin\AppData\Local\Temp\GOLAYA-BABE.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\dus_dezodorant\mouyus\drochka_peredrochka.vbs"
  2⤵
  PID:2672
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Program Files (x86)\dus_dezodorant\mouyus\zelands.bat" "
  2⤵
  - Drops file in Drivers directory
  PID:2780

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\dus_dezodorant\mouyus\fifa.vbs"
1⤵
PID:2624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\dus_dezodorant\mouyus\drochka_peredrochka.vbs

Filesize
789B

MD5
fbfaf5456d9016723c58958bbb6fcb99

SHA1
38d0c30b1d89f76a0471f528d6f3536061661a9b

SHA256
22dcf67869a40499096986790585adef290eb556c85077ac1b5a9f5d2f0ef17d

SHA512
537c9b09a96b107cf26a1a2b5aa8a513fed2632b3fdaf932d44fa63b78a1d91bd78cce7c5d7794025785c79091171a52546bb8f42f927cb1072f45873a32f2d6

Download Submit
C:\Program Files (x86)\dus_dezodorant\mouyus\tutunas.nistyak

Filesize
27B

MD5
213c0742081a9007c9093a01760f9f8c

SHA1
df53bb518c732df777b5ce19fc7c02dcb2f9d81b

SHA256
9681429a2b00c27fe6cb0453f255024813944a7cd460d18797e3c35e81c53d69

SHA512
55182c2e353a0027f585535a537b9c309c3bf57f47da54a16e0c415ed6633b725bf40e40a664b1071575feeb7e589d775983516728ec3e51e87a0a29010c4eb9

Download Submit
C:\Program Files (x86)\dus_dezodorant\mouyus\zelands.bat

Filesize
3KB

MD5
25a0b02e83ef7cc0e50772e9ca8fdbe9

SHA1
5bf8d941645128fc22548c44d1cb9f64b0cfb360

SHA256
fd0e09bfa5c5af35ed2b17b0c3a63740fcf657550fff9a397c1a1f69af246863

SHA512
b15105e92adf78c304e7ccbd2a87946a08897ab10b009643348e7675806646a3159c632f5aa788ee6ca8128cb8f76a3d77aaa49fe6e4d9ee17748b35166562bd

Download Submit
memory/2028-72-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download