4789bc2b5d8584085cff6869f61f5b75a0d995df5d883b78e1933b716c495c2f

General

Target

GOLAYA-SEXY.exe
Size

239KB
MD5

f4eeb055f29a903de30886496d2399d0
SHA1

3f10e04a7b1884382759b252f294b6db527877c6
SHA256

802a092b98f19900cc472c08f9bc07009f16197d15f66273be6ae7fe77df0456
SHA512

d77d6fca5c1297816150b21c1c1f71080a273a2512dd657a2eff159070ff66c8fd9b7531c2f0230f489fec35a12646f9940fc3d3d4ba00b2a191a1c84454a567
SSDEEP

6144:sbXE9OiTGfhEClq9zrd52hTDOC661lYQawJJUq:IU9Xiuix1lYQaS

Score

8^/10

discovery

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
3	2324	WScript.exe
5	2324	WScript.exe

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hîsts	WScript.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	cmd.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	WScript.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 13 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ustanovi menya plllll\life is life\everybody_lie_life_is_life.gol	GOLAYA-SEXY.exe
File created	C:\Program Files (x86)\ustanovi menya plllll\life is life\Tocausetofallby.striking	GOLAYA-SEXY.exe
File opened for modification	C:\Program Files (x86)\ustanovi menya plllll\life is life\lethala fell blowsinisterby somefell.chanc	GOLAYA-SEXY.exe
File opened for modification	C:\Program Files (x86)\ustanovi menya plllll\life is life\Tocausetofallby.vbs	cmd.exe
File opened for modification	C:\Program Files (x86)\ustanovi menya plllll\life is life\when_we_a_fill_the_power.bat	GOLAYA-SEXY.exe
File opened for modification	C:\Program Files (x86)\ustanovi menya plllll\life is life\everybody_lie_life_is_life.gol	GOLAYA-SEXY.exe
File created	C:\Program Files (x86)\ustanovi menya plllll\life is life\lethala fell blowsinisterby somefell.chanc	GOLAYA-SEXY.exe
File created	C:\Program Files (x86)\ustanovi menya plllll\life is life\Tocausetofallby.vbs	cmd.exe
File opened for modification	C:\Program Files (x86)\ustanovi menya plllll\life is life\Tocausetofallby.striking	GOLAYA-SEXY.exe
File created	C:\Program Files (x86)\ustanovi menya plllll\life is life\Uninstall.exe	GOLAYA-SEXY.exe
File opened for modification	C:\Program Files (x86)\ustanovi menya plllll\life is life\Uninstall.exe	GOLAYA-SEXY.exe
File created	C:\Program Files (x86)\ustanovi menya plllll\life is life\when_we_a_fill_the_power.bat	GOLAYA-SEXY.exe
File created	C:\Program Files (x86)\ustanovi menya plllll\life is life\Uninstall.ini	GOLAYA-SEXY.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2568 wrote to memory of 572	2568	GOLAYA-SEXY.exe	29
PID 2568 wrote to memory of 572	2568	GOLAYA-SEXY.exe	29
PID 2568 wrote to memory of 572	2568	GOLAYA-SEXY.exe	29
PID 2568 wrote to memory of 572	2568	GOLAYA-SEXY.exe	29
PID 2568 wrote to memory of 2324	2568	GOLAYA-SEXY.exe	31
PID 2568 wrote to memory of 2324	2568	GOLAYA-SEXY.exe	31
PID 2568 wrote to memory of 2324	2568	GOLAYA-SEXY.exe	31
PID 2568 wrote to memory of 2324	2568	GOLAYA-SEXY.exe	31

C:\Users\Admin\AppData\Local\Temp\GOLAYA-SEXY.exe
"C:\Users\Admin\AppData\Local\Temp\GOLAYA-SEXY.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2568
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Program Files (x86)\ustanovi menya plllll\life is life\when_we_a_fill_the_power.bat" "
  2⤵
  - Drops file in Drivers directory
  - Drops file in Program Files directory
  PID:572
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\ustanovi menya plllll\life is life\Tocausetofallby.vbs"
  2⤵
  - Blocklisted process makes network request
  - Drops file in Drivers directory
  PID:2324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\ustanovi menya plllll\life is life\Tocausetofallby.striking

Filesize
1KB

MD5
d5c95d3a186f4040987d0c223cb3658f

SHA1
5eb6e2da8b840a724122c7c5be0e23df4b531091

SHA256
bf3e62dcfe61f47ee835483a44f8bcef858204f11268ecab21f8ded205215816

SHA512
77468a47fbacdc590cbde28377e69e5a067081ca34d631a98b83cd219c5923d9c02a1bc123f6ddf264d02b0250133ba2c0d6b60a6e5139ab9e5991a2bb3153d3

Download Submit
C:\Program Files (x86)\ustanovi menya plllll\life is life\everybody_lie_life_is_life.gol

Filesize
112B

MD5
a97805a7dcdf57804ebce37d2599a681

SHA1
99cfacb04b6bbe087d6c46e3d920ba9ab0a4f056

SHA256
0c6fa09a4144b4313cd2a859b98b622f836c1ea311d84aca4dcd25f706d35039

SHA512
dca01920001d10435669e51f2ba65159e9997bc0e4a3f12e0b52b66061e402194d01ac8cfd74c53499cdf59aa9f6adf3fa0e5e73b6ef1d4c0e8a5bc9955ab1c9

Download Submit
C:\Program Files (x86)\ustanovi menya plllll\life is life\when_we_a_fill_the_power.bat

Filesize
1KB

MD5
61f1b7fb8a21fc4581e23fb2dc730b15

SHA1
5cabcd23be864415ef2f7d27df9441ffbbc1bf9d

SHA256
5ee1fe1b989948b2495be3e69d64c32979116574118236c49e456b6ae457cc05

SHA512
8258d12f1e46f1e3c1fcec3410a1f2f24a189b3dc3c132c36f6a910feaedc41a5d1790097a0cced4c15e00a76d964bf0b052ed8d50e8268a3303d5d99450df08

Download Submit
C:\Windows\System32\drivers\etc\hosts

Filesize
1KB

MD5
84329ca38521147bedbf96352ded8748

SHA1
ed0f088b1ea944f0e5feb88bbee6569f6d3d7ad4

SHA256
09b4e6bed5e704ec4c86dd0fe1832885e2754d39ae6e13983b2118e7ea6926b0

SHA512
f2ec192d3925a2889b164693a8907b878f155e9e66875be8d6b17545430c11eaf39bc23cd2896f5795a2e7cc050ca22b03c65da53b17186fc3419de51447d652

Download Submit
memory/2568-0-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2568-45-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2568-50-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download

Analysis

Sharing