4789bc2b5d8584085cff6869f61f5b75a0d995df5d883b78e1933b716c495c2f

General

Target

GOLAYA-SEXY.exe
Size

239KB
MD5

f4eeb055f29a903de30886496d2399d0
SHA1

3f10e04a7b1884382759b252f294b6db527877c6
SHA256

802a092b98f19900cc472c08f9bc07009f16197d15f66273be6ae7fe77df0456
SHA512

d77d6fca5c1297816150b21c1c1f71080a273a2512dd657a2eff159070ff66c8fd9b7531c2f0230f489fec35a12646f9940fc3d3d4ba00b2a191a1c84454a567
SSDEEP

6144:sbXE9OiTGfhEClq9zrd52hTDOC661lYQawJJUq:IU9Xiuix1lYQaS

Score

8^/10

discovery

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
58	1568	WScript.exe

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	cmd.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	WScript.exe
File opened for modification	C:\Windows\System32\drivers\etc\hîsts	WScript.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Control Panel\International\Geo\Nation	GOLAYA-SEXY.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 13 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ustanovi menya plllll\life is life\Uninstall.exe	GOLAYA-SEXY.exe
File created	C:\Program Files (x86)\ustanovi menya plllll\life is life\Uninstall.ini	GOLAYA-SEXY.exe
File created	C:\Program Files (x86)\ustanovi menya plllll\life is life\when_we_a_fill_the_power.bat	GOLAYA-SEXY.exe
File opened for modification	C:\Program Files (x86)\ustanovi menya plllll\life is life\everybody_lie_life_is_life.gol	GOLAYA-SEXY.exe
File created	C:\Program Files (x86)\ustanovi menya plllll\life is life\lethala fell blowsinisterby somefell.chanc	GOLAYA-SEXY.exe
File opened for modification	C:\Program Files (x86)\ustanovi menya plllll\life is life\lethala fell blowsinisterby somefell.chanc	GOLAYA-SEXY.exe
File created	C:\Program Files (x86)\ustanovi menya plllll\life is life\everybody_lie_life_is_life.gol	GOLAYA-SEXY.exe
File opened for modification	C:\Program Files (x86)\ustanovi menya plllll\life is life\Uninstall.exe	GOLAYA-SEXY.exe
File opened for modification	C:\Program Files (x86)\ustanovi menya plllll\life is life\when_we_a_fill_the_power.bat	GOLAYA-SEXY.exe
File created	C:\Program Files (x86)\ustanovi menya plllll\life is life\Tocausetofallby.vbs	cmd.exe
File created	C:\Program Files (x86)\ustanovi menya plllll\life is life\Tocausetofallby.striking	GOLAYA-SEXY.exe
File opened for modification	C:\Program Files (x86)\ustanovi menya plllll\life is life\Tocausetofallby.striking	GOLAYA-SEXY.exe
File opened for modification	C:\Program Files (x86)\ustanovi menya plllll\life is life\Tocausetofallby.vbs	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\Local Settings	GOLAYA-SEXY.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4568 wrote to memory of 4692	4568	GOLAYA-SEXY.exe	92
PID 4568 wrote to memory of 4692	4568	GOLAYA-SEXY.exe	92
PID 4568 wrote to memory of 4692	4568	GOLAYA-SEXY.exe	92
PID 4568 wrote to memory of 1568	4568	GOLAYA-SEXY.exe	94
PID 4568 wrote to memory of 1568	4568	GOLAYA-SEXY.exe	94
PID 4568 wrote to memory of 1568	4568	GOLAYA-SEXY.exe	94

C:\Users\Admin\AppData\Local\Temp\GOLAYA-SEXY.exe
"C:\Users\Admin\AppData\Local\Temp\GOLAYA-SEXY.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4568
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\ustanovi menya plllll\life is life\when_we_a_fill_the_power.bat" "
  2⤵
  - Drops file in Drivers directory
  - Drops file in Program Files directory
  PID:4692
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\ustanovi menya plllll\life is life\Tocausetofallby.vbs"
  2⤵
  - Blocklisted process makes network request
  - Drops file in Drivers directory
  PID:1568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\ustanovi menya plllll\life is life\Tocausetofallby.vbs

Filesize
1KB

MD5
d5c95d3a186f4040987d0c223cb3658f

SHA1
5eb6e2da8b840a724122c7c5be0e23df4b531091

SHA256
bf3e62dcfe61f47ee835483a44f8bcef858204f11268ecab21f8ded205215816

SHA512
77468a47fbacdc590cbde28377e69e5a067081ca34d631a98b83cd219c5923d9c02a1bc123f6ddf264d02b0250133ba2c0d6b60a6e5139ab9e5991a2bb3153d3

Download Submit
C:\Program Files (x86)\ustanovi menya plllll\life is life\everybody_lie_life_is_life.gol

Filesize
112B

MD5
a97805a7dcdf57804ebce37d2599a681

SHA1
99cfacb04b6bbe087d6c46e3d920ba9ab0a4f056

SHA256
0c6fa09a4144b4313cd2a859b98b622f836c1ea311d84aca4dcd25f706d35039

SHA512
dca01920001d10435669e51f2ba65159e9997bc0e4a3f12e0b52b66061e402194d01ac8cfd74c53499cdf59aa9f6adf3fa0e5e73b6ef1d4c0e8a5bc9955ab1c9

Download Submit
C:\Program Files (x86)\ustanovi menya plllll\life is life\when_we_a_fill_the_power.bat

Filesize
1KB

MD5
61f1b7fb8a21fc4581e23fb2dc730b15

SHA1
5cabcd23be864415ef2f7d27df9441ffbbc1bf9d

SHA256
5ee1fe1b989948b2495be3e69d64c32979116574118236c49e456b6ae457cc05

SHA512
8258d12f1e46f1e3c1fcec3410a1f2f24a189b3dc3c132c36f6a910feaedc41a5d1790097a0cced4c15e00a76d964bf0b052ed8d50e8268a3303d5d99450df08

Download Submit
C:\Windows\System32\drivers\etc\hosts

Filesize
1KB

MD5
5c9f2cf9a434cffc0c3f8e62cf5c7f06

SHA1
2dd4e8cea4c11fb80db492f882164860dbf4a20e

SHA256
167f555a90c154b0da88098d9c5358d9fd3a878445819c72cc6fcca34cb49827

SHA512
e19d37a8f00b8e1f644bbd49c71eb5c96c0f8117fd799b9fb33b75e456d12bb1bde0f5243a13cabe0eb32b31ee86ce4e2add9576ab2bafae6106ab82e614f72a

Download Submit
memory/4568-0-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4568-38-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4568-45-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download

Analysis

Sharing