059fecdb8f1c3c9a6831be49efdd45cf852b4852bca4452fd6d1d8c8113e3b90

Analysis

max time kernel
2s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
11/01/2024, 23:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

GOLAYA-SEXY.exe
Size

180KB
MD5

05dcabe4947ada380eb48cf90eb0aa6f
SHA1

d11c9319a518ddc14dc62cc138d074b1d908c924
SHA256

53b296ba46752bf57d298dfe5ba8b011574253199e57ffd8c8786bb16f642f49
SHA512

a336ca962fe97f329fa6968e2532096a0051e5f124c20c7ba74d6688e5b15b2f34980b56f2b6f1e5ff3a53a05936510f22841279497ca50061e5c3fc55ea1614
SSDEEP

3072:nBAp5XhKpN4eOyVTGfhEClj8jTk+0hJiH8ga2EPb9ePlO7/IQ1bvatjKv5sK2DdH:qbXE9OiTGfhEClq9j8ga2+b9ePlO7/IR

Score

4^/10

Malware Config

Signatures

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\hulioeglesias\give me malchik\ebi_manya_kon\so_my_name_is_brus_dick.bat	GOLAYA-SEXY.exe
File opened for modification	C:\Program Files (x86)\hulioeglesias\give me malchik\kandyvi\krasota_ta_kakaya.vbs	GOLAYA-SEXY.exe
File opened for modification	C:\Program Files (x86)\hulioeglesias\give me malchik\kandyvi\prich4ki_pouuuuut.vbs	GOLAYA-SEXY.exe
File opened for modification	C:\Program Files (x86)\hulioeglesias\give me malchik\kandyvi\ebi_manya_kon.rud	GOLAYA-SEXY.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\GOLAYA-SEXY.exe
"C:\Users\Admin\AppData\Local\Temp\GOLAYA-SEXY.exe"
1⤵
- Drops file in Program Files directory
PID:3328
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\hulioeglesias\give me malchik\ebi_manya_kon\so_my_name_is_brus_dick.bat" "
  2⤵
  PID:2964
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\hulioeglesias\give me malchik\kandyvi\krasota_ta_kakaya.vbs"
  2⤵
  PID:4648
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\hulioeglesias\give me malchik\kandyvi\prich4ki_pouuuuut.vbs"
  2⤵
  PID:3048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\hulioeglesias\give me malchik\ebi_manya_kon\so_my_name_is_brus_dick.bat

Filesize
2KB

MD5
d515dbabc1d4148509640420b7a56dc7

SHA1
5e3c3c4ae1882bd0aef3d9a3cbd527f2fdad6cc1

SHA256
db87b544d4eb7fb04ab140aaa18afa2b985f1636b19605715d22db93a2369063

SHA512
0d5140346185c9ebcc2447b33e4c279449ed8c5ca7b9ec961135848a4317ee79093a3f514f77d9c18bb337ca367375f15ac7b00493d0ffe2ac99836a4a9f808c

Download Submit
C:\Program Files (x86)\hulioeglesias\give me malchik\kandyvi\ebi_manya_kon.rud

Filesize
33B

MD5
7d94f52916ecca6d3c68eb13ab68a2ab

SHA1
f40da9aa43d2208ab2ca0c0792572588b5f54c02

SHA256
354b2baf1b5a08368077e053984063a0a94736e16d3d77aa259e7d212e50b92a

SHA512
c15e0655df3a745949926ff7b783b565a137916a3dfc52f15698643ac8405223259d2ae7641e4d4ab572f926cd0b192a500ef10349cab60b1e92da838497fd0c

Download Submit
C:\Program Files (x86)\hulioeglesias\give me malchik\kandyvi\krasota_ta_kakaya.vbs

Filesize
899B

MD5
c99bcd3152c111c27332bfc299c30379

SHA1
114b6dff436d74f361d8ca0b5bd4978adc3e9346

SHA256
8c7cc60f62079e6e6970ad0930850c114b22ebf4214310d4401159782c0ce111

SHA512
0f7b76e06cb6a4b7bf4a137a8ff24d51d32d266df43c1be54cf6185c00bb9fb621b587f58281684dd583e1ca58d0343e8d507a96e186f6a635dc8ff964e312b8

Download Submit
C:\Program Files (x86)\hulioeglesias\give me malchik\kandyvi\prich4ki_pouuuuut.vbs

Filesize
700B

MD5
a7d73318a92af8e3cfc771049d3edfac

SHA1
d9c5ab0e91ea4c71d8d9591f2851ca9282e3523e

SHA256
20b0d215ab3b82e181190a170660f0e9f816b149169001e6ca2daa08101ff7be

SHA512
c313aceb921c76d6c3bf0b35bfadff5a2479781a588300340ead4258c0ba4d6adb29a566873e981f8fed44a53b7ec88611c1d4366cb873743b472ba8a4f449df

Download Submit
C:\Windows\System32\drivers\etc\hosts

Filesize
1KB

MD5
7b561e5093eb943dbad98e4e1c72f91a

SHA1
f9174925f52ee2c7d0e09bf4993d7b12c6d268bf

SHA256
60e809d41d5772e3e7b2555ab949160c831e889fb7eb99cc95baf201f0657212

SHA512
69487f6d604e8d47ece431439a147e1672a185c90a132649c30a3540458d331eedc9923c24fe8261f811602573f830d2f4ce99d716c0906d72ce9374d8acb78a

Download Submit
memory/3328-31-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download