Analysis
-
max time kernel
2s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
11/01/2024, 23:19
Static task
static1
Behavioral task
behavioral1
Sample
GOLAYA-SEXY.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
GOLAYA-SEXY.exe
Resource
win10v2004-20231215-en
General
-
Target
GOLAYA-SEXY.exe
-
Size
180KB
-
MD5
05dcabe4947ada380eb48cf90eb0aa6f
-
SHA1
d11c9319a518ddc14dc62cc138d074b1d908c924
-
SHA256
53b296ba46752bf57d298dfe5ba8b011574253199e57ffd8c8786bb16f642f49
-
SHA512
a336ca962fe97f329fa6968e2532096a0051e5f124c20c7ba74d6688e5b15b2f34980b56f2b6f1e5ff3a53a05936510f22841279497ca50061e5c3fc55ea1614
-
SSDEEP
3072:nBAp5XhKpN4eOyVTGfhEClj8jTk+0hJiH8ga2EPb9ePlO7/IQ1bvatjKv5sK2DdH:qbXE9OiTGfhEClq9j8ga2+b9ePlO7/IR
Malware Config
Signatures
-
Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\hulioeglesias\give me malchik\ebi_manya_kon\so_my_name_is_brus_dick.bat GOLAYA-SEXY.exe File opened for modification C:\Program Files (x86)\hulioeglesias\give me malchik\kandyvi\krasota_ta_kakaya.vbs GOLAYA-SEXY.exe File opened for modification C:\Program Files (x86)\hulioeglesias\give me malchik\kandyvi\prich4ki_pouuuuut.vbs GOLAYA-SEXY.exe File opened for modification C:\Program Files (x86)\hulioeglesias\give me malchik\kandyvi\ebi_manya_kon.rud GOLAYA-SEXY.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
Processes
-
C:\Users\Admin\AppData\Local\Temp\GOLAYA-SEXY.exe"C:\Users\Admin\AppData\Local\Temp\GOLAYA-SEXY.exe"1⤵
- Drops file in Program Files directory
PID:3328 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\hulioeglesias\give me malchik\ebi_manya_kon\so_my_name_is_brus_dick.bat" "2⤵PID:2964
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\hulioeglesias\give me malchik\kandyvi\krasota_ta_kakaya.vbs"2⤵PID:4648
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\hulioeglesias\give me malchik\kandyvi\prich4ki_pouuuuut.vbs"2⤵PID:3048
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5d515dbabc1d4148509640420b7a56dc7
SHA15e3c3c4ae1882bd0aef3d9a3cbd527f2fdad6cc1
SHA256db87b544d4eb7fb04ab140aaa18afa2b985f1636b19605715d22db93a2369063
SHA5120d5140346185c9ebcc2447b33e4c279449ed8c5ca7b9ec961135848a4317ee79093a3f514f77d9c18bb337ca367375f15ac7b00493d0ffe2ac99836a4a9f808c
-
Filesize
33B
MD57d94f52916ecca6d3c68eb13ab68a2ab
SHA1f40da9aa43d2208ab2ca0c0792572588b5f54c02
SHA256354b2baf1b5a08368077e053984063a0a94736e16d3d77aa259e7d212e50b92a
SHA512c15e0655df3a745949926ff7b783b565a137916a3dfc52f15698643ac8405223259d2ae7641e4d4ab572f926cd0b192a500ef10349cab60b1e92da838497fd0c
-
Filesize
899B
MD5c99bcd3152c111c27332bfc299c30379
SHA1114b6dff436d74f361d8ca0b5bd4978adc3e9346
SHA2568c7cc60f62079e6e6970ad0930850c114b22ebf4214310d4401159782c0ce111
SHA5120f7b76e06cb6a4b7bf4a137a8ff24d51d32d266df43c1be54cf6185c00bb9fb621b587f58281684dd583e1ca58d0343e8d507a96e186f6a635dc8ff964e312b8
-
Filesize
700B
MD5a7d73318a92af8e3cfc771049d3edfac
SHA1d9c5ab0e91ea4c71d8d9591f2851ca9282e3523e
SHA25620b0d215ab3b82e181190a170660f0e9f816b149169001e6ca2daa08101ff7be
SHA512c313aceb921c76d6c3bf0b35bfadff5a2479781a588300340ead4258c0ba4d6adb29a566873e981f8fed44a53b7ec88611c1d4366cb873743b472ba8a4f449df
-
Filesize
1KB
MD57b561e5093eb943dbad98e4e1c72f91a
SHA1f9174925f52ee2c7d0e09bf4993d7b12c6d268bf
SHA25660e809d41d5772e3e7b2555ab949160c831e889fb7eb99cc95baf201f0657212
SHA51269487f6d604e8d47ece431439a147e1672a185c90a132649c30a3540458d331eedc9923c24fe8261f811602573f830d2f4ce99d716c0906d72ce9374d8acb78a