2573f431f36673bcbd1869f1efae587aac993404fee301c2fe43c122165de531

General

Target
GOLAYA-SEXY.exe
Size 180KB
Sample240128-pvr36aaga8
SHA256 ea286591122804d91a79ca2bc2a20d6272bd28359560ca6996a1d88aabdafca3
MD5 8c608ea2bc292f5c709636b7863ead50
SHA1 a6db5d61bef6be02a0108d2639585609cb25cbea
SHA512 d12607b0a2bd2ee182a9940b3f52263981122d73a9a19c1c55bdd56e39c4be82d56f1befb297d2426af67acb5d5ac153c8a109b575339ed71c5b77c524e3eb49
SSDEEP 3072:gBAp5XhKpN4eOyVTGfhEClj8jTk+0hf2oscVS8Br9cOO0JkW06C:XbXE9OiTGfhEClq9+2oscVS8Br9cOO02
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
10	4808	WScript.exe

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	cmd.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	WScript.exe
File opened for modification	C:\Windows\System32\drivers\etc\hîsts	WScript.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	GOLAYA-SEXY.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\primarily the African odfgm\Palm oil is an edible vegdfg\palm\Elaeioleiferandhemar.ipa	GOLAYA-SEXY.exe
File opened for modification	C:\Program Files (x86)\primarily the African odfgm\Palm oil is an edible vegdfg\palm\Crudepalmilutures.bat	GOLAYA-SEXY.exe
File opened for modification	C:\Program Files (x86)\primarily the African odfgm\Palm oil is an edible vegdfg\palm\yellowishfattyilobtained.vbs	GOLAYA-SEXY.exe
File opened for modification	C:\Program Files (x86)\primarily the African odfgm\Palm oil is an edible vegdfg\palm\conservationistsandother.vbs	GOLAYA-SEXY.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings	GOLAYA-SEXY.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4900 wrote to memory of 3248	4900	GOLAYA-SEXY.exe	83
PID 4900 wrote to memory of 3248	4900	GOLAYA-SEXY.exe	83
PID 4900 wrote to memory of 3248	4900	GOLAYA-SEXY.exe	83
PID 4900 wrote to memory of 3308	4900	GOLAYA-SEXY.exe	85
PID 4900 wrote to memory of 3308	4900	GOLAYA-SEXY.exe	85
PID 4900 wrote to memory of 3308	4900	GOLAYA-SEXY.exe	85
PID 4900 wrote to memory of 4808	4900	GOLAYA-SEXY.exe	86
PID 4900 wrote to memory of 4808	4900	GOLAYA-SEXY.exe	86
PID 4900 wrote to memory of 4808	4900	GOLAYA-SEXY.exe	86

C:\Users\Admin\AppData\Local\Temp\GOLAYA-SEXY.exe
"C:\Users\Admin\AppData\Local\Temp\GOLAYA-SEXY.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4900
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\primarily the African odfgm\Palm oil is an edible vegdfg\palm\Crudepalmilutures.bat" "
  2⤵
  - Drops file in Drivers directory
  PID:3248
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\primarily the African odfgm\Palm oil is an edible vegdfg\palm\yellowishfattyilobtained.vbs"
  2⤵
  - Drops file in Drivers directory
  PID:3308
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\primarily the African odfgm\Palm oil is an edible vegdfg\palm\conservationistsandother.vbs"
  2⤵
  - Blocklisted process makes network request
  PID:4808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Crudepalmilutures.bat

Path C:\Program Files (x86)\primarily the African odfgm\Palm oil is an edible vegdfg\palm\Crudepalmilutures.bat
Size 647B
SHA256 b587ba9cc779182f9614d3ac2fc238cb17b7c2882b29117b6d8b2aa7abb37c7d
MD5 81108cbcc6f47c6031e6409c2a64ae2e
SHA1 9005d5c715e7b2de7ebc856a15f9c5453b3522e5
SHA512 15df6cc76617d9d9285e2f7955fbd4da279f5c532cc7d5b4331f46b774904d3e7875be249d049ec38f0fe349219a7d539045a82e9218a5113e4e9b8af7e3c7dc
MD5 SHA1 SHA512

Submit Download

Elaeioleiferandhemar.ipa

Path C:\Program Files (x86)\primarily the African odfgm\Palm oil is an edible vegdfg\palm\Elaeioleiferandhemar.ipa
Size 71B
SHA256 f13162f2daacb18ca122acf96330a0df7596b73e63f0cf30a445e27126c739b4
MD5 b03811235166ed1db54892e4f4711966
SHA1 618efdba3d3cf2d2ec8e460ed3b8208523451e01
SHA512 9b79447dcb0d83ac9589e5bedb307020211ad05086bfdad8e8ab4d40132aef905081ba86926b648e1c4c3e856c0a07fcf81a3e57faadb734a8e1ce62170a8424
MD5 SHA1 SHA512

Submit Download

conservationistsandother.vbs

Path C:\Program Files (x86)\primarily the African odfgm\Palm oil is an edible vegdfg\palm\conservationistsandother.vbs
Size 501B
SHA256 6645790650560192f640524ffa19bf838098c6dc9712a4bdd7e038f7e2a33c82
MD5 7d339bc34979950d528e0b004906b6ff
SHA1 56e7a9132b3b3b89fb45c33a6b036a98a5e26abc
SHA512 b0fa19852edd28732ab19bfa8233082eed6e08f43a06b4b26c93d3348eb22680b43b6c92a43c3b281cb84a9841dc94f5b77c87450727db8df91554e66b8671b5
MD5 SHA1 SHA512

Submit Download

yellowishfattyilobtained.vbs

Path C:\Program Files (x86)\primarily the African odfgm\Palm oil is an edible vegdfg\palm\yellowishfattyilobtained.vbs
Size 642B
SHA256 7414caf157df194aec0da3eacaadf5becea1ce49be0511493d1ed51cb447880e
MD5 2420251a9092be41271baecef8e98bf7
SHA1 bdb7260078dd430bd68505ec0a84fbc079f7ef41
SHA512 bd0350be33a5c9c12fcb8422ba3ed0b86f3e8682f999c3c40384e4e514c0fe306ccff22f78940ad15be5865deaed283d12a18abfbb8eed47a657a36bba942674
MD5 SHA1 SHA512

Submit Download

hosts

Path C:\Windows\System32\drivers\etc\hosts
Size 1KB
SHA256 8f7a294349bd802db8991a3246f0d3153ff993e593249398f0b1342f97a49487
MD5 b39b3c6e849da2757406331d12729746
SHA1 3974776133b06047b01a16c818024e4d363ef1df
SHA512 b995db81214a871c92cac59a0e4a569be016c35bd6a571d7f1bbbcc0535ffb99f480e04fdff8af00bb7a172efe104d138c6153c2b20d8833c11209effb161e58
MD5 SHA1 SHA512

Submit Download

memory/4900-40-0x0000000000400000-0x0000000000432000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads