c69f2c76e055788d4896956c8ed91e4d8d6f410f5c38e8bdd154bb727452f60a

General

Target

GOLAYA-DEVOCHKA.exe
Size

239KB
MD5

5ddfe645d3cbe2590b34e5afa2deb822
SHA1

df310df675c59e8958aef6ce041e78118696ad5e
SHA256

b13c0037e3ac532d246bd13e0e096509fd2fe9fa688de1bea39596368fa3341a
SHA512

ccd3706dcd7dba5543187ef6375d34eee6a07807046386f7ab0540583a9f583f583bcd7157f2c756dbb0c08f399c65aca20652ee698378d2e255cd41ce7e4ed4
SSDEEP

3072:cBAp5XhKpN4eOyVTGfhEClj8jTk+0h1Rqsrf6XFfuoyTNwTJSFya+Cgw5CKHG:LbXE9OiTGfhEClq9+6btJJUG

Score

8^/10

discovery

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
3	2668	WScript.exe
7	2668	WScript.exe

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	cmd.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	WScript.exe
File opened for modification	C:\Windows\System32\drivers\etc\hîsts	WScript.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\loksjin serdchema\nedorosti samim\put_ya_flower_to_unita.bat	GOLAYA-DEVOCHKA.exe
File opened for modification	C:\Program Files (x86)\loksjin serdchema\nedorosti samim\10101010101010101010101010100101010101011010.la	GOLAYA-DEVOCHKA.exe
File created	C:\Program Files (x86)\loksjin serdchema\nedorosti samim\Uninstall.ini	GOLAYA-DEVOCHKA.exe
File created	C:\Program Files (x86)\loksjin serdchema\nedorosti samim\put_ya_flower_to_unita.bat	GOLAYA-DEVOCHKA.exe
File created	C:\Program Files (x86)\loksjin serdchema\nedorosti samim\skolidbfwbfngpxvbbo3ignbglsnflhlsbsvgkblebrhbkfb.gggog	GOLAYA-DEVOCHKA.exe
File opened for modification	C:\Program Files (x86)\loksjin serdchema\nedorosti samim\skolidbfwbfngpxvbbo3ignbglsnflhlsbsvgkblebrhbkfb.vbs	cmd.exe
File created	C:\Program Files (x86)\loksjin serdchema\nedorosti samim\lap_lap-kol_pois_oaloa.fok	GOLAYA-DEVOCHKA.exe
File opened for modification	C:\Program Files (x86)\loksjin serdchema\nedorosti samim\lap_lap-kol_pois_oaloa.fok	GOLAYA-DEVOCHKA.exe
File opened for modification	C:\Program Files (x86)\loksjin serdchema\nedorosti samim\skolidbfwbfngpxvbbo3ignbglsnflhlsbsvgkblebrhbkfb.gggog	GOLAYA-DEVOCHKA.exe
File created	C:\Program Files (x86)\loksjin serdchema\nedorosti samim\Uninstall.exe	GOLAYA-DEVOCHKA.exe
File opened for modification	C:\Program Files (x86)\loksjin serdchema\nedorosti samim\Uninstall.exe	GOLAYA-DEVOCHKA.exe
File created	C:\Program Files (x86)\loksjin serdchema\nedorosti samim\skolidbfwbfngpxvbbo3ignbglsnflhlsbsvgkblebrhbkfb.vbs	cmd.exe
File created	C:\Program Files (x86)\loksjin serdchema\nedorosti samim\10101010101010101010101010100101010101011010.la	GOLAYA-DEVOCHKA.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1220 wrote to memory of 2720	1220	GOLAYA-DEVOCHKA.exe	28
PID 1220 wrote to memory of 2720	1220	GOLAYA-DEVOCHKA.exe	28
PID 1220 wrote to memory of 2720	1220	GOLAYA-DEVOCHKA.exe	28
PID 1220 wrote to memory of 2720	1220	GOLAYA-DEVOCHKA.exe	28
PID 1220 wrote to memory of 2668	1220	GOLAYA-DEVOCHKA.exe	30
PID 1220 wrote to memory of 2668	1220	GOLAYA-DEVOCHKA.exe	30
PID 1220 wrote to memory of 2668	1220	GOLAYA-DEVOCHKA.exe	30
PID 1220 wrote to memory of 2668	1220	GOLAYA-DEVOCHKA.exe	30

C:\Users\Admin\AppData\Local\Temp\GOLAYA-DEVOCHKA.exe
"C:\Users\Admin\AppData\Local\Temp\GOLAYA-DEVOCHKA.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1220
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Program Files (x86)\loksjin serdchema\nedorosti samim\put_ya_flower_to_unita.bat" "
  2⤵
  - Drops file in Drivers directory
  - Drops file in Program Files directory
  PID:2720
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\loksjin serdchema\nedorosti samim\skolidbfwbfngpxvbbo3ignbglsnflhlsbsvgkblebrhbkfb.vbs"
  2⤵
  - Blocklisted process makes network request
  - Drops file in Drivers directory
  PID:2668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\loksjin serdchema\nedorosti samim\lap_lap-kol_pois_oaloa.fok

Filesize
103B

MD5
90a3db669d194ce55dc278ad5444d289

SHA1
de18ca30d4bc3e7206b51ed4a9f552bf6a8e100f

SHA256
8c8703d8b4451afd261ec7759dfd658c15136becfdd8b89c419efa1ddac69d95

SHA512
f0030acf4281724f8ea6a0c538948d601eb953ed08147b71f12a62769ec94c05f1307534aa5839ab366edf7e0e5c20664eef4a55b627998bb8263fdba789a1d9

Download Submit
C:\Program Files (x86)\loksjin serdchema\nedorosti samim\put_ya_flower_to_unita.bat

Filesize
1KB

MD5
fcec908830aee9c8482588062b200acf

SHA1
c1a8454c1129790c36bc6e8a609c17b613284ef9

SHA256
259516df31d69f03603aa8065ecd4fdcf4eb76df9104caf04f275f41c05f9a5b

SHA512
e4561f1dfb572ad5024c3142d9b0e31447f7eb4fe0d34561927d58a4bea1fa5f5a9dd5558a713410d660c52e0ea2a2d772b89697a196d0f8eafc69b5f8c3844f

Download Submit
C:\Program Files (x86)\loksjin serdchema\nedorosti samim\skolidbfwbfngpxvbbo3ignbglsnflhlsbsvgkblebrhbkfb.gggog

Filesize
1KB

MD5
405191d4afee699f34ef70b0f00cde3c

SHA1
5bc00f7859a1cd28cae3a11991353a8d196b4ae0

SHA256
bebb34ffa33066a8488587318ba03c205eb0a26272e396703828199e73439d43

SHA512
81aa0e3e06910ce1a3b48beb0fd46fbc5ce9daa74331840e88abb36aa306b52d2f78f2caa8c5e79e024780df6e10e7523daff9bd7bf717d95d4b76cb613fec08

Download Submit
C:\Windows\System32\drivers\etc\hosts

Filesize
1KB

MD5
309c7178e2195b972b784e50db5925a4

SHA1
27c1550c18e6256d3a4b3d67333357ae351c2724

SHA256
ccdb95990894605be29c48788b2d0e3a9c7c5234713a721be113875abbc2d39b

SHA512
20bd6eb120f1651971e5fce8a29761f4cfe45508e423bb81e3b85d7f8809b49ee71f16fcc74a14ad1f6fee421bcce661cb100ee275bf9d40c1754894ff817e5b

Download Submit
memory/1220-44-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1220-48-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download

Analysis

Sharing