c69f2c76e055788d4896956c8ed91e4d8d6f410f5c38e8bdd154bb727452f60a

General

Target

GOLAYA-DEVOCHKA.exe
Size

239KB
MD5

5ddfe645d3cbe2590b34e5afa2deb822
SHA1

df310df675c59e8958aef6ce041e78118696ad5e
SHA256

b13c0037e3ac532d246bd13e0e096509fd2fe9fa688de1bea39596368fa3341a
SHA512

ccd3706dcd7dba5543187ef6375d34eee6a07807046386f7ab0540583a9f583f583bcd7157f2c756dbb0c08f399c65aca20652ee698378d2e255cd41ce7e4ed4
SSDEEP

3072:cBAp5XhKpN4eOyVTGfhEClj8jTk+0h1Rqsrf6XFfuoyTNwTJSFya+Cgw5CKHG:LbXE9OiTGfhEClq9+6btJJUG

Score

8^/10

discovery

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
2	4512	WScript.exe

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	cmd.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	WScript.exe
File opened for modification	C:\Windows\System32\drivers\etc\hîsts	WScript.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation	GOLAYA-DEVOCHKA.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 13 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\loksjin serdchema\nedorosti samim\skolidbfwbfngpxvbbo3ignbglsnflhlsbsvgkblebrhbkfb.gggog	GOLAYA-DEVOCHKA.exe
File created	C:\Program Files (x86)\loksjin serdchema\nedorosti samim\Uninstall.ini	GOLAYA-DEVOCHKA.exe
File created	C:\Program Files (x86)\loksjin serdchema\nedorosti samim\lap_lap-kol_pois_oaloa.fok	GOLAYA-DEVOCHKA.exe
File opened for modification	C:\Program Files (x86)\loksjin serdchema\nedorosti samim\lap_lap-kol_pois_oaloa.fok	GOLAYA-DEVOCHKA.exe
File created	C:\Program Files (x86)\loksjin serdchema\nedorosti samim\skolidbfwbfngpxvbbo3ignbglsnflhlsbsvgkblebrhbkfb.vbs	cmd.exe
File created	C:\Program Files (x86)\loksjin serdchema\nedorosti samim\put_ya_flower_to_unita.bat	GOLAYA-DEVOCHKA.exe
File created	C:\Program Files (x86)\loksjin serdchema\nedorosti samim\Uninstall.exe	GOLAYA-DEVOCHKA.exe
File opened for modification	C:\Program Files (x86)\loksjin serdchema\nedorosti samim\Uninstall.exe	GOLAYA-DEVOCHKA.exe
File opened for modification	C:\Program Files (x86)\loksjin serdchema\nedorosti samim\skolidbfwbfngpxvbbo3ignbglsnflhlsbsvgkblebrhbkfb.vbs	cmd.exe
File opened for modification	C:\Program Files (x86)\loksjin serdchema\nedorosti samim\put_ya_flower_to_unita.bat	GOLAYA-DEVOCHKA.exe
File opened for modification	C:\Program Files (x86)\loksjin serdchema\nedorosti samim\10101010101010101010101010100101010101011010.la	GOLAYA-DEVOCHKA.exe
File opened for modification	C:\Program Files (x86)\loksjin serdchema\nedorosti samim\skolidbfwbfngpxvbbo3ignbglsnflhlsbsvgkblebrhbkfb.gggog	GOLAYA-DEVOCHKA.exe
File created	C:\Program Files (x86)\loksjin serdchema\nedorosti samim\10101010101010101010101010100101010101011010.la	GOLAYA-DEVOCHKA.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000_Classes\Local Settings	GOLAYA-DEVOCHKA.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5708 wrote to memory of 3496	5708	GOLAYA-DEVOCHKA.exe	85
PID 5708 wrote to memory of 3496	5708	GOLAYA-DEVOCHKA.exe	85
PID 5708 wrote to memory of 3496	5708	GOLAYA-DEVOCHKA.exe	85
PID 5708 wrote to memory of 4512	5708	GOLAYA-DEVOCHKA.exe	87
PID 5708 wrote to memory of 4512	5708	GOLAYA-DEVOCHKA.exe	87
PID 5708 wrote to memory of 4512	5708	GOLAYA-DEVOCHKA.exe	87

C:\Users\Admin\AppData\Local\Temp\GOLAYA-DEVOCHKA.exe
"C:\Users\Admin\AppData\Local\Temp\GOLAYA-DEVOCHKA.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5708
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\loksjin serdchema\nedorosti samim\put_ya_flower_to_unita.bat" "
  2⤵
  - Drops file in Drivers directory
  - Drops file in Program Files directory
  PID:3496
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\loksjin serdchema\nedorosti samim\skolidbfwbfngpxvbbo3ignbglsnflhlsbsvgkblebrhbkfb.vbs"
  2⤵
  - Blocklisted process makes network request
  - Drops file in Drivers directory
  PID:4512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\loksjin serdchema\nedorosti samim\lap_lap-kol_pois_oaloa.fok

Filesize
103B

MD5
90a3db669d194ce55dc278ad5444d289

SHA1
de18ca30d4bc3e7206b51ed4a9f552bf6a8e100f

SHA256
8c8703d8b4451afd261ec7759dfd658c15136becfdd8b89c419efa1ddac69d95

SHA512
f0030acf4281724f8ea6a0c538948d601eb953ed08147b71f12a62769ec94c05f1307534aa5839ab366edf7e0e5c20664eef4a55b627998bb8263fdba789a1d9

Download Submit
C:\Program Files (x86)\loksjin serdchema\nedorosti samim\put_ya_flower_to_unita.bat

Filesize
1KB

MD5
fcec908830aee9c8482588062b200acf

SHA1
c1a8454c1129790c36bc6e8a609c17b613284ef9

SHA256
259516df31d69f03603aa8065ecd4fdcf4eb76df9104caf04f275f41c05f9a5b

SHA512
e4561f1dfb572ad5024c3142d9b0e31447f7eb4fe0d34561927d58a4bea1fa5f5a9dd5558a713410d660c52e0ea2a2d772b89697a196d0f8eafc69b5f8c3844f

Download Submit
C:\Program Files (x86)\loksjin serdchema\nedorosti samim\skolidbfwbfngpxvbbo3ignbglsnflhlsbsvgkblebrhbkfb.gggog

Filesize
1KB

MD5
405191d4afee699f34ef70b0f00cde3c

SHA1
5bc00f7859a1cd28cae3a11991353a8d196b4ae0

SHA256
bebb34ffa33066a8488587318ba03c205eb0a26272e396703828199e73439d43

SHA512
81aa0e3e06910ce1a3b48beb0fd46fbc5ce9daa74331840e88abb36aa306b52d2f78f2caa8c5e79e024780df6e10e7523daff9bd7bf717d95d4b76cb613fec08

Download Submit
C:\Windows\System32\drivers\etc\hosts

Filesize
1KB

MD5
e895b77e7ccb25b85bced418a87608bd

SHA1
c7ca319ed930fb7451f3f71dd3cc28b447917630

SHA256
ff2cab78345bcf7b012854a3318bb2ff9469069b977c67d52b42f613f2bd4a1b

SHA512
696f37d0b5791cdde648b6ef93e5518f1861afd6b7c0f5d8ecd3d9e2773e3175c69c2b9ab9c392ec73ff03a74dacc08ddb090033dfa5d9de6140e82d444d2f85

Download Submit
memory/5708-39-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/5708-41-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download

Analysis

Sharing