b91ff35eed56f8e8a9109484cef95e94c146a84324ca9deda1154947022ce7d3

General

Target

GOLAYA-BABE.exe
Size

180KB
MD5

2e7d20079b41b69b3b16ecbd895be189
SHA1

c63b1f1a9ec96ca7b0fc0d92bc082593e1df85e0
SHA256

8aac418dfae104c626385ba620705f3d8f83ad9753020474a7fd41db3e808fc6
SHA512

ab1326e5b177a7d32f7d97c0d3efce235df0da4d2b2faf40528fe399e0adccb6e7c67c2aac07f15294be6c23f12b966c9fc3135d9b8f561e99f10a5ad98532e9
SSDEEP

3072:TBAp5XhKpN4eOyVTGfhEClj8jTk+0h6eXmUS:+bXE9OiTGfhEClq9deXY

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
3	2332	WScript.exe
5	2332	WScript.exe

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	cmd.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	WScript.exe
File opened for modification	C:\Windows\System32\drivers\etc\hîsts	WScript.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\na ulisdf\take me tsdf\poztfiz\popizdota.dot	GOLAYA-BABE.exe
File opened for modification	C:\Program Files (x86)\na ulisdf\take me tsdf\333\why_do_you_cry_willy.bat	GOLAYA-BABE.exe
File opened for modification	C:\Program Files (x86)\na ulisdf\take me tsdf\poztfiz\____000000_hello__.vbs	GOLAYA-BABE.exe
File opened for modification	C:\Program Files (x86)\na ulisdf\take me tsdf\poztfiz\_hello______22222_______.vbs	GOLAYA-BABE.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 2768	2224	GOLAYA-BABE.exe	28
PID 2224 wrote to memory of 2768	2224	GOLAYA-BABE.exe	28
PID 2224 wrote to memory of 2768	2224	GOLAYA-BABE.exe	28
PID 2224 wrote to memory of 2768	2224	GOLAYA-BABE.exe	28
PID 2224 wrote to memory of 2700	2224	GOLAYA-BABE.exe	30
PID 2224 wrote to memory of 2700	2224	GOLAYA-BABE.exe	30
PID 2224 wrote to memory of 2700	2224	GOLAYA-BABE.exe	30
PID 2224 wrote to memory of 2700	2224	GOLAYA-BABE.exe	30
PID 2224 wrote to memory of 2332	2224	GOLAYA-BABE.exe	31
PID 2224 wrote to memory of 2332	2224	GOLAYA-BABE.exe	31
PID 2224 wrote to memory of 2332	2224	GOLAYA-BABE.exe	31
PID 2224 wrote to memory of 2332	2224	GOLAYA-BABE.exe	31

C:\Users\Admin\AppData\Local\Temp\GOLAYA-BABE.exe
"C:\Users\Admin\AppData\Local\Temp\GOLAYA-BABE.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Program Files (x86)\na ulisdf\take me tsdf\333\why_do_you_cry_willy.bat" "
  2⤵
  - Drops file in Drivers directory
  PID:2768
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\na ulisdf\take me tsdf\poztfiz\____000000_hello__.vbs"
  2⤵
  - Drops file in Drivers directory
  PID:2700
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\na ulisdf\take me tsdf\poztfiz\_hello______22222_______.vbs"
  2⤵
  - Blocklisted process makes network request
  PID:2332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\na ulisdf\take me tsdf\333\why_do_you_cry_willy.bat

Filesize
1KB

MD5
9d139d064933d01879a44984a43c0346

SHA1
81f546bb8d23151c07748f49d6d4f6e46bc3aca0

SHA256
2dcfbfd5c623fe341803f8be6ef66be4403af553c9312d46394e68f376c65467

SHA512
7765c000154d7af286dd8615640693b3be11f89f9d8001fa635c1e4cb12163f4dd97b481430f53b766fd1e551c6ff76499414732a51bd7f8a406d4c7ed669e8d

Download Submit
C:\Program Files (x86)\na ulisdf\take me tsdf\poztfiz\____000000_hello__.vbs

Filesize
832B

MD5
df76155dbd96ed3fba4dae39b11d380a

SHA1
b92763f66c212d74ce657d7063b12f037f71911f

SHA256
cec520a813dad4bbb36f79d09034dbd2a27fd42d6a26a3697c781600e8b179d7

SHA512
6f97a45b6042a1654c85bc9e2c2e6e65c94345a7e77dac442ef20052e0a15adc8f60af2664b3c034d99dd97d46f276183ce80beefc29fd22d6c4de791a93f0b9

Download Submit
C:\Program Files (x86)\na ulisdf\take me tsdf\poztfiz\_hello______22222_______.vbs

Filesize
620B

MD5
e3a6c856222acceb9bbb3f521b2d6f8a

SHA1
cafca047a208fe189513d7c206b453778d0564e1

SHA256
994947db4656545c01196676f84e8c1d866938e22986db53792a01c112955559

SHA512
bfed69e1c2bde450910651f699474ecaf022bef888db008a51f7ac60c0bba727faf3d5cb9261edc29a781d7791e2a8a5db317edeb4d8996909cf778bc2d429a3

Download Submit
C:\Program Files (x86)\na ulisdf\take me tsdf\poztfiz\popizdota.dot

Filesize
34B

MD5
aa5511a167a67e429a9fdf3ac25bce0e

SHA1
8ac961be922cdc3314ed342e809d68637e9ea1f2

SHA256
bcf768f1b7db9992ed293fee0d986033c0ed203ad7698cc3f0eec8faad6a4665

SHA512
736021521ab3062dd0b748fe989b942c52e2978e7d7313d66684518c4209a8816ccb7cd0229306c1f4fae1cac2c4d107fff52c9d027d4f04d0d4cb736ca53a10

Download Submit
C:\Windows\System32\drivers\etc\hosts

Filesize
1KB

MD5
25ee27baa31c59fdf6cf5d18955ef985

SHA1
51d4725afa6d997cb7347c60a7d17485a8fb2ea7

SHA256
75daf3b3c78bc2038351bee72d6036edf869f7106da7366722b1cd03f26f195d

SHA512
8a4e1f971b8158db5df7b24b8f0d317d2397209c21ab07c6e6014bc767bbc95e32093fb59e2e67369687c9ed024ff6d354652d02424a8050500a410369abe12e

Download Submit
memory/2224-40-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download

Analysis

Sharing