801ab1617ef30de72c2cbda79d385a6e8f66940069b265b7ad0ccf1dfa15b69d

General

Target
GOLAYA-SEXY.exe
Size 240KB
Sample240224-syqahsgd6v
SHA256 fe9d78c0c394e248da57fc5693fe5cb0a759489c93ae300adef582f1069413c6
MD5 934d29283079d878fae23838ff5d156b
SHA1 773c0ba664625a4030af3b8ea321de5ee0e029c6
SHA512 d410f0196092ad17a00496a587cd135e610efd6af47091731be9040d9426e2d24641e5989dc753d4e9d7ba3f126f8f2ce467f006c303a659cfb8495c8c119fc2
SSDEEP 3072:4BAp5XhKpN4eOyVTGfhEClj8jTk+0hnbGsthRX1Tr+Cgw5CKHe:vbXE9OiTGfhEClq9uLhjyJJUe
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
9	1520	WScript.exe

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	cmd.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	WScript.exe
File opened for modification	C:\Windows\System32\drivers\etc\hîsts	WScript.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1712835645-2080934712-2142796781-1000\Control Panel\International\Geo\Nation	GOLAYA-SEXY.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1712835645-2080934712-2142796781-1000\Control Panel\International\Geo\Nation	cmd.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\snova holod\beskonechnaya\dobit.vbs	cmd.exe
File created	C:\Program Files (x86)\snova holod\beskonechnaya\chervyak.txt	GOLAYA-SEXY.exe
File created	C:\Program Files (x86)\snova holod\beskonechnaya\kak_zima.bat	GOLAYA-SEXY.exe
File created	C:\Program Files (x86)\snova holod\beskonechnaya\prihodi_ko_mne.vbs	GOLAYA-SEXY.exe
File created	C:\Program Files (x86)\snova holod\beskonechnaya\Uninstall.ini	GOLAYA-SEXY.exe
File opened for modification	C:\Program Files (x86)\snova holod\beskonechnaya\prihodi_ko_mne.vbs	GOLAYA-SEXY.exe
File opened for modification	C:\Program Files (x86)\snova holod\beskonechnaya\chervyak.txt	GOLAYA-SEXY.exe
File opened for modification	C:\Program Files (x86)\snova holod\beskonechnaya\snovabudet.axui	GOLAYA-SEXY.exe
File opened for modification	C:\Program Files (x86)\snova holod\beskonechnaya\dobit.normik	GOLAYA-SEXY.exe
File opened for modification	C:\Program Files (x86)\snova holod\beskonechnaya\3.exe	GOLAYA-SEXY.exe
File created	C:\Program Files (x86)\snova holod\beskonechnaya\dobit.vbs	cmd.exe
File opened for modification	C:\Program Files (x86)\snova holod\beskonechnaya\kak_zima.bat	GOLAYA-SEXY.exe
File created	C:\Program Files (x86)\snova holod\beskonechnaya\snovabudet.axui	GOLAYA-SEXY.exe
File created	C:\Program Files (x86)\snova holod\beskonechnaya\dobit.normik	GOLAYA-SEXY.exe
File created	C:\Program Files (x86)\snova holod\beskonechnaya\3.exe	GOLAYA-SEXY.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1712835645-2080934712-2142796781-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1712835645-2080934712-2142796781-1000_Classes\Local Settings	GOLAYA-SEXY.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4212 wrote to memory of 632	4212	GOLAYA-SEXY.exe	88
PID 4212 wrote to memory of 632	4212	GOLAYA-SEXY.exe	88
PID 4212 wrote to memory of 632	4212	GOLAYA-SEXY.exe	88
PID 632 wrote to memory of 1520	632	cmd.exe	92
PID 632 wrote to memory of 1520	632	cmd.exe	92
PID 632 wrote to memory of 1520	632	cmd.exe	92
PID 4212 wrote to memory of 2816	4212	GOLAYA-SEXY.exe	93
PID 4212 wrote to memory of 2816	4212	GOLAYA-SEXY.exe	93
PID 4212 wrote to memory of 2816	4212	GOLAYA-SEXY.exe	93

C:\Users\Admin\AppData\Local\Temp\GOLAYA-SEXY.exe
"C:\Users\Admin\AppData\Local\Temp\GOLAYA-SEXY.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4212
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\snova holod\beskonechnaya\kak_zima.bat" "
  2⤵
  - Drops file in Drivers directory
  - Checks computer location settings
  - Drops file in Program Files directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:632
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\snova holod\beskonechnaya\dobit.vbs"
    3⤵
    - Blocklisted process makes network request
    PID:1520
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\snova holod\beskonechnaya\prihodi_ko_mne.vbs"
  2⤵
  - Drops file in Drivers directory
  PID:2816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

chervyak.txt

Path C:\Program Files (x86)\snova holod\beskonechnaya\chervyak.txt
Size 27B
SHA256 9681429a2b00c27fe6cb0453f255024813944a7cd460d18797e3c35e81c53d69
MD5 213c0742081a9007c9093a01760f9f8c
SHA1 df53bb518c732df777b5ce19fc7c02dcb2f9d81b
SHA512 55182c2e353a0027f585535a537b9c309c3bf57f47da54a16e0c415ed6633b725bf40e40a664b1071575feeb7e589d775983516728ec3e51e87a0a29010c4eb9
MD5 SHA1 SHA512

Submit Download

dobit.vbs

Path C:\Program Files (x86)\snova holod\beskonechnaya\dobit.vbs
Size 216B
SHA256 8ccbd7ab5ea149cbe5e8f6c02a83a051cd3af1fcbf13e0b119f3493794dfbdf2
MD5 41ffde2af2fa5859ce6aa839370d6d91
SHA1 ea6b40dee843fb2da5426cca128e56f26517dc43
SHA512 27d0a6d918b0ecce88fe9e80e4f0a9f04a904693670325feb774120ee96384e525edbc4289e6bc6e394398a464474cb824ef7b2fa9b54ee5e2251551645bf74c
MD5 SHA1 SHA512

Submit Download

kak_zima.bat

Path C:\Program Files (x86)\snova holod\beskonechnaya\kak_zima.bat
Size 2KB
SHA256 a221c4308650abbcc41949592e0898e2fca9e6c24811b11525fb32900aeeca30
MD5 806ae060c82c3de9e0117b7291b6bb3a
SHA1 bc9050e4acf88ef35c53a4c2f6e0499d2fc1d896
SHA512 12093a2ae94f8c59df40eb1c18c3c4b739f8d9a1004f9bfc33c5b55cf8543d77037fdc45a417d06d86a13015e1153314e024dd83bb99cea73f1c0c947cc1a551
MD5 SHA1 SHA512

Submit Download

prihodi_ko_mne.vbs

Path C:\Program Files (x86)\snova holod\beskonechnaya\prihodi_ko_mne.vbs
Size 741B
SHA256 d10e7fde0640490062b98d3d53f1cb65dc02906e90a0b4cc8b698eccc6c51e7f
MD5 1310ee3d115fa438b2ad8a90adb248ad
SHA1 60cda736223211876c5d69238f9ec364359c5902
SHA512 a8b4af726190118147dcdf87081859c987af2e709944bc4dd0009f88d44d3bfe78978a4fdfd87d03bd6e7a65e14d2be8ab54eb715cb5aa850635da6f556422bb
MD5 SHA1 SHA512

Submit Download

snovabudet.axui

Path C:\Program Files (x86)\snova holod\beskonechnaya\snovabudet.axui
Size 69B
SHA256 199c7e48807b60549ad9146503628763eb09542dedfabb74fd5aeb7a0d52cfd6
MD5 337fd7f482967d86c608e11f07a2f086
SHA1 a7a9e3801775eb02f879a769ad306de48b402852
SHA512 a8f6c886eab8ce09a8c30be2461e34e1d6ac787658aa9454757ccd8f7f9f5df82a6d749a7d5d0b17dadfeb1b65a87d0a66e5d9b3b4bd0ba030735eb67ddbef7c
MD5 SHA1 SHA512

Submit Download

hosts

Path C:\Windows\System32\drivers\etc\hosts
Size 1KB
SHA256 0b4bb2b098ae8a8f62afaacaec63be4e8ec282e19c3b596df26efc8acb9d7295
MD5 c525250576e43ebdf6e507f70d33692c
SHA1 54bc4847d056796f486969729db4052e36ee5b0c
SHA512 a4bb591fa54a83e0eceb239fe7aa96e76511f4b045a0dbf21c700a51ffc53050160d69051b4ff6dd5877be411fefa11e6b44e97d6dbb397d0e4af08409e4ddf6
MD5 SHA1 SHA512

Submit Download

hosts

Path C:\Windows\System32\drivers\etc\hosts
Size 1KB
SHA256 f6c84e7c7fced4ae3ee3ca143fd5e134a183eb1e2f67ab71a6e9a902596be993
MD5 d9a93296f8c62ab96271667c72d7a3b3
SHA1 abcf5a6ed773cfc978fc2176138778ad406c188a
SHA512 f91de9fbc57397c895aa1bda0ed18601711b1da377ceeee9d5a5ff48a4a3ba2e4feaacf3c64475c07daf584d6374e79d8206a49d1e25bc3044b2e4b6c7d4bd02
MD5 SHA1 SHA512

Submit Download

memory/4212-49-0x0000000000400000-0x0000000000432000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads