Analysis

  • max time kernel
    90s
  • max time network
    95s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/03/2024, 00:13

General

  • Target

    GOLAYA-DEVOCHKA.exe

  • Size

    238KB

  • MD5

    abba37efd3a03df55c6a615e9762f9e5

  • SHA1

    0cbd015b62ef4a188e29d5ccc82eff6dbb75e02e

  • SHA256

    47a9d86207338ad60e9820fe3c947485290d6138540354fd741747395229875d

  • SHA512

    31c133da63cde479a2e16a4472a8c9bdc98db41750bc594e4165e30c87767d845dd4ecd40e064760bc1e04208f267ba0c63a8651f7278b8c2c3d29b00159cf74

  • SSDEEP

    3072:TBAp5XhKpN4eOyVTGfhEClj8jTk+0hFHPhnw4NSmNjxXyAIVragLR+ncvLn1l+C6:+bXE9OiTGfhEClq9cyHO9XFAugLKJJUm

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Drops file in Drivers directory 3 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 13 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\GOLAYA-DEVOCHKA.exe
    "C:\Users\Admin\AppData\Local\Temp\GOLAYA-DEVOCHKA.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:3632
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\idol ya poka_\no_lover_simp\svezee_techenie_cheloveko.bat" "
      2⤵
      • Drops file in Drivers directory
      • Drops file in Program Files directory
      PID:2272
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\idol ya poka_\no_lover_simp\slooooowthespeedafer.vbs"
      2⤵
      • Blocklisted process makes network request
      • Drops file in Drivers directory
      PID:316

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\idol ya poka_\no_lover_simp\slooooowthespeedafer.cross

    Filesize

    1KB

    MD5

    f4b65959c7c31a3a31ca9f2080555910

    SHA1

    74aae7370da8db12001e4733a13eb8e01a21efd0

    SHA256

    a2b30b33d996b98e74fabe9761793438391e23b889663d03d682acbd708573d5

    SHA512

    f57792a60613d3d8335d679d3641ec4f577534dcde2a7256de2d2448a38ca87301aba678b3f6fc0e057f12eb51c74ef660367304c6d927b0ddfa7312912eb97e

  • C:\Program Files (x86)\idol ya poka_\no_lover_simp\svezee_techenie_cheloveko.bat

    Filesize

    1KB

    MD5

    6f8784f2b895a46ee40a54b47fad1349

    SHA1

    2b30224f5f893489f9ced2f7ba60f1d3668bba9f

    SHA256

    f982068db2c241f784a0ba831d664747d8445a0f5f91ee4d439fd4755e9daccd

    SHA512

    607f7370a664ae33111080deff3e5794de92ab55f165b259c39dba8c02190f93264bbbb0b3ef6032002ffdee4e674475957f48f1465684c52954878a0d6ec6bc

  • C:\Program Files (x86)\idol ya poka_\no_lover_simp\xranilise_vsei_figni_tut.bok

    Filesize

    99B

    MD5

    86dc7199339e9623d9cb19240a752740

    SHA1

    71cb2333efd767a21c031c23bb5b7e81115aff18

    SHA256

    c374079002e58508af7c8de08bf7e98b72a0d11b44650dcbb89f31d15e887370

    SHA512

    eee63bbf12c45ba73cfb543d0069288090410e91ef484587dde79995a585ef510d295d4de19701feb5704167b3d0ba01cf0a40f00c42abf29825e1f2bf917f5d

  • C:\Windows\System32\drivers\etc\hosts

    Filesize

    1KB

    MD5

    4fccb4d0b47dfce4da0002ee30fc74e6

    SHA1

    e5e9311650e7631800cd404d2aa7df00e4b169d3

    SHA256

    2554b9fc2dd8cdb75ac6e3650a9b5fe0b90d40a7bb04625b021aaf6d0e1a1499

    SHA512

    951e1f0a5636052f32b7990201cc1d855d8bef07fd247fe95f87dfc20c314c3945fecb549e402445543fadd60c5c46db4d028391a690c84bd6a8308d335adacd

  • memory/3632-39-0x0000000000400000-0x0000000000432000-memory.dmp

    Filesize

    200KB

  • memory/3632-41-0x0000000000400000-0x0000000000432000-memory.dmp

    Filesize

    200KB