8a873e0af2e3b2190420ce21cc529ecb38b2e93d23e84409a3aec2bdce27ab74

General

Target

GOLAYA-DEVOCHKA.exe
Size

238KB
MD5

abba37efd3a03df55c6a615e9762f9e5
SHA1

0cbd015b62ef4a188e29d5ccc82eff6dbb75e02e
SHA256

47a9d86207338ad60e9820fe3c947485290d6138540354fd741747395229875d
SHA512

31c133da63cde479a2e16a4472a8c9bdc98db41750bc594e4165e30c87767d845dd4ecd40e064760bc1e04208f267ba0c63a8651f7278b8c2c3d29b00159cf74
SSDEEP

3072:TBAp5XhKpN4eOyVTGfhEClj8jTk+0hFHPhnw4NSmNjxXyAIVragLR+ncvLn1l+C6:+bXE9OiTGfhEClq9cyHO9XFAugLKJJUm

Score

8^/10

discovery

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
3	316	WScript.exe

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	cmd.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	WScript.exe
File opened for modification	C:\Windows\System32\drivers\etc\hîsts	WScript.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	GOLAYA-DEVOCHKA.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\idol ya poka_\no_lover_simp\slooooowthespeedafer.cross	GOLAYA-DEVOCHKA.exe
File created	C:\Program Files (x86)\idol ya poka_\no_lover_simp\slooooowthespeedafer.vbs	cmd.exe
File created	C:\Program Files (x86)\idol ya poka_\no_lover_simp\Uninstall.exe	GOLAYA-DEVOCHKA.exe
File opened for modification	C:\Program Files (x86)\idol ya poka_\no_lover_simp\svezee_techenie_cheloveko.bat	GOLAYA-DEVOCHKA.exe
File opened for modification	C:\Program Files (x86)\idol ya poka_\no_lover_simp\xranilise_vsei_figni_tut.bok	GOLAYA-DEVOCHKA.exe
File opened for modification	C:\Program Files (x86)\idol ya poka_\no_lover_simp\Uninstall.exe	GOLAYA-DEVOCHKA.exe
File created	C:\Program Files (x86)\idol ya poka_\no_lover_simp\Uninstall.ini	GOLAYA-DEVOCHKA.exe
File created	C:\Program Files (x86)\idol ya poka_\no_lover_simp\svezee_techenie_cheloveko.bat	GOLAYA-DEVOCHKA.exe
File created	C:\Program Files (x86)\idol ya poka_\no_lover_simp\xranilise_vsei_figni_tut.bok	GOLAYA-DEVOCHKA.exe
File created	C:\Program Files (x86)\idol ya poka_\no_lover_simp\slooooowthespeedafer.cross	GOLAYA-DEVOCHKA.exe
File created	C:\Program Files (x86)\idol ya poka_\no_lover_simp\nu kak bi vsua hernya.fos	GOLAYA-DEVOCHKA.exe
File opened for modification	C:\Program Files (x86)\idol ya poka_\no_lover_simp\nu kak bi vsua hernya.fos	GOLAYA-DEVOCHKA.exe
File opened for modification	C:\Program Files (x86)\idol ya poka_\no_lover_simp\slooooowthespeedafer.vbs	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings	GOLAYA-DEVOCHKA.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3632 wrote to memory of 2272	3632	GOLAYA-DEVOCHKA.exe	84
PID 3632 wrote to memory of 2272	3632	GOLAYA-DEVOCHKA.exe	84
PID 3632 wrote to memory of 2272	3632	GOLAYA-DEVOCHKA.exe	84
PID 3632 wrote to memory of 316	3632	GOLAYA-DEVOCHKA.exe	86
PID 3632 wrote to memory of 316	3632	GOLAYA-DEVOCHKA.exe	86
PID 3632 wrote to memory of 316	3632	GOLAYA-DEVOCHKA.exe	86

C:\Users\Admin\AppData\Local\Temp\GOLAYA-DEVOCHKA.exe
"C:\Users\Admin\AppData\Local\Temp\GOLAYA-DEVOCHKA.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3632
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\idol ya poka_\no_lover_simp\svezee_techenie_cheloveko.bat" "
  2⤵
  - Drops file in Drivers directory
  - Drops file in Program Files directory
  PID:2272
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\idol ya poka_\no_lover_simp\slooooowthespeedafer.vbs"
  2⤵
  - Blocklisted process makes network request
  - Drops file in Drivers directory
  PID:316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\idol ya poka_\no_lover_simp\slooooowthespeedafer.cross

Filesize
1KB

MD5
f4b65959c7c31a3a31ca9f2080555910

SHA1
74aae7370da8db12001e4733a13eb8e01a21efd0

SHA256
a2b30b33d996b98e74fabe9761793438391e23b889663d03d682acbd708573d5

SHA512
f57792a60613d3d8335d679d3641ec4f577534dcde2a7256de2d2448a38ca87301aba678b3f6fc0e057f12eb51c74ef660367304c6d927b0ddfa7312912eb97e

Download Submit
C:\Program Files (x86)\idol ya poka_\no_lover_simp\svezee_techenie_cheloveko.bat

Filesize
1KB

MD5
6f8784f2b895a46ee40a54b47fad1349

SHA1
2b30224f5f893489f9ced2f7ba60f1d3668bba9f

SHA256
f982068db2c241f784a0ba831d664747d8445a0f5f91ee4d439fd4755e9daccd

SHA512
607f7370a664ae33111080deff3e5794de92ab55f165b259c39dba8c02190f93264bbbb0b3ef6032002ffdee4e674475957f48f1465684c52954878a0d6ec6bc

Download Submit
C:\Program Files (x86)\idol ya poka_\no_lover_simp\xranilise_vsei_figni_tut.bok

Filesize
99B

MD5
86dc7199339e9623d9cb19240a752740

SHA1
71cb2333efd767a21c031c23bb5b7e81115aff18

SHA256
c374079002e58508af7c8de08bf7e98b72a0d11b44650dcbb89f31d15e887370

SHA512
eee63bbf12c45ba73cfb543d0069288090410e91ef484587dde79995a585ef510d295d4de19701feb5704167b3d0ba01cf0a40f00c42abf29825e1f2bf917f5d

Download Submit
C:\Windows\System32\drivers\etc\hosts

Filesize
1KB

MD5
4fccb4d0b47dfce4da0002ee30fc74e6

SHA1
e5e9311650e7631800cd404d2aa7df00e4b169d3

SHA256
2554b9fc2dd8cdb75ac6e3650a9b5fe0b90d40a7bb04625b021aaf6d0e1a1499

SHA512
951e1f0a5636052f32b7990201cc1d855d8bef07fd247fe95f87dfc20c314c3945fecb549e402445543fadd60c5c46db4d028391a690c84bd6a8308d335adacd

Download Submit
memory/3632-39-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3632-41-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download

Analysis

Sharing