ad2750aac2523be52197b6d427517d5dac150e0158441ecf77d447eef862cdf4

General

Target

GOLAYA-BABE.exe
Size

149KB
MD5

8038ebcd984916c69c58ede697dbe7b4
SHA1

94e4561a06e0b423bc5b76c49234a977a869aae8
SHA256

ae6226759da82fa559e63bc55b1e62a103c98fae2d246b81d43eae1826c99064
SHA512

1acbf5b396f5e88c85ad4e86cf25ad2722f681d42c31bdc113f66c70a8fa6015da20af4a0418e75fbdb350c09c80785fd08e2161b5cdb5ae067636e5715355bf
SSDEEP

3072:lBAp5XhKpN4eOyVTGfhEClj8jTk+0hi38puk4NUtjV:AbXE9OiTGfhEClq9qptV

Score

8^/10

discovery

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
3	2492	WScript.exe
7	2492	WScript.exe

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	cmd.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	WScript.exe
File opened for modification	C:\Windows\System32\drivers\etc\hîsts	WScript.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Company\NewProduct\slonik.po	GOLAYA-BABE.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\al99999.pp	GOLAYA-BABE.exe
File created	C:\Program Files (x86)\Company\NewProduct\al99999.vbs	cmd.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\al99999.vbs	cmd.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\hhhh.txt	GOLAYA-BABE.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\all2.vbs	GOLAYA-BABE.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\koollapsa.bat	GOLAYA-BABE.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\Uninstall.exe	GOLAYA-BABE.exe
File created	C:\Program Files (x86)\Company\NewProduct\Uninstall.ini	GOLAYA-BABE.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1028 wrote to memory of 2012	1028	GOLAYA-BABE.exe	28
PID 1028 wrote to memory of 2012	1028	GOLAYA-BABE.exe	28
PID 1028 wrote to memory of 2012	1028	GOLAYA-BABE.exe	28
PID 1028 wrote to memory of 2012	1028	GOLAYA-BABE.exe	28
PID 2012 wrote to memory of 2492	2012	cmd.exe	30
PID 2012 wrote to memory of 2492	2012	cmd.exe	30
PID 2012 wrote to memory of 2492	2012	cmd.exe	30
PID 2012 wrote to memory of 2492	2012	cmd.exe	30
PID 1028 wrote to memory of 2932	1028	GOLAYA-BABE.exe	31
PID 1028 wrote to memory of 2932	1028	GOLAYA-BABE.exe	31
PID 1028 wrote to memory of 2932	1028	GOLAYA-BABE.exe	31
PID 1028 wrote to memory of 2932	1028	GOLAYA-BABE.exe	31

C:\Users\Admin\AppData\Local\Temp\GOLAYA-BABE.exe
"C:\Users\Admin\AppData\Local\Temp\GOLAYA-BABE.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1028
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Program Files (x86)\Company\NewProduct\koollapsa.bat" "
  2⤵
  - Drops file in Drivers directory
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:2012
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Company\NewProduct\al99999.vbs"
    3⤵
    - Blocklisted process makes network request
    PID:2492
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Company\NewProduct\all2.vbs"
  2⤵
  - Drops file in Drivers directory
  PID:2932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Company\NewProduct\al99999.pp

Filesize
234B

MD5
dd1664a1bd6c20ff17e7ab15e00510ee

SHA1
1ebbcb2ef9c68141cd0d5ab5d348d6417c303a5e

SHA256
5cbd54d4928f6b5e68ab54046e015f10ae5d044a7a10d138f4a5b953707f0a43

SHA512
f13d1021ec90af9103665e9e5242af28e85137f83400931bc852c4f78bf2b25fc600b3e6cb4f48754cc37c78da729a7904d25af2130b76fa84a4f2fa82ecbadd

Download Submit
C:\Program Files (x86)\Company\NewProduct\all2.vbs

Filesize
758B

MD5
f146f415df0981d96d10be43c8042424

SHA1
2f4125b5312566d96079de4d5723879ee5c71ada

SHA256
2d443c61261981b7023dca06f82dde969dbef6bfabf2a3e5e643d166e3165dae

SHA512
a61f3252f5ebc90ea84262103ec03b26d93ec34dbf73a81e18e820c8fd2ecaafc0c184895f54314d54bc809528d37e8bba8859129117ca0a7ebf6646fa77080a

Download Submit
C:\Program Files (x86)\Company\NewProduct\hhhh.txt

Filesize
27B

MD5
213c0742081a9007c9093a01760f9f8c

SHA1
df53bb518c732df777b5ce19fc7c02dcb2f9d81b

SHA256
9681429a2b00c27fe6cb0453f255024813944a7cd460d18797e3c35e81c53d69

SHA512
55182c2e353a0027f585535a537b9c309c3bf57f47da54a16e0c415ed6633b725bf40e40a664b1071575feeb7e589d775983516728ec3e51e87a0a29010c4eb9

Download Submit
C:\Program Files (x86)\Company\NewProduct\koollapsa.bat

Filesize
2KB

MD5
97500c34cf7c2f6ab00e202bc4dd4229

SHA1
1386e443b33609143e94f13c42bacffb8e8c5126

SHA256
67fa3bea764831799e89d164c3eb29d408b9057b321e7745a18083201b106c9c

SHA512
0d0d73181b5743605c52704391961c57fb847fe92681222cfd98a500435ad8c47539b2ae6a0e988f69f17fc64d3fe5a68562298bde0e0dc956c0d365a2ae7350

Download Submit
C:\Program Files (x86)\Company\NewProduct\slonik.po

Filesize
42B

MD5
645762809de5650cae734e629a60c92e

SHA1
7a84e6c54c2c30b90ad7590fb285605e1a0fb21f

SHA256
9fb02cdb68a2deb143ff90f757c9275916dc912a90170a328ec08f23829d156f

SHA512
c7787ce50d0038c187798951b6b25d9e0afb51915b6d3bd98339cb8e4f4e4c1c4efa7829b32afa81d570b190535b1667486d1fdf04a65e32093a83480581212e

Download Submit
C:\Windows\System32\drivers\etc\hosts

Filesize
1KB

MD5
44ccd2e0f82c735fbef30c341d6bfc10

SHA1
8cc305f7f8fff401380175ae0cc7d0df99b83373

SHA256
d29b19381fbf3494195232c63a36e6a9d38de4e2db3e80ae3f007a36e9674db3

SHA512
8627b9c13415f5d9c917692281f2a33aa4286f0a50b0d08933ca663cd6cc12fb17256a2270ff283dd497661001b6c06f3d16e889215821659fa24ede367dfe07

Download Submit
memory/1028-73-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download

Analysis

Sharing