02b8478e00ac16c06a36eac7f0b1950f4a6c3594400181f80b2e93911374bc0a

General

Target

GOLAYA-TOPLESS.exe
Size

149KB
MD5

bb56c5bb89c3b94f370473b957aece84
SHA1

4139ddb92122333d61e57c97cbd75a91bd8a42ed
SHA256

b3928bb091873840a406cb0f0c3f5f35fb8c04d729b407672c498f6a78e74f8c
SHA512

ff6a55323b554e88d96d3ac29c9e0187f295af7c7065a2bf20b5fe494bdb3068f422142631bc39b24e4174957095e99afffa162065740934f17d94c6cab1a374
SSDEEP

3072:lBAp5XhKpN4eOyVTGfhEClj8jTk+0hiztfVOO0krXu:AbXE9OiTGfhEClq9pf76

Score

8^/10

discovery

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
36	4508	WScript.exe

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	cmd.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	WScript.exe
File opened for modification	C:\Windows\System32\drivers\etc\hîsts	WScript.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	GOLAYA-TOPLESS.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	cmd.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Produc\New\Uninstall.ini	GOLAYA-TOPLESS.exe
File opened for modification	C:\Program Files (x86)\Produc\New\nuashks.bat	GOLAYA-TOPLESS.exe
File opened for modification	C:\Program Files (x86)\Produc\New\nadopilitsa.nabazu	GOLAYA-TOPLESS.exe
File opened for modification	C:\Program Files (x86)\Produc\New\samisok.vbs	GOLAYA-TOPLESS.exe
File opened for modification	C:\Program Files (x86)\Produc\New\Uninstall.exe	GOLAYA-TOPLESS.exe
File created	C:\Program Files (x86)\Produc\New\nadopilitsa.vbs	cmd.exe
File opened for modification	C:\Program Files (x86)\Produc\New\nadopilitsa.vbs	cmd.exe
File opened for modification	C:\Program Files (x86)\Produc\New\poppets.txt	GOLAYA-TOPLESS.exe
File opened for modification	C:\Program Files (x86)\Produc\New\nevedomaya.hernya	GOLAYA-TOPLESS.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	GOLAYA-TOPLESS.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3756 wrote to memory of 3856	3756	GOLAYA-TOPLESS.exe	97
PID 3756 wrote to memory of 3856	3756	GOLAYA-TOPLESS.exe	97
PID 3756 wrote to memory of 3856	3756	GOLAYA-TOPLESS.exe	97
PID 3856 wrote to memory of 4508	3856	cmd.exe	99
PID 3856 wrote to memory of 4508	3856	cmd.exe	99
PID 3856 wrote to memory of 4508	3856	cmd.exe	99
PID 3756 wrote to memory of 2528	3756	GOLAYA-TOPLESS.exe	100
PID 3756 wrote to memory of 2528	3756	GOLAYA-TOPLESS.exe	100
PID 3756 wrote to memory of 2528	3756	GOLAYA-TOPLESS.exe	100

C:\Users\Admin\AppData\Local\Temp\GOLAYA-TOPLESS.exe
"C:\Users\Admin\AppData\Local\Temp\GOLAYA-TOPLESS.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3756
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\Produc\New\nuashks.bat" "
  2⤵
  - Drops file in Drivers directory
  - Checks computer location settings
  - Drops file in Program Files directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3856
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Produc\New\nadopilitsa.vbs"
    3⤵
    - Blocklisted process makes network request
    PID:4508
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Produc\New\samisok.vbs"
  2⤵
  - Drops file in Drivers directory
  PID:2528

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3540 --field-trial-handle=3088,i,14310325015283915034,7660943942870463106,262144 --variations-seed-version /prefetch:8
1⤵
PID:3844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Produc\New\nadopilitsa.nabazu

Filesize
234B

MD5
6c86f55825faf8d78c73a75593532b62

SHA1
b588b22149a5ea676e748637b5273df66874df94

SHA256
f0f5980f257615ea251f33cec0bb508210a348348b5384b9c72c969e26f854ec

SHA512
8f55b699454ac573d72c2488c39fd4935f569438929651afbfe911c8302fd2a9e29036a655118aa272d6e9664734c23b605ff61e440640c2cd9474c4373b6ef2

Download Submit
C:\Program Files (x86)\Produc\New\nevedomaya.hernya

Filesize
44B

MD5
909307255b6031a469dd1ee6bf4d3e88

SHA1
634ab51e9344f086c2270896d446530a34fac605

SHA256
e7ec60ff4476cd07a52c82818783ab82535187092b85eab3e33d7855c64d0ea7

SHA512
d69902aa1e5006c54fbc97f2fc8d62c522089d6d4b22c06070391a49c200566d6f8c1b9ddde4f5e402e6ce11a454a7a00a59d4521424f8d3515f134fa9c34a37

Download Submit
C:\Program Files (x86)\Produc\New\nuashks.bat

Filesize
3KB

MD5
5344c1ee5d19842f875b732e28d78df5

SHA1
3d6dd120c45c4e2c7da6e73d0d2a2bf44ab62c08

SHA256
4f444d593d36894b9f31ac5d34ed0da77dd193caeb08e59c6e0b9697a0404d05

SHA512
82eec69b768350757f6a1ad72b62d0ec800f90ddb8d264de06b8e3ba3c3eb7875acbd7d69f52e646fff4f6e1de42d47630379a6eec3984415a7446410bd998c1

Download Submit
C:\Program Files (x86)\Produc\New\poppets.txt

Filesize
27B

MD5
213c0742081a9007c9093a01760f9f8c

SHA1
df53bb518c732df777b5ce19fc7c02dcb2f9d81b

SHA256
9681429a2b00c27fe6cb0453f255024813944a7cd460d18797e3c35e81c53d69

SHA512
55182c2e353a0027f585535a537b9c309c3bf57f47da54a16e0c415ed6633b725bf40e40a664b1071575feeb7e589d775983516728ec3e51e87a0a29010c4eb9

Download Submit
C:\Program Files (x86)\Produc\New\samisok.vbs

Filesize
766B

MD5
d75b4ac2afa8da8d78931cb84e36f6b9

SHA1
5d17b6aace7772f0ea3a2abcf404267180460dd0

SHA256
fbdcd852e988e5356e979c673aa93b363c182545aadf03d02dcba556bacfaf43

SHA512
df5df025b16b1bce547f0ae3f5694e8856b68c2df3009cc6e96ce386fc263dd7a5c189f76baa386b825192fbf901a33ae2aec77f8ba17a1e8b029fe96cbf7f7c

Download Submit
C:\Windows\System32\drivers\etc\hosts

Filesize
1KB

MD5
d9a93296f8c62ab96271667c72d7a3b3

SHA1
abcf5a6ed773cfc978fc2176138778ad406c188a

SHA256
f6c84e7c7fced4ae3ee3ca143fd5e134a183eb1e2f67ab71a6e9a902596be993

SHA512
f91de9fbc57397c895aa1bda0ed18601711b1da377ceeee9d5a5ff48a4a3ba2e4feaacf3c64475c07daf584d6374e79d8206a49d1e25bc3044b2e4b6c7d4bd02

Download Submit
memory/3756-3-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/3756-57-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/3756-59-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download

Analysis

Sharing