ff7c7256a0f4a9d1bdaf6a59111624c2d3e61fd940505aac64aef2c1654ae5b6

General

Target

GOLAYA-SEXY.exe
Size

180KB
MD5

b5bfc25ec5d0d2576975e6df14cee8f2
SHA1

ff48876248f0f0ff668aa7d67e2243bd9a3fd465
SHA256

e39b4d47bafb657aa37f821378b6140e21643173551f0c01adf8dbf4a3f0d748
SHA512

aaaafcad061f3ce56aeb0a636fb375dbb8eda5d34e4ce743037ff90ec00b3cd972bbf671881f0a3fb3ab9a03f0782944454f78eed2cf33c72aff2e758e52ce6f
SSDEEP

3072:fBAp5XhKpN4eOyVTGfhEClj8jTk+0hD+V64pfPFxI:ibXE9OiTGfhEClq9VzfPFa

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
3	2656	WScript.exe
5	2656	WScript.exe

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	cmd.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	WScript.exe
File opened for modification	C:\Windows\System32\drivers\etc\hîsts	WScript.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\na ulissdfsdf\take me devo4ka\ebi_manya_kon\so_my_name_is_brus_dick.bat	GOLAYA-SEXY.exe
File opened for modification	C:\Program Files (x86)\na ulissdfsdf\take me devo4ka\kandyvi\krasota_ta_kakaya.vbs	GOLAYA-SEXY.exe
File opened for modification	C:\Program Files (x86)\na ulissdfsdf\take me devo4ka\kandyvi\prich4ki_pouuuuut.vbs	GOLAYA-SEXY.exe
File opened for modification	C:\Program Files (x86)\na ulissdfsdf\take me devo4ka\kandyvi\ebi_manya_kon.rud	GOLAYA-SEXY.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2696 wrote to memory of 2512	2696	GOLAYA-SEXY.exe	28
PID 2696 wrote to memory of 2512	2696	GOLAYA-SEXY.exe	28
PID 2696 wrote to memory of 2512	2696	GOLAYA-SEXY.exe	28
PID 2696 wrote to memory of 2512	2696	GOLAYA-SEXY.exe	28
PID 2696 wrote to memory of 2676	2696	GOLAYA-SEXY.exe	30
PID 2696 wrote to memory of 2676	2696	GOLAYA-SEXY.exe	30
PID 2696 wrote to memory of 2676	2696	GOLAYA-SEXY.exe	30
PID 2696 wrote to memory of 2676	2696	GOLAYA-SEXY.exe	30
PID 2696 wrote to memory of 2656	2696	GOLAYA-SEXY.exe	31
PID 2696 wrote to memory of 2656	2696	GOLAYA-SEXY.exe	31
PID 2696 wrote to memory of 2656	2696	GOLAYA-SEXY.exe	31
PID 2696 wrote to memory of 2656	2696	GOLAYA-SEXY.exe	31

C:\Users\Admin\AppData\Local\Temp\GOLAYA-SEXY.exe
"C:\Users\Admin\AppData\Local\Temp\GOLAYA-SEXY.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2696
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Program Files (x86)\na ulissdfsdf\take me devo4ka\ebi_manya_kon\so_my_name_is_brus_dick.bat" "
  2⤵
  - Drops file in Drivers directory
  PID:2512
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\na ulissdfsdf\take me devo4ka\kandyvi\krasota_ta_kakaya.vbs"
  2⤵
  - Drops file in Drivers directory
  PID:2676
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\na ulissdfsdf\take me devo4ka\kandyvi\prich4ki_pouuuuut.vbs"
  2⤵
  - Blocklisted process makes network request
  PID:2656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\na ulissdfsdf\take me devo4ka\ebi_manya_kon\so_my_name_is_brus_dick.bat

Filesize
2KB

MD5
7d744cf5e580d72d8f5043d150d493c1

SHA1
3a6a8cc463a408e9962b05c939ff17feb5af6a14

SHA256
1e121e5015638fd024cc86bea8153a133fd53428b856a5abaf753eb46fdeb624

SHA512
f296a55289388ae855f2a32b6e5088a921af3d86d1c8bb57581ce77a52dbedc0e308bb256dcc01760a458cc0fadfb3b77a1bc7235d03be4a2690cd227140dc29

Download Submit
C:\Program Files (x86)\na ulissdfsdf\take me devo4ka\kandyvi\ebi_manya_kon.rud

Filesize
33B

MD5
7d94f52916ecca6d3c68eb13ab68a2ab

SHA1
f40da9aa43d2208ab2ca0c0792572588b5f54c02

SHA256
354b2baf1b5a08368077e053984063a0a94736e16d3d77aa259e7d212e50b92a

SHA512
c15e0655df3a745949926ff7b783b565a137916a3dfc52f15698643ac8405223259d2ae7641e4d4ab572f926cd0b192a500ef10349cab60b1e92da838497fd0c

Download Submit
C:\Program Files (x86)\na ulissdfsdf\take me devo4ka\kandyvi\krasota_ta_kakaya.vbs

Filesize
909B

MD5
7b492ffa8638ebfec98dc28d94d40b50

SHA1
b1c0142200aaecaa0ec81d915879265be6e429cb

SHA256
73ef3bffc757aa3b8b181a92a08f0c525996bac3a51935200690ac77e8e7be57

SHA512
be1b3563fc5c8b9c918ee217881bf00fdf4040d311dcca6a856526a5583e2dc538d86c25946dc30f19e02f2708e8bc2c28d645a7934b7f189a30f2556f67c77b

Download Submit
C:\Program Files (x86)\na ulissdfsdf\take me devo4ka\kandyvi\prich4ki_pouuuuut.vbs

Filesize
635B

MD5
a2d2ec3d8447064be489ff80607614eb

SHA1
15aa84b1a47f8f9c1a634bf0491172520008a3c7

SHA256
1e27c6d0bf78023e7156a02da0f5d91f6380e3caeca3b14b978c00de52c21969

SHA512
5a0d105f02b987706d869234bb8634cef297308463403fafaaa651e4f931bc59ee74ac1cb47b92390a0d1cb03d856372a6d55af3eb830fef4d44708c8a980530

Download Submit
C:\Windows\System32\drivers\etc\hosts

Filesize
1KB

MD5
25ee27baa31c59fdf6cf5d18955ef985

SHA1
51d4725afa6d997cb7347c60a7d17485a8fb2ea7

SHA256
75daf3b3c78bc2038351bee72d6036edf869f7106da7366722b1cd03f26f195d

SHA512
8a4e1f971b8158db5df7b24b8f0d317d2397209c21ab07c6e6014bc767bbc95e32093fb59e2e67369687c9ed024ff6d354652d02424a8050500a410369abe12e

Download Submit
memory/2696-35-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download

Analysis

Sharing