2d3b9e20c3394c844bafd90436fe5f2b9f48f2db542ae1148d8d7902373f6358

General

Target

RUSSKAYA-GOLAYA.exe
Size

210KB
MD5

55c52c71c8a5b4b8f588a5f374efeffa
SHA1

421f679f5b796d77f5bd785377f72e7e168e48de
SHA256

d0941243d0cf16809f7338045a08686deba40f0ea436fb11202595eb1b1d34ae
SHA512

b2394c9f0eeb3d71f67ffc724e36f03da1e303bbec469fdf8663d163f096fe2788e29e5c10f64a5f27e042d8d73a7afea1ac697bf38da1aae44f8b125a738264
SSDEEP

3072:EBAp5XhKpN4eOyVTGfhEClj8jTk+0h8xwNhv4+Cgw5CKHG:TbXE9OiTGfhEClq9hwZJJUG

Score

8^/10

discovery

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
3	2460	WScript.exe
7	2460	WScript.exe

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	cmd.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	WScript.exe
File opened for modification	C:\Windows\System32\drivers\etc\hîsts	WScript.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 13 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\oni_voobshe_ohueli_haher\yarko_zeltie_vot_eto_da_bleat\Uninstall.ini	RUSSKAYA-GOLAYA.exe
File created	C:\Program Files (x86)\oni_voobshe_ohueli_haher\yarko_zeltie_vot_eto_da_bleat\netu_pokoya_mne_gore.vbs	cmd.exe
File opened for modification	C:\Program Files (x86)\oni_voobshe_ohueli_haher\yarko_zeltie_vot_eto_da_bleat\froggi_nogcci.bat	RUSSKAYA-GOLAYA.exe
File created	C:\Program Files (x86)\oni_voobshe_ohueli_haher\yarko_zeltie_vot_eto_da_bleat\pod_yasnim_nebom_yanvarya.pro	RUSSKAYA-GOLAYA.exe
File opened for modification	C:\Program Files (x86)\oni_voobshe_ohueli_haher\yarko_zeltie_vot_eto_da_bleat\netu_pokoya_mne_gore.tua	RUSSKAYA-GOLAYA.exe
File created	C:\Program Files (x86)\oni_voobshe_ohueli_haher\yarko_zeltie_vot_eto_da_bleat\Uninstall.exe	RUSSKAYA-GOLAYA.exe
File opened for modification	C:\Program Files (x86)\oni_voobshe_ohueli_haher\yarko_zeltie_vot_eto_da_bleat\netu_pokoya_mne_gore.vbs	cmd.exe
File created	C:\Program Files (x86)\oni_voobshe_ohueli_haher\yarko_zeltie_vot_eto_da_bleat\opasdkjsadflijsldf.wf	RUSSKAYA-GOLAYA.exe
File created	C:\Program Files (x86)\oni_voobshe_ohueli_haher\yarko_zeltie_vot_eto_da_bleat\froggi_nogcci.bat	RUSSKAYA-GOLAYA.exe
File opened for modification	C:\Program Files (x86)\oni_voobshe_ohueli_haher\yarko_zeltie_vot_eto_da_bleat\pod_yasnim_nebom_yanvarya.pro	RUSSKAYA-GOLAYA.exe
File created	C:\Program Files (x86)\oni_voobshe_ohueli_haher\yarko_zeltie_vot_eto_da_bleat\netu_pokoya_mne_gore.tua	RUSSKAYA-GOLAYA.exe
File opened for modification	C:\Program Files (x86)\oni_voobshe_ohueli_haher\yarko_zeltie_vot_eto_da_bleat\opasdkjsadflijsldf.wf	RUSSKAYA-GOLAYA.exe
File opened for modification	C:\Program Files (x86)\oni_voobshe_ohueli_haher\yarko_zeltie_vot_eto_da_bleat\Uninstall.exe	RUSSKAYA-GOLAYA.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1884 wrote to memory of 2668	1884	RUSSKAYA-GOLAYA.exe	28
PID 1884 wrote to memory of 2668	1884	RUSSKAYA-GOLAYA.exe	28
PID 1884 wrote to memory of 2668	1884	RUSSKAYA-GOLAYA.exe	28
PID 1884 wrote to memory of 2668	1884	RUSSKAYA-GOLAYA.exe	28
PID 1884 wrote to memory of 2460	1884	RUSSKAYA-GOLAYA.exe	30
PID 1884 wrote to memory of 2460	1884	RUSSKAYA-GOLAYA.exe	30
PID 1884 wrote to memory of 2460	1884	RUSSKAYA-GOLAYA.exe	30
PID 1884 wrote to memory of 2460	1884	RUSSKAYA-GOLAYA.exe	30

C:\Users\Admin\AppData\Local\Temp\RUSSKAYA-GOLAYA.exe
"C:\Users\Admin\AppData\Local\Temp\RUSSKAYA-GOLAYA.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1884
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Program Files (x86)\oni_voobshe_ohueli_haher\yarko_zeltie_vot_eto_da_bleat\froggi_nogcci.bat" "
  2⤵
  - Drops file in Drivers directory
  - Drops file in Program Files directory
  PID:2668
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\oni_voobshe_ohueli_haher\yarko_zeltie_vot_eto_da_bleat\netu_pokoya_mne_gore.vbs"
  2⤵
  - Blocklisted process makes network request
  - Drops file in Drivers directory
  PID:2460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\oni_voobshe_ohueli_haher\yarko_zeltie_vot_eto_da_bleat\froggi_nogcci.bat

Filesize
1KB

MD5
f054afa5f5d123ae38e7abe194f7a87d

SHA1
dec5e6adc48e0fbd39680ccd3af0219c9d246c12

SHA256
4f0c74b25e6329f09968bbd2f7c84ee52e70d1d483b94c701306467ae3a5a293

SHA512
8bdccfa538a17d62a1c27260d38384d2020eafbff8d97e8cc795468bda2992e1b7473cd92fb9f205b3ed2696ee141c240ab96de2158094456c7e9866fad9c386

Download Submit
C:\Program Files (x86)\oni_voobshe_ohueli_haher\yarko_zeltie_vot_eto_da_bleat\netu_pokoya_mne_gore.vbs

Filesize
1KB

MD5
9043ecb77cdbd1fd33fb87e41e06b8d0

SHA1
a6b19c1f971e377f30cab943550511560b55d473

SHA256
5017f0c1936f7276d0dea8efcfe6ec7a10a4fb008e06d07ca1e484777033f41f

SHA512
f58c6f29fb67825ff7f75bc3ea0c225549f4df3c0bab97e83a9999f6b58b7ab7bd13f700391ba7698f3d419bb911dc1e2ec1509bed3773dfaaff0e94d2d9fefc

Download Submit
C:\Program Files (x86)\oni_voobshe_ohueli_haher\yarko_zeltie_vot_eto_da_bleat\pod_yasnim_nebom_yanvarya.pro

Filesize
87B

MD5
2048e7f377827684952eac6638737664

SHA1
177f0e8e28f88204df60059d64c6ec3bc108a673

SHA256
e69334131aff4bd540d8972b135c0510f9e7e310c4513df87793923b464ae688

SHA512
624f4865cda8892e6521ff1878cb290b9329fd7eb82034b3224a0358678d2d6eaa20c287efbe69b6d6fcc654c2ee4a36d3235f688c817f44f0e67d6f55ad7916

Download Submit
C:\Windows\System32\drivers\etc\hosts

Filesize
1KB

MD5
876c58a010e3783aabbe07379cde0ceb

SHA1
9c575ffe423996c781b7ded17791bfb7d6e161f1

SHA256
68805ab47d88db2bd07456ac670c31a3484757d5daaeb4088a8a48ae8af760ee

SHA512
3340ab50fea94f0d956117a420e4b53efddbe023beb0db762abd89d4f6ddfe7577cd6afa164f4f13de880001d54dd345009af5b376066034be68af9edcf3f06f

Download Submit
memory/1884-44-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1884-48-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download

Analysis

Sharing