2d3b9e20c3394c844bafd90436fe5f2b9f48f2db542ae1148d8d7902373f6358

General

Target

RUSSKAYA-GOLAYA.exe
Size

210KB
MD5

55c52c71c8a5b4b8f588a5f374efeffa
SHA1

421f679f5b796d77f5bd785377f72e7e168e48de
SHA256

d0941243d0cf16809f7338045a08686deba40f0ea436fb11202595eb1b1d34ae
SHA512

b2394c9f0eeb3d71f67ffc724e36f03da1e303bbec469fdf8663d163f096fe2788e29e5c10f64a5f27e042d8d73a7afea1ac697bf38da1aae44f8b125a738264
SSDEEP

3072:EBAp5XhKpN4eOyVTGfhEClj8jTk+0h8xwNhv4+Cgw5CKHG:TbXE9OiTGfhEClq9hwZJJUG

Score

8^/10

discovery

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
7	644	WScript.exe

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	cmd.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	WScript.exe
File opened for modification	C:\Windows\System32\drivers\etc\hîsts	WScript.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation	RUSSKAYA-GOLAYA.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 13 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\oni_voobshe_ohueli_haher\yarko_zeltie_vot_eto_da_bleat\opasdkjsadflijsldf.wf	RUSSKAYA-GOLAYA.exe
File created	C:\Program Files (x86)\oni_voobshe_ohueli_haher\yarko_zeltie_vot_eto_da_bleat\Uninstall.ini	RUSSKAYA-GOLAYA.exe
File opened for modification	C:\Program Files (x86)\oni_voobshe_ohueli_haher\yarko_zeltie_vot_eto_da_bleat\pod_yasnim_nebom_yanvarya.pro	RUSSKAYA-GOLAYA.exe
File created	C:\Program Files (x86)\oni_voobshe_ohueli_haher\yarko_zeltie_vot_eto_da_bleat\netu_pokoya_mne_gore.tua	RUSSKAYA-GOLAYA.exe
File opened for modification	C:\Program Files (x86)\oni_voobshe_ohueli_haher\yarko_zeltie_vot_eto_da_bleat\netu_pokoya_mne_gore.tua	RUSSKAYA-GOLAYA.exe
File opened for modification	C:\Program Files (x86)\oni_voobshe_ohueli_haher\yarko_zeltie_vot_eto_da_bleat\opasdkjsadflijsldf.wf	RUSSKAYA-GOLAYA.exe
File opened for modification	C:\Program Files (x86)\oni_voobshe_ohueli_haher\yarko_zeltie_vot_eto_da_bleat\Uninstall.exe	RUSSKAYA-GOLAYA.exe
File created	C:\Program Files (x86)\oni_voobshe_ohueli_haher\yarko_zeltie_vot_eto_da_bleat\netu_pokoya_mne_gore.vbs	cmd.exe
File created	C:\Program Files (x86)\oni_voobshe_ohueli_haher\yarko_zeltie_vot_eto_da_bleat\pod_yasnim_nebom_yanvarya.pro	RUSSKAYA-GOLAYA.exe
File opened for modification	C:\Program Files (x86)\oni_voobshe_ohueli_haher\yarko_zeltie_vot_eto_da_bleat\netu_pokoya_mne_gore.vbs	cmd.exe
File created	C:\Program Files (x86)\oni_voobshe_ohueli_haher\yarko_zeltie_vot_eto_da_bleat\froggi_nogcci.bat	RUSSKAYA-GOLAYA.exe
File opened for modification	C:\Program Files (x86)\oni_voobshe_ohueli_haher\yarko_zeltie_vot_eto_da_bleat\froggi_nogcci.bat	RUSSKAYA-GOLAYA.exe
File created	C:\Program Files (x86)\oni_voobshe_ohueli_haher\yarko_zeltie_vot_eto_da_bleat\Uninstall.exe	RUSSKAYA-GOLAYA.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings	RUSSKAYA-GOLAYA.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1380 wrote to memory of 4264	1380	RUSSKAYA-GOLAYA.exe	89
PID 1380 wrote to memory of 4264	1380	RUSSKAYA-GOLAYA.exe	89
PID 1380 wrote to memory of 4264	1380	RUSSKAYA-GOLAYA.exe	89
PID 1380 wrote to memory of 644	1380	RUSSKAYA-GOLAYA.exe	91
PID 1380 wrote to memory of 644	1380	RUSSKAYA-GOLAYA.exe	91
PID 1380 wrote to memory of 644	1380	RUSSKAYA-GOLAYA.exe	91

C:\Users\Admin\AppData\Local\Temp\RUSSKAYA-GOLAYA.exe
"C:\Users\Admin\AppData\Local\Temp\RUSSKAYA-GOLAYA.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1380
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\oni_voobshe_ohueli_haher\yarko_zeltie_vot_eto_da_bleat\froggi_nogcci.bat" "
  2⤵
  - Drops file in Drivers directory
  - Drops file in Program Files directory
  PID:4264
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\oni_voobshe_ohueli_haher\yarko_zeltie_vot_eto_da_bleat\netu_pokoya_mne_gore.vbs"
  2⤵
  - Blocklisted process makes network request
  - Drops file in Drivers directory
  PID:644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\oni_voobshe_ohueli_haher\yarko_zeltie_vot_eto_da_bleat\froggi_nogcci.bat

Filesize
1KB

MD5
f054afa5f5d123ae38e7abe194f7a87d

SHA1
dec5e6adc48e0fbd39680ccd3af0219c9d246c12

SHA256
4f0c74b25e6329f09968bbd2f7c84ee52e70d1d483b94c701306467ae3a5a293

SHA512
8bdccfa538a17d62a1c27260d38384d2020eafbff8d97e8cc795468bda2992e1b7473cd92fb9f205b3ed2696ee141c240ab96de2158094456c7e9866fad9c386

Download Submit
C:\Program Files (x86)\oni_voobshe_ohueli_haher\yarko_zeltie_vot_eto_da_bleat\netu_pokoya_mne_gore.vbs

Filesize
1KB

MD5
9043ecb77cdbd1fd33fb87e41e06b8d0

SHA1
a6b19c1f971e377f30cab943550511560b55d473

SHA256
5017f0c1936f7276d0dea8efcfe6ec7a10a4fb008e06d07ca1e484777033f41f

SHA512
f58c6f29fb67825ff7f75bc3ea0c225549f4df3c0bab97e83a9999f6b58b7ab7bd13f700391ba7698f3d419bb911dc1e2ec1509bed3773dfaaff0e94d2d9fefc

Download Submit
C:\Program Files (x86)\oni_voobshe_ohueli_haher\yarko_zeltie_vot_eto_da_bleat\pod_yasnim_nebom_yanvarya.pro

Filesize
87B

MD5
2048e7f377827684952eac6638737664

SHA1
177f0e8e28f88204df60059d64c6ec3bc108a673

SHA256
e69334131aff4bd540d8972b135c0510f9e7e310c4513df87793923b464ae688

SHA512
624f4865cda8892e6521ff1878cb290b9329fd7eb82034b3224a0358678d2d6eaa20c287efbe69b6d6fcc654c2ee4a36d3235f688c817f44f0e67d6f55ad7916

Download Submit
C:\Windows\System32\drivers\etc\hosts

Filesize
1KB

MD5
0d13ead42a57df87654479ff41c28491

SHA1
b869515352ee31a359e594a5f15169979cb79039

SHA256
64970eaf03cd8dcf35000c5c93589ee9e834e3ec997b065616cfbc14e7b1a046

SHA512
33d9e1846c1c8c7d5ce9e645e8fe9ccc138db52971bb12942a6c374617ea218e5203196069940565cfb6a8ad851b32c26779458254958e68c07715fdfcf8750a

Download Submit
memory/1380-39-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1380-41-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download

Analysis

Sharing