28ccdc782b4710a937d3b3bb108803e41117a5110b0329c659dae02f3ce72aa1

General

Target

GOLAYA-RUSSKAYA.exe
Size

238KB
MD5

4bf7fbae5d85b68dba3a92e172504238
SHA1

641a659c755e3adafa971a3f32c6e47b4f5f1173
SHA256

2e8efaea895111c02f1efddb99fa07fdd1e9c2318d488ae6c9b27064f6c0feac
SHA512

93e67706c4d5ffd05de586f612c8af211630921e2b91b5ec488a734fa951835caab543da76160f21bec8160473017857bcdd5625440a9247279986d05468e96d
SSDEEP

6144:zbXE9OiTGfhEClq9dqCvR/w/3E616xKJJUm:/U9XiuiURI/ss

Score

8^/10

discovery

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
3	2868	WScript.exe
7	2868	WScript.exe

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	cmd.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	WScript.exe
File opened for modification	C:\Windows\System32\drivers\etc\hîsts	WScript.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 13 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\idol ya poka\no lover simfony\nu kak bi vsua hernya.fos	GOLAYA-RUSSKAYA.exe
File created	C:\Program Files (x86)\idol ya poka\no lover simfony\slooooowthespeedafer.vbs	cmd.exe
File opened for modification	C:\Program Files (x86)\idol ya poka\no lover simfony\svezee_techenie_cheloveko.bat	GOLAYA-RUSSKAYA.exe
File created	C:\Program Files (x86)\idol ya poka\no lover simfony\slooooowthespeedafer.cross	GOLAYA-RUSSKAYA.exe
File created	C:\Program Files (x86)\idol ya poka\no lover simfony\Uninstall.exe	GOLAYA-RUSSKAYA.exe
File opened for modification	C:\Program Files (x86)\idol ya poka\no lover simfony\Uninstall.exe	GOLAYA-RUSSKAYA.exe
File created	C:\Program Files (x86)\idol ya poka\no lover simfony\xranilise_vsei_figni_tut.bok	GOLAYA-RUSSKAYA.exe
File opened for modification	C:\Program Files (x86)\idol ya poka\no lover simfony\nu kak bi vsua hernya.fos	GOLAYA-RUSSKAYA.exe
File created	C:\Program Files (x86)\idol ya poka\no lover simfony\Uninstall.ini	GOLAYA-RUSSKAYA.exe
File opened for modification	C:\Program Files (x86)\idol ya poka\no lover simfony\xranilise_vsei_figni_tut.bok	GOLAYA-RUSSKAYA.exe
File opened for modification	C:\Program Files (x86)\idol ya poka\no lover simfony\slooooowthespeedafer.cross	GOLAYA-RUSSKAYA.exe
File opened for modification	C:\Program Files (x86)\idol ya poka\no lover simfony\slooooowthespeedafer.vbs	cmd.exe
File created	C:\Program Files (x86)\idol ya poka\no lover simfony\svezee_techenie_cheloveko.bat	GOLAYA-RUSSKAYA.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 2628	1948	GOLAYA-RUSSKAYA.exe	28
PID 1948 wrote to memory of 2628	1948	GOLAYA-RUSSKAYA.exe	28
PID 1948 wrote to memory of 2628	1948	GOLAYA-RUSSKAYA.exe	28
PID 1948 wrote to memory of 2628	1948	GOLAYA-RUSSKAYA.exe	28
PID 1948 wrote to memory of 2868	1948	GOLAYA-RUSSKAYA.exe	30
PID 1948 wrote to memory of 2868	1948	GOLAYA-RUSSKAYA.exe	30
PID 1948 wrote to memory of 2868	1948	GOLAYA-RUSSKAYA.exe	30
PID 1948 wrote to memory of 2868	1948	GOLAYA-RUSSKAYA.exe	30

C:\Users\Admin\AppData\Local\Temp\GOLAYA-RUSSKAYA.exe
"C:\Users\Admin\AppData\Local\Temp\GOLAYA-RUSSKAYA.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Program Files (x86)\idol ya poka\no lover simfony\svezee_techenie_cheloveko.bat" "
  2⤵
  - Drops file in Drivers directory
  - Drops file in Program Files directory
  PID:2628
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\idol ya poka\no lover simfony\slooooowthespeedafer.vbs"
  2⤵
  - Blocklisted process makes network request
  - Drops file in Drivers directory
  PID:2868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\idol ya poka\no lover simfony\slooooowthespeedafer.cross

Filesize
1KB

MD5
528196221bc23381192e61fb6fe20f66

SHA1
2b0ac1a49b0be10f66dc798a6d2c8b20b4c6d179

SHA256
7fc68d1bafcc4d34084104d9ca10498b9e8c974ef19212abb6079ee0bbd07f67

SHA512
6e6512bb9640c7d3978f4b4b7a3b40c8b899ad75778fc8f4bbc136d7376fcec0543451d603d6f4f409dde79ba227040f27f8b96cf7efa5d84eedb13d232c84f1

Download Submit
C:\Program Files (x86)\idol ya poka\no lover simfony\svezee_techenie_cheloveko.bat

Filesize
1KB

MD5
13978e983ba5365f3004dbf68a35d69b

SHA1
2da80dd54cd7df37817b259928f8998466b1f934

SHA256
b57be79eb8e15466c5283e3bf4c1745500365a7fb0b2a6a17ff6d2e5da02ec78

SHA512
3e205c74f5e13bf08913890f149792456666bcdb499803e69c89d500a621bfd2a0967ef525a359fefc319d8e0d7b24a6f4e76061a18a07bd03bcb3db192492ec

Download Submit
C:\Program Files (x86)\idol ya poka\no lover simfony\xranilise_vsei_figni_tut.bok

Filesize
99B

MD5
86dc7199339e9623d9cb19240a752740

SHA1
71cb2333efd767a21c031c23bb5b7e81115aff18

SHA256
c374079002e58508af7c8de08bf7e98b72a0d11b44650dcbb89f31d15e887370

SHA512
eee63bbf12c45ba73cfb543d0069288090410e91ef484587dde79995a585ef510d295d4de19701feb5704167b3d0ba01cf0a40f00c42abf29825e1f2bf917f5d

Download Submit
C:\Windows\System32\drivers\etc\hosts

Filesize
1KB

MD5
62f349a8cbe23f76b9a64af91c4901f3

SHA1
27fa28e6e22e320bdaeea11ad9be50ce85f0ae15

SHA256
11d67412a287aa262b5d3dda16a28e27d099186632883beb83d430396ada0536

SHA512
8574b744600558492d36cfcaff66ff344fc51dd7e7947e1b8247311a2ec73d11dd051791c10d864af77f7f7166aa340e6b4a2319f1c42f1f90ac6dff12d0fec4

Download Submit
memory/1948-44-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1948-49-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download

Analysis

Sharing