6c2b934200e1f6537897e6b3a9d6bdd6371c31a8c66feb40eb64eda9ae284255

General

Target

PHOTO-GOLAYA.exe
Size

239KB
MD5

3b6a823d2a38f447bfa16008f5c1486c
SHA1

a73038f71665e91fcbcbf2d7c34b7601dd88d805
SHA256

216e9686036f1f962f05526b583ed2b26f6666e8a3783e8f42883c4a09e8f86a
SHA512

a65c311f7c54db12c8cd738259df95afdf2dc01d19f21c61c3e3ef410c079df1af5475fe62cb73f01dab625b09b52b358315ac62899388dc6e9e6f101ed38f53
SSDEEP

3072:MBAp5XhKpN4eOyVTGfhEClj8jTk+0hYoO/MgjqEWBr+Cgw5CKH6:7bXE9OiTGfhEClq95/MghJJU6

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	cmd.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	WScript.exe
File opened for modification	C:\Windows\System32\drivers\etc\hîsts	WScript.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 17 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\lop\piccoloucioamepiacanutella\Twitvid allows you to easily.home	PHOTO-GOLAYA.exe
File opened for modification	C:\Program Files (x86)\lop\piccoloucioamepiacanutella\kolitmna.kol	PHOTO-GOLAYA.exe
File created	C:\Program Files (x86)\lop\piccoloucioamepiacanutella\Uninstall.ini	PHOTO-GOLAYA.exe
File created	C:\Program Files (x86)\lop\piccoloucioamepiacanutella\pizdaxui.vbs	cmd.exe
File created	C:\Program Files (x86)\lop\piccoloucioamepiacanutella\Uninstall.exe	PHOTO-GOLAYA.exe
File created	C:\Program Files (x86)\lop\piccoloucioamepiacanutella\Twitvid allows you to easily.home	PHOTO-GOLAYA.exe
File created	C:\Program Files (x86)\lop\piccoloucioamepiacanutella\Dogma.bat	PHOTO-GOLAYA.exe
File opened for modification	C:\Program Files (x86)\lop\piccoloucioamepiacanutella\Dogma.bat	PHOTO-GOLAYA.exe
File created	C:\Program Files (x86)\lop\piccoloucioamepiacanutella\kolitmna.kol	PHOTO-GOLAYA.exe
File created	C:\Program Files (x86)\lop\piccoloucioamepiacanutella\xuipizda\1.txt	PHOTO-GOLAYA.exe
File opened for modification	C:\Program Files (x86)\lop\piccoloucioamepiacanutella\xuipizda\1.txt	PHOTO-GOLAYA.exe
File created	C:\Program Files (x86)\lop\piccoloucioamepiacanutella\pizdaxui.eblya	PHOTO-GOLAYA.exe
File opened for modification	C:\Program Files (x86)\lop\piccoloucioamepiacanutella\pizdaxui.vbs	cmd.exe
File opened for modification	C:\Program Files (x86)\lop\piccoloucioamepiacanutella\pizdaxui.eblya	PHOTO-GOLAYA.exe
File opened for modification	C:\Program Files (x86)\lop\piccoloucioamepiacanutella\Uninstall.exe	PHOTO-GOLAYA.exe
File created	C:\Program Files (x86)\lop\piccoloucioamepiacanutella\olologggg.vbs	cmd.exe
File opened for modification	C:\Program Files (x86)\lop\piccoloucioamepiacanutella\olologggg.vbs	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 320 wrote to memory of 2644	320	PHOTO-GOLAYA.exe	28
PID 320 wrote to memory of 2644	320	PHOTO-GOLAYA.exe	28
PID 320 wrote to memory of 2644	320	PHOTO-GOLAYA.exe	28
PID 320 wrote to memory of 2644	320	PHOTO-GOLAYA.exe	28
PID 320 wrote to memory of 2664	320	PHOTO-GOLAYA.exe	30
PID 320 wrote to memory of 2664	320	PHOTO-GOLAYA.exe	30
PID 320 wrote to memory of 2664	320	PHOTO-GOLAYA.exe	30
PID 320 wrote to memory of 2664	320	PHOTO-GOLAYA.exe	30

C:\Users\Admin\AppData\Local\Temp\PHOTO-GOLAYA.exe
"C:\Users\Admin\AppData\Local\Temp\PHOTO-GOLAYA.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:320
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Program Files (x86)\lop\piccoloucioamepiacanutella\Dogma.bat" "
  2⤵
  - Drops file in Drivers directory
  - Drops file in Program Files directory
  PID:2644
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\lop\piccoloucioamepiacanutella\olologggg.vbs"
  2⤵
  - Drops file in Drivers directory
  PID:2664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\lop\piccoloucioamepiacanutella\Dogma.bat

Filesize
1KB

MD5
b952f2d824197f7c2c349d7cb7020669

SHA1
c3af4829b1d7dd1e600fea969912cdf6d6d05c7b

SHA256
eb0aad309aa85490ea3fd69b553732d65f6639c21df20d06f04ca56296be18ca

SHA512
9332cbfda80fb45002e5ac90f847310a1168b234931cd491f5fb479f952484644acd272f893ec02a5772d4fb345649a59f7528537183f9ee05b12356d0877c4e

Download Submit
C:\Program Files (x86)\lop\piccoloucioamepiacanutella\Twitvid allows you to easily.home

Filesize
92B

MD5
119d851aca579cb6d3b3f996209ae746

SHA1
8269aa49847598efea40cd76a43846238da6c791

SHA256
4f8c85a7fc4aaf52afc6fb758ea289640c8dc03d38557b12d5ed92d2c8d9005d

SHA512
244b4535f9af527324977c3cd744912fb56b3946d2a1c3188725ae10753eccc969ed9b3f602b9c13e1e8df268290d7d38a1304213043e79ee2258ccb90ed25fc

Download Submit
C:\Program Files (x86)\lop\piccoloucioamepiacanutella\kolitmna.kol

Filesize
628B

MD5
3b007c1b75cc2e976187ad8387b31b8a

SHA1
f34230fbb690026536ead92ab51fb97fa4f90f00

SHA256
4cbc257c9ee854c9ea8c39f2d021db2ceea44fb2adee64fcaf7596cb2e03f04b

SHA512
b9d23a4eceeb124f7be3cad975f013344a04656788f7a2ceb160a9e0268631029f963595b5522b7fb6865c74c2b0cdd45652bc2234329eba7f46dafe051e33c8

Download Submit
C:\Program Files (x86)\lop\piccoloucioamepiacanutella\pizdaxui.eblya

Filesize
185B

MD5
b6ca24e2cc23d2c4ab76cff73b6705b9

SHA1
028560ec53255c570a99884061443285f363a9ab

SHA256
dc7ff1cd3688a4332b64cdc31beb07bb3de9e1b578433aae8e1b296aee4385db

SHA512
4ec8a185eb1d7fdf2a6d9d6a59750338649a899ced69097bf494443652ddc8e8177f4b4de7af60d459251cd3ebca6e417164a46388096424ab96c21b39182e26

Download Submit
C:\Windows\System32\drivers\etc\hosts

Filesize
1KB

MD5
2f9c045fc3a02a6e1047dc1365ff70d6

SHA1
484298b8f3d58b92bcca200f23243d561ce537c4

SHA256
4de127588b9e7971f21601163457726ec5452bc64c0c184bcb8049fa6ff4e353

SHA512
e2f5918f2213b550a2c288a36f3f15f0dede58e76ac3fc5d0399a9691d51a6b9f177f6aaf5b4d3a563c7000f5b6510b464792830166aeca383990cffbaa872e9

Download Submit
memory/320-50-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download

Analysis

Sharing