cbf439d2a7f898ce241df8892305971ecef2bde96a96bcc58afe17b383ec553c

General

Target

RUSSKAYA-GOLAYA.exe
Size

239KB
MD5

6839c4c1e533bdef312fa9501b7cd622
SHA1

0a4a288e686a64c0d926e5d5c7ddd46ec7eeeaa1
SHA256

5b40e9c2a5bbd190d09eade750b1ce1a48887f6822a3e8a4cf3f927c38088982
SHA512

d0cafe97a7ab0444424d88d6fddbe2bb0bc9d33abaaeec21101388982d40728d5114d30d1d9b3f7b5d0ea77cbfc6f8067256d4cd7613d14de74ccd196a1dd954
SSDEEP

3072:MBAp5XhKpN4eOyVTGfhEClj8jTk+0hYoO/MgjqEWBz+Cgw5CKHy:7bXE9OiTGfhEClq95/MgXJJUy

Score

8^/10

discovery

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
4	2856	WScript.exe
5	2856	WScript.exe

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	cmd.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	WScript.exe
File opened for modification	C:\Windows\System32\drivers\etc\hîsts	WScript.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 17 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\lop1\piccoloucioamepiacanutella\kolitmna.kol	RUSSKAYA-GOLAYA.exe
File created	C:\Program Files (x86)\lop1\piccoloucioamepiacanutella\xuipizda\1.txt	RUSSKAYA-GOLAYA.exe
File opened for modification	C:\Program Files (x86)\lop1\piccoloucioamepiacanutella\xuipizda\1.txt	RUSSKAYA-GOLAYA.exe
File created	C:\Program Files (x86)\lop1\piccoloucioamepiacanutella\Uninstall.exe	RUSSKAYA-GOLAYA.exe
File opened for modification	C:\Program Files (x86)\lop1\piccoloucioamepiacanutella\Uninstall.exe	RUSSKAYA-GOLAYA.exe
File created	C:\Program Files (x86)\lop1\piccoloucioamepiacanutella\Twitvid allows you to easily.home	RUSSKAYA-GOLAYA.exe
File opened for modification	C:\Program Files (x86)\lop1\piccoloucioamepiacanutella\Twitvid allows you to easily.home	RUSSKAYA-GOLAYA.exe
File opened for modification	C:\Program Files (x86)\lop1\piccoloucioamepiacanutella\Dogma.bat	RUSSKAYA-GOLAYA.exe
File created	C:\Program Files (x86)\lop1\piccoloucioamepiacanutella\Uninstall.ini	RUSSKAYA-GOLAYA.exe
File created	C:\Program Files (x86)\lop1\piccoloucioamepiacanutella\olologggg.vbs	cmd.exe
File created	C:\Program Files (x86)\lop1\piccoloucioamepiacanutella\pizdaxui11.vbs	cmd.exe
File opened for modification	C:\Program Files (x86)\lop1\piccoloucioamepiacanutella\pizdaxui11.vbs	cmd.exe
File created	C:\Program Files (x86)\lop1\piccoloucioamepiacanutella\kolitmna.kol	RUSSKAYA-GOLAYA.exe
File opened for modification	C:\Program Files (x86)\lop1\piccoloucioamepiacanutella\pizdaxui11.eb	RUSSKAYA-GOLAYA.exe
File opened for modification	C:\Program Files (x86)\lop1\piccoloucioamepiacanutella\olologggg.vbs	cmd.exe
File created	C:\Program Files (x86)\lop1\piccoloucioamepiacanutella\Dogma.bat	RUSSKAYA-GOLAYA.exe
File created	C:\Program Files (x86)\lop1\piccoloucioamepiacanutella\pizdaxui11.eb	RUSSKAYA-GOLAYA.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RUSSKAYA-GOLAYA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 2652	1940	RUSSKAYA-GOLAYA.exe	30
PID 1940 wrote to memory of 2652	1940	RUSSKAYA-GOLAYA.exe	30
PID 1940 wrote to memory of 2652	1940	RUSSKAYA-GOLAYA.exe	30
PID 1940 wrote to memory of 2652	1940	RUSSKAYA-GOLAYA.exe	30
PID 1940 wrote to memory of 2716	1940	RUSSKAYA-GOLAYA.exe	32
PID 1940 wrote to memory of 2716	1940	RUSSKAYA-GOLAYA.exe	32
PID 1940 wrote to memory of 2716	1940	RUSSKAYA-GOLAYA.exe	32
PID 1940 wrote to memory of 2716	1940	RUSSKAYA-GOLAYA.exe	32
PID 1940 wrote to memory of 2856	1940	RUSSKAYA-GOLAYA.exe	33
PID 1940 wrote to memory of 2856	1940	RUSSKAYA-GOLAYA.exe	33
PID 1940 wrote to memory of 2856	1940	RUSSKAYA-GOLAYA.exe	33
PID 1940 wrote to memory of 2856	1940	RUSSKAYA-GOLAYA.exe	33

C:\Users\Admin\AppData\Local\Temp\RUSSKAYA-GOLAYA.exe
"C:\Users\Admin\AppData\Local\Temp\RUSSKAYA-GOLAYA.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Program Files (x86)\lop1\piccoloucioamepiacanutella\Dogma.bat" "
  2⤵
  - Drops file in Drivers directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:2652
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\lop1\piccoloucioamepiacanutella\olologggg.vbs"
  2⤵
  - Drops file in Drivers directory
  - System Location Discovery: System Language Discovery
  PID:2716
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\lop1\piccoloucioamepiacanutella\pizdaxui11.vbs"
  2⤵
  - Blocklisted process makes network request
  - System Location Discovery: System Language Discovery
  PID:2856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\lop1\piccoloucioamepiacanutella\Dogma.bat

Filesize
1KB

MD5
c116ccc255832c552d663600eb1d142a

SHA1
bfe7637478bbcbee0253df07cd2d20d3e7e5c04c

SHA256
10be330e7e4da276d80edb4123f37610b8284b77b6b5f809fc128558d44a2560

SHA512
00eee11e8efa70bd728c182394d15063c5f192f4e673cd64930a77735c28cd8944062ffe06eaeec4b9e8e5bb259d1d61eaf6074018d2bffa99d9c9641f9a7688

Download Submit
C:\Program Files (x86)\lop1\piccoloucioamepiacanutella\Twitvid allows you to easily.home

Filesize
92B

MD5
119d851aca579cb6d3b3f996209ae746

SHA1
8269aa49847598efea40cd76a43846238da6c791

SHA256
4f8c85a7fc4aaf52afc6fb758ea289640c8dc03d38557b12d5ed92d2c8d9005d

SHA512
244b4535f9af527324977c3cd744912fb56b3946d2a1c3188725ae10753eccc969ed9b3f602b9c13e1e8df268290d7d38a1304213043e79ee2258ccb90ed25fc

Download Submit
C:\Program Files (x86)\lop1\piccoloucioamepiacanutella\kolitmna.kol

Filesize
628B

MD5
3b007c1b75cc2e976187ad8387b31b8a

SHA1
f34230fbb690026536ead92ab51fb97fa4f90f00

SHA256
4cbc257c9ee854c9ea8c39f2d021db2ceea44fb2adee64fcaf7596cb2e03f04b

SHA512
b9d23a4eceeb124f7be3cad975f013344a04656788f7a2ceb160a9e0268631029f963595b5522b7fb6865c74c2b0cdd45652bc2234329eba7f46dafe051e33c8

Download Submit
C:\Program Files (x86)\lop1\piccoloucioamepiacanutella\pizdaxui11.eb

Filesize
185B

MD5
b6ca24e2cc23d2c4ab76cff73b6705b9

SHA1
028560ec53255c570a99884061443285f363a9ab

SHA256
dc7ff1cd3688a4332b64cdc31beb07bb3de9e1b578433aae8e1b296aee4385db

SHA512
4ec8a185eb1d7fdf2a6d9d6a59750338649a899ced69097bf494443652ddc8e8177f4b4de7af60d459251cd3ebca6e417164a46388096424ab96c21b39182e26

Download Submit
C:\Windows\System32\drivers\etc\hosts

Filesize
1KB

MD5
2f9c045fc3a02a6e1047dc1365ff70d6

SHA1
484298b8f3d58b92bcca200f23243d561ce537c4

SHA256
4de127588b9e7971f21601163457726ec5452bc64c0c184bcb8049fa6ff4e353

SHA512
e2f5918f2213b550a2c288a36f3f15f0dede58e76ac3fc5d0399a9691d51a6b9f177f6aaf5b4d3a563c7000f5b6510b464792830166aeca383990cffbaa872e9

Download Submit
memory/1940-51-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1940-56-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download

Analysis

Sharing