cbf439d2a7f898ce241df8892305971ecef2bde96a96bcc58afe17b383ec553c

General

Target

RUSSKAYA-GOLAYA.exe
Size

239KB
MD5

6839c4c1e533bdef312fa9501b7cd622
SHA1

0a4a288e686a64c0d926e5d5c7ddd46ec7eeeaa1
SHA256

5b40e9c2a5bbd190d09eade750b1ce1a48887f6822a3e8a4cf3f927c38088982
SHA512

d0cafe97a7ab0444424d88d6fddbe2bb0bc9d33abaaeec21101388982d40728d5114d30d1d9b3f7b5d0ea77cbfc6f8067256d4cd7613d14de74ccd196a1dd954
SSDEEP

3072:MBAp5XhKpN4eOyVTGfhEClj8jTk+0hYoO/MgjqEWBz+Cgw5CKHy:7bXE9OiTGfhEClq95/MgXJJUy

Score

8^/10

discovery

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
3	936	WScript.exe

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	cmd.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	WScript.exe
File opened for modification	C:\Windows\System32\drivers\etc\hîsts	WScript.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	RUSSKAYA-GOLAYA.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 17 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\lop1\piccoloucioamepiacanutella\Twitvid allows you to easily.home	RUSSKAYA-GOLAYA.exe
File opened for modification	C:\Program Files (x86)\lop1\piccoloucioamepiacanutella\pizdaxui11.eb	RUSSKAYA-GOLAYA.exe
File opened for modification	C:\Program Files (x86)\lop1\piccoloucioamepiacanutella\Uninstall.exe	RUSSKAYA-GOLAYA.exe
File created	C:\Program Files (x86)\lop1\piccoloucioamepiacanutella\Uninstall.ini	RUSSKAYA-GOLAYA.exe
File created	C:\Program Files (x86)\lop1\piccoloucioamepiacanutella\pizdaxui11.vbs	cmd.exe
File created	C:\Program Files (x86)\lop1\piccoloucioamepiacanutella\kolitmna.kol	RUSSKAYA-GOLAYA.exe
File created	C:\Program Files (x86)\lop1\piccoloucioamepiacanutella\xuipizda\1.txt	RUSSKAYA-GOLAYA.exe
File created	C:\Program Files (x86)\lop1\piccoloucioamepiacanutella\olologggg.vbs	cmd.exe
File opened for modification	C:\Program Files (x86)\lop1\piccoloucioamepiacanutella\olologggg.vbs	cmd.exe
File created	C:\Program Files (x86)\lop1\piccoloucioamepiacanutella\Twitvid allows you to easily.home	RUSSKAYA-GOLAYA.exe
File created	C:\Program Files (x86)\lop1\piccoloucioamepiacanutella\Dogma.bat	RUSSKAYA-GOLAYA.exe
File opened for modification	C:\Program Files (x86)\lop1\piccoloucioamepiacanutella\Dogma.bat	RUSSKAYA-GOLAYA.exe
File created	C:\Program Files (x86)\lop1\piccoloucioamepiacanutella\pizdaxui11.eb	RUSSKAYA-GOLAYA.exe
File opened for modification	C:\Program Files (x86)\lop1\piccoloucioamepiacanutella\kolitmna.kol	RUSSKAYA-GOLAYA.exe
File opened for modification	C:\Program Files (x86)\lop1\piccoloucioamepiacanutella\xuipizda\1.txt	RUSSKAYA-GOLAYA.exe
File created	C:\Program Files (x86)\lop1\piccoloucioamepiacanutella\Uninstall.exe	RUSSKAYA-GOLAYA.exe
File opened for modification	C:\Program Files (x86)\lop1\piccoloucioamepiacanutella\pizdaxui11.vbs	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RUSSKAYA-GOLAYA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings	RUSSKAYA-GOLAYA.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5016 wrote to memory of 3128	5016	RUSSKAYA-GOLAYA.exe	84
PID 5016 wrote to memory of 3128	5016	RUSSKAYA-GOLAYA.exe	84
PID 5016 wrote to memory of 3128	5016	RUSSKAYA-GOLAYA.exe	84
PID 5016 wrote to memory of 4860	5016	RUSSKAYA-GOLAYA.exe	86
PID 5016 wrote to memory of 4860	5016	RUSSKAYA-GOLAYA.exe	86
PID 5016 wrote to memory of 4860	5016	RUSSKAYA-GOLAYA.exe	86
PID 5016 wrote to memory of 936	5016	RUSSKAYA-GOLAYA.exe	87
PID 5016 wrote to memory of 936	5016	RUSSKAYA-GOLAYA.exe	87
PID 5016 wrote to memory of 936	5016	RUSSKAYA-GOLAYA.exe	87

C:\Users\Admin\AppData\Local\Temp\RUSSKAYA-GOLAYA.exe
"C:\Users\Admin\AppData\Local\Temp\RUSSKAYA-GOLAYA.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5016
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\lop1\piccoloucioamepiacanutella\Dogma.bat" "
  2⤵
  - Drops file in Drivers directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:3128
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\lop1\piccoloucioamepiacanutella\olologggg.vbs"
  2⤵
  - Drops file in Drivers directory
  - System Location Discovery: System Language Discovery
  PID:4860
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\lop1\piccoloucioamepiacanutella\pizdaxui11.vbs"
  2⤵
  - Blocklisted process makes network request
  - System Location Discovery: System Language Discovery
  PID:936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\lop1\piccoloucioamepiacanutella\Dogma.bat

Filesize
1KB

MD5
c116ccc255832c552d663600eb1d142a

SHA1
bfe7637478bbcbee0253df07cd2d20d3e7e5c04c

SHA256
10be330e7e4da276d80edb4123f37610b8284b77b6b5f809fc128558d44a2560

SHA512
00eee11e8efa70bd728c182394d15063c5f192f4e673cd64930a77735c28cd8944062ffe06eaeec4b9e8e5bb259d1d61eaf6074018d2bffa99d9c9641f9a7688

Download Submit
C:\Program Files (x86)\lop1\piccoloucioamepiacanutella\Twitvid allows you to easily.home

Filesize
92B

MD5
119d851aca579cb6d3b3f996209ae746

SHA1
8269aa49847598efea40cd76a43846238da6c791

SHA256
4f8c85a7fc4aaf52afc6fb758ea289640c8dc03d38557b12d5ed92d2c8d9005d

SHA512
244b4535f9af527324977c3cd744912fb56b3946d2a1c3188725ae10753eccc969ed9b3f602b9c13e1e8df268290d7d38a1304213043e79ee2258ccb90ed25fc

Download Submit
C:\Program Files (x86)\lop1\piccoloucioamepiacanutella\kolitmna.kol

Filesize
628B

MD5
3b007c1b75cc2e976187ad8387b31b8a

SHA1
f34230fbb690026536ead92ab51fb97fa4f90f00

SHA256
4cbc257c9ee854c9ea8c39f2d021db2ceea44fb2adee64fcaf7596cb2e03f04b

SHA512
b9d23a4eceeb124f7be3cad975f013344a04656788f7a2ceb160a9e0268631029f963595b5522b7fb6865c74c2b0cdd45652bc2234329eba7f46dafe051e33c8

Download Submit
C:\Program Files (x86)\lop1\piccoloucioamepiacanutella\pizdaxui11.eb

Filesize
185B

MD5
b6ca24e2cc23d2c4ab76cff73b6705b9

SHA1
028560ec53255c570a99884061443285f363a9ab

SHA256
dc7ff1cd3688a4332b64cdc31beb07bb3de9e1b578433aae8e1b296aee4385db

SHA512
4ec8a185eb1d7fdf2a6d9d6a59750338649a899ced69097bf494443652ddc8e8177f4b4de7af60d459251cd3ebca6e417164a46388096424ab96c21b39182e26

Download Submit
C:\Windows\System32\drivers\etc\hosts

Filesize
1KB

MD5
435d5b9ac8adeb9d27fad84bf5303c6b

SHA1
bde744ec28854dae3189115a948db25c2e21a886

SHA256
8c2c870afff5c4585252a9bc7675674b5756f316bb2bd0d63c09ee07972ea411

SHA512
4460ee340753053374c72342d5f0878fc30a1f10d4cbde5b55440932479ab35d42487af08a27703dcf06dedf875b25ec9a888974f8adeee3243afd2f9425cb8e

Download Submit
memory/5016-46-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/5016-48-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download

Analysis

Sharing