a1191b8467d94c234186fabfffb3b8fb6730629215e3e451f3facbdeaa9fac04

General

Target

GOLAYA-SEXY.exe
Size

180KB
MD5

4f0501d3741234b99f31ed8b7caad73c
SHA1

b64354ecd96279f8eb9b9fbdeb9696cbae1458bb
SHA256

f715c0b6d8971f65335ba0c4499e82c7f56df615209c7b5b30d79bb79f2c9b6d
SHA512

373397915c7e9251b1a24359722efbf13f2c6b5081f8208fe8572c7bf94fa2c0bb4ac1064ff3dbc1fd0d84ac82820ecc20341cb1393b5c35df8a61f8b1623a4d
SSDEEP

3072:bBAp5XhKpN4eOyVTGfhEClj8jTk+0hq4zRQhF4:GbXE9OiTGfhEClq9boWk

Score

8^/10

discovery

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
5	3656	WScript.exe

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	cmd.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	WScript.exe
File opened for modification	C:\Windows\System32\drivers\etc\hîsts	WScript.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation	GOLAYA-SEXY.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\primarily the African odfgm\Palm oil is an edible vegdfg\palm\Crudepalmilutures.bat	GOLAYA-SEXY.exe
File opened for modification	C:\Program Files (x86)\primarily the African odfgm\Palm oil is an edible vegdfg\palm\yellowishfattyilobtained.vbs	GOLAYA-SEXY.exe
File opened for modification	C:\Program Files (x86)\primarily the African odfgm\Palm oil is an edible vegdfg\palm\conservationistsandother.vbs	GOLAYA-SEXY.exe
File opened for modification	C:\Program Files (x86)\primarily the African odfgm\Palm oil is an edible vegdfg\palm\Elaeioleiferandhemar.ipa	GOLAYA-SEXY.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GOLAYA-SEXY.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings	GOLAYA-SEXY.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1456 wrote to memory of 264	1456	GOLAYA-SEXY.exe	82
PID 1456 wrote to memory of 264	1456	GOLAYA-SEXY.exe	82
PID 1456 wrote to memory of 264	1456	GOLAYA-SEXY.exe	82
PID 1456 wrote to memory of 4064	1456	GOLAYA-SEXY.exe	84
PID 1456 wrote to memory of 4064	1456	GOLAYA-SEXY.exe	84
PID 1456 wrote to memory of 4064	1456	GOLAYA-SEXY.exe	84
PID 1456 wrote to memory of 3656	1456	GOLAYA-SEXY.exe	85
PID 1456 wrote to memory of 3656	1456	GOLAYA-SEXY.exe	85
PID 1456 wrote to memory of 3656	1456	GOLAYA-SEXY.exe	85

C:\Users\Admin\AppData\Local\Temp\GOLAYA-SEXY.exe
"C:\Users\Admin\AppData\Local\Temp\GOLAYA-SEXY.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1456
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\primarily the African odfgm\Palm oil is an edible vegdfg\palm\Crudepalmilutures.bat" "
  2⤵
  - Drops file in Drivers directory
  - System Location Discovery: System Language Discovery
  PID:264
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\primarily the African odfgm\Palm oil is an edible vegdfg\palm\yellowishfattyilobtained.vbs"
  2⤵
  - Drops file in Drivers directory
  - System Location Discovery: System Language Discovery
  PID:4064
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\primarily the African odfgm\Palm oil is an edible vegdfg\palm\conservationistsandother.vbs"
  2⤵
  - Blocklisted process makes network request
  - System Location Discovery: System Language Discovery
  PID:3656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\primarily the African odfgm\Palm oil is an edible vegdfg\palm\Crudepalmilutures.bat

Filesize
730B

MD5
638b16067ce1d377fb40ceb716dce5cf

SHA1
35a1a8b3b540c8d8fedc9739518dcb52dda1fa19

SHA256
dfb307b0ade6ba151289460fbcbd9af0f8bf0b04ed96b04bd8a3bc4850aacf79

SHA512
74dc3cd206f09b6242691bd37784e8be046abb13b92c5c66c1cc41665dd0ab8b965e8f815998e4a24b674f55826b1416d4d3602054611199b53da3c3ce309711

Download Submit
C:\Program Files (x86)\primarily the African odfgm\Palm oil is an edible vegdfg\palm\Elaeioleiferandhemar.ipa

Filesize
71B

MD5
b03811235166ed1db54892e4f4711966

SHA1
618efdba3d3cf2d2ec8e460ed3b8208523451e01

SHA256
f13162f2daacb18ca122acf96330a0df7596b73e63f0cf30a445e27126c739b4

SHA512
9b79447dcb0d83ac9589e5bedb307020211ad05086bfdad8e8ab4d40132aef905081ba86926b648e1c4c3e856c0a07fcf81a3e57faadb734a8e1ce62170a8424

Download Submit
C:\Program Files (x86)\primarily the African odfgm\Palm oil is an edible vegdfg\palm\conservationistsandother.vbs

Filesize
502B

MD5
d663bf0396bb9a2201f8776ca348d187

SHA1
81a05e3e4642d4bae44d65afc6eb23a8b8b0192b

SHA256
acdc802bfbd4e267fa67d975eca3527772456fdbfeaadf8160a1e6bf60beaff2

SHA512
2611b688f4f7710a3051d222de8be47bbe7a1e5196efadf7661ef701aef2c55f2a13c19ec0d782b0485a6976367e8c839a6e107022daa2a11a8f5c280e36594c

Download Submit
C:\Program Files (x86)\primarily the African odfgm\Palm oil is an edible vegdfg\palm\yellowishfattyilobtained.vbs

Filesize
641B

MD5
7ae5c9af987601b240a2ef0f502ee77d

SHA1
6813c07e7c67986f232ae30171a9c4e7fff2dfd3

SHA256
68bcf53f14a764c770e827fa06cd1d954f31ddfeebdb88e875897b4ca35e0fdd

SHA512
0bbec39de44fd8bfd99eebbcd1c087d1c174aca30d758007e01d07b20773624b0caf7e7949ee55ad10d08229a44dec77842e967f8ab851257c78a15ae0c73c28

Download Submit
C:\Windows\System32\drivers\etc\hosts

Filesize
1KB

MD5
a8d8655c77d6cfe3ddb1fb98ce2a4b96

SHA1
ab5f6867cf7f76bc3f19a6abfefe60a461f20d52

SHA256
ac4c821e48a769f70bfe6a24035976d13292d7cffec4c022372677de04dcbb81

SHA512
15de8a16ecc57e8c96df22543ce80e7912477ee92ddc24eab51c2b8570327cede8926943e9e7c16b71253f495c4daa3fc929610718d4bd151c3940ebab7724bd

Download Submit
memory/1456-30-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download

Analysis

Sharing