82719f24198e890b3e7a4b3a69d63205c82f00e0e7c926461a9cc9f6cbe59b0b

General

Target
GOLAYA-DEVOCHKA.exe
Size 180KB
Sample250127-sejnmatpcw
SHA256 e39b4d47bafb657aa37f821378b6140e21643173551f0c01adf8dbf4a3f0d748
MD5 b5bfc25ec5d0d2576975e6df14cee8f2
SHA1 ff48876248f0f0ff668aa7d67e2243bd9a3fd465
SHA512 aaaafcad061f3ce56aeb0a636fb375dbb8eda5d34e4ce743037ff90ec00b3cd972bbf671881f0a3fb3ab9a03f0782944454f78eed2cf33c72aff2e758e52ce6f
SSDEEP 3072:fBAp5XhKpN4eOyVTGfhEClj8jTk+0hD+V64pfPFxI:ibXE9OiTGfhEClq9VzfPFa
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
5	2280	WScript.exe

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hîsts	WScript.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	cmd.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	WScript.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	GOLAYA-DEVOCHKA.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\na ulissdfsdf\take me devo4ka\kandyvi\krasota_ta_kakaya.vbs	GOLAYA-DEVOCHKA.exe
File opened for modification	C:\Program Files (x86)\na ulissdfsdf\take me devo4ka\kandyvi\prich4ki_pouuuuut.vbs	GOLAYA-DEVOCHKA.exe
File opened for modification	C:\Program Files (x86)\na ulissdfsdf\take me devo4ka\kandyvi\ebi_manya_kon.rud	GOLAYA-DEVOCHKA.exe
File opened for modification	C:\Program Files (x86)\na ulissdfsdf\take me devo4ka\ebi_manya_kon\so_my_name_is_brus_dick.bat	GOLAYA-DEVOCHKA.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GOLAYA-DEVOCHKA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	GOLAYA-DEVOCHKA.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3928 wrote to memory of 2440	3928	GOLAYA-DEVOCHKA.exe	83
PID 3928 wrote to memory of 2440	3928	GOLAYA-DEVOCHKA.exe	83
PID 3928 wrote to memory of 2440	3928	GOLAYA-DEVOCHKA.exe	83
PID 3928 wrote to memory of 2276	3928	GOLAYA-DEVOCHKA.exe	85
PID 3928 wrote to memory of 2276	3928	GOLAYA-DEVOCHKA.exe	85
PID 3928 wrote to memory of 2276	3928	GOLAYA-DEVOCHKA.exe	85
PID 3928 wrote to memory of 2280	3928	GOLAYA-DEVOCHKA.exe	86
PID 3928 wrote to memory of 2280	3928	GOLAYA-DEVOCHKA.exe	86
PID 3928 wrote to memory of 2280	3928	GOLAYA-DEVOCHKA.exe	86

C:\Users\Admin\AppData\Local\Temp\GOLAYA-DEVOCHKA.exe
"C:\Users\Admin\AppData\Local\Temp\GOLAYA-DEVOCHKA.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3928
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\na ulissdfsdf\take me devo4ka\ebi_manya_kon\so_my_name_is_brus_dick.bat" "
  2⤵
  - Drops file in Drivers directory
  - System Location Discovery: System Language Discovery
  PID:2440
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\na ulissdfsdf\take me devo4ka\kandyvi\krasota_ta_kakaya.vbs"
  2⤵
  - Drops file in Drivers directory
  - System Location Discovery: System Language Discovery
  PID:2276
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\na ulissdfsdf\take me devo4ka\kandyvi\prich4ki_pouuuuut.vbs"
  2⤵
  - Blocklisted process makes network request
  - System Location Discovery: System Language Discovery
  PID:2280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

so_my_name_is_brus_dick.bat

Path C:\Program Files (x86)\na ulissdfsdf\take me devo4ka\ebi_manya_kon\so_my_name_is_brus_dick.bat
Size 2KB
SHA256 1e121e5015638fd024cc86bea8153a133fd53428b856a5abaf753eb46fdeb624
MD5 7d744cf5e580d72d8f5043d150d493c1
SHA1 3a6a8cc463a408e9962b05c939ff17feb5af6a14
SHA512 f296a55289388ae855f2a32b6e5088a921af3d86d1c8bb57581ce77a52dbedc0e308bb256dcc01760a458cc0fadfb3b77a1bc7235d03be4a2690cd227140dc29
MD5 SHA1 SHA512

Submit Download

ebi_manya_kon.rud

Path C:\Program Files (x86)\na ulissdfsdf\take me devo4ka\kandyvi\ebi_manya_kon.rud
Size 33B
SHA256 354b2baf1b5a08368077e053984063a0a94736e16d3d77aa259e7d212e50b92a
MD5 7d94f52916ecca6d3c68eb13ab68a2ab
SHA1 f40da9aa43d2208ab2ca0c0792572588b5f54c02
SHA512 c15e0655df3a745949926ff7b783b565a137916a3dfc52f15698643ac8405223259d2ae7641e4d4ab572f926cd0b192a500ef10349cab60b1e92da838497fd0c
MD5 SHA1 SHA512

Submit Download

krasota_ta_kakaya.vbs

Path C:\Program Files (x86)\na ulissdfsdf\take me devo4ka\kandyvi\krasota_ta_kakaya.vbs
Size 909B
SHA256 73ef3bffc757aa3b8b181a92a08f0c525996bac3a51935200690ac77e8e7be57
MD5 7b492ffa8638ebfec98dc28d94d40b50
SHA1 b1c0142200aaecaa0ec81d915879265be6e429cb
SHA512 be1b3563fc5c8b9c918ee217881bf00fdf4040d311dcca6a856526a5583e2dc538d86c25946dc30f19e02f2708e8bc2c28d645a7934b7f189a30f2556f67c77b
MD5 SHA1 SHA512

Submit Download

prich4ki_pouuuuut.vbs

Path C:\Program Files (x86)\na ulissdfsdf\take me devo4ka\kandyvi\prich4ki_pouuuuut.vbs
Size 635B
SHA256 1e27c6d0bf78023e7156a02da0f5d91f6380e3caeca3b14b978c00de52c21969
MD5 a2d2ec3d8447064be489ff80607614eb
SHA1 15aa84b1a47f8f9c1a634bf0491172520008a3c7
SHA512 5a0d105f02b987706d869234bb8634cef297308463403fafaaa651e4f931bc59ee74ac1cb47b92390a0d1cb03d856372a6d55af3eb830fef4d44708c8a980530
MD5 SHA1 SHA512

Submit Download

hosts

Path C:\Windows\System32\drivers\etc\hosts
Size 1KB
SHA256 f8cbd15a3b3a1bef651d687af8dd34a8787d48f0a3a159fb4050bfde2f83711b
MD5 f54958a6917b4db6b6102f354b3be108
SHA1 516f23fa567b63be53cc9e85fc243d09cf0bfee6
SHA512 4dab27bd040bb30aca4be0d477b8b5d7d2614c15667c98566dad271db66976a272b9800159ac4de4149aa116b56b45099d587cdca9e078c233a04420a3f52ef1
MD5 SHA1 SHA512

Submit Download

hosts

Path C:\Windows\System32\drivers\etc\hosts
Size 1KB
SHA256 53f25ec3705be321e5d7c17acc6ea1aba6aae01e99223f97d97bcf288c5a8228
MD5 c0805e6fff9d30c65b91bc9284beac8e
SHA1 45456e27d6632159ed7e4403caa1a16721c3b603
SHA512 34648a026528d9746f73d01f7600bf947fdee00ddf8525cb89338ebd9b51789f968a79b4c1671eeb96ac83f21788167980835cae8c0f86a550ff95bddfa3c2c3
MD5 SHA1 SHA512

Submit Download

memory/3928-38-0x0000000000400000-0x0000000000432000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads