satancryptor | 0eb47cce8acbc742dd9d8e73a3c48411c13bdb03d99dfbeafe1ddcb453626f8f

General

Target

dd286a4d79d0f4c2b906073c7f46680252ca09c1c39b0dc12c92097c56662876.exe
Size

1.8MB
MD5

057aad993a3ef50f6b3ca2db37cb928a
SHA1

a57592be641738c86c85308ef68148181249bc0b
SHA256

dd286a4d79d0f4c2b906073c7f46680252ca09c1c39b0dc12c92097c56662876
SHA512

87c89027d60f80e99c526584fa093620b3f099151170362424ad78f5e4d7184bd9f2d627ec8463ca202127835f435dd4f85bf2b0d9351593c688855f0bbaffbb

Score

10^/10

satancryptor ransomware spyware stealer suricata

Malware Config

Signatures

SatanCryptor
Golang ransomware first seen in early 2020.
ransomware satancryptor
suricata: ET MALWARE Possible Satan Cryptor GeoIP Lookup
suricata: ET MALWARE Possible Satan Cryptor GeoIP Lookup
suricata

Modifies extensions of user files 1 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

dd286a4d79d0f4c2b906073c7f46680252ca09c1c39b0dc12c92097c56662876.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Pictures\AddInvoke.tiff	dd286a4d79d0f4c2b906073c7f46680252ca09c1c39b0dc12c92097c56662876.exe

Drops startup file 1 IoCs

Processes:

dd286a4d79d0f4c2b906073c7f46680252ca09c1c39b0dc12c92097c56662876.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\# SATAN CRYPTOR #.hta	dd286a4d79d0f4c2b906073c7f46680252ca09c1c39b0dc12c92097c56662876.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Drops desktop.ini file(s) 28 IoCs

Processes:

dd286a4d79d0f4c2b906073c7f46680252ca09c1c39b0dc12c92097c56662876.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	dd286a4d79d0f4c2b906073c7f46680252ca09c1c39b0dc12c92097c56662876.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	dd286a4d79d0f4c2b906073c7f46680252ca09c1c39b0dc12c92097c56662876.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	dd286a4d79d0f4c2b906073c7f46680252ca09c1c39b0dc12c92097c56662876.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	dd286a4d79d0f4c2b906073c7f46680252ca09c1c39b0dc12c92097c56662876.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	dd286a4d79d0f4c2b906073c7f46680252ca09c1c39b0dc12c92097c56662876.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	dd286a4d79d0f4c2b906073c7f46680252ca09c1c39b0dc12c92097c56662876.exe
File opened for modification	C:\Users\Admin\3D Objects\desktop.ini	dd286a4d79d0f4c2b906073c7f46680252ca09c1c39b0dc12c92097c56662876.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	dd286a4d79d0f4c2b906073c7f46680252ca09c1c39b0dc12c92097c56662876.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	dd286a4d79d0f4c2b906073c7f46680252ca09c1c39b0dc12c92097c56662876.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	dd286a4d79d0f4c2b906073c7f46680252ca09c1c39b0dc12c92097c56662876.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	dd286a4d79d0f4c2b906073c7f46680252ca09c1c39b0dc12c92097c56662876.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	dd286a4d79d0f4c2b906073c7f46680252ca09c1c39b0dc12c92097c56662876.exe
File opened for modification	C:\Users\Public\desktop.ini	dd286a4d79d0f4c2b906073c7f46680252ca09c1c39b0dc12c92097c56662876.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	dd286a4d79d0f4c2b906073c7f46680252ca09c1c39b0dc12c92097c56662876.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	dd286a4d79d0f4c2b906073c7f46680252ca09c1c39b0dc12c92097c56662876.exe
File opened for modification	C:\Users\Public\AccountPictures\desktop.ini	dd286a4d79d0f4c2b906073c7f46680252ca09c1c39b0dc12c92097c56662876.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	dd286a4d79d0f4c2b906073c7f46680252ca09c1c39b0dc12c92097c56662876.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	dd286a4d79d0f4c2b906073c7f46680252ca09c1c39b0dc12c92097c56662876.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	dd286a4d79d0f4c2b906073c7f46680252ca09c1c39b0dc12c92097c56662876.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	dd286a4d79d0f4c2b906073c7f46680252ca09c1c39b0dc12c92097c56662876.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	dd286a4d79d0f4c2b906073c7f46680252ca09c1c39b0dc12c92097c56662876.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	dd286a4d79d0f4c2b906073c7f46680252ca09c1c39b0dc12c92097c56662876.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	dd286a4d79d0f4c2b906073c7f46680252ca09c1c39b0dc12c92097c56662876.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	dd286a4d79d0f4c2b906073c7f46680252ca09c1c39b0dc12c92097c56662876.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	dd286a4d79d0f4c2b906073c7f46680252ca09c1c39b0dc12c92097c56662876.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	dd286a4d79d0f4c2b906073c7f46680252ca09c1c39b0dc12c92097c56662876.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	dd286a4d79d0f4c2b906073c7f46680252ca09c1c39b0dc12c92097c56662876.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	dd286a4d79d0f4c2b906073c7f46680252ca09c1c39b0dc12c92097c56662876.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

17 extreme-ip-lookup.com
GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.

Processes:

description flow ioc

HTTP User-Agent header 18 Go-http-client/1.1

flow	ioc
17	extreme-ip-lookup.com

description	flow	ioc
HTTP User-Agent header	18	Go-http-client/1.1

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

dd286a4d79d0f4c2b906073c7f46680252ca09c1c39b0dc12c92097c56662876.exe

description	pid	process	target process
PID 8 wrote to memory of 4512	8	dd286a4d79d0f4c2b906073c7f46680252ca09c1c39b0dc12c92097c56662876.exe	cmd.exe
PID 8 wrote to memory of 4512	8	dd286a4d79d0f4c2b906073c7f46680252ca09c1c39b0dc12c92097c56662876.exe	cmd.exe
PID 8 wrote to memory of 4512	8	dd286a4d79d0f4c2b906073c7f46680252ca09c1c39b0dc12c92097c56662876.exe	cmd.exe
PID 8 wrote to memory of 1196	8	dd286a4d79d0f4c2b906073c7f46680252ca09c1c39b0dc12c92097c56662876.exe	cmd.exe
PID 8 wrote to memory of 1196	8	dd286a4d79d0f4c2b906073c7f46680252ca09c1c39b0dc12c92097c56662876.exe	cmd.exe
PID 8 wrote to memory of 1196	8	dd286a4d79d0f4c2b906073c7f46680252ca09c1c39b0dc12c92097c56662876.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\dd286a4d79d0f4c2b906073c7f46680252ca09c1c39b0dc12c92097c56662876.exe
"C:\Users\Admin\AppData\Local\Temp\dd286a4d79d0f4c2b906073c7f46680252ca09c1c39b0dc12c92097c56662876.exe"
1⤵
- Modifies extensions of user files
- Drops startup file
- Drops desktop.ini file(s)
- Suspicious use of WriteProcessMemory
PID:8
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ver
  2⤵
  PID:4512
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C del C:\Users\Admin\AppData\Local\Temp\dd286a4d79d0f4c2b906073c7f46680252ca09c1c39b0dc12c92097c56662876.exe
  2⤵
  PID:1196

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1196-131-0x0000000000000000-mapping.dmp

Download
memory/4512-130-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads