satancryptor | 41c059f4dfaa143cc75df07f38f50d7d6ac0c6416d3e21aac2e530683c037fdf

Analysis

max time kernel
44s
max time network
48s
platform
windows7_x64
resource
win7-20220414-en
submitted
24-05-2022 21:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

41c059f4dfaa143cc75df07f38f50d7d6ac0c6416d3e21aac2e530683c037fdf.exe
Size

4.7MB
MD5

d2654d7085cfa021953f9a42c8057bba
SHA1

e86ad4024e568938ca94454f00d04a9303f5f7af
SHA256

41c059f4dfaa143cc75df07f38f50d7d6ac0c6416d3e21aac2e530683c037fdf
SHA512

2767f4ab916d58a0700d1df4933f6b8edb7d6e54ec9920a6b228ae1c130563942dbf4828e7ca9066fa71f1f195047a3b78a38e63ef67a0d8232f1599d4f00ea3

Score

10^/10

satancryptor ransomware spyware stealer suricata

Malware Config

Signatures

SatanCryptor
Golang ransomware first seen in early 2020.
ransomware satancryptor
suricata: ET MALWARE Possible Satan Cryptor GeoIP Lookup
suricata: ET MALWARE Possible Satan Cryptor GeoIP Lookup
suricata

Deletes itself 1 IoCs

pid	Process
1688	cmd.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Drops desktop.ini file(s) 34 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\N6KW9TJE\desktop.ini	41c059f4dfaa143cc75df07f38f50d7d6ac0c6416d3e21aac2e530683c037fdf.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	41c059f4dfaa143cc75df07f38f50d7d6ac0c6416d3e21aac2e530683c037fdf.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	41c059f4dfaa143cc75df07f38f50d7d6ac0c6416d3e21aac2e530683c037fdf.exe
File opened for modification	C:\Users\Public\desktop.ini	41c059f4dfaa143cc75df07f38f50d7d6ac0c6416d3e21aac2e530683c037fdf.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	41c059f4dfaa143cc75df07f38f50d7d6ac0c6416d3e21aac2e530683c037fdf.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	41c059f4dfaa143cc75df07f38f50d7d6ac0c6416d3e21aac2e530683c037fdf.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	41c059f4dfaa143cc75df07f38f50d7d6ac0c6416d3e21aac2e530683c037fdf.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\VCRELHVT\desktop.ini	41c059f4dfaa143cc75df07f38f50d7d6ac0c6416d3e21aac2e530683c037fdf.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	41c059f4dfaa143cc75df07f38f50d7d6ac0c6416d3e21aac2e530683c037fdf.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	41c059f4dfaa143cc75df07f38f50d7d6ac0c6416d3e21aac2e530683c037fdf.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	41c059f4dfaa143cc75df07f38f50d7d6ac0c6416d3e21aac2e530683c037fdf.exe
File opened for modification	C:\Users\Public\Music\Sample Music\desktop.ini	41c059f4dfaa143cc75df07f38f50d7d6ac0c6416d3e21aac2e530683c037fdf.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\A9INZ3MO\desktop.ini	41c059f4dfaa143cc75df07f38f50d7d6ac0c6416d3e21aac2e530683c037fdf.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\VP7YQ4XO\desktop.ini	41c059f4dfaa143cc75df07f38f50d7d6ac0c6416d3e21aac2e530683c037fdf.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini	41c059f4dfaa143cc75df07f38f50d7d6ac0c6416d3e21aac2e530683c037fdf.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	41c059f4dfaa143cc75df07f38f50d7d6ac0c6416d3e21aac2e530683c037fdf.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	41c059f4dfaa143cc75df07f38f50d7d6ac0c6416d3e21aac2e530683c037fdf.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	41c059f4dfaa143cc75df07f38f50d7d6ac0c6416d3e21aac2e530683c037fdf.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	41c059f4dfaa143cc75df07f38f50d7d6ac0c6416d3e21aac2e530683c037fdf.exe
File opened for modification	C:\Users\Admin\Favorites\Links for United States\desktop.ini	41c059f4dfaa143cc75df07f38f50d7d6ac0c6416d3e21aac2e530683c037fdf.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	41c059f4dfaa143cc75df07f38f50d7d6ac0c6416d3e21aac2e530683c037fdf.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	41c059f4dfaa143cc75df07f38f50d7d6ac0c6416d3e21aac2e530683c037fdf.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	41c059f4dfaa143cc75df07f38f50d7d6ac0c6416d3e21aac2e530683c037fdf.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	41c059f4dfaa143cc75df07f38f50d7d6ac0c6416d3e21aac2e530683c037fdf.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	41c059f4dfaa143cc75df07f38f50d7d6ac0c6416d3e21aac2e530683c037fdf.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	41c059f4dfaa143cc75df07f38f50d7d6ac0c6416d3e21aac2e530683c037fdf.exe
File opened for modification	C:\Users\Public\Pictures\Sample Pictures\desktop.ini	41c059f4dfaa143cc75df07f38f50d7d6ac0c6416d3e21aac2e530683c037fdf.exe
File opened for modification	C:\Users\Public\Recorded TV\Sample Media\desktop.ini	41c059f4dfaa143cc75df07f38f50d7d6ac0c6416d3e21aac2e530683c037fdf.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	41c059f4dfaa143cc75df07f38f50d7d6ac0c6416d3e21aac2e530683c037fdf.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	41c059f4dfaa143cc75df07f38f50d7d6ac0c6416d3e21aac2e530683c037fdf.exe
File opened for modification	C:\Users\Public\Recorded TV\desktop.ini	41c059f4dfaa143cc75df07f38f50d7d6ac0c6416d3e21aac2e530683c037fdf.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	41c059f4dfaa143cc75df07f38f50d7d6ac0c6416d3e21aac2e530683c037fdf.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	41c059f4dfaa143cc75df07f38f50d7d6ac0c6416d3e21aac2e530683c037fdf.exe
File opened for modification	C:\Users\Public\Videos\Sample Videos\desktop.ini	41c059f4dfaa143cc75df07f38f50d7d6ac0c6416d3e21aac2e530683c037fdf.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
5	extreme-ip-lookup.com

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	6	Go-http-client/1.1

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1452 wrote to memory of 1820	1452	41c059f4dfaa143cc75df07f38f50d7d6ac0c6416d3e21aac2e530683c037fdf.exe	28
PID 1452 wrote to memory of 1820	1452	41c059f4dfaa143cc75df07f38f50d7d6ac0c6416d3e21aac2e530683c037fdf.exe	28
PID 1452 wrote to memory of 1820	1452	41c059f4dfaa143cc75df07f38f50d7d6ac0c6416d3e21aac2e530683c037fdf.exe	28
PID 1452 wrote to memory of 1820	1452	41c059f4dfaa143cc75df07f38f50d7d6ac0c6416d3e21aac2e530683c037fdf.exe	28
PID 1452 wrote to memory of 1688	1452	41c059f4dfaa143cc75df07f38f50d7d6ac0c6416d3e21aac2e530683c037fdf.exe	31
PID 1452 wrote to memory of 1688	1452	41c059f4dfaa143cc75df07f38f50d7d6ac0c6416d3e21aac2e530683c037fdf.exe	31
PID 1452 wrote to memory of 1688	1452	41c059f4dfaa143cc75df07f38f50d7d6ac0c6416d3e21aac2e530683c037fdf.exe	31
PID 1452 wrote to memory of 1688	1452	41c059f4dfaa143cc75df07f38f50d7d6ac0c6416d3e21aac2e530683c037fdf.exe	31

C:\Users\Admin\AppData\Local\Temp\41c059f4dfaa143cc75df07f38f50d7d6ac0c6416d3e21aac2e530683c037fdf.exe
"C:\Users\Admin\AppData\Local\Temp\41c059f4dfaa143cc75df07f38f50d7d6ac0c6416d3e21aac2e530683c037fdf.exe"
1⤵
- Drops desktop.ini file(s)
- Suspicious use of WriteProcessMemory
PID:1452
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ver
  2⤵
  PID:1820
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C del C:\Users\Admin\AppData\Local\Temp\41c059f4dfaa143cc75df07f38f50d7d6ac0c6416d3e21aac2e530683c037fdf.exe
  2⤵
  - Deletes itself
  PID:1688

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads