Analysis
-
max time kernel
158s -
max time network
162s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
01/07/2022, 08:05
Static task
static1
Behavioral task
behavioral1
Sample
3e3f8570c11dff0b5a0e061eae6bdd66cf9fa01d815658a0589d98873500358d.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
3e3f8570c11dff0b5a0e061eae6bdd66cf9fa01d815658a0589d98873500358d.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
3e3f8570c11dff0b5a0e061eae6bdd66cf9fa01d815658a0589d98873500358d.exe
-
Size
1.7MB
-
MD5
c290cd24892905fbcf3cb39929de19a5
-
SHA1
4d105c8331d23ded5de85fb18dbe552c73c0998d
-
SHA256
3e3f8570c11dff0b5a0e061eae6bdd66cf9fa01d815658a0589d98873500358d
-
SHA512
f25e7a23f855a7e99e8931455368cd97e6d23a9680dc737fb134726a0b3bb965db99b1d1d1d01d156fef3190d296ce2b7bcd5eb39b587ba685516140a3a22ef9
Score
10/10
Malware Config
Signatures
-
SatanCryptor
Golang ransomware first seen in early 2020.
-
Executes dropped EXE 1 IoCs
pid Process 4280 Satan.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation 3e3f8570c11dff0b5a0e061eae6bdd66cf9fa01d815658a0589d98873500358d.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: Satan.exe File opened (read-only) \??\F: Satan.exe File opened (read-only) \??\A: Satan.exe File opened (read-only) \??\W: Satan.exe File opened (read-only) \??\T: Satan.exe File opened (read-only) \??\S: Satan.exe File opened (read-only) \??\P: Satan.exe File opened (read-only) \??\N: Satan.exe File opened (read-only) \??\Y: Satan.exe File opened (read-only) \??\V: Satan.exe File opened (read-only) \??\O: Satan.exe File opened (read-only) \??\H: Satan.exe File opened (read-only) \??\G: Satan.exe File opened (read-only) \??\K: Satan.exe File opened (read-only) \??\E: Satan.exe File opened (read-only) \??\B: Satan.exe File opened (read-only) \??\Z: Satan.exe File opened (read-only) \??\X: Satan.exe File opened (read-only) \??\U: Satan.exe File opened (read-only) \??\Q: Satan.exe File opened (read-only) \??\L: Satan.exe File opened (read-only) \??\R: Satan.exe File opened (read-only) \??\M: Satan.exe File opened (read-only) \??\I: Satan.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\[[email protected]]he.pak.satan Satan.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[[email protected]]Personal2019R_Trial-ul-oob.xrm-ms.satan Satan.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\server\[[email protected]]classes.jsa.satan Satan.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\[[email protected]]C2RManifest.PowerView.PowerView.x-none.msi.16.x-none.xml.satan Satan.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[[email protected]]O365ProPlusEDUR_SubTrial-pl.xrm-ms.satan Satan.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[[email protected]]O365SmallBusPremR_Grace-ul-oob.xrm-ms.satan Satan.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[[email protected]]ProfessionalR_OEM_Perp-ppd.xrm-ms.satan Satan.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\[[email protected]]AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml.satan Satan.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[[email protected]]HomeStudent2019R_Retail-ul-oob.xrm-ms.satan Satan.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[[email protected]]MondoR_Retail-ppd.xrm-ms.satan Satan.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[[email protected]]O365HomePremR_Subscription4-ppd.xrm-ms.satan Satan.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\[[email protected]]Georgia.xml.satan Satan.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[[email protected]]HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms.satan Satan.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[[email protected]]HomeBusinessR_OEM_Perp3-ppd.xrm-ms.satan Satan.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[[email protected]]HomeBusinessR_Retail2-ul-phn.xrm-ms.satan Satan.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[[email protected]]O365ProPlusR_Subscription2-ul-oob.xrm-ms.satan Satan.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[[email protected]]PersonalPipcR_OEM_Perp-ppd.xrm-ms.satan Satan.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[[email protected]]ProfessionalR_Retail-ppd.xrm-ms.satan Satan.exe File opened for modification C:\Program Files\[[email protected]]ExitDismount.3g2.satan Satan.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[[email protected]]Excel2019R_Trial-ul-oob.xrm-ms.satan Satan.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\[[email protected]]Orange Red.xml.satan Satan.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[[email protected]]O365HomePremR_SubTrial1-pl.xrm-ms.satan Satan.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\[[email protected]]Green Yellow.xml.satan Satan.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\[[email protected]]C2RManifest.proofing.msi.16.en-us.xml.satan Satan.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[[email protected]]MondoR_ConsumerSub_Bypass30-ul-oob.xrm-ms.satan Satan.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[[email protected]]MondoR_SubTrial-pl.xrm-ms.satan Satan.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\[[email protected]]fil.pak.satan Satan.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[[email protected]]HomeBusinessR_Grace-ul-oob.xrm-ms.satan Satan.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[[email protected]]O365HomePremR_SubTrial4-ppd.xrm-ms.satan Satan.exe File opened for modification C:\Program Files\7-Zip\Lang\[[email protected]]fur.txt.satan Satan.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[[email protected]]O365HomePremR_SubTest5-ppd.xrm-ms.satan Satan.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[[email protected]]ProfessionalR_OEM_Perp-pl.xrm-ms.satan Satan.exe File opened for modification C:\Program Files\7-Zip\Lang\[[email protected]]ru.txt.satan Satan.exe File opened for modification C:\Program Files\[[email protected]]ConvertGroup.ex_.satan Satan.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[[email protected]]HomeBusinessR_Retail3-ul-phn.xrm-ms.satan Satan.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[[email protected]]HomeBusinessR_Trial2-pl.xrm-ms.satan Satan.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[[email protected]]PowerPointVL_MAK-ppd.xrm-ms.satan Satan.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[[email protected]]O365HomePremR_SubTest1-pl.xrm-ms.satan Satan.exe File opened for modification C:\Program Files\7-Zip\Lang\[[email protected]]lt.txt.satan Satan.exe File opened for modification C:\Program Files\Google\Chrome\Application\[[email protected]]master_preferences.satan Satan.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\[[email protected]]C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml.satan Satan.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[[email protected]]HomeBusiness2019R_OEM_Perp3-ppd.xrm-ms.satan Satan.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[[email protected]]MondoR_EnterpriseSub_Bypass30-ul-oob.xrm-ms.satan Satan.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[[email protected]]AccessR_Grace-ppd.xrm-ms.satan Satan.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[[email protected]]O365HomePremR_SubTrial4-ul-oob.xrm-ms.satan Satan.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[[email protected]]O365SmallBusPremR_Subscription3-ul-oob.xrm-ms.satan Satan.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[[email protected]]OutlookVL_MAK-ppd.xrm-ms.satan Satan.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\[[email protected]]Marquee.xml.satan Satan.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[[email protected]]O365SmallBusPremR_Subscription1-ul-oob.xrm-ms.satan Satan.exe File opened for modification C:\Program Files\7-Zip\[[email protected]]7z.sfx.satan Satan.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[[email protected]]MondoR_Subscription-pl.xrm-ms.satan Satan.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\[[email protected]]AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.satan Satan.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\[[email protected]]AppXManifest.90160000-3102-0000-1000-0000000FF1CE.xml.satan Satan.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[[email protected]]AccessR_OEM_Perp-pl.xrm-ms.satan Satan.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\[[email protected]]am.pak.satan Satan.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[[email protected]]ExcelR_Trial-pl.xrm-ms.satan Satan.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[[email protected]]O365HomePremR_SubTrial3-ppd.xrm-ms.satan Satan.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\[[email protected]]chrome_200_percent.pak.satan Satan.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\[[email protected]]AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.satan Satan.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[[email protected]]ExcelVL_MAK-ul-oob.xrm-ms.satan Satan.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[[email protected]]MondoR_Retail-ul-oob.xrm-ms.satan Satan.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[[email protected]]O365BusinessR_SubTrial-ppd.xrm-ms.satan Satan.exe File opened for modification C:\Program Files\[[email protected]]CompressMerge.mpeg3.satan Satan.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\[[email protected]]es-419.pak.satan Satan.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4116 3e3f8570c11dff0b5a0e061eae6bdd66cf9fa01d815658a0589d98873500358d.exe 4116 3e3f8570c11dff0b5a0e061eae6bdd66cf9fa01d815658a0589d98873500358d.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4116 wrote to memory of 4280 4116 3e3f8570c11dff0b5a0e061eae6bdd66cf9fa01d815658a0589d98873500358d.exe 81 PID 4116 wrote to memory of 4280 4116 3e3f8570c11dff0b5a0e061eae6bdd66cf9fa01d815658a0589d98873500358d.exe 81 PID 4116 wrote to memory of 4280 4116 3e3f8570c11dff0b5a0e061eae6bdd66cf9fa01d815658a0589d98873500358d.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\3e3f8570c11dff0b5a0e061eae6bdd66cf9fa01d815658a0589d98873500358d.exe"C:\Users\Admin\AppData\Local\Temp\3e3f8570c11dff0b5a0e061eae6bdd66cf9fa01d815658a0589d98873500358d.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Satan.exe"C:\Satan.exe"2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
PID:4280
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
142KB
MD54153cbc1f51bca54ba1e948a3653185b
SHA1090e58b0b9ce144598b375c0c206289308535ef3
SHA256cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682
SHA512d1232323496022e2e48dfa372d9d3844ebd31a2390896bca3914d246666cc29a4019313acf23458c540baa07a261023adf46da5315d21ee0557a0b5eb406fb7f
-
Filesize
142KB
MD54153cbc1f51bca54ba1e948a3653185b
SHA1090e58b0b9ce144598b375c0c206289308535ef3
SHA256cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682
SHA512d1232323496022e2e48dfa372d9d3844ebd31a2390896bca3914d246666cc29a4019313acf23458c540baa07a261023adf46da5315d21ee0557a0b5eb406fb7f