satancryptor | cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682

General

Target

cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682.exe
Size

142KB
MD5

4153cbc1f51bca54ba1e948a3653185b
SHA1

090e58b0b9ce144598b375c0c206289308535ef3
SHA256

cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682
SHA512

d1232323496022e2e48dfa372d9d3844ebd31a2390896bca3914d246666cc29a4019313acf23458c540baa07a261023adf46da5315d21ee0557a0b5eb406fb7f

Score

10^/10

satancryptor ransomware spyware stealer

Malware Config

Signatures

SatanCryptor
Golang ransomware first seen in early 2020.
ransomware satancryptor
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682.exe

description	ioc	process
File opened (read-only)	\??\S:	cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682.exe
File opened (read-only)	\??\Q:	cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682.exe
File opened (read-only)	\??\M:	cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682.exe
File opened (read-only)	\??\K:	cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682.exe
File opened (read-only)	\??\F:	cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682.exe
File opened (read-only)	\??\X:	cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682.exe
File opened (read-only)	\??\U:	cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682.exe
File opened (read-only)	\??\L:	cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682.exe
File opened (read-only)	\??\V:	cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682.exe
File opened (read-only)	\??\Y:	cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682.exe
File opened (read-only)	\??\T:	cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682.exe
File opened (read-only)	\??\O:	cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682.exe
File opened (read-only)	\??\H:	cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682.exe
File opened (read-only)	\??\E:	cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682.exe
File opened (read-only)	\??\B:	cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682.exe
File opened (read-only)	\??\Z:	cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682.exe
File opened (read-only)	\??\R:	cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682.exe
File opened (read-only)	\??\P:	cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682.exe
File opened (read-only)	\??\N:	cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682.exe
File opened (read-only)	\??\J:	cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682.exe
File opened (read-only)	\??\I:	cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682.exe
File opened (read-only)	\??\G:	cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682.exe
File opened (read-only)	\??\A:	cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682.exe
File opened (read-only)	\??\W:	cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682.exe

Drops file in Program Files directory 64 IoCs

Processes:

cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682.exe

description	ioc	process
File opened for modification	C:\Program Files\7-Zip\Lang\[[email protected]]fy.txt.satan	cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682.exe
File opened for modification	C:\Program Files\7-Zip\Lang\[[email protected]]he.txt.satan	cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\[[email protected]]Visualizer.zip.satan	cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\[[email protected]]Dataset.zip.satan	cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682.exe
File opened for modification	C:\Program Files\7-Zip\Lang\[[email protected]]ext.txt.satan	cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682.exe
File opened for modification	C:\Program Files\7-Zip\[[email protected]]History.txt.satan	cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682.exe
File opened for modification	C:\Program Files\7-Zip\Lang\[[email protected]]da.txt.satan	cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682.exe
File opened for modification	C:\Program Files\7-Zip\Lang\[[email protected]]be.txt.satan	cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682.exe
File opened for modification	C:\Program Files\7-Zip\Lang\[[email protected]]ja.txt.satan	cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682.exe
File opened for modification	C:\Program Files\7-Zip\Lang\[[email protected]]de.txt.satan	cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682.exe
File opened for modification	C:\Program Files\7-Zip\Lang\[[email protected]]fa.txt.satan	cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682.exe
File opened for modification	C:\Program Files\7-Zip\Lang\[[email protected]]is.txt.satan	cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682.exe
File opened for modification	C:\Program Files\7-Zip\Lang\[[email protected]]ka.txt.satan	cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\[[email protected]]Form.zip.satan	cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\[[email protected]]ResourceInternal.zip.satan	cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\[[email protected]]SplashScreen.zip.satan	cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\[[email protected]]UserControl.zip.satan	cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682.exe
File opened for modification	C:\Program Files\7-Zip\Lang\[[email protected]]ba.txt.satan	cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682.exe
File opened for modification	C:\Program Files\7-Zip\Lang\[[email protected]]bn.txt.satan	cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682.exe
File opened for modification	C:\Program Files\7-Zip\Lang\[[email protected]]cs.txt.satan	cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\[[email protected]]Class.zip.satan	cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\[[email protected]]MDIParent.zip.satan	cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\[[email protected]]Dialog.zip.satan	cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\[[email protected]]Form.zip.satan	cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\[[email protected]]Module.zip.satan	cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682.exe
File opened for modification	C:\Program Files\7-Zip\Lang\[[email protected]]eu.txt.satan	cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682.exe
File opened for modification	C:\Program Files\7-Zip\Lang\[[email protected]]hi.txt.satan	cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\[[email protected]]AppConfigInternal.zip.satan	cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\[[email protected]]SettingsInternal.zip.satan	cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\[[email protected]]AppConfigurationInternal.zip.satan	cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682.exe
File opened for modification	C:\Program Files\7-Zip\[[email protected]]7z.sfx.satan	cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682.exe
File opened for modification	C:\Program Files\7-Zip\[[email protected]]descript.ion.satan	cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682.exe
File opened for modification	C:\Program Files\7-Zip\Lang\[[email protected]]gu.txt.satan	cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\[[email protected]]CodeFile.zip.satan	cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\[[email protected]]ResourceInternal.zip.satan	cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\[[email protected]]Class.zip.satan	cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\[[email protected]]EmptyDatabase.zip.satan	cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\[[email protected]]LoginForm.zip.satan	cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682.exe
File opened for modification	C:\Program Files\7-Zip\Lang\[[email protected]]hy.txt.satan	cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682.exe
File opened for modification	C:\Program Files\7-Zip\Lang\[[email protected]]id.txt.satan	cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\[[email protected]]DataSet.zip.satan	cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\[[email protected]]Resource.zip.satan	cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682.exe
File opened for modification	C:\Program Files\7-Zip\Lang\[[email protected]]ca.txt.satan	cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682.exe
File opened for modification	C:\Program Files\7-Zip\Lang\[[email protected]]en.ttt.satan	cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\[[email protected]]UserControl.zip.satan	cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\[[email protected]]XmlFile.zip.satan	cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\[[email protected]]MDIParent.zip.satan	cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\[[email protected]]Text.zip.satan	cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\[[email protected]]EmptyDatabase.zip.satan	cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\[[email protected]]TextFile.zip.satan	cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682.exe
File opened for modification	C:\Program Files\7-Zip\Lang\[[email protected]]fi.txt.satan	cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682.exe
File opened for modification	C:\Program Files\7-Zip\Lang\[[email protected]]fur.txt.satan	cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682.exe
File opened for modification	C:\Program Files\7-Zip\Lang\[[email protected]]hu.txt.satan	cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682.exe
File opened for modification	C:\Program Files\7-Zip\Lang\[[email protected]]it.txt.satan	cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682.exe
File opened for modification	C:\Program Files\7-Zip\Lang\[[email protected]]kaa.txt.satan	cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682.exe
File opened for modification	C:\Program Files\7-Zip\Lang\[[email protected]]an.txt.satan	cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682.exe
File opened for modification	C:\Program Files\7-Zip\Lang\[[email protected]]br.txt.satan	cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682.exe
File opened for modification	C:\Program Files\7-Zip\Lang\[[email protected]]io.txt.satan	cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682.exe
File opened for modification	C:\Program Files\7-Zip\Lang\[[email protected]]af.txt.satan	cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682.exe
File opened for modification	C:\Program Files\7-Zip\Lang\[[email protected]]cy.txt.satan	cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\[[email protected]]Explorer.zip.satan	cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682.exe
File opened for modification	C:\Program Files\7-Zip\[[email protected]]7zCon.sfx.satan	cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682.exe
File opened for modification	C:\Program Files\7-Zip\Lang\[[email protected]]az.txt.satan	cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682.exe
File opened for modification	C:\Program Files\7-Zip\Lang\[[email protected]]el.txt.satan	cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682.exe

C:\Users\Admin\AppData\Local\Temp\cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682.exe
"C:\Users\Admin\AppData\Local\Temp\cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682.exe"
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
PID:1768

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1768-54-0x0000000075C01000-0x0000000075C03000-memory.dmp

Filesize
8KB

Download
memory/1768-55-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/1768-56-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download

Analysis

Sharing