Analysis
-
max time kernel
153s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
08-07-2022 06:30
Static task
static1
Behavioral task
behavioral1
Sample
Satan.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Satan.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
Satan.exe
-
Size
142KB
-
MD5
4153cbc1f51bca54ba1e948a3653185b
-
SHA1
090e58b0b9ce144598b375c0c206289308535ef3
-
SHA256
cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682
-
SHA512
d1232323496022e2e48dfa372d9d3844ebd31a2390896bca3914d246666cc29a4019313acf23458c540baa07a261023adf46da5315d21ee0557a0b5eb406fb7f
Score
10/10
Malware Config
Signatures
-
SatanCryptor
Golang ransomware first seen in early 2020.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\T: Satan.exe File opened (read-only) \??\Q: Satan.exe File opened (read-only) \??\O: Satan.exe File opened (read-only) \??\B: Satan.exe File opened (read-only) \??\A: Satan.exe File opened (read-only) \??\E: Satan.exe File opened (read-only) \??\Z: Satan.exe File opened (read-only) \??\Y: Satan.exe File opened (read-only) \??\X: Satan.exe File opened (read-only) \??\U: Satan.exe File opened (read-only) \??\S: Satan.exe File opened (read-only) \??\M: Satan.exe File opened (read-only) \??\F: Satan.exe File opened (read-only) \??\W: Satan.exe File opened (read-only) \??\N: Satan.exe File opened (read-only) \??\J: Satan.exe File opened (read-only) \??\I: Satan.exe File opened (read-only) \??\H: Satan.exe File opened (read-only) \??\G: Satan.exe File opened (read-only) \??\V: Satan.exe File opened (read-only) \??\R: Satan.exe File opened (read-only) \??\P: Satan.exe File opened (read-only) \??\L: Satan.exe File opened (read-only) \??\K: Satan.exe -
Drops file in Program Files directory 63 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\[[email protected]]Resource.zip.satan Satan.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\[[email protected]]Explorer.zip.satan Satan.exe File opened for modification C:\Program Files\7-Zip\[[email protected]]7z.sfx.satan Satan.exe File opened for modification C:\Program Files\7-Zip\Lang\[[email protected]]cs.txt.satan Satan.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\[[email protected]]UserControl.zip.satan Satan.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\[[email protected]]SettingsInternal.zip.satan Satan.exe File opened for modification C:\Program Files\7-Zip\Lang\[[email protected]]ba.txt.satan Satan.exe File opened for modification C:\Program Files\7-Zip\Lang\[[email protected]]eu.txt.satan Satan.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\[[email protected]]CodeFile.zip.satan Satan.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\[[email protected]]Interface.zip.satan Satan.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\[[email protected]]ResourceInternal.zip.satan Satan.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\[[email protected]]Visualizer.zip.satan Satan.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\[[email protected]]Form.zip.satan Satan.exe File opened for modification C:\Program Files\7-Zip\Lang\[[email protected]]az.txt.satan Satan.exe File opened for modification C:\Program Files\7-Zip\Lang\[[email protected]]de.txt.satan Satan.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\[[email protected]]AppConfigurationInternal.zip.satan Satan.exe File opened for modification C:\Program Files\7-Zip\Lang\[[email protected]]ext.txt.satan Satan.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\[[email protected]]AssemblyInfo.zip.satan Satan.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\[[email protected]]Class.zip.satan Satan.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\[[email protected]]Module.zip.satan Satan.exe File opened for modification C:\Program Files\7-Zip\[[email protected]]descript.ion.satan Satan.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\[[email protected]]AssemblyInfoInternal.zip.satan Satan.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\[[email protected]]Dialog.zip.satan Satan.exe File opened for modification C:\Program Files\7-Zip\Lang\[[email protected]]an.txt.satan Satan.exe File opened for modification C:\Program Files\7-Zip\Lang\[[email protected]]es.txt.satan Satan.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\[[email protected]]Text.zip.satan Satan.exe File opened for modification C:\Program Files\7-Zip\Lang\[[email protected]]bn.txt.satan Satan.exe File opened for modification C:\Program Files\7-Zip\Lang\[[email protected]]co.txt.satan Satan.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\[[email protected]]AppConfig.zip.satan Satan.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\[[email protected]]TextFile.zip.satan Satan.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\[[email protected]]Dataset.zip.satan Satan.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\[[email protected]]ResourceInternal.zip.satan Satan.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\[[email protected]]XmlFile.zip.satan Satan.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\[[email protected]]MDIParent.zip.satan Satan.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\[[email protected]]AssemblyInfoInternal.zip.satan Satan.exe File opened for modification C:\Program Files\7-Zip\Lang\[[email protected]]br.txt.satan Satan.exe File opened for modification C:\Program Files\7-Zip\Lang\[[email protected]]ca.txt.satan Satan.exe File opened for modification C:\Program Files\7-Zip\Lang\[[email protected]]el.txt.satan Satan.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\[[email protected]]Class.zip.satan Satan.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\[[email protected]]LoginForm.zip.satan Satan.exe File opened for modification C:\Program Files\7-Zip\Lang\[[email protected]]ar.txt.satan Satan.exe File opened for modification C:\Program Files\7-Zip\[[email protected]]7zCon.sfx.satan Satan.exe File opened for modification C:\Program Files\7-Zip\Lang\[[email protected]]da.txt.satan Satan.exe File opened for modification C:\Program Files\7-Zip\Lang\[[email protected]]eo.txt.satan Satan.exe File opened for modification C:\Program Files\7-Zip\Lang\[[email protected]]et.txt.satan Satan.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\[[email protected]]DataSet.zip.satan Satan.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\[[email protected]]SettingsInternal.zip.satan Satan.exe File opened for modification C:\Program Files\7-Zip\Lang\[[email protected]]af.txt.satan Satan.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\[[email protected]]EmptyDatabase.zip.satan Satan.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\[[email protected]]EmptyDatabase.zip.satan Satan.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\[[email protected]]SplashScreen.zip.satan Satan.exe File opened for modification C:\Program Files\7-Zip\Lang\[[email protected]]be.txt.satan Satan.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\[[email protected]]AboutBox.zip.satan Satan.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\[[email protected]]AppConfigInternal.zip.satan Satan.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\[[email protected]]Form.zip.satan Satan.exe File opened for modification C:\Program Files\7-Zip\Lang\[[email protected]]cy.txt.satan Satan.exe File opened for modification C:\Program Files\7-Zip\Lang\[[email protected]]ast.txt.satan Satan.exe File opened for modification C:\Program Files\7-Zip\Lang\[[email protected]]bg.txt.satan Satan.exe File opened for modification C:\Program Files\7-Zip\Lang\[[email protected]]en.ttt.satan Satan.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\[[email protected]]MDIParent.zip.satan Satan.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\[[email protected]]Settings.zip.satan Satan.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\[[email protected]]UserControl.zip.satan Satan.exe File opened for modification C:\Program Files\7-Zip\[[email protected]]History.txt.satan Satan.exe