Analysis
-
max time kernel
126s -
max time network
181s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
08-07-2022 06:30
Static task
static1
Behavioral task
behavioral1
Sample
Satan.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Satan.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
Satan.exe
-
Size
142KB
-
MD5
4153cbc1f51bca54ba1e948a3653185b
-
SHA1
090e58b0b9ce144598b375c0c206289308535ef3
-
SHA256
cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682
-
SHA512
d1232323496022e2e48dfa372d9d3844ebd31a2390896bca3914d246666cc29a4019313acf23458c540baa07a261023adf46da5315d21ee0557a0b5eb406fb7f
Score
10/10
Malware Config
Signatures
-
SatanCryptor
Golang ransomware first seen in early 2020.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\U: Satan.exe File opened (read-only) \??\N: Satan.exe File opened (read-only) \??\L: Satan.exe File opened (read-only) \??\J: Satan.exe File opened (read-only) \??\H: Satan.exe File opened (read-only) \??\G: Satan.exe File opened (read-only) \??\Y: Satan.exe File opened (read-only) \??\V: Satan.exe File opened (read-only) \??\F: Satan.exe File opened (read-only) \??\P: Satan.exe File opened (read-only) \??\K: Satan.exe File opened (read-only) \??\A: Satan.exe File opened (read-only) \??\X: Satan.exe File opened (read-only) \??\Q: Satan.exe File opened (read-only) \??\T: Satan.exe File opened (read-only) \??\S: Satan.exe File opened (read-only) \??\R: Satan.exe File opened (read-only) \??\I: Satan.exe File opened (read-only) \??\E: Satan.exe File opened (read-only) \??\Z: Satan.exe File opened (read-only) \??\W: Satan.exe File opened (read-only) \??\B: Satan.exe File opened (read-only) \??\O: Satan.exe File opened (read-only) \??\M: Satan.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\Lang\[[email protected]]sr-spc.txt.satan Satan.exe File opened for modification C:\Program Files\7-Zip\Lang\[[email protected]]sv.txt.satan Satan.exe File opened for modification C:\Program Files\7-Zip\Lang\[[email protected]]tt.txt.satan Satan.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\[[email protected]]external_extensions.json.satan Satan.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\[[email protected]]am.pak.satan Satan.exe File opened for modification C:\Program Files\7-Zip\Lang\[[email protected]]mr.txt.satan Satan.exe File opened for modification C:\Program Files\7-Zip\Lang\[[email protected]]ms.txt.satan Satan.exe File opened for modification C:\Program Files\7-Zip\Lang\[[email protected]]sq.txt.satan Satan.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\[[email protected]]ar.pak.satan Satan.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\[[email protected]]et.pak.satan Satan.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\[[email protected]]pt-BR.pak.satan Satan.exe File opened for modification C:\Program Files\7-Zip\Lang\[[email protected]]pa-in.txt.satan Satan.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\[[email protected]]en-US.pak.satan Satan.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\[[email protected]]LICENSE.satan Satan.exe File opened for modification C:\Program Files\7-Zip\Lang\[[email protected]]fr.txt.satan Satan.exe File opened for modification C:\Program Files\7-Zip\Lang\[[email protected]]hr.txt.satan Satan.exe File opened for modification C:\Program Files\7-Zip\Lang\[[email protected]]ne.txt.satan Satan.exe File opened for modification C:\Program Files\7-Zip\Lang\[[email protected]]sl.txt.satan Satan.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\[[email protected]]cs.pak.satan Satan.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\[[email protected]]hr.pak.satan Satan.exe File opened for modification C:\Program Files\7-Zip\Lang\[[email protected]]az.txt.satan Satan.exe File opened for modification C:\Program Files\7-Zip\Lang\[[email protected]]cs.txt.satan Satan.exe File opened for modification C:\Program Files\7-Zip\Lang\[[email protected]]ja.txt.satan Satan.exe File opened for modification C:\Program Files\7-Zip\[[email protected]]readme.txt.satan Satan.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\[[email protected]]zh-TW.pak.satan Satan.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\[[email protected]]tr.pak.satan Satan.exe File opened for modification C:\Program Files\7-Zip\Lang\[[email protected]]el.txt.satan Satan.exe File opened for modification C:\Program Files\7-Zip\Lang\[[email protected]]lv.txt.satan Satan.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\[[email protected]]el.pak.satan Satan.exe File opened for modification C:\Program Files\[[email protected]]GroupMerge.M2T.satan Satan.exe File opened for modification C:\Program Files\7-Zip\Lang\[[email protected]]bg.txt.satan Satan.exe File opened for modification C:\Program Files\7-Zip\Lang\[[email protected]]ky.txt.satan Satan.exe File opened for modification C:\Program Files\7-Zip\Lang\[[email protected]]sk.txt.satan Satan.exe File opened for modification C:\Program Files\7-Zip\Lang\[[email protected]]io.txt.satan Satan.exe File opened for modification C:\Program Files\7-Zip\Lang\[[email protected]]gl.txt.satan Satan.exe File opened for modification C:\Program Files\Microsoft Office\[[email protected]]AppXManifest.xml.satan Satan.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\[[email protected]]89.0.4389.114.manifest.satan Satan.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\[[email protected]]es-419.pak.satan Satan.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\[[email protected]]chrome.dll.sig.satan Satan.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\[[email protected]]lt.pak.satan Satan.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\[[email protected]]sr.pak.satan Satan.exe File opened for modification C:\Program Files\7-Zip\Lang\[[email protected]]es.txt.satan Satan.exe File opened for modification C:\Program Files\7-Zip\Lang\[[email protected]]fur.txt.satan Satan.exe File opened for modification C:\Program Files\[[email protected]]ExpandUpdate.xps.satan Satan.exe File opened for modification C:\Program Files\7-Zip\Lang\[[email protected]]ug.txt.satan Satan.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\[[email protected]]pt-PT.pak.satan Satan.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\[[email protected]]Logo.png.satan Satan.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\[[email protected]]COPYRIGHT.satan Satan.exe File opened for modification C:\Program Files\7-Zip\Lang\[[email protected]]af.txt.satan Satan.exe File opened for modification C:\Program Files\7-Zip\Lang\[[email protected]]ba.txt.satan Satan.exe File opened for modification C:\Program Files\7-Zip\Lang\[[email protected]]uk.txt.satan Satan.exe File opened for modification C:\Program Files\7-Zip\Lang\[[email protected]]pl.txt.satan Satan.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\[[email protected]]bn.pak.satan Satan.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\[[email protected]]bg.pak.satan Satan.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\[[email protected]]id.pak.satan Satan.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\[[email protected]]vi.pak.satan Satan.exe File opened for modification C:\Program Files\7-Zip\[[email protected]]7z.sfx.satan Satan.exe File opened for modification C:\Program Files\7-Zip\Lang\[[email protected]]an.txt.satan Satan.exe File opened for modification C:\Program Files\7-Zip\Lang\[[email protected]]ext.txt.satan Satan.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\[[email protected]]widevinecdm.dll.sig.satan Satan.exe File opened for modification C:\Program Files\7-Zip\Lang\[[email protected]]mn.txt.satan Satan.exe File opened for modification C:\Program Files\7-Zip\Lang\[[email protected]]vi.txt.satan Satan.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\[[email protected]]da.pak.satan Satan.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\[[email protected]]it.pak.satan Satan.exe