Analysis

  • max time kernel
    153s
  • max time network
    160s
  • platform
    windows7_x64
  • resource
    win7-20220718-en
  • resource tags

    arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system
  • submitted
    31-07-2022 08:00

General

  • Target

    sts.exe

  • Size

    1.7MB

  • MD5

    c290cd24892905fbcf3cb39929de19a5

  • SHA1

    4d105c8331d23ded5de85fb18dbe552c73c0998d

  • SHA256

    3e3f8570c11dff0b5a0e061eae6bdd66cf9fa01d815658a0589d98873500358d

  • SHA512

    f25e7a23f855a7e99e8931455368cd97e6d23a9680dc737fb134726a0b3bb965db99b1d1d1d01d156fef3190d296ce2b7bcd5eb39b587ba685516140a3a22ef9

Malware Config

Signatures

  • SatanCryptor

    Golang ransomware first seen in early 2020.

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\sts.exe
    "C:\Users\Admin\AppData\Local\Temp\sts.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1956
    • C:\Satan.exe
      "C:\Satan.exe"
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      PID:1944

Network

    No results found
  • 45.124.132.119:80
    Satan.exe
    152 B
    3
  • 10.127.1.1:445
    sts.exe
    152 B
    3
  • 10.127.1.1:88
    sts.exe
    152 B
    3
  • 10.127.1.2:445
    sts.exe
    152 B
    3
  • 10.127.1.1:89
    sts.exe
    152 B
    3
  • 43.247.6.1:80
    sts.exe
    152 B
    3
  • 10.127.1.1:80
    sts.exe
    100 B
    2
  • 10.127.1.3:445
    sts.exe
    152 B
    3
  • 10.127.1.1:90
    sts.exe
    152 B
    3
  • 10.127.1.4:445
    sts.exe
    152 B
    3
  • 43.247.6.1:88
    sts.exe
    152 B
    3
  • 10.127.1.1:99
    sts.exe
    152 B
    3
  • 43.247.6.1:89
    sts.exe
    152 B
    3
  • 10.127.1.5:445
    sts.exe
    152 B
    3
  • 10.127.1.1:443
    sts.exe
    152 B
    3
  • 43.247.6.1:90
    sts.exe
    152 B
    3
  • 10.127.1.6:445
    sts.exe
    152 B
    3
  • 10.127.1.1:6060
    sts.exe
    152 B
    3
  • 43.247.6.1:99
    sts.exe
    152 B
    3
  • 10.127.1.7:445
    sts.exe
    152 B
    3
  • 10.127.1.1:7070
    sts.exe
    152 B
    3
  • 43.247.6.1:443
    sts.exe
    152 B
    3
  • 10.127.1.8:445
    sts.exe
    152 B
    3
  • 10.127.1.1:7080
    sts.exe
    152 B
    3
  • 10.127.1.9:445
    sts.exe
    152 B
    3
  • 43.247.6.1:445
    sts.exe
    152 B
    3
  • 10.127.1.1:7777
    sts.exe
    152 B
    3
  • 43.247.6.1:6060
    sts.exe
    152 B
    3
  • 10.127.1.10:445
    sts.exe
    152 B
    3
  • 10.127.1.1:8000
    sts.exe
    152 B
    3
  • 43.247.6.1:7070
    sts.exe
    152 B
    3
  • 10.127.1.11:445
    sts.exe
    152 B
    3
  • 10.127.1.1:8008
    sts.exe
    152 B
    3
  • 43.247.6.1:7080
    sts.exe
    152 B
    3
  • 10.127.1.12:445
    sts.exe
    152 B
    3
  • 10.127.1.1:8009
    sts.exe
    152 B
    3
  • 43.247.6.1:7777
    sts.exe
    152 B
    3
  • 10.127.1.13:445
    sts.exe
    152 B
    3
  • 10.127.1.1:8010
    sts.exe
    152 B
    3
  • 10.127.1.14:445
    sts.exe
    152 B
    3
  • 43.247.6.1:8000
    sts.exe
    152 B
    3
  • 10.127.1.1:8020
    sts.exe
    152 B
    3
  • 43.247.6.1:8008
    sts.exe
    152 B
    3
  • 10.127.1.15:445
    sts.exe
    152 B
    3
  • 10.127.1.1:8030
    sts.exe
    152 B
    3
  • 10.127.1.16:445
    sts.exe
    152 B
    3
  • 43.247.6.1:8009
    sts.exe
    152 B
    3
  • 10.127.1.1:8040
    sts.exe
    152 B
    3
  • 43.247.6.1:8010
    sts.exe
    152 B
    3
  • 10.127.1.17:445
    sts.exe
    152 B
    3
  • 10.127.1.1:8050
    sts.exe
    152 B
    3
  • 43.247.6.1:8020
    sts.exe
    152 B
    3
  • 10.127.1.18:445
    sts.exe
    152 B
    3
  • 10.127.1.1:8060
    sts.exe
    152 B
    3
  • 10.127.1.19:445
    sts.exe
    152 B
    3
  • 43.247.6.1:8030
    sts.exe
    152 B
    3
  • 10.127.1.1:8070
    sts.exe
    152 B
    3
  • 10.127.1.20:445
    sts.exe
    152 B
    3
  • 43.247.6.1:8040
    sts.exe
    152 B
    3
  • 10.127.1.21:445
    sts.exe
    152 B
    3
  • 10.127.1.1:8080
    sts.exe
    152 B
    3
  • 43.247.6.1:8050
    sts.exe
    152 B
    3
  • 10.127.1.22:445
    sts.exe
    152 B
    3
  • 10.127.1.1:8081
    sts.exe
    152 B
    3
  • 43.247.6.1:8060
    sts.exe
    152 B
    3
  • 10.127.1.1:8082
    sts.exe
    152 B
    3
  • 43.247.6.1:8070
    sts.exe
    152 B
    3
  • 10.127.1.23:445
    sts.exe
    152 B
    3
  • 10.127.1.24:445
    sts.exe
    152 B
    3
  • 10.127.1.1:8083
    sts.exe
    152 B
    3
  • 43.247.6.1:8080
    sts.exe
    152 B
    3
  • 10.127.1.1:8084
    sts.exe
    152 B
    3
  • 43.247.6.1:8081
    sts.exe
    152 B
    3
  • 10.127.1.25:445
    sts.exe
    152 B
    3
  • 10.127.1.1:8085
    sts.exe
    152 B
    3
  • 10.127.1.26:445
    sts.exe
    152 B
    3
  • 43.247.6.1:8082
    sts.exe
    152 B
    3
  • 10.127.1.27:445
    sts.exe
    152 B
    3
  • 10.127.1.1:8086
    sts.exe
    152 B
    3
  • 43.247.6.1:8083
    sts.exe
    152 B
    3
  • 10.127.1.1:8087
    sts.exe
    152 B
    3
  • 10.127.1.28:445
    sts.exe
    152 B
    3
  • 43.247.6.1:8084
    sts.exe
    152 B
    3
  • 10.127.1.1:8088
    sts.exe
    152 B
    3
  • 43.247.6.1:8085
    sts.exe
    152 B
    3
  • 10.127.1.29:445
    sts.exe
    152 B
    3
  • 10.127.1.1:8090
    sts.exe
    152 B
    3
  • 43.247.6.1:8086
    sts.exe
    152 B
    3
  • 10.127.1.30:445
    sts.exe
    152 B
    3
  • 10.127.1.1:8443
    sts.exe
    152 B
    3
  • 10.127.1.31:445
    sts.exe
    152 B
    3
  • 43.247.6.1:8087
    sts.exe
    152 B
    3
  • 10.127.1.1:8888
    sts.exe
    152 B
    3
  • 43.247.6.1:8088
    sts.exe
    152 B
    3
  • 10.127.1.32:445
    sts.exe
    152 B
    3
  • 10.127.1.1:9000
    sts.exe
    152 B
    3
  • 10.127.1.33:445
    sts.exe
    152 B
    3
  • 43.247.6.1:8090
    sts.exe
    152 B
    3
  • 10.127.1.1:9080
    sts.exe
    152 B
    3
  • 43.247.6.1:8443
    sts.exe
    152 B
    3
  • 10.127.1.34:445
    sts.exe
    152 B
    3
  • 10.127.1.1:9090
    sts.exe
    152 B
    3
  • 43.247.6.1:8888
    sts.exe
    152 B
    3
  • 10.127.1.35:445
    sts.exe
    152 B
    3
  • 10.127.1.1:9999
    sts.exe
    152 B
    3
  • 10.127.1.36:445
    sts.exe
    152 B
    3
  • 43.247.6.1:9000
    sts.exe
    152 B
    3
  • 10.127.1.2:80
    sts.exe
    152 B
    3
  • 43.247.6.1:9080
    sts.exe
    152 B
    3
  • 10.127.1.37:445
    sts.exe
    152 B
    3
  • 10.127.1.2:88
    sts.exe
    152 B
    3
  • 10.127.1.38:445
    sts.exe
    152 B
    3
  • 43.247.6.1:9090
    sts.exe
    152 B
    3
  • 10.127.1.2:89
    sts.exe
    152 B
    3
  • 43.247.6.1:9999
    sts.exe
    152 B
    3
  • 10.127.1.39:445
    sts.exe
    152 B
    3
  • 10.127.1.2:90
    sts.exe
    152 B
    3
  • 43.247.6.2:80
    sts.exe
    152 B
    3
  • 10.127.1.40:445
    sts.exe
    152 B
    3
  • 10.127.1.41:445
    sts.exe
    152 B
    3
  • 10.127.1.2:99
    sts.exe
    152 B
    3
  • 43.247.6.2:88
    sts.exe
    152 B
    3
  • 10.127.1.2:443
    sts.exe
    152 B
    3
  • 43.247.6.2:89
    sts.exe
    152 B
    3
  • 10.127.1.42:445
    sts.exe
    152 B
    3
  • 10.127.1.2:6060
    sts.exe
    152 B
    3
  • 10.127.1.43:445
    sts.exe
    152 B
    3
  • 43.247.6.2:90
    sts.exe
    152 B
    3
  • 10.127.1.2:7070
    sts.exe
    152 B
    3
  • 10.127.1.44:445
    sts.exe
    152 B
    3
  • 43.247.6.2:99
    sts.exe
    152 B
    3
  • 10.127.1.2:7080
    sts.exe
    152 B
    3
  • 43.247.6.2:443
    sts.exe
    152 B
    3
  • 10.127.1.45:445
    sts.exe
    152 B
    3
  • 10.127.1.2:7777
    sts.exe
    152 B
    3
  • 10.127.1.46:445
    sts.exe
    152 B
    3
  • 43.247.6.2:445
    sts.exe
    152 B
    3
  • 10.127.1.2:8000
    sts.exe
    152 B
    3
  • 43.247.6.2:6060
    sts.exe
    152 B
    3
  • 10.127.1.47:445
    sts.exe
    152 B
    3
  • 10.127.1.48:445
    sts.exe
    152 B
    3
  • 10.127.1.2:8008
    sts.exe
    152 B
    3
  • 43.247.6.2:7070
    sts.exe
    152 B
    3
  • 10.127.1.2:8009
    sts.exe
    152 B
    3
  • 43.247.6.2:7080
    sts.exe
    152 B
    3
  • 10.127.1.49:445
    sts.exe
    152 B
    3
  • 10.127.1.2:8010
    sts.exe
    152 B
    3
  • 43.247.6.2:7777
    sts.exe
    152 B
    3
  • 10.127.1.50:445
    sts.exe
    152 B
    3
  • 10.127.1.2:8020
    sts.exe
    152 B
    3
  • 10.127.1.51:445
    sts.exe
    152 B
    3
  • 43.247.6.2:8000
    sts.exe
    152 B
    3
  • 10.127.1.2:8030
    sts.exe
    152 B
    3
  • 43.247.6.2:8008
    sts.exe
    152 B
    3
  • 10.127.1.52:445
    sts.exe
    152 B
    3
  • 10.127.1.2:8040
    sts.exe
    152 B
    3
  • 10.127.1.53:445
    sts.exe
    152 B
    3
  • 43.247.6.2:8009
    sts.exe
    152 B
    3
  • 10.127.1.2:8050
    sts.exe
    152 B
    3
  • 43.247.6.2:8010
    sts.exe
    152 B
    3
  • 10.127.1.54:445
    sts.exe
    152 B
    3
  • 10.127.1.2:8060
    sts.exe
    152 B
    3
  • 43.247.6.2:8020
    sts.exe
    152 B
    3
  • 10.127.1.55:445
    sts.exe
    152 B
    3
  • 10.127.1.2:8070
    sts.exe
    152 B
    3
  • 10.127.1.56:445
    sts.exe
    152 B
    3
  • 43.247.6.2:8030
    sts.exe
    152 B
    3
  • 10.127.1.2:8080
    sts.exe
    152 B
    3
  • 43.247.6.2:8040
    sts.exe
    152 B
    3
  • 10.127.1.57:445
    sts.exe
    152 B
    3
  • 10.127.1.2:8081
    sts.exe
    152 B
    3
  • 10.127.1.58:445
    sts.exe
    152 B
    3
  • 43.247.6.2:8050
    sts.exe
    152 B
    3
  • 10.127.1.2:8082
    sts.exe
    152 B
    3
  • 43.247.6.2:8060
    sts.exe
    152 B
    3
  • 10.127.1.59:445
    sts.exe
    152 B
    3
  • 10.127.1.2:8083
    sts.exe
    152 B
    3
  • 43.247.6.2:8070
    sts.exe
    152 B
    3
  • 10.127.1.60:445
    sts.exe
    152 B
    3
  • 10.127.1.2:8084
    sts.exe
    152 B
    3
  • 10.127.1.61:445
    sts.exe
    152 B
    3
  • 43.247.6.2:8080
    sts.exe
    152 B
    3
  • 10.127.1.2:8085
    sts.exe
    152 B
    3
  • 43.247.6.2:8081
    sts.exe
    152 B
    3
  • 10.127.1.62:445
    sts.exe
    152 B
    3
  • 10.127.1.2:8086
    sts.exe
    152 B
    3
  • 43.247.6.2:8082
    sts.exe
    152 B
    3
  • 10.127.1.63:445
    sts.exe
    152 B
    3
  • 10.127.1.2:8087
    sts.exe
    152 B
    3
  • 43.247.6.2:8083
    sts.exe
    152 B
    3
  • 10.127.1.64:445
    sts.exe
    152 B
    3
  • 10.127.1.2:8088
    sts.exe
    152 B
    3
  • 43.247.6.2:8084
    sts.exe
    152 B
    3
  • 10.127.1.65:445
    sts.exe
    152 B
    3
  • 10.127.1.2:8090
    sts.exe
    152 B
    3
  • 10.127.1.66:445
    sts.exe
    152 B
    3
  • 43.247.6.2:8085
    sts.exe
    152 B
    3
  • 10.127.1.2:8443
    sts.exe
    152 B
    3
  • 43.247.6.2:8086
    sts.exe
    152 B
    3
  • 10.127.1.67:445
    sts.exe
    152 B
    3
  • 10.127.1.2:8888
    sts.exe
    152 B
    3
  • 43.247.6.2:8087
    sts.exe
    152 B
    3
  • 10.127.1.68:445
    sts.exe
    152 B
    3
  • 10.127.1.2:9000
    sts.exe
    152 B
    3
  • 43.247.6.2:8088
    sts.exe
    152 B
    3
  • 10.127.1.69:445
    sts.exe
    152 B
    3
  • 10.127.1.2:9080
    sts.exe
    152 B
    3
  • 43.247.6.2:8090
    sts.exe
    152 B
    3
  • 45.124.132.119:80
    Satan.exe
    152 B
    3
  • 10.127.1.70:445
    sts.exe
    152 B
    3
  • 10.127.1.2:9090
    sts.exe
    152 B
    3
  • 43.247.6.2:8443
    sts.exe
    152 B
    3
  • 10.127.1.71:445
    sts.exe
    152 B
    3
  • 10.127.1.2:9999
    sts.exe
    152 B
    3
  • 43.247.6.2:8888
    sts.exe
    152 B
    3
  • 10.127.1.72:445
    sts.exe
    152 B
    3
  • 10.127.1.3:80
    sts.exe
    152 B
    3
  • 43.247.6.2:9000
    sts.exe
    152 B
    3
  • 10.127.1.73:445
    sts.exe
    152 B
    3
  • 10.127.1.3:88
    sts.exe
    152 B
    3
  • 43.247.6.2:9080
    sts.exe
    152 B
    3
  • 10.127.1.74:445
    sts.exe
    152 B
    3
  • 10.127.1.3:89
    sts.exe
    152 B
    3
  • 43.247.6.2:9090
    sts.exe
    152 B
    3
  • 10.127.1.75:445
    sts.exe
    152 B
    3
  • 10.127.1.3:90
    sts.exe
    152 B
    3
  • 43.247.6.2:9999
    sts.exe
    152 B
    3
  • 10.127.1.76:445
    sts.exe
    152 B
    3
  • 10.127.1.3:99
    sts.exe
    152 B
    3
  • 10.127.1.77:445
    sts.exe
    152 B
    3
  • 43.247.6.3:80
    sts.exe
    152 B
    3
  • 10.127.1.3:443
    sts.exe
    152 B
    3
  • 10.127.1.78:445
    sts.exe
    152 B
    3
  • 43.247.6.3:88
    sts.exe
    152 B
    3
  • 10.127.1.3:6060
    sts.exe
    152 B
    3
  • 43.247.6.3:89
    sts.exe
    152 B
    3
  • 10.127.1.79:445
    sts.exe
    152 B
    3
  • 10.127.1.3:7070
    sts.exe
    152 B
    3
  • 10.127.1.80:445
    sts.exe
    152 B
    3
  • 43.247.6.3:90
    sts.exe
    152 B
    3
  • 10.127.1.3:7080
    sts.exe
    152 B
    3
  • 43.247.6.3:99
    sts.exe
    152 B
    3
  • 10.127.1.81:445
    sts.exe
    152 B
    3
  • 10.127.1.3:7777
    sts.exe
    152 B
    3
  • 10.127.1.82:445
    sts.exe
    152 B
    3
  • 43.247.6.3:443
    sts.exe
    152 B
    3
  • 10.127.1.3:8000
    sts.exe
    152 B
    3
  • 10.127.1.83:445
    sts.exe
    152 B
    3
  • 43.247.6.3:445
    sts.exe
    152 B
    3
  • 10.127.1.3:8008
    sts.exe
    152 B
    3
  • 10.127.1.84:445
    sts.exe
    152 B
    3
  • 43.247.6.3:6060
    sts.exe
    152 B
    3
  • 10.127.1.3:8009
    sts.exe
    152 B
    3
  • 10.127.1.85:445
    sts.exe
    152 B
    3
  • 43.247.6.3:7070
    sts.exe
    152 B
    3
  • 10.127.1.3:8010
    sts.exe
    152 B
    3
  • 43.247.6.3:7080
    sts.exe
    152 B
    3
  • 10.127.1.86:445
    sts.exe
    152 B
    3
  • 10.127.1.3:8020
    sts.exe
    152 B
    3
  • 43.247.6.3:7777
    sts.exe
    152 B
    3
  • 10.127.1.87:445
    sts.exe
    152 B
    3
  • 10.127.1.3:8030
    sts.exe
    152 B
    3
  • 10.127.1.88:445
    sts.exe
    152 B
    3
  • 43.247.6.3:8000
    sts.exe
    152 B
    3
  • 10.127.1.3:8040
    sts.exe
    152 B
    3
  • 43.247.6.3:8008
    sts.exe
    152 B
    3
  • 10.127.1.89:445
    sts.exe
    152 B
    3
  • 10.127.1.3:8050
    sts.exe
    152 B
    3
  • 10.127.1.90:445
    sts.exe
    152 B
    3
  • 43.247.6.3:8009
    sts.exe
    152 B
    3
  • 10.127.1.3:8060
    sts.exe
    152 B
    3
  • 10.127.1.91:445
    sts.exe
    152 B
    3
  • 43.247.6.3:8010
    sts.exe
    152 B
    3
  • 10.127.1.3:8070
    sts.exe
    152 B
    3
  • 43.247.6.3:8020
    sts.exe
    152 B
    3
  • 10.127.1.92:445
    sts.exe
    152 B
    3
  • 10.127.1.3:8080
    sts.exe
    152 B
    3
  • 10.127.1.93:445
    sts.exe
    152 B
    3
  • 43.247.6.3:8030
    sts.exe
    152 B
    3
  • 10.127.1.3:8081
    sts.exe
    152 B
    3
  • 43.247.6.3:8040
    sts.exe
    152 B
    3
  • 10.127.1.94:445
    sts.exe
    152 B
    3
  • 10.127.1.95:445
    sts.exe
    152 B
    3
  • 10.127.1.3:8082
    sts.exe
    152 B
    3
  • 43.247.6.3:8050
    sts.exe
    152 B
    3
  • 10.127.1.3:8083
    sts.exe
    152 B
    3
  • 10.127.1.96:445
    sts.exe
    152 B
    3
  • 43.247.6.3:8060
    sts.exe
    152 B
    3
  • 10.127.1.3:8084
    sts.exe
    152 B
    3
  • 43.247.6.3:8070
    sts.exe
    152 B
    3
  • 45.124.132.119:80
    Satan.exe
    152 B
    3
  • 10.127.1.97:445
    sts.exe
    100 B
    2
  • 10.127.1.3:8085
    sts.exe
    152 B
    3
  • 10.127.1.98:445
    sts.exe
    152 B
    3
  • 43.247.6.3:8080
    sts.exe
    152 B
    3
  • 10.127.1.3:8086
    sts.exe
    152 B
    3
  • 43.247.6.3:8081
    sts.exe
    152 B
    3
  • 10.127.1.99:445
    sts.exe
    152 B
    3
  • 10.127.1.3:8087
    sts.exe
    152 B
    3
  • 10.127.1.100:445
    sts.exe
    152 B
    3
  • 43.247.6.3:8082
    sts.exe
    152 B
    3
  • 10.127.1.3:8088
    sts.exe
    152 B
    3
  • 43.247.6.3:8083
    sts.exe
    152 B
    3
  • 10.127.1.101:445
    sts.exe
    152 B
    3
  • 10.127.1.3:8090
    sts.exe
    152 B
    3
  • 43.247.6.3:8084
    sts.exe
    152 B
    3
  • 10.127.1.102:445
    sts.exe
    152 B
    3
  • 10.127.1.3:8443
    sts.exe
    152 B
    3
  • 43.247.6.3:8085
    sts.exe
    152 B
    3
  • 10.127.1.103:445
    sts.exe
    152 B
    3
  • 10.127.1.3:8888
    sts.exe
    152 B
    3
  • 10.127.1.104:445
    sts.exe
    152 B
    3
  • 43.247.6.3:8086
    sts.exe
    152 B
    3
  • 10.127.1.3:9000
    sts.exe
    152 B
    3
  • 10.127.1.105:445
    sts.exe
    152 B
    3
  • 43.247.6.3:8087
    sts.exe
    152 B
    3
  • 10.127.1.3:9080
    sts.exe
    152 B
    3
  • 43.247.6.3:8088
    sts.exe
    152 B
    3
  • 10.127.1.106:445
    sts.exe
    152 B
    3
  • 10.127.1.3:9090
    sts.exe
    152 B
    3
  • 43.247.6.3:8090
    sts.exe
    152 B
    3
  • 10.127.1.107:445
    sts.exe
    152 B
    3
  • 10.127.1.3:9999
    sts.exe
    152 B
    3
  • 43.247.6.3:8443
    sts.exe
    152 B
    3
  • 10.127.1.108:445
    sts.exe
    152 B
    3
  • 43.247.6.3:8888
    sts.exe
    152 B
    3
  • 10.127.1.109:445
    sts.exe
    152 B
    3
  • 10.127.1.4:80
    sts.exe
    152 B
    3
  • 10.127.1.110:445
    sts.exe
    152 B
    3
  • 10.127.1.4:88
    sts.exe
    152 B
    3
  • 43.247.6.3:9000
    sts.exe
    152 B
    3
  • 10.127.1.4:89
    sts.exe
    152 B
    3
  • 43.247.6.3:9080
    sts.exe
    152 B
    3
  • 10.127.1.111:445
    sts.exe
    152 B
    3
  • 10.127.1.4:90
    sts.exe
    152 B
    3
  • 10.127.1.112:445
    sts.exe
    152 B
    3
  • 43.247.6.3:9090
    sts.exe
    152 B
    3
  • 10.127.1.4:99
    sts.exe
    152 B
    3
  • 43.247.6.3:9999
    sts.exe
    152 B
    3
  • 10.127.1.113:445
    sts.exe
    152 B
    3
  • 10.127.1.4:443
    sts.exe
    152 B
    3
  • 43.247.6.4:80
    sts.exe
    152 B
    3
  • 10.127.1.114:445
    sts.exe
    152 B
    3
  • 10.127.1.4:6060
    sts.exe
    152 B
    3
  • 10.127.1.115:445
    sts.exe
    152 B
    3
  • 43.247.6.4:88
    sts.exe
    152 B
    3
  • 10.127.1.4:7070
    sts.exe
    152 B
    3
  • 10.127.1.116:445
    sts.exe
    152 B
    3
  • 43.247.6.4:89
    sts.exe
    152 B
    3
  • 10.127.1.4:7080
    sts.exe
    152 B
    3
  • 43.247.6.4:90
    sts.exe
    152 B
    3
  • 10.127.1.117:445
    sts.exe
    152 B
    3
  • 10.127.1.4:7777
    sts.exe
    152 B
    3
  • 43.247.6.4:99
    sts.exe
    152 B
    3
  • 10.127.1.118:445
    sts.exe
    152 B
    3
  • 10.127.1.4:8000
    sts.exe
    152 B
    3
  • 43.247.6.4:443
    sts.exe
    152 B
    3
  • 10.127.1.119:445
    sts.exe
    152 B
    3
  • 10.127.1.4:8008
    sts.exe
    152 B
    3
  • 10.127.1.120:445
    sts.exe
    152 B
    3
  • 43.247.6.4:445
    sts.exe
    152 B
    3
  • 10.127.1.4:8009
    sts.exe
    152 B
    3
  • 10.127.1.121:445
    sts.exe
    152 B
    3
  • 43.247.6.4:6060
    sts.exe
    152 B
    3
  • 10.127.1.4:8010
    sts.exe
    152 B
    3
  • 43.247.6.4:7070
    sts.exe
    152 B
    3
  • 10.127.1.122:445
    sts.exe
    152 B
    3
  • 10.127.1.4:8020
    sts.exe
    152 B
    3
  • 43.247.6.4:7080
    sts.exe
    152 B
    3
  • 10.127.1.123:445
    sts.exe
    152 B
    3
  • 10.127.1.4:8030
    sts.exe
    152 B
    3
  • 43.247.6.4:7777
    sts.exe
    152 B
    3
  • 10.127.1.124:445
    sts.exe
    152 B
    3
  • 10.127.1.4:8040
    sts.exe
    152 B
    3
  • 10.127.1.125:445
    sts.exe
    152 B
    3
  • 43.247.6.4:8000
    sts.exe
    152 B
    3
  • 10.127.1.4:8050
    sts.exe
    152 B
    3
  • 43.247.6.4:8008
    sts.exe
    152 B
    3
  • 10.127.1.126:445
    sts.exe
    152 B
    3
  • 10.127.1.4:8060
    sts.exe
    152 B
    3
  • 43.247.6.4:8009
    sts.exe
    152 B
    3
  • 10.127.1.127:445
    sts.exe
    152 B
    3
  • 10.127.1.4:8070
    sts.exe
    152 B
    3
  • 43.247.6.4:8010
    sts.exe
    152 B
    3
  • 10.127.1.128:445
    sts.exe
    152 B
    3
  • 10.127.1.4:8080
    sts.exe
    152 B
    3
  • 10.127.1.129:445
    sts.exe
    152 B
    3
  • 43.247.6.4:8020
    sts.exe
    152 B
    3
  • 10.127.1.4:8081
    sts.exe
    152 B
    3
  • 43.247.6.4:8030
    sts.exe
    152 B
    3
  • 10.127.1.130:445
    sts.exe
    152 B
    3
  • 10.127.1.4:8082
    sts.exe
    152 B
    3
  • 43.247.6.4:8040
    sts.exe
    152 B
    3
  • 10.127.1.131:445
    sts.exe
    152 B
    3
  • 10.127.1.132:445
    sts.exe
    152 B
    3
  • 10.127.1.4:8083
    sts.exe
    152 B
    3
  • 43.247.6.4:8050
    sts.exe
    152 B
    3
  • 10.127.1.4:8084
    sts.exe
    152 B
    3
  • 43.247.6.4:8060
    sts.exe
    152 B
    3
  • 10.127.1.133:445
    sts.exe
    152 B
    3
  • 10.127.1.4:8085
    sts.exe
    152 B
    3
  • 10.127.1.134:445
    sts.exe
    152 B
    3
  • 43.247.6.4:8070
    sts.exe
    152 B
    3
  • 10.127.1.4:8086
    sts.exe
    152 B
    3
  • 43.247.6.4:8080
    sts.exe
    152 B
    3
  • 10.127.1.135:445
    sts.exe
    152 B
    3
  • 10.127.1.4:8087
    sts.exe
    152 B
    3
  • 43.247.6.4:8081
    sts.exe
    152 B
    3
  • 10.127.1.136:445
    sts.exe
    152 B
    3
  • 10.127.1.4:8088
    sts.exe
    152 B
    3
  • 10.127.1.137:445
    sts.exe
    152 B
    3
  • 43.247.6.4:8082
    sts.exe
    152 B
    3
  • 10.127.1.4:8090
    sts.exe
    152 B
    3
  • 43.247.6.4:8083
    sts.exe
    152 B
    3
  • 10.127.1.138:445
    sts.exe
    152 B
    3
  • 10.127.1.4:8443
    sts.exe
    152 B
    3
  • 10.127.1.139:445
    sts.exe
    152 B
    3
  • 43.247.6.4:8084
    sts.exe
    152 B
    3
  • 10.127.1.4:8888
    sts.exe
    152 B
    3
  • 43.247.6.4:8085
    sts.exe
    152 B
    3
  • 10.127.1.140:445
    sts.exe
    152 B
    3
  • 10.127.1.4:9000
    sts.exe
    152 B
    3
  • 43.247.6.4:8086
    sts.exe
    152 B
    3
  • 10.127.1.141:445
    sts.exe
    152 B
    3
  • 10.127.1.4:9080
    sts.exe
    152 B
    3
  • 10.127.1.142:445
    sts.exe
    152 B
    3
  • 43.247.6.4:8087
    sts.exe
    152 B
    3
  • 10.127.1.4:9090
    sts.exe
    152 B
    3
  • 43.247.6.4:8088
    sts.exe
    152 B
    3
  • 10.127.1.143:445
    sts.exe
    152 B
    3
  • 10.127.1.4:9999
    sts.exe
    152 B
    3
  • 10.127.1.144:445
    sts.exe
    152 B
    3
  • 43.247.6.4:8090
    sts.exe
    152 B
    3
  • 43.247.6.4:8443
    sts.exe
    152 B
    3
  • 10.127.1.145:445
    sts.exe
    152 B
    3
  • 10.127.1.5:88
    sts.exe
    152 B
    3
  • 43.247.6.4:8888
    sts.exe
    152 B
    3
  • 10.127.1.146:445
    sts.exe
    152 B
    3
  • 10.127.1.5:80
    sts.exe
    100 B
    2
  • 10.127.1.147:445
    sts.exe
    152 B
    3
  • 10.127.1.5:89
    sts.exe
    152 B
    3
  • 43.247.6.4:9000
    sts.exe
    152 B
    3
  • 10.127.1.5:90
    sts.exe
    152 B
    3
  • 43.247.6.4:9080
    sts.exe
    152 B
    3
  • 10.127.1.148:445
    sts.exe
    152 B
    3
  • 10.127.1.5:99
    sts.exe
    152 B
    3
  • 10.127.1.149:445
    sts.exe
    152 B
    3
  • 43.247.6.4:9090
    sts.exe
    152 B
    3
  • 10.127.1.5:443
    sts.exe
    152 B
    3
  • 10.127.1.150:445
    sts.exe
    152 B
    3
  • 43.247.6.4:9999
    sts.exe
    152 B
    3
  • 10.127.1.5:6060
    sts.exe
    152 B
    3
  • 43.247.6.5:80
    sts.exe
    152 B
    3
  • 10.127.1.151:445
    sts.exe
    152 B
    3
  • 10.127.1.5:7070
    sts.exe
    152 B
    3
  • 10.127.1.152:445
    sts.exe
    152 B
    3
  • 43.247.6.5:88
    sts.exe
    152 B
    3
  • 10.127.1.5:7080
    sts.exe
    152 B
    3
  • 43.247.6.5:89
    sts.exe
    152 B
    3
  • 10.127.1.153:445
    sts.exe
    152 B
    3
  • 10.127.1.5:7777
    sts.exe
    152 B
    3
  • 10.127.1.154:445
    sts.exe
    152 B
    3
  • 43.247.6.5:90
    sts.exe
    152 B
    3
  • 10.127.1.5:8000
    sts.exe
    152 B
    3
  • 43.247.6.5:99
    sts.exe
    152 B
    3
  • 10.127.1.155:445
    sts.exe
    152 B
    3
  • 10.127.1.5:8008
    sts.exe
    152 B
    3
  • 43.247.6.5:443
    sts.exe
    152 B
    3
  • 10.127.1.156:445
    sts.exe
    152 B
    3
  • 10.127.1.157:445
    sts.exe
    152 B
    3
  • 10.127.1.5:8009
    sts.exe
    152 B
    3
  • 43.247.6.5:445
    sts.exe
    152 B
    3
  • 10.127.1.5:8010
    sts.exe
    152 B
    3
  • 43.247.6.5:6060
    sts.exe
    152 B
    3
  • 10.127.1.158:445
    sts.exe
    152 B
    3
  • 10.127.1.5:8020
    sts.exe
    152 B
    3
  • 10.127.1.159:445
    sts.exe
    152 B
    3
  • 43.247.6.5:7070
    sts.exe
    152 B
    3
  • 10.127.1.5:8030
    sts.exe
    152 B
    3
  • 43.247.6.5:7080
    sts.exe
    152 B
    3
  • 10.127.1.160:445
    sts.exe
    152 B
    3
  • 10.127.1.5:8040
    sts.exe
    152 B
    3
  • 43.247.6.5:7777
    sts.exe
    152 B
    3
  • 10.127.1.161:445
    sts.exe
    152 B
    3
  • 10.127.1.5:8050
    sts.exe
    152 B
    3
  • 10.127.1.162:445
    sts.exe
    152 B
    3
  • 43.247.6.5:8000
    sts.exe
    152 B
    3
  • 10.127.1.5:8060
    sts.exe
    152 B
    3
  • 43.247.6.5:8008
    sts.exe
    152 B
    3
  • 10.127.1.163:445
    sts.exe
    152 B
    3
  • 10.127.1.5:8070
    sts.exe
    152 B
    3
  • 43.247.6.5:8009
    sts.exe
    152 B
    3
  • 10.127.1.164:445
    sts.exe
    152 B
    3
  • 10.127.1.5:8080
    sts.exe
    152 B
    3
  • 43.247.6.5:8010
    sts.exe
    152 B
    3
  • 10.127.1.165:445
    sts.exe
    152 B
    3
  • 10.127.1.5:8081
    sts.exe
    152 B
    3
  • 10.127.1.166:445
    sts.exe
    152 B
    3
  • 43.247.6.5:8020
    sts.exe
    152 B
    3
  • 10.127.1.5:8082
    sts.exe
    152 B
    3
No results found

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Satan.exe

    Filesize

    142KB

    MD5

    4153cbc1f51bca54ba1e948a3653185b

    SHA1

    090e58b0b9ce144598b375c0c206289308535ef3

    SHA256

    cf12eca0e10dc3370d7917e7678dc09629240d3e7cc71c5ac0df68576bea0682

    SHA512

    d1232323496022e2e48dfa372d9d3844ebd31a2390896bca3914d246666cc29a4019313acf23458c540baa07a261023adf46da5315d21ee0557a0b5eb406fb7f

  • memory/1944-60-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

  • memory/1956-54-0x00000000756B1000-0x00000000756B3000-memory.dmp

    Filesize

    8KB

  • memory/1956-55-0x0000000000400000-0x0000000000935000-memory.dmp

    Filesize

    5.2MB

  • memory/1956-59-0x00000000029A0000-0x0000000002A25000-memory.dmp

    Filesize

    532KB

  • memory/1956-61-0x0000000000400000-0x0000000000935000-memory.dmp

    Filesize

    5.2MB

  • memory/1956-62-0x00000000029A0000-0x0000000002A25000-memory.dmp

    Filesize

    532KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.