satancryptor | b5ddb13a397596ff8ca1e6f3a3c3df5ba490486cbb33afedd1a5e7ff6e4ebec2

General

Target

25f38c1ea9b72f30be7df57ee6c0a358de7c23d59c2a0dd5f9c8c787c863abbd.exe
Size

1.7MB
MD5

58d30af5992e33b351293b23ce97724f
SHA1

22e8cd9c08037ea925d57355c4ae142490688bb9
SHA256

25f38c1ea9b72f30be7df57ee6c0a358de7c23d59c2a0dd5f9c8c787c863abbd
SHA512

e3c5034f07d85a4cf4f3de8314fb332ebdab3ed5e6058340951bf3482cd03ee2ceb42817bc2fcb8d12c3a5becdb52896d7bd8ff72c8c978034626cc7fd93244d
SSDEEP

49152:BRoNt5F+/BocHmdgcmPH8fKr1HbYObrTTAj/unm0yJk:DoNt5E/BoC6gcCcfKtjfnvkk

Score

10^/10

satancryptor ransomware spyware stealer

Malware Config

Signatures

SatanCryptor
Golang ransomware first seen in early 2020.
ransomware satancryptor
Executes dropped EXE 1 IoCs

Processes:

Satan.exe

pid process

1488 Satan.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
1488	Satan.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

Satan.exe

description	ioc	process
File opened (read-only)	\??\O:	Satan.exe
File opened (read-only)	\??\I:	Satan.exe
File opened (read-only)	\??\H:	Satan.exe
File opened (read-only)	\??\U:	Satan.exe
File opened (read-only)	\??\R:	Satan.exe
File opened (read-only)	\??\M:	Satan.exe
File opened (read-only)	\??\G:	Satan.exe
File opened (read-only)	\??\B:	Satan.exe
File opened (read-only)	\??\Y:	Satan.exe
File opened (read-only)	\??\S:	Satan.exe
File opened (read-only)	\??\V:	Satan.exe
File opened (read-only)	\??\T:	Satan.exe
File opened (read-only)	\??\Q:	Satan.exe
File opened (read-only)	\??\P:	Satan.exe
File opened (read-only)	\??\N:	Satan.exe
File opened (read-only)	\??\K:	Satan.exe
File opened (read-only)	\??\Z:	Satan.exe
File opened (read-only)	\??\X:	Satan.exe
File opened (read-only)	\??\F:	Satan.exe
File opened (read-only)	\??\E:	Satan.exe
File opened (read-only)	\??\J:	Satan.exe
File opened (read-only)	\??\A:	Satan.exe
File opened (read-only)	\??\W:	Satan.exe
File opened (read-only)	\??\L:	Satan.exe

Drops file in Program Files directory 64 IoCs

Processes:

Satan.exe

description	ioc	process
File opened for modification	C:\Program Files\7-Zip\Lang\[[email protected]]gu.txt.satan	Satan.exe
File opened for modification	C:\Program Files\7-Zip\Lang\[[email protected]]sr-spl.txt.satan	Satan.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\[[email protected]]UserControl.zip.satan	Satan.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\[[email protected]]EmptyDatabase.zip.satan	Satan.exe
File opened for modification	C:\Program Files\7-Zip\[[email protected]]7zCon.sfx.satan	Satan.exe
File opened for modification	C:\Program Files\7-Zip\Lang\[[email protected]]eu.txt.satan	Satan.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\[[email protected]]AppConfig.zip.satan	Satan.exe
File opened for modification	C:\Program Files\7-Zip\Lang\[[email protected]]ar.txt.satan	Satan.exe
File opened for modification	C:\Program Files\7-Zip\Lang\[[email protected]]de.txt.satan	Satan.exe
File opened for modification	C:\Program Files\7-Zip\Lang\[[email protected]]fi.txt.satan	Satan.exe
File opened for modification	C:\Program Files\7-Zip\Lang\[[email protected]]kab.txt.satan	Satan.exe
File opened for modification	C:\Program Files\7-Zip\Lang\[[email protected]]ku-ckb.txt.satan	Satan.exe
File opened for modification	C:\Program Files\7-Zip\Lang\[[email protected]]sr-spc.txt.satan	Satan.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\[[email protected]]Resource.zip.satan	Satan.exe
File opened for modification	C:\Program Files\7-Zip\Lang\[[email protected]]ug.txt.satan	Satan.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\[[email protected]]AboutBox.zip.satan	Satan.exe
File opened for modification	C:\Program Files\7-Zip\Lang\[[email protected]]ms.txt.satan	Satan.exe
File opened for modification	C:\Program Files\7-Zip\Lang\[[email protected]]fr.txt.satan	Satan.exe
File opened for modification	C:\Program Files\7-Zip\Lang\[[email protected]]ja.txt.satan	Satan.exe
File opened for modification	C:\Program Files\7-Zip\Lang\[[email protected]]ne.txt.satan	Satan.exe
File opened for modification	C:\Program Files\7-Zip\Lang\[[email protected]]pt.txt.satan	Satan.exe
File opened for modification	C:\Program Files\7-Zip\Lang\[[email protected]]sl.txt.satan	Satan.exe
File opened for modification	C:\Program Files\7-Zip\[[email protected]]History.txt.satan	Satan.exe
File opened for modification	C:\Program Files\7-Zip\Lang\[[email protected]]mk.txt.satan	Satan.exe
File opened for modification	C:\Program Files\7-Zip\Lang\[[email protected]]ga.txt.satan	Satan.exe
File opened for modification	C:\Program Files\7-Zip\Lang\[[email protected]]io.txt.satan	Satan.exe
File opened for modification	C:\Program Files\7-Zip\Lang\[[email protected]]lv.txt.satan	Satan.exe
File opened for modification	C:\Program Files\7-Zip\Lang\[[email protected]]ps.txt.satan	Satan.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\[[email protected]]Explorer.zip.satan	Satan.exe
File opened for modification	C:\Program Files\7-Zip\Lang\[[email protected]]nb.txt.satan	Satan.exe
File opened for modification	C:\Program Files\7-Zip\Lang\[[email protected]]mn.txt.satan	Satan.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\[[email protected]]TextFile.zip.satan	Satan.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\[[email protected]]Form.zip.satan	Satan.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\[[email protected]]MDIParent.zip.satan	Satan.exe
File opened for modification	C:\Program Files\7-Zip\Lang\[[email protected]]ro.txt.satan	Satan.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\[[email protected]]MDIParent.zip.satan	Satan.exe
File opened for modification	C:\Program Files\7-Zip\Lang\[[email protected]]ast.txt.satan	Satan.exe
File opened for modification	C:\Program Files\7-Zip\Lang\[[email protected]]hi.txt.satan	Satan.exe
File opened for modification	C:\Program Files\7-Zip\Lang\[[email protected]]vi.txt.satan	Satan.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\[[email protected]]Form.zip.satan	Satan.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\[[email protected]]XmlFile.zip.satan	Satan.exe
File opened for modification	C:\Program Files\7-Zip\Lang\[[email protected]]az.txt.satan	Satan.exe
File opened for modification	C:\Program Files\7-Zip\Lang\[[email protected]]bg.txt.satan	Satan.exe
File opened for modification	C:\Program Files\7-Zip\Lang\[[email protected]]bn.txt.satan	Satan.exe
File opened for modification	C:\Program Files\7-Zip\Lang\[[email protected]]nn.txt.satan	Satan.exe
File opened for modification	C:\Program Files\7-Zip\Lang\[[email protected]]sv.txt.satan	Satan.exe
File opened for modification	C:\Program Files\7-Zip\Lang\[[email protected]]uz.txt.satan	Satan.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\[[email protected]]Visualizer.zip.satan	Satan.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\[[email protected]]AssemblyInfoInternal.zip.satan	Satan.exe
File opened for modification	C:\Program Files\7-Zip\Lang\[[email protected]]ext.txt.satan	Satan.exe
File opened for modification	C:\Program Files\7-Zip\Lang\[[email protected]]ta.txt.satan	Satan.exe
File opened for modification	C:\Program Files\7-Zip\Lang\[[email protected]]tt.txt.satan	Satan.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\[[email protected]]AssemblyInfo.zip.satan	Satan.exe
File opened for modification	C:\Program Files\7-Zip\Lang\[[email protected]]eo.txt.satan	Satan.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\[[email protected]]ResourceInternal.zip.satan	Satan.exe
File opened for modification	C:\Program Files\7-Zip\Lang\[[email protected]]be.txt.satan	Satan.exe
File opened for modification	C:\Program Files\7-Zip\Lang\[[email protected]]fa.txt.satan	Satan.exe
File opened for modification	C:\Program Files\7-Zip\Lang\[[email protected]]lij.txt.satan	Satan.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\[[email protected]]EmptyDatabase.zip.satan	Satan.exe
File opened for modification	C:\Program Files\7-Zip\Lang\[[email protected]]tr.txt.satan	Satan.exe
File opened for modification	C:\Program Files\7-Zip\Lang\[[email protected]]pa-in.txt.satan	Satan.exe
File opened for modification	C:\Program Files\7-Zip\Lang\[[email protected]]lt.txt.satan	Satan.exe
File opened for modification	C:\Program Files\7-Zip\Lang\[[email protected]]an.txt.satan	Satan.exe
File opened for modification	C:\Program Files\7-Zip\Lang\[[email protected]]gl.txt.satan	Satan.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

25f38c1ea9b72f30be7df57ee6c0a358de7c23d59c2a0dd5f9c8c787c863abbd.exe

description	pid	process	target process
PID 2032 wrote to memory of 1488	2032	25f38c1ea9b72f30be7df57ee6c0a358de7c23d59c2a0dd5f9c8c787c863abbd.exe	Satan.exe
PID 2032 wrote to memory of 1488	2032	25f38c1ea9b72f30be7df57ee6c0a358de7c23d59c2a0dd5f9c8c787c863abbd.exe	Satan.exe
PID 2032 wrote to memory of 1488	2032	25f38c1ea9b72f30be7df57ee6c0a358de7c23d59c2a0dd5f9c8c787c863abbd.exe	Satan.exe
PID 2032 wrote to memory of 1488	2032	25f38c1ea9b72f30be7df57ee6c0a358de7c23d59c2a0dd5f9c8c787c863abbd.exe	Satan.exe

C:\Users\Admin\AppData\Local\Temp\25f38c1ea9b72f30be7df57ee6c0a358de7c23d59c2a0dd5f9c8c787c863abbd.exe
"C:\Users\Admin\AppData\Local\Temp\25f38c1ea9b72f30be7df57ee6c0a358de7c23d59c2a0dd5f9c8c787c863abbd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Satan.exe
  "C:\Satan.exe"
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  PID:1488

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Satan.exe

Filesize
143KB

MD5
1fedee59eb95756282cff2493da93689

SHA1
dde1ee119b5c2e1facd22df44b7487f17f319c84

SHA256
480e8c67f2354530c006380d4804f4bacb1016f0401f391303e3337be94fbb11

SHA512
076c3b3ce6b96150e16daa5a49c0fd0762260d183c633d1fa58c9d48c38bfed914c9b69da0e7f5fe68d66edbec6706311dc3859e65d474f1495ce741297f0317

Download Submit
memory/1488-221-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/1488-362-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/1488-459-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/1488-265-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/1488-409-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/1488-214-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/1488-312-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/1488-129-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/1488-176-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/1488-86-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2032-84-0x0000000000400000-0x000000000093F000-memory.dmp

Filesize
5.2MB

Download
memory/2032-220-0x0000000000400000-0x000000000093F000-memory.dmp

Filesize
5.2MB

Download
memory/2032-217-0x0000000000400000-0x000000000093F000-memory.dmp

Filesize
5.2MB

Download
memory/2032-311-0x0000000000400000-0x000000000093F000-memory.dmp

Filesize
5.2MB

Download
memory/2032-215-0x0000000000400000-0x000000000093F000-memory.dmp

Filesize
5.2MB

Download
memory/2032-358-0x0000000000400000-0x000000000093F000-memory.dmp

Filesize
5.2MB

Download
memory/2032-85-0x0000000002810000-0x0000000002895000-memory.dmp

Filesize
532KB

Download
memory/2032-408-0x0000000000400000-0x000000000093F000-memory.dmp

Filesize
5.2MB

Download
memory/2032-264-0x0000000000400000-0x000000000093F000-memory.dmp

Filesize
5.2MB

Download
memory/2032-455-0x0000000000400000-0x000000000093F000-memory.dmp

Filesize
5.2MB

Download
memory/2032-222-0x0000000000400000-0x000000000093F000-memory.dmp

Filesize
5.2MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads