�y�y��5��v��(��q����_�ũ��j!��,G�*G���_��5��Tn�[�H��o.^ר�� ,*s��~'�1�-�&p ���?��ߚ�C|qH����u����A���v>َ�9_\3�����;�����n�oO�������g�+r����( (*�vU%�]Pf�@��P"*��[�m�x �d��C�L��z/�d��k�-V�tX^�g�7#�ѭ�<g��]�b#�r�Cs��h^�$y�^�u�Df1%���Q�~��_��tg�XtP*��]O��vS��}��4D�y���������7OF�-�j��L��aq�B��F��=�QC경P� ��3g��P�75��8��:�ZDU�Z�p����ql G�A� �,?�cQj~ɏ�����o��Z��ݬ!���~����X�N,5�,;g��=4�{���鉶�c���e߁��_VQ���TT��;���Hԗ[n�#E�}���6@җa]B��!�=EC��fA��J~fn�#e9 ���j� ��h�^P���d��ܻ S]���ﶇbm8��z^�&��C\��3��v=L#:� k, ��wP)p��x ί�B�m�8[~=l�c1��;o't��d� w��N�,cj�R����J|�� ��`��e�lwdi�D$q�St���})4_LW���T=�W�R��:S�7����U���RN�yeA��d���pX%�.r��W��6�&2:��V/�+��Fk>Ī��>������U���pޓo���O����KM��� :�F����/ �\��ː��� d�����av����Fҍ���"9�2�j�N���7� Vܤ�\=���W:�n%�m��ACG�x ��\8�������8Ҝ��F$oPr��B^ۋ����0�KYJ`l�ܸ��b�� oV_ʎ�k�@����5�6A�e�"��}���*<������ƫ���[�|L̷(�9�Y�i$�ls�WMe�F�8�;�6lLUyc���:2AFl?�r϶�`�����t�&��YF��F+���^�gm�JH�y���Я��,�������Oz���K�(�,m:����#}�V@�6�d�W�]��˿�G�������ļi�+r�%���he�e+�V�� .D�i'���+ol�is�7���g����) q���Ď�T)�,vݧ�b���+��h#5b<���Z����X�Z�7�ڝHS:�/��OFg�1���,C��8^� �n��7����z�y��2з�m�L�PkE��б|��w�wA��ӏ���a�(c�H�px��;�t�!��&�2%���HD�L'��h������3|����E����D�m���ҫ��&��!_��|x;;ySS��:�g�-P-��8�bS����|�6��ᡯ�"~��:�������؍�3=��$���#��1ﳶ��l���lS ��tJH�E_��h����0�[����JG ��<��vls�J��YB(+�� �9N�GI���@W��]�(�`��P��GT5�����G��]D=Q���dT�.a�a��yuM��5���'"��� ��D($ڇ�� NA�`Nf~E���LƻRI�̾8��s�W�j�^j&�^l��k #e��K�=)�?BsQ�����g��_</i)��W�� �����yX�]a����f���Q� $$XZ3�#�+���F}�_�fWZ\�T�"b�m�>^u\Tq�^���v�����&{�iv����%���R"�R�R�a;+BVXf;��אi�`}��c&�?õ8fFGYTG.�����/ e�����hK�g�'�F3T9��Ht�,��~�hr���X����طŖs۟:p�@�N�\�l}�н�.������oC�$�3�u��7�BA�a�M����p �"��R��)8a�Ty8¦�ф[����[��wg2��p;�T?���(���� `�}L'+�FX �|���l��-���K�R�����#��l�����\�a��<�� 켊:5t�@x��[�ô4}^�j�x���}� :�;O�M~6Z9�����_�o����*����#mN��/\D�"�;�J���%����`��{uO���R�������c,$L�L�]n�v͞9���olC�_�;�\ʴ��o�n�7�r~�����^��]?�g��]��������$%2w����W�ƒcƈt�5Y��T�0�>w3�����4�Z~k��J��a��5V������,Ɨ ��H�C� RY���M����h����_(�;�&U.�%n�,pŽ�L=|o�E�����xr���P|K��.4�� �Z>�d�OO�s�,�sd4y�C�N�}�d�r�Ǭ�a!\��C�tC�4&�ZL���犞��YvqZq�6:��^8 vf�+W�����xCMy7 &rL�Ι�!��M��PR��46s���к��a�2��Zcw�@��^��R�f�mdF�^!{qyz� ��Fg"�*����0 ���>�&(Ok·m����?3Ai�U�(�>G��c����B�eXOvD�*} ����=�ք��ܳkC��$-f�R=g ��~�|4*��{����Ƌ�����T�I9��G$$%|��u�$�O��3c���H��Ns��fB�ݏ���l�3����ab������p}�E3��RY��ϣ �����݆Z�U�?����O��Hȡ�f\cs��5�6��̢�3�ɥ�/��B�ܤ2i���lw?16�,��R��m~� `�� �It"P�1M�0�M �%h8���q��U,�LGO�0a���g �z�>L�<�$���W��h��,X�I�m�H��G�ӛ# `�ø�(�֧F��2#s�Z~������ 7�}�i� b����;��BB�u1�����H��E�A�'�+�=s����J�c�˕J.┍���3�n� � 7ȦbSb^�\�����u� :�%\DF1{��gOV{7��1�(�%��ZF��z�g��g�/K���A�S�ďM��_���_9D�����\;�`� ����&�� �L�JE���ť���xT�NJQ���P�m����m<vuD���M��j7j
Behavioral task
behavioral1
Sample
Satan_AIO.exe
Resource
win7-20230621-en
Behavioral task
behavioral2
Sample
Satan_AIO.exe
Resource
win10v2004-20230621-en
General
-
Target
Satan_AIO.exe
-
Size
7.5MB
-
MD5
c8c82a0f0ee038fddb54cbf156f2e300
-
SHA1
8c5d0ed46b025de5a464a9da0300183e444b5d35
-
SHA256
399987a10d716912a53e259227fd90bab5e239ac253ff6bd5171a71d9f719746
-
SHA512
d4814df8d427713cf08922d8c81da2a20044161e9adad5db7cf07a84f9e4ebd2f6b0003e9ccf3797b0672399934bfb22791354b05c395506b51f1ed19fc61fd2
-
SSDEEP
196608:bFk1xjIShj19s9NtuwuU7wsaK381VGACLbRI:IhIShZ90puU7wsF3GEACn
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Satan_AIO.exe
Files
-
Satan_AIO.exe.exe windows x64
13b6fd52de0539c3ee52dddd27773b20
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ws2_32
setsockopt
wldap32
ord27
crypt32
CertDuplicateCertificateContext
advapi32
CryptEnumProvidersW
kernel32
ResumeThread
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
UnhookWindowsHookEx
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
shell32
ShellExecuteA
urlmon
URLOpenBlockingStreamA
wininet
InternetCloseHandle
ntdll
RtlImageNtHeader
userenv
UnloadUserProfile
rpcrt4
RpcStringFreeA
bcrypt
BCryptGenRandom
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 842KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 104KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Main Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.detourc Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.detourd Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
_RDATA Size: - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 7.1MB - Virtual size: 7.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 224B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 402KB - Virtual size: 401KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ