satana | 683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96

Resubmissions

15-12-2023 20:21

231215-y41lbshbem 10

15-12-2023 20:02

231215-yr82yaaed2 10

Analysis

max time kernel
28s
max time network
39s
platform
windows7_x64
resource
win7-20231129-es
resource tags

arch:x64arch:x86image:win7-20231129-eslocale:es-esos:windows7-x64systemwindows
submitted
15-12-2023 20:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96.exe
Size

49KB
MD5

46bfd4f1d581d7c0121d2b19a005d3df
SHA1

5b063298bbd1670b4d39e1baef67f854b8dcba9d
SHA256

683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96
SHA512

b52aa090f689765d099689700be7e18922137e7a860a00113e3f72aa6553e94a870bbb741e52de9617506a236a2a59198fb224fcd128576d76642eec9d715df5
SSDEEP

768:AbFw10RFnAwJM7MiqwecUaX5h4IuCdYa+XLXTGY1idL2WYiwtDj:Apw10vnAOIUaJh4IXdWXLXTWLfuFj

Score

10^/10

satana persistence ransomware

Malware Config

Signatures

Satana
Ransomware family which also encrypts the system's Master Boot Record (MBR).
ransomware satana

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Windows\CurrentVersion\Run\rdzc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\!satana!.txt"	683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96.exe

description	pid	process	target process
PID 2036 set thread context of 1832	2036	683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96.exe	683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96.exe

description	pid	process	target process
PID 2036 wrote to memory of 1832	2036	683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96.exe	683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96.exe
PID 2036 wrote to memory of 1832	2036	683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96.exe	683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96.exe
PID 2036 wrote to memory of 1832	2036	683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96.exe	683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96.exe
PID 2036 wrote to memory of 1832	2036	683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96.exe	683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96.exe
PID 2036 wrote to memory of 1832	2036	683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96.exe	683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96.exe
PID 2036 wrote to memory of 1832	2036	683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96.exe	683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96.exe
PID 2036 wrote to memory of 1832	2036	683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96.exe	683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96.exe
PID 2036 wrote to memory of 1832	2036	683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96.exe	683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96.exe
PID 2036 wrote to memory of 1832	2036	683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96.exe	683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96.exe
PID 2036 wrote to memory of 1832	2036	683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96.exe	683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96.exe

C:\Users\Admin\AppData\Local\Temp\683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96.exe
"C:\Users\Admin\AppData\Local\Temp\683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2036

C:\Users\Admin\AppData\Local\Temp\683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96.exe
"C:\Users\Admin\AppData\Local\Temp\683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96.exe"
2⤵
- Adds Run key to start application
PID:1832

C:\Users\Admin\AppData\Local\Temp\dys.exe
"C:\Users\Admin\AppData\Local\Temp\dys.exe" {846ee340-7039-11de-9d20-806e6f6e6963} "C:\Users\Admin\AppData\Local\Temp\683A09~1.EXE"
3⤵
PID:2612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\dys.exe
Filesize
40KB

MD5
7c069179663fda6d4f00638083074107

SHA1
e845e015c03486dd25424df5195608149e6c8559

SHA256
bc217d44c96fa540c18685436b14a779639ba15d58175b9ec6f15ad1a861b265

SHA512
a131882b822c5b0dd06f7d7b4648a97279161001f34b066e6c24fb3a057d89c021186d96e97217748f3baed66a35029df3bacf976d55250495c691756435fc85

Download Submit
\Users\Admin\AppData\Local\Temp\dys.exe
Filesize
7KB

MD5
89d404bf5792ddc6ad4c286acde0f286

SHA1
4d5676db055535606e0ad642f14e10a70ab9b114

SHA256
21708dd7eec935cd5ff8967c2199061f2a1b843227d437ba2cd12cefbf3df6d6

SHA512
e35198dfdcaa18da77000728402a9d2cd7c743540a5aa59c753bd8c58bcff32e5d3d8ed64ed90ccf56fae80a404bc08c7da1701e7bfd20f78c769a1d34867400

Download Submit
\Users\Admin\AppData\Local\Temp\dys.exe
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Local\Temp\dys.exe
Filesize
6KB

MD5
4d1a7859ae007f6424a93bc63cf7e666

SHA1
2085112ca44eced749bcca86f268d20ea2f87891

SHA256
0ae9dd087342755804c6447d9e289ab1c8a38ab561790df7b9986ecc51f2d426

SHA512
99ba5e16f6061a164acdb58c55dc3b99f61cc345cffbddec5f9dd2e723765e33b89634fe9512590dd0ec6034ac6d15efb29c5de29bba305feb1762d217900987

Download Submit
memory/1832-5-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1832-3-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1832-1-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1832-0-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1832-7-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1832-9-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2940-38-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download