Resubmissions
11-01-2024 16:01
240111-tgd2laahcq 1011-01-2024 13:57
240111-q9c38ahbcn 1030-12-2023 02:18
231230-crebnsadgm 9Analysis
-
max time kernel
145s -
max time network
143s -
platform
windows10-1703_x64 -
resource
win10-20231220-en -
resource tags
arch:x64arch:x86image:win10-20231220-enlocale:en-usos:windows10-1703-x64system -
submitted
11-01-2024 13:57
Static task
static1
Behavioral task
behavioral1
Sample
Satana.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
Satana.exe
Resource
win10-20231220-en
Behavioral task
behavioral3
Sample
Satana.exe
Resource
win10v2004-20231215-en
General
-
Target
Satana.exe
-
Size
49KB
-
MD5
46bfd4f1d581d7c0121d2b19a005d3df
-
SHA1
5b063298bbd1670b4d39e1baef67f854b8dcba9d
-
SHA256
683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96
-
SHA512
b52aa090f689765d099689700be7e18922137e7a860a00113e3f72aa6553e94a870bbb741e52de9617506a236a2a59198fb224fcd128576d76642eec9d715df5
-
SSDEEP
768:AbFw10RFnAwJM7MiqwecUaX5h4IuCdYa+XLXTGY1idL2WYiwtDj:Apw10vnAOIUaJh4IXdWXLXTWLfuFj
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
Satana.exedescription pid process target process PID 4728 set thread context of 4668 4728 Satana.exe Satana.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process 4020 4668 WerFault.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
Satana.exedescription pid process target process PID 4728 wrote to memory of 4668 4728 Satana.exe Satana.exe PID 4728 wrote to memory of 4668 4728 Satana.exe Satana.exe PID 4728 wrote to memory of 4668 4728 Satana.exe Satana.exe PID 4728 wrote to memory of 4668 4728 Satana.exe Satana.exe PID 4728 wrote to memory of 4668 4728 Satana.exe Satana.exe PID 4728 wrote to memory of 4668 4728 Satana.exe Satana.exe PID 4728 wrote to memory of 4668 4728 Satana.exe Satana.exe PID 4728 wrote to memory of 4668 4728 Satana.exe Satana.exe PID 4728 wrote to memory of 4668 4728 Satana.exe Satana.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Satana.exe"C:\Users\Admin\AppData\Local\Temp\Satana.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\Satana.exe"C:\Users\Admin\AppData\Local\Temp\Satana.exe"2⤵PID:4668
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4668 -s 4961⤵
- Program crash
PID:4020
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4668-5-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/4668-3-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/4668-1-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/4668-0-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB