Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
10-03-2024 17:05
Static task
static1
Behavioral task
behavioral1
Sample
683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral2
Sample
Satana/satana.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
Satana/unpacked.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral4
Sample
unpacked.exe
Resource
win10v2004-20240226-en
General
-
Target
Satana/satana.exe
-
Size
49KB
-
MD5
46bfd4f1d581d7c0121d2b19a005d3df
-
SHA1
5b063298bbd1670b4d39e1baef67f854b8dcba9d
-
SHA256
683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96
-
SHA512
b52aa090f689765d099689700be7e18922137e7a860a00113e3f72aa6553e94a870bbb741e52de9617506a236a2a59198fb224fcd128576d76642eec9d715df5
-
SSDEEP
768:AbFw10RFnAwJM7MiqwecUaX5h4IuCdYa+XLXTGY1idL2WYiwtDj:Apw10vnAOIUaJh4IXdWXLXTWLfuFj
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
satana.exedescription pid process target process PID 4648 set thread context of 4936 4648 satana.exe satana.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2280 4936 WerFault.exe satana.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
satana.exedescription pid process target process PID 4648 wrote to memory of 4936 4648 satana.exe satana.exe PID 4648 wrote to memory of 4936 4648 satana.exe satana.exe PID 4648 wrote to memory of 4936 4648 satana.exe satana.exe PID 4648 wrote to memory of 4936 4648 satana.exe satana.exe PID 4648 wrote to memory of 4936 4648 satana.exe satana.exe PID 4648 wrote to memory of 4936 4648 satana.exe satana.exe PID 4648 wrote to memory of 4936 4648 satana.exe satana.exe PID 4648 wrote to memory of 4936 4648 satana.exe satana.exe PID 4648 wrote to memory of 4936 4648 satana.exe satana.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Satana\satana.exe"C:\Users\Admin\AppData\Local\Temp\Satana\satana.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\Satana\satana.exe"C:\Users\Admin\AppData\Local\Temp\Satana\satana.exe"2⤵PID:4936
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4936 -s 3403⤵
- Program crash
PID:2280
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4936 -ip 49361⤵PID:3648