Overview

overview

9

Static

static

satan_1.0....ir.exe

windows7_x64

9

satan_1.0....ir.exe

windows10_x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    satan_1.0.0.16.vir

  • Size

    184KB

  • Sample

    200719-ev4bcz7hs2

  • MD5

    5e2ed2f916fc4291ffd2f58334a966bc

  • SHA1

    2f887e570c13f5dc204230a05774adba6ad3004c

  • SHA256

    3b73775e3999fa2a73354e2f9073ae52c61f2aa4ed348b0889f3c85653cf1145

  • SHA512

    0a55713bc54efbad793515b7c29b97a58fcd3daac9ead934028878b8f135f63b50e3cc4c1073703f0ad6202137f0ac403da997ce9bf84dc0ed6a56fef87bf671

Score
9/10
evasionpersistenceransomwaretrojan

Malware Config

Targets

    • Target

      satan_1.0.0.16.vir

    • Size

      184KB

    • MD5

      5e2ed2f916fc4291ffd2f58334a966bc

    • SHA1

      2f887e570c13f5dc204230a05774adba6ad3004c

    • SHA256

      3b73775e3999fa2a73354e2f9073ae52c61f2aa4ed348b0889f3c85653cf1145

    • SHA512

      0a55713bc54efbad793515b7c29b97a58fcd3daac9ead934028878b8f135f63b50e3cc4c1073703f0ad6202137f0ac403da997ce9bf84dc0ed6a56fef87bf671

    Score
    9/10
    persistenceevasiontrojanransomware

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Modifies service

      persistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Modify Existing Service

1
T1031

Privilege Escalation

Defense Evasion

File Deletion

2
T1107

Modify Registry

2
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

2
T1490

Tasks