File name:

satan.exe

Full analysis: https://app.any.run/tasks/99e7732e-af08-42a9-adc3-a333f3419cf3
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: February 05, 2024, 20:58:01
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
ransomware
satan
terdot
zloader
loader
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

C9C341EAF04C89933ED28CBC2739D325

SHA1:

C5B7D47AEF3BD33A24293138FCBA3A5FF286C2A8

SHA256:

1A0A2FD546E3C05E15B2DB3B531CB8E8755641F5F1C17910CE2FB7BBCE2A05B7

SSDEEP:

3072:H8SIBtQnE7OhssdWJ5jy392aCmCbBq0ryEbh/Wl7hqU6Q4NJ15xgDbvSY5thfRb3:c7qvhssdu5jyYaCmCQVE6hqUI5sb9Rb3

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • satan.exe (PID: 1264)
      • satan.exe (PID: 752)

    • Application was injected by another process

      • dwm.exe (PID: 612)
      • explorer.exe (PID: 1164)
      • taskeng.exe (PID: 300)
      • ctfmon.exe (PID: 1564)

    • Runs injected code in another process

      • ucimq.exe (PID: 1172)

    • Deletes shadow copies

      • explorer.exe (PID: 1164)

    • Connects to the CnC server

      • explorer.exe (PID: 1164)

    • ZLOADER has been detected (SURICATA)

      • explorer.exe (PID: 1164)

    • Changes the autorun value in the registry

      • explorer.exe (PID: 1164)

  • SUSPICIOUS

    • Application launched itself

      • satan.exe (PID: 1264)
      • ucimq.exe (PID: 1632)

    • Executable content was dropped or overwritten

      • satan.exe (PID: 752)

    • Executing commands from a ".bat" file

      • satan.exe (PID: 752)

    • Drops a self-deleting batch file

      • satan.exe (PID: 752)

    • Starts itself from another location

      • satan.exe (PID: 752)

    • Starts CMD.EXE for commands execution

      • satan.exe (PID: 752)

    • Block-list domains

      • explorer.exe (PID: 1164)

  • INFO

    • Checks supported languages

      • satan.exe (PID: 752)
      • satan.exe (PID: 1264)
      • ucimq.exe (PID: 1632)
      • ucimq.exe (PID: 1172)

    • Reads the computer name

      • satan.exe (PID: 1264)
      • satan.exe (PID: 752)
      • ucimq.exe (PID: 1172)
      • ucimq.exe (PID: 1632)

    • Reads the machine GUID from the registry

      • satan.exe (PID: 1264)
      • ucimq.exe (PID: 1172)
      • ucimq.exe (PID: 1632)
      • satan.exe (PID: 752)

    • Creates files or folders in the user directory

      • satan.exe (PID: 752)
      • explorer.exe (PID: 1164)

    • Create files in a temporary directory

      • satan.exe (PID: 752)

    • Manual execution by a user

      • vssadmin.exe (PID: 3416)

    • Reads the Internet Settings

      • explorer.exe (PID: 1164)

    • Checks proxy server information

      • explorer.exe (PID: 1164)

    • Reads settings of System Certificates

      • explorer.exe (PID: 1164)

    • Reads security settings of Internet Explorer

      • explorer.exe (PID: 1164)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.dll | Win32 Dynamic Link Library (generic) (43.5)
.exe | Win32 Executable (generic) (29.8)
.exe | Generic Win/DOS Executable (13.2)
.exe | DOS Executable Generic (13.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2017:02:23 20:28:24+01:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 12
CodeSize: 18432
InitializedDataSize: 84992
UninitializedDataSize: -
EntryPoint: 0x13b9
OSVersion: 5.1
ImageVersion: 1
SubsystemVersion: 5.1
Subsystem: Windows GUI
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
45
Monitored processes
10
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start inject inject inject satan.exe no specs satan.exe cmd.exe no specs ucimq.exe no specs ucimq.exe no specs taskeng.exe dwm.exe ctfmon.exe vssadmin.exe no specs #ZLOADER explorer.exe

Process information

PID
CMD
Path
Indicators
Parent process
300taskeng.exe {CE1452CD-5E82-4DCD-B0CC-498574D17563}C:\Windows\System32\taskeng.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Engine
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskeng.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
612"C:\Windows\system32\Dwm.exe"C:\Windows\System32\dwm.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Desktop Window Manager
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\dwm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\uxtheme.dll
752"C:\Users\admin\AppData\Local\Temp\satan.exe" C:\Users\admin\AppData\Local\Temp\satan.exe
satan.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\satan.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1164C:\Windows\Explorer.EXEC:\Windows\explorer.exe
—
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1172"C:\Users\admin\AppData\Roaming\Adadih\ucimq.exe" C:\Users\admin\AppData\Roaming\Adadih\ucimq.exe—ucimq.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\roaming\adadih\ucimq.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1264"C:\Users\admin\AppData\Local\Temp\satan.exe" C:\Users\admin\AppData\Local\Temp\satan.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\satan.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1316"C:\Windows\system32\cmd.exe" /c "C:\Users\admin\AppData\Local\Temp\tmp_92a263fa.bat"C:\Windows\System32\cmd.exe—satan.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1564C:\Windows\System32\ctfmon.exe C:\Windows\System32\ctfmon.exe
taskeng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
CTF Loader
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ctfmon.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msctfmonitor.dll
c:\windows\system32\msctf.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
1632"C:\Users\admin\AppData\Roaming\Adadih\ucimq.exe" C:\Users\admin\AppData\Roaming\Adadih\ucimq.exe—satan.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\roaming\adadih\ucimq.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
3416"C:\Windows\System32\vssadmin.exe" delete shadows /all /quietC:\Windows\System32\vssadmin.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Command Line Interface for Microsoft® Volume Shadow Copy Service
Exit code:
2
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vssadmin.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
Total events
5 468
Read events
4 595
Write events
873
Delete events
0

Modification events

(PID) Process:(1164) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{C8E6F269-B90A-4053-A3BE-499AFCEC98C4}.check.0
Operation:writeName:CheckSetting
Value:
01000000D08C9DDF0115D1118C7A00C04FC297EB01000000DBDD10622BD67741A42163F361389C4700000000020000000000106600000001000020000000714C0B985B0540658F4A2080B484A48FEA0193B4945278E76DEADC9EF300F178000000000E80000000020000200000002B477AD6A48910EDA2BF44A8E4FAAFB7E2EDF3EE6F87B8965B303D8016BD90EA30000000CB02147CAA96DADF9F5A3BD08AC8A954F632048A3EC443FAA534C64E43A96953CAB4A202A2BC0443ADBC5B693897DBB44000000078BCD17E1DCD91E99A86D38616C049FA8C5E2A7C07BB269B76B0709DC8A01ABF25866BF6638D5C4422D1151CE173748901F5A2433E1BD07914E254B07BB130FD
(PID) Process:(1164) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(1164) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000005B010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A8016B000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(1164) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FCC67766-6201-4AD1-A6B8-2F4553C93D47}
Operation:writeName:WpadDecisionReason
Value:
1
(PID) Process:(1164) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FCC67766-6201-4AD1-A6B8-2F4553C93D47}
Operation:writeName:WpadDecisionTime
Value:
40909C067658DA01
(PID) Process:(1164) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FCC67766-6201-4AD1-A6B8-2F4553C93D47}
Operation:writeName:WpadDecision
Value:
0
(PID) Process:(1164) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FCC67766-6201-4AD1-A6B8-2F4553C93D47}
Operation:writeName:WpadNetworkName
Value:
Network 3
(PID) Process:(1164) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-36-3e-ff
Operation:writeName:WpadDecisionReason
Value:
1
(PID) Process:(1164) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-36-3e-ff
Operation:writeName:WpadDecisionTime
Value:
40909C067658DA01
(PID) Process:(1164) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-36-3e-ff
Operation:writeName:WpadDecision
Value:
0
Executable files
1
Suspicious files
7
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
1164explorer.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8408FE5CA4467EE4DA84A76EF238FE3binary
MD5:AC31ABC8D328A2C70BFF97330F9B9752
SHA256:BD9366861534EF52A34C9E1BB8D92C9D26931A28C979182C2B32C7AB2E0C431F
752satan.exeC:\Users\admin\AppData\Local\Temp\tmp_92a263fa.battext
MD5:C8E448797935001B5CEE6DD1ED52F241
SHA256:63A0FDADE9FC3E649B8693E7F1746CDD3D37A0014D28B9DACF141775BA705904
1164explorer.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D2B71A4BE6642FC73BA7DCE0639EFD46binary
MD5:7DA7CD73EF58BEC95435BFA4D5A1406F
SHA256:7C121EA930659BE1FFE9D252C1F4F2A04A93BD9DB5CDFAF47CABD570704FF4EC
1164explorer.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751binary
MD5:8C844D933F095FA7F337CB4BC580C4BA
SHA256:0DCEE9B101B5A24298815367D3B25E03563ABE87FA03615CD2B6308529307A24
1164explorer.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:AEABF29B34E354EDA12A5540F3344106
SHA256:DFD0B05C2D40E9352DA8386BCB99934510D60B638C11D6DE661102F72EA1A27F
1164explorer.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D2B71A4BE6642FC73BA7DCE0639EFD46binary
MD5:C6CECC911F1CAD061F31ABB9B06091EA
SHA256:05FAE3FAF19EF1FD2B01BE0C7B83D286B4BA4F66E867F17782651746CE07574C
1164explorer.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751binary
MD5:60FE01DF86BE2E5331B0CDBE86165686
SHA256:C08CCBC876CD5A7CDFA9670F9637DA57F6A1282198A9BC71FC7D7247A6E5B7A8
752satan.exeC:\Users\admin\AppData\Roaming\Adadih\ucimq.exeexecutable
MD5:DE9157C3CBB3355B0E9F190C09247DFB
SHA256:4FF70EAE9B426F9A0FC0251ED00E627B758152D39543954AAD8A970142476A82
1164explorer.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8408FE5CA4467EE4DA84A76EF238FE3binary
MD5:E829E65D7C4307D6FBC13C179E037A36
SHA256:67ADD1166B020AE61B8F5FC96813C04C2AA589960796865572A3C7E737613DFD
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
17
DNS requests
6
Threats
12

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1164
explorer.exe
GET
200
23.192.153.142:80
http://r3.i.lencr.org/
unknown
binary
1.28 Kb
unknown
1164
explorer.exe
GET
200
23.192.153.142:80
http://x1.c.lencr.org/
unknown
binary
717 b
unknown
1164
explorer.exe
GET
304
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?7a1349fffd0eac93
unknown
—
—
unknown
1164
explorer.exe
POST
301
144.202.70.158:80
http://6pi3jrqjbssfh6gu.onion.pw/g.php
unknown
html
169 b
unknown
1164
explorer.exe
GET
200
23.213.161.5:80
http://r3.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgSyGh0nqioi4IuUUJAypdNGzg%3D%3D
unknown
binary
503 b
unknown
1164
explorer.exe
POST
301
144.202.70.158:80
http://6pi3jrqjbssfh6gu.onion.pw/g.php
unknown
html
169 b
unknown
1080
svchost.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?1b8fee253118cbef
unknown
compressed
65.2 Kb
unknown
1080
svchost.exe
GET
304
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?3e412f7b4eff0943
unknown
compressed
65.2 Kb
unknown
1164
explorer.exe
POST
301
144.202.70.158:80
http://6pi3jrqjbssfh6gu.onion.pw/g.php
unknown
html
169 b
unknown
1164
explorer.exe
POST
301
144.202.70.158:80
http://6pi3jrqjbssfh6gu.onion.pw/g.php
unknown
html
169 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
1164
explorer.exe
144.202.70.158:80
6pi3jrqjbssfh6gu.onion.pw
AS-CHOOPA
US
unknown
1164
explorer.exe
144.202.70.158:443
6pi3jrqjbssfh6gu.onion.pw
AS-CHOOPA
US
unknown
1164
explorer.exe
93.184.221.240:80
ctldl.windowsupdate.com
EDGECAST
GB
whitelisted
1164
explorer.exe
23.192.153.142:80
r3.i.lencr.org
AKAMAI-AS
GB
unknown
1164
explorer.exe
23.213.161.5:80
r3.o.lencr.org
Akamai International B.V.
DE
unknown
1080
svchost.exe
93.184.221.240:80
ctldl.windowsupdate.com
EDGECAST
GB
whitelisted

DNS requests

Domain
IP
Reputation
6pi3jrqjbssfh6gu.onion.pw
  • 144.202.70.158
whitelisted
ctldl.windowsupdate.com
  • 93.184.221.240
whitelisted
r3.i.lencr.org
  • 23.192.153.142
whitelisted
x1.c.lencr.org
  • 23.192.153.142
whitelisted
r3.o.lencr.org
  • 23.213.161.5
  • 23.213.161.9
shared
synlogosttloeq2pwb4w6zaibacubnedji46bmsd3mhapesyeqa4xpqd.onion
  • —
unknown

Threats

PID
Process
Class
Message
1080
svchost.exe
Potentially Bad Traffic
ET DNS Query to a *.pw domain - Likely Hostile
1080
svchost.exe
Potentially Bad Traffic
ET POLICY DNS Query to .onion proxy Domain (onion. pw)
1164
explorer.exe
Misc activity
ET INFO HTTP Request to a *.pw domain
1080
svchost.exe
Potential Corporate Privacy Violation
ET POLICY DNS Query for TOR Hidden Domain .onion Accessible Via TOR
1164
explorer.exe
Misc activity
ET INFO HTTP Request to a *.pw domain
1164
explorer.exe
Misc activity
ET INFO HTTP Request to a *.pw domain
1164
explorer.exe
Misc activity
ET INFO HTTP Request to a *.pw domain
5 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
satan.exe