| File name: | satanC2.exe |
| Full analysis: | https://app.any.run/tasks/e219a6f4-05e5-47ab-a9a4-fe2b99d967a9 |
| Verdict: | Malicious activity |
| Analysis date: | September 10, 2024, 13:33:11 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32+ executable (console) x86-64, for MS Windows |
| MD5: | 6C63E2D2B1D9CEB7FD822E0627BB5DF4 |
| SHA1: | BAF3E78639A8A835E77A591F19516FA461AF656B |
| SHA256: | CD423D772A1F7BD99D83BC09611BE2317A83C50BBC0D4212A5D0900FC8ED5A05 |
| SSDEEP: | 98304:lXE5BKsuDOXScbtnbGd49IRQJ+FgLHIcctvQ4qUmbJ7E8coKSTdB9kUp5JU5XjAB:mf/1T82YqzQ0rKVTMG |
MALICIOUS
No malicious indicators.SUSPICIOUS
The process drops C-runtime libraries
- satanC2.exe (PID: 5712)
Process drops python dynamic module
- satanC2.exe (PID: 5712)
Loads Python modules
- satanC2.exe (PID: 5544)
Process drops legitimate windows executable
- satanC2.exe (PID: 5712)
Executable content was dropped or overwritten
- satanC2.exe (PID: 5712)
Application launched itself
- satanC2.exe (PID: 5712)
INFO
Reads the computer name
- satanC2.exe (PID: 5712)
Create files in a temporary directory
- satanC2.exe (PID: 5712)
Checks supported languages
- satanC2.exe (PID: 5544)
- satanC2.exe (PID: 5712)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | InstallShield setup (57.6) |
|---|---|---|
| .exe | | | Win64 Executable (generic) (36.9) |
| .exe | | | Generic Win/DOS Executable (2.6) |
| .exe | | | DOS Executable Generic (2.6) |
EXIF
EXE
| MachineType: | AMD AMD64 |
|---|---|
| TimeStamp: | 2023:11:03 18:29:41+00:00 |
| ImageFileCharacteristics: | Executable, Large address aware |
| PEType: | PE32+ |
| LinkerVersion: | 14.34 |
| CodeSize: | 166400 |
| InitializedDataSize: | 152576 |
| UninitializedDataSize: | - |
| EntryPoint: | 0xa6a0 |
| OSVersion: | 5.2 |
| ImageVersion: | - |
| SubsystemVersion: | 5.2 |
| Subsystem: | Windows command line |
Total processes
123
Monitored processes
3
Malicious processes
1
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 5544 | "C:\Users\admin\Desktop\satanC2.exe" | C:\Users\admin\Desktop\satanC2.exe | — | satanC2.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 1 Modules
| |||||||||||||||
| 5712 | "C:\Users\admin\Desktop\satanC2.exe" | C:\Users\admin\Desktop\satanC2.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 1 Modules
| |||||||||||||||
| 5720 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | satanC2.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
217
Read events
217
Write events
0
Delete events
0
Modification events
Executable files
64
Suspicious files
1
Text files
9
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 5712 | satanC2.exe | C:\Users\admin\AppData\Local\Temp\_MEI57122\_cffi_backend.cp311-win_amd64.pyd | executable | |
MD5:FDE9A1D6590026A13E81712CD2F23522 | SHA256:16ECCC4BAF6CF4AB72ACD53C72A1F2B04D952E07E385E9050A933E78074A7D5B | |||
| 5712 | satanC2.exe | C:\Users\admin\AppData\Local\Temp\_MEI57122\VCRUNTIME140.dll | executable | |
MD5:4585A96CC4EEF6AAFD5E27EA09147DC6 | SHA256:A8F950B4357EC12CFCCDDC9094CCA56A3D5244B95E09EA6E9A746489F2D58736 | |||
| 5712 | satanC2.exe | C:\Users\admin\AppData\Local\Temp\_MEI57122\_decimal.pyd | executable | |
MD5:65B4AB77D6C6231C145D3E20E7073F51 | SHA256:93EB9D1859EDCA1C29594491863BF3D72AF70B9A4240E0D9DD171F668F4F8614 | |||
| 5712 | satanC2.exe | C:\Users\admin\AppData\Local\Temp\_MEI57122\_lzma.pyd | executable | |
MD5:E5ABC3A72996F8FDE0BCF709E6577D9D | SHA256:1796038480754A680F33A4E37C8B5673CC86C49281A287DC0C5CAE984D0CB4BB | |||
| 5712 | satanC2.exe | C:\Users\admin\AppData\Local\Temp\_MEI57122\_ctypes.pyd | executable | |
MD5:BD36F7D64660D120C6FB98C8F536D369 | SHA256:EE543453AC1A2B9B52E80DC66207D3767012CA24CE2B44206804767F37443902 | |||
| 5712 | satanC2.exe | C:\Users\admin\AppData\Local\Temp\_MEI57122\_socket.pyd | executable | |
MD5:1EEA9568D6FDEF29B9963783827F5867 | SHA256:74181072392A3727049EA3681FE9E59516373809CED53E08F6DA7C496B76E117 | |||
| 5712 | satanC2.exe | C:\Users\admin\AppData\Local\Temp\_MEI57122\api-ms-win-core-datetime-l1-1-0.dll | executable | |
MD5:88870D5E29A3C5297F3B7E69B7ECD74D | SHA256:9608C021164094322899E5799A86188891FA571A4E31B36888E256324C7D76BD | |||
| 5712 | satanC2.exe | C:\Users\admin\AppData\Local\Temp\_MEI57122\_uuid.pyd | executable | |
MD5:46E9D7B5D9668C9DB5CAA48782CA71BA | SHA256:F6063622C0A0A34468679413D1B18D1F3BE67E747696AB972361FAED4B8D6735 | |||
| 5712 | satanC2.exe | C:\Users\admin\AppData\Local\Temp\_MEI57122\_overlapped.pyd | executable | |
MD5:E5ACEAF21E82253E300C0B78793887A8 | SHA256:D950342686C959056FF43C9E5127554760FA20669D97166927DD6AAE5494E02A | |||
| 5712 | satanC2.exe | C:\Users\admin\AppData\Local\Temp\_MEI57122\api-ms-win-core-debug-l1-1-0.dll | executable | |
MD5:F57813D3B4B2669EE379C8D63D068507 | SHA256:7009A34534C64708F00117345BF577611747351F723969B50DB761DEFC9360F2 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
16
DNS requests
4
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
1356 | svchost.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
2120 | MoUsoCoreWorker.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6112 | RUXIMICS.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
1356 | svchost.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
1356 | svchost.exe | 184.30.21.171:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
3888 | svchost.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
2120 | MoUsoCoreWorker.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
1356 | svchost.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4324 | svchost.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |