{"id":86406,"date":"2018-06-20T16:38:35","date_gmt":"2018-06-20T11:08:35","guid":{"rendered":"https:\/\/blogs_admin.quickheal.com\/?p=86406"},"modified":"2018-06-20T16:38:35","modified_gmt":"2018-06-20T11:08:35","slug":"satan-ransomware-raises-head","status":"publish","type":"post","link":"https:\/\/www.quickheal.com\/blogs\/satan-ransomware-raises-head\/","title":{"rendered":"Satan ransomware raises its head again!"},"content":{"rendered":"<p>Satan ransomware first occurred in early 2017. And it has resurfaced with a new variant in 2018. We have seen it using new, innovative techniques to spread such as EternalBlue exploit to distribute over compromised networks.<\/p>\n<p>&nbsp;<\/p>\n<p>This variant of Satan propagates using the below techniques:<\/p>\n<ul>\n<li>Mimikatz<\/li>\n<li>EternalBlue &#8211; exploit CVE-2017-0143<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<p><strong>Technical Analysis<\/strong><\/p>\n<p>1<strong>.<\/strong> The mother file is packed with the MPRESS packer (as shown in the snippet in fig 1) which after execution drops many public version EternalBlue files on the victim\u2019s machine.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-86407\" src=\"https:\/\/blogs_admin.quickheal.com\/wp-content\/uploads\/2018\/06\/1.png\" alt=\"\" width=\"687\" height=\"236\" srcset=\"https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2018\/06\/1.png 687w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2018\/06\/1-300x103.png 300w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2018\/06\/1-650x223.png 650w\" sizes=\"(max-width: 687px) 100vw, 687px\" \/><\/p>\n<p style=\"text-align: center\">Fig 1. The file is packed with Mpress packer<\/p>\n<p>2. These files are dropped at \u2018C:\\Users\\All Users\\\u2019 location. These files are also packed with the MPRESS packer.<\/p>\n<p>3. Mother file scans for all the systems which are in the same network using EternalBlue to find outdated SMB services and encrypts files on the host systems to maximize profit from attack.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-86411\" src=\"https:\/\/blogs_admin.quickheal.com\/wp-content\/uploads\/2018\/06\/2.jpg\" alt=\"\" width=\"668\" height=\"560\" srcset=\"https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2018\/06\/2.jpg 668w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2018\/06\/2-300x251.jpg 300w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2018\/06\/2-465x390.jpg 465w\" sizes=\"(max-width: 668px) 100vw, 668px\" \/><\/p>\n<p style=\"text-align: center\">Fig 2. Dropped EternalBlue files<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p>This version of Satan also drops mmkt.exe (Mimikatz) which is an open-source tool that permits the attacker to dig out credential information from the Windows lsass (Local Security Authority Subsystem Service). Using Mimikatz, it then stores credential of network computers and then it accesses and infects machines on the same network using these credentials.<\/p>\n<p>It had dropped satan.exe on the victim\u2019s machine at C drive and executed it, which is responsible for encryption.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-86412\" src=\"https:\/\/blogs_admin.quickheal.com\/wp-content\/uploads\/2018\/06\/3.png\" alt=\"\" width=\"616\" height=\"165\" srcset=\"https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2018\/06\/3.png 616w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2018\/06\/3-300x80.png 300w\" sizes=\"(max-width: 616px) 100vw, 616px\" \/><\/p>\n<p style=\"text-align: center\">Fig 3. Drop location for satan.exe from mother file.<\/p>\n<p>For storing unique host identifier, it drops a file with name \u201cKSession\u201d at \u201cC:\\Windows\\Temp\\\u201d<\/p>\n<p>Satan renames an encrypted file in following way:<\/p>\n<p>E.g.: Example.jpg to [dbger@protonmail.com] Example.jpg.dbger<\/p>\n<p>Following are the infection marker files and encrypted files with their pattern.<\/p>\n<p style=\"text-align: center\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-86413\" src=\"https:\/\/blogs_admin.quickheal.com\/wp-content\/uploads\/2018\/06\/4.jpg\" alt=\"\" width=\"695\" height=\"412\" srcset=\"https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2018\/06\/4.jpg 695w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2018\/06\/4-300x178.jpg 300w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2018\/06\/4-650x385.jpg 650w\" sizes=\"(max-width: 695px) 100vw, 695px\" \/>Fig 4. Encrypted files pattern.<\/p>\n<p>The ransom note of this ransomware looks like this (fig 5)<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-86414\" src=\"https:\/\/blogs_admin.quickheal.com\/wp-content\/uploads\/2018\/06\/5.jpg\" alt=\"\" width=\"707\" height=\"532\" srcset=\"https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2018\/06\/5.jpg 707w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2018\/06\/5-300x226.jpg 300w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2018\/06\/5-518x390.jpg 518w\" sizes=\"(max-width: 707px) 100vw, 707px\" \/><\/p>\n<p style=\"text-align: center\">Fig 5. Ransom note<\/p>\n<p>After encrypting all the data on the victim\u2019s machine, it kills Satan.exe from memory but the mother file keeps running for sending data to a Command and Control server as seen from the following snippet.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-86416\" src=\"https:\/\/blogs_admin.quickheal.com\/wp-content\/uploads\/2018\/06\/6.png\" alt=\"\" width=\"766\" height=\"49\" srcset=\"https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2018\/06\/6.png 766w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2018\/06\/6-300x19.png 300w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2018\/06\/6-650x42.png 650w\" sizes=\"(max-width: 766px) 100vw, 766px\" \/><\/p>\n<p style=\"text-align: center\">Fig6. Connection to CNC server.<\/p>\n<p>&nbsp;<\/p>\n<p><strong>How Quick Heal protects its users from the Satan ransomware : &#8211;<\/strong><\/p>\n<p>Quick Heal works on multiple levels to protect its users from this threat. These levels include:<\/p>\n<ul>\n<li>Virus Protection<\/li>\n<li>Behavior-based Detection<\/li>\n<li>Anti-Ransomware<\/li>\n<\/ul>\n<p style=\"text-align: center\"><strong>\u00a0<img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-86417\" src=\"https:\/\/blogs_admin.quickheal.com\/wp-content\/uploads\/2018\/06\/7.jpg\" alt=\"\" width=\"459\" height=\"265\" srcset=\"https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2018\/06\/7.jpg 459w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2018\/06\/7-300x173.jpg 300w\" sizes=\"(max-width: 459px) 100vw, 459px\" \/><\/strong>Fig 7. Behavior Detection<\/p>\n<p style=\"text-align: center\"><strong><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-86419\" src=\"https:\/\/blogs_admin.quickheal.com\/wp-content\/uploads\/2018\/06\/8.png\" alt=\"\" width=\"460\" height=\"264\" srcset=\"https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2018\/06\/8.png 460w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2018\/06\/8-300x172.png 300w\" sizes=\"(max-width: 460px) 100vw, 460px\" \/><\/strong>\u00a0Fig 8. Anti-Ransomware Detection<\/p>\n<p><strong>\u00a0<\/strong><\/p>\n<p><strong>How to stay safe from ransomware attacks<\/strong><\/p>\n<ul>\n<li>Always take a backup of your important data in external drives like HDD and pen drives. Consider using a reliable Cloud service to store the data.<\/li>\n<li>Never install any freeware or cracked versions of any software.<\/li>\n<li>Do not open any advertisement pages shown on websites without knowing that they are genuine.<\/li>\n<li>Disable macros while using MS Office.<\/li>\n<li>Always install and update your anti-virus to protect your system from unknown threats.<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<p>Indicators of compromise:<\/p>\n<ul>\n<li>MD5: 6E44ABB2B449DD0BCADF8B0316590D0E<\/li>\n<\/ul>\n<p><strong>Subject matter experts<\/strong><\/p>\n<p>Priyanka Dhasade, Shalaka Patil | Quick Heal Security Labs<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Satan ransomware first occurred in early 2017. And it has resurfaced with a new variant in 2018. We have seen it using new, innovative techniques to spread such as EternalBlue exploit to distribute over compromised networks. &nbsp; This variant of Satan propagates using the below techniques: Mimikatz EternalBlue &#8211; exploit CVE-2017-0143 &nbsp; Technical Analysis 1. [&hellip;]<\/p>\n","protected":false},"author":39,"featured_media":86423,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-86406","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/posts\/86406"}],"collection":[{"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/users\/39"}],"replies":[{"embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/comments?post=86406"}],"version-history":[{"count":3,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/posts\/86406\/revisions"}],"predecessor-version":[{"id":86425,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/posts\/86406\/revisions\/86425"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/media\/86423"}],"wp:attachment":[{"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/media?parent=86406"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/categories?post=86406"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/tags?post=86406"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}