saintbot | fa1bc7d6f03a49af50f7153814a078a32f24f353c9cb2b8e3f329888f2b37a6e

Analysis

max time kernel
4294181s
max time network
123s
platform
windows7_x64
resource
win7-20220223-en
submitted
28-02-2022 03:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fa1bc7d6f03a49af50f7153814a078a32f24f353c9cb2b8e3f329888f2b37a6e.exe
Size

365KB
MD5

2371d432700a7e1f9c070a6e97fdb634
SHA1

00d6c66ab2fd1810628d13980cc73275884933b1
SHA256

fa1bc7d6f03a49af50f7153814a078a32f24f353c9cb2b8e3f329888f2b37a6e
SHA512

423e76393e65defab5cdaef0c2a3249cadfbd3413d6763db8428e3a6a13e2a880c6a93cba35cf783ccc126b26bcd3e6ad6bf3059be94ca0d3798b75b51c4e7e5

Score

10^/10

saintbot discovery dropper persistence

Malware Config

Signatures

SaintBot
Saint Bot is a malware dropper being used to deliver secondary payloads such as information stealers.
dropper saintbot

SaintBot Payload 1 IoCs

resource	yara_rule
behavioral1/memory/900-101-0x0000000000080000-0x000000000008B000-memory.dmp	family_saintbot

Executes dropped EXE 2 IoCs

pid	Process
1988	Google Chrome.exe
1764	Google Chrome.exe

Deletes itself 1 IoCs

pid	Process
2004	cmd.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Google Chrome.exe	fa1bc7d6f03a49af50f7153814a078a32f24f353c9cb2b8e3f329888f2b37a6e.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Google Chrome.exe	Google Chrome.exe

Loads dropped DLL 4 IoCs

pid	Process
1108	fa1bc7d6f03a49af50f7153814a078a32f24f353c9cb2b8e3f329888f2b37a6e.exe
1988	Google Chrome.exe
1764	Google Chrome.exe
900	dfrgui.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\zzAdmin\\Admin.vbs"	dfrgui.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Maps connected drives based on registry 3 TTPs 6 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	dfrgui.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\start /b "" cmd /c del "%~f0"&exit /b	dfrgui.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	fa1bc7d6f03a49af50f7153814a078a32f24f353c9cb2b8e3f329888f2b37a6e.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\start /b "" cmd /c del "%~f0"&exit /b	fa1bc7d6f03a49af50f7153814a078a32f24f353c9cb2b8e3f329888f2b37a6e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	Google Chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\start /b "" cmd /c del "%~f0"&exit /b	Google Chrome.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\dfrgui.exe	dfrgui.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1636 set thread context of 1108	1636	fa1bc7d6f03a49af50f7153814a078a32f24f353c9cb2b8e3f329888f2b37a6e.exe	27
PID 1988 set thread context of 1764	1988	Google Chrome.exe	35

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	dfrgui.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dfrgui.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1480	schtasks.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
956	PING.EXE

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
1636	fa1bc7d6f03a49af50f7153814a078a32f24f353c9cb2b8e3f329888f2b37a6e.exe
1636	fa1bc7d6f03a49af50f7153814a078a32f24f353c9cb2b8e3f329888f2b37a6e.exe
1636	fa1bc7d6f03a49af50f7153814a078a32f24f353c9cb2b8e3f329888f2b37a6e.exe
1636	fa1bc7d6f03a49af50f7153814a078a32f24f353c9cb2b8e3f329888f2b37a6e.exe
1988	Google Chrome.exe
1988	Google Chrome.exe
1988	Google Chrome.exe
1988	Google Chrome.exe
1764	Google Chrome.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1636	fa1bc7d6f03a49af50f7153814a078a32f24f353c9cb2b8e3f329888f2b37a6e.exe
Token: SeDebugPrivilege	1988	Google Chrome.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 1108	1636	fa1bc7d6f03a49af50f7153814a078a32f24f353c9cb2b8e3f329888f2b37a6e.exe	27
PID 1636 wrote to memory of 1108	1636	fa1bc7d6f03a49af50f7153814a078a32f24f353c9cb2b8e3f329888f2b37a6e.exe	27
PID 1636 wrote to memory of 1108	1636	fa1bc7d6f03a49af50f7153814a078a32f24f353c9cb2b8e3f329888f2b37a6e.exe	27
PID 1636 wrote to memory of 1108	1636	fa1bc7d6f03a49af50f7153814a078a32f24f353c9cb2b8e3f329888f2b37a6e.exe	27
PID 1636 wrote to memory of 1108	1636	fa1bc7d6f03a49af50f7153814a078a32f24f353c9cb2b8e3f329888f2b37a6e.exe	27
PID 1636 wrote to memory of 1108	1636	fa1bc7d6f03a49af50f7153814a078a32f24f353c9cb2b8e3f329888f2b37a6e.exe	27
PID 1636 wrote to memory of 1108	1636	fa1bc7d6f03a49af50f7153814a078a32f24f353c9cb2b8e3f329888f2b37a6e.exe	27
PID 1636 wrote to memory of 1108	1636	fa1bc7d6f03a49af50f7153814a078a32f24f353c9cb2b8e3f329888f2b37a6e.exe	27
PID 1636 wrote to memory of 1108	1636	fa1bc7d6f03a49af50f7153814a078a32f24f353c9cb2b8e3f329888f2b37a6e.exe	27
PID 1636 wrote to memory of 1108	1636	fa1bc7d6f03a49af50f7153814a078a32f24f353c9cb2b8e3f329888f2b37a6e.exe	27
PID 1636 wrote to memory of 1108	1636	fa1bc7d6f03a49af50f7153814a078a32f24f353c9cb2b8e3f329888f2b37a6e.exe	27
PID 1636 wrote to memory of 1108	1636	fa1bc7d6f03a49af50f7153814a078a32f24f353c9cb2b8e3f329888f2b37a6e.exe	27
PID 1636 wrote to memory of 1108	1636	fa1bc7d6f03a49af50f7153814a078a32f24f353c9cb2b8e3f329888f2b37a6e.exe	27
PID 1636 wrote to memory of 1108	1636	fa1bc7d6f03a49af50f7153814a078a32f24f353c9cb2b8e3f329888f2b37a6e.exe	27
PID 1108 wrote to memory of 1988	1108	fa1bc7d6f03a49af50f7153814a078a32f24f353c9cb2b8e3f329888f2b37a6e.exe	28
PID 1108 wrote to memory of 1988	1108	fa1bc7d6f03a49af50f7153814a078a32f24f353c9cb2b8e3f329888f2b37a6e.exe	28
PID 1108 wrote to memory of 1988	1108	fa1bc7d6f03a49af50f7153814a078a32f24f353c9cb2b8e3f329888f2b37a6e.exe	28
PID 1108 wrote to memory of 1988	1108	fa1bc7d6f03a49af50f7153814a078a32f24f353c9cb2b8e3f329888f2b37a6e.exe	28
PID 1108 wrote to memory of 1988	1108	fa1bc7d6f03a49af50f7153814a078a32f24f353c9cb2b8e3f329888f2b37a6e.exe	28
PID 1108 wrote to memory of 1988	1108	fa1bc7d6f03a49af50f7153814a078a32f24f353c9cb2b8e3f329888f2b37a6e.exe	28
PID 1108 wrote to memory of 1988	1108	fa1bc7d6f03a49af50f7153814a078a32f24f353c9cb2b8e3f329888f2b37a6e.exe	28
PID 1108 wrote to memory of 2004	1108	fa1bc7d6f03a49af50f7153814a078a32f24f353c9cb2b8e3f329888f2b37a6e.exe	30
PID 1108 wrote to memory of 2004	1108	fa1bc7d6f03a49af50f7153814a078a32f24f353c9cb2b8e3f329888f2b37a6e.exe	30
PID 1108 wrote to memory of 2004	1108	fa1bc7d6f03a49af50f7153814a078a32f24f353c9cb2b8e3f329888f2b37a6e.exe	30
PID 1108 wrote to memory of 2004	1108	fa1bc7d6f03a49af50f7153814a078a32f24f353c9cb2b8e3f329888f2b37a6e.exe	30
PID 2004 wrote to memory of 956	2004	cmd.exe	31
PID 2004 wrote to memory of 956	2004	cmd.exe	31
PID 2004 wrote to memory of 956	2004	cmd.exe	31
PID 2004 wrote to memory of 956	2004	cmd.exe	31
PID 2004 wrote to memory of 1380	2004	cmd.exe	34
PID 2004 wrote to memory of 1380	2004	cmd.exe	34
PID 2004 wrote to memory of 1380	2004	cmd.exe	34
PID 2004 wrote to memory of 1380	2004	cmd.exe	34
PID 1988 wrote to memory of 1764	1988	Google Chrome.exe	35
PID 1988 wrote to memory of 1764	1988	Google Chrome.exe	35
PID 1988 wrote to memory of 1764	1988	Google Chrome.exe	35
PID 1988 wrote to memory of 1764	1988	Google Chrome.exe	35
PID 1988 wrote to memory of 1764	1988	Google Chrome.exe	35
PID 1988 wrote to memory of 1764	1988	Google Chrome.exe	35
PID 1988 wrote to memory of 1764	1988	Google Chrome.exe	35
PID 1988 wrote to memory of 1764	1988	Google Chrome.exe	35
PID 1988 wrote to memory of 1764	1988	Google Chrome.exe	35
PID 1988 wrote to memory of 1764	1988	Google Chrome.exe	35
PID 1988 wrote to memory of 1764	1988	Google Chrome.exe	35
PID 1988 wrote to memory of 1764	1988	Google Chrome.exe	35
PID 1988 wrote to memory of 1764	1988	Google Chrome.exe	35
PID 1988 wrote to memory of 1764	1988	Google Chrome.exe	35
PID 1764 wrote to memory of 900	1764	Google Chrome.exe	36
PID 1764 wrote to memory of 900	1764	Google Chrome.exe	36
PID 1764 wrote to memory of 900	1764	Google Chrome.exe	36
PID 1764 wrote to memory of 900	1764	Google Chrome.exe	36
PID 1764 wrote to memory of 900	1764	Google Chrome.exe	36
PID 900 wrote to memory of 1480	900	dfrgui.exe	37
PID 900 wrote to memory of 1480	900	dfrgui.exe	37
PID 900 wrote to memory of 1480	900	dfrgui.exe	37
PID 900 wrote to memory of 1480	900	dfrgui.exe	37

C:\Users\Admin\AppData\Local\Temp\fa1bc7d6f03a49af50f7153814a078a32f24f353c9cb2b8e3f329888f2b37a6e.exe
"C:\Users\Admin\AppData\Local\Temp\fa1bc7d6f03a49af50f7153814a078a32f24f353c9cb2b8e3f329888f2b37a6e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Users\Admin\AppData\Local\Temp\fa1bc7d6f03a49af50f7153814a078a32f24f353c9cb2b8e3f329888f2b37a6e.exe
  "C:\Users\Admin\AppData\Local\Temp\fa1bc7d6f03a49af50f7153814a078a32f24f353c9cb2b8e3f329888f2b37a6e.exe"
  2⤵
  - Drops startup file
  - Loads dropped DLL
  - Maps connected drives based on registry
  - Suspicious use of WriteProcessMemory
  PID:1108
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Google Chrome.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Google Chrome.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1988
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Google Chrome.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Google Chrome.exe"
      4⤵
      Executes dropped EXE
      Drops startup file
      Loads dropped DLL
      Maps connected drives based on registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1764
    - - C:\Windows\SysWOW64\dfrgui.exe
        
        "C:\Windows\system32\dfrgui.exe"
        5⤵
        Loads dropped DLL
        Adds Run key to start application
        Maps connected drives based on registry
        Drops file in System32 directory
        Checks processor information in registry
        Suspicious use of WriteProcessMemory
        
        PID:900
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /sc minute /mo 5 /tn "Update" /tr "%SYSTEMDRIVE%\Users\%USERNAME%\AppData\Local\zz%USERNAME%\%USERNAME%.vbs" /F
        6⤵
        Creates scheduled task(s)
        
        PID:1480
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Users\Admin\AppData\Roaming\del.bat
    3⤵
    - Deletes itself
    - Suspicious use of WriteProcessMemory
    PID:2004
  - - C:\Windows\SysWOW64\PING.EXE
      ping localhost -n 3
      4⤵
      Runs ping.exe
      PID:956
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c del "C:\Users\Admin\AppData\Roaming\del.bat"
      4⤵
      PID:1380

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/900-101-0x0000000000080000-0x000000000008B000-memory.dmp

Filesize
44KB

Download
memory/1108-62-0x0000000000090000-0x000000000009B000-memory.dmp

Filesize
44KB

Download
memory/1108-61-0x0000000000090000-0x000000000009B000-memory.dmp

Filesize
44KB

Download
memory/1108-66-0x0000000000090000-0x000000000009B000-memory.dmp

Filesize
44KB

Download
memory/1108-65-0x0000000000090000-0x000000000009B000-memory.dmp

Filesize
44KB

Download
memory/1108-69-0x0000000000090000-0x000000000009B000-memory.dmp

Filesize
44KB

Download
memory/1108-73-0x0000000000090000-0x000000000009B000-memory.dmp

Filesize
44KB

Download
memory/1108-77-0x0000000075AC1000-0x0000000075AC3000-memory.dmp

Filesize
8KB

Download
memory/1108-64-0x0000000000090000-0x000000000009B000-memory.dmp

Filesize
44KB

Download
memory/1108-63-0x0000000000090000-0x000000000009B000-memory.dmp

Filesize
44KB

Download
memory/1636-59-0x0000000000740000-0x000000000075A000-memory.dmp

Filesize
104KB

Download
memory/1636-54-0x0000000000B20000-0x0000000000B80000-memory.dmp

Filesize
384KB

Download
memory/1636-60-0x00000000007D0000-0x00000000007D6000-memory.dmp

Filesize
24KB

Download
memory/1636-67-0x0000000004D61000-0x0000000004D62000-memory.dmp

Filesize
4KB

Download
memory/1636-58-0x0000000004D60000-0x0000000004D61000-memory.dmp

Filesize
4KB

Download
memory/1636-57-0x0000000074BEE000-0x0000000074BEF000-memory.dmp

Filesize
4KB

Download
memory/1636-56-0x0000000000360000-0x0000000000376000-memory.dmp

Filesize
88KB

Download
memory/1636-55-0x00000000004A0000-0x00000000004D2000-memory.dmp

Filesize
200KB

Download
memory/1764-98-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1988-82-0x0000000001380000-0x00000000013E0000-memory.dmp

Filesize
384KB

Download
memory/1988-83-0x00000000749FE000-0x00000000749FF000-memory.dmp

Filesize
4KB

Download
memory/1988-84-0x0000000004D90000-0x0000000004D91000-memory.dmp

Filesize
4KB

Download
memory/1988-92-0x0000000004D91000-0x0000000004D92000-memory.dmp

Filesize
4KB

Download