saintbot | 49555ffb1acfd634bb20aab6bbb9aa3b7d953db6984949f7336668c9429fa86d

Analysis

max time kernel
112s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
14/07/2022, 00:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
49555ffb1acfd634bb20aab6bbb9aa3b7d953db6984949f7336668c9429fa86d.exe
Size 3.3MB
Sample220714-aem2yadafm
SHA256 49555ffb1acfd634bb20aab6bbb9aa3b7d953db6984949f7336668c9429fa86d
MD5 b4cc346bf020b471e0c3a670857e34b0
SHA1 298c8b97b14dd90efe7c5f0143637976d4b7d1de
SHA512 e9aa62b1fb6ce5a06374a235d357ce1e2b74b0b0f4ffb5109a9653f54338874b23b49c57c328071e3ea44c74bb86032314d818bd37da2dd6bdd3dbd27f99ebfd
MD5 SHA1 SHA512

Score

10^/10

saintbot dropper

Malware Config

Signatures

SaintBot
Saint Bot is a malware dropper being used to deliver secondary payloads such as information stealers.
dropper saintbot

SaintBot payload 1 IoCs

resource	yara_rule
behavioral2/memory/1540-130-0x0000000000400000-0x0000000000748000-memory.dmp	family_saintbot

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\start /b "" cmd /c del "%~f0"&exit /b	49555ffb1acfd634bb20aab6bbb9aa3b7d953db6984949f7336668c9429fa86d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	49555ffb1acfd634bb20aab6bbb9aa3b7d953db6984949f7336668c9429fa86d.exe

C:\Users\Admin\AppData\Local\Temp\49555ffb1acfd634bb20aab6bbb9aa3b7d953db6984949f7336668c9429fa86d.exe
"C:\Users\Admin\AppData\Local\Temp\49555ffb1acfd634bb20aab6bbb9aa3b7d953db6984949f7336668c9429fa86d.exe"
1⤵
- Maps connected drives based on registry
PID:1540

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1540-130-0x0000000000400000-0x0000000000748000-memory.dmp

Download