saintbot | 1e6596320a3fa48d8c13609a66e639b35fb1e9caae378552956aa9659809162b

General

Target

1e6596320a3fa48d8c13609a66e639b35fb1e9caae378552956aa9659809162b.exe
Size

1.5MB
MD5

13ea6a80588a9eeea6b919a4f104a7de
SHA1

7e79e0459e7aa0fa54bd5a2e5e79b6c0587f2334
SHA256

1e6596320a3fa48d8c13609a66e639b35fb1e9caae378552956aa9659809162b
SHA512

a3c212e76c7dc8328ea501abba5f76cf01c52b3bc7a60b7ec2eeff2af83537defbde1cecc22b6618b70390f81b46a47a4e5a10cea734d1e7d5cbb5db46613e73
SSDEEP

24576:PRfrBt/w6kIzuGIwlweXNivgGqG0ronl7Nti7VclubgkL:PRc6yGfweXNivgVp0nl7/mVc4s2

Score

10^/10

saintbot agilenet discovery dropper

Malware Config

Signatures

SaintBot
Saint Bot is a malware dropper being used to deliver secondary payloads such as information stealers.
dropper saintbot

SaintBot payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4928-15-0x0000000000400000-0x000000000040B000-memory.dmp	family_saintbot
behavioral2/memory/4928-34-0x0000000000400000-0x000000000040B000-memory.dmp	family_saintbot

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

1e6596320a3fa48d8c13609a66e639b35fb1e9caae378552956aa9659809162b.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	1e6596320a3fa48d8c13609a66e639b35fb1e9caae378552956aa9659809162b.exe

Drops startup file 1 IoCs

Processes:

1e6596320a3fa48d8c13609a66e639b35fb1e9caae378552956aa9659809162b.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\17743.exe	1e6596320a3fa48d8c13609a66e639b35fb1e9caae378552956aa9659809162b.exe

Executes dropped EXE 1 IoCs

Processes:

17743.exe

pid process

1348 17743.exe

pid	process
1348	17743.exe

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Processes:

resource	yara_rule
behavioral2/memory/1428-8-0x0000000006F20000-0x0000000006F48000-memory.dmp	agile_net

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

1e6596320a3fa48d8c13609a66e639b35fb1e9caae378552956aa9659809162b.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	1e6596320a3fa48d8c13609a66e639b35fb1e9caae378552956aa9659809162b.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\start /b "" cmd /c del "%~f0"&exit /b	1e6596320a3fa48d8c13609a66e639b35fb1e9caae378552956aa9659809162b.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

1e6596320a3fa48d8c13609a66e639b35fb1e9caae378552956aa9659809162b.exe

description	pid	process	target process
PID 1428 set thread context of 4928	1428	1e6596320a3fa48d8c13609a66e639b35fb1e9caae378552956aa9659809162b.exe	1e6596320a3fa48d8c13609a66e639b35fb1e9caae378552956aa9659809162b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1968 PING.EXE

pid	process
1968	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

1e6596320a3fa48d8c13609a66e639b35fb1e9caae378552956aa9659809162b.exe17743.exe

pid	process
1428	1e6596320a3fa48d8c13609a66e639b35fb1e9caae378552956aa9659809162b.exe
1428	1e6596320a3fa48d8c13609a66e639b35fb1e9caae378552956aa9659809162b.exe
1348	17743.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

1e6596320a3fa48d8c13609a66e639b35fb1e9caae378552956aa9659809162b.exe17743.exe

description	pid	process
Token: SeDebugPrivilege	1428	1e6596320a3fa48d8c13609a66e639b35fb1e9caae378552956aa9659809162b.exe
Token: SeDebugPrivilege	1348	17743.exe

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

1e6596320a3fa48d8c13609a66e639b35fb1e9caae378552956aa9659809162b.exe1e6596320a3fa48d8c13609a66e639b35fb1e9caae378552956aa9659809162b.execmd.exe

description	pid	process	target process
PID 1428 wrote to memory of 4928	1428	1e6596320a3fa48d8c13609a66e639b35fb1e9caae378552956aa9659809162b.exe	1e6596320a3fa48d8c13609a66e639b35fb1e9caae378552956aa9659809162b.exe
PID 1428 wrote to memory of 4928	1428	1e6596320a3fa48d8c13609a66e639b35fb1e9caae378552956aa9659809162b.exe	1e6596320a3fa48d8c13609a66e639b35fb1e9caae378552956aa9659809162b.exe
PID 1428 wrote to memory of 4928	1428	1e6596320a3fa48d8c13609a66e639b35fb1e9caae378552956aa9659809162b.exe	1e6596320a3fa48d8c13609a66e639b35fb1e9caae378552956aa9659809162b.exe
PID 1428 wrote to memory of 4928	1428	1e6596320a3fa48d8c13609a66e639b35fb1e9caae378552956aa9659809162b.exe	1e6596320a3fa48d8c13609a66e639b35fb1e9caae378552956aa9659809162b.exe
PID 1428 wrote to memory of 4928	1428	1e6596320a3fa48d8c13609a66e639b35fb1e9caae378552956aa9659809162b.exe	1e6596320a3fa48d8c13609a66e639b35fb1e9caae378552956aa9659809162b.exe
PID 1428 wrote to memory of 4928	1428	1e6596320a3fa48d8c13609a66e639b35fb1e9caae378552956aa9659809162b.exe	1e6596320a3fa48d8c13609a66e639b35fb1e9caae378552956aa9659809162b.exe
PID 1428 wrote to memory of 4928	1428	1e6596320a3fa48d8c13609a66e639b35fb1e9caae378552956aa9659809162b.exe	1e6596320a3fa48d8c13609a66e639b35fb1e9caae378552956aa9659809162b.exe
PID 1428 wrote to memory of 4928	1428	1e6596320a3fa48d8c13609a66e639b35fb1e9caae378552956aa9659809162b.exe	1e6596320a3fa48d8c13609a66e639b35fb1e9caae378552956aa9659809162b.exe
PID 1428 wrote to memory of 4928	1428	1e6596320a3fa48d8c13609a66e639b35fb1e9caae378552956aa9659809162b.exe	1e6596320a3fa48d8c13609a66e639b35fb1e9caae378552956aa9659809162b.exe
PID 1428 wrote to memory of 4928	1428	1e6596320a3fa48d8c13609a66e639b35fb1e9caae378552956aa9659809162b.exe	1e6596320a3fa48d8c13609a66e639b35fb1e9caae378552956aa9659809162b.exe
PID 4928 wrote to memory of 1348	4928	1e6596320a3fa48d8c13609a66e639b35fb1e9caae378552956aa9659809162b.exe	17743.exe
PID 4928 wrote to memory of 1348	4928	1e6596320a3fa48d8c13609a66e639b35fb1e9caae378552956aa9659809162b.exe	17743.exe
PID 4928 wrote to memory of 1348	4928	1e6596320a3fa48d8c13609a66e639b35fb1e9caae378552956aa9659809162b.exe	17743.exe
PID 4928 wrote to memory of 764	4928	1e6596320a3fa48d8c13609a66e639b35fb1e9caae378552956aa9659809162b.exe	cmd.exe
PID 4928 wrote to memory of 764	4928	1e6596320a3fa48d8c13609a66e639b35fb1e9caae378552956aa9659809162b.exe	cmd.exe
PID 4928 wrote to memory of 764	4928	1e6596320a3fa48d8c13609a66e639b35fb1e9caae378552956aa9659809162b.exe	cmd.exe
PID 764 wrote to memory of 1968	764	cmd.exe	PING.EXE
PID 764 wrote to memory of 1968	764	cmd.exe	PING.EXE
PID 764 wrote to memory of 1968	764	cmd.exe	PING.EXE
PID 764 wrote to memory of 3288	764	cmd.exe	cmd.exe
PID 764 wrote to memory of 3288	764	cmd.exe	cmd.exe
PID 764 wrote to memory of 3288	764	cmd.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\1e6596320a3fa48d8c13609a66e639b35fb1e9caae378552956aa9659809162b.exe
"C:\Users\Admin\AppData\Local\Temp\1e6596320a3fa48d8c13609a66e639b35fb1e9caae378552956aa9659809162b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1428
- C:\Users\Admin\AppData\Local\Temp\1e6596320a3fa48d8c13609a66e639b35fb1e9caae378552956aa9659809162b.exe
  "C:\Users\Admin\AppData\Local\Temp\1e6596320a3fa48d8c13609a66e639b35fb1e9caae378552956aa9659809162b.exe"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Maps connected drives based on registry
  - Suspicious use of WriteProcessMemory
  PID:4928
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\17743.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\17743.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1348
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\del.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:764
  - - C:\Windows\SysWOW64\PING.EXE
      ping localhost -n 3
      4⤵
      Runs ping.exe
      PID:1968
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c del "C:\Users\Admin\AppData\Roaming\del.bat"
      4⤵
      PID:3288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

Remote System Discovery

1

T1018

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\17743.exe

Filesize
1.5MB

MD5
13ea6a80588a9eeea6b919a4f104a7de

SHA1
7e79e0459e7aa0fa54bd5a2e5e79b6c0587f2334

SHA256
1e6596320a3fa48d8c13609a66e639b35fb1e9caae378552956aa9659809162b

SHA512
a3c212e76c7dc8328ea501abba5f76cf01c52b3bc7a60b7ec2eeff2af83537defbde1cecc22b6618b70390f81b46a47a4e5a10cea734d1e7d5cbb5db46613e73

Download Submit
C:\Users\Admin\AppData\Roaming\del.bat

Filesize
169B

MD5
441825bd87d8ee749c2f4aa9c24e3306

SHA1
b1a8d72b95ec14cf8c680d7440e373f4c6ca81c7

SHA256
bca1724f68c5355850de114b9313ee195d8f72fd2a36e70e4e515e19594db5a1

SHA512
1980e5e8b36668ad19ebeedfac322d97ce9f1acba00eef92072ab6d68af9fc817f276acbd1d60d75a696264427b34de41fb57da2085ed1af2eac369cf8a7c8da

Download Submit
memory/1348-40-0x0000000073B60000-0x0000000074310000-memory.dmp

Filesize
7.7MB

Download
memory/1348-38-0x00000000054F0000-0x0000000005500000-memory.dmp

Filesize
64KB

Download
memory/1348-37-0x0000000005600000-0x0000000005954000-memory.dmp

Filesize
3.3MB

Download
memory/1348-35-0x0000000073B60000-0x0000000074310000-memory.dmp

Filesize
7.7MB

Download
memory/1428-12-0x0000000007210000-0x0000000007224000-memory.dmp

Filesize
80KB

Download
memory/1428-5-0x0000000005FB0000-0x0000000006156000-memory.dmp

Filesize
1.6MB

Download
memory/1428-8-0x0000000006F20000-0x0000000006F48000-memory.dmp

Filesize
160KB

Download
memory/1428-9-0x0000000006FD0000-0x0000000007036000-memory.dmp

Filesize
408KB

Download
memory/1428-10-0x0000000006FA0000-0x0000000006FC2000-memory.dmp

Filesize
136KB

Download
memory/1428-11-0x0000000005DF0000-0x0000000005E00000-memory.dmp

Filesize
64KB

Download
memory/1428-0-0x0000000074660000-0x0000000074E10000-memory.dmp

Filesize
7.7MB

Download
memory/1428-13-0x0000000007220000-0x0000000007226000-memory.dmp

Filesize
24KB

Download
memory/1428-1-0x0000000000670000-0x00000000007EA000-memory.dmp

Filesize
1.5MB

Download
memory/1428-2-0x0000000005710000-0x0000000005CB4000-memory.dmp

Filesize
5.6MB

Download
memory/1428-21-0x0000000074660000-0x0000000074E10000-memory.dmp

Filesize
7.7MB

Download
memory/1428-6-0x0000000005CC0000-0x0000000005D5C000-memory.dmp

Filesize
624KB

Download
memory/1428-3-0x0000000005200000-0x0000000005292000-memory.dmp

Filesize
584KB

Download
memory/1428-7-0x0000000005DF0000-0x0000000005E00000-memory.dmp

Filesize
64KB

Download
memory/1428-4-0x00000000052A0000-0x00000000055F4000-memory.dmp

Filesize
3.3MB

Download
memory/4928-34-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4928-15-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4928-14-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads