saintbot | 4715a5009de403edd2dd480cf5c78531ee937381f2e69e0fb265b2e9f81f15c4

General

Target

4715a5009de403edd2dd480cf5c78531ee937381f2e69e0fb265b2e9f81f15c4.exe
Size

493KB
MD5

eb332fd9cc8be8e6a60d4ff9c5f5fcf7
SHA1

e18df098c2fcb6a3961c310fdde58106e07ef9c0
SHA256

4715a5009de403edd2dd480cf5c78531ee937381f2e69e0fb265b2e9f81f15c4
SHA512

6557930a1f572627d378a38137ceb852221f9363e881cfe09396c8a0bdb181834b269d9594b30404c77b79f91b73348fe0dbab99263d29821fa2ce432108d3c7
SSDEEP

12288:BuhtvdReEyemChwq/AIIS+EtqgqgPxrbjitolNHISFjZ:obPAIIS+3N

Score

10^/10

saintbot dropper

Malware Config

Signatures

SaintBot
Saint Bot is a malware dropper being used to deliver secondary payloads such as information stealers.
dropper saintbot

SaintBot payload 5 IoCs

resource	yara_rule
behavioral1/memory/2508-11-0x0000000000400000-0x000000000040C000-memory.dmp	family_saintbot
behavioral1/memory/2508-12-0x0000000000400000-0x000000000040C000-memory.dmp	family_saintbot
behavioral1/memory/2508-13-0x0000000000400000-0x000000000040C000-memory.dmp	family_saintbot
behavioral1/memory/2508-16-0x0000000000400000-0x000000000040C000-memory.dmp	family_saintbot
behavioral1/memory/2508-18-0x0000000000400000-0x000000000040C000-memory.dmp	family_saintbot

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2840 set thread context of 2508	2840	4715a5009de403edd2dd480cf5c78531ee937381f2e69e0fb265b2e9f81f15c4.exe	30

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2436	2508	WerFault.exe	30

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2840	4715a5009de403edd2dd480cf5c78531ee937381f2e69e0fb265b2e9f81f15c4.exe
2840	4715a5009de403edd2dd480cf5c78531ee937381f2e69e0fb265b2e9f81f15c4.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2840	4715a5009de403edd2dd480cf5c78531ee937381f2e69e0fb265b2e9f81f15c4.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 2840 wrote to memory of 2548	2840	4715a5009de403edd2dd480cf5c78531ee937381f2e69e0fb265b2e9f81f15c4.exe	28
PID 2840 wrote to memory of 2548	2840	4715a5009de403edd2dd480cf5c78531ee937381f2e69e0fb265b2e9f81f15c4.exe	28
PID 2840 wrote to memory of 2548	2840	4715a5009de403edd2dd480cf5c78531ee937381f2e69e0fb265b2e9f81f15c4.exe	28
PID 2840 wrote to memory of 2548	2840	4715a5009de403edd2dd480cf5c78531ee937381f2e69e0fb265b2e9f81f15c4.exe	28
PID 2840 wrote to memory of 2524	2840	4715a5009de403edd2dd480cf5c78531ee937381f2e69e0fb265b2e9f81f15c4.exe	29
PID 2840 wrote to memory of 2524	2840	4715a5009de403edd2dd480cf5c78531ee937381f2e69e0fb265b2e9f81f15c4.exe	29
PID 2840 wrote to memory of 2524	2840	4715a5009de403edd2dd480cf5c78531ee937381f2e69e0fb265b2e9f81f15c4.exe	29
PID 2840 wrote to memory of 2524	2840	4715a5009de403edd2dd480cf5c78531ee937381f2e69e0fb265b2e9f81f15c4.exe	29
PID 2840 wrote to memory of 2508	2840	4715a5009de403edd2dd480cf5c78531ee937381f2e69e0fb265b2e9f81f15c4.exe	30
PID 2840 wrote to memory of 2508	2840	4715a5009de403edd2dd480cf5c78531ee937381f2e69e0fb265b2e9f81f15c4.exe	30
PID 2840 wrote to memory of 2508	2840	4715a5009de403edd2dd480cf5c78531ee937381f2e69e0fb265b2e9f81f15c4.exe	30
PID 2840 wrote to memory of 2508	2840	4715a5009de403edd2dd480cf5c78531ee937381f2e69e0fb265b2e9f81f15c4.exe	30
PID 2840 wrote to memory of 2508	2840	4715a5009de403edd2dd480cf5c78531ee937381f2e69e0fb265b2e9f81f15c4.exe	30
PID 2840 wrote to memory of 2508	2840	4715a5009de403edd2dd480cf5c78531ee937381f2e69e0fb265b2e9f81f15c4.exe	30
PID 2840 wrote to memory of 2508	2840	4715a5009de403edd2dd480cf5c78531ee937381f2e69e0fb265b2e9f81f15c4.exe	30
PID 2840 wrote to memory of 2508	2840	4715a5009de403edd2dd480cf5c78531ee937381f2e69e0fb265b2e9f81f15c4.exe	30
PID 2840 wrote to memory of 2508	2840	4715a5009de403edd2dd480cf5c78531ee937381f2e69e0fb265b2e9f81f15c4.exe	30
PID 2840 wrote to memory of 2508	2840	4715a5009de403edd2dd480cf5c78531ee937381f2e69e0fb265b2e9f81f15c4.exe	30
PID 2840 wrote to memory of 2508	2840	4715a5009de403edd2dd480cf5c78531ee937381f2e69e0fb265b2e9f81f15c4.exe	30
PID 2508 wrote to memory of 2436	2508	4715a5009de403edd2dd480cf5c78531ee937381f2e69e0fb265b2e9f81f15c4.exe	31
PID 2508 wrote to memory of 2436	2508	4715a5009de403edd2dd480cf5c78531ee937381f2e69e0fb265b2e9f81f15c4.exe	31
PID 2508 wrote to memory of 2436	2508	4715a5009de403edd2dd480cf5c78531ee937381f2e69e0fb265b2e9f81f15c4.exe	31
PID 2508 wrote to memory of 2436	2508	4715a5009de403edd2dd480cf5c78531ee937381f2e69e0fb265b2e9f81f15c4.exe	31

C:\Users\Admin\AppData\Local\Temp\4715a5009de403edd2dd480cf5c78531ee937381f2e69e0fb265b2e9f81f15c4.exe
"C:\Users\Admin\AppData\Local\Temp\4715a5009de403edd2dd480cf5c78531ee937381f2e69e0fb265b2e9f81f15c4.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2840
- C:\Users\Admin\AppData\Local\Temp\4715a5009de403edd2dd480cf5c78531ee937381f2e69e0fb265b2e9f81f15c4.exe
  "{path}"
  2⤵
  PID:2548
- C:\Users\Admin\AppData\Local\Temp\4715a5009de403edd2dd480cf5c78531ee937381f2e69e0fb265b2e9f81f15c4.exe
  "{path}"
  2⤵
  PID:2524
- C:\Users\Admin\AppData\Local\Temp\4715a5009de403edd2dd480cf5c78531ee937381f2e69e0fb265b2e9f81f15c4.exe
  "{path}"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2508
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2508 -s 88
    3⤵
    - Program crash
    PID:2436

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2508-13-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2508-7-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2508-9-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2508-18-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2508-10-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2508-16-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2508-14-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2508-11-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2508-12-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2840-5-0x0000000004A30000-0x0000000004A70000-memory.dmp

Filesize
256KB

Download
memory/2840-4-0x00000000745F0000-0x0000000074CDE000-memory.dmp

Filesize
6.9MB

Download
memory/2840-2-0x0000000004A30000-0x0000000004A70000-memory.dmp

Filesize
256KB

Download
memory/2840-1-0x00000000745F0000-0x0000000074CDE000-memory.dmp

Filesize
6.9MB

Download
memory/2840-6-0x00000000020E0000-0x000000000211E000-memory.dmp

Filesize
248KB

Download
memory/2840-0-0x00000000001C0000-0x0000000000240000-memory.dmp

Filesize
512KB

Download
memory/2840-3-0x0000000000410000-0x0000000000422000-memory.dmp

Filesize
72KB

Download
memory/2840-19-0x00000000745F0000-0x0000000074CDE000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing