saintbot | 4715a5009de403edd2dd480cf5c78531ee937381f2e69e0fb265b2e9f81f15c4

Analysis

max time kernel
112s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10-04-2024 10:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4715a5009de403edd2dd480cf5c78531ee937381f2e69e0fb265b2e9f81f15c4.exe
Size

493KB
MD5

eb332fd9cc8be8e6a60d4ff9c5f5fcf7
SHA1

e18df098c2fcb6a3961c310fdde58106e07ef9c0
SHA256

4715a5009de403edd2dd480cf5c78531ee937381f2e69e0fb265b2e9f81f15c4
SHA512

6557930a1f572627d378a38137ceb852221f9363e881cfe09396c8a0bdb181834b269d9594b30404c77b79f91b73348fe0dbab99263d29821fa2ce432108d3c7
SSDEEP

12288:BuhtvdReEyemChwq/AIIS+EtqgqgPxrbjitolNHISFjZ:obPAIIS+3N

Score

10^/10

saintbot discovery dropper persistence

Malware Config

Signatures

SaintBot
Saint Bot is a malware dropper being used to deliver secondary payloads such as information stealers.
dropper saintbot

SaintBot payload 7 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2632-11-0x0000000000400000-0x000000000040C000-memory.dmp	family_saintbot
behavioral2/memory/2632-13-0x0000000000400000-0x000000000040C000-memory.dmp	family_saintbot
behavioral2/memory/2632-32-0x0000000000400000-0x000000000040C000-memory.dmp	family_saintbot
behavioral2/memory/2868-46-0x0000000000400000-0x000000000040C000-memory.dmp	family_saintbot
behavioral2/memory/4872-47-0x0000000000890000-0x000000000089C000-memory.dmp	family_saintbot
behavioral2/memory/4872-49-0x0000000000890000-0x000000000089C000-memory.dmp	family_saintbot
behavioral2/memory/4872-50-0x0000000000890000-0x000000000089C000-memory.dmp	family_saintbot

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

4715a5009de403edd2dd480cf5c78531ee937381f2e69e0fb265b2e9f81f15c4.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation	4715a5009de403edd2dd480cf5c78531ee937381f2e69e0fb265b2e9f81f15c4.exe

Drops startup file 2 IoCs

Processes:

4715a5009de403edd2dd480cf5c78531ee937381f2e69e0fb265b2e9f81f15c4.exe9012.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9012.exe	4715a5009de403edd2dd480cf5c78531ee937381f2e69e0fb265b2e9f81f15c4.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9012.exe	9012.exe

Executes dropped EXE 2 IoCs

Processes:

9012.exe9012.exe

pid process

2428 9012.exe
2868 9012.exe
Loads dropped DLL 2 IoCs

Processes:

9012.exeEhStorAuthn.exe

pid process

2868 9012.exe
4872 EhStorAuthn.exe

pid	process
2428	9012.exe
2868	9012.exe

pid	process
2868	9012.exe
4872	EhStorAuthn.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

EhStorAuthn.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\z_Admin\\Admin.vbs"	EhStorAuthn.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Maps connected drives based on registry 3 TTPs 6 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

4715a5009de403edd2dd480cf5c78531ee937381f2e69e0fb265b2e9f81f15c4.exe9012.exeEhStorAuthn.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	4715a5009de403edd2dd480cf5c78531ee937381f2e69e0fb265b2e9f81f15c4.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	4715a5009de403edd2dd480cf5c78531ee937381f2e69e0fb265b2e9f81f15c4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	9012.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	9012.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	EhStorAuthn.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	EhStorAuthn.exe

Drops file in System32 directory 1 IoCs

Processes:

EhStorAuthn.exe

description ioc process

File opened for modification C:\Windows\SysWOW64\EhStorAuthn.exe EhStorAuthn.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\EhStorAuthn.exe	EhStorAuthn.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

4715a5009de403edd2dd480cf5c78531ee937381f2e69e0fb265b2e9f81f15c4.exe9012.exe

description	pid	process	target process
PID 2896 set thread context of 2632	2896	4715a5009de403edd2dd480cf5c78531ee937381f2e69e0fb265b2e9f81f15c4.exe	4715a5009de403edd2dd480cf5c78531ee937381f2e69e0fb265b2e9f81f15c4.exe
PID 2428 set thread context of 2868	2428	9012.exe	9012.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EhStorAuthn.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	EhStorAuthn.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EhStorAuthn.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

3084 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

EhStorAuthn.exe

description pid process

Token: SeDebugPrivilege 4872 EhStorAuthn.exe

pid	process
3084	PING.EXE

description	pid	process
Token: SeDebugPrivilege	4872	EhStorAuthn.exe

Suspicious use of WriteProcessMemory 36 IoCs

Processes:

4715a5009de403edd2dd480cf5c78531ee937381f2e69e0fb265b2e9f81f15c4.exe4715a5009de403edd2dd480cf5c78531ee937381f2e69e0fb265b2e9f81f15c4.execmd.exe9012.exe9012.exe

description	pid	process	target process
PID 2896 wrote to memory of 2632	2896	4715a5009de403edd2dd480cf5c78531ee937381f2e69e0fb265b2e9f81f15c4.exe	4715a5009de403edd2dd480cf5c78531ee937381f2e69e0fb265b2e9f81f15c4.exe
PID 2896 wrote to memory of 2632	2896	4715a5009de403edd2dd480cf5c78531ee937381f2e69e0fb265b2e9f81f15c4.exe	4715a5009de403edd2dd480cf5c78531ee937381f2e69e0fb265b2e9f81f15c4.exe
PID 2896 wrote to memory of 2632	2896	4715a5009de403edd2dd480cf5c78531ee937381f2e69e0fb265b2e9f81f15c4.exe	4715a5009de403edd2dd480cf5c78531ee937381f2e69e0fb265b2e9f81f15c4.exe
PID 2896 wrote to memory of 2632	2896	4715a5009de403edd2dd480cf5c78531ee937381f2e69e0fb265b2e9f81f15c4.exe	4715a5009de403edd2dd480cf5c78531ee937381f2e69e0fb265b2e9f81f15c4.exe
PID 2896 wrote to memory of 2632	2896	4715a5009de403edd2dd480cf5c78531ee937381f2e69e0fb265b2e9f81f15c4.exe	4715a5009de403edd2dd480cf5c78531ee937381f2e69e0fb265b2e9f81f15c4.exe
PID 2896 wrote to memory of 2632	2896	4715a5009de403edd2dd480cf5c78531ee937381f2e69e0fb265b2e9f81f15c4.exe	4715a5009de403edd2dd480cf5c78531ee937381f2e69e0fb265b2e9f81f15c4.exe
PID 2896 wrote to memory of 2632	2896	4715a5009de403edd2dd480cf5c78531ee937381f2e69e0fb265b2e9f81f15c4.exe	4715a5009de403edd2dd480cf5c78531ee937381f2e69e0fb265b2e9f81f15c4.exe
PID 2896 wrote to memory of 2632	2896	4715a5009de403edd2dd480cf5c78531ee937381f2e69e0fb265b2e9f81f15c4.exe	4715a5009de403edd2dd480cf5c78531ee937381f2e69e0fb265b2e9f81f15c4.exe
PID 2896 wrote to memory of 2632	2896	4715a5009de403edd2dd480cf5c78531ee937381f2e69e0fb265b2e9f81f15c4.exe	4715a5009de403edd2dd480cf5c78531ee937381f2e69e0fb265b2e9f81f15c4.exe
PID 2896 wrote to memory of 2632	2896	4715a5009de403edd2dd480cf5c78531ee937381f2e69e0fb265b2e9f81f15c4.exe	4715a5009de403edd2dd480cf5c78531ee937381f2e69e0fb265b2e9f81f15c4.exe
PID 2632 wrote to memory of 2428	2632	4715a5009de403edd2dd480cf5c78531ee937381f2e69e0fb265b2e9f81f15c4.exe	9012.exe
PID 2632 wrote to memory of 2428	2632	4715a5009de403edd2dd480cf5c78531ee937381f2e69e0fb265b2e9f81f15c4.exe	9012.exe
PID 2632 wrote to memory of 2428	2632	4715a5009de403edd2dd480cf5c78531ee937381f2e69e0fb265b2e9f81f15c4.exe	9012.exe
PID 2632 wrote to memory of 4460	2632	4715a5009de403edd2dd480cf5c78531ee937381f2e69e0fb265b2e9f81f15c4.exe	cmd.exe
PID 2632 wrote to memory of 4460	2632	4715a5009de403edd2dd480cf5c78531ee937381f2e69e0fb265b2e9f81f15c4.exe	cmd.exe
PID 2632 wrote to memory of 4460	2632	4715a5009de403edd2dd480cf5c78531ee937381f2e69e0fb265b2e9f81f15c4.exe	cmd.exe
PID 4460 wrote to memory of 3084	4460	cmd.exe	PING.EXE
PID 4460 wrote to memory of 3084	4460	cmd.exe	PING.EXE
PID 4460 wrote to memory of 3084	4460	cmd.exe	PING.EXE
PID 4460 wrote to memory of 460	4460	cmd.exe	cmd.exe
PID 4460 wrote to memory of 460	4460	cmd.exe	cmd.exe
PID 4460 wrote to memory of 460	4460	cmd.exe	cmd.exe
PID 2428 wrote to memory of 2868	2428	9012.exe	9012.exe
PID 2428 wrote to memory of 2868	2428	9012.exe	9012.exe
PID 2428 wrote to memory of 2868	2428	9012.exe	9012.exe
PID 2428 wrote to memory of 2868	2428	9012.exe	9012.exe
PID 2428 wrote to memory of 2868	2428	9012.exe	9012.exe
PID 2428 wrote to memory of 2868	2428	9012.exe	9012.exe
PID 2428 wrote to memory of 2868	2428	9012.exe	9012.exe
PID 2428 wrote to memory of 2868	2428	9012.exe	9012.exe
PID 2428 wrote to memory of 2868	2428	9012.exe	9012.exe
PID 2428 wrote to memory of 2868	2428	9012.exe	9012.exe
PID 2868 wrote to memory of 4872	2868	9012.exe	EhStorAuthn.exe
PID 2868 wrote to memory of 4872	2868	9012.exe	EhStorAuthn.exe
PID 2868 wrote to memory of 4872	2868	9012.exe	EhStorAuthn.exe
PID 2868 wrote to memory of 4872	2868	9012.exe	EhStorAuthn.exe

C:\Users\Admin\AppData\Local\Temp\4715a5009de403edd2dd480cf5c78531ee937381f2e69e0fb265b2e9f81f15c4.exe
"C:\Users\Admin\AppData\Local\Temp\4715a5009de403edd2dd480cf5c78531ee937381f2e69e0fb265b2e9f81f15c4.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Users\Admin\AppData\Local\Temp\4715a5009de403edd2dd480cf5c78531ee937381f2e69e0fb265b2e9f81f15c4.exe
  "{path}"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Maps connected drives based on registry
  - Suspicious use of WriteProcessMemory
  PID:2632
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9012.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9012.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2428
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9012.exe
      "{path}"
      4⤵
      Drops startup file
      Executes dropped EXE
      Loads dropped DLL
      Maps connected drives based on registry
      Suspicious use of WriteProcessMemory
      PID:2868
    - - C:\Windows\SysWOW64\EhStorAuthn.exe
        
        "C:\Windows\System32\EhStorAuthn.exe"
        5⤵
        Loads dropped DLL
        Adds Run key to start application
        Maps connected drives based on registry
        Drops file in System32 directory
        Checks processor information in registry
        Suspicious use of AdjustPrivilegeToken
        
        PID:4872
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\del.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4460
  - - C:\Windows\SysWOW64\PING.EXE
      ping localhost -n 3
      4⤵
      Runs ping.exe
      PID:3084
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c del "C:\Users\Admin\AppData\Roaming\del.bat"
      4⤵
      PID:460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\z_Admin\wallpaper.mp4

Filesize
1.6MB

MD5
4f3387277ccbd6d1f21ac5c07fe4ca68

SHA1
e16506f662dc92023bf82def1d621497c8ab5890

SHA256
767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac

SHA512
9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9012.exe

Filesize
493KB

MD5
eb332fd9cc8be8e6a60d4ff9c5f5fcf7

SHA1
e18df098c2fcb6a3961c310fdde58106e07ef9c0

SHA256
4715a5009de403edd2dd480cf5c78531ee937381f2e69e0fb265b2e9f81f15c4

SHA512
6557930a1f572627d378a38137ceb852221f9363e881cfe09396c8a0bdb181834b269d9594b30404c77b79f91b73348fe0dbab99263d29821fa2ce432108d3c7

Download Submit
C:\Users\Admin\AppData\Roaming\del.bat

Filesize
170B

MD5
bfd4d8bcab71dfa29b59ecc31861e739

SHA1
d42222f08a02303cb2c699c3b0014abb5d114eb4

SHA256
09f71f806aea4c278a18147e4ae1a117b1732b5dfe0e07c0dadad558a305d568

SHA512
c1e777986f540efa401092fb3fde9c2e50743d68da2ee547beb6250537e24ae475a4c0bf68c52bfd3bd422cfb6d0d524758885e73a340eb4d84e3e5fafaeb7a6

Download Submit
memory/2428-43-0x0000000073C30000-0x00000000743E0000-memory.dmp

Filesize
7.7MB

Download
memory/2428-37-0x0000000007A50000-0x0000000007A60000-memory.dmp

Filesize
64KB

Download
memory/2428-36-0x0000000073C30000-0x00000000743E0000-memory.dmp

Filesize
7.7MB

Download
memory/2428-35-0x0000000007A50000-0x0000000007A60000-memory.dmp

Filesize
64KB

Download
memory/2428-33-0x0000000073C30000-0x00000000743E0000-memory.dmp

Filesize
7.7MB

Download
memory/2632-13-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2632-32-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2632-11-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2868-46-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2896-6-0x0000000008DF0000-0x0000000008E8C000-memory.dmp

Filesize
624KB

Download
memory/2896-4-0x0000000007CB0000-0x0000000007CC0000-memory.dmp

Filesize
64KB

Download
memory/2896-8-0x0000000074F20000-0x00000000756D0000-memory.dmp

Filesize
7.7MB

Download
memory/2896-0-0x0000000074F20000-0x00000000756D0000-memory.dmp

Filesize
7.7MB

Download
memory/2896-7-0x0000000007C70000-0x0000000007C82000-memory.dmp

Filesize
72KB

Download
memory/2896-9-0x0000000007CB0000-0x0000000007CC0000-memory.dmp

Filesize
64KB

Download
memory/2896-5-0x0000000007AD0000-0x0000000007ADA000-memory.dmp

Filesize
40KB

Download
memory/2896-15-0x0000000074F20000-0x00000000756D0000-memory.dmp

Filesize
7.7MB

Download
memory/2896-3-0x0000000007B30000-0x0000000007BC2000-memory.dmp

Filesize
584KB

Download
memory/2896-2-0x0000000008040000-0x00000000085E4000-memory.dmp

Filesize
5.6MB

Download
memory/2896-1-0x0000000000CB0000-0x0000000000D30000-memory.dmp

Filesize
512KB

Download
memory/2896-10-0x000000000A4E0000-0x000000000A51E000-memory.dmp

Filesize
248KB

Download
memory/4872-47-0x0000000000890000-0x000000000089C000-memory.dmp

Filesize
48KB

Download
memory/4872-49-0x0000000000890000-0x000000000089C000-memory.dmp

Filesize
48KB

Download
memory/4872-50-0x0000000000890000-0x000000000089C000-memory.dmp

Filesize
48KB

Download