Overview

overview

10

Static

static

3

e0c46e23bd...a2.exe

windows7-x64

10

e0c46e23bd...a2.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e0c46e23bd1b5b96123e0c64914484bbfae7a7ad13cbd45184035d4c0f8a10a2

  • Size

    224KB

  • Sample

    240410-rwmk6sbc57

  • MD5

    e65e7ca60642f80fe2a95823247f8726

  • SHA1

    fc0700076fd443edb24777e4ee7eed802411fd70

  • SHA256

    e0c46e23bd1b5b96123e0c64914484bbfae7a7ad13cbd45184035d4c0f8a10a2

  • SHA512

    ddbeb67894fa3b847dbaf34d3e2fce5d383baabd6cfef9c1a2ec15ebe59ae922f9cbd711f83acddd05455919bc462863cc0e52bd1982195260487e45ef198f1a

  • SSDEEP

    3072:rDXO3PV+Al8gnrlowLLjY/LWxJi9G4d4As3duOs5n53qN6Z5YR2Ot:oV+AltnrawLLWWQG4d4NF3N6EHt

Score
10/10
saintbotdiscoverydropperpersistence

Malware Config

Targets

    • Target

      e0c46e23bd1b5b96123e0c64914484bbfae7a7ad13cbd45184035d4c0f8a10a2

    • Size

      224KB

    • MD5

      e65e7ca60642f80fe2a95823247f8726

    • SHA1

      fc0700076fd443edb24777e4ee7eed802411fd70

    • SHA256

      e0c46e23bd1b5b96123e0c64914484bbfae7a7ad13cbd45184035d4c0f8a10a2

    • SHA512

      ddbeb67894fa3b847dbaf34d3e2fce5d383baabd6cfef9c1a2ec15ebe59ae922f9cbd711f83acddd05455919bc462863cc0e52bd1982195260487e45ef198f1a

    • SSDEEP

      3072:rDXO3PV+Al8gnrlowLLjY/LWxJi9G4d4As3duOs5n53qN6Z5YR2Ot:oV+AltnrawLLWWQG4d4NF3N6EHt

    Score
    10/10
    saintbotdiscoverydropperpersistence

    • SaintBot

      Saint Bot is a malware dropper being used to deliver secondary payloads such as information stealers.

      droppersaintbot

    • SaintBot payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

4
T1012

System Information Discovery

4
T1082

Peripheral Device Discovery

1
T1120

Remote System Discovery

1
T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks