saintbot | a4b705baac8bb2c0d2bc111eae9735fb8586d6d1dab050f3c89fb12589470969

Analysis

max time kernel
293s
max time network
210s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
13/06/2024, 18:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a4b705baac8bb2c0d2bc111eae9735fb8586d6d1dab050f3c89fb12589470969.exe
Size

29KB
MD5

d2efb0b8b82576016416aacbde6c3873
SHA1

19cac454edb76d7e879598d8c7e8e032f9d006d2
SHA256

a4b705baac8bb2c0d2bc111eae9735fb8586d6d1dab050f3c89fb12589470969
SHA512

e05172a8e7b0988ecfd85833177727262448bc9730dd0b33bae2b311d95336a97399824635f2ef4a6374fe04eb46f3739f4a6cce4a46b0c04df88a915d5b2c94
SSDEEP

768:HOMiz6RkiNkf8DnpdGMXMmCp3gzr9b3j3zIXwrn:smCiE89dGM6pwzFF

Score

10^/10

saintbot discovery dropper

Malware Config

Signatures

SaintBot
Saint Bot is a malware dropper being used to deliver secondary payloads such as information stealers.
dropper saintbot

SaintBot payload 4 IoCs

resource	yara_rule
behavioral1/files/0x0012000000015c83-5.dat	family_saintbot
behavioral1/memory/2772-20-0x0000000000080000-0x000000000008C000-memory.dmp	family_saintbot
behavioral1/memory/2772-22-0x0000000000080000-0x000000000008C000-memory.dmp	family_saintbot
behavioral1/memory/2772-23-0x0000000000080000-0x000000000008C000-memory.dmp	family_saintbot

Deletes itself 1 IoCs

pid	Process
2580	cmd.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office InfoPath MUI (English) 2010.exe	a4b705baac8bb2c0d2bc111eae9735fb8586d6d1dab050f3c89fb12589470969.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office InfoPath MUI (English) 2010.exe	Microsoft Office InfoPath MUI (English) 2010.exe

Executes dropped EXE 1 IoCs

pid	Process
2724	Microsoft Office InfoPath MUI (English) 2010.exe

Loads dropped DLL 3 IoCs

pid	Process
2200	a4b705baac8bb2c0d2bc111eae9735fb8586d6d1dab050f3c89fb12589470969.exe
2724	Microsoft Office InfoPath MUI (English) 2010.exe
2772	EhStorAuthn.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Maps connected drives based on registry 3 TTPs 6 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	EhStorAuthn.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	EhStorAuthn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	a4b705baac8bb2c0d2bc111eae9735fb8586d6d1dab050f3c89fb12589470969.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	a4b705baac8bb2c0d2bc111eae9735fb8586d6d1dab050f3c89fb12589470969.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	Microsoft Office InfoPath MUI (English) 2010.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	Microsoft Office InfoPath MUI (English) 2010.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\EhStorAuthn.exe	EhStorAuthn.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EhStorAuthn.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	EhStorAuthn.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2468	schtasks.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
884	tasklist.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2752	PING.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	884	tasklist.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 2724	2200	a4b705baac8bb2c0d2bc111eae9735fb8586d6d1dab050f3c89fb12589470969.exe	28
PID 2200 wrote to memory of 2724	2200	a4b705baac8bb2c0d2bc111eae9735fb8586d6d1dab050f3c89fb12589470969.exe	28
PID 2200 wrote to memory of 2724	2200	a4b705baac8bb2c0d2bc111eae9735fb8586d6d1dab050f3c89fb12589470969.exe	28
PID 2200 wrote to memory of 2724	2200	a4b705baac8bb2c0d2bc111eae9735fb8586d6d1dab050f3c89fb12589470969.exe	28
PID 2200 wrote to memory of 2580	2200	a4b705baac8bb2c0d2bc111eae9735fb8586d6d1dab050f3c89fb12589470969.exe	29
PID 2200 wrote to memory of 2580	2200	a4b705baac8bb2c0d2bc111eae9735fb8586d6d1dab050f3c89fb12589470969.exe	29
PID 2200 wrote to memory of 2580	2200	a4b705baac8bb2c0d2bc111eae9735fb8586d6d1dab050f3c89fb12589470969.exe	29
PID 2200 wrote to memory of 2580	2200	a4b705baac8bb2c0d2bc111eae9735fb8586d6d1dab050f3c89fb12589470969.exe	29
PID 2580 wrote to memory of 2752	2580	cmd.exe	31
PID 2580 wrote to memory of 2752	2580	cmd.exe	31
PID 2580 wrote to memory of 2752	2580	cmd.exe	31
PID 2580 wrote to memory of 2752	2580	cmd.exe	31
PID 2580 wrote to memory of 2604	2580	cmd.exe	32
PID 2580 wrote to memory of 2604	2580	cmd.exe	32
PID 2580 wrote to memory of 2604	2580	cmd.exe	32
PID 2580 wrote to memory of 2604	2580	cmd.exe	32
PID 2724 wrote to memory of 2772	2724	Microsoft Office InfoPath MUI (English) 2010.exe	33
PID 2724 wrote to memory of 2772	2724	Microsoft Office InfoPath MUI (English) 2010.exe	33
PID 2724 wrote to memory of 2772	2724	Microsoft Office InfoPath MUI (English) 2010.exe	33
PID 2724 wrote to memory of 2772	2724	Microsoft Office InfoPath MUI (English) 2010.exe	33
PID 2724 wrote to memory of 2772	2724	Microsoft Office InfoPath MUI (English) 2010.exe	33
PID 2772 wrote to memory of 2468	2772	EhStorAuthn.exe	34
PID 2772 wrote to memory of 2468	2772	EhStorAuthn.exe	34
PID 2772 wrote to memory of 2468	2772	EhStorAuthn.exe	34
PID 2772 wrote to memory of 2468	2772	EhStorAuthn.exe	34
PID 2360 wrote to memory of 1728	2360	taskeng.exe	39
PID 2360 wrote to memory of 1728	2360	taskeng.exe	39
PID 2360 wrote to memory of 1728	2360	taskeng.exe	39
PID 1728 wrote to memory of 2900	1728	WScript.exe	40
PID 1728 wrote to memory of 2900	1728	WScript.exe	40
PID 1728 wrote to memory of 2900	1728	WScript.exe	40
PID 2900 wrote to memory of 1112	2900	cmd.exe	42
PID 2900 wrote to memory of 1112	2900	cmd.exe	42
PID 2900 wrote to memory of 1112	2900	cmd.exe	42
PID 2900 wrote to memory of 2396	2900	cmd.exe	43
PID 2900 wrote to memory of 2396	2900	cmd.exe	43
PID 2900 wrote to memory of 2396	2900	cmd.exe	43
PID 2396 wrote to memory of 884	2396	cmd.exe	44
PID 2396 wrote to memory of 884	2396	cmd.exe	44
PID 2396 wrote to memory of 884	2396	cmd.exe	44

C:\Users\Admin\AppData\Local\Temp\a4b705baac8bb2c0d2bc111eae9735fb8586d6d1dab050f3c89fb12589470969.exe
"C:\Users\Admin\AppData\Local\Temp\a4b705baac8bb2c0d2bc111eae9735fb8586d6d1dab050f3c89fb12589470969.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Maps connected drives based on registry
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office InfoPath MUI (English) 2010.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office InfoPath MUI (English) 2010.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Loads dropped DLL
  - Maps connected drives based on registry
  - Suspicious use of WriteProcessMemory
  PID:2724
- - C:\Windows\SysWOW64\EhStorAuthn.exe
    "C:\Windows\System32\EhStorAuthn.exe"
    3⤵
    - Loads dropped DLL
    - Maps connected drives based on registry
    - Drops file in System32 directory
    - Checks processor information in registry
    - Suspicious use of WriteProcessMemory
    PID:2772
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /sc minute /mo 5 /tn "Maintenance" /tr "C:\Users\%USERNAME%\AppData\Local\z_%USERNAME%\%USERNAME%.vbs" /F
      4⤵
      Creates scheduled task(s)
      PID:2468
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Roaming\del.bat
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:2580
- - C:\Windows\SysWOW64\PING.EXE
    ping localhost -n 3
    3⤵
    - Runs ping.exe
    PID:2752
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c del "C:\Users\Admin\AppData\Roaming\del.bat"
    3⤵
    PID:2604

C:\Windows\system32\taskeng.exe
taskeng.exe {18229A7F-AC2A-4249-9153-02A9D935AD98} S-1-5-21-39690363-730359138-1046745555-1000:EILATWEW\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Windows\System32\WScript.exe
  C:\Windows\System32\WScript.exe "C:\Users\Admin\AppData\Local\z_Admin\Admin.vbs"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1728
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Local\z_Admin\Admin.bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2900
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:1112
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq EhStorAuthn.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2396
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /NH /FI "IMAGENAME eq EhStorAuthn.exe"
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\z_Admin\Admin.bat

Filesize
318B

MD5
c87e8fdc20bf8d140b0e67e1d00aa6d7

SHA1
ce80a9aac930a057b26e584c99931288ac82a1be

SHA256
a2bb3643dd8e625e4d2cbb56c2c331a8ee0879a3ff432aaa57d9c057b9f7d986

SHA512
09f09f2b499046a3dd2434c5193636a978a6ed98b7ca34f27e680cbafa628d2a43050fc7c6d7472d7a6edcb5c6f70b729cbee708175c014a2d086a983b4961c7

Download Submit
C:\Users\Admin\AppData\Local\z_Admin\Admin.vbs

Filesize
175B

MD5
27a66c6f5104a0f9e0feee3a3ed57816

SHA1
8c08034fe0e93748fcd653acda13a5df92263c1d

SHA256
fb5da38c62629330924a6e14b8f47159c3b93f18e62688ee56364d45a7f34894

SHA512
f259af45c189712dae757fb9eccd828a19a6da3d8011c64a7825093123a74452967f21e5416aee69809c40137e2b31a8bd77125ab0a6d986033df8416d7a3046

Download Submit
C:\Users\Admin\AppData\Local\z_Admin\wallpaper.mp4

Filesize
1.2MB

MD5
d124f55b9393c976963407dff51ffa79

SHA1
2c7bbedd79791bfb866898c85b504186db610b5d

SHA256
ea1e16247c848c8c171c4cd1fa17bc5a018a1fcb0c0dac25009066b6667b8eef

SHA512
278fe3a4b1fbbe700e4f4483b610133e975e36e101455661d5197bd892a68839b9d555499040d200c92aefa9e3819380e395c0cd85d5fc845c6364d128a8cf06

Download Submit
C:\Users\Admin\AppData\Roaming\del.bat

Filesize
170B

MD5
7fe762e20099ac6263f73e9802371684

SHA1
caee8a6e500edaa047451fee1a748c0cb02a04da

SHA256
eb1049f972679d763edd03252cbad0cc801021ca5eabe897c9cfd0142fee26a4

SHA512
eac2d0e01c18e33e6405bd76518ac1357f1040300dd9b575f84193c66aa6f152f97d8adc0598f99e0c15e418007bba4dcc2a4c54ab8b96a7c530670f3e0e6b22

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office InfoPath MUI (English) 2010.exe

Filesize
29KB

MD5
d2efb0b8b82576016416aacbde6c3873

SHA1
19cac454edb76d7e879598d8c7e8e032f9d006d2

SHA256
a4b705baac8bb2c0d2bc111eae9735fb8586d6d1dab050f3c89fb12589470969

SHA512
e05172a8e7b0988ecfd85833177727262448bc9730dd0b33bae2b311d95336a97399824635f2ef4a6374fe04eb46f3739f4a6cce4a46b0c04df88a915d5b2c94

Download Submit
memory/2772-20-0x0000000000080000-0x000000000008C000-memory.dmp

Filesize
48KB

Download
memory/2772-22-0x0000000000080000-0x000000000008C000-memory.dmp

Filesize
48KB

Download
memory/2772-23-0x0000000000080000-0x000000000008C000-memory.dmp

Filesize
48KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads