Procedure examples

Saint Bot can collect files and information from a compromised host.

Saint Bot has used `check_registry_keys` as part of its environmental checks.

Saint Bot can collect the IP address of a victim machine.

Saint Bot has been obfuscated to help avoid detection.

Saint Bot has been packed using a dark market crypter.

Saint Bot can collect the username from a compromised host.

Saint Bot has renamed malicious binaries as `wallpaper.mp4` and `slideshow.mp4` to avoid detection.

Saint Bot has been disguised as a legitimate executable, including as Windows SDK.

Saint Bot has created a scheduled task named "Maintenance" to establish persistence.

Saint Bot has injected its DLL component into `EhStorAurhn.exe`.

Saint Bot has written its payload into a newly-created `EhStorAuthn.exe` process using `ZwWriteVirtualMemory` and executed it using `NtQueueApcThread` and `ZwAlertResumeThread`.

The Saint Bot loader has used API calls to spawn `MSBuild.exe` in a suspended state before injecting the decrypted Saint Bot binary into it.

Saint Bot has enumerated running processes on a compromised host to determine if it is running under the process name `dfrgui.exe`.

Saint Bot has used PowerShell for execution.

Saint Bot has used `cmd.exe` and `.bat` scripts for execution.

Saint Bot has used `.vbs` scripts for execution.

Saint Bot can run a batch script named `del.bat` to remove any Saint Bot payload-linked files from a compromise system if anti-analysis or locale checks fail.

Saint Bot has used HTTP for C2 communications.

Saint Bot can identify the OS version, CPU, and other details from a victim's machine.

Saint Bot can search a compromised host for specific files.

Saint Bot can download additional files onto a compromised host.

Saint Bot has used different API calls, including `GetProcAddress`, `VirtualAllocEx`, `WriteProcessMemory`, `CreateProcessA`, and `SetThreadContext`.

Saint Bot has used Base64 to encode its C2 communications.

Saint Bot can deobfuscate strings and files for execution.

Saint Bot has relied on users to click on a malicious link delivered via a spearphishing.

Saint Bot has relied on users to execute a malicious attachment delivered via spearphishing.

Saint Bot had used `InstallUtil.exe` to download and deploy executables.

Saint Bot has used `regsvr32` to execute scripts.

Saint Bot has run several virtual machine and sandbox checks, including checking if `Sbiedll.dll` is present in a list of loaded modules, comparing the machine name to `HAL9TH` and the user name to `JohnDoe`, and checking the BIOS version for known virtual machine identifiers.

Saint Bot has used the command `timeout 20` to pause the execution of its initial loader.

Saint Bot has established persistence by being copied to the Startup directory or through the `\Software\Microsoft\Windows\CurrentVersion\Run` registry key.

Saint Bot has attempted to bypass UAC using `fodhelper.exe` to escalate privileges.

Saint Bot has been distributed as malicious attachments within spearphishing emails.

Saint Bot has been distributed through malicious links contained within spearphishing emails.

Saint Bot will use the malicious file slideshow.mp4 if present to load the core API provided by ntdll.dll to avoid any hooks placed on calls to the original ntdll.dll file by endpoint detection and response or antimalware software.

Saint Bot has conducted system locale checks to see if the compromised host is in Russia, Ukraine, Belarus, Armenia, Kazakhstan, or Moldova.

Saint Bot has used `is_debugger_present` as part of its environmental checks.