b4d3bccc58e0a1222261fc91cf6c0b56db9116302c9aaf9d4ddf9273706d571f

Analysis

max time kernel
39s
max time network
155s
platform
windows7_x64
resource
win7v200430
submitted
09/07/2020, 14:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Payment details.exe
Size

546KB
MD5

d580a1f4241f75ac8bf99ac6ca501977
SHA1

11a2d6e337c2a5830a918d206d475400d606c5b3
SHA256

b4d3bccc58e0a1222261fc91cf6c0b56db9116302c9aaf9d4ddf9273706d571f
SHA512

19ef34c65bacb0d0b38bd45126d989f2fbd510d91f844ab844e92d87b5380f749d5d89f6fc7ec16bbfcca97f40bf7d10d24d86186a402bb442f10fbb7c773ab5

Score

7^/10

persistence spyware

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 804 wrote to memory of 1856	804	Payment details.exe	26
PID 804 wrote to memory of 1856	804	Payment details.exe	26
PID 804 wrote to memory of 1856	804	Payment details.exe	26
PID 804 wrote to memory of 1856	804	Payment details.exe	26
PID 804 wrote to memory of 1856	804	Payment details.exe	26
PID 804 wrote to memory of 1856	804	Payment details.exe	26
PID 804 wrote to memory of 1856	804	Payment details.exe	26
PID 804 wrote to memory of 1856	804	Payment details.exe	26
PID 804 wrote to memory of 1856	804	Payment details.exe	26

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 804 set thread context of 1856	804	Payment details.exe	26

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1856	ieinstal.exe

Loads dropped DLL 6 IoCs

pid	Process
1856	ieinstal.exe
1856	ieinstal.exe
1856	ieinstal.exe
1856	ieinstal.exe
1856	ieinstal.exe
1856	ieinstal.exe

Adds Run entry to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Molt = "C:\\Users\\Admin\\AppData\\Local\\Molt\\Molt.hta"	Payment details.exe

C:\Users\Admin\AppData\Local\Temp\Payment details.exe
"C:\Users\Admin\AppData\Local\Temp\Payment details.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Adds Run entry to start application
PID:804
- C:\Program Files (x86)\internet explorer\ieinstal.exe
  "C:\Program Files (x86)\internet explorer\ieinstal.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  - Loads dropped DLL
  PID:1856

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1856-0-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/1856-2-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download