b4d3bccc58e0a1222261fc91cf6c0b56db9116302c9aaf9d4ddf9273706d571f

General

Target

Payment details.exe
Size

546KB
MD5

d580a1f4241f75ac8bf99ac6ca501977
SHA1

11a2d6e337c2a5830a918d206d475400d606c5b3
SHA256

b4d3bccc58e0a1222261fc91cf6c0b56db9116302c9aaf9d4ddf9273706d571f
SHA512

19ef34c65bacb0d0b38bd45126d989f2fbd510d91f844ab844e92d87b5380f749d5d89f6fc7ec16bbfcca97f40bf7d10d24d86186a402bb442f10fbb7c773ab5

Score

7^/10

persistence spyware

Malware Config

Signatures

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

Payment details.exe

description	pid	process	target process
PID 3100 wrote to memory of 3912	3100	Payment details.exe	ieinstal.exe
PID 3100 wrote to memory of 3912	3100	Payment details.exe	ieinstal.exe
PID 3100 wrote to memory of 3912	3100	Payment details.exe	ieinstal.exe
PID 3100 wrote to memory of 3912	3100	Payment details.exe	ieinstal.exe
PID 3100 wrote to memory of 3912	3100	Payment details.exe	ieinstal.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

Payment details.exe

description pid process target process

PID 3100 set thread context of 3912 3100 Payment details.exe ieinstal.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

ieinstal.exe

pid process

3912 ieinstal.exe
Loads dropped DLL 6 IoCs

Processes:

ieinstal.exe

pid process

3912 ieinstal.exe
3912 ieinstal.exe
3912 ieinstal.exe
3912 ieinstal.exe
3912 ieinstal.exe
3912 ieinstal.exe

description	pid	process	target process
PID 3100 set thread context of 3912	3100	Payment details.exe	ieinstal.exe

pid	process
3912	ieinstal.exe

pid	process
3912	ieinstal.exe
3912	ieinstal.exe
3912	ieinstal.exe
3912	ieinstal.exe
3912	ieinstal.exe
3912	ieinstal.exe

Adds Run entry to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Payment details.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\Molt = "C:\\Users\\Admin\\AppData\\Local\\Molt\\Molt.hta"	Payment details.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

C:\Users\Admin\AppData\Local\Temp\Payment details.exe
"C:\Users\Admin\AppData\Local\Temp\Payment details.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Adds Run entry to start application
PID:3100

C:\Program Files (x86)\internet explorer\ieinstal.exe
"C:\Program Files (x86)\internet explorer\ieinstal.exe"
2⤵
- Suspicious use of SetWindowsHookEx
- Loads dropped DLL
PID:3912

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\freebl3.dll

Download Submit
\Users\Admin\AppData\Local\Temp\mozglue.dll

Download Submit
\Users\Admin\AppData\Local\Temp\msvcp140.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nss3.dll

Download Submit
\Users\Admin\AppData\Local\Temp\softokn3.dll

Download Submit
\Users\Admin\AppData\Local\Temp\vcruntime140.dll

Download Submit
memory/3912-0-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/3912-1-0x0000000000405A3D-mapping.dmp

Download
memory/3912-2-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download

Analysis

Sharing