b4d3bccc58e0a1222261fc91cf6c0b56db9116302c9aaf9d4ddf9273706d571f

Analysis

max time kernel
76s
max time network
141s
platform
windows10_x64
resource
win10
submitted
09/07/2020, 14:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Payment details.exe
Size

546KB
MD5

d580a1f4241f75ac8bf99ac6ca501977
SHA1

11a2d6e337c2a5830a918d206d475400d606c5b3
SHA256

b4d3bccc58e0a1222261fc91cf6c0b56db9116302c9aaf9d4ddf9273706d571f
SHA512

19ef34c65bacb0d0b38bd45126d989f2fbd510d91f844ab844e92d87b5380f749d5d89f6fc7ec16bbfcca97f40bf7d10d24d86186a402bb442f10fbb7c773ab5

Score

7^/10

persistence spyware

Malware Config

Signatures

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3100 wrote to memory of 3912	3100	Payment details.exe	67
PID 3100 wrote to memory of 3912	3100	Payment details.exe	67
PID 3100 wrote to memory of 3912	3100	Payment details.exe	67
PID 3100 wrote to memory of 3912	3100	Payment details.exe	67
PID 3100 wrote to memory of 3912	3100	Payment details.exe	67

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3100 set thread context of 3912	3100	Payment details.exe	67

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3912	ieinstal.exe

Loads dropped DLL 6 IoCs

pid	Process
3912	ieinstal.exe
3912	ieinstal.exe
3912	ieinstal.exe
3912	ieinstal.exe
3912	ieinstal.exe
3912	ieinstal.exe

Adds Run entry to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\Molt = "C:\\Users\\Admin\\AppData\\Local\\Molt\\Molt.hta"	Payment details.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

C:\Users\Admin\AppData\Local\Temp\Payment details.exe
"C:\Users\Admin\AppData\Local\Temp\Payment details.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Adds Run entry to start application
PID:3100
- C:\Program Files (x86)\internet explorer\ieinstal.exe
  "C:\Program Files (x86)\internet explorer\ieinstal.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  - Loads dropped DLL
  PID:3912

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3912-0-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/3912-2-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download