Trustwave Pillowmint June 2020

Pillowmint has collected credit card data using native API functions.

Pillowmint has used shellcode which reads code stored in the registry keys \REGISTRY\SOFTWARE\Microsoft\DRM using the native Windows API as well as read HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces as part of its C2.

Pillowmint has obfuscated the AES key used for encryption.

Pillowmint has stored a compressed payload in the Registry key HKLM\SOFTWARE\Microsoft\DRM.

Pillowmint has been compressed and stored within a registry key.

Pillowmint has used the NtQueueApcThread syscall to inject code into svchost.exe.

Pillowmint can iterate through running processes every six seconds collecting a list of processes to capture from later.

Pillowmint has used a PowerShell script to install a shim database.

Pillowmint has deleted the filepath %APPDATA%\Intel\devmonsrv.exe.

Pillowmint can uninstall the malicious service from an infected machine.

Pillowmint has used multiple native Windows APIs to execute and conduct process injections.

Pillowmint has modified the Registry key HKLM\SOFTWARE\Microsoft\DRM to store a malicious payload.

Pillowmint has been decompressed by included shellcode prior to being launched.

Pillowmint has used a malicious shim database to maintain persistence.

Pillowmint has encrypted stolen credit card information with AES and further encoded it with Base64.