Analysis
-
max time kernel
1726s -
max time network
1829s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
09-07-2021 13:58
Static task
static1
Behavioral task
behavioral1
Sample
ToDesk_Lite.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
ToDesk_Lite.exe
Resource
win10v20210410
General
-
Target
ToDesk_Lite.exe
-
Size
6.4MB
-
MD5
ce5ab2494fc91c67248bbdb085b747c2
-
SHA1
bdc554a291a4c4e2bf2490522aa70d0ff262cba7
-
SHA256
4a36398050b818b3ea0067685fc31cedbe3efa017ae741774c527c9391ec26a6
-
SHA512
a60d8225cf8c497f8364adde5467ba6872fd56692650b324815c7eec676e263776be8f7aa442e21d3cb733d5d7544d4e6001a2f8a5834f1b834c9de222b0cbc0
Malware Config
Signatures
-
Drops file in System32 directory 3 IoCs
Processes:
ToDesk_Lite.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ToDesk\Logs\service_2021_07_09.log ToDesk_Lite.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ToDesk\config.ini ToDesk_Lite.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ToDesk\config.ini ToDesk_Lite.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
ToDesk_Lite.exepid process 1832 ToDesk_Lite.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
ToDesk_Lite.exepid process 1988 ToDesk_Lite.exe 1988 ToDesk_Lite.exe 1988 ToDesk_Lite.exe 1988 ToDesk_Lite.exe 1988 ToDesk_Lite.exe 1988 ToDesk_Lite.exe 1988 ToDesk_Lite.exe 1988 ToDesk_Lite.exe 1988 ToDesk_Lite.exe 1988 ToDesk_Lite.exe 1988 ToDesk_Lite.exe 1988 ToDesk_Lite.exe 1988 ToDesk_Lite.exe 1988 ToDesk_Lite.exe 1988 ToDesk_Lite.exe 1988 ToDesk_Lite.exe 1988 ToDesk_Lite.exe 1988 ToDesk_Lite.exe 1988 ToDesk_Lite.exe 1988 ToDesk_Lite.exe 1988 ToDesk_Lite.exe 1988 ToDesk_Lite.exe 1988 ToDesk_Lite.exe 1988 ToDesk_Lite.exe 1988 ToDesk_Lite.exe 1988 ToDesk_Lite.exe 1988 ToDesk_Lite.exe 1988 ToDesk_Lite.exe 1988 ToDesk_Lite.exe 1988 ToDesk_Lite.exe 1988 ToDesk_Lite.exe 1988 ToDesk_Lite.exe 1988 ToDesk_Lite.exe 1988 ToDesk_Lite.exe 1988 ToDesk_Lite.exe 1988 ToDesk_Lite.exe 1988 ToDesk_Lite.exe 1988 ToDesk_Lite.exe 1988 ToDesk_Lite.exe 1988 ToDesk_Lite.exe 1988 ToDesk_Lite.exe 1988 ToDesk_Lite.exe 1988 ToDesk_Lite.exe 1988 ToDesk_Lite.exe 1988 ToDesk_Lite.exe 1988 ToDesk_Lite.exe 1988 ToDesk_Lite.exe 1988 ToDesk_Lite.exe 1988 ToDesk_Lite.exe 1988 ToDesk_Lite.exe 1988 ToDesk_Lite.exe 1988 ToDesk_Lite.exe 1988 ToDesk_Lite.exe 1988 ToDesk_Lite.exe 1988 ToDesk_Lite.exe 1988 ToDesk_Lite.exe 1988 ToDesk_Lite.exe 1988 ToDesk_Lite.exe 1988 ToDesk_Lite.exe 1988 ToDesk_Lite.exe 1988 ToDesk_Lite.exe 1988 ToDesk_Lite.exe 1988 ToDesk_Lite.exe 1988 ToDesk_Lite.exe -
Suspicious use of FindShellTrayWindow 42 IoCs
Processes:
ToDesk_Lite.exepid process 1832 ToDesk_Lite.exe 1832 ToDesk_Lite.exe 1832 ToDesk_Lite.exe 1832 ToDesk_Lite.exe 1832 ToDesk_Lite.exe 1832 ToDesk_Lite.exe 1832 ToDesk_Lite.exe 1832 ToDesk_Lite.exe 1832 ToDesk_Lite.exe 1832 ToDesk_Lite.exe 1832 ToDesk_Lite.exe 1832 ToDesk_Lite.exe 1832 ToDesk_Lite.exe 1832 ToDesk_Lite.exe 1832 ToDesk_Lite.exe 1832 ToDesk_Lite.exe 1832 ToDesk_Lite.exe 1832 ToDesk_Lite.exe 1832 ToDesk_Lite.exe 1832 ToDesk_Lite.exe 1832 ToDesk_Lite.exe 1832 ToDesk_Lite.exe 1832 ToDesk_Lite.exe 1832 ToDesk_Lite.exe 1832 ToDesk_Lite.exe 1832 ToDesk_Lite.exe 1832 ToDesk_Lite.exe 1832 ToDesk_Lite.exe 1832 ToDesk_Lite.exe 1832 ToDesk_Lite.exe 1832 ToDesk_Lite.exe 1832 ToDesk_Lite.exe 1832 ToDesk_Lite.exe 1832 ToDesk_Lite.exe 1832 ToDesk_Lite.exe 1832 ToDesk_Lite.exe 1832 ToDesk_Lite.exe 1832 ToDesk_Lite.exe 1832 ToDesk_Lite.exe 1832 ToDesk_Lite.exe 1832 ToDesk_Lite.exe 1832 ToDesk_Lite.exe -
Suspicious use of SendNotifyMessage 42 IoCs
Processes:
ToDesk_Lite.exepid process 1832 ToDesk_Lite.exe 1832 ToDesk_Lite.exe 1832 ToDesk_Lite.exe 1832 ToDesk_Lite.exe 1832 ToDesk_Lite.exe 1832 ToDesk_Lite.exe 1832 ToDesk_Lite.exe 1832 ToDesk_Lite.exe 1832 ToDesk_Lite.exe 1832 ToDesk_Lite.exe 1832 ToDesk_Lite.exe 1832 ToDesk_Lite.exe 1832 ToDesk_Lite.exe 1832 ToDesk_Lite.exe 1832 ToDesk_Lite.exe 1832 ToDesk_Lite.exe 1832 ToDesk_Lite.exe 1832 ToDesk_Lite.exe 1832 ToDesk_Lite.exe 1832 ToDesk_Lite.exe 1832 ToDesk_Lite.exe 1832 ToDesk_Lite.exe 1832 ToDesk_Lite.exe 1832 ToDesk_Lite.exe 1832 ToDesk_Lite.exe 1832 ToDesk_Lite.exe 1832 ToDesk_Lite.exe 1832 ToDesk_Lite.exe 1832 ToDesk_Lite.exe 1832 ToDesk_Lite.exe 1832 ToDesk_Lite.exe 1832 ToDesk_Lite.exe 1832 ToDesk_Lite.exe 1832 ToDesk_Lite.exe 1832 ToDesk_Lite.exe 1832 ToDesk_Lite.exe 1832 ToDesk_Lite.exe 1832 ToDesk_Lite.exe 1832 ToDesk_Lite.exe 1832 ToDesk_Lite.exe 1832 ToDesk_Lite.exe 1832 ToDesk_Lite.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
ToDesk_Lite.exedescription pid process target process PID 1988 wrote to memory of 1832 1988 ToDesk_Lite.exe ToDesk_Lite.exe PID 1988 wrote to memory of 1832 1988 ToDesk_Lite.exe ToDesk_Lite.exe PID 1988 wrote to memory of 1832 1988 ToDesk_Lite.exe ToDesk_Lite.exe PID 1988 wrote to memory of 1832 1988 ToDesk_Lite.exe ToDesk_Lite.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ToDesk_Lite.exe"C:\Users\Admin\AppData\Local\Temp\ToDesk_Lite.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\ToDesk_Lite.exe"C:\Users\Admin\AppData\Local\Temp\ToDesk_Lite.exe" server_start1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ToDesk_Lite.exe"C:\Users\Admin\AppData\Local\Temp\ToDesk_Lite.exe" clinet_hide2⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\ToDesk\config.iniMD5
4187f96e15ee413a8eb83d252fda4110
SHA17042dd19b9404cc24f8ac487c311eaf523c749a7
SHA256d0618493d09ae512e80820b5929081fc74ddb640cf3ae2df05783249ad86592a
SHA5129834d22423770fd1333309e4917e4b7f8ba2f3adba468d9ab1eb26b71b74812c93144fecefee7dea1531d12cc8647a5af4568624af3522869c72666236c74513
-
memory/1832-61-0x0000000000000000-mapping.dmp
-
memory/2004-59-0x00000000754F1000-0x00000000754F3000-memory.dmpFilesize
8KB