Overview

overview

10

Static

static

04c4e2ad06...le.exe

windows7_x64

10

04c4e2ad06...le.exe

windows10_x64

10

Analysis

  • max time kernel
    129s
  • max time network
    147s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    26-07-2021 12:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    04c4e2ad0699cc27f79c0b4f62a12ce8514aea55e5737628de293d81846cf7c5.sample.exe

  • Size

    1.1MB

  • MD5

    44ff529219044aea635985dbb98b63f1

  • SHA1

    b82193412b1cd9cb59d9bbaf30145cbdfb75b6b4

  • SHA256

    04c4e2ad0699cc27f79c0b4f62a12ce8514aea55e5737628de293d81846cf7c5

  • SHA512

    7b60a6038d5045821d019ce0368e604946a699c7d530277a9a08272f6e19e6cd97c20edf6c4263e0d125230dd486dc4a3128c8edc5e3bb65bb5a211b63ec9db3

Score
10/10
troldeshdiscoverypersistenceransomwarespywarestealertrojanupx

Malware Config

Signatures

  • Troldesh, Shade, Encoder.858

    Troldesh is a ransomware spread by malspam.

    ransomwaretrojantroldesh
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\04c4e2ad0699cc27f79c0b4f62a12ce8514aea55e5737628de293d81846cf7c5.sample.exe
    "C:\Users\Admin\AppData\Local\Temp\04c4e2ad0699cc27f79c0b4f62a12ce8514aea55e5737628de293d81846cf7c5.sample.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    PID:572

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/572-114-0x00000000023C0000-0x0000000002495000-memory.dmp
    Filesize

    852KB

    Download
  • memory/572-115-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download