troldesh | dcc056e22b9479b84787d8affd79778f494cf6a86c1dd51e8cc7fb5a04c61732

Analysis

max time kernel
49s
max time network
148s
platform
windows10_x64
resource
win10v20210410
submitted
26-07-2021 13:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dcc056e22b9479b84787d8affd79778f494cf6a86c1dd51e8cc7fb5a04c61732.sample.exe
Size

1.8MB
MD5

cb83d6c4e2e5de482e6e18abcc2d2a5d
SHA1

6bb5b3e9ceb1eea6a493471d1ebc527327d9f8ac
SHA256

dcc056e22b9479b84787d8affd79778f494cf6a86c1dd51e8cc7fb5a04c61732
SHA512

851c7181b7bff17cffe614427a21be6a1716d5319fd3c8c84a6de8076a35ed71107e05f5c2105152559630300a667e299682911adf9a0a0c9498828167f90625

Score

10^/10

troldesh persistence ransomware trojan

Malware Config

Signatures

Troldesh, Shade, Encoder.858
Troldesh is a ransomware spread by malspam.
ransomware trojan troldesh

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

dcc056e22b9479b84787d8affd79778f494cf6a86c1dd51e8cc7fb5a04c61732.sample.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\	dcc056e22b9479b84787d8affd79778f494cf6a86c1dd51e8cc7fb5a04c61732.sample.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\""	dcc056e22b9479b84787d8affd79778f494cf6a86c1dd51e8cc7fb5a04c61732.sample.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

dcc056e22b9479b84787d8affd79778f494cf6a86c1dd51e8cc7fb5a04c61732.sample.exe

pid	process
4008	dcc056e22b9479b84787d8affd79778f494cf6a86c1dd51e8cc7fb5a04c61732.sample.exe
4008	dcc056e22b9479b84787d8affd79778f494cf6a86c1dd51e8cc7fb5a04c61732.sample.exe
4008	dcc056e22b9479b84787d8affd79778f494cf6a86c1dd51e8cc7fb5a04c61732.sample.exe
4008	dcc056e22b9479b84787d8affd79778f494cf6a86c1dd51e8cc7fb5a04c61732.sample.exe

C:\Users\Admin\AppData\Local\Temp\dcc056e22b9479b84787d8affd79778f494cf6a86c1dd51e8cc7fb5a04c61732.sample.exe
"C:\Users\Admin\AppData\Local\Temp\dcc056e22b9479b84787d8affd79778f494cf6a86c1dd51e8cc7fb5a04c61732.sample.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:4008

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4008-114-0x0000000000400000-0x00000000005DA000-memory.dmp

Filesize
1.9MB

Download