Analysis
-
max time kernel
133s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
05-03-2022 16:55
Static task
static1
Behavioral task
behavioral1
Sample
e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe
Resource
win10v2004-en-20220113
General
-
Target
e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe
-
Size
1.2MB
-
MD5
78be5b87f4282ad396ba0cdb3219a8c4
-
SHA1
2b07c58af5ae103c9b4745c948cabc36cd12d97c
-
SHA256
e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a
-
SHA512
9539b3ad5c65243b13d2dcc7ef98599e50cac742d5c097f4305d5de025b0c8cb8c7af579ffb533f67517c6c01d8a18b5e42a6030ce3b5d535362efbe62d784b7
Malware Config
Signatures
-
Troldesh, Shade, Encoder.858
Troldesh is a ransomware spread by malspam.
-
resource yara_rule behavioral2/memory/2432-131-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral2/memory/2432-132-0x0000000000400000-0x0000000000608000-memory.dmp upx -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\"" e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2432 e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe 2432 e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe 2432 e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe 2432 e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe"C:\Users\Admin\AppData\Local\Temp\e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:2432