troldesh | 0774ee18a57ee8a20d7f355f23a6b7f049dd93c251e2cc9af0100e92a3526547

Target

0774ee18a57ee8a20d7f355f23a6b7f049dd93c251e2cc9af0100e92a3526547.exe
Size

917KB
MD5

6b5410cf5fa90e28d32077088f3a3514
SHA1

321a8ad1d6ec06af69ab4515e523f5d31261814d
SHA256

0774ee18a57ee8a20d7f355f23a6b7f049dd93c251e2cc9af0100e92a3526547
SHA512

6107132f44b4b72e5019425a7536b953bdaa3c1cf46a28cfbcccae4a00dae95489dd2bcbdbbf387eff494a15c049f0e30597e3018662722ef37a533311ca2ecd

Score

10^/10

troldesh persistence ransomware trojan upx

Malware Config

Signatures

Troldesh, Shade, Encoder.858
Troldesh is a ransomware spread by malspam.
ransomware trojan troldesh

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1568-59-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/1568-60-0x0000000000400000-0x00000000005DE000-memory.dmp	upx

Loads dropped DLL 1 IoCs

pid	Process
1980	0774ee18a57ee8a20d7f355f23a6b7f049dd93c251e2cc9af0100e92a3526547.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\	0774ee18a57ee8a20d7f355f23a6b7f049dd93c251e2cc9af0100e92a3526547.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\""	0774ee18a57ee8a20d7f355f23a6b7f049dd93c251e2cc9af0100e92a3526547.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1980 set thread context of 1568	1980	0774ee18a57ee8a20d7f355f23a6b7f049dd93c251e2cc9af0100e92a3526547.exe	27

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1568	0774ee18a57ee8a20d7f355f23a6b7f049dd93c251e2cc9af0100e92a3526547.exe
1568	0774ee18a57ee8a20d7f355f23a6b7f049dd93c251e2cc9af0100e92a3526547.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1980	0774ee18a57ee8a20d7f355f23a6b7f049dd93c251e2cc9af0100e92a3526547.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 1568	1980	0774ee18a57ee8a20d7f355f23a6b7f049dd93c251e2cc9af0100e92a3526547.exe	27
PID 1980 wrote to memory of 1568	1980	0774ee18a57ee8a20d7f355f23a6b7f049dd93c251e2cc9af0100e92a3526547.exe	27
PID 1980 wrote to memory of 1568	1980	0774ee18a57ee8a20d7f355f23a6b7f049dd93c251e2cc9af0100e92a3526547.exe	27
PID 1980 wrote to memory of 1568	1980	0774ee18a57ee8a20d7f355f23a6b7f049dd93c251e2cc9af0100e92a3526547.exe	27
PID 1980 wrote to memory of 1568	1980	0774ee18a57ee8a20d7f355f23a6b7f049dd93c251e2cc9af0100e92a3526547.exe	27

C:\Users\Admin\AppData\Local\Temp\0774ee18a57ee8a20d7f355f23a6b7f049dd93c251e2cc9af0100e92a3526547.exe
"C:\Users\Admin\AppData\Local\Temp\0774ee18a57ee8a20d7f355f23a6b7f049dd93c251e2cc9af0100e92a3526547.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Users\Admin\AppData\Local\Temp\0774ee18a57ee8a20d7f355f23a6b7f049dd93c251e2cc9af0100e92a3526547.exe
  "C:\Users\Admin\AppData\Local\Temp\0774ee18a57ee8a20d7f355f23a6b7f049dd93c251e2cc9af0100e92a3526547.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  PID:1568

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nst15A.tmp\System.dll

Filesize
11KB

MD5
fc3772787eb239ef4d0399680dcc4343

SHA1
db2fa99ec967178cd8057a14a428a8439a961a73

SHA256
9b93c61c9d63ef8ec80892cc0e4a0877966dca9b0c3eb85555cebd2ddf4d6eed

SHA512
79e491ca4591a5da70116114b7fbb66ee15a0532386035e980c9dfe7afb59b1f9d9c758891e25bfb45c36b07afd3e171bac37a86c887387ef0e80b1eaf296c89

Download Submit
memory/1568-59-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/1568-60-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/1980-54-0x00000000768D1000-0x00000000768D3000-memory.dmp

Filesize
8KB

Download
memory/1980-56-0x00000000023F0000-0x000000000303A000-memory.dmp

Filesize
12.3MB

Download