troldesh | 388e56393ae6b4d2ad4c434721060000f6782c412aea274f3465757a114efe04

Target

388e56393ae6b4d2ad4c434721060000f6782c412aea274f3465757a114efe04.exe
Size

1.3MB
MD5

588c44f7d45328df605aaa90902f51b4
SHA1

db8209e71f200f0c6169fb13e5315fe5e3d1682d
SHA256

388e56393ae6b4d2ad4c434721060000f6782c412aea274f3465757a114efe04
SHA512

d0635547ca3e121034c1ee25f696b7a051c60d616fbeec70093307c5aa811ce76aaf0af4db0a3429e206868ddd20059e910532e06f4fe3973bc687630905b3cf

Score

10^/10

Malware Config

Troldesh, Shade, Encoder.858
Troldesh is a ransomware spread by malspam.
ransomware trojan troldesh

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2536-132-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/2536-133-0x0000000000400000-0x0000000000608000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\	388e56393ae6b4d2ad4c434721060000f6782c412aea274f3465757a114efe04.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\""	388e56393ae6b4d2ad4c434721060000f6782c412aea274f3465757a114efe04.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2536-130-0x0000000002200000-0x00000000022D5000-memory.dmp

Filesize
852KB

Download
memory/2536-131-0x0000000002200000-0x00000000022D5000-memory.dmp

Filesize
852KB

Download
memory/2536-132-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/2536-133-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download