troldesh | 6556303d76c57a172c38ce49630acbceb6b5fb9f033a9ff0c3d1ad5668269c32

General

Target

6556303d76c57a172c38ce49630acbceb6b5fb9f033a9ff0c3d1ad5668269c32.exe
Size

1012KB
MD5

e99a6653e12d6b676a8984380b387a15
SHA1

3c17b6a7e1f0d3be71cfa185d8866f7caccbeb46
SHA256

6556303d76c57a172c38ce49630acbceb6b5fb9f033a9ff0c3d1ad5668269c32
SHA512

e908819771ba6eabb61433c65763593eb941554f677784657f4409cc51c7c342542e02bc2fe54caff9e3f3044ea993d29abfef499723a68222ed37cba1227941

Score

10^/10

troldesh discovery persistence ransomware trojan upx

Malware Config

Signatures

Troldesh, Shade, Encoder.858
Troldesh is a ransomware spread by malspam.
ransomware trojan troldesh

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1420-55-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral1/memory/1420-57-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral1/memory/1420-60-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral1/memory/1420-62-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral1/memory/1420-63-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral1/memory/1420-64-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral1/memory/1420-65-0x0000000000400000-0x0000000000608000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\	6556303d76c57a172c38ce49630acbceb6b5fb9f033a9ff0c3d1ad5668269c32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\""	6556303d76c57a172c38ce49630acbceb6b5fb9f033a9ff0c3d1ad5668269c32.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1308 set thread context of 1420	1308	6556303d76c57a172c38ce49630acbceb6b5fb9f033a9ff0c3d1ad5668269c32.exe	27

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1420	6556303d76c57a172c38ce49630acbceb6b5fb9f033a9ff0c3d1ad5668269c32.exe
1420	6556303d76c57a172c38ce49630acbceb6b5fb9f033a9ff0c3d1ad5668269c32.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1308 wrote to memory of 1420	1308	6556303d76c57a172c38ce49630acbceb6b5fb9f033a9ff0c3d1ad5668269c32.exe	27
PID 1308 wrote to memory of 1420	1308	6556303d76c57a172c38ce49630acbceb6b5fb9f033a9ff0c3d1ad5668269c32.exe	27
PID 1308 wrote to memory of 1420	1308	6556303d76c57a172c38ce49630acbceb6b5fb9f033a9ff0c3d1ad5668269c32.exe	27
PID 1308 wrote to memory of 1420	1308	6556303d76c57a172c38ce49630acbceb6b5fb9f033a9ff0c3d1ad5668269c32.exe	27
PID 1308 wrote to memory of 1420	1308	6556303d76c57a172c38ce49630acbceb6b5fb9f033a9ff0c3d1ad5668269c32.exe	27
PID 1308 wrote to memory of 1420	1308	6556303d76c57a172c38ce49630acbceb6b5fb9f033a9ff0c3d1ad5668269c32.exe	27
PID 1308 wrote to memory of 1420	1308	6556303d76c57a172c38ce49630acbceb6b5fb9f033a9ff0c3d1ad5668269c32.exe	27
PID 1308 wrote to memory of 1420	1308	6556303d76c57a172c38ce49630acbceb6b5fb9f033a9ff0c3d1ad5668269c32.exe	27
PID 1308 wrote to memory of 1420	1308	6556303d76c57a172c38ce49630acbceb6b5fb9f033a9ff0c3d1ad5668269c32.exe	27

C:\Users\Admin\AppData\Local\Temp\6556303d76c57a172c38ce49630acbceb6b5fb9f033a9ff0c3d1ad5668269c32.exe
"C:\Users\Admin\AppData\Local\Temp\6556303d76c57a172c38ce49630acbceb6b5fb9f033a9ff0c3d1ad5668269c32.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1308
- C:\Users\Admin\AppData\Local\Temp\6556303d76c57a172c38ce49630acbceb6b5fb9f033a9ff0c3d1ad5668269c32.exe
  "C:\Users\Admin\AppData\Local\Temp\6556303d76c57a172c38ce49630acbceb6b5fb9f033a9ff0c3d1ad5668269c32.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  PID:1420

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1308-54-0x0000000001C50000-0x0000000001D25000-memory.dmp

Filesize
852KB

Download
memory/1308-59-0x0000000001C50000-0x0000000001D25000-memory.dmp

Filesize
852KB

Download
memory/1308-61-0x0000000001D30000-0x0000000001E05000-memory.dmp

Filesize
852KB

Download
memory/1420-55-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/1420-57-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/1420-60-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/1420-58-0x00000000763E1000-0x00000000763E3000-memory.dmp

Filesize
8KB

Download
memory/1420-62-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/1420-63-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/1420-64-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/1420-65-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download

Analysis

Sharing