troldesh | 441116d55e97124a067207bf57483dd3462bccfb034e56c4152675b0dcb118e7

Analysis

max time kernel
165s
max time network
129s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16-03-2024 15:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3c0fe521f6a9cfbfabc1f27a1a64dfc081a63aaaf2a6ce8cd831f6251ee85816.exe
Size

947KB
MD5

39217b125403ff7c755622ef9bbef974
SHA1

9fc607b7c17919c83999bdd119e9cd6bf413101a
SHA256

3c0fe521f6a9cfbfabc1f27a1a64dfc081a63aaaf2a6ce8cd831f6251ee85816
SHA512

1252ea94931eaf4426ca1eb94a070645238775c447a09286109fe894c569de29ca502882a0fa34e97e09109c43c486a3aa32081e3a3afef0b6557db59c71fc50
SSDEEP

12288:3+Zn/gJtKaNIBpB+iMMOD30ZnZ47m0T3JF9j3GOF0l7B2FzqL2aZa7rf58bs:3+RYeaNILZi/JDLG60y1aZvs

Score

10^/10

troldesh persistence ransomware trojan upx

Malware Config

Signatures

Troldesh, Shade, Encoder.858
Troldesh is a ransomware spread by malspam.
ransomware trojan troldesh

UPX packed file 19 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral12/memory/3004-5833-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral12/memory/3004-5836-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral12/memory/3004-5837-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral12/memory/3004-5841-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral12/memory/3004-5843-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral12/memory/3004-5844-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral12/memory/3004-5845-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral12/memory/3004-5846-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral12/memory/3004-5847-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral12/memory/3004-5848-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral12/memory/3004-5849-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral12/memory/3004-5852-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral12/memory/3004-5853-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral12/memory/3004-5854-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral12/memory/3004-5855-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral12/memory/3004-5856-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral12/memory/3004-5857-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral12/memory/3004-5858-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral12/memory/3004-5859-0x0000000000400000-0x00000000005DE000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

3c0fe521f6a9cfbfabc1f27a1a64dfc081a63aaaf2a6ce8cd831f6251ee85816.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\""	3c0fe521f6a9cfbfabc1f27a1a64dfc081a63aaaf2a6ce8cd831f6251ee85816.exe

Drops file in System32 directory 1 IoCs

Processes:

3c0fe521f6a9cfbfabc1f27a1a64dfc081a63aaaf2a6ce8cd831f6251ee85816.exe

description	ioc	process
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	3c0fe521f6a9cfbfabc1f27a1a64dfc081a63aaaf2a6ce8cd831f6251ee85816.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

3c0fe521f6a9cfbfabc1f27a1a64dfc081a63aaaf2a6ce8cd831f6251ee85816.exe

pid	process
3004	3c0fe521f6a9cfbfabc1f27a1a64dfc081a63aaaf2a6ce8cd831f6251ee85816.exe
3004	3c0fe521f6a9cfbfabc1f27a1a64dfc081a63aaaf2a6ce8cd831f6251ee85816.exe
3004	3c0fe521f6a9cfbfabc1f27a1a64dfc081a63aaaf2a6ce8cd831f6251ee85816.exe

C:\Users\Admin\AppData\Local\Temp\3c0fe521f6a9cfbfabc1f27a1a64dfc081a63aaaf2a6ce8cd831f6251ee85816.exe
"C:\Users\Admin\AppData\Local\Temp\3c0fe521f6a9cfbfabc1f27a1a64dfc081a63aaaf2a6ce8cd831f6251ee85816.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:3004

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System32\catroot2\dberr.txt
Filesize
112KB

MD5
b3aa3331a2ea89acc58b9abc0f1fbd6f

SHA1
c0e146205ed17734b639bb19edc15f4d95cf746b

SHA256
2ef5a268c44a97d94cf5e8b54bfbc7859a497c9598c592fabb9797953ddb9d7f

SHA512
6cabd1351b9b2a5f0f34c6f7f3d4bbe733ac96bba131a9de89fcf90fa59977e75665046df081f9b2aca1be1cb4ba1bebb3418efb6da7907e8f1f8a18d981cf62

Download Submit
C:\Windows\System32\catroot2\dberr.txt
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/3004-5844-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/3004-5830-0x0000000002D40000-0x0000000002E08000-memory.dmp

Filesize
800KB

Download
memory/3004-5845-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/3004-5846-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/3004-5832-0x0000000002D40000-0x0000000002E08000-memory.dmp

Filesize
800KB

Download
memory/3004-5834-0x0000000002D40000-0x0000000002E08000-memory.dmp

Filesize
800KB

Download
memory/3004-5833-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/3004-5836-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/3004-5837-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/3004-5841-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/3004-5842-0x0000000002320000-0x0000000002430000-memory.dmp

Filesize
1.1MB

Download
memory/3004-5843-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/3004-5859-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/3004-5829-0x0000000002320000-0x0000000002430000-memory.dmp

Filesize
1.1MB

Download
memory/3004-5831-0x0000000002D40000-0x0000000002E08000-memory.dmp

Filesize
800KB

Download
memory/3004-5847-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/3004-5848-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/3004-5849-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/3004-5852-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/3004-5853-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/3004-5854-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/3004-5855-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/3004-5856-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/3004-5857-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/3004-5858-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/3004-0-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download