troldesh | 23aa29c51dfaab97c07c2b1f9e61c9aabd1a8db97750ec1864b42cd2184710be

Analysis

max time kernel
411s
max time network
393s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
18-05-2024 19:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

inf.exe
Size

1.3MB
MD5

73dea1a75637e14f6fcd012fe2815636
SHA1

f1edca0d6464b76bc4956352571d8941c02d2c4e
SHA256

fd03dd58aa7cb5236f4df8cde3fb07af304c6f402cd48b86eefcecb8e7b86883
SHA512

f6dc462194037a5c4e0b186088f1fd75befe4cb88bf1dcc7477987951332fc18f8aa66389d567e01677990b022fea6849a66a24510027794e12e2a517edde8d0
SSDEEP

24576:SkMiDApH5iholXZFFqn14hhzk8wncu0Z9Ml+5PkjyDs5U2cuC:tApsolXTF8mhC1c9WCkjMs5Uq

Score

10^/10

troldesh discovery persistence ransomware spyware stealer trojan upx

Malware Config

Signatures

Troldesh, Shade, Encoder.858
Troldesh is a ransomware spread by malspam.
ransomware trojan troldesh
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 49 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4624-1-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/4624-2-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/4624-4-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/4624-5-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/4624-7-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/4624-3-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/4624-8-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/4624-11-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/4624-12-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/4624-13-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/4624-15-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/4624-16-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/4624-17-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/4624-20-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/4624-21-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/4624-22-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/4624-23-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/4624-24-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/4624-25-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/4624-26-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/4624-27-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/4624-28-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/4624-29-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/4624-30-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/4624-31-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/4624-32-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/4624-33-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/4624-34-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/4624-35-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/4624-36-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/4624-37-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/4624-38-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/4624-39-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/4624-40-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/4624-41-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/4624-42-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/4624-43-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/4624-44-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/4624-45-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/4624-46-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/4624-47-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/4624-48-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/4624-49-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/4624-50-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/4624-51-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/4624-52-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/4624-53-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/4624-54-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/4624-74-0x0000000000400000-0x0000000000608000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

inf.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2551177587-3778486488-1329702901-1000\Software\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\""	inf.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Modifies registry class 1 IoCs

Processes:

MiniSearchHost.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2551177587-3778486488-1329702901-1000_Classes\Local Settings\MuiCache MiniSearchHost.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

inf.exe

pid process

4624 inf.exe
4624 inf.exe
4624 inf.exe
4624 inf.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

MiniSearchHost.exe

pid process

4712 MiniSearchHost.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2551177587-3778486488-1329702901-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe

pid	process
4624	inf.exe
4624	inf.exe
4624	inf.exe
4624	inf.exe

pid	process
4712	MiniSearchHost.exe

C:\Users\Admin\AppData\Local\Temp\inf.exe
"C:\Users\Admin\AppData\Local\Temp\inf.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:4624

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4712

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
Filesize
10KB

MD5
bca013349ea9cbfeae8a6a2fcfc0a968

SHA1
e6e8031627dd6efee732345a879d37bb8f5bbb62

SHA256
72996bfeb0e86a9816bd2521deb29d43117b8ea2dd12e81e002222131a40b672

SHA512
6adc3a35c751ee3aec51ffc33c00113e5c795b7925ea31cd9f412b386a9e1fec54b89a665678ce891e6877f01f981aa5c1c19a24fc9ee8687e8b72a39b4478e1

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
Filesize
10KB

MD5
113d26c6d5bf518bf98f08c69313c555

SHA1
6a7f0c789d2772333899eda3b8c03ec765ec0570

SHA256
01e2576ea162b3f2759ccc3ef9819bcf76d672718c585519c89db04207f3e63c

SHA512
36e058803b10e4c9f6cdc5f47adf1522e197dfb3934d2b01d133f57485517677a91766624f36dfe8d3bf4461650f5a21d8fa7525468d9536b07765ddcd676d60

Download Submit
memory/4624-0-0x0000000002320000-0x00000000023F5000-memory.dmp

Filesize
852KB

Download
memory/4624-1-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4624-2-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4624-4-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4624-5-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4624-7-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4624-3-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4624-8-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4624-11-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4624-12-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4624-14-0x0000000002320000-0x00000000023F5000-memory.dmp

Filesize
852KB

Download
memory/4624-13-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4624-15-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4624-16-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4624-17-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4624-20-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4624-21-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4624-22-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4624-23-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4624-24-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4624-25-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4624-26-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4624-27-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4624-28-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4624-29-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4624-30-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4624-31-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4624-32-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4624-33-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4624-34-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4624-35-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4624-36-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4624-37-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4624-38-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4624-39-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4624-40-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4624-41-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4624-42-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4624-43-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4624-44-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4624-45-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4624-46-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4624-47-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4624-48-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4624-49-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4624-50-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4624-51-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4624-52-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4624-53-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4624-54-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/4624-74-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download