triumphloader | d66a644a2ce11f18d87ee7fd0fe6cedd44dbff28b952ea6ecd17617cfc2a9095

Analysis

Target

d66a644a2ce11f18d87ee7fd0fe6cedd44dbff28b952ea6ecd17617cfc2a9095.exe
Size

414KB
MD5

9c212da781d631789af40e3b5a72d26b
SHA1

e157431a391504f6eb6050af1c576b218884bf3b
SHA256

d66a644a2ce11f18d87ee7fd0fe6cedd44dbff28b952ea6ecd17617cfc2a9095
SHA512

1d1e3cc3adb3df32185ecd61a6c52ef6d66e52f1b37eab0cc0b6c7e61b726144773ead33f16a12f26966803f0b739b6992e7b62e5c01fedb651b094a9acd7c8c

Score

10^/10

TriumphLoader
TriumphLoader is a c++ loader based on the open source AbsentLoader.
trojan loader triumphloader

TriumphLoader Payload 2 IoCs

resource	yara_rule
behavioral1/memory/912-56-0x0000000000260000-0x00000000002C7000-memory.dmp	family_triumphloader
behavioral1/memory/912-57-0x0000000000400000-0x0000000002325000-memory.dmp	family_triumphloader

Program crash 1 IoCs

pid	pid_target	Process	procid_target
328	912	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 912 wrote to memory of 328	912	d66a644a2ce11f18d87ee7fd0fe6cedd44dbff28b952ea6ecd17617cfc2a9095.exe	28
PID 912 wrote to memory of 328	912	d66a644a2ce11f18d87ee7fd0fe6cedd44dbff28b952ea6ecd17617cfc2a9095.exe	28
PID 912 wrote to memory of 328	912	d66a644a2ce11f18d87ee7fd0fe6cedd44dbff28b952ea6ecd17617cfc2a9095.exe	28
PID 912 wrote to memory of 328	912	d66a644a2ce11f18d87ee7fd0fe6cedd44dbff28b952ea6ecd17617cfc2a9095.exe	28

C:\Users\Admin\AppData\Local\Temp\d66a644a2ce11f18d87ee7fd0fe6cedd44dbff28b952ea6ecd17617cfc2a9095.exe
"C:\Users\Admin\AppData\Local\Temp\d66a644a2ce11f18d87ee7fd0fe6cedd44dbff28b952ea6ecd17617cfc2a9095.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:912
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 912 -s 140
  2⤵
  - Program crash
  PID:328

memory/912-54-0x0000000002469000-0x00000000024A1000-memory.dmp

Filesize
224KB

Download
memory/912-55-0x0000000002469000-0x00000000024A1000-memory.dmp

Filesize
224KB

Download
memory/912-56-0x0000000000260000-0x00000000002C7000-memory.dmp

Filesize
412KB

Download
memory/912-57-0x0000000000400000-0x0000000002325000-memory.dmp

Filesize
31.1MB

Download
memory/912-58-0x0000000076C81000-0x0000000076C83000-memory.dmp

Filesize
8KB

Download