triumphloader | b64409a8a96c8049183132c22020fb723f2949cf1ee034e18d656d37a4d30e8f

Analysis

max time kernel
91s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
30/11/2022, 19:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b64409a8a96c8049183132c22020fb723f2949cf1ee034e18d656d37a4d30e8f.exe
Size 974KB
Sample221130-xsdrraff86
SHA256 b64409a8a96c8049183132c22020fb723f2949cf1ee034e18d656d37a4d30e8f
MD5 f5ed4a29db1a7970304b8ecf87c7dc52
SHA1 9219076e0e0606370e56fe669c2d15d46471509b
SHA512 69b4d4bda95bd1af83e80d5ec594b3d2b66bd784fbb0a20a1267594fff97fbd4a6bc4ed33d42e2baeb94fb4eb976e889f23781b8d979a63d49edb28024eaac11
SSDEEP 12288:yH0Hxl/wEGaZpo37UBh2QhJry48ceJ04g7gsd4iycJ3LA969Fe0su:ki/m7UBQQN8ceJ0v7gseqc
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

triumphloader loader trojan

Malware Config

Signatures

TriumphLoader
TriumphLoader is a c++ loader based on the open source AbsentLoader.
trojan loader triumphloader

TriumphLoader payload 4 IoCs

resource	yara_rule
behavioral2/memory/3488-134-0x0000000000400000-0x00000000004F6000-memory.dmp	family_triumphloader
behavioral2/memory/3488-135-0x0000000000400000-0x00000000004F6000-memory.dmp	family_triumphloader
behavioral2/memory/3488-136-0x0000000000400000-0x00000000004F6000-memory.dmp	family_triumphloader
behavioral2/memory/3488-141-0x0000000000400000-0x00000000004F6000-memory.dmp	family_triumphloader

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	b64409a8a96c8049183132c22020fb723f2949cf1ee034e18d656d37a4d30e8f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3156	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2816	timeout.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3488 wrote to memory of 1848	3488	b64409a8a96c8049183132c22020fb723f2949cf1ee034e18d656d37a4d30e8f.exe	87
PID 3488 wrote to memory of 1848	3488	b64409a8a96c8049183132c22020fb723f2949cf1ee034e18d656d37a4d30e8f.exe	87
PID 3488 wrote to memory of 1848	3488	b64409a8a96c8049183132c22020fb723f2949cf1ee034e18d656d37a4d30e8f.exe	87
PID 3488 wrote to memory of 876	3488	b64409a8a96c8049183132c22020fb723f2949cf1ee034e18d656d37a4d30e8f.exe	89
PID 3488 wrote to memory of 876	3488	b64409a8a96c8049183132c22020fb723f2949cf1ee034e18d656d37a4d30e8f.exe	89
PID 3488 wrote to memory of 876	3488	b64409a8a96c8049183132c22020fb723f2949cf1ee034e18d656d37a4d30e8f.exe	89
PID 1848 wrote to memory of 2552	1848	cmd.exe	91
PID 1848 wrote to memory of 2552	1848	cmd.exe	91
PID 1848 wrote to memory of 2552	1848	cmd.exe	91
PID 876 wrote to memory of 2816	876	cmd.exe	92
PID 876 wrote to memory of 2816	876	cmd.exe	92
PID 876 wrote to memory of 2816	876	cmd.exe	92
PID 876 wrote to memory of 3156	876	cmd.exe	94
PID 876 wrote to memory of 3156	876	cmd.exe	94
PID 876 wrote to memory of 3156	876	cmd.exe	94

C:\Users\Admin\AppData\Local\Temp\b64409a8a96c8049183132c22020fb723f2949cf1ee034e18d656d37a4d30e8f.exe
"C:\Users\Admin\AppData\Local\Temp\b64409a8a96c8049183132c22020fb723f2949cf1ee034e18d656d37a4d30e8f.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3488
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C reg add "HKEY_CURRENT_USER\Software\NetHelper" /v path /t REG_SZ /d C:\ProgramData\NetHelper\Cache\gCiUXjkAyaiBIfWSjukb /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1848
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKEY_CURRENT_USER\Software\NetHelper" /v path /t REG_SZ /d C:\ProgramData\NetHelper\Cache\gCiUXjkAyaiBIfWSjukb /f
    3⤵
    PID:2552
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C timeout /t 60 && SCHTASKS /Create /SC MINUTE /MO 1 /TN "Service for windows Network Helper updates" /TR C:\ProgramData\NetHelper\Cache\gCiUXjkAyaiBIfWSjukb\xônethelper.exe /F
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:876
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 60
    3⤵
    - Delays execution with timeout.exe
    PID:2816
- - C:\Windows\SysWOW64\schtasks.exe
    SCHTASKS /Create /SC MINUTE /MO 1 /TN "Service for windows Network Helper updates" /TR C:\ProgramData\NetHelper\Cache\gCiUXjkAyaiBIfWSjukb\xônethelper.exe /F
    3⤵
    - Creates scheduled task(s)
    PID:3156

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3488-132-0x0000000000400000-0x00000000004F6000-memory.dmp

Download

memory/3488-133-0x0000000002310000-0x0000000002404000-memory.dmp

Download

memory/3488-134-0x0000000000400000-0x00000000004F6000-memory.dmp

Download

memory/3488-135-0x0000000000400000-0x00000000004F6000-memory.dmp

Download

memory/3488-136-0x0000000000400000-0x00000000004F6000-memory.dmp

Download

memory/3488-141-0x0000000000400000-0x00000000004F6000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads