triumphloader | a7a7246ae8bed2509e3ff7aca7cb226c203d651e8fdeadeeb64c934d60a4c99e

Analysis

max time kernel
164s
max time network
178s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29/01/2023, 15:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a7a7246ae8bed2509e3ff7aca7cb226c203d651e8fdeadeeb64c934d60a4c99e.exe
Size

1.0MB
MD5

0b2d6f1c38893c7039dd14f037d8eb65
SHA1

6e0d715411d35af8afd3b5231eed8c6c472be5e2
SHA256

a7a7246ae8bed2509e3ff7aca7cb226c203d651e8fdeadeeb64c934d60a4c99e
SHA512

9b6aaf257bf9ae40c8f4c677a4541594934a9b14313122f0d40eee7fd1b402f41b8f2e7254facfd006632142a3a1e6058c1eeceaa2334f06da2122b1a1ad264b
SSDEEP

12288:7zJh2QhJry48ceJ04g7gsd4iycJ3LA969Fe0suC0Hxl/wEGaZpo37U:XJQQN8ceJ0v7gseqcBi/m7U

Score

10^/10

triumphloader loader trojan

Malware Config

Signatures

TriumphLoader
TriumphLoader is a c++ loader based on the open source AbsentLoader.
trojan loader triumphloader

TriumphLoader payload 4 IoCs

resource	yara_rule
behavioral2/memory/4252-134-0x0000000000400000-0x0000000000506000-memory.dmp	family_triumphloader
behavioral2/memory/4252-135-0x0000000000400000-0x0000000000506000-memory.dmp	family_triumphloader
behavioral2/memory/4252-137-0x0000000000400000-0x0000000000506000-memory.dmp	family_triumphloader
behavioral2/memory/4252-142-0x0000000000400000-0x0000000000506000-memory.dmp	family_triumphloader

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	a7a7246ae8bed2509e3ff7aca7cb226c203d651e8fdeadeeb64c934d60a4c99e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
308	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2108	timeout.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4252 wrote to memory of 4392	4252	a7a7246ae8bed2509e3ff7aca7cb226c203d651e8fdeadeeb64c934d60a4c99e.exe	82
PID 4252 wrote to memory of 4392	4252	a7a7246ae8bed2509e3ff7aca7cb226c203d651e8fdeadeeb64c934d60a4c99e.exe	82
PID 4252 wrote to memory of 4392	4252	a7a7246ae8bed2509e3ff7aca7cb226c203d651e8fdeadeeb64c934d60a4c99e.exe	82
PID 4252 wrote to memory of 4660	4252	a7a7246ae8bed2509e3ff7aca7cb226c203d651e8fdeadeeb64c934d60a4c99e.exe	84
PID 4252 wrote to memory of 4660	4252	a7a7246ae8bed2509e3ff7aca7cb226c203d651e8fdeadeeb64c934d60a4c99e.exe	84
PID 4252 wrote to memory of 4660	4252	a7a7246ae8bed2509e3ff7aca7cb226c203d651e8fdeadeeb64c934d60a4c99e.exe	84
PID 4392 wrote to memory of 1444	4392	cmd.exe	86
PID 4392 wrote to memory of 1444	4392	cmd.exe	86
PID 4392 wrote to memory of 1444	4392	cmd.exe	86
PID 4660 wrote to memory of 2108	4660	cmd.exe	87
PID 4660 wrote to memory of 2108	4660	cmd.exe	87
PID 4660 wrote to memory of 2108	4660	cmd.exe	87
PID 4660 wrote to memory of 308	4660	cmd.exe	88
PID 4660 wrote to memory of 308	4660	cmd.exe	88
PID 4660 wrote to memory of 308	4660	cmd.exe	88

C:\Users\Admin\AppData\Local\Temp\a7a7246ae8bed2509e3ff7aca7cb226c203d651e8fdeadeeb64c934d60a4c99e.exe
"C:\Users\Admin\AppData\Local\Temp\a7a7246ae8bed2509e3ff7aca7cb226c203d651e8fdeadeeb64c934d60a4c99e.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4252
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C reg add "HKEY_CURRENT_USER\Software\NetHelper" /v path /t REG_SZ /d C:\ProgramData\NetHelper\Cache\BQrqshGTkrfJjcezSPsn /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4392
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKEY_CURRENT_USER\Software\NetHelper" /v path /t REG_SZ /d C:\ProgramData\NetHelper\Cache\BQrqshGTkrfJjcezSPsn /f
    3⤵
    PID:1444
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C timeout /t 60 && SCHTASKS /Create /SC MINUTE /MO 1 /TN "Service for windows Network Helper updates" /TR C:\ProgramData\NetHelper\Cache\BQrqshGTkrfJjcezSPsn\xônethelper.exe /F
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4660
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 60
    3⤵
    - Delays execution with timeout.exe
    PID:2108
- - C:\Windows\SysWOW64\schtasks.exe
    SCHTASKS /Create /SC MINUTE /MO 1 /TN "Service for windows Network Helper updates" /TR C:\ProgramData\NetHelper\Cache\BQrqshGTkrfJjcezSPsn\xônethelper.exe /F
    3⤵
    - Creates scheduled task(s)
    PID:308

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4252-132-0x0000000000400000-0x0000000000506000-memory.dmp

Filesize
1.0MB

Download
memory/4252-133-0x0000000002670000-0x0000000002764000-memory.dmp

Filesize
976KB

Download
memory/4252-134-0x0000000000400000-0x0000000000506000-memory.dmp

Filesize
1.0MB

Download
memory/4252-136-0x0000000002670000-0x0000000002764000-memory.dmp

Filesize
976KB

Download
memory/4252-135-0x0000000000400000-0x0000000000506000-memory.dmp

Filesize
1.0MB

Download
memory/4252-137-0x0000000000400000-0x0000000000506000-memory.dmp

Filesize
1.0MB

Download
memory/4252-142-0x0000000000400000-0x0000000000506000-memory.dmp

Filesize
1.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads