Analysis
-
max time kernel
153s -
max time network
583s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
29/01/2023, 16:13
General
-
Target
fe0f17aefe66829e9b1ec1d524b7946c1cc56b3f34b26e7591b36907d89601e1.exe
-
Size
485KB
-
MD5
5146a6bc71523d8d55a72b3c4a6d3775
-
SHA1
9d5dfa47ef983b71bc1ce4df4bb1b14227c8bf9b
-
SHA256
fe0f17aefe66829e9b1ec1d524b7946c1cc56b3f34b26e7591b36907d89601e1
-
SHA512
09c5d89e5161180e59bb9262cffcdfa7f5cd1ad7c24f53d3a3aa0de01205a4b501bb00e708288d8821e3ddb3bb3c881d453dbeb40c5e39ac1d84f762e2cede7a
-
SSDEEP
12288:R58Ho4fOnN+Kt0iIBuDIzZe7C4lJvjTfuWa:R6FM+KDDIzY7Pu
Score
10/10
Malware Config
Signatures
-
TriumphLoader
TriumphLoader is a c++ loader based on the open source AbsentLoader.
-
TriumphLoader payload 4 IoCs
-
Program crash 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fe0f17aefe66829e9b1ec1d524b7946c1cc56b3f34b26e7591b36907d89601e1.exe"C:\Users\Admin\AppData\Local\Temp\fe0f17aefe66829e9b1ec1d524b7946c1cc56b3f34b26e7591b36907d89601e1.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3548 -s 7482⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3548 -s 8042⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 3548 -ip 35481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3548 -ip 35481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 3548 -ip 35481⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
244KB
-
Filesize
508KB
-
Filesize
244KB
-
Filesize
39.9MB
-
Filesize
508KB
-
Filesize
39.9MB