triumphloader | 3c38eb510b9a2616b648de7734a8772a9739102599e7e128cc520d8b958b57d5

Analysis

max time kernel
27s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29/01/2023, 16:21

Target

3c38eb510b9a2616b648de7734a8772a9739102599e7e128cc520d8b958b57d5.exe
Size

368KB
MD5

17358cc82a59b6403afb0ab287ab5629
SHA1

778da0baf186f31b6c7b525fc112bb070514f4b0
SHA256

3c38eb510b9a2616b648de7734a8772a9739102599e7e128cc520d8b958b57d5
SHA512

8a58ef4a5bb03337f785bf2dcf1e212b6f28e5bbb8da906b84e4e1d8b6c4c70e361a4ca1235e1cffab9b5e899e869ee8782ec7e114018a2d1315f09190d6fc89
SSDEEP

6144:NbfDIM2SpQtijNZ9ZtEYB5bY0xRWRrrDJwwD4GizoIVwoeyEE30GLfijJO:Nb0eCy9ZtEwmzaw0GizBi3yEs/Lfq

Score

10^/10

TriumphLoader
TriumphLoader is a c++ loader based on the open source AbsentLoader.
trojan loader triumphloader

TriumphLoader payload 3 IoCs

resource	yara_rule
behavioral1/memory/1516-55-0x0000000000380000-0x00000000003FF000-memory.dmp	family_triumphloader
behavioral1/memory/1516-56-0x0000000000400000-0x0000000000856000-memory.dmp	family_triumphloader
behavioral1/memory/1516-59-0x0000000000400000-0x0000000000856000-memory.dmp	family_triumphloader

C:\Users\Admin\AppData\Local\Temp\3c38eb510b9a2616b648de7734a8772a9739102599e7e128cc520d8b958b57d5.exe
"C:\Users\Admin\AppData\Local\Temp\3c38eb510b9a2616b648de7734a8772a9739102599e7e128cc520d8b958b57d5.exe"
1⤵
PID:1516

memory/1516-54-0x00000000009CA000-0x0000000000A06000-memory.dmp

Filesize
240KB

Download
memory/1516-55-0x0000000000380000-0x00000000003FF000-memory.dmp

Filesize
508KB

Download
memory/1516-56-0x0000000000400000-0x0000000000856000-memory.dmp

Filesize
4.3MB

Download
memory/1516-57-0x0000000075C81000-0x0000000075C83000-memory.dmp

Filesize
8KB

Download
memory/1516-58-0x00000000009CA000-0x0000000000A06000-memory.dmp

Filesize
240KB

Download
memory/1516-59-0x0000000000400000-0x0000000000856000-memory.dmp

Filesize
4.3MB

Download