triumphloader | c7af3849210fbedaa9447012d804ccb362d66a34e7d636ea1b97d0a8115f022c

General

Target

ed5c086f90c82e755393dd4d183d8323.exe
Size

369KB
MD5

ed5c086f90c82e755393dd4d183d8323
SHA1

50900629dd2d2e39d67e8fa098e2460e2d899139
SHA256

c7af3849210fbedaa9447012d804ccb362d66a34e7d636ea1b97d0a8115f022c
SHA512

7345707c182898eb134250dd3de5870a36c45a522a363d7c9b06df72b9fe81785c4c448d8efb2a748a5b578783d6282ce499d03f2ce8d624e408f5bde18c328e
SSDEEP

6144:SP+ESgo6HYAkY4u1gXwztMaKjNBl/wO+tLL5A8ybLUxjwi:C+soU7kY4u1Mwz7KjYtLL5AVb

Score

10^/10

triumphloader discovery loader trojan

Malware Config

Signatures

Detects TriumphLoader 5 IoCs

Detects TriumphLoader.

resource	yara_rule
behavioral1/memory/5024-2-0x0000000000A00000-0x0000000000A7F000-memory.dmp	TriumphLoader
behavioral1/memory/5024-3-0x0000000000400000-0x0000000000482000-memory.dmp	TriumphLoader
behavioral1/memory/5024-6-0x0000000000400000-0x0000000000482000-memory.dmp	TriumphLoader
behavioral1/memory/5024-4-0x0000000000400000-0x0000000000856000-memory.dmp	TriumphLoader
behavioral1/memory/5024-5-0x0000000000A00000-0x0000000000A7F000-memory.dmp	TriumphLoader

TriumphLoader
TriumphLoader is a c++ loader based on the open source AbsentLoader.
trojan loader triumphloader

TriumphLoader payload 5 IoCs

resource	yara_rule
behavioral1/memory/5024-2-0x0000000000A00000-0x0000000000A7F000-memory.dmp	family_triumphloader
behavioral1/memory/5024-3-0x0000000000400000-0x0000000000482000-memory.dmp	family_triumphloader
behavioral1/memory/5024-6-0x0000000000400000-0x0000000000482000-memory.dmp	family_triumphloader
behavioral1/memory/5024-4-0x0000000000400000-0x0000000000856000-memory.dmp	family_triumphloader
behavioral1/memory/5024-5-0x0000000000A00000-0x0000000000A7F000-memory.dmp	family_triumphloader

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	ed5c086f90c82e755393dd4d183d8323.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 8 IoCs

pid	pid_target	Process	procid_target
1188	5024	WerFault.exe	83
4492	5024	WerFault.exe	83
4856	5024	WerFault.exe	83
996	5024	WerFault.exe	83
4764	5024	WerFault.exe	83
2704	5024	WerFault.exe	83
4456	5024	WerFault.exe	83
1328	5024	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ed5c086f90c82e755393dd4d183d8323.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
3192	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3244	schtasks.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 5024 wrote to memory of 2712	5024	ed5c086f90c82e755393dd4d183d8323.exe	103
PID 5024 wrote to memory of 2712	5024	ed5c086f90c82e755393dd4d183d8323.exe	103
PID 5024 wrote to memory of 2712	5024	ed5c086f90c82e755393dd4d183d8323.exe	103
PID 5024 wrote to memory of 4440	5024	ed5c086f90c82e755393dd4d183d8323.exe	105
PID 5024 wrote to memory of 4440	5024	ed5c086f90c82e755393dd4d183d8323.exe	105
PID 5024 wrote to memory of 4440	5024	ed5c086f90c82e755393dd4d183d8323.exe	105
PID 2712 wrote to memory of 2416	2712	cmd.exe	107
PID 2712 wrote to memory of 2416	2712	cmd.exe	107
PID 2712 wrote to memory of 2416	2712	cmd.exe	107
PID 4440 wrote to memory of 3192	4440	cmd.exe	108
PID 4440 wrote to memory of 3192	4440	cmd.exe	108
PID 4440 wrote to memory of 3192	4440	cmd.exe	108
PID 4440 wrote to memory of 3244	4440	cmd.exe	116
PID 4440 wrote to memory of 3244	4440	cmd.exe	116
PID 4440 wrote to memory of 3244	4440	cmd.exe	116

C:\Users\Admin\AppData\Local\Temp\ed5c086f90c82e755393dd4d183d8323.exe
"C:\Users\Admin\AppData\Local\Temp\ed5c086f90c82e755393dd4d183d8323.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5024
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5024 -s 736
  2⤵
  - Program crash
  PID:1188
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5024 -s 776
  2⤵
  - Program crash
  PID:4492
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5024 -s 776
  2⤵
  - Program crash
  PID:4856
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5024 -s 832
  2⤵
  - Program crash
  PID:996
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5024 -s 900
  2⤵
  - Program crash
  PID:4764
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5024 -s 1172
  2⤵
  - Program crash
  PID:2704
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5024 -s 1228
  2⤵
  - Program crash
  PID:4456
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C reg add "HKEY_CURRENT_USER\Software\NetHelper" /v path /t REG_SZ /d C:\ProgramData\NetHelper\Cache\VYYxejkIAPrUGckLKKTt /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2712
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKEY_CURRENT_USER\Software\NetHelper" /v path /t REG_SZ /d C:\ProgramData\NetHelper\Cache\VYYxejkIAPrUGckLKKTt /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2416
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C timeout /t 60 && SCHTASKS /Create /SC MINUTE /MO 1 /TN "Service for windows Network Helper updates" /TR C:\ProgramData\NetHelper\Cache\VYYxejkIAPrUGckLKKTt\œÛnethelper.exe /F
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4440
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 60
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:3192
- - C:\Windows\SysWOW64\schtasks.exe
    SCHTASKS /Create /SC MINUTE /MO 1 /TN "Service for windows Network Helper updates" /TR C:\ProgramData\NetHelper\Cache\VYYxejkIAPrUGckLKKTt\œÛnethelper.exe /F
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3244
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5024 -s 1588
  2⤵
  - Program crash
  PID:1328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 372 -p 5024 -ip 5024
1⤵
PID:4832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 5024 -ip 5024
1⤵
PID:4748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 5024 -ip 5024
1⤵
PID:3828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 5024 -ip 5024
1⤵
PID:1340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5024 -ip 5024
1⤵
PID:3608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5024 -ip 5024
1⤵
PID:4996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 5024 -ip 5024
1⤵
PID:1172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 5024 -ip 5024
1⤵
PID:1640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5024-1-0x0000000000A80000-0x0000000000B80000-memory.dmp

Filesize
1024KB

Download
memory/5024-2-0x0000000000A00000-0x0000000000A7F000-memory.dmp

Filesize
508KB

Download
memory/5024-3-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/5024-6-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/5024-4-0x0000000000400000-0x0000000000856000-memory.dmp

Filesize
4.3MB

Download
memory/5024-5-0x0000000000A00000-0x0000000000A7F000-memory.dmp

Filesize
508KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads