Analysis
-
max time kernel
119s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
12/08/2024, 16:52
Static task
static1
Behavioral task
behavioral1
Sample
8f85ebeafa44681fc4b8e10342722499_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
8f85ebeafa44681fc4b8e10342722499_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
8f85ebeafa44681fc4b8e10342722499_JaffaCakes118.exe
-
Size
485KB
-
MD5
8f85ebeafa44681fc4b8e10342722499
-
SHA1
fbdb1a95913a752cbe80313cc80d4363b9bfc981
-
SHA256
1e3d43db0f7df4d61d57d9c867f9217ba69c61b58563a3893ea4fff75cf81a1e
-
SHA512
3959fb203d6c2bf6f445c026d36f7e7848271a84b8e9132a1e58d8b24c9903617dd2e34677e5422d75702faef1d6e0e775f8745202d3b4dd288fb319beae1900
-
SSDEEP
6144:GCrmIi+E4cu3O6Jgb2Wf3urb7+ubYihDwUWxid9ZKWw8Um5uukm8nz1lxWdF:7mIiR5u+6ebl3A+ubYK0Uy2ZKJnzRW
Malware Config
Signatures
-
TriumphLoader
TriumphLoader is a c++ loader based on the open source AbsentLoader.
-
TriumphLoader payload 5 IoCs
resource yara_rule behavioral1/memory/1928-3-0x0000000000400000-0x0000000000482000-memory.dmp family_triumphloader behavioral1/memory/1928-2-0x0000000000220000-0x000000000029F000-memory.dmp family_triumphloader behavioral1/memory/1928-4-0x0000000000400000-0x0000000002BF0000-memory.dmp family_triumphloader behavioral1/memory/1928-6-0x0000000000400000-0x0000000000482000-memory.dmp family_triumphloader behavioral1/memory/1928-5-0x0000000000400000-0x0000000002BF0000-memory.dmp family_triumphloader