Trigon_Evo_0[.]1[.]0 (2)[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Trigon_Evo_0.1.0 (2).exe
Size 16.3MB
Sample250703-ebq2msap4w
SHA256 a0e18cc75cb4f9a0b89f20fad7a8a6a34b8a4a464cd0063cd413f5685339cfb1
MD5 db88f7f69ac4e6f19f34159d827ef4ed
SHA1 8b083ef12cfd933b10b2c8c43b577aa321b51b95
SHA512 a4704657e4b6c3d3e09c897e885550f68ebc6c8c568ada36f7325a76a8d8d17de6203903740b6b5ece1d00b8eb7307a36571f214b40ee2895a19fad2dfcd91bb
SSDEEP 196608:hR95pgRua6zlmK+PLPTJsBlIFjJJxytv:hR95wZKl7+PLPTJs/Ayt
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Trigon_Evo_0.1.0 (2).exe

File Explorer

Trigon_Evo_0.1.0 (2).exe

.exe 16.3MB

Trigon_Evo_0.1.0 (2).exe

IMPHASH d808e400271273106927d63520ec9dc8
SHA256 a0e18cc75cb4f9a0b89f20fad7a8a6a34b8a4a464cd0063cd413f5685339cfb1
MD5 db88f7f69ac4e6f19f34159d827ef4ed
SHA1 8b083ef12cfd933b10b2c8c43b577aa321b51b95
SHA512 a4704657e4b6c3d3e09c897e885550f68ebc6c8c568ada36f7325a76a8d8d17de6203903740b6b5ece1d00b8eb7307a36571f214b40ee2895a19fad2dfcd91bb
SSDEEP 196608:hR95pgRua6zlmK+PLPTJsBlIFjJJxytv:hR95wZKl7+PLPTJs/Ayt
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

9648696

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

trigon_evo.pdb

ntdll

NtWriteFile NtDeviceIoControlFile NtCancelIoFileEx NtOpenFile NtReadFile RtlNtStatusToDosError RtlGetVersion NtCreateFile

kernel32

LoadLibraryExA GetLastError TlsFree TlsSetValue TlsGetValue HeapAlloc TlsAlloc EncodePointer RaiseException IsProcessorFeaturePresent IsDebuggerPresent GetSystemTimeAsFileTime ResetEvent SetEvent LoadLibraryW FormatMessageW OutputDebugStringA LoadLibraryA lstrlenW RtlPcToFileHeader GetProcAddress OutputDebugStringW GetModuleFileNameW SetHandleInformation GetCurrentThreadId LCIDToLocaleName GetUserDefaultUILanguage CloseHandle FreeLibrary LoadLibraryExW HeapFree GetProcessHeap GetModuleHandleW CreateMutexA WideCharToMultiByte WriteConsoleW MultiByteToWideChar GetConsoleOutputCP CreateProcessW GetWindowsDirectoryW GetSystemDirectoryW CopyFileExW GetFinalPathNameByHandleW DeviceIoControl RemoveDirectoryW MoveFileExW DeleteFileW FindFirstFileExW CreateDirectoryW GetFileInformationByHandleEx FindClose FindNextFileW GetTempPathW GetFullPathNameW CreateThread WaitForMultipleObjects ReadFileEx CreateNamedPipeW ExitProcess SetEnvironmentVariableW CreateEventW ReleaseMutex HeapReAlloc QueryPerformanceFrequency TerminateProcess GetExitCodeProcess SleepEx WriteFileEx GetCurrentProcessId GetStdHandle SetFilePointerEx LeaveCriticalSection GetCurrentProcess SetFileInformationByHandle GetCommandLineW GetEnvironmentStringsW GetCurrentDirectoryW SetLastError RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetSystemInfo QueryPerformanceCounter WaitForSingleObject SetWaitableTimer CreateWaitableTimerExW SwitchToThread GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler CompareStringOrdinal FreeEnvironmentStringsW GetConsoleMode GetFileInformationByHandle ReleaseSemaphore ReadDirectoryChangesW CreateSemaphoreW CancelIo WaitForSingleObjectEx GetModuleHandleA Sleep SetFileCompletionNotificationModes GetQueuedCompletionStatusEx PostQueuedCompletionStatus GetOverlappedResult ReadFile CreateIoCompletionPort GetEnvironmentVariableW CreateFileW GetFileAttributesW FlushFileBuffers WriteFile CreateFileA EnterCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection InitializeSListHead UnhandledExceptionFilter SetUnhandledExceptionFilter RtlUnwindEx DuplicateHandle

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

ole32

CoUninitialize CoTaskMemFree CoTaskMemAlloc CoInitializeEx CoInitialize RevokeDragDrop CoCreateFreeThreadedMarshaler RegisterDragDrop OleInitialize CoCreateInstance

shell32

DragQueryFileW DragFinish SHCreateItemFromParsingName SHOpenFolderAndSelectItems SHAppBarMessage ShellExecuteExW ILFree SHGetKnownFolderPath ILCreateFromPathW

user32

IsWindowEnabled FindWindowExW GetWindowLongPtrW GetParent SetWindowLongPtrW GetWindowRect SetWindowRgn GetDC IsProcessDPIAware ReleaseDC ShowWindow SetFocus RegisterWindowMessageA GetWindow MapWindowPoints SetParent CreateWindowExW SetWindowPos RegisterRawInputDevices MsgWaitForMultipleObjectsEx DispatchMessageA EnumChildWindows IsIconic MapVirtualKeyW GetMessageA SendMessageW RedrawWindow TranslateMessage DispatchMessageW PostMessageW PostThreadMessageW DefWindowProcW GetUpdateRect RegisterClassExW ValidateRect ClientToScreen ChangeDisplaySettingsExW DestroyWindow TranslateAcceleratorW AdjustWindowRect PeekMessageW SetWindowPlacement GetWindowPlacement InvalidateRgn LoadCursorW SetCursor SetCursorPos InvalidateRect UpdateWindow GetActiveWindow FlashWindowEx AdjustWindowRectEx IsWindow GetSystemMetrics GetMessageW RegisterTouchWindow GetMonitorInfoW MonitorFromWindow GetCursorPos GetForegroundWindow EnableWindow ScreenToClient GetWindowLongW GetClientRect MonitorFromRect CloseTouchInputHandle PostQuitMessage TrackPopupMenu CheckMenuItem SetMenuItemInfoW AppendMenuW GetTouchInputInfo InsertMenuW CreateAcceleratorTableW DestroyAcceleratorTable CreatePopupMenu CreateMenu DestroyMenu RemoveMenu SetMenu DrawMenuBar DrawTextW GetWindowDC OffsetRect GetMenuBarInfo DrawIconEx GetMenuItemInfoW FillRect GetAsyncKeyState GetKeyboardState ToUnicodeEx GetKeyState MapVirtualKeyExW CreateIcon SetWindowLongW EnableMenuItem GetSystemMenu SystemParametersInfoA SetPropW IsWindowVisible ClipCursor GetClipCursor ShowCursor GetMenu GetKeyboardLayout SendInput SetForegroundWindow SetWindowDisplayAffinity GetWindowTextW GetWindowTextLengthW SetWindowTextW GetRawInputData MonitorFromPoint EnumDisplayMonitors DestroyIcon SystemParametersInfoW ReleaseCapture TrackMouseEvent SetCapture

comctl32

SetWindowSubclass TaskDialogIndirect DefSubclassProc RemoveWindowSubclass

gdi32

CreateCompatibleDC DeleteDC CreateRectRgn GetDeviceCaps CombineRgn CreateSolidBrush CreateDIBSection BitBlt DeleteObject SetBkMode SetTextColor SelectObject

dwmapi

DwmGetWindowAttribute DwmSetWindowAttribute DwmEnableBlurBehindWindow

shlwapi

SHCreateMemStream

advapi32

RegCloseKey RegGetValueW RegQueryValueExW RegOpenKeyExW SystemFunction036 EventRegister EventSetInformation EventWriteTransfer EventUnregister

oleaut32

SetErrorInfo GetErrorInfo SysFreeString SysStringLen

bcryptprimitives

ProcessPrng

bcrypt

BCryptGenRandom

ws2_32

freeaddrinfo getaddrinfo WSACleanup WSAStartup WSAGetLastError WSAIoctl setsockopt WSASend select recv shutdown ioctlsocket connect bind WSASocketW getsockname getpeername getsockopt closesocket send

secur32

DeleteSecurityContext DecryptMessage QueryContextAttributesW AcquireCredentialsHandleA ApplyControlToken AcceptSecurityContext EncryptMessage FreeContextBuffer InitializeSecurityContextW FreeCredentialsHandle

crypt32

CertVerifyCertificateChainPolicy CertFreeCertificateContext CertAddCertificateContextToStore CertDuplicateCertificateContext CertEnumCertificatesInStore CertOpenStore CertGetCertificateChain CertDuplicateStore CertCloseStore CertFreeCertificateChain CertDuplicateCertificateChain

api-ms-win-crt-math-l1-1-0

floor pow trunc roundf __setusermatherr round

api-ms-win-crt-string-l1-1-0

_wcsicmp strcpy_s wcslen wcscmp wcsncmp

api-ms-win-crt-convert-l1-1-0

_ultow_s _wtoi wcstol

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function _configure_narrow_argv _crt_atexit _set_app_type _seh_filter_exe _initialize_narrow_environment _get_initial_narrow_environment _initterm _initterm_e terminate exit _exit abort __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _initialize_onexit_table

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc _callnewh

Name

.text

Size

9.4MB

Virtual Size

9.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

6.3MB

Virtual Size

6.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

13KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

567KB

Virtual Size

566KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

37KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

37KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Trigon_Evo_0.1.0 (2).exe

ntdll

kernel32

api-ms-win-core-synch-l1-2-0

ole32

shell32

user32

comctl32

gdi32

dwmapi

shlwapi

advapi32

oleaut32

bcryptprimitives

bcrypt

ws2_32

secur32

crypt32

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic