trident_loader[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
trident_loader.exe
Size 2.2MB
Sample260929-pmllea1thw
SHA256 3f433aeee53877eb3c59664bf1ad984a59df83f343b2fdf3dc290e9283179efd
MD5 b4112fd0ae865290a52f718a9d251020
SHA1 9418c15f0991c8ae556f77272662893f3a92bb98
SHA512 94a9340c1d243d8eb0bf3388c800a627d651e29eeb3f8ff885daeecd697b1f3742c6213918eaeac0e630b40d21a87ef25d803bfa275009d7e732139a10e109eb
SSDEEP 49152:FSSMJf/TsxIQZcZj2tgHleAeuQYmHfTKFikKxHCYDw+nYyU1m2:FJM1/YXcZj+gH8rHrKF12HCAwOZU1m2
TLSH
T1BEB523C6B5DA0EF5E019B578C2732445E34D3171DEE256127A1CAF5EAECB82380FA681
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
trident_loader.exe

File Explorer

trident_loader.exe

.exe 2.2MB

trident_loader.exe

IMPHASH 48b9ceb4e431f29c0c3da4562183d919
SHA256 3f433aeee53877eb3c59664bf1ad984a59df83f343b2fdf3dc290e9283179efd
MD5 b4112fd0ae865290a52f718a9d251020
SHA1 9418c15f0991c8ae556f77272662893f3a92bb98
SHA512 94a9340c1d243d8eb0bf3388c800a627d651e29eeb3f8ff885daeecd697b1f3742c6213918eaeac0e630b40d21a87ef25d803bfa275009d7e732139a10e109eb
SSDEEP 49152:FSSMJf/TsxIQZcZj2tgHleAeuQYmHfTKFikKxHCYDw+nYyU1m2:FJM1/YXcZj+gH8rHrKF12HCAwOZU1m2
TLSH
T1BEB523C6B5DA0EF5E019B578C2732445E34D3171DEE256127A1CAF5EAECB82380FA681
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4828837

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ws2_32

WSACleanup

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

ntdll

NtQueryInformationProcess

shell32

ShellExecuteA

advapi32

AdjustTokenPrivileges

kernel32

AcquireSRWLockExclusive

user32

ClientToScreen

msvcp140

??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ

imm32

ImmGetContext

bcrypt

BCryptGenRandom

crypt32

CertAddCertificateContextToStore

wldap32

ord301

vcruntime140

_CxxThrowException

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func

api-ms-win-crt-runtime-l1-1-0

__sys_errlist

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-filesystem-l1-1-0

_fstat64

api-ms-win-crt-time-l1-1-0

_gmtime64

api-ms-win-crt-multibyte-l1-1-0

_mbschr

api-ms-win-crt-string-l1-1-0

_strdup

api-ms-win-crt-convert-l1-1-0

atoi

api-ms-win-crt-heap-l1-1-0

_callnewh

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-utility-l1-1-0

qsort

Name

.text

Size

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

534KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

54KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

Virtual Size

61KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.,([

Size

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.l&g

Size

512B

Virtual Size

456B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.cdR

Size

2.2MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

463B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

64B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

trident_loader.exe

ws2_32

d3d11

d3dcompiler_47

ntdll

shell32

advapi32

kernel32

user32

msvcp140

imm32

bcrypt

crypt32

wldap32

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-utility-l1-1-0

generic