trident_loader[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
trident_loader.exe
Size 2.2MB
Sample260929-tg7c5sysgx
SHA256 eee05510638c18590a5f23352760c91f7d6d4d40de0dd94a07e1b11a9ae59163
MD5 e1b68fd3664c83b26a9de187522966ee
SHA1 b0d2366fccbbec65a7823ccd5f35f662cb03a9d3
SHA512 98a5fa57ca4521192b99a135954ab41addbe226979f85848d091b2597acdf461c6f6b836741018d7a871b9e0d20d9d31301653430da94cf5d8e52435a73e39dc
SSDEEP 49152:FSSMJf/TsxIQZcZj2tgHleAeuQYmHfTKFikKxHCYDw+nYyU1mo:FJM1/YXcZj+gH8rHrKF12HCAwOZU1mo
TLSH
T10DB523C6B5DA0EF5E019B578C2732445E34D3171DEE256127A1CAF5EBECB82380FA681
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
trident_loader.exe

File Explorer

trident_loader.exe

.exe 2.2MB

trident_loader.exe

IMPHASH 48b9ceb4e431f29c0c3da4562183d919
SHA256 eee05510638c18590a5f23352760c91f7d6d4d40de0dd94a07e1b11a9ae59163
MD5 e1b68fd3664c83b26a9de187522966ee
SHA1 b0d2366fccbbec65a7823ccd5f35f662cb03a9d3
SHA512 98a5fa57ca4521192b99a135954ab41addbe226979f85848d091b2597acdf461c6f6b836741018d7a871b9e0d20d9d31301653430da94cf5d8e52435a73e39dc
SSDEEP 49152:FSSMJf/TsxIQZcZj2tgHleAeuQYmHfTKFikKxHCYDw+nYyU1mo:FJM1/YXcZj+gH8rHrKF12HCAwOZU1mo
TLSH
T10DB523C6B5DA0EF5E019B578C2732445E34D3171DEE256127A1CAF5EBECB82380FA681
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4828837

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ws2_32

WSACleanup

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

ntdll

NtQueryInformationProcess

shell32

ShellExecuteA

advapi32

AdjustTokenPrivileges

kernel32

AcquireSRWLockExclusive

user32

ClientToScreen

msvcp140

??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ

imm32

ImmGetContext

bcrypt

BCryptGenRandom

crypt32

CertAddCertificateContextToStore

wldap32

ord301

vcruntime140

_CxxThrowException

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func

api-ms-win-crt-runtime-l1-1-0

__sys_errlist

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-filesystem-l1-1-0

_fstat64

api-ms-win-crt-time-l1-1-0

_gmtime64

api-ms-win-crt-multibyte-l1-1-0

_mbschr

api-ms-win-crt-string-l1-1-0

_strdup

api-ms-win-crt-convert-l1-1-0

atoi

api-ms-win-crt-heap-l1-1-0

_callnewh

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-utility-l1-1-0

qsort

Name

.text

Size

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

534KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

54KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

Virtual Size

61KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.,([

Size

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.l&g

Size

512B

Virtual Size

456B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.cdR

Size

2.2MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

463B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

64B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

trident_loader.exe

ws2_32

d3d11

d3dcompiler_47

ntdll

shell32

advapi32

kernel32

user32

msvcp140

imm32

bcrypt

crypt32

wldap32

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-utility-l1-1-0

generic