Overview

overview

5

Static

static

3

trident_loader.exe

windows11-21h2-x64

5

Analysis

  • user interaction
    yes
  • max time kernel
    598s
  • max time network
    514s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260911-en
  • resource tags

    arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    30/09/2026, 06:36

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    trident_loader.exe
  • Size 2.2MB
  • Sample260930-hdazzsha57
  • SHA256 d57cf22195b4896467ccba44c6cc302f55d9083a560856ca2bc96ecdf41efb03
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
defense_evasion

Malware Config

Signatures

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 6 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\trident_loader.exe
    "C:\Users\Admin\AppData\Local\Temp\trident_loader.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:4816
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:3332
    • C:\Users\Admin\AppData\Local\Temp\trident_loader.exe
      "C:\Users\Admin\AppData\Local\Temp\trident_loader.exe"
      1⤵
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:2360
    • C:\Users\Admin\AppData\Local\Temp\trident_loader.exe
      "C:\Users\Admin\AppData\Local\Temp\trident_loader.exe"
      1⤵
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:4580

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          memory/2360-7-0x00007FF6797B0000-0x00007FF679D16000-memory.dmp
          Download

          memory/2360-10-0x00007FF6797B0000-0x00007FF679D16000-memory.dmp
          Download

          memory/2360-13-0x00007FF6797B0000-0x00007FF679D16000-memory.dmp
          Download

          memory/4580-17-0x00007FF6797B0000-0x00007FF679D16000-memory.dmp
          Download

          memory/4816-0-0x00007FF6799C7000-0x00007FF679AE0000-memory.dmp
          Download

          memory/4816-1-0x00007FFB36230000-0x00007FFB36232000-memory.dmp
          Download

          memory/4816-2-0x00007FF6797B0000-0x00007FF679D16000-memory.dmp
          Download

          memory/4816-6-0x00007FF6799C7000-0x00007FF679AE0000-memory.dmp
          Download