Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

albiondata...er.exe

windows11-21h2-x64

7

$PLUGINSDI...LL.dll

windows11-21h2-x64

3

$PLUGINSDI...nu.dll

windows11-21h2-x64

3

$PLUGINSDI...em.dll

windows11-21h2-x64

3

$PLUGINSDI...rd.bmp

windows11-21h2-x64

3

$PLUGINSDI...gs.dll

windows11-21h2-x64

3

LICENSE

windows11-21h2-x64

1

WinPcap_4_1_3.exe

windows11-21h2-x64

7

$PLUGINSDI...ns.dll

windows11-21h2-x64

3

$PLUGINSDI...ns.ini

windows11-21h2-x64

3

$PLUGINSDI...al.ini

windows11-21h2-x64

3

$PLUGINSDI...er.bmp

windows11-21h2-x64

3

$PLUGINSDI...rd.bmp

windows11-21h2-x64

3

$SYSDIR/Packet.dll

windows11-21h2-x64

3

$SYSDIR/pthreadVC.dll

windows11-21h2-x64

3

$SYSDIR/wpcap.dll

windows11-21h2-x64

3

WinPcapInstall.dll

windows11-21h2-x64

3

rpcapd.exe

windows11-21h2-x64

3

albiondata-client.exe

windows11-21h2-x64

1

uninstall.exe

windows11-21h2-x64

7

$PLUGINSDI...LL.dll

windows11-21h2-x64

3

$PLUGINSDI...em.dll

windows11-21h2-x64

3

$PLUGINSDI...rd.bmp

windows11-21h2-x64

3

$PLUGINSDI...gs.dll

windows11-21h2-x64

3

Analysis

  • max time kernel
    1195s
  • max time network
    1160s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    11/11/2024, 17:29

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    albiondata-client-amd64-installer.exe

  • Size

    4.3MB

  • MD5

    4972eb741a31887a10d82fd3a2f2905d

  • SHA1

    f43b4c841ce61b49b0bed3348b93c27bc0dde795

  • SHA256

    2b0a81c38f8a50530de18c0ff5f207739262155a4a309eac3d10f24e5079e7d1

  • SHA512

    1021a291fedf6a7f20643fb2a3926482c731fc6442504a39ccbdc402d55c470f189f73d6eb69e2c225c3d9f040bbf0cfd46ba4aa00e5c45849a77684e7c6e708

  • SSDEEP

    98304:qtSp68NIlEkNDOk2SAVxxL33eLvCkB2SMms41XQo9dbqGh0:qti6WIlPRO86xL33ejCBmHQsdbL+

Score
7/10
discovery

Malware Config

Signatures

  • Loads dropped DLL 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery

Processes

  • C:\Users\Admin\AppData\Local\Temp\albiondata-client-amd64-installer.exe
    "C:\Users\Admin\AppData\Local\Temp\albiondata-client-amd64-installer.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    PID:4448

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nstB577.tmp\LangDLL.dll
    Filesize

    8KB

    MD5

    e5240dcd169abe69a7332d01106e1d84

    SHA1

    2ca68892501102586f6ab4eb99744d7f6138c166

    SHA256

    96c40847d52270061c25743bc9ec4843be1991f3ac36c2d1b78ec04a04437ea4

    SHA512

    519479d1c6bfd4fcb11e0802f9cf5eb7b324577514a986f0fdf07d33ff6a275dc5ac41654aed818d1c30e0bdda543297f4b7886442cbc93066a808cafbaf8a70

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nstB577.tmp\StartMenu.dll
    Filesize

    12KB

    MD5

    d5d2c8404b5f616c2a39cf023c0f63f0

    SHA1

    4f591c857724898429e215c25005ff38c7837776

    SHA256

    e8832ca91b2f909a34fb2d41d9c3c7928c055057c79277eaf5fb0725bcbddaac

    SHA512

    de54487f75212be426d12c342b2a5657d08379f2746549b54d3832e8f9ad0bab63b4c8dc91596fc39f313938afc9c1e5b0f0bb735d08c29cb1f41667f99603eb

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nstB577.tmp\System.dll
    Filesize

    29KB

    MD5

    26c8a92678f1b970ac2a700bb844c309

    SHA1

    c821a5980c31b0b35f1505cde836d6769f45e3a3

    SHA256

    2a7b5d1cab96a5280b0694d0ed54510129626a1ba36a51bd34d546972b7d18b8

    SHA512

    fba6e371853fd6c27097eb7cce7ffc59d71e4f0a9b5e55de06472d094b70c44a409bd82f39d9a27a814e826ab8468c59e947401a3c3ead1f057cbac236588860

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nstB577.tmp\nsDialogs.dll
    Filesize

    14KB

    MD5

    8f45e78d9d02ca8a9f9c274a8bfe2a57

    SHA1

    9b3838e1d2d4fbc1c84e1252747e96aa1b223d83

    SHA256

    78f9594721361fd3415b8c5194f9c9b87c580d6a70ddb95f2c4743c61ce68ebe

    SHA512

    125f1bcf833e0c233ebee552c164d9726769f06e5163467888abea08048fdae60a94b903ef97ba82ca9cf684f3c027d9605d54e9efe794df3e452f9b20e4ca96

    Download Submit

  • memory/4448-16-0x0000000000400000-0x000000000048A000-memory.dmp

    Filesize

    552KB

    Download

  • memory/4448-18-0x0000000073EA0000-0x0000000073EAF000-memory.dmp

    Filesize

    60KB

    Download

  • memory/4448-17-0x0000000073F50000-0x0000000073F5C000-memory.dmp

    Filesize

    48KB

    Download

  • memory/4448-19-0x0000000000400000-0x000000000048A000-memory.dmp

    Filesize

    552KB

    Download

  • memory/4448-26-0x0000000000400000-0x000000000048A000-memory.dmp

    Filesize

    552KB

    Download

  • memory/4448-29-0x0000000073E00000-0x0000000073E0C000-memory.dmp

    Filesize

    48KB

    Download