Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

3

albiondata...er.exe

windows7-x64

8

albiondata...er.exe

windows10-2004-x64

7

$PLUGINSDI...LL.dll

windows7-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...nu.dll

windows7-x64

3

$PLUGINSDI...nu.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows7-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

WinPcap_4_1_3.exe

windows7-x64

7

WinPcap_4_1_3.exe

windows10-2004-x64

7

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$SYSDIR/Packet.dll

windows7-x64

3

$SYSDIR/Packet.dll

windows10-2004-x64

3

$SYSDIR/pthreadVC.dll

windows7-x64

3

$SYSDIR/pthreadVC.dll

windows10-2004-x64

3

$SYSDIR/wpcap.dll

windows7-x64

3

$SYSDIR/wpcap.dll

windows10-2004-x64

3

WinPcapInstall.dll

windows7-x64

3

WinPcapInstall.dll

windows10-2004-x64

3

rpcapd.exe

windows7-x64

1

rpcapd.exe

windows10-2004-x64

3

albiondata-client.exe

windows7-x64

1

albiondata-client.exe

windows10-2004-x64

1

uninstall.exe

windows7-x64

7

uninstall.exe

windows10-2004-x64

7

$PLUGINSDI...LL.dll

windows7-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

Analysis

  • max time kernel
    121s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20241023-en
  • resource tags

    arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
  • submitted
    11/11/2024, 17:36

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    albiondata-client-amd64-installer.exe

  • Size

    4.3MB

  • MD5

    4972eb741a31887a10d82fd3a2f2905d

  • SHA1

    f43b4c841ce61b49b0bed3348b93c27bc0dde795

  • SHA256

    2b0a81c38f8a50530de18c0ff5f207739262155a4a309eac3d10f24e5079e7d1

  • SHA512

    1021a291fedf6a7f20643fb2a3926482c731fc6442504a39ccbdc402d55c470f189f73d6eb69e2c225c3d9f040bbf0cfd46ba4aa00e5c45849a77684e7c6e708

  • SSDEEP

    98304:qtSp68NIlEkNDOk2SAVxxL33eLvCkB2SMms41XQo9dbqGh0:qti6WIlPRO86xL33ejCBmHQsdbL+

Score
8/10
discovery

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 43 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 12 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • NSIS installer 2 IoCs
    installer
  • Runs net.exe
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 56 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious behavior: LoadsDriver 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\albiondata-client-amd64-installer.exe
    "C:\Users\Admin\AppData\Local\Temp\albiondata-client-amd64-installer.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2412
    • \??\c:\Windows\SysWOW64\schtasks.exe
      c:\Windows\System32\schtasks.exe /Create /F /SC ONLOGON /RL HIGHEST /TN "Albion Data Client" /TR "\"C:\Program Files\Albion Data Client\albiondata-client.exe\" -minimize"
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:2844
    • C:\Program Files\Albion Data Client\WinPcap_4_1_3.exe
      "C:\Program Files\Albion Data Client\WinPcap_4_1_3.exe"
      2⤵
      • Drops file in Drivers directory
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2180
      • C:\Windows\SysWOW64\net.exe
        net start npf
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2780
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 start npf
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2248
  • C:\Program Files\Albion Data Client\albiondata-client.exe
    "C:\Program Files\Albion Data Client\albiondata-client.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1712
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /4
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2560
  • C:\Program Files\Albion Data Client\albiondata-client.exe
    "C:\Program Files\Albion Data Client\albiondata-client.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2980
  • C:\Program Files\Albion Data Client\albiondata-client.exe
    "C:\Program Files\Albion Data Client\albiondata-client.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2764
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /4
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    PID:2592

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Albion Data Client\WinPcap_4_1_3.exe
    Filesize

    893KB

    MD5

    a11a2f0cfe6d0b4c50945989db6360cd

    SHA1

    e2516fcd1573e70334c8f50bee5241cdfdf48a00

    SHA256

    fc4623b113a1f603c0d9ad5f83130bd6de1c62b973be9892305132389c8588de

    SHA512

    2652d84eb91ca7957b4fb3ff77313e5dae978960492669242df4f246296f1bedaa48c0d33ffb286b2859a1b86ef5460060b551edca597b4ec60ee08676877c70

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\CabCC25.tmp
    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsjF77A.tmp\bootOptions.ini
    Filesize

    362B

    MD5

    e4b5616803edec8d188869f31fe2913d

    SHA1

    f5b43e1d7e8672e46b93508bc35cec3fdf1986d7

    SHA256

    048b4c74c057ca7f0575487c8fedb6f404ae4f5f4e33dd904c008202f4ba17f7

    SHA512

    04173785ec423b0add1e85d86ccb6787d5fdb83e59e9d66457567009cd487cf93f84f53f1076d0f66429720d6660beccc69b03eda726facf8fe00eeecbd4abb5

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsjF77A.tmp\bootOptions.ini
    Filesize

    371B

    MD5

    959a3f8ffee43aba8f75283532109eb5

    SHA1

    b4b5860a9dff6ca745e1f0d456b4c32fc4f06ff9

    SHA256

    19643ac44625a5e7469c3bdbc7f4f735638f22fcc625e414f0dd5c6ab97b1878

    SHA512

    e7913db3cf8cf206f6f21ac2143c1185606af13824911284447b1b0d1e33a6bf18eea1c877dbd22e3e5740a62a0670f812727d5dff1e786f4bf1062d4feacab4

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsjF77A.tmp\ioSpecial.ini
    Filesize

    556B

    MD5

    315b8ec80a09cfd3b88f0ed9a08064b6

    SHA1

    71a8437c3906a2ffe84d978651d471dd73d8cee5

    SHA256

    177313df6b234f830a7afaf75b2b444a3d55a32d0faaf6f05296d531d3c792c4

    SHA512

    b5c037facb01bfca7fd356c59aad823e917e21277c764cc155b32cd671d01063fe6fa4a7ee430cd1456505f68e8246acc6c52182776f79eb2e6c7316f270a0fe

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsjF77A.tmp\ioSpecial.ini
    Filesize

    578B

    MD5

    27c88bb4e174cca63b97118498959a30

    SHA1

    52f8de4be145bbf3ed26c61c569b5d939939233b

    SHA256

    45ae7008a24809ff6b9317b4e9b3b0a591fa961409f1f7ebe9ca5a73b351a379

    SHA512

    06e6300054b73bd39dc143fd868fad92c5dc058d3f31d5a4e00382a939ef7211f66a3f664bbd9fb2adc9749bce0b6b811ba318b146eeddadeadd1f50dd0a0789

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsjF77A.tmp\modern-wizard.bmp
    Filesize

    25KB

    MD5

    cbe40fd2b1ec96daedc65da172d90022

    SHA1

    366c216220aa4329dff6c485fd0e9b0f4f0a7944

    SHA256

    3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2

    SHA512

    62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\systray_temp_icon_e32448d339e29cb8b7fa5e0fd232b59d
    Filesize

    149KB

    MD5

    e32448d339e29cb8b7fa5e0fd232b59d

    SHA1

    02bb281b53363b89948387d50cbee4269af6c80d

    SHA256

    f7c6c3db18cde3ffc802a4c5745d3158d131f0d2c33cb139b3fdec80f97fcbe6

    SHA512

    29c9577ea2b56779a3f4bc220a091d68cf77257a2ccc2de9196cd29ceaabe2c70f8c6fe9753a3897e159215735d4d9c550e4d6a2768a38de191dc9ace614af00

    Download Submit

  • C:\Windows\system32\drivers\NPF.sys
    Filesize

    35KB

    MD5

    de7fcc77f4a503af4ca6a47d49b3713d

    SHA1

    8206e2d8374f5e7bf626e47d56d2431edc939652

    SHA256

    4bfaa99393f635cd05d91a64de73edb5639412c129e049f0fe34f88517a10fc6

    SHA512

    fdace7ee2593ffe5724db32f4be62bb13aa1ec89e1e01c713d8c1e9891a5a0975d127450024c3388a987a35e546568ecdbcc60c185dc8f8b08ccef67a084b20d

    Download Submit

  • C:\Windows\system32\packet.dll
    Filesize

    105KB

    MD5

    899a5bf1669610cdb78d322ac8d9358b

    SHA1

    80a2e420b99ffe294a523c6c6d87ed09dfc8d82b

    SHA256

    ab3cce674f5216895fd26a073771f82b05d4c8b214a89f0f288a59774a06b14b

    SHA512

    41f2459793ac04e433d8471780e770417afac499dc3c5413877d4a4499656c9669c069d24e638d0aaf43af178a763acb656ffd34d710eb5e3c94682db1559056

    Download Submit

  • \Program Files (x86)\WinPcap\WinPcapInstall.dll
    Filesize

    91KB

    MD5

    e78291558cb803dfd091ad8fb56feecc

    SHA1

    4bde2f87e903fe8d3bd80179c5584cec7a8cbdc4

    SHA256

    d9f4cd9f0e1bc9a138fb4da6f83c92c3e86eb3de4f988d5943d75c9b1dc6bb9d

    SHA512

    042b96bc2c0e6d8b6e2730426938eb7400fd833be8a108a4942f559fedefabc35fd5dcb7ea1898d377b4382c0a9af8eeeebd663a4c852c706e3bd168c1f1f62f

    Download Submit

  • \Program Files\Albion Data Client\albiondata-client.exe
    Filesize

    11.0MB

    MD5

    9a7b8c20cfed880daab754eb83ac142e

    SHA1

    1179b7159088600976c2ae51fa8f198b392496e2

    SHA256

    d97c8068118239449cacbb252222f7d3248438752dfc43c82beb1af652da329f

    SHA512

    17566a227801518f08e51b7009a39e1a329aa10b978b1aacb364af5f9fc75e19a057ef15362fc0a051d85f5a74a3e3dd669e9a7561ae499c37dbda34c847ff05

    Download Submit

  • \Program Files\Albion Data Client\uninstall.exe
    Filesize

    259KB

    MD5

    22a26bb892e35810581882bcfc52c652

    SHA1

    eb734ca419687009c75229213ae285649a3c5921

    SHA256

    7723d04405e97cefd0e220133fbdb07acfb3bcb11e2607dc71482d555744ac8b

    SHA512

    61d0c5f55a13041e201818ba7cfa6319cbfed42f4d186b8b729e71ebf4388e59a7eda67ecf09e6c4de1a12d1cab30b21ce8f7b76d807cb1988eb455ea8c04082

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nsjF77A.tmp\ExecDos.dll
    Filesize

    5KB

    MD5

    a7cd6206240484c8436c66afb12bdfbf

    SHA1

    0bb3e24a7eb0a9e5a8eae06b1c6e7551a7ec9919

    SHA256

    69ac56d2fdf3c71b766d3cc49b33b36f1287cc2503310811017467dfcb455926

    SHA512

    b9ee7803301e50a8ec20ab3f87eb9e509ea24d11a69e90005f30c1666acc4ed0a208bd56e372e2e5c6a6d901d45f04a12427303d74761983593d10b344c79904

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nsjF77A.tmp\InstallOptions.dll
    Filesize

    14KB

    MD5

    325b008aec81e5aaa57096f05d4212b5

    SHA1

    27a2d89747a20305b6518438eff5b9f57f7df5c3

    SHA256

    c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b

    SHA512

    18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nsjF77A.tmp\System.dll
    Filesize

    11KB

    MD5

    c17103ae9072a06da581dec998343fc1

    SHA1

    b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

    SHA256

    dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

    SHA512

    d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nsjF77A.tmp\UserInfo.dll
    Filesize

    4KB

    MD5

    7579ade7ae1747a31960a228ce02e666

    SHA1

    8ec8571a296737e819dcf86353a43fcf8ec63351

    SHA256

    564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5

    SHA512

    a88bc56e938374c333b0e33cb72951635b5d5a98b9cb2d6785073cbcad23bf4c0f9f69d3b7e87b46c76eb03ced9bb786844ce87656a9e3df4ca24acf43d7a05b

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nstB685.tmp\LangDLL.dll
    Filesize

    8KB

    MD5

    e5240dcd169abe69a7332d01106e1d84

    SHA1

    2ca68892501102586f6ab4eb99744d7f6138c166

    SHA256

    96c40847d52270061c25743bc9ec4843be1991f3ac36c2d1b78ec04a04437ea4

    SHA512

    519479d1c6bfd4fcb11e0802f9cf5eb7b324577514a986f0fdf07d33ff6a275dc5ac41654aed818d1c30e0bdda543297f4b7886442cbc93066a808cafbaf8a70

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nstB685.tmp\StartMenu.dll
    Filesize

    12KB

    MD5

    d5d2c8404b5f616c2a39cf023c0f63f0

    SHA1

    4f591c857724898429e215c25005ff38c7837776

    SHA256

    e8832ca91b2f909a34fb2d41d9c3c7928c055057c79277eaf5fb0725bcbddaac

    SHA512

    de54487f75212be426d12c342b2a5657d08379f2746549b54d3832e8f9ad0bab63b4c8dc91596fc39f313938afc9c1e5b0f0bb735d08c29cb1f41667f99603eb

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nstB685.tmp\System.dll
    Filesize

    29KB

    MD5

    26c8a92678f1b970ac2a700bb844c309

    SHA1

    c821a5980c31b0b35f1505cde836d6769f45e3a3

    SHA256

    2a7b5d1cab96a5280b0694d0ed54510129626a1ba36a51bd34d546972b7d18b8

    SHA512

    fba6e371853fd6c27097eb7cce7ffc59d71e4f0a9b5e55de06472d094b70c44a409bd82f39d9a27a814e826ab8468c59e947401a3c3ead1f057cbac236588860

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nstB685.tmp\nsDialogs.dll
    Filesize

    14KB

    MD5

    8f45e78d9d02ca8a9f9c274a8bfe2a57

    SHA1

    9b3838e1d2d4fbc1c84e1252747e96aa1b223d83

    SHA256

    78f9594721361fd3415b8c5194f9c9b87c580d6a70ddb95f2c4743c61ce68ebe

    SHA512

    125f1bcf833e0c233ebee552c164d9726769f06e5163467888abea08048fdae60a94b903ef97ba82ca9cf684f3c027d9605d54e9efe794df3e452f9b20e4ca96

    Download Submit

  • \Windows\System32\wpcap.dll
    Filesize

    361KB

    MD5

    a672f1cf00fa5ac3f4f59577f77d8c86

    SHA1

    b68e64401d91c75cafa810086a35cd0838c61a4b

    SHA256

    35aab6caaaf1720a4d888ae0de9e2a8e19604f3ea0e4dd882c3eeae4f39af117

    SHA512

    a566e7571437be765279c915dd6e13f72203eff0dc3838a154fc137ed828e05644d650fd8432d1fb4c1e1d84ee00ef9bde90225c68c3ca8a5da349065e7ebfd6

    Download Submit

  • memory/1712-326-0x00000000292B0000-0x00000000292CF000-memory.dmp

    Filesize

    124KB

    Download

  • memory/1712-331-0x00000000293E0000-0x00000000293EC000-memory.dmp

    Filesize

    48KB

    Download

  • memory/1712-329-0x00000000293E0000-0x00000000293EC000-memory.dmp

    Filesize

    48KB

    Download

  • memory/2180-202-0x0000000003380000-0x0000000003396000-memory.dmp

    Filesize

    88KB

    Download

  • memory/2412-20-0x0000000074970000-0x000000007497C000-memory.dmp

    Filesize

    48KB

    Download

  • memory/2412-19-0x0000000000400000-0x000000000048A000-memory.dmp

    Filesize

    552KB

    Download

  • memory/2412-319-0x0000000000400000-0x000000000048A000-memory.dmp

    Filesize

    552KB

    Download

  • memory/2412-21-0x0000000074960000-0x000000007496F000-memory.dmp

    Filesize

    60KB

    Download

  • memory/2412-151-0x0000000074950000-0x000000007495C000-memory.dmp

    Filesize

    48KB

    Download

  • memory/2412-148-0x0000000000400000-0x000000000048A000-memory.dmp

    Filesize

    552KB

    Download

  • memory/2560-335-0x0000000140000000-0x00000001405E8000-memory.dmp

    Filesize

    5.9MB

    Download

  • memory/2560-336-0x0000000140000000-0x00000001405E8000-memory.dmp

    Filesize

    5.9MB

    Download

  • memory/2560-334-0x0000000140000000-0x00000001405E8000-memory.dmp

    Filesize

    5.9MB

    Download

  • memory/2592-377-0x0000000140000000-0x00000001405E8000-memory.dmp

    Filesize

    5.9MB

    Download

  • memory/2592-378-0x0000000140000000-0x00000001405E8000-memory.dmp

    Filesize

    5.9MB

    Download

  • memory/2592-379-0x0000000140000000-0x00000001405E8000-memory.dmp

    Filesize

    5.9MB

    Download

  • memory/2592-380-0x0000000140000000-0x00000001405E8000-memory.dmp

    Filesize

    5.9MB

    Download

  • memory/2764-368-0x00000000292A0000-0x00000000292AC000-memory.dmp

    Filesize

    48KB

    Download

  • memory/2764-365-0x0000000029270000-0x000000002928F000-memory.dmp

    Filesize

    124KB

    Download

  • memory/2764-376-0x00000000292A0000-0x00000000292AC000-memory.dmp

    Filesize

    48KB

    Download

  • memory/2980-348-0x0000000029480000-0x000000002948C000-memory.dmp

    Filesize

    48KB

    Download

  • memory/2980-347-0x0000000029480000-0x000000002948C000-memory.dmp

    Filesize

    48KB

    Download

  • memory/2980-344-0x0000000029350000-0x000000002936F000-memory.dmp

    Filesize

    124KB

    Download