Forum Discussion

posewadone23's avatar
posewadone23
Icon for Bronze II rankBronze II
22 days ago
Solved

ICS Malware: Triton - unpack trilog.exe

Hi.

I get the following error when trying to unpack trilog.exe by:

iml-user@ics-malware-triton:~/Desktop/Lab-Files/python_exe_unpacker$ python3 python_exe_unpack.py /Desktop/Lab-Files/trilog.exe

Traceback (most recent call last):
  File "python_exe_unpack.py", line 14, in <module>
    import pefile
ModuleNotFoundError: No module named 'pefile'

Thanks.

  • Hello,

    I’ve had similar issue, if I remember well,

    1. I used python2 instead of python3
    2. Depend from where you launch the command and you have to give the path to trilog.exe with "-i" and the path for the output folder with "-o"

     

    iml-user@ics-malware-triton:~/Desktop/Lab-Files/python_exe_unpacker$ python2 python_exe_unpack.py -i ~/Desktop/Lab-Files/trilog.exe -o /PathToFolder/

5 Replies

  • ChrisKershaw's avatar
    ChrisKershaw
    Icon for Community Support rankCommunity Support

    Hey posewadone23​ πŸ‘‹πŸ»

    I'm sorry you have been encountering an issue completing the lab. 

    Are you able to confirm which question number you are having difficulties completing, so I can look into this for you?

  • Hello,

    I’ve had similar issue, if I remember well,

    1. I used python2 instead of python3
    2. Depend from where you launch the command and you have to give the path to trilog.exe with "-i" and the path for the output folder with "-o"

     

    iml-user@ics-malware-triton:~/Desktop/Lab-Files/python_exe_unpacker$ python2 python_exe_unpack.py -i ~/Desktop/Lab-Files/trilog.exe -o /PathToFolder/

    • ChrisKershaw's avatar
      ChrisKershaw
      Icon for Community Support rankCommunity Support

      Hey posewadone23​ 

      Thank you for confirming the task numbers you are stuck completing; I've just raised your lab issue to our Cyber Team now, to see if they can review the steps you have tried so far, and to share some further guidance to get you moving with this.

      As soon as I hear anything further, I'll be happy to get back to you with a further update on this 😊

      Kindest regards, 
      Chris