MALICIOUS — 24a2dbe612c93adf6c4836a0401fe7da5a74f9c77d9c17bb790deddd17f619b2

MALICIOUS — 24a2dbe612c93adf6c4836a0401fe7da5a74f9c77d9c17bb790deddd17f619b2 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Alien family. 3 of 55 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: 24a2dbe612c93adf6c4836a0401fe7da5a74f9c77d9c17bb790deddd17f619b2
SHA-1: 2e18ac3579775d4b0aadde0799ed1f3d024676d9
MD5: 9b792692fe47fd7806c2c5b3a38b9fc7
imphash: fcf1390e9ce472c7270447fc5c61a0c1
ssdeep: 98304:Qk/wxH13paWZ3W/L3LoNLPYvTx1UYW458oH1R+MHjgbkKFVEjLuwqjBP:H0raWPErxWYW45b/9HIkKz3wqjBP
TLSH: T12063336F9560E1DCE9B1EE405C0E1E0F0466E1E7107ABC594E72C27D2AA7087AD183B7
Submitted as: 24a2dbe612c93adf6c4836a0401fe7da5a74f9c77d9c17bb790deddd17f619b2
File type: pe · Size: 4917828 bytes
Verdict: malicious (99/100) · Family: Alien

Detections (3 of 55 engines)

ClamAV (daily): Win.Malware.Alien-9936770-0
Microsoft Defender: Trojan:Win32/Wacatac.B!ml
Kaspersky (KVRT): HEUR:Trojan.BAT.Alien.gen

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 8 weighted signals:

ClamAV (daily) flagged Win.Malware.Alien-9936770-0 (rule Win.Malware.Alien-9936770-0) - engine signal, weight 0.90, confidence 0.95
2 behavioral detection(s): Defense Evasion: disable AV / Defender [high] (rule tl-defender-tamper) - dynamic signal, weight 0.60, confidence 0.90
Memory forensics: 4 finding(s), e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Dropped a suspicious payload: ModuleAnalysisCache - dynamic signal, weight 0.40, confidence 0.90
Contacted 23 external host(s) at runtime (21 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082, T1622, T1497.001 - dynamic signal, weight 0.40, confidence 0.75
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

59201 behavior events · 2 ATT&CK techniques · 50 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache - 9429fb123c90f8d5130515bc7f73b0157a5bc3c6a7558f336c80cc2680b9dca2
C:\Users\analyst\AppData\Local\Temp\isolation.exe - ede30bb0c9a4b8564538315b76759def592ee6869864f0fc7cd6de89deba6581
C:\Users\analyst\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive - fde89d6d26ed54b692f9d9a7844fbb4dac300a94834c2c827037f9ffd4bc6ae2
C:\Users\analyst\AppData\Local\Temp\service.vbs - 5b8ca3d7d0e6ae7926db6db31c9659703a23e9145721bf357fb7357bdbaf6b96
C:\Users\analyst\AppData\Local\Temp\service.bat - d50bfadd8fc5edc7a60680716a9d3844c85713213eeef9a0ebb32ad92496c1f0
C:\Users\analyst\AppData\Local\Temp\__PSScriptPolicyTest_qghdyj4c.po3.psm1 - 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
C:\Users\analyst\AppData\Local\Temp\config.exe - d10adc98b44ea705d1cc4c2978ca8dcac9cba4fd368d582b0e0f7628986edc38
39e22a7d04b3c4cef949cb52d9fe53277092cab5d2b92bec04e833976ce8b2ab - 39e22a7d04b3c4cef949cb52d9fe53277092cab5d2b92bec04e833976ce8b2ab
6acc4f624c8d2c35a54170c7ea6af3e120edb489d45baeaf05bc3f3e6086ec02 - 6acc4f624c8d2c35a54170c7ea6af3e120edb489d45baeaf05bc3f3e6086ec02
1656f8a675567eeb99dad0d256bf4329d3b85571fd946588da0fbcf605a6c258 - 1656f8a675567eeb99dad0d256bf4329d3b85571fd946588da0fbcf605a6c258
ab1746bda9d887d5a15a8efcfe5e5faa7363c6c49ae405a2bc750b54a23a5d4c - ab1746bda9d887d5a15a8efcfe5e5faa7363c6c49ae405a2bc750b54a23a5d4c
c6c6a545266bbefccfabd91c2ef2e02066d8047c148f8c93e96678716aed2165 - c6c6a545266bbefccfabd91c2ef2e02066d8047c148f8c93e96678716aed2165
851a3f979aca314bf05da1cc268c4ca918976eb17bb41f29fae5d9d856fe6b84 - 851a3f979aca314bf05da1cc268c4ca918976eb17bb41f29fae5d9d856fe6b84
cf0274e923b62cb4196bbe55d6adf7dc1ef01c3829f547dc708e1759670f08e3 - cf0274e923b62cb4196bbe55d6adf7dc1ef01c3829f547dc708e1759670f08e3
6df9183ac3296556955e3303980bc7d4e840e991734307c7853ff500f51f1091 - 6df9183ac3296556955e3303980bc7d4e840e991734307c7853ff500f51f1091

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787929571&P2=404&P3=2&P4=RCjYKl%2fxPTyiUHQO%2bgJRNfq6FZSq%2bMZUSOwdo%2bXPiu93tL%2f3pzXdf6w95I4ngN8jyrKKvmiuzsg0MBkx3TJYig%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/51d86688-616b-47e3-abeb-3df16a1583c5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/51d86688-616b-47e3-abeb-3df16a1583c5?P1=1787929631&P2=404&P3=2&P4=UWb13Y2BpsyG1J2v2%2fApGbV3UDgaeD5tf1gklooiQKMfnYzuz5zoBIVcKCXE1luV0%2foMQE2DgUQC22%2fMR51WuQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

to9.uk
schemas.microsoft.com
5.br
5h.br

Embedded IP addresses

20.89.1.11
20.42.179.204
4.230.171.124
4.144.132.114
74.179.77.204
74.178.76.54
20.42.73.28
20.112.250.133
40.99.133.210
52.123.128.14
52.123.129.14
20.184.175.4
203.26.79.13
20.165.94.46
52.123.252.218
52.110.12.19
52.110.12.30
135.234.160.244
172.178.240.161
52.148.114.188
72.153.5.96
52.110.12.52
52.110.12.24

File paths

D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb
T:\:d:l:t:
D:\n

More Alien samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report