eb1a0bec9602c3afb7c5b496bb502c4747566bd7ad9bf467766b993cc6d214d9

Resubmissions

31/07/2026, 03:47

260731-ecdspsvzd1

31/07/2026, 03:45

260731-ebdrbatcja7

Analysis

user interaction
yes
max time kernel
29s
max time network
32s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 03:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Alien Invasion.exe
Size 1.3MB
Sample260731-ebdrbatcja
SHA256 eb1a0bec9602c3afb7c5b496bb502c4747566bd7ad9bf467766b993cc6d214d9
MD5 b1d14a08dff0b3ed0ffec5a3e0806aaf
SHA1 80ca659bb6e9999b3916ada1892cba94c6bf48be
SHA512 71dd22871c990bba7c1386b19784e5871ec0369a84fe089194a6750748dadf98236cd601a4fb44266d3925fc73356936c2f94ac4ab32f436995016c905b7c60e
SSDEEP 24576:A2ctIvKqwpMKvT7QvYMy91tA2DP2crkmQNHElqKlRRaBI19n/Egb:lToMKvPQvOi8AmQNsrlLa8
TLSH
T12E559E0773E7C1E9DA7BC1F9C9610612EA31BC6407388ADB2190952EEF77ED04A3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion execution

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3672	Alien Invasion.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5116	powershell.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5360	cmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4868	timeout.exe

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	8	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	9	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5116	powershell.exe
5116	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3672	Alien Invasion.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	5116	powershell.exe
Token: SeBackupPrivilege	4824	Robocopy.exe
Token: SeRestorePrivilege	4824	Robocopy.exe
Token: SeSecurityPrivilege	4824	Robocopy.exe
Token: SeTakeOwnershipPrivilege	4824	Robocopy.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
964	Alien Invasion.exe
964	Alien Invasion.exe
3672	Alien Invasion.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
964	Alien Invasion.exe
964	Alien Invasion.exe
3672	Alien Invasion.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 964 wrote to memory of 5116	964	Alien Invasion.exe	89
PID 964 wrote to memory of 5360	964	Alien Invasion.exe	91
PID 5360 wrote to memory of 4868	5360	cmd.exe	93
PID 5360 wrote to memory of 4824	5360	cmd.exe	94
PID 5360 wrote to memory of 3672	5360	cmd.exe	95

C:\Users\Admin\AppData\Local\Temp\Alien Invasion.exe
"C:\Users\Admin\AppData\Local\Temp\Alien Invasion.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:964
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -Command "Expand-Archive -Path "C:\Users\Admin\AppData\Local\Temp\update_240722937.zip" -DestinationPath "C:\Users\Admin\AppData\Local\Temp\update_extracted_240722937" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5116
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\updater_240734812.bat""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5360
- - C:\Windows\system32\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:4868
- - C:\Windows\system32\Robocopy.exe
    robocopy "C:\Users\Admin\AppData\Local\Temp\update_extracted_240722937" "C:\Users\Admin\AppData\Local\Temp" /E /IS /IT
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4824
- - C:\Users\Admin\AppData\Local\Temp\Alien Invasion.exe
    "C:\Users\Admin\AppData\Local\Temp\Alien Invasion.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:3672

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

update_240722937.zip

Path C:\Users\Admin\AppData\Local\Temp\update_240722937.zip
Size 754KB
SHA256 d96ee6826dd0efe3d9d432f3de75050236176f2e7af111806202cbe46995d28c
MD5 d0fd6d6c5d76d0189760953685e542f8
SHA1 e29d0994c1af8490462d0184b57f9cd29e554077
SHA512 f650f84b90d8003fde02dfe706e41a12a636bebeeb2f896df066f07f9a92f3c81998bc17edb0864397b4c599d3764acddcac19ae8320e389416b310a720bb357
SSDEEP 12288:zaxHTCbrZvzKiDQHUppZQqHpglMNbfv4nPogqt8U1c5jyqMKryVXTktG78ys71V5:zaBTCh1D/TQi6MdfgnxqtvcpT2XV776j
TLSH
T152F42373540425BEC5020AF7A7569E4293CF09BE2BC1F5B4074DF1BBE2B53982B58A9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Alien Invasion.exe

Path C:\Users\Admin\AppData\Local\Temp\update_extracted_240722937\Alien Invasion.exe
Size 1.7MB
SHA256 8b9ec5c1c6198ab32399b25eb889a227eb72608403e63f2442b39c784d21faa6
MD5 6e0e95a2e867a4a5e75ec3c374270dcc
SHA1 1e10e66ca32726c0cebe2849145e87a4ac64c9fa
SHA512 909a64337d53663122d79256b3d5ed1d2a5445637ebec8046f253ea72e082545581aad5188d7cdce5bf9a895aab5fd04954372b8539d10a93e1c4b60fb1d3dc1
SSDEEP 24576:c2ctIvKqwpMKvT7QvYMy91tA2DP2crkmQNHElqKlRRaBJ/FTn/EIn:hToMKvPQvOi8AmQNsrlLaL
TLSH
T1CF852792E39281A9DE6683B98532CD3696337C74173485DF51EC783BBF736C20936A12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Continue.png

Path C:\Users\Admin\AppData\Local\Temp\update_extracted_240722937\Images\Continue.png
Size 3KB
SHA256 f451520fd8dcfe423b31d10a85179446b23fae1f04315efec27775e836073d8e
MD5 871b4768e400ad35ef77d7df6d5fda40
SHA1 8425990c3d5320b55be39452e8345f0327a78337
SHA512 eeeb726f78813e0c89106e7964acaeebc688043c5c11d0177100d443ba0b993af18507e7c6e0477054bbb76fabae5113efcba5c7a9cdbaa49e1b50ca033bf34a
TLSH
T143816C10F50DBF025B294E1D2EFC059AD41AAB0996C4509FA236DCDA22877DF11B2B99
MD5 SHA1 SHA512 TLSH

Submit Download

HostKey.png

Path C:\Users\Admin\AppData\Local\Temp\update_extracted_240722937\Images\HostKey.png
Size 1KB
SHA256 6f952d830e28044e5c72210901d3c36a4d63b581a148eacc0ddb09b501e25351
MD5 6914a0aec2071d16db74dd8e3633566f
SHA1 1f7380df72fee941dd850728040155494c8c2185
SHA512 c5da70599f86e0730583daa14a54bf85931100810ec58b1af8a271a7823da58a7b746dcad78f19478f91a715e9a365c9a325f682afea92c1a7f62fefaf1f7939
TLSH
T148311A57274008BE327DE04EFF8F0BB4063D059024DE6824AD31D136FA2A8E8C19B8A7
MD5 SHA1 SHA512 TLSH

Submit Download

Respawn.png

Path C:\Users\Admin\AppData\Local\Temp\update_extracted_240722937\Images\Respawn.png
Size 3KB
SHA256 1a49b20fad7c5a76267865a75bf74744a24adcff67b4afaba021f5cd42f1fb49
MD5 f1f68512e3219ad8665deb375eebdd5d
SHA1 af0e38233becdf1f19dbe81619691c9e8d7b5f15
SHA512 5558287d44889a0af1033fde28ff1e56a1fa61218ad17fed781fc53d6e188af3bd22c96ebe67318c1be9f5604c00f3b38cd37ddd44a748fb74655eaa9b8b5bfe
TLSH
T153816D966105EDDABE9F647E61AD6C0240BC05B749B3CB7C034931293AF3E1945F4CB0
MD5 SHA1 SHA512 TLSH

Submit Download

Rounds.png

Path C:\Users\Admin\AppData\Local\Temp\update_extracted_240722937\Images\Rounds.png
Size 1KB
SHA256 1eb0f7dcc4bcf5d57bb06f21be76e93f93a76eca27cafadeb9fd69fb7e6804ce
MD5 19fc2b14fbfbb25b0cfff0c225b14b02
SHA1 26a822097fdccd1f533c4952baea79af75826c0b
SHA512 b94c91577e5bdbefd152179847e0fadcf11ba12a8f4917fd526a6096f1d6bd3ad783d86ff8d87a2231d11cfd212164ebfe37ec5efc4ae2b1408567bf1ea17510
TLSH
T10611A853C606B6F181AA3579A2F75701D858AA9E04813350FDA311AD645E1D08B023C5
MD5 SHA1 SHA512 TLSH

Submit Download

Shovel.png

Path C:\Users\Admin\AppData\Local\Temp\update_extracted_240722937\Images\Shovel.png
Size 1KB
SHA256 1e3cc6aa40b0a2e912521928be5c5298f42a300d824a42ee040ffc942511f2e9
MD5 eeb81de9ecea8066fcc948bd829935d1
SHA1 981f687722e6c67929fe4cce7d8f8a6fa11d2991
SHA512 628d5650735b6676770e4f74332ecc9db599e2a133fa62d091ad2264824952c1e50ef3a685432c66e39212015fbc95116541c91c65c52072c1ae0b15bbc5aac6
TLSH
T1F821DAAF7909974D9342853055500C1B649BDAF99448C1070E49F8C6E171FCE914DB0B
MD5 SHA1 SHA512 TLSH

Submit Download

Yes.png

Path C:\Users\Admin\AppData\Local\Temp\update_extracted_240722937\Images\Yes.png
Size 1KB
SHA256 8ee80cd97d3c94d6c11d719467da577b914a939162dae56e2d6708af2eb6cd94
MD5 342a983b36a05f32bed81b74d84fff15
SHA1 04733ab0a1511919a599797789ce347c2634c444
SHA512 fd1e31d041422380087e11e91a47a864cc0645073b0cf432300972972049458d89c7bc93c3a737a22bced55102f6e19e1971805addac296e87537f1a116ba997
TLSH
T15A21D8CE591177EC4E5F9D312F9AB2079CBB5CA4159BE405999810F515302C7DC03FB6
MD5 SHA1 SHA512 TLSH

Submit Download

Settings.ini

Path C:\Users\Admin\AppData\Local\Temp\update_extracted_240722937\Settings.ini
Size 1KB
SHA256 1f9ab9334e296bbb9e5ae7fdde03b3001002f907966cc4b6848ef9cffced195e
MD5 8249043d46a10c0fc869dd5a20b68888
SHA1 e8022b8f3f364725f27f58e7fd65ff34ac41b1f7
SHA512 c17a41e327708d74de713a59d3d1da8d413b97ad2521759cb3fbfad2e8c80478554c1b7f4aa97a5b1e0d46c235ba6d19ddc67c6c50311168e78cfa6f1d0e07fa
TLSH
T1563161232AF558E5B0B25785D17424265B34BCD5347CD45C22C1711F88EA901DAA7BBB
MD5 SHA1 SHA512 TLSH

Submit Download

ColorPicker.ahk

Path C:\Users\Admin\AppData\Local\Temp\update_extracted_240722937\Tools\ColorPicker.ahk
Size 101B
SHA256 5e902ea5d6a44da66a94c3121124cc9ff15d829be222d24fc47810d27dd052a6
MD5 ea1a5b710e048e1e61c9bb33d8dd490c
SHA1 dfd43a8f73d1a0556c27fa230642fd50f9f1e63a
SHA512 cd29f9ae3db08cd81df10a8bd5eaf811d696436b618dda55f09dc72c32d75a953f813c7c9b4bf2bc69a52b8504e08f2927da3ae5ffa7e550419b7f64a6d15e50
TLSH
T1B6B01255367F2027E8B1D34A5A025D509741907BC29E054D7133412709770092301C3E
MD5 SHA1 SHA512 TLSH

Submit Download

updater_240734812.bat

Path C:\Users\Admin\AppData\Local\Temp\updater_240734812.bat
Size 377B
SHA256 2fb1d26aa1bb6d42cb77f575ecd0079cc0982107bc730a63c43d81e387a7903d
MD5 a5c7fd43d63ca1d67f6306b3b469632d
SHA1 6827ab038be267c6fe3919150107e59426898b21
SHA512 3d2dbe8a581a16573afac10605f73b5b91a59187f6b6d8f3b04e2d976ee22995346b277f319f5db15721bbc0338437e3513dc0e933b0f5887c7ca450172d6352
TLSH
T1D3E09252C1D7C62A0884385709FAA68EC0B40C9D7F857BC18729C59C238742EFFC7642
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5116-25-0x0000011CE7BA0000-0x0000011CE7BAA000-memory.dmp

Download

memory/5116-49-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp

Download

memory/5116-21-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp

Download

memory/5116-22-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp

Download

memory/5116-8-0x0000011CE7BC0000-0x0000011CE7BE2000-memory.dmp

Download

memory/5116-24-0x0000011CFFE10000-0x0000011CFFE22000-memory.dmp

Download

memory/5116-17-0x0000011C802C0000-0x0000011C802DE000-memory.dmp

Download

memory/5116-7-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp

Download

memory/5116-41-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp

Download

memory/5116-42-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp

Download

memory/5116-43-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp

Download

memory/5116-20-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp

Download

memory/5116-19-0x0000011CE7BA0000-0x0000011CE7BAA000-memory.dmp

Download

memory/5116-4-0x00007FF99F5EF000-0x00007FF99F5F0000-memory.dmp

Download

memory/5116-18-0x0000011C802E0000-0x0000011C80392000-memory.dmp

Download

memory/5116-23-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp

Download

memory/5116-14-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp

Download

memory/5116-13-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp

Download

memory/5116-12-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp

Download

memory/5116-11-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp

Download

memory/5116-10-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp

Download

memory/5116-9-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp

Download