File name:

Alicia_Launcher_Install_Beta.exe

Full analysis: https://app.any.run/tasks/d1a8a229-bf92-4ca4-9c27-21a35f4b3d51
Verdict: Malicious activity
Analysis date: October 13, 2020, 00:49:36
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

3051566C9AA1BA4179928DCF7787943F

SHA1:

D9E71A1808DAF3514F7165DD4CB354E2EC5C4766

SHA256:

4AB62442F42B6446112A109E8FC0A18BA9BC1073AB93A707AE2FAED15BCF64F6

SSDEEP:

6144:cJIoRUP1uclAzyfnoblay/TC1j4Ce/234+kazIAd/2xvEg57WAUr:cSWUPIzyfwxTOUX/234czIAdexvEiqb

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Launcher.exe (PID: 3856)
      • Launcher.exe (PID: 3344)
      • Launcher.exe (PID: 3188)

    • Loads dropped or rewritten executable

      • Launcher.exe (PID: 3188)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Alicia_Launcher_Install_Beta.exe (PID: 3744)
      • Launcher.exe (PID: 3188)

    • Creates files in the user directory

      • Alicia_Launcher_Install_Beta.exe (PID: 3744)

  • INFO

    • Dropped object may contain Bitcoin addresses

      • Alicia_Launcher_Install_Beta.exe (PID: 3744)

    • Manual execution by user

      • Launcher.exe (PID: 3856)
      • Launcher.exe (PID: 3344)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2014:12:22 02:56:10+01:00
PEType: PE32
LinkerVersion: 8
CodeSize: 114176
InitializedDataSize: 67072
UninitializedDataSize: -
EntryPoint: 0x1bf5a
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 22-Dec-2014 01:56:10
Detected languages:
  • English - United States

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000F8

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 4
Time date stamp: 22-Dec-2014 01:56:10
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x0001BC27
0x0001BE00
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.74119
.rdata
0x0001D000
0x00006E7E
0x00007000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
6.73401
.data
0x00024000
0x00001D70
0x00000800
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
7.03819
.rsrc
0x00026000
0x000077A0
0x00007800
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.6982

Resources

Title
Entropy
Size
Codepage
Language
Type
1
4.24889
9640
UNKNOWN
English - United States
RT_ICON
2
3.3317
4264
UNKNOWN
English - United States
RT_ICON
3
5.23831
1128
UNKNOWN
English - United States
RT_ICON
4
4.84055
9640
UNKNOWN
English - United States
RT_ICON
5
5.23193
4264
UNKNOWN
English - United States
RT_ICON
6
5.64963
1128
UNKNOWN
English - United States
RT_ICON
I_0
2.45849
48
UNKNOWN
English - United States
RT_GROUP_ICON
I_1
2.53369
48
UNKNOWN
English - United States
RT_GROUP_ICON

Imports

ADVAPI32.dll
COMCTL32.dll
GDI32.dll
KERNEL32.dll
MSVCRT.dll
SHELL32.dll
USER32.dll
WS2_32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
52
Monitored processes
7
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start alicia_launcher_install_beta.exe launcher.exe update.exe launcher.exe no specs launcher.exe update.exe alicia_launcher_install_beta.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1288"C:\Users\admin\AppData\Roaming\AliciaOnline\Install\Update.exe" C:\Users\admin\AppData\Roaming\AliciaOnline\Install\Update.exe
Launcher.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\roaming\aliciaonline\install\update.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\advapi32.dll
3188"C:\Users\admin\AppData\Roaming\AliciaOnline\Launcher.exe" C:\Users\admin\AppData\Roaming\AliciaOnline\Launcher.exe
Alicia_Launcher_Install_Beta.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\roaming\aliciaonline\launcher.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\advapi32.dll
3344"C:\Users\admin\AppData\Roaming\AliciaOnline\Launcher.exe" C:\Users\admin\AppData\Roaming\AliciaOnline\Launcher.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\roaming\aliciaonline\launcher.exe
c:\systemroot\system32\ntdll.dll
3744"C:\Users\admin\AppData\Local\Temp\Alicia_Launcher_Install_Beta.exe" C:\Users\admin\AppData\Local\Temp\Alicia_Launcher_Install_Beta.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\alicia_launcher_install_beta.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\advapi32.dll
3856"C:\Users\admin\AppData\Roaming\AliciaOnline\Launcher.exe" C:\Users\admin\AppData\Roaming\AliciaOnline\Launcher.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\roaming\aliciaonline\launcher.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\advapi32.dll
3884"C:\Users\admin\AppData\Roaming\AliciaOnline\Install\Update.exe" C:\Users\admin\AppData\Roaming\AliciaOnline\Install\Update.exe
Launcher.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\roaming\aliciaonline\install\update.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\advapi32.dll
4060"C:\Users\admin\AppData\Local\Temp\Alicia_Launcher_Install_Beta.exe" C:\Users\admin\AppData\Local\Temp\Alicia_Launcher_Install_Beta.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\alicia_launcher_install_beta.exe
c:\systemroot\system32\ntdll.dll
Total events
1 159
Read events
1 140
Write events
19
Delete events
0

Modification events

(PID) Process:(3744) Alicia_Launcher_Install_Beta.exeKey:HKEY_CURRENT_USER\Software\AliciaOnline
Operation:writeName:Update
Value:
1
(PID) Process:(3744) Alicia_Launcher_Install_Beta.exeKey:HKEY_CURRENT_USER\Software\AliciaOnline
Operation:writeName:Update
Value:
0
(PID) Process:(3744) Alicia_Launcher_Install_Beta.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(3744) Alicia_Launcher_Install_Beta.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(3744) Alicia_Launcher_Install_Beta.exeKey:HKEY_USERS\S-1-5-21-1302019708-1500728564-335382590-500\Software\AliciaOnline
Operation:writeName:Update
Value:
0
(PID) Process:(3188) Launcher.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(3188) Launcher.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(1288) Update.exeKey:HKEY_CURRENT_USER\Software\AliciaOnline
Operation:writeName:Update
Value:
1
(PID) Process:(1288) Update.exeKey:HKEY_CURRENT_USER\Software\AliciaOnline
Operation:writeName:Update
Value:
0
(PID) Process:(3856) Launcher.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
Executable files
11
Suspicious files
3
Text files
0
Unknown types
11

Dropped files

PID
Process
Filename
Type
3744Alicia_Launcher_Install_Beta.exeC:\Users\admin\AppData\Roaming\AliciaOnline\Launcher.exe.upd —
MD5:—
SHA256:—
3744Alicia_Launcher_Install_Beta.exeC:\Users\admin\AppData\Roaming\AliciaOnline\Install\AlLayer.dll.upd —
MD5:—
SHA256:—
3744Alicia_Launcher_Install_Beta.exeC:\Users\admin\AppData\Roaming\AliciaOnline\Install\ALRes409.dll.upd —
MD5:—
SHA256:—
3744Alicia_Launcher_Install_Beta.exeC:\Users\admin\AppData\Roaming\AliciaOnline\Install\AppLoc.exe.upd —
MD5:—
SHA256:—
3744Alicia_Launcher_Install_Beta.exeC:\Users\admin\AppData\Roaming\AliciaOnline\Install\AppLoc.msi.upd —
MD5:—
SHA256:—
3744Alicia_Launcher_Install_Beta.exeC:\Users\admin\AppData\Roaming\AliciaOnline\Install\AppLoc.sdb.upd —
MD5:—
SHA256:—
3744Alicia_Launcher_Install_Beta.exeC:\Users\admin\AppData\Roaming\AliciaOnline\Install\GTLInstall.exe.upd —
MD5:—
SHA256:—
3744Alicia_Launcher_Install_Beta.exeC:\Users\admin\AppData\Roaming\AliciaOnline\Install\node.dll.upd —
MD5:—
SHA256:—
3744Alicia_Launcher_Install_Beta.exeC:\Users\admin\AppData\Roaming\AliciaOnline\Install\ntleai.dll.upd —
MD5:—
SHA256:—
3744Alicia_Launcher_Install_Beta.exeC:\Users\admin\AppData\Roaming\AliciaOnline\Install\ntleas.exe.upd —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3744
Alicia_Launcher_Install_Beta.exe
138.201.34.71:443
login.aliciagame.com
Hetzner Online GmbH
DE
suspicious
1288
Update.exe
138.201.34.71:443
login.aliciagame.com
Hetzner Online GmbH
DE
suspicious
3884
Update.exe
138.201.34.71:443
login.aliciagame.com
Hetzner Online GmbH
DE
suspicious

DNS requests

Domain
IP
Reputation
login.aliciagame.com
  • 138.201.34.71
suspicious

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Alicia_Launcher_Install_Beta.exe