405f028aa8a057162a9ae7e409261bf8cbd623f0568235924c93db7f95b8f409

Analysis

max time kernel
21s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/02/2023, 17:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fl_patch_installer_20_7_2_1863.exe
Size

111.1MB
MD5

d4ba52ac1ac6bcb16c616ea369058c80
SHA1

cc61da8d29b59a239f680e877c0699435bb18f62
SHA256

405f028aa8a057162a9ae7e409261bf8cbd623f0568235924c93db7f95b8f409
SHA512

cf7b38c1158a5eb78c26cbd4ccbec9d724ba4930125009348cab3341a356207bce54179907f3f0955ba9c8e12a5e25edbf22385288b2da50f24c7457e36b9382
SSDEEP

3145728:YXXSmgoAU2HahqHaO5re0aa9PepTOI2dBa6:YHSNoP2Hahq6O5reHaR7IMh

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
848	fl_patch_installer_20_7_2_1863.tmp

Loads dropped DLL 1 IoCs

pid	Process
1508	fl_patch_installer_20_7_2_1863.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Image-Line\FL Studio 20\Plugins\Fruity\Generators\Harmless\is-H17KL.tmp	fl_patch_installer_20_7_2_1863.tmp
File opened for modification	C:\Program Files\Image-Line\FL Studio 20\Plugins\Fruity\Generators\Slicex\Slicex.dll	fl_patch_installer_20_7_2_1863.tmp
File opened for modification	C:\Program Files\Image-Line\FL Studio 20\Plugins\Fruity\Generators\Fruity Video Player\Fruity Video Player_x64.dll	fl_patch_installer_20_7_2_1863.tmp
File opened for modification	C:\Program Files\Image-Line\FL Studio 20\Plugins\Fruity\Generators\Sytrus\Sytrus_x64.dll	fl_patch_installer_20_7_2_1863.tmp
File opened for modification	C:\Program Files\Image-Line\FL Studio 20\Plugins\Fruity\Effects\Edison\Edison.dll	fl_patch_installer_20_7_2_1863.tmp
File created	C:\Program Files\Image-Line\FL Studio 20\Plugins\Fruity\Generators\Fruity DX10\is-MCQET.tmp	fl_patch_installer_20_7_2_1863.tmp
File created	C:\Program Files\Image-Line\FL Studio 20\Plugins\Fruity\Generators\Fruity Soundfont Player\is-1R7P1.tmp	fl_patch_installer_20_7_2_1863.tmp
File opened for modification	C:\Program Files\Image-Line\FL Studio 20\Plugins\Fruity\Effects\Gross Beat\Gross Beat_x64.dll	fl_patch_installer_20_7_2_1863.tmp
File opened for modification	C:\Program Files\Image-Line\FL Studio 20\Plugins\Fruity\Generators\Fruity Soundfont Player\Fruity SoundFont Player_x64.dll	fl_patch_installer_20_7_2_1863.tmp
File created	C:\Program Files\Image-Line\FL Studio 20\Plugins\Fruity\Effects\Newtone\is-BFHGD.tmp	fl_patch_installer_20_7_2_1863.tmp
File created	C:\Program Files\Image-Line\FL Studio 20\Plugins\Fruity\Generators\Ogun\is-88FV7.tmp	fl_patch_installer_20_7_2_1863.tmp
File created	C:\Program Files\Image-Line\FL Studio 20\Plugins\Fruity\Generators\Fruity DX10\is-COSLU.tmp	fl_patch_installer_20_7_2_1863.tmp
File created	C:\Program Files\Image-Line\FL Studio 20\Plugins\Fruity\Generators\Fruity Video Player\is-7H9R1.tmp	fl_patch_installer_20_7_2_1863.tmp
File created	C:\Program Files\Image-Line\FL Studio 20\Plugins\Fruity\Generators\Harmor\is-F271S.tmp	fl_patch_installer_20_7_2_1863.tmp
File created	C:\Program Files\Image-Line\FL Studio 20\Plugins\Fruity\Generators\Wasp XT\is-5VTO5.tmp	fl_patch_installer_20_7_2_1863.tmp
File opened for modification	C:\Program Files\Image-Line\FL Studio 20\Plugins\Fruity\Generators\Fruity Video Player\Fruity Video Player.dll	fl_patch_installer_20_7_2_1863.tmp
File opened for modification	C:\Program Files\Image-Line\FL Studio 20\_FLEngine_x64.dll	fl_patch_installer_20_7_2_1863.tmp
File opened for modification	C:\Program Files\Image-Line\FL Studio 20\Plugins\Fruity\Generators\Fruity DX10\Fruity DX10_x64.dll	fl_patch_installer_20_7_2_1863.tmp
File opened for modification	C:\Program Files\Image-Line\FL Studio 20\Plugins\Fruity\Generators\Ogun\Ogun_x64.dll	fl_patch_installer_20_7_2_1863.tmp
File created	C:\Program Files\Image-Line\FL Studio 20\Plugins\Fruity\Effects\Transient Processor\is-I1HVB.tmp	fl_patch_installer_20_7_2_1863.tmp
File opened for modification	C:\Program Files\Image-Line\FL Studio 20\Plugins\Fruity\Generators\Harmor\Harmor.dll	fl_patch_installer_20_7_2_1863.tmp
File opened for modification	C:\Program Files\Image-Line\FL Studio 20\Plugins\Fruity\Generators\Fruity DrumSynth Live\Fruity DrumSynth Live.dll	fl_patch_installer_20_7_2_1863.tmp
File created	C:\Program Files\Image-Line\FL Studio 20\Plugins\Fruity\Effects\Edison\is-UFPN0.tmp	fl_patch_installer_20_7_2_1863.tmp
File created	C:\Program Files\Image-Line\FL Studio 20\Plugins\Fruity\Generators\Fruity DrumSynth Live\is-PQ2DK.tmp	fl_patch_installer_20_7_2_1863.tmp
File created	C:\Program Files\Image-Line\FL Studio 20\Plugins\Fruity\Generators\Slicex\is-0NLB8.tmp	fl_patch_installer_20_7_2_1863.tmp
File created	C:\Program Files\Image-Line\FL Studio 20\Plugins\Fruity\Generators\Transistor Bass\is-ACTTS.tmp	fl_patch_installer_20_7_2_1863.tmp
File opened for modification	C:\Program Files\Image-Line\FL Studio 20\Plugins\Fruity\Generators\SimSynth\SimSynth.dll	fl_patch_installer_20_7_2_1863.tmp
File opened for modification	C:\Program Files\Image-Line\FL Studio 20\_FLEngine.dll	fl_patch_installer_20_7_2_1863.tmp
File opened for modification	C:\Program Files\Image-Line\FL Studio 20\Plugins\Fruity\Generators\Transistor Bass\Transistor Bass.dll	fl_patch_installer_20_7_2_1863.tmp
File opened for modification	C:\Program Files\Image-Line\FL Studio 20\Plugins\Fruity\Generators\Wasp\Wasp_x64.dll	fl_patch_installer_20_7_2_1863.tmp
File created	C:\Program Files\Image-Line\FL Studio 20\Plugins\Fruity\Effects\Edison\is-VLTCK.tmp	fl_patch_installer_20_7_2_1863.tmp
File opened for modification	C:\Program Files\Image-Line\FL Studio 20\Plugins\Fruity\Generators\Harmor\Harmor_x64.dll	fl_patch_installer_20_7_2_1863.tmp
File created	C:\Program Files\Image-Line\FL Studio 20\is-3DT3T.tmp	fl_patch_installer_20_7_2_1863.tmp
File created	C:\Program Files\Image-Line\FL Studio 20\Plugins\Fruity\Generators\Fruity DrumSynth Live\is-1Q99Q.tmp	fl_patch_installer_20_7_2_1863.tmp
File created	C:\Program Files\Image-Line\FL Studio 20\Plugins\Fruity\Generators\SimSynth\is-15S37.tmp	fl_patch_installer_20_7_2_1863.tmp
File opened for modification	C:\Program Files\Image-Line\FL Studio 20\Plugins\Fruity\Generators\Ogun\Ogun.dll	fl_patch_installer_20_7_2_1863.tmp
File opened for modification	C:\Program Files\Image-Line\FL Studio 20\FLEngine.dll	fl_patch_installer_20_7_2_1863.tmp
File opened for modification	C:\Program Files\Image-Line\FL Studio 20\Plugins\Fruity\Effects\Newtone\Newtone_x64.dll	fl_patch_installer_20_7_2_1863.tmp
File opened for modification	C:\Program Files\Image-Line\FL Studio 20\Plugins\Fruity\Generators\Fruity Soundfont Player\Fruity Soundfont Player.dll	fl_patch_installer_20_7_2_1863.tmp
File created	C:\Program Files\Image-Line\FL Studio 20\Plugins\Fruity\Generators\SimSynth\is-CQSO7.tmp	fl_patch_installer_20_7_2_1863.tmp
File created	C:\Program Files\Image-Line\FL Studio 20\Plugins\Fruity\Generators\Sytrus\is-DCAAO.tmp	fl_patch_installer_20_7_2_1863.tmp
File created	C:\Program Files\Image-Line\FL Studio 20\Plugins\Fruity\Effects\Maximus\is-48DU5.tmp	fl_patch_installer_20_7_2_1863.tmp
File created	C:\Program Files\Image-Line\FL Studio 20\Plugins\Fruity\Effects\Vocodex\is-68R7L.tmp	fl_patch_installer_20_7_2_1863.tmp
File opened for modification	C:\Program Files\Image-Line\FL Studio 20\Plugins\Fruity\Generators\Wasp XT\Wasp XT_x64.dll	fl_patch_installer_20_7_2_1863.tmp
File opened for modification	C:\Program Files\Image-Line\FL Studio 20\Plugins\Fruity\Effects\Newtime\Newtime.dll	fl_patch_installer_20_7_2_1863.tmp
File opened for modification	C:\Program Files\Image-Line\FL Studio 20\Plugins\Fruity\Generators\Fruity DX10\Fruity DX10.dll	fl_patch_installer_20_7_2_1863.tmp
File opened for modification	C:\Program Files\Image-Line\FL Studio 20\Plugins\Fruity\Generators\SimSynth\SimSynth_x64.dll	fl_patch_installer_20_7_2_1863.tmp
File created	C:\Program Files\Image-Line\FL Studio 20\Plugins\Fruity\Effects\Gross Beat\is-AOTTB.tmp	fl_patch_installer_20_7_2_1863.tmp
File created	C:\Program Files\Image-Line\FL Studio 20\Plugins\Fruity\Effects\Maximus\is-G5A53.tmp	fl_patch_installer_20_7_2_1863.tmp
File created	C:\Program Files\Image-Line\FL Studio 20\Plugins\Fruity\Effects\Vocodex\Synthesizer\is-PO6IR.tmp	fl_patch_installer_20_7_2_1863.tmp
File created	C:\Program Files\Image-Line\FL Studio 20\Plugins\Fruity\Generators\Harmless\is-APAJ0.tmp	fl_patch_installer_20_7_2_1863.tmp
File created	C:\Program Files\Image-Line\FL Studio 20\Plugins\Fruity\Generators\Ogun\is-701IR.tmp	fl_patch_installer_20_7_2_1863.tmp
File opened for modification	C:\Program Files\Image-Line\FL Studio 20\Plugins\Fruity\Generators\Slicex\Slicex_x64.dll	fl_patch_installer_20_7_2_1863.tmp
File created	C:\Program Files\Image-Line\FL Studio 20\Plugins\Fruity\Effects\Vocodex\is-7HRGV.tmp	fl_patch_installer_20_7_2_1863.tmp
File created	C:\Program Files\Image-Line\FL Studio 20\Plugins\Fruity\Generators\Harmor\is-F020I.tmp	fl_patch_installer_20_7_2_1863.tmp
File opened for modification	C:\Program Files\Image-Line\FL Studio 20\Plugins\Fruity\Generators\Transistor Bass\Transistor Bass_x64.dll	fl_patch_installer_20_7_2_1863.tmp
File created	C:\Program Files\Image-Line\FL Studio 20\Plugins\Fruity\Effects\Gross Beat\is-M1V81.tmp	fl_patch_installer_20_7_2_1863.tmp
File created	C:\Program Files\Image-Line\FL Studio 20\Plugins\Fruity\Effects\Newtime\is-S88PD.tmp	fl_patch_installer_20_7_2_1863.tmp
File created	C:\Program Files\Image-Line\FL Studio 20\Plugins\Fruity\Effects\Newtone\is-0E7HM.tmp	fl_patch_installer_20_7_2_1863.tmp
File created	C:\Program Files\Image-Line\FL Studio 20\Plugins\Fruity\Generators\Fruity Video Player\is-RFM1C.tmp	fl_patch_installer_20_7_2_1863.tmp
File created	C:\Program Files\Image-Line\FL Studio 20\Plugins\Fruity\Generators\Slicex\is-6CMBG.tmp	fl_patch_installer_20_7_2_1863.tmp
File opened for modification	C:\Program Files\Image-Line\FL Studio 20\Plugins\Fruity\Effects\Vocodex\Vocodex_x64.dll	fl_patch_installer_20_7_2_1863.tmp
File opened for modification	C:\Program Files\Image-Line\FL Studio 20\Plugins\Fruity\Effects\Maximus\Maximus.dll	fl_patch_installer_20_7_2_1863.tmp
File created	C:\Program Files\Image-Line\FL Studio 20\Plugins\Fruity\Effects\Vocodex\Synthesizer\is-0HLSE.tmp	fl_patch_installer_20_7_2_1863.tmp

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
848	fl_patch_installer_20_7_2_1863.tmp
848	fl_patch_installer_20_7_2_1863.tmp

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
848	fl_patch_installer_20_7_2_1863.tmp

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1508 wrote to memory of 848	1508	fl_patch_installer_20_7_2_1863.exe	27
PID 1508 wrote to memory of 848	1508	fl_patch_installer_20_7_2_1863.exe	27
PID 1508 wrote to memory of 848	1508	fl_patch_installer_20_7_2_1863.exe	27
PID 1508 wrote to memory of 848	1508	fl_patch_installer_20_7_2_1863.exe	27
PID 1508 wrote to memory of 848	1508	fl_patch_installer_20_7_2_1863.exe	27
PID 1508 wrote to memory of 848	1508	fl_patch_installer_20_7_2_1863.exe	27
PID 1508 wrote to memory of 848	1508	fl_patch_installer_20_7_2_1863.exe	27

C:\Users\Admin\AppData\Local\Temp\fl_patch_installer_20_7_2_1863.exe
"C:\Users\Admin\AppData\Local\Temp\fl_patch_installer_20_7_2_1863.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1508
- C:\Users\Admin\AppData\Local\Temp\is-4Q9JK.tmp\fl_patch_installer_20_7_2_1863.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-4Q9JK.tmp\fl_patch_installer_20_7_2_1863.tmp" /SL5="$60122,116119095,125440,C:\Users\Admin\AppData\Local\Temp\fl_patch_installer_20_7_2_1863.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  PID:848

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-4Q9JK.tmp\fl_patch_installer_20_7_2_1863.tmp

Filesize
1.1MB

MD5
006c402fd22016b5a5a1c2180ca5ccc9

SHA1
dc8dae24ef11181d145c8d9f6f245f3b67a3e1d0

SHA256
5b246db2dfc1a5d000b0662e2a58e1cb9f89fdc87945597ec1e1f2f245fd7898

SHA512
caea20f48421f7918c9ead0316decba60460c74ff878666e0a48ae1e5b2eb41a37b03c1a59bc3aa416990e49cae155e19894461c28c225f4f9b42e184db289b1

Download Submit
\Users\Admin\AppData\Local\Temp\is-4Q9JK.tmp\fl_patch_installer_20_7_2_1863.tmp

Filesize
1.1MB

MD5
006c402fd22016b5a5a1c2180ca5ccc9

SHA1
dc8dae24ef11181d145c8d9f6f245f3b67a3e1d0

SHA256
5b246db2dfc1a5d000b0662e2a58e1cb9f89fdc87945597ec1e1f2f245fd7898

SHA512
caea20f48421f7918c9ead0316decba60460c74ff878666e0a48ae1e5b2eb41a37b03c1a59bc3aa416990e49cae155e19894461c28c225f4f9b42e184db289b1

Download Submit
memory/848-62-0x0000000074111000-0x0000000074113000-memory.dmp

Filesize
8KB

Download
memory/1508-54-0x0000000074C91000-0x0000000074C93000-memory.dmp

Filesize
8KB

Download
memory/1508-55-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1508-58-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1508-63-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1508-64-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download