94d317af528ed1714c1f6df2347acf2f52acc9c3e22bd4e668bbdef33399f3d8

Analysis

max time kernel
186s
max time network
257s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2023, 15:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

flstudio_win64_21.1.1.3750.exe
Size

925.6MB
MD5

30e6727eaec87bd7276f2b7e1180e531
SHA1

b28c262435c5526d30be224246ceb5527f78f6b3
SHA256

94d317af528ed1714c1f6df2347acf2f52acc9c3e22bd4e668bbdef33399f3d8
SHA512

f127131b9b533146ca45007642aaf74d006c761c11894f3a719aad2414e04ee0cc5e384eedd961a227043ab87bc29afcb8bed827e1c8461aafd3ec62489f664f
SSDEEP

12582912:0ozZdSUlJ/amvaZRPLoO4rIP9H39uW1YfmuSlKOx256aOYvki+dYKXwoCwzVAd2m:DnKmCZREvIPOWyOu3Ox2nMXwjwp/6XCe

Score

4^/10

Malware Config

Signatures

Loads dropped DLL 16 IoCs

pid	Process
2396	flstudio_win64_21.1.1.3750.exe
2396	flstudio_win64_21.1.1.3750.exe
2396	flstudio_win64_21.1.1.3750.exe
2396	flstudio_win64_21.1.1.3750.exe
2396	flstudio_win64_21.1.1.3750.exe
2396	flstudio_win64_21.1.1.3750.exe
2396	flstudio_win64_21.1.1.3750.exe
2396	flstudio_win64_21.1.1.3750.exe
2396	flstudio_win64_21.1.1.3750.exe
2396	flstudio_win64_21.1.1.3750.exe
2396	flstudio_win64_21.1.1.3750.exe
2396	flstudio_win64_21.1.1.3750.exe
2396	flstudio_win64_21.1.1.3750.exe
2396	flstudio_win64_21.1.1.3750.exe
2396	flstudio_win64_21.1.1.3750.exe
2396	flstudio_win64_21.1.1.3750.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\flstudio_win64_21.1.1.3750.exe
"C:\Users\Admin\AppData\Local\Temp\flstudio_win64_21.1.1.3750.exe"
1⤵
- Loads dropped DLL
PID:2396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsuFEF9.tmp\ILSetup.dll

Filesize
1.0MB

MD5
cd50c47c010aa1e6abd8bd8ce98fb8c5

SHA1
547e445c42b39041204c012f95e146ba7bb3442b

SHA256
1ea1404b5e14ee8572575d941ef27437a534b46aa1d23e112cf40f4144cbb7ca

SHA512
f4c54f3403633167572e36867a0e99164de2cafe873505922b055b65b63809729a89ab3df092a634d18fe2fb8d3d1060a908349ef61b88ff0750815347a4fa53

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsuFEF9.tmp\ILSetup.dll

Filesize
1.0MB

MD5
cd50c47c010aa1e6abd8bd8ce98fb8c5

SHA1
547e445c42b39041204c012f95e146ba7bb3442b

SHA256
1ea1404b5e14ee8572575d941ef27437a534b46aa1d23e112cf40f4144cbb7ca

SHA512
f4c54f3403633167572e36867a0e99164de2cafe873505922b055b65b63809729a89ab3df092a634d18fe2fb8d3d1060a908349ef61b88ff0750815347a4fa53

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsuFEF9.tmp\ILSetup.dll

Filesize
1.0MB

MD5
cd50c47c010aa1e6abd8bd8ce98fb8c5

SHA1
547e445c42b39041204c012f95e146ba7bb3442b

SHA256
1ea1404b5e14ee8572575d941ef27437a534b46aa1d23e112cf40f4144cbb7ca

SHA512
f4c54f3403633167572e36867a0e99164de2cafe873505922b055b65b63809729a89ab3df092a634d18fe2fb8d3d1060a908349ef61b88ff0750815347a4fa53

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsuFEF9.tmp\ILSetup.dll

Filesize
1.0MB

MD5
cd50c47c010aa1e6abd8bd8ce98fb8c5

SHA1
547e445c42b39041204c012f95e146ba7bb3442b

SHA256
1ea1404b5e14ee8572575d941ef27437a534b46aa1d23e112cf40f4144cbb7ca

SHA512
f4c54f3403633167572e36867a0e99164de2cafe873505922b055b65b63809729a89ab3df092a634d18fe2fb8d3d1060a908349ef61b88ff0750815347a4fa53

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsuFEF9.tmp\ILSetup.dll

Filesize
1.0MB

MD5
cd50c47c010aa1e6abd8bd8ce98fb8c5

SHA1
547e445c42b39041204c012f95e146ba7bb3442b

SHA256
1ea1404b5e14ee8572575d941ef27437a534b46aa1d23e112cf40f4144cbb7ca

SHA512
f4c54f3403633167572e36867a0e99164de2cafe873505922b055b65b63809729a89ab3df092a634d18fe2fb8d3d1060a908349ef61b88ff0750815347a4fa53

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsuFEF9.tmp\ILSetup.dll

Filesize
1.0MB

MD5
cd50c47c010aa1e6abd8bd8ce98fb8c5

SHA1
547e445c42b39041204c012f95e146ba7bb3442b

SHA256
1ea1404b5e14ee8572575d941ef27437a534b46aa1d23e112cf40f4144cbb7ca

SHA512
f4c54f3403633167572e36867a0e99164de2cafe873505922b055b65b63809729a89ab3df092a634d18fe2fb8d3d1060a908349ef61b88ff0750815347a4fa53

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsuFEF9.tmp\ILSetup.dll

Filesize
1.0MB

MD5
cd50c47c010aa1e6abd8bd8ce98fb8c5

SHA1
547e445c42b39041204c012f95e146ba7bb3442b

SHA256
1ea1404b5e14ee8572575d941ef27437a534b46aa1d23e112cf40f4144cbb7ca

SHA512
f4c54f3403633167572e36867a0e99164de2cafe873505922b055b65b63809729a89ab3df092a634d18fe2fb8d3d1060a908349ef61b88ff0750815347a4fa53

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsuFEF9.tmp\InstallOptions.dll

Filesize
15KB

MD5
998189882c9f1be220c9faf0fd2bde15

SHA1
787d50c46c9a2a48565f684fabc7503aca8b0493

SHA256
f34385901206a3952fe2724edb3b0b123fd897119c774ab68c8745de6662d990

SHA512
e0c52ad851b476e7bcbadea8f993e5c6f9f70a9b46e2aebe8ee353a372b0bd5af95241240f880f49b9d91d240a4a2b7e7d2b7c8a18ca1654e607fa8d2772dfd6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsuFEF9.tmp\InstallOptions.dll

Filesize
15KB

MD5
998189882c9f1be220c9faf0fd2bde15

SHA1
787d50c46c9a2a48565f684fabc7503aca8b0493

SHA256
f34385901206a3952fe2724edb3b0b123fd897119c774ab68c8745de6662d990

SHA512
e0c52ad851b476e7bcbadea8f993e5c6f9f70a9b46e2aebe8ee353a372b0bd5af95241240f880f49b9d91d240a4a2b7e7d2b7c8a18ca1654e607fa8d2772dfd6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsuFEF9.tmp\InstallOptions.dll

Filesize
15KB

MD5
998189882c9f1be220c9faf0fd2bde15

SHA1
787d50c46c9a2a48565f684fabc7503aca8b0493

SHA256
f34385901206a3952fe2724edb3b0b123fd897119c774ab68c8745de6662d990

SHA512
e0c52ad851b476e7bcbadea8f993e5c6f9f70a9b46e2aebe8ee353a372b0bd5af95241240f880f49b9d91d240a4a2b7e7d2b7c8a18ca1654e607fa8d2772dfd6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsuFEF9.tmp\InstallOptions.dll

Filesize
15KB

MD5
998189882c9f1be220c9faf0fd2bde15

SHA1
787d50c46c9a2a48565f684fabc7503aca8b0493

SHA256
f34385901206a3952fe2724edb3b0b123fd897119c774ab68c8745de6662d990

SHA512
e0c52ad851b476e7bcbadea8f993e5c6f9f70a9b46e2aebe8ee353a372b0bd5af95241240f880f49b9d91d240a4a2b7e7d2b7c8a18ca1654e607fa8d2772dfd6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsuFEF9.tmp\InstallOptions.dll

Filesize
15KB

MD5
998189882c9f1be220c9faf0fd2bde15

SHA1
787d50c46c9a2a48565f684fabc7503aca8b0493

SHA256
f34385901206a3952fe2724edb3b0b123fd897119c774ab68c8745de6662d990

SHA512
e0c52ad851b476e7bcbadea8f993e5c6f9f70a9b46e2aebe8ee353a372b0bd5af95241240f880f49b9d91d240a4a2b7e7d2b7c8a18ca1654e607fa8d2772dfd6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsuFEF9.tmp\InstallOptions.dll

Filesize
15KB

MD5
998189882c9f1be220c9faf0fd2bde15

SHA1
787d50c46c9a2a48565f684fabc7503aca8b0493

SHA256
f34385901206a3952fe2724edb3b0b123fd897119c774ab68c8745de6662d990

SHA512
e0c52ad851b476e7bcbadea8f993e5c6f9f70a9b46e2aebe8ee353a372b0bd5af95241240f880f49b9d91d240a4a2b7e7d2b7c8a18ca1654e607fa8d2772dfd6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsuFEF9.tmp\InstallOptions.dll

Filesize
15KB

MD5
998189882c9f1be220c9faf0fd2bde15

SHA1
787d50c46c9a2a48565f684fabc7503aca8b0493

SHA256
f34385901206a3952fe2724edb3b0b123fd897119c774ab68c8745de6662d990

SHA512
e0c52ad851b476e7bcbadea8f993e5c6f9f70a9b46e2aebe8ee353a372b0bd5af95241240f880f49b9d91d240a4a2b7e7d2b7c8a18ca1654e607fa8d2772dfd6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsuFEF9.tmp\InstallOptions.dll

Filesize
15KB

MD5
998189882c9f1be220c9faf0fd2bde15

SHA1
787d50c46c9a2a48565f684fabc7503aca8b0493

SHA256
f34385901206a3952fe2724edb3b0b123fd897119c774ab68c8745de6662d990

SHA512
e0c52ad851b476e7bcbadea8f993e5c6f9f70a9b46e2aebe8ee353a372b0bd5af95241240f880f49b9d91d240a4a2b7e7d2b7c8a18ca1654e607fa8d2772dfd6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsuFEF9.tmp\System.dll

Filesize
11KB

MD5
24523fe14bb9ba400a3950016b187915

SHA1
6ec152b4e4ac04038d4608a8a206070185116036

SHA256
c4aaf80e3990185eeb5ea56bf841dbf5f3d02269d715f3bfdfe8b54aa797a7b9

SHA512
ae73351d27109187f7c4e312bc30a165202f29d74c65dd0feaee75dab72b97d27c6482b1e95771063afec7e9f2ca03a27a11cd25e39228072b69c33fffef7257

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsuFEF9.tmp\UAC.dll

Filesize
14KB

MD5
adb29e6b186daa765dc750128649b63d

SHA1
160cbdc4cb0ac2c142d361df138c537aa7e708c9

SHA256
2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08

SHA512
b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsuFEF9.tmp\UserMgr.dll

Filesize
23KB

MD5
9210597fba3dfab3c69b1eb490205419

SHA1
6e3ca39043756ed1cceaf2d4853e7cb6be1c64cb

SHA256
7696c255014a543f720e189ab3fe48f62fcf43435465062649c96138eedb222f

SHA512
4877daefdd34725791fba7c8cc2d85c4e91080ca7787a71ee9ffde71704ac40799b891f03d1f1805a31af6ddc35e335f74c9d620e87d517670a378c001cffb06

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsuFEF9.tmp\ioSpecial.ini

Filesize
1KB

MD5
9aaa9ab8ae75ecd493591110cb7b9997

SHA1
93f298d8dc42348b7d031fa5c2b772b3f2df338a

SHA256
68b511823475949eb764b996621d3a8048df5ddb666c86bd88b6c7ba8e435da5

SHA512
0e114424ce7443790e5bdc9aaa080ebb5d4451b7615fd88c7e5b536d1bc91c2baeb71b8719c834e7d5033518b86066d69ed2322bf7875357b820a65ad8c68d8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsuFEF9.tmp\ioSpecial.ini

Filesize
1KB

MD5
48e08affe01caefb069f660a0d7260cd

SHA1
43a9d4f4778a3f2e8452a4d13a6aed1241d05f5b

SHA256
a0c134f14dc9cc67ae82e65ed374dc64cbc74a6580056abeb631f2890aa7cbf9

SHA512
e21c1ed8df8cb11923382fd2100ce01f9da0283eb8a27b5b804e95869ab1d7c1dc6dd0dce580585b2084e96c899f7895455218b2762ddaf2c58873fafa7c9223

Download Submit
memory/2396-61-0x0000000005640000-0x000000000574B000-memory.dmp

Filesize
1.0MB

Download
memory/2396-13-0x00000000055E0000-0x00000000056EB000-memory.dmp

Filesize
1.0MB

Download