241c4f4aea828e2dba276c2e510340703129f08f6ab6714f253c1d36497c062c

Resubmissions

25/11/2023, 13:43

231125-q1fgzsag78 7

25/11/2023, 13:41

231125-qzfflabd51 7

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
25/11/2023, 13:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

flcluster-1.1.0_setup.exe
Size

2.4MB
MD5

f5a98c9776d865c0ba05b15d46323205
SHA1

56d1ecedb1a9d10ff799827f1dbba87b8787bc0b
SHA256

241c4f4aea828e2dba276c2e510340703129f08f6ab6714f253c1d36497c062c
SHA512

005f894cb42f7ab44c7581b3f658374166d233d193ef0a90cfc8beacc49841e20e0b2b93d062e2ddf2cf0dd241225f250c4ee6f2516678b9875ac25fbdd9dab4
SSDEEP

49152:DidZhIzoR88i2b/ZKuJiB/fsCQFDWoF9bnY8bsGpSweAvNQ8oag+D:mZhXq8i2bxDJiB38F6oTnYgpJvBgs

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2548	flcluster.exe

Loads dropped DLL 1 IoCs

pid	Process
2028	flcluster-1.1.0_setup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2028	flcluster-1.1.0_setup.exe

C:\Users\Admin\AppData\Local\Temp\flcluster-1.1.0_setup.exe
"C:\Users\Admin\AppData\Local\Temp\flcluster-1.1.0_setup.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:2028

C:\Users\Admin\Desktop\flcluster-1.1.0\flcluster.exe
"C:\Users\Admin\Desktop\flcluster-1.1.0\flcluster.exe"
1⤵
- Executes dropped EXE
PID:2548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Desktop\flcluster-1.1.0\flcluster.exe

Filesize
10.4MB

MD5
6d7851cfd63c92e169b37f6efef0ea5c

SHA1
26c6da3804c8cab058153c015f1993bcb407e9ed

SHA256
7eb59025bdf392ac4d67c0b206cfaa08c0968b54114f3b7265e57c45ade00481

SHA512
bcdd1f4f7695893ce5d8d4eafe4e56d2bbccbd37570ec031df6d27994036856dc0d1f319b02731901d156563733121860b1c07bd1444fcf8e4725d17c4261d24

Download Submit
C:\Users\Admin\Desktop\flcluster-1.1.0\flcluster.exe

Filesize
10.4MB

MD5
6d7851cfd63c92e169b37f6efef0ea5c

SHA1
26c6da3804c8cab058153c015f1993bcb407e9ed

SHA256
7eb59025bdf392ac4d67c0b206cfaa08c0968b54114f3b7265e57c45ade00481

SHA512
bcdd1f4f7695893ce5d8d4eafe4e56d2bbccbd37570ec031df6d27994036856dc0d1f319b02731901d156563733121860b1c07bd1444fcf8e4725d17c4261d24

Download Submit
\Users\Admin\Desktop\flcluster-1.1.0\uninstall.exe

Filesize
88KB

MD5
ef72b74fd3b05abbbed4ad0fed123ccd

SHA1
960c18cf74be54ac5a5c7724a77c81ce4d5e6ff6

SHA256
c0d3ff4c94cfb89a0d9a779e4f097cbc38e83a14d53a12bacb43d4c4a5475624

SHA512
5670f35ea2ba4ce3791365c5dc1c3f6c51098f8a6a646ad595c68af98b8f980ac628435913c7767b360efb19982af3019ac026a37987636d72ff15290a9da5d4

Download Submit
memory/2028-1-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/2028-17-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/2028-21-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/2028-0-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/2548-28-0x0000000000400000-0x0000000000D1D000-memory.dmp

Filesize
9.1MB

Download
memory/2548-30-0x0000000000400000-0x0000000000D1D000-memory.dmp

Filesize
9.1MB

Download
memory/2548-31-0x0000000000400000-0x0000000000D1D000-memory.dmp

Filesize
9.1MB

Download
memory/2548-32-0x0000000000400000-0x0000000000D1D000-memory.dmp

Filesize
9.1MB

Download
memory/2548-33-0x0000000000400000-0x0000000000D1D000-memory.dmp

Filesize
9.1MB

Download
memory/2548-35-0x0000000000400000-0x0000000000D1D000-memory.dmp

Filesize
9.1MB

Download