Overview
overview
7Static
static
3flstudio_11.1.exe
windows7-x64
7flstudio_11.1.exe
windows10-2004-x64
7$0/ILMinih...32.exe
windows7-x64
3$0/ILMinih...32.exe
windows10-2004-x64
3$0/ILMinih...64.exe
windows7-x64
3$0/ILMinih...64.exe
windows10-2004-x64
3$0/ILPlugi...32.exe
windows7-x64
3$0/ILPlugi...32.exe
windows10-2004-x64
3$0/ILPlugi...64.exe
windows7-x64
3$0/ILPlugi...64.exe
windows10-2004-x64
3$_3_/ILDow...er.exe
windows7-x64
3$_3_/ILDow...er.exe
windows10-2004-x64
3$_3_/Updat...er.exe
windows7-x64
7$_3_/Updat...er.exe
windows10-2004-x64
7$_4_/ILDow...er.exe
windows7-x64
3$_4_/ILDow...er.exe
windows10-2004-x64
3$_4_/Updat...er.exe
windows7-x64
7$_4_/Updat...er.exe
windows10-2004-x64
7Analysis
- max time kernel
4s - max time network
16s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system - submitted
24/02/2024, 17:03
Static task
static1
Behavioral task
behavioral1
Sample
flstudio_11.1.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral2
Sample
flstudio_11.1.exe
Resource
win10v2004-20240221-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$0/ILMinihostBridge32.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral4
Sample
$0/ILMinihostBridge32.exe
Resource
win10v2004-20240221-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
$0/ILMinihostBridge64.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral6
Sample
$0/ILMinihostBridge64.exe
Resource
win10v2004-20240221-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
$0/ILPluginScanner32.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral8
Sample
$0/ILPluginScanner32.exe
Resource
win10v2004-20240221-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
$0/ILPluginScanner64.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral10
Sample
$0/ILPluginScanner64.exe
Resource
win10v2004-20240221-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
$_3_/ILDownloadManager.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral12
Sample
$_3_/ILDownloadManager.exe
Resource
win10v2004-20240221-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
$_3_/Update/Updater.exe
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral14
Sample
$_3_/Update/Updater.exe
Resource
win10v2004-20240221-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
$_4_/ILDownloadManager.exe
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral16
Sample
$_4_/ILDownloadManager.exe
Resource
win10v2004-20240221-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
$_4_/Update/Updater.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral18
Sample
$_4_/Update/Updater.exe
Resource
win10v2004-20240221-en
windows10-2004-x64
General
- Target flstudio_11.1.exe
- Size 348.2MB
- Sample240224-vkn7eaha52
- SHA256 79d352413ec91e3c74925718fd3a7e8d6f234d62a2ceffb6a1e7c5b257ec48e9
- MD5 ddaaa231e042bfe80f378e4e0d006e76
- SHA1 709e3cc71aec905938a0c0dd64c82d10249c8962
- SHA512 f64e24c77c88c53f8ef396f384a0d094149f2c1fc2e7c9c48d71da56646e2ba8b093375b2829c1b8e9e84d19a76fc4f0eba98db19f2b0da7dabcbfc265921a59
- SSDEEP 6291456:8/5YjuChKJa7uE1/r1m6iu8tA3Q8KarvxabS+pWdK+Okau9MTB5ViZGdZD:8R2ByuuE1DPmC1Gv7FVnIZGdZD
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Loads dropped DLL 8 IoCs
pid Process 2200 flstudio_11.1.exe 2200 flstudio_11.1.exe 2200 flstudio_11.1.exe 2200 flstudio_11.1.exe 2200 flstudio_11.1.exe 2200 flstudio_11.1.exe 2200 flstudio_11.1.exe 2200 flstudio_11.1.exe - Drops file in Program Files directory 55 IoCs
description ioc Process File created C:\Program Files (x86)\Image-Line\Shared\Artwork\Fonts\Francois One\OFL.txt flstudio_11.1.exe File created C:\Program Files (x86)\Image-Line\Shared\Artwork\Fonts\Open_Sans_Condensed\LICENSE.txt flstudio_11.1.exe File created C:\Program Files (x86)\Image-Line\Shared\Artwork\Fonts\PT Sans\OFL.txt flstudio_11.1.exe File created C:\Program Files (x86)\Image-Line\Shared\ILMinihostBridge64.exe flstudio_11.1.exe File created C:\Program Files (x86)\Image-Line\Shared\QuickFontCache.dll flstudio_11.1.exe File created C:\Program Files (x86)\Image-Line\Shared\dsp_ipp_x64.dll flstudio_11.1.exe File created C:\Program Files (x86)\Image-Line\Shared\Reverb_x64.dll flstudio_11.1.exe File created C:\Program Files (x86)\Image-Line\Shared\Artwork\Fonts\OpenSans-CondLight.ttf flstudio_11.1.exe File created C:\Program Files (x86)\Image-Line\Shared\Artwork\Fonts\PT_Sans-Web-Regular.ttf flstudio_11.1.exe File created C:\Program Files (x86)\Image-Line\Shared\Artwork\Fonts\Share-Regular.ttf flstudio_11.1.exe File created C:\Program Files (x86)\Image-Line\Shared\DirectWaveCtEngine.dll flstudio_11.1.exe File created C:\Program Files (x86)\Image-Line\Shared\ILRemoteServer_x64.dll flstudio_11.1.exe File created C:\Program Files (x86)\Image-Line\Shared\REX Shared Library_x64.dll flstudio_11.1.exe File created C:\Program Files (x86)\Image-Line\Shared\Artwork\Fonts\Cuprum\OFL.txt flstudio_11.1.exe File created C:\Program Files (x86)\Image-Line\Shared\uninstall.exe flstudio_11.1.exe File created C:\Program Files (x86)\Image-Line\Shared\elastique_x64.dll flstudio_11.1.exe File created C:\Program Files (x86)\Image-Line\Shared\Artwork\Fonts\ILGlyphs.ttf flstudio_11.1.exe File created C:\Program Files (x86)\Image-Line\Shared\Artwork\Fonts\Revalia-Regular.ttf flstudio_11.1.exe File created C:\Program Files (x86)\Image-Line\Shared\Artwork\Fonts\Share\OFL.txt flstudio_11.1.exe File created C:\Program Files (x86)\Image-Line\Shared\QuickFontCache_x64.dll flstudio_11.1.exe File created C:\Program Files (x86)\Image-Line\Shared\REX Shared Library.dll flstudio_11.1.exe File created C:\Program Files (x86)\Image-Line\Shared\SG_x64.dll flstudio_11.1.exe File created C:\Program Files (x86)\Image-Line\Shared\wavpackdll.dll flstudio_11.1.exe File created C:\Program Files (x86)\Image-Line\Shared\ILMinihostBridge32.exe flstudio_11.1.exe File created C:\Program Files (x86)\Image-Line\Shared\freetype.dll flstudio_11.1.exe File created C:\Program Files (x86)\Image-Line\Shared\wavpackdll_x64.dll flstudio_11.1.exe File created C:\Program Files (x86)\Image-Line\Shared\dsp_ipp.dll flstudio_11.1.exe File created C:\Program Files (x86)\Image-Line\Shared\Artwork\Fonts\FrancoisOne.ttf flstudio_11.1.exe File created C:\Program Files (x86)\Image-Line\Shared\Artwork\Fonts\RobotoCondensed-Regular.ttf flstudio_11.1.exe File created C:\Program Files (x86)\Image-Line\Shared\DelZip64.dll flstudio_11.1.exe File created C:\Program Files (x86)\Image-Line\Shared\LAMEenc.dll flstudio_11.1.exe File created C:\Program Files (x86)\Image-Line\Shared\oggio.dll flstudio_11.1.exe File created C:\Program Files (x86)\Image-Line\Shared\steam_api.dll flstudio_11.1.exe File created C:\Program Files (x86)\Image-Line\Shared\Artwork\Fonts\JosefinSans-SemiBold.ttf flstudio_11.1.exe File created C:\Program Files (x86)\Image-Line\Shared\DelZip190.dll flstudio_11.1.exe File created C:\Program Files (x86)\Image-Line\Shared\Artwork\Fonts\UbuntuCondensed-Regular.ttf flstudio_11.1.exe File created C:\Program Files (x86)\Image-Line\Shared\freetype_x64.dll flstudio_11.1.exe File created C:\Program Files (x86)\Image-Line\Shared\oggio_x64.dll flstudio_11.1.exe File created C:\Program Files (x86)\Image-Line\Shared\Artwork\Fonts\ILCursors.ttf flstudio_11.1.exe File created C:\Program Files (x86)\Image-Line\Shared\Artwork\Fonts\Revalia\OFL.txt flstudio_11.1.exe File created C:\Program Files (x86)\Image-Line\Shared\ILPluginScanner64.exe flstudio_11.1.exe File created C:\Program Files (x86)\Image-Line\Shared\steam_api64.dll flstudio_11.1.exe File created C:\Program Files (x86)\Image-Line\Shared\Artwork\Fonts\RobotoCondensed-Light.ttf flstudio_11.1.exe File created C:\Program Files (x86)\Image-Line\Shared\DirectWaveCtEngine_x64.dll flstudio_11.1.exe File created C:\Program Files (x86)\Image-Line\Shared\LAMEenc_x64.dll flstudio_11.1.exe File created C:\Program Files (x86)\Image-Line\Shared\Reverb.dll flstudio_11.1.exe File created C:\Program Files (x86)\Image-Line\Shared\Artwork\Fonts\Cuprum.ttf flstudio_11.1.exe File created C:\Program Files (x86)\Image-Line\Shared\Artwork\Fonts\Ubuntu-R.ttf flstudio_11.1.exe File created C:\Program Files (x86)\Image-Line\Shared\ILPluginScanner32.exe flstudio_11.1.exe File created C:\Program Files (x86)\Image-Line\Shared\ILRemoteServer.dll flstudio_11.1.exe File created C:\Program Files (x86)\Image-Line\Shared\SG.dll flstudio_11.1.exe File created C:\Program Files (x86)\Image-Line\Shared\Artwork\Fonts\PT_Sans-Narrow-Web-Regular.ttf flstudio_11.1.exe File created C:\Program Files (x86)\Image-Line\Shared\Elastique.dll flstudio_11.1.exe File created C:\Program Files (x86)\Image-Line\Shared\Artwork\Fonts\ILGlyphsEx.ttf flstudio_11.1.exe File created C:\Program Files (x86)\Image-Line\Shared\Artwork\Fonts\Roboto_Condensed\LICENSE.txt flstudio_11.1.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path \Program Files (x86)\Image-Line\Shared\dsp_ipp.dll
- Size 3.4MB
- SHA256 f4e8d0f898effe353237c9afe30e5922609a5fdb5cfa1bd1110534aef7802952
- MD5 a48296dd463f94350cd9f481a83ff792
- SHA1 5bf19d71b189367554e991fdceb429a8b2f435aa
- SHA512 c47978f089f668c12fb380a90a23a41c2f10c4b485bd3ed4337f0ab0640143f55a7d87932e417a0269c1e7ad0c25003bd970d7d7396e19244cf68745aefc5d3e
- SSDEEP 49152:GsXqlU7UKTrygk7Mrxb0AyRsx8TuvC/4+AFk1KhPELNr:GKvdk+xAAGs8Cvc4+j1K+LJ
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\nsi5820.tmp\FindFLPath.dll
- Size 937KB
- SHA256 f0919dc170478243e93f301dd1bb6dda415d37152e8bb5b6cc14a86bc9b0bf2e
- MD5 aaf3ae1b962427a046857aef33ed8b95
- SHA1 d551dd388be075922962220fb12d82a76397d1ad
- SHA512 bcc5cb3630ace7bd8cf83eeacdbd8d8df286c4702c4279e0b407b31781f89da43d850c88ea3141bda5cf6884c297a549d44e92df0ed958c6752035c8e177c45f
- SSDEEP 24576:ye9ZfQNS8KuzexeJmw5T6UIn6yBt9659:njGzAeJPKVt9659
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\nsi5820.tmp\ILInstallUtil.dll
- Size 343KB
- SHA256 32b674a0de4577544e138b7675110a6f09a99dd576a8b847af6a8e5976002325
- MD5 e396b4dba8c838b9eec93e8ef428e73e
- SHA1 f4c17acabd53262ce1576e1a59a4f8dc264ef077
- SHA512 cab82519fe54f37d33e5254ba6abe3cf1533580535a27faf5f8c9caf832269564067e9355a99e33d8cc218c19f20fa17e439aa49ea21058435f933fe246bac1d
- SSDEEP 6144:9S9ZlvuAVyPczPlWo+AiL9RujmwyJYi8q8V1NjQ:98ZlvvVqcz9WpuyJgfV1ZQ
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\nsi5820.tmp\System.dll
- Size 11KB
- SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
- MD5 c17103ae9072a06da581dec998343fc1
- SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
- SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
- SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\nsi5820.tmp\UAC.dll
- Size 13KB
- SHA256 a6d956f28c32e8aa2ab2df13ef52637e23113fab41225031e7a3d47390a6cf13
- MD5 431e5b960aa15af5d153bae6ba6b7e87
- SHA1 e090c90be02e0bafe5f3d884c0525d8f87b3db40
- SHA512 f1526c7e4d0fce8ab378e43e89aafb1d7e9d57ef5324501e804091e99331dd2544912181d6d4a07d30416fe17c892867c593aee623834935e11c7bb385c6a0a8
- SSDEEP 192:vIARvmFvcukSWn8EAKVZ8148Dj33RZgqWVWYuOUEjRuFzEun0J:v2mukSe8EA88pRZAVWYuO3cFznny
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\nsi5820.tmp\UserMgr.dll
- Size 55KB
- SHA256 54a9ab4ac127d950ad293a71f5a496af3ab09b70aa73839fd0f1c9cbaf35f70e
- MD5 74813d238f84d5c0f5328bd7ba79537a
- SHA1 5aeecd94f0902bad1572fd2cceada9ad44af6725
- SHA512 ac7fb85c6375bc3e0e76b535550b604cbad31e69696030314f34e41d3bb5c04411ec826c89885c30556649961d45061f501db6a37a23bb419e4f1e7cea34deff
- SSDEEP 768:WThBSJtwQegACHpCygw5eKeK/B/viiTRvTkujLWf2UEHzDSZA7yM5jt/BJE4lW:aSCQeLCHpCyNV9ZTRbkuOQzyMVt/blW
- MD5 SHA1 SHA512 SSDEEP