Overview

overview

7

Static

static

7

flstudio_11.0.4.exe

windows7-x64

7

flstudio_11.0.4.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    flstudio_11.0.4.exe

  • Size

    300.2MB

  • Sample

    240420-2dkzqscb5s

  • MD5

    de0748256dfe26b27d00e6232cb88ee0

  • SHA1

    f9bdc2fb0b8d18ffce90e048b12a0c196d0b82d0

  • SHA256

    c8b6e3996c36aa85738911b1838aeaed69b986b4f3e39435424b7521b42df675

  • SHA512

    c4aac4167ae2266cdba9e902df14cef689e2b96c01d7a91cad046f682ab9fc38692db13fdc53845b8076bc6a20186704c61b3232eeab7608433042cbdcbd4790

  • SSDEEP

    6291456:Zov8/Fu2qrwZVF1+Qu132htLW20Ae7vGGh1Ar2ESudf5WemT:qvmFdZ3WEL/0Ae7vGhaICT

Score
7/10
aspackv2discoverylinkpdfpersistenceupx

Malware Config

Targets

    • Target

      flstudio_11.0.4.exe

    • Size

      300.2MB

    • MD5

      de0748256dfe26b27d00e6232cb88ee0

    • SHA1

      f9bdc2fb0b8d18ffce90e048b12a0c196d0b82d0

    • SHA256

      c8b6e3996c36aa85738911b1838aeaed69b986b4f3e39435424b7521b42df675

    • SHA512

      c4aac4167ae2266cdba9e902df14cef689e2b96c01d7a91cad046f682ab9fc38692db13fdc53845b8076bc6a20186704c61b3232eeab7608433042cbdcbd4790

    • SSDEEP

      6291456:Zov8/Fu2qrwZVF1+Qu132htLW20Ae7vGGh1Ar2ESudf5WemT:qvmFdZ3WEL/0Ae7vGhaICT

    Score
    7/10
    discoverypersistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Registers COM server for autorun

      persistence

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

3
T1012

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks