3a6fb161d92cda9d5cc9399073070393ac23afd27684a08d2ce6f84586c72f20

Analysis

max time kernel
150s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-11-2024 15:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Flux.exe
Size

154.5MB
MD5

87278673be7f80f2fbfc5dc51d4cd83d
SHA1

19c05e365d15da1705cb6e057eb74ff7c1340ddc
SHA256

e3ee85f2d8fd1496cff031965769c6222cae8ffc66c52e0f8e832ff0d5e2e831
SHA512

0ecdd4568faf37f6aac7a9c41381a9e0ebbb36496fbfcc8a832ffb2c470c24cfdfbea17c2086eb22578e636b098ddb9170821070be91b02a98ed617088e5f4df
SSDEEP

1572864:1CquurbtqKajQe7vqrTU4PrCsdCXrBngPE1cG7VOWe2IkBmUgq3Fd6iU3x6VCdbm:xDAgZi

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Flux.exeFlux.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	Flux.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	Flux.exe

Loads dropped DLL 2 IoCs

Processes:

Flux.exe

pid process

2256 Flux.exe
2256 Flux.exe

pid	process
2256	Flux.exe
2256	Flux.exe

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Flux.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Flux.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Flux.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Flux.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Flux.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Flux.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Flux.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Flux.exe

Modifies registry class 7 IoCs

Processes:

Flux.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\fluxapp\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Flux.exe\" \"%1\""	Flux.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\fluxapp	Flux.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\fluxapp\URL Protocol	Flux.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\fluxapp\ = "URL:fluxapp"	Flux.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\fluxapp\shell\open\command	Flux.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\fluxapp\shell	Flux.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\fluxapp\shell\open	Flux.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

Flux.exeFlux.exe

pid process

2256 Flux.exe
2256 Flux.exe
4832 Flux.exe
4832 Flux.exe

pid	process
2256	Flux.exe
2256	Flux.exe
4832	Flux.exe
4832	Flux.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

Flux.exe

description	pid	process
Token: SeShutdownPrivilege	2256	Flux.exe
Token: SeCreatePagefilePrivilege	2256	Flux.exe
Token: SeShutdownPrivilege	2256	Flux.exe
Token: SeCreatePagefilePrivilege	2256	Flux.exe
Token: SeShutdownPrivilege	2256	Flux.exe
Token: SeCreatePagefilePrivilege	2256	Flux.exe
Token: SeShutdownPrivilege	2256	Flux.exe
Token: SeCreatePagefilePrivilege	2256	Flux.exe
Token: SeShutdownPrivilege	2256	Flux.exe
Token: SeCreatePagefilePrivilege	2256	Flux.exe
Token: SeShutdownPrivilege	2256	Flux.exe
Token: SeCreatePagefilePrivilege	2256	Flux.exe
Token: SeShutdownPrivilege	2256	Flux.exe
Token: SeCreatePagefilePrivilege	2256	Flux.exe
Token: SeShutdownPrivilege	2256	Flux.exe
Token: SeCreatePagefilePrivilege	2256	Flux.exe
Token: SeShutdownPrivilege	2256	Flux.exe
Token: SeCreatePagefilePrivilege	2256	Flux.exe
Token: SeShutdownPrivilege	2256	Flux.exe
Token: SeCreatePagefilePrivilege	2256	Flux.exe
Token: SeShutdownPrivilege	2256	Flux.exe
Token: SeCreatePagefilePrivilege	2256	Flux.exe
Token: SeShutdownPrivilege	2256	Flux.exe
Token: SeCreatePagefilePrivilege	2256	Flux.exe
Token: SeShutdownPrivilege	2256	Flux.exe
Token: SeCreatePagefilePrivilege	2256	Flux.exe
Token: SeShutdownPrivilege	2256	Flux.exe
Token: SeCreatePagefilePrivilege	2256	Flux.exe
Token: SeShutdownPrivilege	2256	Flux.exe
Token: SeCreatePagefilePrivilege	2256	Flux.exe
Token: SeShutdownPrivilege	2256	Flux.exe
Token: SeCreatePagefilePrivilege	2256	Flux.exe
Token: SeShutdownPrivilege	2256	Flux.exe
Token: SeCreatePagefilePrivilege	2256	Flux.exe
Token: SeShutdownPrivilege	2256	Flux.exe
Token: SeCreatePagefilePrivilege	2256	Flux.exe
Token: SeShutdownPrivilege	2256	Flux.exe
Token: SeCreatePagefilePrivilege	2256	Flux.exe
Token: SeShutdownPrivilege	2256	Flux.exe
Token: SeCreatePagefilePrivilege	2256	Flux.exe
Token: SeShutdownPrivilege	2256	Flux.exe
Token: SeCreatePagefilePrivilege	2256	Flux.exe
Token: SeShutdownPrivilege	2256	Flux.exe
Token: SeCreatePagefilePrivilege	2256	Flux.exe
Token: SeShutdownPrivilege	2256	Flux.exe
Token: SeCreatePagefilePrivilege	2256	Flux.exe
Token: SeShutdownPrivilege	2256	Flux.exe
Token: SeCreatePagefilePrivilege	2256	Flux.exe
Token: SeShutdownPrivilege	2256	Flux.exe
Token: SeCreatePagefilePrivilege	2256	Flux.exe
Token: SeShutdownPrivilege	2256	Flux.exe
Token: SeCreatePagefilePrivilege	2256	Flux.exe
Token: SeShutdownPrivilege	2256	Flux.exe
Token: SeCreatePagefilePrivilege	2256	Flux.exe
Token: SeShutdownPrivilege	2256	Flux.exe
Token: SeCreatePagefilePrivilege	2256	Flux.exe
Token: SeShutdownPrivilege	2256	Flux.exe
Token: SeCreatePagefilePrivilege	2256	Flux.exe
Token: SeShutdownPrivilege	2256	Flux.exe
Token: SeCreatePagefilePrivilege	2256	Flux.exe
Token: SeShutdownPrivilege	2256	Flux.exe
Token: SeCreatePagefilePrivilege	2256	Flux.exe
Token: SeShutdownPrivilege	2256	Flux.exe
Token: SeCreatePagefilePrivilege	2256	Flux.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Flux.exe

description	pid	process	target process
PID 2256 wrote to memory of 2032	2256	Flux.exe	FortniteLauncher.exe
PID 2256 wrote to memory of 2032	2256	Flux.exe	FortniteLauncher.exe
PID 2256 wrote to memory of 1284	2256	Flux.exe	Flux.exe
PID 2256 wrote to memory of 1284	2256	Flux.exe	Flux.exe
PID 2256 wrote to memory of 1284	2256	Flux.exe	Flux.exe
PID 2256 wrote to memory of 1284	2256	Flux.exe	Flux.exe
PID 2256 wrote to memory of 1284	2256	Flux.exe	Flux.exe
PID 2256 wrote to memory of 1284	2256	Flux.exe	Flux.exe
PID 2256 wrote to memory of 1284	2256	Flux.exe	Flux.exe
PID 2256 wrote to memory of 1284	2256	Flux.exe	Flux.exe
PID 2256 wrote to memory of 1284	2256	Flux.exe	Flux.exe
PID 2256 wrote to memory of 1284	2256	Flux.exe	Flux.exe
PID 2256 wrote to memory of 1284	2256	Flux.exe	Flux.exe
PID 2256 wrote to memory of 1284	2256	Flux.exe	Flux.exe
PID 2256 wrote to memory of 1284	2256	Flux.exe	Flux.exe
PID 2256 wrote to memory of 1284	2256	Flux.exe	Flux.exe
PID 2256 wrote to memory of 1284	2256	Flux.exe	Flux.exe
PID 2256 wrote to memory of 1284	2256	Flux.exe	Flux.exe
PID 2256 wrote to memory of 1284	2256	Flux.exe	Flux.exe
PID 2256 wrote to memory of 1284	2256	Flux.exe	Flux.exe
PID 2256 wrote to memory of 1284	2256	Flux.exe	Flux.exe
PID 2256 wrote to memory of 1284	2256	Flux.exe	Flux.exe
PID 2256 wrote to memory of 1284	2256	Flux.exe	Flux.exe
PID 2256 wrote to memory of 1284	2256	Flux.exe	Flux.exe
PID 2256 wrote to memory of 1284	2256	Flux.exe	Flux.exe
PID 2256 wrote to memory of 1284	2256	Flux.exe	Flux.exe
PID 2256 wrote to memory of 1284	2256	Flux.exe	Flux.exe
PID 2256 wrote to memory of 1284	2256	Flux.exe	Flux.exe
PID 2256 wrote to memory of 1284	2256	Flux.exe	Flux.exe
PID 2256 wrote to memory of 1284	2256	Flux.exe	Flux.exe
PID 2256 wrote to memory of 1284	2256	Flux.exe	Flux.exe
PID 2256 wrote to memory of 1284	2256	Flux.exe	Flux.exe
PID 2256 wrote to memory of 1284	2256	Flux.exe	Flux.exe
PID 2256 wrote to memory of 3956	2256	Flux.exe	Flux.exe
PID 2256 wrote to memory of 3956	2256	Flux.exe	Flux.exe
PID 2256 wrote to memory of 4100	2256	Flux.exe	Flux.exe
PID 2256 wrote to memory of 4100	2256	Flux.exe	Flux.exe
PID 2256 wrote to memory of 4100	2256	Flux.exe	Flux.exe
PID 2256 wrote to memory of 4100	2256	Flux.exe	Flux.exe
PID 2256 wrote to memory of 4100	2256	Flux.exe	Flux.exe
PID 2256 wrote to memory of 4100	2256	Flux.exe	Flux.exe
PID 2256 wrote to memory of 4100	2256	Flux.exe	Flux.exe
PID 2256 wrote to memory of 4100	2256	Flux.exe	Flux.exe
PID 2256 wrote to memory of 4100	2256	Flux.exe	Flux.exe
PID 2256 wrote to memory of 4100	2256	Flux.exe	Flux.exe
PID 2256 wrote to memory of 4100	2256	Flux.exe	Flux.exe
PID 2256 wrote to memory of 4100	2256	Flux.exe	Flux.exe
PID 2256 wrote to memory of 4100	2256	Flux.exe	Flux.exe
PID 2256 wrote to memory of 4100	2256	Flux.exe	Flux.exe
PID 2256 wrote to memory of 4100	2256	Flux.exe	Flux.exe
PID 2256 wrote to memory of 4100	2256	Flux.exe	Flux.exe
PID 2256 wrote to memory of 4100	2256	Flux.exe	Flux.exe
PID 2256 wrote to memory of 4100	2256	Flux.exe	Flux.exe
PID 2256 wrote to memory of 4100	2256	Flux.exe	Flux.exe
PID 2256 wrote to memory of 4100	2256	Flux.exe	Flux.exe
PID 2256 wrote to memory of 4100	2256	Flux.exe	Flux.exe
PID 2256 wrote to memory of 4100	2256	Flux.exe	Flux.exe
PID 2256 wrote to memory of 4100	2256	Flux.exe	Flux.exe
PID 2256 wrote to memory of 4100	2256	Flux.exe	Flux.exe
PID 2256 wrote to memory of 4100	2256	Flux.exe	Flux.exe
PID 2256 wrote to memory of 4100	2256	Flux.exe	Flux.exe
PID 2256 wrote to memory of 4100	2256	Flux.exe	Flux.exe
PID 2256 wrote to memory of 4100	2256	Flux.exe	Flux.exe
PID 2256 wrote to memory of 4100	2256	Flux.exe	Flux.exe

C:\Users\Admin\AppData\Local\Temp\Flux.exe
"C:\Users\Admin\AppData\Local\Temp\Flux.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Users\Admin\AppData\Local\Temp\binaries\FortniteLauncher.exe
  C:\Users\Admin\AppData\Local\Temp\binaries\FortniteLauncher.exe
  2⤵
  PID:2032
- C:\Users\Admin\AppData\Local\Temp\Flux.exe
  "C:\Users\Admin\AppData\Local\Temp\Flux.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Flux" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1708 --field-trial-handle=1784,i,626866343854456253,4676630842337300181,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  PID:1284
- C:\Users\Admin\AppData\Local\Temp\Flux.exe
  "C:\Users\Admin\AppData\Local\Temp\Flux.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Flux" --mojo-platform-channel-handle=1944 --field-trial-handle=1784,i,626866343854456253,4676630842337300181,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
  2⤵
  PID:3956
- C:\Users\Admin\AppData\Local\Temp\Flux.exe
  "C:\Users\Admin\AppData\Local\Temp\Flux.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Flux" --app-user-model-id=Flux --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --enable-sandbox --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2332 --field-trial-handle=1784,i,626866343854456253,4676630842337300181,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
  2⤵
  - Checks computer location settings
  PID:4100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\VisualStudio\14.0\VC\Runtimes\x64" /v "Installed""
  2⤵
  PID:4992
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\VisualStudio\14.0\VC\Runtimes\x64" /v "Installed"
    3⤵
    PID:3912
- C:\Users\Admin\AppData\Local\Temp\Flux.exe
  "C:\Users\Admin\AppData\Local\Temp\Flux.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\Flux" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2644 --field-trial-handle=1784,i,626866343854456253,4676630842337300181,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\20683f31-e7fe-4371-a00f-f03effce6d69.tmp.node

Filesize
248KB

MD5
c534e350395bd5e0e39417a71513648e

SHA1
4439aa0f96e707c6324c1cd8080253692c16af6e

SHA256
3790b9fabedfe3c3b2161f13ca1a209516779649c4374c3941ae9a8720cbbc36

SHA512
a183dc39b82dbb27574f0251133a4c7ba3f7b2c695c7eeabb62df92e1dbab582b8326470bf1443510664a6dac128b230239a418a24b8e3d4923038ed60de2757

Download Submit
C:\Users\Admin\AppData\Local\Temp\7a9162ff-4ae1-473d-b466-1b16583a167f.tmp.node

Filesize
4.6MB

MD5
07423989cdcb444f519f22f78526498d

SHA1
e0cc86c48b430f574dfd1a7a91ef9d35b572b14c

SHA256
3b407af04ef8ffa39b1b7d34c1ad6a15be766ebbb6ff27ddeb40c5380f981fdd

SHA512
56cd17c5ff8fbc35915b1738c42a80299f5e47906acc4c8910b810cf8ed95832a1a69068df89a76fd325c02c6b06d57fe7fde693ead1007b75090088ab8646c5

Download Submit
C:\Users\Admin\AppData\Roaming\Flux\Network\Network Persistent State

Filesize
917B

MD5
4e8869586ec738a7006c85c36390a52a

SHA1
c9ee0d2bcf21c49d269fb699974cd08c98ac606d

SHA256
a3787791aebbe7bfeac698e98510f27c5c71d89d22570d650d5c1a497b987de0

SHA512
489bb778d95a939a5a377679d07af91ff4e1907174debb06e24c1cd4e570cbdab58f6dc90e4bf5a6b900e813bd1c71ed1707adca755b5c7a1784f7ccef5587af

Download Submit
C:\Users\Admin\AppData\Roaming\Flux\Network\Network Persistent State~RFe58baee.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
memory/2032-71-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4100-57-0x00007FFE55A30000-0x00007FFE55A31000-memory.dmp

Filesize
4KB

Download
memory/4100-74-0x0000013E4DB70000-0x0000013E4DBA0000-memory.dmp

Filesize
192KB

Download
memory/4100-58-0x00007FFE574E0000-0x00007FFE574E1000-memory.dmp

Filesize
4KB

Download
memory/4832-110-0x000001BA210C0000-0x000001BA210C1000-memory.dmp

Filesize
4KB

Download
memory/4832-109-0x000001BA210C0000-0x000001BA210C1000-memory.dmp

Filesize
4KB

Download
memory/4832-108-0x000001BA210C0000-0x000001BA210C1000-memory.dmp

Filesize
4KB

Download
memory/4832-120-0x000001BA210C0000-0x000001BA210C1000-memory.dmp

Filesize
4KB

Download
memory/4832-119-0x000001BA210C0000-0x000001BA210C1000-memory.dmp

Filesize
4KB

Download
memory/4832-118-0x000001BA210C0000-0x000001BA210C1000-memory.dmp

Filesize
4KB

Download
memory/4832-117-0x000001BA210C0000-0x000001BA210C1000-memory.dmp

Filesize
4KB

Download
memory/4832-116-0x000001BA210C0000-0x000001BA210C1000-memory.dmp

Filesize
4KB

Download
memory/4832-115-0x000001BA210C0000-0x000001BA210C1000-memory.dmp

Filesize
4KB

Download
memory/4832-114-0x000001BA210C0000-0x000001BA210C1000-memory.dmp

Filesize
4KB

Download