Analysis
- max time kernel
150s - max time network
122s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
12/07/2026, 23:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Feishu_Setup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
Feishu_Setup.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target Feishu_Setup.exe
- Size 4.7MB
- Sample260712-3rb5eshx7j
- SHA256 dfacebad09d75d41ee5f477754815ae7e4afd926638d7b72a6a25338cd2479da
- MD5 26d7035a2330793f6d67f2b3c5429f95
- SHA1 e6c21df0a8142465a410de7e6da31ece2c2fab4a
- SHA512 d2fb401c560de56543080b21001f3b1d5e837e39dca5e1c30e4af4af2a2645e14f6c16c1c5a2bc65830d09d9e8faf439f5b0fcb303dc2eb3b96cbcd35da8a70a
- SSDEEP 98304:qTQUX2D2LH8oRO+TJOTs5BqrSZ5DgOc+pV6UHsiXMoj9ghi1RebMIg9Cbk/V+thx:qF2UH/rTJOTs5BqrSZ5DgOc+pVNsiXMb
- TLSH T1AC36BE96AEAD40D8D895D075C557491BE7B6BC242331838B317DFA5B6F333920E2E322
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4604 Iconsext.exe - Loads dropped DLL 9 IoCs
pid Process 4604 Iconsext.exe 4604 Iconsext.exe 4604 Iconsext.exe 4604 Iconsext.exe 4604 Iconsext.exe 4604 Iconsext.exe 4604 Iconsext.exe 4604 Iconsext.exe 4604 Iconsext.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4604 Iconsext.exe 4604 Iconsext.exe 4604 Iconsext.exe 4604 Iconsext.exe 4604 Iconsext.exe 4604 Iconsext.exe 4604 Iconsext.exe 4604 Iconsext.exe 4604 Iconsext.exe 4604 Iconsext.exe 4604 Iconsext.exe 4604 Iconsext.exe 4604 Iconsext.exe 4604 Iconsext.exe 4604 Iconsext.exe 4604 Iconsext.exe 4604 Iconsext.exe 4604 Iconsext.exe 4604 Iconsext.exe 4604 Iconsext.exe 4604 Iconsext.exe 4604 Iconsext.exe 4604 Iconsext.exe 4604 Iconsext.exe 4604 Iconsext.exe 4604 Iconsext.exe 4604 Iconsext.exe 4604 Iconsext.exe 4604 Iconsext.exe 4604 Iconsext.exe 4604 Iconsext.exe 4604 Iconsext.exe 4604 Iconsext.exe 4604 Iconsext.exe 4604 Iconsext.exe 4604 Iconsext.exe 4604 Iconsext.exe 4604 Iconsext.exe 4604 Iconsext.exe 4604 Iconsext.exe 4604 Iconsext.exe 4604 Iconsext.exe 4604 Iconsext.exe 4604 Iconsext.exe 4604 Iconsext.exe 4604 Iconsext.exe 4604 Iconsext.exe 4604 Iconsext.exe 4604 Iconsext.exe 4604 Iconsext.exe 4604 Iconsext.exe 4604 Iconsext.exe 4604 Iconsext.exe 4604 Iconsext.exe 4604 Iconsext.exe 4604 Iconsext.exe 4604 Iconsext.exe 4604 Iconsext.exe 4604 Iconsext.exe 4604 Iconsext.exe 4604 Iconsext.exe 4604 Iconsext.exe 4604 Iconsext.exe 4604 Iconsext.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4604 Iconsext.exe Token: SeDebugPrivilege 4604 Iconsext.exe Token: SeDebugPrivilege 4604 Iconsext.exe Token: SeDebugPrivilege 4604 Iconsext.exe Token: SeDebugPrivilege 4604 Iconsext.exe Token: SeDebugPrivilege 4604 Iconsext.exe Token: SeDebugPrivilege 4604 Iconsext.exe Token: SeDebugPrivilege 4604 Iconsext.exe Token: SeDebugPrivilege 4604 Iconsext.exe Token: SeDebugPrivilege 4604 Iconsext.exe Token: SeDebugPrivilege 4604 Iconsext.exe Token: SeDebugPrivilege 4604 Iconsext.exe Token: SeDebugPrivilege 4604 Iconsext.exe Token: SeDebugPrivilege 4604 Iconsext.exe Token: SeDebugPrivilege 4604 Iconsext.exe Token: SeDebugPrivilege 4604 Iconsext.exe Token: SeDebugPrivilege 4604 Iconsext.exe Token: SeDebugPrivilege 4604 Iconsext.exe Token: SeDebugPrivilege 4604 Iconsext.exe Token: SeDebugPrivilege 4604 Iconsext.exe Token: SeDebugPrivilege 4604 Iconsext.exe Token: SeDebugPrivilege 4604 Iconsext.exe Token: SeDebugPrivilege 4604 Iconsext.exe Token: SeDebugPrivilege 4604 Iconsext.exe Token: SeDebugPrivilege 4604 Iconsext.exe Token: SeDebugPrivilege 4604 Iconsext.exe Token: SeDebugPrivilege 4604 Iconsext.exe Token: SeDebugPrivilege 4604 Iconsext.exe Token: SeDebugPrivilege 4604 Iconsext.exe Token: SeDebugPrivilege 4604 Iconsext.exe Token: SeDebugPrivilege 4604 Iconsext.exe Token: SeDebugPrivilege 4604 Iconsext.exe Token: SeDebugPrivilege 4604 Iconsext.exe Token: SeDebugPrivilege 4604 Iconsext.exe Token: SeDebugPrivilege 4604 Iconsext.exe Token: SeDebugPrivilege 4604 Iconsext.exe Token: SeDebugPrivilege 4604 Iconsext.exe Token: SeDebugPrivilege 4604 Iconsext.exe Token: SeDebugPrivilege 4604 Iconsext.exe Token: SeDebugPrivilege 4604 Iconsext.exe Token: SeDebugPrivilege 4604 Iconsext.exe Token: SeDebugPrivilege 4604 Iconsext.exe Token: SeDebugPrivilege 4604 Iconsext.exe Token: SeDebugPrivilege 4604 Iconsext.exe Token: SeDebugPrivilege 4604 Iconsext.exe Token: SeDebugPrivilege 4604 Iconsext.exe Token: SeDebugPrivilege 4604 Iconsext.exe Token: SeDebugPrivilege 4604 Iconsext.exe Token: SeDebugPrivilege 4604 Iconsext.exe Token: SeDebugPrivilege 4604 Iconsext.exe Token: SeDebugPrivilege 4604 Iconsext.exe Token: SeDebugPrivilege 4604 Iconsext.exe Token: SeDebugPrivilege 4604 Iconsext.exe Token: SeDebugPrivilege 4604 Iconsext.exe Token: SeDebugPrivilege 4604 Iconsext.exe Token: SeDebugPrivilege 4604 Iconsext.exe Token: SeDebugPrivilege 4604 Iconsext.exe Token: SeDebugPrivilege 4604 Iconsext.exe Token: SeDebugPrivilege 4604 Iconsext.exe Token: SeDebugPrivilege 4604 Iconsext.exe Token: SeDebugPrivilege 4604 Iconsext.exe Token: SeDebugPrivilege 4604 Iconsext.exe Token: SeDebugPrivilege 4604 Iconsext.exe Token: SeDebugPrivilege 4604 Iconsext.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2716 Feishu_Setup.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 2716 wrote to memory of 4604 2716 Feishu_Setup.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\Feishu_Setup.exe"C:\Users\Admin\AppData\Local\Temp\Feishu_Setup.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Iconsext\updates\Iconsext\Iconsext.exe"C:\Users\Admin\AppData\Local\Iconsext\updates\Iconsext\Iconsext.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4604
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Iconsext\updates\Iconsext\IPCSdk_u.dll
- Size 26KB
- SHA256 e30e2f3c3d2b0a5a1943fc46396482722a169f76b83667a25f46d1e3345e4e3c
- MD5 38e06c50faccc14bc21c452db71eb9df
- SHA1 60ea4756404b576bdf8d67321cb71c7d4ec993e0
- SHA512 260e49551ca915c094e831bd61d2a7fa1c4fe3fae728022e4bd2f43e26fea5cebbdad30e619b5a1c00c04d58a95e5c552be2c9aa9afef8e0cb016641483062e5
- SSDEEP 384:r5fWANrhUTTsqYB6lRBVfJ8cCE4O2OACEWeDGuVC2DGuc7C:rVhUTsqYMfJ8TE4FOARWeDG0C2DG9+
- TLSH T1DEC2286AAB084852E523C17860C5EE16EB72F1412B2397DFA6B9C35DAF533C1393D352
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Iconsext\updates\Iconsext\Iconsext.exe
- Size 254KB
- SHA256 3c7beef342835127938ea182b2326e9fafdfb019fa3ccd0e318751ca95c1aed9
- MD5 0cf79180a997788baa8608d76d6e5888
- SHA1 6ec04bf1f6409ea76d662c176f4d9aab875393bb
- SHA512 770fff16717ba68c0d8971a448a45b04152813710244207562b1c8946664729dd4a066355bd0fd203b61590d03535f9b2cb40410651df6a85bba78f377b07d2d
- SSDEEP 6144:ujFyDOrbgC4Oi/yxo7+QS8ERJLIN+2oTred9jEcw:ujJrbgC/+6QStRJLINDoXedBEJ
- TLSH T15944E50B32044945C299A138A582E521FE61BD321B22579BE762BF4EFF7EDD70C7A341
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Iconsext\updates\Iconsext\LoManager_u.dll
- Size 174KB
- SHA256 291baa6f61a19f858b753012eed506bb7922dfda782949c4af27fa453057240e
- MD5 6b31c58cc20653f6a039d5a9b934e642
- SHA1 1f34918e44959abf5a89092b1aca284138b3cab4
- SHA512 6feb2a775564cae6bc01d70e6ff4630266ad348b862fff33ad8488ccf8c61589798033cfdf9238eae6581e111fb1f9d54ac8315f8e0619c1e301ab96a32b7861
- SSDEEP 3072:2fjWJqA1PMxjhGHop5GzMzG1lp6g8WH+3d/OAMsYC:2fj6qAhajhGHopwzMzG58d/OAMsx
- TLSH T11E04391A7B2840A3C066D17D8AC68A46F3B374515F219BCF46A1837E0F77AD0BD7E611
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Iconsext\updates\Iconsext\MSVCP120.dll
- Size 644KB
- SHA256 2abf0aab5a3c5ae9424b64e9d19d9d6d4aebc67814d7e92e4927b9798fef2848
- MD5 46060c35f697281bc5e7337aee3722b1
- SHA1 d0164c041707f297a73abb9ea854111953e99cf1
- SHA512 2cf2ed4d45c79a6e6cebfa3d332710a97f5cf0251dc194eec8c54ea0cb85762fd19822610021ccd6a6904e80afae1590a83af1fa45152f28ca56d862a3473f0a
- SSDEEP 12288:N2fus43uu43Ry4GHlT4xH2K+M+/i+WSpY+7YOzCaK9A3gS2EKZm+GWodEEwnyh:muJzCaK9AB2EKZm+GWodEEwnyh
- TLSH T11EE44C13FB150AB0E192D3B891D74741D7F1BC898822E70752ABE27D5F67391AA2F360
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Iconsext\updates\Iconsext\SimpleLog_u.dll
- Size 1.1MB
- SHA256 13f22ab7bfab450f5622b1ddfb246933d271b19a452f4cde05bb5df82a6c5b62
- MD5 9018ecf412f72f831174447f1750e7ba
- SHA1 457ad2bc3dc4773cb5325f1a595c5131c4d672f3
- SHA512 a12e4437b8265e9403485b740554345aa165fefc223e630c46ba45d5ba90a6708551c8689a684cef3fce929e4166d4494e9ace7c712ff073513fd9634e4f479e
- SSDEEP 24576:XFk75t9WX3hHgIaNTgMOecvGirbHqy42UyhpQHbheULcVYwxcNI:C7H4NaNyBeirbHq21LmbhBLtw4I
- TLSH T1E235121BB79404BBEDA78278D5D74A02E776784203709BEF035482799F573E0AE39B60
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Iconsext\updates\Iconsext\XChat.bmp
- Size 1.1MB
- SHA256 c7238aa564a7abe7730acdebd0a5e20b1da507e18c27441443d3b48e51573812
- MD5 f725a8cd1f2a7bc8d776567cb9c4c043
- SHA1 bf66a10d5ef276497389b10cac2e77dcfc33b3d6
- SHA512 cf998e33f7b46f02ad78c8c5de41a7d7689281265166a3535578164d6c739896ba54685aa95c9f0377319d604acde0a6253cbf12d097b41bb6f85393e1f95e78
- SSDEEP 24576:JIPnCMVVrWMBKMB1SrGpwcBbshiiGYcbzV+XsOsJQypEFNM:JadXKPzaYHJA+clJQyUNM
- TLSH T11B4533F2C18247A9F95E870BE8E536D79DB543B8EBA39FDC1306E4121E42C3D2251AD1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Iconsext\updates\Iconsext\msvcr120.dll
- Size 940KB
- SHA256 ad32240bb1de55c3f5fcac8789f583a17057f9d14914c538c2a7a5ad346b341c
- MD5 9c861c079dd81762b6c54e37597b7712
- SHA1 62cb65a1d79e2c5ada0c7bfc04c18693567c90d0
- SHA512 3aa770d6fba8590fdcf5d263cb2b3d2fae859e29d31ad482fbfbd700bcd602a013ac2568475999ef9fb06ae666d203d97f42181ec7344cba023a8534fb13acb7
- SSDEEP 24576:FkZ+EUPoH5KTcAxt/qvRQdxQxO61kCS9mmWymzVPD:FkMAlM8ixQI5C6wl
- TLSH T10525BE4676A106FAD463D2B4C9A79607E2B2B85B1530D7AF02E0866D3F23B30975F317
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Iconsext\updates\Iconsext\original_SimpleLog_u.DLL
- Size 32KB
- SHA256 6429f3789e5b2220477a2295734c32a2ecb78d8f9868e198ca2656417535e178
- MD5 2e5fea6e0b15b44aed670e9ba9903ffc
- SHA1 034fba2c6e249f846c8e275a45f497ec2f3c923a
- SHA512 7336acfdf717a2e05fa28359097dd4faee0df7390b9648782d6bec6b6983fec73bcf25c186782a3085c3b16dbce46e71f52aea311b50a92925f485ed1bd40797
- SSDEEP 768:rSePZLKZqa8c2kehUpRxKiO+OAsjDGx0DGy:rB1pLLhUpRxKF+OAsUy
- TLSH T193E27C9A7F2C08A1E566C13D91E14903E772B01137218BDF9679D35F5F17BC1623A392
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Iconsext\updates\Iconsext\util_u.dll
- Size 144KB
- SHA256 e27c0235a66b7172dc8aa1433a99ebcfd5b4a7c38a545840f91bb882977d3e97
- MD5 aa10fc2fb9caf77644073526db1bb3bf
- SHA1 96f18dc33abc91492744412168375d0122a534e7
- SHA512 76ec07eed9b7af5ce1aacced46825fdb68f55e98c04820ed22776842408a945bd9acb422b16fdf0d7b58033824ea5861179906ec8fa40bedb2471a3906dba969
- SSDEEP 3072:1IgbUIuWsipDMJMidsvpWCDyHJ/UMYCOAgxYX:LbUIhsiDMJlipyiCOAg8
- TLSH T1DFE34B1A77098176D195E3BC92C64641F3F2F8011B29A7CF46A6C62E0F73AC96E7F250
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Iconsext\updates\Iconsext\zipper.dll
- Size 258KB
- SHA256 ce0ab704ff0903e71426668e15b6c8dec0f62329345253262294b9200ddba750
- MD5 825b6eb28d03f0177641236d14392f6c
- SHA1 5146990ed1f0e629d40136ecfddd1682e9c47d93
- SHA512 4b7b3145eb0e744a883563a02e65c564acaa02880ee5a6be2e00ef714a0ec89718b0a099f7f41a9ec02353b66e895d442e171895c4bf5eee65ecbbdba08bbd35
- SSDEEP 6144:525aAkUZcaduMDR9vnc5TBq0CtXmtSFOAAIrI:c5PkUZ3duMDc5Ts0CtXmAzc
- TLSH T105445D0A3A584D65E977E27D86C3CE06E3B378000761EBCB4555836E1F33ED86D3A2A5
- MD5 SHA1 SHA512 SSDEEP TLSH