Analysis
- max time kernel
149s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
21/07/2026, 15:56
General
- Target Fleasion-v2.3.0-Windows.exe
- Size 56.9MB
- Sample260721-tdf2sazdmb
- SHA256 e16001a8d80af46d306d1112bb0b577bc8e7900f393316aa384a082ad9ae778a
Malware Config
Signatures
- Drops file in Drivers directory 1 IoCs
- Loads dropped DLL 53 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 25 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Scheduled Task/Job: Scheduled Task 1 TTPs 14 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 12 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 6 IoCs
- Suspicious use of SendNotifyMessage 6 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Fleasion-v2.3.0-Windows.exe"C:\Users\Admin\AppData\Local\Temp\Fleasion-v2.3.0-Windows.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Fleasion-v2.3.0-Windows.exe"C:\Users\Admin\AppData\Local\Temp\Fleasion-v2.3.0-Windows.exe"2⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\certutil.exeC:\Windows\System32\certutil.exe -store Root3⤵
-
-
C:\Windows\System32\certutil.exeC:\Windows\System32\certutil.exe -store Root CA631CCF51D7786933506C17C39C10B6592E419B3⤵
-
-
C:\Windows\System32\certutil.exeC:\Windows\System32\certutil.exe -addstore -f Root C:\Users\Admin\AppData\Local\FleasionNT\proxy_ca\ca.crt3⤵
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /delete /TN Fleasion-HostsWatchdog /F3⤵
-
-
C:\Windows\SYSTEM32\netsh.exenetsh winhttp show proxy3⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /create /TN Fleasion-HostsWatchdog /XML C:\Users\Admin\AppData\Local\Temp\fleasion_watchdog_task.xml /RU SYSTEM /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /create /TN Fleasion-HostsWatchdog /XML C:\Users\Admin\AppData\Local\Temp\fleasion_watchdog_task.xml /RU SYSTEM /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /create /TN Fleasion-HostsWatchdog /XML C:\Users\Admin\AppData\Local\Temp\fleasion_watchdog_task.xml /RU SYSTEM /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /create /TN Fleasion-HostsWatchdog /XML C:\Users\Admin\AppData\Local\Temp\fleasion_watchdog_task.xml /RU SYSTEM /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /create /TN Fleasion-HostsWatchdog /XML C:\Users\Admin\AppData\Local\Temp\fleasion_watchdog_task.xml /RU SYSTEM /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /create /TN Fleasion-HostsWatchdog /XML C:\Users\Admin\AppData\Local\Temp\fleasion_watchdog_task.xml /RU SYSTEM /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /create /TN Fleasion-HostsWatchdog /XML C:\Users\Admin\AppData\Local\Temp\fleasion_watchdog_task.xml /RU SYSTEM /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /create /TN Fleasion-HostsWatchdog /XML C:\Users\Admin\AppData\Local\Temp\fleasion_watchdog_task.xml /RU SYSTEM /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /create /TN Fleasion-HostsWatchdog /XML C:\Users\Admin\AppData\Local\Temp\fleasion_watchdog_task.xml /RU SYSTEM /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /create /TN Fleasion-HostsWatchdog /XML C:\Users\Admin\AppData\Local\Temp\fleasion_watchdog_task.xml /RU SYSTEM /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /create /TN Fleasion-HostsWatchdog /XML C:\Users\Admin\AppData\Local\Temp\fleasion_watchdog_task.xml /RU SYSTEM /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /create /TN Fleasion-HostsWatchdog /XML C:\Users\Admin\AppData\Local\Temp\fleasion_watchdog_task.xml /RU SYSTEM /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /create /TN Fleasion-HostsWatchdog /XML C:\Users\Admin\AppData\Local\Temp\fleasion_watchdog_task.xml /RU SYSTEM /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /create /TN Fleasion-HostsWatchdog /XML C:\Users\Admin\AppData\Local\Temp\fleasion_watchdog_task.xml /RU SYSTEM /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004B8 0x00000000000004F41⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
fleasion.log
fleasion.log
fleasion.log
ca.crt
ca.key
MSVCP140.dll
MSVCP140_1.dll
MSVCP140_2.dll
Qt6Core.dll
Qt6Gui.dll
Qt6Network.dll
Qt6Widgets.dll
VCRUNTIME140_1.dll
QtCore.pyd
QtGui.pyd
QtNetwork.pyd
QtWidgets.pyd
sip.cp314-win_amd64.pyd
VCRUNTIME140.dll
_bz2.pyd
_ctypes.pyd
_hashlib.pyd
_lzma.pyd
_queue.pyd
_socket.pyd
_ssl.pyd
_wmi.pyd
_zstd.pyd
base_library.zip
METADATA
libcrypto-3-x64.dll
libffi-8.dll
libssl-3-x64.dll
python3.DLL
python314.dll
select.pyd
Lorem ipsum.txt
INSTALLER
ucrtbase.dll
memory/4168-399-0x00007FFA05D00000-0x00007FFA05DBD000-memory.dmp
memory/4168-427-0x00007FFA107B0000-0x00007FFA107BD000-memory.dmp
memory/4168-342-0x00007FFA151B0000-0x00007FFA151CA000-memory.dmp
memory/4168-311-0x00007FFA10C20000-0x00007FFA10CA0000-memory.dmp
memory/4168-334-0x00007FFA13900000-0x00007FFA1390D000-memory.dmp
memory/4168-357-0x00007FFA07D70000-0x00007FFA07E54000-memory.dmp
memory/4168-308-0x00007FFA13960000-0x00007FFA1398E000-memory.dmp
memory/4168-305-0x00007FFA151B0000-0x00007FFA151CA000-memory.dmp
memory/4168-302-0x00007FFA151D0000-0x00007FFA151DF000-memory.dmp
memory/4168-356-0x00007FFA10C20000-0x00007FFA10CA0000-memory.dmp
memory/4168-363-0x00007FF9FB4E0000-0x00007FF9FBA0F000-memory.dmp
memory/4168-351-0x00007FFA0FD70000-0x00007FFA0FDA6000-memory.dmp
memory/4168-350-0x00007FFA13960000-0x00007FFA1398E000-memory.dmp
memory/4168-349-0x00007FFA07E60000-0x00007FFA07FB0000-memory.dmp
memory/4168-368-0x00007FFA01F70000-0x00007FFA02231000-memory.dmp
memory/4168-340-0x00007FFA107C0000-0x00007FFA107D4000-memory.dmp
memory/4168-300-0x00007FFA15320000-0x00007FFA1534A000-memory.dmp
memory/4168-372-0x00007FFA10BB0000-0x00007FFA10BD5000-memory.dmp
memory/4168-335-0x00007FFA138A0000-0x00007FFA138AF000-memory.dmp
memory/4168-336-0x00007FFA15320000-0x00007FFA1534A000-memory.dmp
memory/4168-401-0x00007FFA05FC0000-0x00007FFA05FFB000-memory.dmp
memory/4168-405-0x00007FFA0FD60000-0x00007FFA0FD6B000-memory.dmp
memory/4168-406-0x00007FF9F99C0000-0x00007FF9F9DA7000-memory.dmp
memory/4168-404-0x00007FFA05260000-0x00007FFA0529E000-memory.dmp
memory/4168-403-0x00007FFA0FA90000-0x00007FFA0FAAC000-memory.dmp
memory/4168-402-0x00007FFA10520000-0x00007FFA1052B000-memory.dmp
memory/4168-400-0x00007FFA0A380000-0x00007FFA0A3A6000-memory.dmp
memory/4168-322-0x00007FFA01F70000-0x00007FFA02231000-memory.dmp
memory/4168-398-0x00007FFA07D30000-0x00007FFA07D6E000-memory.dmp
memory/4168-397-0x00007FFA107A0000-0x00007FFA107AB000-memory.dmp
memory/4168-396-0x00007FF9FDAD0000-0x00007FF9FDD3A000-memory.dmp
memory/4168-416-0x00007FF9F85F0000-0x00007FF9F99BB000-memory.dmp
memory/4168-420-0x00007FFA0F390000-0x00007FFA0F3A2000-memory.dmp
memory/4168-419-0x00007FFA0F970000-0x00007FFA0F988000-memory.dmp
memory/4168-428-0x0000025C281C0000-0x0000025C281D0000-memory.dmp
memory/4168-347-0x00007FF9FBA10000-0x00007FF9FC11C000-memory.dmp
memory/4168-426-0x00007FFA03D20000-0x00007FFA03D56000-memory.dmp
memory/4168-333-0x00007FF9FCB30000-0x00007FF9FD20E000-memory.dmp
memory/4168-292-0x00007FF9FCB30000-0x00007FF9FD20E000-memory.dmp
memory/4168-425-0x00007FF9F7C60000-0x00007FF9F85E7000-memory.dmp
memory/4168-418-0x00007FF9FB250000-0x00007FF9FB4DC000-memory.dmp
memory/4168-417-0x00007FFA07D00000-0x00007FFA07D22000-memory.dmp
memory/4168-315-0x00007FFA15040000-0x00007FFA1505A000-memory.dmp
memory/4168-485-0x00007FF9FCB30000-0x00007FF9FD20E000-memory.dmp
memory/4168-501-0x00007FF9FDAD0000-0x00007FF9FDD3A000-memory.dmp
memory/4168-505-0x00007FF9FBA10000-0x00007FF9FC11C000-memory.dmp
memory/4168-499-0x00007FFA07E60000-0x00007FFA07FB0000-memory.dmp
memory/4168-492-0x00007FFA01F70000-0x00007FFA02231000-memory.dmp
memory/4168-504-0x00007FFA138A0000-0x00007FFA138AF000-memory.dmp
memory/4168-500-0x00007FFA07D70000-0x00007FFA07E54000-memory.dmp
memory/4168-498-0x00007FFA0FD70000-0x00007FFA0FDA6000-memory.dmp
memory/4168-496-0x00007FFA107C0000-0x00007FFA107D4000-memory.dmp
memory/4168-493-0x00007FFA10BB0000-0x00007FFA10BD5000-memory.dmp
memory/4168-328-0x00007FFA10BB0000-0x00007FFA10BD5000-memory.dmp
memory/4168-567-0x00007FFA0FD70000-0x00007FFA0FDA6000-memory.dmp
memory/4168-568-0x00007FF9FB4E0000-0x00007FF9FBA0F000-memory.dmp
memory/4168-569-0x00007FFA0F970000-0x00007FFA0F988000-memory.dmp
memory/4168-570-0x00007FF9FCB30000-0x00007FF9FD20E000-memory.dmp
memory/4168-577-0x00007FFA01F70000-0x00007FFA02231000-memory.dmp
memory/4168-579-0x00007FFA13900000-0x00007FFA1390D000-memory.dmp
memory/4168-590-0x00007FF9FCB30000-0x00007FF9FD20E000-memory.dmp
memory/4168-610-0x00007FF9FCB30000-0x00007FF9FD20E000-memory.dmp
memory/4168-636-0x00007FF9FCB30000-0x00007FF9FD20E000-memory.dmp
memory/4168-681-0x00007FF9FCB30000-0x00007FF9FD20E000-memory.dmp
memory/4168-701-0x00007FF9FCB30000-0x00007FF9FD20E000-memory.dmp
memory/4168-721-0x00007FF9FCB30000-0x00007FF9FD20E000-memory.dmp
memory/4168-741-0x00007FF9FCB30000-0x00007FF9FD20E000-memory.dmp
memory/4168-761-0x00007FF9FCB30000-0x00007FF9FD20E000-memory.dmp
memory/4168-781-0x00007FF9FCB30000-0x00007FF9FD20E000-memory.dmp
memory/4168-801-0x00007FF9FCB30000-0x00007FF9FD20E000-memory.dmp
memory/4168-821-0x00007FF9FCB30000-0x00007FF9FD20E000-memory.dmp
memory/4168-841-0x00007FF9FCB30000-0x00007FF9FD20E000-memory.dmp