Analysis
- user interaction
yes - max time kernel
103s - max time network
70s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
22/07/2026, 23:33
General
- Target Fleasion-v2.3.0-Windows.exe
- Size 56.9MB
- Sample260722-3js3zade66
- SHA256 e16001a8d80af46d306d1112bb0b577bc8e7900f393316aa384a082ad9ae778a
Malware Config
Signatures
- Drops file in Drivers directory 1 IoCs
- Loads dropped DLL 64 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 24 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Scheduled Task/Job: Scheduled Task 1 TTPs 10 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 6 IoCs
- Suspicious use of SendNotifyMessage 6 IoCs
- Suspicious use of SetWindowsHookEx 64 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Fleasion-v2.3.0-Windows.exe"C:\Users\Admin\AppData\Local\Temp\Fleasion-v2.3.0-Windows.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Fleasion-v2.3.0-Windows.exe"C:\Users\Admin\AppData\Local\Temp\Fleasion-v2.3.0-Windows.exe"2⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\certutil.exeC:\Windows\System32\certutil.exe -store Root3⤵
-
-
C:\Windows\System32\certutil.exeC:\Windows\System32\certutil.exe -store Root C16D43999F89412F79A54B45A3EB518B563F70B63⤵
-
-
C:\Windows\System32\certutil.exeC:\Windows\System32\certutil.exe -addstore -f Root C:\Users\Admin\AppData\Local\FleasionNT\proxy_ca\ca.crt3⤵
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /delete /TN Fleasion-HostsWatchdog /F3⤵
-
-
C:\Windows\SYSTEM32\netsh.exenetsh winhttp show proxy3⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /create /TN Fleasion-HostsWatchdog /XML C:\Users\Admin\AppData\Local\Temp\fleasion_watchdog_task.xml /RU SYSTEM /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /create /TN Fleasion-HostsWatchdog /XML C:\Users\Admin\AppData\Local\Temp\fleasion_watchdog_task.xml /RU SYSTEM /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /create /TN Fleasion-HostsWatchdog /XML C:\Users\Admin\AppData\Local\Temp\fleasion_watchdog_task.xml /RU SYSTEM /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /Query /TN Fleasion_Autostart3⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /Create /TN Fleasion_Autostart /XML C:\Users\Admin\AppData\Local\Temp\tmpu_u3q8ed.xml /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /create /TN Fleasion-HostsWatchdog /XML C:\Users\Admin\AppData\Local\Temp\fleasion_watchdog_task.xml /RU SYSTEM /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /create /TN Fleasion-HostsWatchdog /XML C:\Users\Admin\AppData\Local\Temp\fleasion_watchdog_task.xml /RU SYSTEM /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /create /TN Fleasion-HostsWatchdog /XML C:\Users\Admin\AppData\Local\Temp\fleasion_watchdog_task.xml /RU SYSTEM /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /create /TN Fleasion-HostsWatchdog /XML C:\Users\Admin\AppData\Local\Temp\fleasion_watchdog_task.xml /RU SYSTEM /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /create /TN Fleasion-HostsWatchdog /XML C:\Users\Admin\AppData\Local\Temp\fleasion_watchdog_task.xml /RU SYSTEM /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /create /TN Fleasion-HostsWatchdog /XML C:\Users\Admin\AppData\Local\Temp\fleasion_watchdog_task.xml /RU SYSTEM /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004F4 0x00000000000004EC1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Fleasion-v2.3.0-Windows.exeC:\Users\Admin\AppData\Local\Temp\Fleasion-v2.3.0-Windows.exe1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Fleasion-v2.3.0-Windows.exeC:\Users\Admin\AppData\Local\Temp\Fleasion-v2.3.0-Windows.exe2⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
fleasion.log
fleasion.log
fleasion.log
fleasion.log
ca.crt
ca.key
MSVCP140.dll
MSVCP140_1.dll
MSVCP140_2.dll
Qt6Core.dll
Qt6Gui.dll
Qt6Network.dll
Qt6Widgets.dll
VCRUNTIME140_1.dll
QtCore.pyd
QtGui.pyd
QtNetwork.pyd
QtWidgets.pyd
sip.cp314-win_amd64.pyd
VCRUNTIME140.dll
_bz2.pyd
_ctypes.pyd
_hashlib.pyd
_lzma.pyd
_queue.pyd
_socket.pyd
_ssl.pyd
_wmi.pyd
_zstd.pyd
base_library.zip
METADATA
libcrypto-3-x64.dll
libffi-8.dll
libssl-3-x64.dll
python3.dll
python314.dll
select.pyd
Lorem ipsum.txt
INSTALLER
ucrtbase.dll
memory/3140-452-0x00007FFBA3570000-0x00007FFBA3957000-memory.dmp
memory/3140-575-0x00007FFBB80F0000-0x00007FFBB80FD000-memory.dmp
memory/3140-306-0x00007FFBB9500000-0x00007FFBB951A000-memory.dmp
memory/3140-354-0x00007FFBB2530000-0x00007FFBB25B0000-memory.dmp
memory/3140-355-0x00007FFBAA280000-0x00007FFBAA364000-memory.dmp
memory/3140-309-0x00007FFBB3F70000-0x00007FFBB3F9E000-memory.dmp
memory/3140-328-0x00007FFBB2010000-0x00007FFBB2035000-memory.dmp
memory/3140-340-0x00007FFBA5420000-0x00007FFBA5B2C000-memory.dmp
memory/3140-342-0x00007FFBB4090000-0x00007FFBB40A4000-memory.dmp
memory/3140-361-0x00007FFBA4B60000-0x00007FFBA508F000-memory.dmp
memory/3140-343-0x00007FFBB9520000-0x00007FFBB954A000-memory.dmp
memory/3140-348-0x00007FFBAB6D0000-0x00007FFBAB820000-memory.dmp
memory/3140-370-0x00007FFBA3960000-0x00007FFBA3BCA000-memory.dmp
memory/3140-374-0x00007FFBB5BF0000-0x00007FFBB5BFB000-memory.dmp
memory/3140-377-0x00007FFBAEAC0000-0x00007FFBAEAFE000-memory.dmp
memory/3140-382-0x00007FFBAB660000-0x00007FFBAB69B000-memory.dmp
memory/3140-387-0x00007FFBAA240000-0x00007FFBAA27E000-memory.dmp
memory/3140-390-0x00007FFBA3570000-0x00007FFBA3957000-memory.dmp
memory/3140-389-0x00007FFBB53E0000-0x00007FFBB53EB000-memory.dmp
memory/3140-391-0x00007FFBA21A0000-0x00007FFBA356B000-memory.dmp
memory/3140-388-0x00007FFBA3960000-0x00007FFBA3BCA000-memory.dmp
memory/3140-386-0x00007FFBA4B60000-0x00007FFBA508F000-memory.dmp
memory/3140-394-0x00007FFBA1F10000-0x00007FFBA219C000-memory.dmp
memory/3140-396-0x00007FFBB1FF0000-0x00007FFBB2002000-memory.dmp
memory/3140-395-0x00007FFBB2110000-0x00007FFBB2128000-memory.dmp
memory/3140-398-0x0000023BCB810000-0x0000023BCB820000-memory.dmp
memory/3140-393-0x00007FFBAA210000-0x00007FFBAA232000-memory.dmp
memory/3140-346-0x00007FFBB1A90000-0x00007FFBB1AC6000-memory.dmp
memory/3140-420-0x00007FFBA12D0000-0x00007FFBA1C57000-memory.dmp
memory/3140-392-0x00007FFBAEAC0000-0x00007FFBAEAFE000-memory.dmp
memory/3140-385-0x00007FFBB3F50000-0x00007FFBB3F6C000-memory.dmp
memory/3140-384-0x00007FFBAA280000-0x00007FFBAA364000-memory.dmp
memory/3140-421-0x00007FFBAA240000-0x00007FFBAA27E000-memory.dmp
memory/3140-422-0x00007FFBA8020000-0x00007FFBA8056000-memory.dmp
memory/3140-383-0x00007FFBB59B0000-0x00007FFBB59BB000-memory.dmp
memory/3140-381-0x00007FFBAB6D0000-0x00007FFBAB820000-memory.dmp
memory/3140-380-0x00007FFBAB6A0000-0x00007FFBAB6C6000-memory.dmp
memory/3140-379-0x00007FFBB1A90000-0x00007FFBB1AC6000-memory.dmp
memory/3140-378-0x00007FFBA9DC0000-0x00007FFBA9E7D000-memory.dmp
memory/3140-376-0x00007FFBA5420000-0x00007FFBA5B2C000-memory.dmp
memory/3140-375-0x00007FFBB80E0000-0x00007FFBB80EF000-memory.dmp
memory/3140-373-0x00007FFBB6AD0000-0x00007FFBB6ADD000-memory.dmp
memory/3140-372-0x00007FFBB2010000-0x00007FFBB2035000-memory.dmp
memory/3140-338-0x00007FFBA6BA0000-0x00007FFBA727E000-memory.dmp
memory/3140-369-0x00007FFBA68D0000-0x00007FFBA6B91000-memory.dmp
memory/3140-339-0x00007FFBB80E0000-0x00007FFBB80EF000-memory.dmp
memory/3140-332-0x00007FFBB80F0000-0x00007FFBB80FD000-memory.dmp
memory/3140-318-0x00007FFBA68D0000-0x00007FFBA6B91000-memory.dmp
memory/3140-315-0x00007FFBB94E0000-0x00007FFBB94FA000-memory.dmp
memory/3140-470-0x00007FFBA6BA0000-0x00007FFBA727E000-memory.dmp
memory/3140-486-0x00007FFBA3960000-0x00007FFBA3BCA000-memory.dmp
memory/3140-483-0x00007FFBB1A90000-0x00007FFBB1AC6000-memory.dmp
memory/3140-478-0x00007FFBB2010000-0x00007FFBB2035000-memory.dmp
memory/3140-311-0x00007FFBB2530000-0x00007FFBB25B0000-memory.dmp
memory/3140-485-0x00007FFBAA280000-0x00007FFBAA364000-memory.dmp
memory/3140-487-0x00007FFBA12D0000-0x00007FFBA1C57000-memory.dmp
memory/3140-484-0x00007FFBAB6D0000-0x00007FFBAB820000-memory.dmp
memory/3140-489-0x00007FFBA21A0000-0x00007FFBA356B000-memory.dmp
memory/3140-482-0x00007FFBA5420000-0x00007FFBA5B2C000-memory.dmp
memory/3140-477-0x00007FFBA68D0000-0x00007FFBA6B91000-memory.dmp
memory/3140-490-0x00007FFBAA210000-0x00007FFBAA232000-memory.dmp
memory/3140-300-0x00007FFBB9520000-0x00007FFBB954A000-memory.dmp
memory/3140-502-0x00007FFBA1F10000-0x00007FFBA219C000-memory.dmp
memory/3140-503-0x00007FFBB2110000-0x00007FFBB2128000-memory.dmp
memory/3140-292-0x00007FFBA6BA0000-0x00007FFBA727E000-memory.dmp
memory/3140-565-0x0000023BCB810000-0x0000023BCB820000-memory.dmp
memory/3140-573-0x00007FFBA68D0000-0x00007FFBA6B91000-memory.dmp
memory/3140-566-0x00007FFBA6BA0000-0x00007FFBA727E000-memory.dmp
memory/3140-579-0x00007FFBB1A90000-0x00007FFBB1AC6000-memory.dmp
memory/3140-302-0x00007FFBB9CB0000-0x00007FFBB9CBF000-memory.dmp
memory/3140-574-0x00007FFBB2010000-0x00007FFBB2035000-memory.dmp
memory/3140-604-0x00007FFBA6BA0000-0x00007FFBA727E000-memory.dmp
memory/3140-624-0x00007FFBC11D0000-0x00007FFBC11FF000-memory.dmp
memory/3140-625-0x00007FFBC1100000-0x00007FFBC11C2000-memory.dmp
memory/3140-626-0x00007FFBC10D0000-0x00007FFBC10FC000-memory.dmp
memory/3140-627-0x00007FFBC10C0000-0x00007FFBC10D0000-memory.dmp
memory/3140-638-0x00007FFBA75D0000-0x00007FFBA75FA000-memory.dmp
memory/3140-639-0x00007FFBA0D60000-0x00007FFBA0E41000-memory.dmp
memory/3140-640-0x00007FFBB0410000-0x00007FFBB042A000-memory.dmp
memory/3140-641-0x00007FFBA0A30000-0x00007FFBA0B6A000-memory.dmp
memory/3140-642-0x00007FFBA07B0000-0x00007FFBA0A2A000-memory.dmp
memory/3140-643-0x00007FFBA0750000-0x00007FFBA07A7000-memory.dmp
memory/3140-793-0x00007FFBB0410000-0x00007FFBB042A000-memory.dmp
memory/3140-748-0x00007FFBA68D0000-0x00007FFBA6B91000-memory.dmp
memory/3140-798-0x00007FFBA07B0000-0x00007FFBA0A2A000-memory.dmp
memory/3140-795-0x00007FFBA0A30000-0x00007FFBA0B6A000-memory.dmp
memory/3140-792-0x00007FFBA0D60000-0x00007FFBA0E41000-memory.dmp
memory/3140-785-0x00007FFBC1100000-0x00007FFBC11C2000-memory.dmp
memory/3140-734-0x00007FFBA6BA0000-0x00007FFBA727E000-memory.dmp
memory/3140-800-0x00007FFBA0750000-0x00007FFBA07A7000-memory.dmp
memory/3140-791-0x00007FFBA75D0000-0x00007FFBA75FA000-memory.dmp
memory/3140-787-0x00007FFBC10D0000-0x00007FFBC10FC000-memory.dmp
memory/3140-780-0x00007FFBA8020000-0x00007FFBA8056000-memory.dmp
memory/3140-771-0x00007FFBA3960000-0x00007FFBA3BCA000-memory.dmp
memory/3140-753-0x00007FFBB2010000-0x00007FFBB2035000-memory.dmp
memory/3140-914-0x00007FFBA00E0000-0x00007FFBA012E000-memory.dmp
memory/3140-941-0x00007FFB9FEC0000-0x00007FFBA00DB000-memory.dmp
memory/3140-1106-0x00007FFBA6BA0000-0x00007FFBA727E000-memory.dmp
memory/3140-1056-0x00007FFBA6BA0000-0x00007FFBA727E000-memory.dmp
memory/3140-973-0x0000023BE8680000-0x0000023BE8690000-memory.dmp
memory/3140-975-0x0000023BE86A0000-0x0000023BE86B0000-memory.dmp
memory/3140-974-0x0000023BE8690000-0x0000023BE86A0000-memory.dmp
memory/3140-972-0x0000023BE6620000-0x0000023BE6630000-memory.dmp
memory/3140-977-0x0000023BE9020000-0x0000023BE9030000-memory.dmp
memory/3140-976-0x0000023BE9010000-0x0000023BE9020000-memory.dmp
memory/3140-985-0x00007FFBA0750000-0x00007FFBA07A7000-memory.dmp
memory/3140-1031-0x00007FFBA0750000-0x00007FFBA07A7000-memory.dmp
memory/3140-1003-0x00007FFBA6BA0000-0x00007FFBA727E000-memory.dmp
memory/3140-1011-0x00007FFBB2010000-0x00007FFBB2035000-memory.dmp
memory/3140-1010-0x00007FFBA68D0000-0x00007FFBA6B91000-memory.dmp
memory/3140-1033-0x00007FFB9FEC0000-0x00007FFBA00DB000-memory.dmp
memory/3140-1019-0x00007FFBA3960000-0x00007FFBA3BCA000-memory.dmp
memory/3140-1034-0x00007FFB9B470000-0x00007FFB9C890000-memory.dmp
memory/3564-1043-0x00007FFB9E370000-0x00007FFB9E3F0000-memory.dmp
memory/3564-1038-0x00007FFB9E3F0000-0x00007FFB9EACE000-memory.dmp
memory/3564-1054-0x00007FFB98720000-0x00007FFB9898A000-memory.dmp
memory/3564-1053-0x00007FFB9A010000-0x00007FFB9A0F4000-memory.dmp
memory/3564-1052-0x00007FFB9CB70000-0x00007FFB9CCC0000-memory.dmp
memory/3564-1050-0x00007FFB9A350000-0x00007FFB9AA5C000-memory.dmp
memory/3564-1044-0x00007FFB9F200000-0x00007FFB9F21A000-memory.dmp
memory/3564-1049-0x00007FFB9DFF0000-0x00007FFB9E004000-memory.dmp
memory/3564-1048-0x00007FFBAEBB0000-0x00007FFBAEBBF000-memory.dmp
memory/3564-1047-0x00007FFBAF950000-0x00007FFBAF95D000-memory.dmp
memory/3564-1051-0x00007FFB9DFB0000-0x00007FFB9DFE6000-memory.dmp
memory/3564-1045-0x00007FFB9E0A0000-0x00007FFB9E361000-memory.dmp
memory/3564-1039-0x00007FFB9F270000-0x00007FFB9F29A000-memory.dmp
memory/3564-1042-0x00007FFB9F220000-0x00007FFB9F24E000-memory.dmp
memory/3564-1041-0x00007FFB9F250000-0x00007FFB9F26A000-memory.dmp
memory/3564-1040-0x00007FFBAFF40000-0x00007FFBAFF4F000-memory.dmp
memory/3564-1046-0x00007FFB9F1D0000-0x00007FFB9F1F5000-memory.dmp
memory/3564-971-0x00007FFB9F270000-0x00007FFB9F29A000-memory.dmp
memory/3564-970-0x00007FFB9E3F0000-0x00007FFB9EACE000-memory.dmp
memory/3564-1156-0x00007FFB9F270000-0x00007FFB9F29A000-memory.dmp
memory/3564-1159-0x00007FFB9F220000-0x00007FFB9F24E000-memory.dmp
memory/3564-1158-0x00007FFB9F250000-0x00007FFB9F26A000-memory.dmp
memory/3564-1157-0x00007FFBAFF40000-0x00007FFBAFF4F000-memory.dmp
memory/3564-1172-0x00007FFB9E3F0000-0x00007FFB9EACE000-memory.dmp