Analysis
- max time kernel
31s - max time network
37s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
31/07/2026, 07:35
General
- Target Fleasion-v2.3.0-Windows.exe
- Size 56.9MB
- Sample260731-jervkaxdqa
- SHA256 e16001a8d80af46d306d1112bb0b577bc8e7900f393316aa384a082ad9ae778a
Malware Config
Signatures
- Drops file in Drivers directory 1 IoCs
- Loads dropped DLL 53 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 12 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 6 IoCs
- Suspicious use of SendNotifyMessage 6 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Fleasion-v2.3.0-Windows.exe"C:\Users\Admin\AppData\Local\Temp\Fleasion-v2.3.0-Windows.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Fleasion-v2.3.0-Windows.exe"C:\Users\Admin\AppData\Local\Temp\Fleasion-v2.3.0-Windows.exe"2⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\certutil.exeC:\Windows\System32\certutil.exe -store Root3⤵
-
-
C:\Windows\System32\certutil.exeC:\Windows\System32\certutil.exe -store Root 4AC4FE712F7AD416EDC9A9E6BC501DCC59CF1CED3⤵
-
-
C:\Windows\System32\certutil.exeC:\Windows\System32\certutil.exe -addstore -f Root C:\Users\Admin\AppData\Local\FleasionNT\proxy_ca\ca.crt3⤵
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /delete /TN Fleasion-HostsWatchdog /F3⤵
-
-
C:\Windows\SYSTEM32\netsh.exenetsh winhttp show proxy3⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /create /TN Fleasion-HostsWatchdog /XML C:\Users\Admin\AppData\Local\Temp\fleasion_watchdog_task.xml /RU SYSTEM /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /create /TN Fleasion-HostsWatchdog /XML C:\Users\Admin\AppData\Local\Temp\fleasion_watchdog_task.xml /RU SYSTEM /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004E4 0x00000000000004EC1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
fleasion.log
fleasion.log
fleasion.log
ca.crt
ca.key
MSVCP140.dll
MSVCP140_1.dll
MSVCP140_2.dll
Qt6Core.dll
Qt6Gui.dll
Qt6Network.dll
Qt6Widgets.dll
VCRUNTIME140_1.dll
QtCore.pyd
QtGui.pyd
QtNetwork.pyd
QtWidgets.pyd
sip.cp314-win_amd64.pyd
VCRUNTIME140.dll
_bz2.pyd
_ctypes.pyd
_hashlib.pyd
_lzma.pyd
_queue.pyd
_socket.pyd
_ssl.pyd
_wmi.pyd
_zstd.pyd
base_library.zip
METADATA
libcrypto-3-x64.dll
libffi-8.dll
libssl-3-x64.dll
python3.DLL
python314.dll
select.pyd
Lorem ipsum.txt
INSTALLER
ucrtbase.dll
memory/2372-302-0x00007FFA7F3F0000-0x00007FFA7F3FF000-memory.dmp
memory/2372-393-0x00007FFA706F0000-0x00007FFA70712000-memory.dmp
memory/2372-349-0x00007FFA737E0000-0x00007FFA73930000-memory.dmp
memory/2372-346-0x00007FFA76F80000-0x00007FFA76FB6000-memory.dmp
memory/2372-342-0x00007FFA6B050000-0x00007FFA6B75C000-memory.dmp
memory/2372-335-0x00007FFA7E250000-0x00007FFA7E27A000-memory.dmp
memory/2372-336-0x00007FFA7BBB0000-0x00007FFA7BBBF000-memory.dmp
memory/2372-355-0x00007FFA6D500000-0x00007FFA6D5E4000-memory.dmp
memory/2372-340-0x00007FFA79190000-0x00007FFA791A4000-memory.dmp
memory/2372-333-0x00007FFA7E400000-0x00007FFA7E40D000-memory.dmp
memory/2372-360-0x00007FFA6E860000-0x00007FFA6EB21000-memory.dmp
memory/2372-332-0x00007FFA6C170000-0x00007FFA6C84E000-memory.dmp
memory/2372-362-0x00007FFA6A530000-0x00007FFA6AA5F000-memory.dmp
memory/2372-328-0x00007FFA76FC0000-0x00007FFA76FE5000-memory.dmp
memory/2372-309-0x00007FFA7E200000-0x00007FFA7E22E000-memory.dmp
memory/2372-371-0x00007FFA69330000-0x00007FFA6959A000-memory.dmp
memory/2372-314-0x00007FFA7D130000-0x00007FFA7D14A000-memory.dmp
memory/2372-374-0x00007FFA777C0000-0x00007FFA777CB000-memory.dmp
memory/2372-376-0x00007FFA70B50000-0x00007FFA70B8E000-memory.dmp
memory/2372-375-0x00007FFA7BBB0000-0x00007FFA7BBBF000-memory.dmp
memory/2372-378-0x00007FFA6D140000-0x00007FFA6D1FD000-memory.dmp
memory/2372-380-0x00007FFA737B0000-0x00007FFA737D6000-memory.dmp
memory/2372-383-0x00007FFA76F70000-0x00007FFA76F7B000-memory.dmp
memory/2372-385-0x00007FFA75090000-0x00007FFA750AC000-memory.dmp
memory/2372-389-0x00007FFA76F10000-0x00007FFA76F1B000-memory.dmp
memory/2372-390-0x00007FFA68B90000-0x00007FFA68F77000-memory.dmp
memory/2372-388-0x00007FFA69330000-0x00007FFA6959A000-memory.dmp
memory/2372-387-0x00007FFA70AD0000-0x00007FFA70B0E000-memory.dmp
memory/2372-391-0x00007FFA677C0000-0x00007FFA68B8B000-memory.dmp
memory/2372-386-0x00007FFA6A530000-0x00007FFA6AA5F000-memory.dmp
memory/2372-384-0x00007FFA6D500000-0x00007FFA6D5E4000-memory.dmp
memory/2372-382-0x00007FFA70B10000-0x00007FFA70B4B000-memory.dmp
memory/2372-381-0x00007FFA76F80000-0x00007FFA76FB6000-memory.dmp
memory/2372-379-0x00007FFA6B050000-0x00007FFA6B75C000-memory.dmp
memory/2372-377-0x00007FFA79190000-0x00007FFA791A4000-memory.dmp
memory/2372-348-0x00007FFA77810000-0x00007FFA77890000-memory.dmp
memory/2372-394-0x00007FFA67530000-0x00007FFA677BC000-memory.dmp
memory/2372-392-0x00007FFA70B50000-0x00007FFA70B8E000-memory.dmp
memory/2372-395-0x00007FFA74BE0000-0x00007FFA74BF8000-memory.dmp
memory/2372-396-0x00007FFA706D0000-0x00007FFA706E2000-memory.dmp
memory/2372-373-0x00007FFA79630000-0x00007FFA7963D000-memory.dmp
memory/2372-398-0x000001CB59E80000-0x000001CB59E90000-memory.dmp
memory/2372-370-0x00007FFA76FC0000-0x00007FFA76FE5000-memory.dmp
memory/2372-420-0x00007FFA663A0000-0x00007FFA66D27000-memory.dmp
memory/2372-422-0x00007FFA6D100000-0x00007FFA6D136000-memory.dmp
memory/2372-421-0x00007FFA70AD0000-0x00007FFA70B0E000-memory.dmp
memory/2372-318-0x00007FFA6E860000-0x00007FFA6EB21000-memory.dmp
memory/2372-311-0x00007FFA77810000-0x00007FFA77890000-memory.dmp
memory/2372-472-0x00007FFA69330000-0x00007FFA6959A000-memory.dmp
memory/2372-487-0x00007FFA68B90000-0x00007FFA68F77000-memory.dmp
memory/2372-469-0x00007FFA737E0000-0x00007FFA73930000-memory.dmp
memory/2372-455-0x00007FFA6C170000-0x00007FFA6C84E000-memory.dmp
memory/2372-462-0x00007FFA6E860000-0x00007FFA6EB21000-memory.dmp
memory/2372-306-0x00007FFA7E230000-0x00007FFA7E24A000-memory.dmp
memory/2372-467-0x00007FFA6B050000-0x00007FFA6B75C000-memory.dmp
memory/2372-470-0x00007FFA6D500000-0x00007FFA6D5E4000-memory.dmp
memory/2372-468-0x00007FFA76F80000-0x00007FFA76FB6000-memory.dmp
memory/2372-463-0x00007FFA76FC0000-0x00007FFA76FE5000-memory.dmp
memory/2372-473-0x00007FFA663A0000-0x00007FFA66D27000-memory.dmp
memory/2372-300-0x00007FFA7E250000-0x00007FFA7E27A000-memory.dmp
memory/2372-499-0x00007FFA677C0000-0x00007FFA68B8B000-memory.dmp
memory/2372-500-0x00007FFA706F0000-0x00007FFA70712000-memory.dmp
memory/2372-525-0x00007FFA67530000-0x00007FFA677BC000-memory.dmp
memory/2372-526-0x00007FFA74BE0000-0x00007FFA74BF8000-memory.dmp
memory/2372-291-0x00007FFA6C170000-0x00007FFA6C84E000-memory.dmp
memory/2372-564-0x00007FFA6C170000-0x00007FFA6C84E000-memory.dmp
memory/2372-577-0x00007FFA76F80000-0x00007FFA76FB6000-memory.dmp
memory/2372-571-0x00007FFA6E860000-0x00007FFA6EB21000-memory.dmp
memory/2372-573-0x00007FFA7E400000-0x00007FFA7E40D000-memory.dmp