Analysis
- user interaction
yes - max time kernel
151s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
13/08/2026, 04:31
General
- Target Fleasion-v2.3.0-Windows.exe
- Size 56.9MB
- Sample260813-e5s34azxe1
- SHA256 e16001a8d80af46d306d1112bb0b577bc8e7900f393316aa384a082ad9ae778a
Malware Config
Signatures
- Drops file in Drivers directory 1 IoCs
- Loads dropped DLL 52 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 26 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Scheduled Task/Job: Scheduled Task 1 TTPs 15 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 7 IoCs
- Suspicious use of SendNotifyMessage 7 IoCs
- Suspicious use of WriteProcessMemory 21 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Fleasion-v2.3.0-Windows.exe"C:\Users\Admin\AppData\Local\Temp\Fleasion-v2.3.0-Windows.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Fleasion-v2.3.0-Windows.exe"C:\Users\Admin\AppData\Local\Temp\Fleasion-v2.3.0-Windows.exe"2⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\certutil.exeC:\Windows\System32\certutil.exe -store Root3⤵
-
-
C:\Windows\System32\certutil.exeC:\Windows\System32\certutil.exe -store Root 77315A7CE412F986ED16D643663BF5795D675C983⤵
-
-
C:\Windows\System32\certutil.exeC:\Windows\System32\certutil.exe -addstore -f Root C:\Users\Admin\AppData\Local\FleasionNT\proxy_ca\ca.crt3⤵
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /delete /TN Fleasion-HostsWatchdog /F3⤵
-
-
C:\Windows\SYSTEM32\netsh.exenetsh winhttp show proxy3⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /create /TN Fleasion-HostsWatchdog /XML C:\Users\Admin\AppData\Local\Temp\fleasion_watchdog_task.xml /RU SYSTEM /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /create /TN Fleasion-HostsWatchdog /XML C:\Users\Admin\AppData\Local\Temp\fleasion_watchdog_task.xml /RU SYSTEM /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /create /TN Fleasion-HostsWatchdog /XML C:\Users\Admin\AppData\Local\Temp\fleasion_watchdog_task.xml /RU SYSTEM /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /create /TN Fleasion-HostsWatchdog /XML C:\Users\Admin\AppData\Local\Temp\fleasion_watchdog_task.xml /RU SYSTEM /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /create /TN Fleasion-HostsWatchdog /XML C:\Users\Admin\AppData\Local\Temp\fleasion_watchdog_task.xml /RU SYSTEM /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /create /TN Fleasion-HostsWatchdog /XML C:\Users\Admin\AppData\Local\Temp\fleasion_watchdog_task.xml /RU SYSTEM /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /create /TN Fleasion-HostsWatchdog /XML C:\Users\Admin\AppData\Local\Temp\fleasion_watchdog_task.xml /RU SYSTEM /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /create /TN Fleasion-HostsWatchdog /XML C:\Users\Admin\AppData\Local\Temp\fleasion_watchdog_task.xml /RU SYSTEM /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /create /TN Fleasion-HostsWatchdog /XML C:\Users\Admin\AppData\Local\Temp\fleasion_watchdog_task.xml /RU SYSTEM /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /create /TN Fleasion-HostsWatchdog /XML C:\Users\Admin\AppData\Local\Temp\fleasion_watchdog_task.xml /RU SYSTEM /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /create /TN Fleasion-HostsWatchdog /XML C:\Users\Admin\AppData\Local\Temp\fleasion_watchdog_task.xml /RU SYSTEM /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /create /TN Fleasion-HostsWatchdog /XML C:\Users\Admin\AppData\Local\Temp\fleasion_watchdog_task.xml /RU SYSTEM /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /create /TN Fleasion-HostsWatchdog /XML C:\Users\Admin\AppData\Local\Temp\fleasion_watchdog_task.xml /RU SYSTEM /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /create /TN Fleasion-HostsWatchdog /XML C:\Users\Admin\AppData\Local\Temp\fleasion_watchdog_task.xml /RU SYSTEM /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /create /TN Fleasion-HostsWatchdog /XML C:\Users\Admin\AppData\Local\Temp\fleasion_watchdog_task.xml /RU SYSTEM /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004A8 0x00000000000004E01⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
fleasion.log
fleasion.log
ca.crt
ca.key
MSVCP140.dll
MSVCP140_1.dll
MSVCP140_2.dll
Qt6Core.dll
Qt6Gui.dll
Qt6Network.dll
Qt6Widgets.dll
VCRUNTIME140_1.dll
QtCore.pyd
QtGui.pyd
QtNetwork.pyd
QtWidgets.pyd
sip.cp314-win_amd64.pyd
VCRUNTIME140.dll
_bz2.pyd
_ctypes.pyd
_hashlib.pyd
_lzma.pyd
_queue.pyd
_socket.pyd
_ssl.pyd
_wmi.pyd
_zstd.pyd
base_library.zip
METADATA
libcrypto-3-x64.dll
libffi-8.dll
libssl-3-x64.dll
python3.dll
python314.dll
select.pyd
Lorem ipsum.txt
INSTALLER
ucrtbase.dll
memory/5428-394-0x00007FFEB4730000-0x00007FFEB4B17000-memory.dmp
memory/5428-334-0x00007FFEB7960000-0x00007FFEB803E000-memory.dmp
memory/5428-346-0x00007FFEC2CC0000-0x00007FFEC2CF6000-memory.dmp
memory/5428-348-0x00007FFECE5B0000-0x00007FFECE5DE000-memory.dmp
memory/5428-356-0x00007FFEBA350000-0x00007FFEBA434000-memory.dmp
memory/5428-300-0x00007FFED1D20000-0x00007FFED1D4A000-memory.dmp
memory/5428-302-0x00007FFED22C0000-0x00007FFED22CF000-memory.dmp
memory/5428-363-0x00007FFEB5D20000-0x00007FFEB624F000-memory.dmp
memory/5428-361-0x00007FFECE590000-0x00007FFECE5AA000-memory.dmp
memory/5428-328-0x00007FFEC3190000-0x00007FFEC31B5000-memory.dmp
memory/5428-335-0x00007FFEC9E20000-0x00007FFEC9E2F000-memory.dmp
memory/5428-342-0x00007FFEB6840000-0x00007FFEB6F4C000-memory.dmp
memory/5428-375-0x00007FFEC8960000-0x00007FFEC896D000-memory.dmp
memory/5428-374-0x00007FFEC3190000-0x00007FFEC31B5000-memory.dmp
memory/5428-377-0x00007FFEC8950000-0x00007FFEC895B000-memory.dmp
memory/5428-378-0x00007FFEC9E20000-0x00007FFEC9E2F000-memory.dmp
memory/5428-379-0x00007FFEC0630000-0x00007FFEC066E000-memory.dmp
memory/5428-380-0x00007FFEC98D0000-0x00007FFEC98E4000-memory.dmp
memory/5428-381-0x00007FFEBC4A0000-0x00007FFEBC55D000-memory.dmp
memory/5428-385-0x00007FFEC2CC0000-0x00007FFEC2CF6000-memory.dmp
memory/5428-389-0x00007FFEC3170000-0x00007FFEC318C000-memory.dmp
memory/5428-391-0x00007FFEBA2D0000-0x00007FFEBA30E000-memory.dmp
memory/5428-392-0x00007FFEB4B20000-0x00007FFEB4D8A000-memory.dmp
memory/5428-393-0x00007FFEC7030000-0x00007FFEC703B000-memory.dmp
memory/5428-339-0x00007FFED1D20000-0x00007FFED1D4A000-memory.dmp
memory/5428-390-0x00007FFEB5D20000-0x00007FFEB624F000-memory.dmp
memory/5428-388-0x00007FFEBA350000-0x00007FFEBA434000-memory.dmp
memory/5428-395-0x00007FFEB3360000-0x00007FFEB472B000-memory.dmp
memory/5428-387-0x00007FFEC7D50000-0x00007FFEC7D5B000-memory.dmp
memory/5428-386-0x00007FFEBC560000-0x00007FFEBC6B0000-memory.dmp
memory/5428-383-0x00007FFEC0A00000-0x00007FFEC0A26000-memory.dmp
memory/5428-382-0x00007FFEB6840000-0x00007FFEB6F4C000-memory.dmp
memory/5428-384-0x00007FFEBA310000-0x00007FFEBA34B000-memory.dmp
memory/5428-376-0x00007FFECE540000-0x00007FFECE54D000-memory.dmp
memory/5428-340-0x00007FFEC98D0000-0x00007FFEC98E4000-memory.dmp
memory/5428-398-0x00007FFEB9F60000-0x00007FFEB9F82000-memory.dmp
memory/5428-397-0x00007FFEBC4A0000-0x00007FFEBC55D000-memory.dmp
memory/5428-396-0x00007FFEC0630000-0x00007FFEC066E000-memory.dmp
memory/5428-371-0x00007FFEB4B20000-0x00007FFEB4D8A000-memory.dmp
memory/5428-399-0x00007FFEB30D0000-0x00007FFEB335C000-memory.dmp
memory/5428-400-0x00007FFEC0850000-0x00007FFEC0868000-memory.dmp
memory/5428-370-0x00007FFEB8780000-0x00007FFEB8A41000-memory.dmp
memory/5428-401-0x00007FFEB9F40000-0x00007FFEB9F52000-memory.dmp
memory/5428-349-0x00007FFEBC560000-0x00007FFEBC6B0000-memory.dmp
memory/5428-403-0x000002CFF8B00000-0x000002CFF8B10000-memory.dmp
memory/5428-355-0x00007FFEC31C0000-0x00007FFEC3240000-memory.dmp
memory/5428-331-0x00007FFECE540000-0x00007FFECE54D000-memory.dmp
memory/5428-306-0x00007FFED0860000-0x00007FFED087A000-memory.dmp
memory/5428-322-0x00007FFEB8780000-0x00007FFEB8A41000-memory.dmp
memory/5428-425-0x00007FFEB2380000-0x00007FFEB2D07000-memory.dmp
memory/5428-426-0x00007FFEB9E90000-0x00007FFEB9EC6000-memory.dmp
memory/5428-314-0x00007FFECE590000-0x00007FFECE5AA000-memory.dmp
memory/5428-311-0x00007FFEC31C0000-0x00007FFEC3240000-memory.dmp
memory/5428-308-0x00007FFECE5B0000-0x00007FFECE5DE000-memory.dmp
memory/5428-488-0x00007FFEB4730000-0x00007FFEB4B17000-memory.dmp
memory/5428-515-0x00007FFEB3360000-0x00007FFEB472B000-memory.dmp
memory/5428-292-0x00007FFEB7960000-0x00007FFEB803E000-memory.dmp
memory/5428-551-0x00007FFEB30D0000-0x00007FFEB335C000-memory.dmp
memory/5428-565-0x00007FFEC2CC0000-0x00007FFEC2CF6000-memory.dmp
memory/5428-567-0x00007FFEBA350000-0x00007FFEBA434000-memory.dmp
memory/5428-569-0x00007FFEB2380000-0x00007FFEB2D07000-memory.dmp
memory/5428-566-0x00007FFEBC560000-0x00007FFEBC6B0000-memory.dmp
memory/5428-564-0x00007FFEB6840000-0x00007FFEB6F4C000-memory.dmp
memory/5428-559-0x00007FFEB8780000-0x00007FFEB8A41000-memory.dmp
memory/5428-571-0x00007FFEC0850000-0x00007FFEC0868000-memory.dmp
memory/5428-552-0x00007FFEB7960000-0x00007FFEB803E000-memory.dmp
memory/5428-561-0x00007FFECE540000-0x00007FFECE54D000-memory.dmp
memory/5428-560-0x00007FFEC3190000-0x00007FFEC31B5000-memory.dmp
memory/5428-568-0x00007FFEB4B20000-0x00007FFEB4D8A000-memory.dmp
memory/5428-577-0x00007FFEB7960000-0x00007FFEB803E000-memory.dmp
memory/5428-636-0x00007FFEB7960000-0x00007FFEB803E000-memory.dmp
memory/5428-656-0x00007FFEB7960000-0x00007FFEB803E000-memory.dmp
memory/5428-676-0x00007FFEB7960000-0x00007FFEB803E000-memory.dmp
memory/5428-696-0x00007FFEB7960000-0x00007FFEB803E000-memory.dmp
memory/5428-703-0x00007FFEB8780000-0x00007FFEB8A41000-memory.dmp
memory/5428-704-0x00007FFEC3190000-0x00007FFEC31B5000-memory.dmp
memory/5428-716-0x00007FFEB7960000-0x00007FFEB803E000-memory.dmp
memory/5428-736-0x00007FFEB7960000-0x00007FFEB803E000-memory.dmp
memory/5428-744-0x00007FFEC3190000-0x00007FFEC31B5000-memory.dmp
memory/5428-743-0x00007FFEB8780000-0x00007FFEB8A41000-memory.dmp
memory/5428-756-0x00007FFEB7960000-0x00007FFEB803E000-memory.dmp
memory/5428-776-0x00007FFEB7960000-0x00007FFEB803E000-memory.dmp
memory/5428-796-0x00007FFEB7960000-0x00007FFEB803E000-memory.dmp
memory/5428-816-0x00007FFEB7960000-0x00007FFEB803E000-memory.dmp
memory/5428-836-0x00007FFEB7960000-0x00007FFEB803E000-memory.dmp
memory/5428-856-0x00007FFEB7960000-0x00007FFEB803E000-memory.dmp