Analysis
- max time kernel
148s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/08/2026, 05:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Falcon's MultiTool.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
Falcon's MultiTool.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target Falcon's MultiTool.exe
- Size 6.2MB
- Sample260816-fm4ybazfqa
- SHA256 ed3325a88fff16affbbea83e89570227b2e428c84027a6676fea14e02943bbc8
- MD5 03d0bcd4e89155834259020cc67c415d
- SHA1 2da999aaff7c4bae8d9c7e0a68da7c389d62c2b5
- SHA512 70b1809ea1fe4bd747940a40fcbeae301b1395de32d2b1e1129b3edc7cfffdee1f42d489b79ab48d09d5329636445c34ec08a7af4ff7bd5527d7c527bb1664eb
- SSDEEP 98304:hdUQWzpqa4j+/OZdaMkDJ1ieLV4DjFrvUwaCSKlhZ1a+jL+ZIwSW0:hdUfZ0uTLV4nFrvUXC/Z15LKIwB0
- TLSH T11566120425D486BED406CB79C156ACBEF2273D599E70D98F6F88FE812F33690C976A04
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 4668 Falcon's MultiTool.exe 5040 fmt-janitor-01dd2d3c2c712db0.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5904 Falcon's MultiTool.exe 5904 Falcon's MultiTool.exe 5904 Falcon's MultiTool.exe 5904 Falcon's MultiTool.exe 5904 Falcon's MultiTool.exe 5904 Falcon's MultiTool.exe 5904 Falcon's MultiTool.exe 5904 Falcon's MultiTool.exe 5904 Falcon's MultiTool.exe 5904 Falcon's MultiTool.exe 5904 Falcon's MultiTool.exe 5904 Falcon's MultiTool.exe 5904 Falcon's MultiTool.exe 5904 Falcon's MultiTool.exe 5904 Falcon's MultiTool.exe 5904 Falcon's MultiTool.exe 5904 Falcon's MultiTool.exe 5904 Falcon's MultiTool.exe 5904 Falcon's MultiTool.exe 5904 Falcon's MultiTool.exe 5904 Falcon's MultiTool.exe 5904 Falcon's MultiTool.exe 5904 Falcon's MultiTool.exe 5904 Falcon's MultiTool.exe 5904 Falcon's MultiTool.exe 5904 Falcon's MultiTool.exe 5904 Falcon's MultiTool.exe 5904 Falcon's MultiTool.exe 5904 Falcon's MultiTool.exe 5904 Falcon's MultiTool.exe 5904 Falcon's MultiTool.exe 5904 Falcon's MultiTool.exe 5904 Falcon's MultiTool.exe 5904 Falcon's MultiTool.exe 5904 Falcon's MultiTool.exe 5904 Falcon's MultiTool.exe 5904 Falcon's MultiTool.exe 5904 Falcon's MultiTool.exe 5904 Falcon's MultiTool.exe 5904 Falcon's MultiTool.exe 5904 Falcon's MultiTool.exe 5904 Falcon's MultiTool.exe 5904 Falcon's MultiTool.exe 5904 Falcon's MultiTool.exe 5904 Falcon's MultiTool.exe 5904 Falcon's MultiTool.exe 5904 Falcon's MultiTool.exe 5904 Falcon's MultiTool.exe 5904 Falcon's MultiTool.exe 5904 Falcon's MultiTool.exe 5904 Falcon's MultiTool.exe 5904 Falcon's MultiTool.exe 5904 Falcon's MultiTool.exe 5904 Falcon's MultiTool.exe 5904 Falcon's MultiTool.exe 5904 Falcon's MultiTool.exe 5904 Falcon's MultiTool.exe 5904 Falcon's MultiTool.exe 5904 Falcon's MultiTool.exe 5904 Falcon's MultiTool.exe 5904 Falcon's MultiTool.exe 5904 Falcon's MultiTool.exe 5904 Falcon's MultiTool.exe 5904 Falcon's MultiTool.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 5904 wrote to memory of 4668 5904 Falcon's MultiTool.exe 90 PID 5904 wrote to memory of 5040 5904 Falcon's MultiTool.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\Falcon's MultiTool.exe"C:\Users\Admin\AppData\Local\Temp\Falcon's MultiTool.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5904 -
C:\Users\Admin\AppData\Local\Temp\Falcon's MultiTool_31776f91\Falcon's MultiTool.exe"C:\Users\Admin\AppData\Local\Temp\Falcon's MultiTool_31776f91\Falcon's MultiTool.exe"2⤵
- Executes dropped EXE
PID:4668
-
-
C:\Users\Admin\AppData\Local\Temp\fmt-janitor-01dd2d3c2c712db0.exe"C:\Users\Admin\AppData\Local\Temp\fmt-janitor-01dd2d3c2c712db0.exe" --fp-cleanup "C:\Users\Admin\AppData\Local\Temp\Falcon's MultiTool_31776f91"2⤵
- Executes dropped EXE
PID:5040
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\Falcon's MultiTool_31776f91\Falcon's MultiTool.exe
- Size 4.5MB
- SHA256 e588606d58c74054712e3663e34e759c63dc77af2ee273d89df199c03449b9e4
- MD5 376bfc99775ef01bcf89a565aca29060
- SHA1 7943ecc0b7284b39d3cfaff0f34a2b342512249f
- SHA512 603bf30b9bd2afb228b4a9ec0ad705314a20af165d7c4952baaa63f761776ea32b5a31db2637b3e8f43d760cba1e0a8f708ff204515bb28af5898237df0d4cb6
- SSDEEP 98304:sUQWzpqa4j+/OZdaMkDJ1ieLV4DjFrvUwaCSKlhZ1a+j:sUfZ0uTLV4nFrvUXC/Z15
- TLSH T18F26128528D186BAD006C779C1492CBDF22B7F599C759C0F6F4ABE812F33981C9B1A1C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\fmt-janitor-01dd2d3c2c712db0.exe
- Size 6.2MB
- SHA256 ed3325a88fff16affbbea83e89570227b2e428c84027a6676fea14e02943bbc8
- MD5 03d0bcd4e89155834259020cc67c415d
- SHA1 2da999aaff7c4bae8d9c7e0a68da7c389d62c2b5
- SHA512 70b1809ea1fe4bd747940a40fcbeae301b1395de32d2b1e1129b3edc7cfffdee1f42d489b79ab48d09d5329636445c34ec08a7af4ff7bd5527d7c527bb1664eb
- SSDEEP 98304:hdUQWzpqa4j+/OZdaMkDJ1ieLV4DjFrvUwaCSKlhZ1a+jL+ZIwSW0:hdUfZ0uTLV4nFrvUXC/Z15LKIwB0
- TLSH T11566120425D486BED406CB79C156ACBEF2273D599E70D98F6F88FE812F33690C976A04
- MD5 SHA1 SHA512 SSDEEP TLSH