Analysis
- max time kernel
151s - max time network
130s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
20/08/2026, 02:50
General
- Target Fleasion-v2.4.0-Windows.exe
- Size 67.9MB
- Sample260820-dbxzhsbb22
- SHA256 cc187c132ab9280c461995494b839a3a98adc948ccf0b2e994958d730be15d7b
Malware Config
Signatures
- Loads dropped DLL 54 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 25 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 16 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 6 IoCs
- Suspicious use of SendNotifyMessage 6 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Fleasion-v2.4.0-Windows.exe"C:\Users\Admin\AppData\Local\Temp\Fleasion-v2.4.0-Windows.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Fleasion-v2.4.0-Windows.exe"C:\Users\Admin\AppData\Local\Temp\Fleasion-v2.4.0-Windows.exe"2⤵
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004DC 0x00000000000004D01⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
fleasion.log
ca.crt
ca.key
MSVCP140.dll
MSVCP140_1.dll
MSVCP140_2.dll
Qt6Core.dll
Qt6Gui.dll
Qt6Network.dll
Qt6Widgets.dll
VCRUNTIME140_1.dll
QtCore.pyd
QtGui.pyd
QtNetwork.pyd
QtWidgets.pyd
sip.cp314-win_amd64.pyd
VCRUNTIME140.dll
_bz2.pyd
_ctypes.pyd
_hashlib.pyd
_lzma.pyd
_queue.pyd
_socket.pyd
_ssl.pyd
_wmi.pyd
_zstd.pyd
base_library.zip
METADATA
libcrypto-3-x64.dll
libffi-8.dll
libssl-3-x64.dll
python3.DLL
python314.dll
INSTALLER
Lorem ipsum.txt
ucrtbase.dll
memory/2100-1274-0x00007FFA43C80000-0x00007FFA43C8F000-memory.dmp
memory/2100-1298-0x00007FFA3CF40000-0x00007FFA3CF65000-memory.dmp
memory/2100-1240-0x00007FFA3AE50000-0x00007FFA3AE64000-memory.dmp
memory/2100-1244-0x00007FFA3D4B0000-0x00007FFA3D4CA000-memory.dmp
memory/2100-1246-0x00007FFA36720000-0x00007FFA36756000-memory.dmp
memory/2100-1248-0x00007FFA33460000-0x00007FFA335B0000-memory.dmp
memory/2100-1241-0x00007FFA3D4D0000-0x00007FFA3D4FA000-memory.dmp
memory/2100-1237-0x00007FFA31C90000-0x00007FFA32373000-memory.dmp
memory/2100-1238-0x00007FFA43C80000-0x00007FFA43C8F000-memory.dmp
memory/2100-1231-0x00007FFA43FF0000-0x00007FFA43FFD000-memory.dmp
memory/2100-1256-0x000001B39B750000-0x000001B39B834000-memory.dmp
memory/2100-1259-0x00007FFA319C0000-0x00007FFA31C81000-memory.dmp
memory/2100-1227-0x00007FFA3CFF0000-0x00007FFA3D00A000-memory.dmp
memory/2100-1224-0x00007FFA3CF40000-0x00007FFA3CF65000-memory.dmp
memory/2100-1262-0x00007FFA3CF40000-0x00007FFA3CF65000-memory.dmp
memory/2100-1264-0x00007FFA2FD80000-0x00007FFA302AF000-memory.dmp
memory/2100-1215-0x00007FFA319C0000-0x00007FFA31C81000-memory.dmp
memory/2100-1210-0x00007FFA36830000-0x00007FFA368B0000-memory.dmp
memory/2100-1208-0x00007FFA3D480000-0x00007FFA3D4AE000-memory.dmp
memory/2100-1272-0x00007FFA2EB80000-0x00007FFA2EDEA000-memory.dmp
memory/2100-1204-0x00007FFA3D4B0000-0x00007FFA3D4CA000-memory.dmp
memory/2100-1279-0x00007FFA3C9E0000-0x00007FFA3C9ED000-memory.dmp
memory/2100-1283-0x00007FFA2EB40000-0x00007FFA2EB7E000-memory.dmp
memory/2100-1285-0x00007FFA2EA80000-0x00007FFA2EB3D000-memory.dmp
memory/2100-1288-0x00007FFA3A8F0000-0x00007FFA3A90C000-memory.dmp
memory/2100-1290-0x00007FFA2EA40000-0x00007FFA2EA7E000-memory.dmp
memory/2100-1289-0x00007FFA2EB80000-0x00007FFA2EDEA000-memory.dmp
memory/2100-1287-0x00007FFA2FD80000-0x00007FFA302AF000-memory.dmp
memory/2100-1286-0x00007FFA3C490000-0x00007FFA3C49B000-memory.dmp
memory/2100-1284-0x000001B39B750000-0x000001B39B834000-memory.dmp
memory/2100-1282-0x00007FFA33460000-0x00007FFA335B0000-memory.dmp
memory/2100-1281-0x00007FFA3C870000-0x00007FFA3C87B000-memory.dmp
memory/2100-1280-0x00007FFA36720000-0x00007FFA36756000-memory.dmp
memory/2100-1278-0x00007FFA3D470000-0x00007FFA3D47B000-memory.dmp
memory/2100-1277-0x00007FFA3AE50000-0x00007FFA3AE64000-memory.dmp
memory/2100-1276-0x00007FFA33250000-0x00007FFA3328C000-memory.dmp
memory/2100-1275-0x00007FFA308A0000-0x00007FFA30FAC000-memory.dmp
memory/2100-1273-0x00007FFA3AC30000-0x00007FFA3AC56000-memory.dmp
memory/2100-1255-0x00007FFA36830000-0x00007FFA368B0000-memory.dmp
memory/2100-1239-0x00007FFA308A0000-0x00007FFA30FAC000-memory.dmp
memory/2100-1297-0x00007FFA319C0000-0x00007FFA31C81000-memory.dmp
memory/2100-1291-0x00007FFA31C90000-0x00007FFA32373000-memory.dmp
memory/2100-1309-0x00007FFA2CFC0000-0x00007FFA2D24C000-memory.dmp
memory/2100-1310-0x00007FFA350E0000-0x00007FFA350F8000-memory.dmp
memory/2100-1311-0x00007FFA337E0000-0x00007FFA337F2000-memory.dmp
memory/2100-1313-0x000001B3AC010000-0x000001B3AC020000-memory.dmp
memory/2100-1328-0x00007FFA2EB40000-0x00007FFA2EB7E000-memory.dmp
memory/2100-1329-0x00007FFA2C200000-0x00007FFA2CB87000-memory.dmp
memory/2100-1331-0x00007FFA2EA80000-0x00007FFA2EB3D000-memory.dmp
memory/2100-1332-0x00007FFA2C1C0000-0x00007FFA2C1F6000-memory.dmp
memory/2100-1201-0x00007FFA46010000-0x00007FFA4601F000-memory.dmp
memory/2100-1199-0x00007FFA3D4D0000-0x00007FFA3D4FA000-memory.dmp
memory/2100-1190-0x00007FFA31C90000-0x00007FFA32373000-memory.dmp
memory/2100-1407-0x00007FFA2EA40000-0x00007FFA2EA7E000-memory.dmp
memory/2100-1427-0x00007FFA2CFC0000-0x00007FFA2D24C000-memory.dmp
memory/2100-1428-0x00007FFA350E0000-0x00007FFA350F8000-memory.dmp
memory/2100-1429-0x00007FFA31C90000-0x00007FFA32373000-memory.dmp
memory/2100-1445-0x00007FFA2EB80000-0x00007FFA2EDEA000-memory.dmp
memory/2100-1443-0x00007FFA33460000-0x00007FFA335B0000-memory.dmp
memory/2100-1441-0x00007FFA308A0000-0x00007FFA30FAC000-memory.dmp
memory/2100-1442-0x00007FFA36720000-0x00007FFA36756000-memory.dmp
memory/2100-1435-0x00007FFA319C0000-0x00007FFA31C81000-memory.dmp
memory/2100-1436-0x00007FFA3CF40000-0x00007FFA3CF65000-memory.dmp
memory/2100-1447-0x00007FFA2C200000-0x00007FFA2CB87000-memory.dmp
memory/2100-1467-0x00007FFA3CF40000-0x00007FFA3CF65000-memory.dmp
memory/2100-1460-0x00007FFA31C90000-0x00007FFA32373000-memory.dmp
memory/2100-1476-0x00007FFA2EB80000-0x00007FFA2EDEA000-memory.dmp
memory/2100-1475-0x000001B39B750000-0x000001B39B834000-memory.dmp
memory/2100-1466-0x00007FFA319C0000-0x00007FFA31C81000-memory.dmp
memory/2100-1487-0x00007FFA3CF40000-0x00007FFA3CF65000-memory.dmp
memory/2100-1507-0x00007FFA3CF40000-0x00007FFA3CF65000-memory.dmp
memory/2100-1527-0x00007FFA3CF40000-0x00007FFA3CF65000-memory.dmp
memory/2100-1547-0x00007FFA3CF40000-0x00007FFA3CF65000-memory.dmp
memory/2100-1567-0x00007FFA3CF40000-0x00007FFA3CF65000-memory.dmp
memory/2100-1587-0x00007FFA3CF40000-0x00007FFA3CF65000-memory.dmp
memory/2100-1627-0x00007FFA3CF40000-0x00007FFA3CF65000-memory.dmp
memory/2100-1687-0x00007FFA3CF40000-0x00007FFA3CF65000-memory.dmp