Analysis
- max time kernel
151s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
25/08/2026, 06:20
General
- Target Fleasion-v2.4.0-Windows.exe
- Size 67.9MB
- Sample260825-g3w33seq8y
- SHA256 cc187c132ab9280c461995494b839a3a98adc948ccf0b2e994958d730be15d7b
Malware Config
Signatures
- Loads dropped DLL 52 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 26 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 16 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 6 IoCs
- Suspicious use of SendNotifyMessage 6 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Fleasion-v2.4.0-Windows.exe"C:\Users\Admin\AppData\Local\Temp\Fleasion-v2.4.0-Windows.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Fleasion-v2.4.0-Windows.exe"C:\Users\Admin\AppData\Local\Temp\Fleasion-v2.4.0-Windows.exe"2⤵
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004C8 0x00000000000004CC1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
fleasion.log
ca.crt
ca.key
MSVCP140.dll
MSVCP140_1.dll
MSVCP140_2.dll
Qt6Core.dll
Qt6Gui.dll
Qt6Network.dll
Qt6Widgets.dll
VCRUNTIME140_1.dll
QtCore.pyd
QtGui.pyd
QtNetwork.pyd
QtWidgets.pyd
sip.cp314-win_amd64.pyd
VCRUNTIME140.dll
_bz2.pyd
_ctypes.pyd
_elementtree.pyd
_hashlib.pyd
_lzma.pyd
_queue.pyd
_socket.pyd
_ssl.pyd
_wmi.pyd
_zstd.pyd
base_library.zip
METADATA
libcrypto-3-x64.dll
libffi-8.dll
libssl-3-x64.dll
python3.DLL
python314.dll
INSTALLER
Lorem ipsum.txt
ucrtbase.dll
memory/1528-1281-0x00007FF967A50000-0x00007FF967A5B000-memory.dmp
memory/1528-1276-0x00007FF968180000-0x00007FF968194000-memory.dmp
memory/1528-1210-0x00007FF968820000-0x00007FF9688A0000-memory.dmp
memory/1528-1233-0x00007FF95CED0000-0x00007FF95D5B3000-memory.dmp
memory/1528-1224-0x00007FF9681C0000-0x00007FF9681E5000-memory.dmp
memory/1528-1249-0x00007FF968820000-0x00007FF9688A0000-memory.dmp
memory/1528-1248-0x00007FF963F10000-0x00007FF964060000-memory.dmp
memory/1528-1245-0x00007FF967A60000-0x00007FF967A96000-memory.dmp
memory/1528-1207-0x00007FF9688A0000-0x00007FF9688CE000-memory.dmp
memory/1528-1256-0x00007FF963D20000-0x00007FF963E04000-memory.dmp
memory/1528-1255-0x00007FF95ED00000-0x00007FF95EFC1000-memory.dmp
memory/1528-1205-0x00007FF96A320000-0x00007FF96A33A000-memory.dmp
memory/1528-1201-0x00007FF9756A0000-0x00007FF9756AF000-memory.dmp
memory/1528-1199-0x00007FF96F4F0000-0x00007FF96F51A000-memory.dmp
memory/1528-1263-0x00007FF95B880000-0x00007FF95BDAF000-memory.dmp
memory/1528-1261-0x00007FF9681C0000-0x00007FF9681E5000-memory.dmp
memory/1528-1235-0x00007FF96F4E0000-0x00007FF96F4EF000-memory.dmp
memory/1528-1241-0x00007FF95BDB0000-0x00007FF95C4BC000-memory.dmp
memory/1528-1273-0x00007FF965A90000-0x00007FF965AB6000-memory.dmp
memory/1528-1277-0x00007FF96ECA0000-0x00007FF96ECAB000-memory.dmp
memory/1528-1280-0x00007FF967A60000-0x00007FF967A96000-memory.dmp
memory/1528-1283-0x00007FF962460000-0x00007FF96251D000-memory.dmp
memory/1528-1285-0x00007FF9675F0000-0x00007FF9675FB000-memory.dmp
memory/1528-1289-0x00007FF963ED0000-0x00007FF963F0E000-memory.dmp
memory/1528-1288-0x00007FF95DEC0000-0x00007FF95E12A000-memory.dmp
memory/1528-1287-0x00007FF965F60000-0x00007FF965F7C000-memory.dmp
memory/1528-1286-0x00007FF95B880000-0x00007FF95BDAF000-memory.dmp
memory/1528-1284-0x00007FF963D20000-0x00007FF963E04000-memory.dmp
memory/1528-1282-0x00007FF964800000-0x00007FF96483E000-memory.dmp
memory/1528-1227-0x00007FF9681A0000-0x00007FF9681BA000-memory.dmp
memory/1528-1279-0x00007FF96EB90000-0x00007FF96EB9D000-memory.dmp
memory/1528-1278-0x00007FF95BDB0000-0x00007FF95C4BC000-memory.dmp
memory/1528-1290-0x00007FF95DA00000-0x00007FF95DC8C000-memory.dmp
memory/1528-1291-0x00007FF964780000-0x00007FF964798000-memory.dmp
memory/1528-1292-0x00007FF964100000-0x00007FF964112000-memory.dmp
memory/1528-1247-0x00007FF9688A0000-0x00007FF9688CE000-memory.dmp
memory/1528-1294-0x0000015D75980000-0x0000015D75990000-memory.dmp
memory/1528-1275-0x00007FF965A50000-0x00007FF965A8C000-memory.dmp
memory/1528-1274-0x00007FF96F4E0000-0x00007FF96F4EF000-memory.dmp
memory/1528-1238-0x00007FF96F4F0000-0x00007FF96F51A000-memory.dmp
memory/1528-1270-0x00007FF95DEC0000-0x00007FF95E12A000-memory.dmp
memory/1528-1239-0x00007FF968180000-0x00007FF968194000-memory.dmp
memory/1528-1326-0x00007FF964800000-0x00007FF96483E000-memory.dmp
memory/1528-1327-0x00007FF957EB0000-0x00007FF958837000-memory.dmp
memory/1528-1329-0x00007FF963530000-0x00007FF963566000-memory.dmp
memory/1528-1328-0x00007FF962460000-0x00007FF96251D000-memory.dmp
memory/1528-1190-0x00007FF95CED0000-0x00007FF95D5B3000-memory.dmp
memory/1528-1217-0x00007FF95ED00000-0x00007FF95EFC1000-memory.dmp
memory/1528-1371-0x00007FF9681C0000-0x00007FF9681E5000-memory.dmp
memory/1528-1377-0x00007FF967A60000-0x00007FF967A96000-memory.dmp
memory/1528-1378-0x00007FF963F10000-0x00007FF964060000-memory.dmp
memory/1528-1380-0x00007FF95DEC0000-0x00007FF95E12A000-memory.dmp
memory/1528-1376-0x00007FF95BDB0000-0x00007FF95C4BC000-memory.dmp
memory/1528-1370-0x00007FF95ED00000-0x00007FF95EFC1000-memory.dmp
memory/1528-1364-0x00007FF95CED0000-0x00007FF95D5B3000-memory.dmp
memory/1528-1382-0x00007FF957EB0000-0x00007FF958837000-memory.dmp
memory/1528-1422-0x00007FF963ED0000-0x00007FF963F0E000-memory.dmp
memory/1528-1430-0x00007FF95DA00000-0x00007FF95DC8C000-memory.dmp
memory/1528-1431-0x00007FF964780000-0x00007FF964798000-memory.dmp
memory/1528-1432-0x00007FF95CED0000-0x00007FF95D5B3000-memory.dmp
memory/1528-1231-0x00007FF970050000-0x00007FF97005D000-memory.dmp
memory/1528-1463-0x00007FF95CED0000-0x00007FF95D5B3000-memory.dmp
memory/1528-1469-0x00007FF95ED00000-0x00007FF95EFC1000-memory.dmp
memory/1528-1479-0x00007FF95DEC0000-0x00007FF95E12A000-memory.dmp
memory/1528-1478-0x00007FF963D20000-0x00007FF963E04000-memory.dmp
memory/1528-1470-0x00007FF9681C0000-0x00007FF9681E5000-memory.dmp
memory/1528-1490-0x00007FF9681C0000-0x00007FF9681E5000-memory.dmp
memory/1528-1510-0x00007FF9681C0000-0x00007FF9681E5000-memory.dmp
memory/1528-1530-0x00007FF9681C0000-0x00007FF9681E5000-memory.dmp
memory/1528-1550-0x00007FF9681C0000-0x00007FF9681E5000-memory.dmp
memory/1528-1571-0x00007FF9681C0000-0x00007FF9681E5000-memory.dmp
memory/1528-1691-0x00007FF9681C0000-0x00007FF9681E5000-memory.dmp