c8c45959679ec5c2ec25498310179deb8084552374dbb186d3643389bc78c783

Analysis

user interaction
yes
max time kernel
308s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/08/2026, 10:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
flower.exe
Size 637.2MB
Sample260826-mqteback2t
SHA256 c8c45959679ec5c2ec25498310179deb8084552374dbb186d3643389bc78c783
MD5 be07c19e56951340a92789a8c10cc46c
SHA1 891f3fc9bfcf6934fbea2345ddea6654f3aeaec6
SHA512 cc95d4f8669f8dd1e53caaf07168051df1a88acfb65e12559ea7e29f2308532d905919998b397abef2517d7f953fd75c1dc826ec5f0fc971fa48cc7adafe7668
SSDEEP 49152:yuJRd5rK1kVHZui63WilaWDdVPE7NDVc82od:yu7V36GilDPmd
TLSH
T106690022B5574902815507BF1A71C4FEC32EEF9C349AAA7EB6341C0ED944AFC4AD437A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ipinfo.io
8	ipinfo.io

C:\Users\Admin\AppData\Local\Temp\flower.exe
"C:\Users\Admin\AppData\Local\Temp\flower.exe"
1⤵
PID:2032

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4196

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2032-9-0x000001D6ECF70000-0x000001D6ECFCB000-memory.dmp

Download

memory/2032-14-0x00007FF6DC050000-0x00007FF6DD050000-memory.dmp