c69a7da796aba7168e1edd6c7b8d573592f17a1a8fb74d3307cc68ccf8203bde

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/09/2026, 22:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 13.4MB
Sample260903-2kf95aca74
SHA256 c69a7da796aba7168e1edd6c7b8d573592f17a1a8fb74d3307cc68ccf8203bde
MD5 0d0bcbf2bb061671bacfb953cc4a40d6
SHA1 e5acc02151fc53d6cd6ee357d38df47f5ca30e17
SHA512 ccaeb57e7b7366005367c78c2420e7377f5efbef2d37d4cfd12f179d91af4e53fc588a2b75bedb0f3d5b71736001a37354d1622bb2f956e5262276bda77f2277
SSDEEP 196608:AMGgWWV5cVARrbDHqKNJ9zZTgqemC88xbXVY5i6:AIzrVNJ9dUqey0XVY86
TLSH
T1B5E67B4BE85555E9C1AD9231CAA692137BB17C090B3263C71B60F7383F76BD46EBA310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

credential_access defense_evasion discovery execution persistence spyware stealer trojan

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1616	powershell.exe

Manipulates Digital Signatures 1 TTPs 2 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates\DBB85EF968841B3F104A365A3C5BEE515562EBAE\Blob = 030000000100000014000000dbb85ef968841b3f104a365a3c5bee515562ebae20000000010000006404000030820460308202c8a00302010202103a24da650158f58d44ff7233e7511c33300d06092a864886f70d01010b05003048310b300906035504061302545231223020060355040a0c19466c6f74696c6c6120466c656574204d616e6167656d656e743115301306035504030c0c53657268617420446f67616e301e170d3236303833313038323930355a170d3331303833313038333930355a3048310b300906035504061302545231223020060355040a0c19466c6f74696c6c6120466c656574204d616e6167656d656e743115301306035504030c0c53657268617420446f67616e308201a2300d06092a864886f70d01010105000382018f003082018a0282018100be3f9c841800a8456f53b1363419a123affbb5e8011db6a2e27432dc610caeb5c62cf166ae501f90c84bba2e7ecd223bd7d1b0d288cfc2923f3cf0ae51fd3a7c9492b6d8991dd7ee625cbda44f147de9e86580d8ef1ac2dc14b8edd5f5eba9395439fc734c7ea8e00386406e7e13f653cd7d201f69b0cbb35314d9e25d4fe4f776835fdea073dbbdfbf083d8d4285dda954b851ecd84f1c7d4e3c886634198e1463c4feb6590d394db5eed5e0df0e5fec5a583703b3f0a0b71ea153b0496bd9e55657d1c71a550998519786b7491408b047bcc7551477137b0d4f0e01f622fb8677178e8f23dd007423a43f3a1058aa825c299081e0257828db32f59e34c4018b2fae6912f8150af9f256a9e0144d229fed8c0bb47e3ce8b7d61ec51f083aa5adde25a50c43d60ef4fab26c4e57f2a53b6cd828a6bbd63895995f8e99eed80119b00d3fe4f38065788147c9ea93aa853eb7ffc03ef2bb8019a82292f83eed8ae28bf6b13786a57ca2d5b320d8de9adf342dc7b704d3c9abcfca56a8efcae452d0203010001a3463044300e0603551d0f0101ff04040302078030130603551d25040c300a06082b06010505070303301d0603551d0e0416041458a42f93de40cb434de9e4d7018606f742ad7f49300d06092a864886f70d01010b05000382018100b9962b8457427aaeedd565b5314f4628bb553200c6cd25d628c8ba1cfa937df8de16ec7e9a256bff5f3383e75116a21d60666894bf859ab0d26bebfa31850cf78e774ca6d6f4e5cb41bb305777040fdfa87741e5d9947af56f0c8ebabd15a00ae1b63d36b63950a541d52c1902c2809949202cab2e4a309da76950a5e7c349d56a806e912e43b30d694fc61605b9494452ea636dcd283bd78a39215e46ab88f1e7333dc34c09b61881786619a7984c8d7fcb6e31968560a8c741cb0d1ba601931876e12f6a8c42024a90828b9fcc4b03c298174231e372166f8fd6fd70f0a8cf89c1d971372f45b904e2dbce533bd9287472a9737ebf30950a5b2a0e8edc562a78aade01dcf7c3efcd76cc46d64a0b83b42d2579cafb5f5b4e1a6bf5052e0c9b9a3d0850cf4d902afd7d233ffa6e257a6fee0a1baa2e96d81ad2ce6c77903405c00b415312494003af061502a71a34c8ffab9537ac7497547ab8cc65f8add510e98337980a9467433bcf3b6d3325f3ca0c349a8fb46167a233839d568ca036e7	certutil.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates\DBB85EF968841B3F104A365A3C5BEE515562EBAE\Blob = 0f000000010000002000000010681c7165ed4cd7664a6a8abef8b7fa071264fa86751ec57cd5f7f8e0f30381030000000100000014000000dbb85ef968841b3f104a365a3c5bee515562ebae20000000010000006404000030820460308202c8a00302010202103a24da650158f58d44ff7233e7511c33300d06092a864886f70d01010b05003048310b300906035504061302545231223020060355040a0c19466c6f74696c6c6120466c656574204d616e6167656d656e743115301306035504030c0c53657268617420446f67616e301e170d3236303833313038323930355a170d3331303833313038333930355a3048310b300906035504061302545231223020060355040a0c19466c6f74696c6c6120466c656574204d616e6167656d656e743115301306035504030c0c53657268617420446f67616e308201a2300d06092a864886f70d01010105000382018f003082018a0282018100be3f9c841800a8456f53b1363419a123affbb5e8011db6a2e27432dc610caeb5c62cf166ae501f90c84bba2e7ecd223bd7d1b0d288cfc2923f3cf0ae51fd3a7c9492b6d8991dd7ee625cbda44f147de9e86580d8ef1ac2dc14b8edd5f5eba9395439fc734c7ea8e00386406e7e13f653cd7d201f69b0cbb35314d9e25d4fe4f776835fdea073dbbdfbf083d8d4285dda954b851ecd84f1c7d4e3c886634198e1463c4feb6590d394db5eed5e0df0e5fec5a583703b3f0a0b71ea153b0496bd9e55657d1c71a550998519786b7491408b047bcc7551477137b0d4f0e01f622fb8677178e8f23dd007423a43f3a1058aa825c299081e0257828db32f59e34c4018b2fae6912f8150af9f256a9e0144d229fed8c0bb47e3ce8b7d61ec51f083aa5adde25a50c43d60ef4fab26c4e57f2a53b6cd828a6bbd63895995f8e99eed80119b00d3fe4f38065788147c9ea93aa853eb7ffc03ef2bb8019a82292f83eed8ae28bf6b13786a57ca2d5b320d8de9adf342dc7b704d3c9abcfca56a8efcae452d0203010001a3463044300e0603551d0f0101ff04040302078030130603551d25040c300a06082b06010505070303301d0603551d0e0416041458a42f93de40cb434de9e4d7018606f742ad7f49300d06092a864886f70d01010b05000382018100b9962b8457427aaeedd565b5314f4628bb553200c6cd25d628c8ba1cfa937df8de16ec7e9a256bff5f3383e75116a21d60666894bf859ab0d26bebfa31850cf78e774ca6d6f4e5cb41bb305777040fdfa87741e5d9947af56f0c8ebabd15a00ae1b63d36b63950a541d52c1902c2809949202cab2e4a309da76950a5e7c349d56a806e912e43b30d694fc61605b9494452ea636dcd283bd78a39215e46ab88f1e7333dc34c09b61881786619a7984c8d7fcb6e31968560a8c741cb0d1ba601931876e12f6a8c42024a90828b9fcc4b03c298174231e372166f8fd6fd70f0a8cf89c1d971372f45b904e2dbce533bd9287472a9737ebf30950a5b2a0e8edc562a78aade01dcf7c3efcd76cc46d64a0b83b42d2579cafb5f5b4e1a6bf5052e0c9b9a3d0850cf4d902afd7d233ffa6e257a6fee0a1baa2e96d81ad2ce6c77903405c00b415312494003af061502a71a34c8ffab9537ac7497547ab8cc65f8add510e98337980a9467433bcf3b6d3325f3ca0c349a8fb46167a233839d568ca036e7	file.exe

Uses browser remote debugging 2 TTPs 6 IoCs

Can be used to control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
4188	chrome.exe
3440	chrome.exe
5336	chrome.exe
4116	chrome.exe
2720	chrome.exe
4780	chrome.exe

Executes dropped EXE 3 IoCs

pid	Process
5592	flotilla.exe
3204	flotilla.exe
4900	flotilla.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\Flotilla = "\"C:\\Users\\Admin\\AppData\\Local\\Flotilla\\spare\\flotilla.exe\" --agent"	file.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Discovers running processes 1 TTPs 2 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
3008	tasklist.exe
3160	tasklist.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4040	cmd.exe

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c614000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	file.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	file.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1224	chrome.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	flotilla.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	flotilla.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	flotilla.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	flotilla.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134329487533063016"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe

Modifies system certificate store 2 TTPs 3 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates\DBB85EF968841B3F104A365A3C5BEE515562EBAE	file.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates\DBB85EF968841B3F104A365A3C5BEE515562EBAE\Blob = 0f000000010000002000000010681c7165ed4cd7664a6a8abef8b7fa071264fa86751ec57cd5f7f8e0f30381030000000100000014000000dbb85ef968841b3f104a365a3c5bee515562ebae20000000010000006404000030820460308202c8a00302010202103a24da650158f58d44ff7233e7511c33300d06092a864886f70d01010b05003048310b300906035504061302545231223020060355040a0c19466c6f74696c6c6120466c656574204d616e6167656d656e743115301306035504030c0c53657268617420446f67616e301e170d3236303833313038323930355a170d3331303833313038333930355a3048310b300906035504061302545231223020060355040a0c19466c6f74696c6c6120466c656574204d616e6167656d656e743115301306035504030c0c53657268617420446f67616e308201a2300d06092a864886f70d01010105000382018f003082018a0282018100be3f9c841800a8456f53b1363419a123affbb5e8011db6a2e27432dc610caeb5c62cf166ae501f90c84bba2e7ecd223bd7d1b0d288cfc2923f3cf0ae51fd3a7c9492b6d8991dd7ee625cbda44f147de9e86580d8ef1ac2dc14b8edd5f5eba9395439fc734c7ea8e00386406e7e13f653cd7d201f69b0cbb35314d9e25d4fe4f776835fdea073dbbdfbf083d8d4285dda954b851ecd84f1c7d4e3c886634198e1463c4feb6590d394db5eed5e0df0e5fec5a583703b3f0a0b71ea153b0496bd9e55657d1c71a550998519786b7491408b047bcc7551477137b0d4f0e01f622fb8677178e8f23dd007423a43f3a1058aa825c299081e0257828db32f59e34c4018b2fae6912f8150af9f256a9e0144d229fed8c0bb47e3ce8b7d61ec51f083aa5adde25a50c43d60ef4fab26c4e57f2a53b6cd828a6bbd63895995f8e99eed80119b00d3fe4f38065788147c9ea93aa853eb7ffc03ef2bb8019a82292f83eed8ae28bf6b13786a57ca2d5b320d8de9adf342dc7b704d3c9abcfca56a8efcae452d0203010001a3463044300e0603551d0f0101ff04040302078030130603551d25040c300a06082b06010505070303301d0603551d0e0416041458a42f93de40cb434de9e4d7018606f742ad7f49300d06092a864886f70d01010b05000382018100b9962b8457427aaeedd565b5314f4628bb553200c6cd25d628c8ba1cfa937df8de16ec7e9a256bff5f3383e75116a21d60666894bf859ab0d26bebfa31850cf78e774ca6d6f4e5cb41bb305777040fdfa87741e5d9947af56f0c8ebabd15a00ae1b63d36b63950a541d52c1902c2809949202cab2e4a309da76950a5e7c349d56a806e912e43b30d694fc61605b9494452ea636dcd283bd78a39215e46ab88f1e7333dc34c09b61881786619a7984c8d7fcb6e31968560a8c741cb0d1ba601931876e12f6a8c42024a90828b9fcc4b03c298174231e372166f8fd6fd70f0a8cf89c1d971372f45b904e2dbce533bd9287472a9737ebf30950a5b2a0e8edc562a78aade01dcf7c3efcd76cc46d64a0b83b42d2579cafb5f5b4e1a6bf5052e0c9b9a3d0850cf4d902afd7d233ffa6e257a6fee0a1baa2e96d81ad2ce6c77903405c00b415312494003af061502a71a34c8ffab9537ac7497547ab8cc65f8add510e98337980a9467433bcf3b6d3325f3ca0c349a8fb46167a233839d568ca036e7	file.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	file.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1368	schtasks.exe

Suspicious behavior: EnumeratesProcesses 40 IoCs

pid	Process
5592	flotilla.exe
5592	flotilla.exe
4188	chrome.exe
4188	chrome.exe
1616	powershell.exe
1616	powershell.exe
1616	powershell.exe
1616	powershell.exe
1616	powershell.exe
1616	powershell.exe
1616	powershell.exe
1616	powershell.exe
1616	powershell.exe
1616	powershell.exe
1616	powershell.exe
1616	powershell.exe
1616	powershell.exe
1616	powershell.exe
1616	powershell.exe
1616	powershell.exe
1616	powershell.exe
1616	powershell.exe
1616	powershell.exe
1616	powershell.exe
1616	powershell.exe
1616	powershell.exe
1616	powershell.exe
1616	powershell.exe
1616	powershell.exe
1616	powershell.exe
1616	powershell.exe
1616	powershell.exe
1616	powershell.exe
1616	powershell.exe
1616	powershell.exe
1616	powershell.exe
1616	powershell.exe
1616	powershell.exe
1616	powershell.exe
1616	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4188	chrome.exe
4188	chrome.exe
4188	chrome.exe
4188	chrome.exe
4188	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3208	file.exe
Token: SeDebugPrivilege	5592	flotilla.exe
Token: SeShutdownPrivilege	4188	chrome.exe
Token: SeCreatePagefilePrivilege	4188	chrome.exe
Token: SeShutdownPrivilege	4188	chrome.exe
Token: SeCreatePagefilePrivilege	4188	chrome.exe
Token: SeShutdownPrivilege	4188	chrome.exe
Token: SeCreatePagefilePrivilege	4188	chrome.exe
Token: SeShutdownPrivilege	4188	chrome.exe
Token: SeCreatePagefilePrivilege	4188	chrome.exe
Token: SeShutdownPrivilege	4188	chrome.exe
Token: SeCreatePagefilePrivilege	4188	chrome.exe
Token: SeShutdownPrivilege	4188	chrome.exe
Token: SeCreatePagefilePrivilege	4188	chrome.exe
Token: SeShutdownPrivilege	4188	chrome.exe
Token: SeCreatePagefilePrivilege	4188	chrome.exe
Token: SeShutdownPrivilege	4188	chrome.exe
Token: SeCreatePagefilePrivilege	4188	chrome.exe
Token: SeShutdownPrivilege	4188	chrome.exe
Token: SeCreatePagefilePrivilege	4188	chrome.exe
Token: SeShutdownPrivilege	4188	chrome.exe
Token: SeCreatePagefilePrivilege	4188	chrome.exe
Token: SeShutdownPrivilege	4188	chrome.exe
Token: SeCreatePagefilePrivilege	4188	chrome.exe
Token: SeShutdownPrivilege	4188	chrome.exe
Token: SeCreatePagefilePrivilege	4188	chrome.exe
Token: SeShutdownPrivilege	4188	chrome.exe
Token: SeCreatePagefilePrivilege	4188	chrome.exe
Token: SeDebugPrivilege	4900	flotilla.exe
Token: SeDebugPrivilege	3008	tasklist.exe
Token: SeDebugPrivilege	3204	flotilla.exe
Token: SeDebugPrivilege	3160	tasklist.exe
Token: SeDebugPrivilege	1616	powershell.exe
Token: SeShutdownPrivilege	4188	chrome.exe
Token: SeCreatePagefilePrivilege	4188	chrome.exe
Token: SeShutdownPrivilege	4188	chrome.exe
Token: SeCreatePagefilePrivilege	4188	chrome.exe
Token: SeIncreaseQuotaPrivilege	1616	powershell.exe
Token: SeSecurityPrivilege	1616	powershell.exe
Token: SeTakeOwnershipPrivilege	1616	powershell.exe
Token: SeLoadDriverPrivilege	1616	powershell.exe
Token: SeSystemProfilePrivilege	1616	powershell.exe
Token: SeSystemtimePrivilege	1616	powershell.exe
Token: SeProfSingleProcessPrivilege	1616	powershell.exe
Token: SeIncBasePriorityPrivilege	1616	powershell.exe
Token: SeCreatePagefilePrivilege	1616	powershell.exe
Token: SeBackupPrivilege	1616	powershell.exe
Token: SeRestorePrivilege	1616	powershell.exe
Token: SeShutdownPrivilege	1616	powershell.exe
Token: SeDebugPrivilege	1616	powershell.exe
Token: SeSystemEnvironmentPrivilege	1616	powershell.exe
Token: SeRemoteShutdownPrivilege	1616	powershell.exe
Token: SeUndockPrivilege	1616	powershell.exe
Token: SeManageVolumePrivilege	1616	powershell.exe
Token: 33	1616	powershell.exe
Token: 34	1616	powershell.exe
Token: 35	1616	powershell.exe
Token: 36	1616	powershell.exe
Token: SeIncreaseQuotaPrivilege	1616	powershell.exe
Token: SeSecurityPrivilege	1616	powershell.exe
Token: SeTakeOwnershipPrivilege	1616	powershell.exe
Token: SeLoadDriverPrivilege	1616	powershell.exe
Token: SeSystemProfilePrivilege	1616	powershell.exe
Token: SeSystemtimePrivilege	1616	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4188	chrome.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3208 wrote to memory of 2776	3208	file.exe	88
PID 3208 wrote to memory of 4040	3208	file.exe	90
PID 3208 wrote to memory of 5592	3208	file.exe	92
PID 5592 wrote to memory of 4188	5592	flotilla.exe	95
PID 4188 wrote to memory of 1740	4188	chrome.exe	96
PID 4188 wrote to memory of 1224	4188	chrome.exe	97
PID 4188 wrote to memory of 3900	4188	chrome.exe	98
PID 4188 wrote to memory of 3900	4188	chrome.exe	98
PID 4188 wrote to memory of 6112	4188	chrome.exe	99
PID 4188 wrote to memory of 6112	4188	chrome.exe	99
PID 4188 wrote to memory of 4780	4188	chrome.exe	100
PID 4188 wrote to memory of 4780	4188	chrome.exe	100
PID 4188 wrote to memory of 3440	4188	chrome.exe	101
PID 4188 wrote to memory of 3440	4188	chrome.exe	101
PID 4188 wrote to memory of 2720	4188	chrome.exe	102
PID 4188 wrote to memory of 2720	4188	chrome.exe	102
PID 4188 wrote to memory of 4116	4188	chrome.exe	103
PID 4188 wrote to memory of 4116	4188	chrome.exe	103
PID 4188 wrote to memory of 5336	4188	chrome.exe	104
PID 4188 wrote to memory of 5336	4188	chrome.exe	104
PID 4188 wrote to memory of 6024	4188	chrome.exe	105
PID 3208 wrote to memory of 5296	3208	file.exe	108
PID 3208 wrote to memory of 4052	3208	file.exe	110
PID 3208 wrote to memory of 4048	3208	file.exe	112
PID 3208 wrote to memory of 5996	3208	file.exe	114
PID 3208 wrote to memory of 1368	3208	file.exe	116
PID 4900 wrote to memory of 3008	4900	flotilla.exe	122
PID 3204 wrote to memory of 2824	3204	flotilla.exe	124
PID 4900 wrote to memory of 3160	4900	flotilla.exe	126
PID 3204 wrote to memory of 1616	3204	flotilla.exe	128

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Manipulates Digital Signatures
- Adds Run key to start application
- Modifies trusted root certificate store through registry
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3208
- C:\Windows\System32\certutil.exe
  C:\Windows\System32\certutil.exe -f -addstore TrustedPeople C:\Users\Admin\AppData\Local\Temp\flotilla-trust3968169789\flotilla-codesign.cer
  2⤵
  - Manipulates Digital Signatures
  PID:2776
- C:\Windows\system32\cmd.exe
  cmd /c mklink /J C:\Users\Admin\AppData\Local\Flotilla\current C:\Users\Admin\AppData\Local\Flotilla\versions\9.9.11-solo.33
  2⤵
  - Executes a command shell one-liner
  PID:4040
- C:\Users\Admin\AppData\Local\Flotilla\current\flotilla.exe
  C:\Users\Admin\AppData\Local\Flotilla\current\flotilla.exe --agent
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5592
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --metrics-recording-only --window-size=854,480 --disable-background-timer-throttling --disable-client-side-phishing-detection --disable-renderer-backgrounding --disable-component-update --enable-zero-copy --no-default-browser-check --disable-dev-shm-usage --disable-hang-monitor --use-mock-keychain --user-data-dir=C:\Users\Admin\AppData\Local\Flotilla\profiles\kick.com-brazko "--user-agent=Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36" --hide-scrollbars --mute-audio --disable-default-apps --disable-features=site-per-process,Translate,BlinkGenPropertyTrees,CalculateNativeWinOcclusion,Vulkan --disable-prompt-on-repost --disable-sync --enable-automation --enable-gpu-rasterization --no-first-run --disable-background-networking --enable-features=NetworkService,NetworkServiceInProcess --disable-backgrounding-occluded-windows --safebrowsing-disable-auto-update --password-store=basic --headless=new --disable-extensions --disable-ipc-flooding-protection --disable-popup-blocking --force-color-profile=srgb --disable-blink-features=AutomationControlled --autoplay-policy=no-user-gesture-required --ignore-gpu-blocklist --disable-breakpad --remote-debugging-port=0 about:blank
    3⤵
    - Uses browser remote debugging
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4188
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Flotilla\profiles\kick.com-brazko /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Flotilla\profiles\kick.com-brazko\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Flotilla\profiles\kick.com-brazko --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x138,0x13c,0x140,0x114,0x144,0x7ffa7189c728,0x7ffa7189c734,0x7ffa7189c740
      4⤵
      PID:1740
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mute-audio --noerrdialogs --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\Flotilla\profiles\kick.com-brazko" --force-high-res-timeticks=disabled --field-trial-handle=1944,i,260183356292198625,11138362662812384165,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=BlinkGenPropertyTrees,CalculateNativeWinOcclusion,PaintHolding,Translate,Vulkan,site-per-process --variations-seed-version --mojo-platform-channel-handle=1972 /prefetch:11
      4⤵
      System Time Discovery
      PID:1224
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-breakpad --enable-gpu-rasterization --headless=new --noerrdialogs --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\Flotilla\profiles\kick.com-brazko" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAYAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1944,i,260183356292198625,11138362662812384165,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=BlinkGenPropertyTrees,CalculateNativeWinOcclusion,PaintHolding,Translate,Vulkan,site-per-process --variations-seed-version --mojo-platform-channel-handle=1940 /prefetch:2
      4⤵
      PID:3900
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mute-audio --noerrdialogs --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\Flotilla\profiles\kick.com-brazko" --force-high-res-timeticks=disabled --field-trial-handle=1944,i,260183356292198625,11138362662812384165,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=BlinkGenPropertyTrees,CalculateNativeWinOcclusion,PaintHolding,Translate,Vulkan,site-per-process --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:13
      4⤵
      PID:6112
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\Flotilla\profiles\kick.com-brazko" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --disable-breakpad --enable-automation --force-color-profile=srgb --remote-debugging-port=0 --disable-blink-features=AutomationControlled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-zero-copy --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1944,i,260183356292198625,11138362662812384165,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=BlinkGenPropertyTrees,CalculateNativeWinOcclusion,PaintHolding,Translate,Vulkan,site-per-process --variations-seed-version --mojo-platform-channel-handle=3192 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4780
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\Flotilla\profiles\kick.com-brazko" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --disable-breakpad --enable-automation --force-color-profile=srgb --remote-debugging-port=0 --disable-blink-features=AutomationControlled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-zero-copy --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1944,i,260183356292198625,11138362662812384165,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=BlinkGenPropertyTrees,CalculateNativeWinOcclusion,PaintHolding,Translate,Vulkan,site-per-process --variations-seed-version --mojo-platform-channel-handle=3216 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3440
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\Flotilla\profiles\kick.com-brazko" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --disable-breakpad --enable-automation --force-color-profile=srgb --remote-debugging-port=0 --disable-blink-features=AutomationControlled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-zero-copy --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=1944,i,260183356292198625,11138362662812384165,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=BlinkGenPropertyTrees,CalculateNativeWinOcclusion,PaintHolding,Translate,Vulkan,site-per-process --variations-seed-version --mojo-platform-channel-handle=3936 /prefetch:9
      4⤵
      Uses browser remote debugging
      PID:2720
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\Flotilla\profiles\kick.com-brazko" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --disable-breakpad --enable-automation --force-color-profile=srgb --remote-debugging-port=0 --disable-blink-features=AutomationControlled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-zero-copy --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=1944,i,260183356292198625,11138362662812384165,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=BlinkGenPropertyTrees,CalculateNativeWinOcclusion,PaintHolding,Translate,Vulkan,site-per-process --variations-seed-version --mojo-platform-channel-handle=3852 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4116
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\Flotilla\profiles\kick.com-brazko" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --disable-breakpad --enable-automation --force-color-profile=srgb --remote-debugging-port=0 --disable-blink-features=AutomationControlled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-zero-copy --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=1944,i,260183356292198625,11138362662812384165,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=BlinkGenPropertyTrees,CalculateNativeWinOcclusion,PaintHolding,Translate,Vulkan,site-per-process --variations-seed-version --mojo-platform-channel-handle=4700 /prefetch:9
      4⤵
      Uses browser remote debugging
      PID:5336
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mute-audio --video-capture-use-gpu-memory-buffer --noerrdialogs --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\Flotilla\profiles\kick.com-brazko" --force-high-res-timeticks=disabled --field-trial-handle=1944,i,260183356292198625,11138362662812384165,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=BlinkGenPropertyTrees,CalculateNativeWinOcclusion,PaintHolding,Translate,Vulkan,site-per-process --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
      4⤵
      PID:6024
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /Delete /F /TN "Flotilla SelfUpdate_18d1f0a2363eece40c88"
  2⤵
  PID:5296
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /Delete /F /TN FlotillaUpdateTaskCore
  2⤵
  PID:4052
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /Delete /F /TN Flotilla-Logon
  2⤵
  PID:4048
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /Delete /F /TN Flotilla-Watch
  2⤵
  PID:5996
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /Create /F /TN "Flotilla SelfUpdate_18d1f0a2363eece40c88" /XML C:\Users\Admin\AppData\Local\Temp\flotilla-task-1258798070.xml
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1368

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:760

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:6080

C:\Users\Admin\AppData\Local\Flotilla\spare\flotilla.exe
"C:\Users\Admin\AppData\Local\Flotilla\spare\flotilla.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3204
- C:\Windows\System32\certutil.exe
  C:\Windows\System32\certutil.exe -f -addstore TrustedPeople C:\Users\Admin\AppData\Local\Temp\flotilla-trust2633532691\flotilla-codesign.cer
  2⤵
  PID:2824
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='flotilla.exe'\" | Where-Object { $_.ExecutablePath -like 'C:\Users\Admin\AppData\Local\Flotilla\*' } | ForEach-Object { Stop-Process -Id $_.ProcessId -Force -ErrorAction SilentlyContinue }; Get-CimInstance Win32_Process -Filter \"Name='chrome.exe'\" | Where-Object { $_.CommandLine -like '*C:\Users\Admin\AppData\Local\Flotilla\profiles*' } | ForEach-Object { Stop-Process -Id $_.ProcessId -Force -ErrorAction SilentlyContinue }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1616

C:\Users\Admin\AppData\Local\Flotilla\spare\flotilla.exe
"C:\Users\Admin\AppData\Local\Flotilla\spare\flotilla.exe" --agent
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4900
- C:\Windows\System32\tasklist.exe
  C:\Windows\System32\tasklist.exe /FI "PID eq 5592" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3008
- C:\Windows\System32\tasklist.exe
  C:\Windows\System32\tasklist.exe /FI "PID eq 5592" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3160

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Modify Authentication Process

T1556

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Authentication Process

T1556

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

flotilla.log

Path C:\Users\Admin\AppData\Local\Flotilla\logs\flotilla.log
Size 1KB
SHA256 5a0b47770bccdd873f2c274764a002e5ac4063acf5fd639a72c2ab382a1bac58
MD5 dc56032f2ad7bf70e006926c07beb307
SHA1 05f189a2040bd1f9addd80d6252f08525b74bcf7
SHA512 4d0de0f96740f4820acad71dcbf17333d1d97e0db714016c289152985844488b53d01b4d8e6c22dc644b7d3bbcaab46e87d8b64d870be86fb3e44c56c52e2b1e
TLSH
T1F221C57115B26040B52F3A96B508AF5D6B16BE1C4EF8E2F633843A5D750E2980FB6391
MD5 SHA1 SHA512 TLSH

Submit Download

install.log

Path C:\Users\Admin\AppData\Local\Flotilla\logs\install.log
Size 1KB
SHA256 2aaf38613f7949d38af2b3c8da6f706fca1b58f752bba33b41cdf07bff3da60b
MD5 60f831625602b29887562c5afa376b27
SHA1 ed113c8d914b7643aba410c5d4e32b5eb0033869
SHA512 11301abb9ea48e5113397e360fde9f9b7068d2564faf2afaddb566ab000ced85f24294a2f83ef02c74cea6fb9b59a8790d4c78cc598dbc21f98dce49a1d1e5fe
TLSH
T19031BE8433FE45A5B1039B4BFA117B5D0B217E15B65EE3A9FBC8BD2431014EC19B8302
MD5 SHA1 SHA512 TLSH

Submit Download

install.log

Path C:\Users\Admin\AppData\Local\Flotilla\logs\install.log
Size 463B
SHA256 1ca06ce69619b13f8a38bd723d08e551c67ccfbe25f6661bfd412b5c71c14fa3
MD5 8fc94ef3ed4dea1d7e6711d4fe98ed76
SHA1 9f13aa0a43465b8890d72a29c89f46229149feb7
SHA512 a867e546d4397b3e58743c861d055f485903e4f66a475897dbc44d45c1775b34fef22474f6182369b5d601419bb55cfb9f134eb08ed173f3217f11b67f466ad9
TLSH
T14FF09EC432FD81A8F5038B4BE601BB4C0A21BD14F75AA369F688BD2472008EC0AFC342
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Flotilla\profiles\kick.com-brazko\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Flotilla\profiles\kick.com-brazko\Default\Extension Scripts\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Flotilla\profiles\kick.com-brazko\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Flotilla\profiles\kick.com-brazko\GrShaderCache\data_0
Size 44KB
SHA256 1178c6dddafa9e8ac56cfc85caf34c991a9823506eb91b60810e2a014cf517a7
MD5 5e470a5683b454dc8e2ced8cb006e704
SHA1 f44650e031e848872a508418c254095ba0e7e871
SHA512 59db0543ef1641d1e22c8e509fb18c19ca0f38c97b7a83afe45062ebc41cea3e8d9af1e477eabfc9cc5f892bcedc3237fb735bbb89de52415c7ff982afa404ff
SSDEEP 24:d3EFPrpKxXll/rhKu/2dXYhgCvclBLFkErnYahxE:zV4uTcBFkCh
TLSH
T16D13FA3CEBA34D13C720803080896F723FB0B18456D22D428320F332A8B001E9F832EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Flotilla\profiles\kick.com-brazko\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Flotilla\profiles\kick.com-brazko\GrShaderCache\data_3
Size 4.0MB
SHA256 7903f988864a9c767259c4f05cc36edd2646e8b93a61a413524937fc7e4326ef
MD5 987219a043b0b1101ab25b98c2a637b9
SHA1 da55f6d00d140aeccf2c4d099ec28c22eb062166
SHA512 7d88660af99391e5808a032cec5d76c7ff6294d132920f79dae644abf21554f9c0e8910cf6f74ecfa4788bb57d5a657f0743ed2420ea8e1a6a875e24ed52d6cd
SSDEEP 1536:7o32w3q2wVQFcxvnytIRX56jhjrPghfMB6Mj3oc3CarGxX:7o32t1tZQCfMoc3g
TLSH
T1FA1620157B50C412CE1EB13C8D8386456339ECE78ED6970B714CB71A0E772AB4BA6EC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Flotilla\profiles\kick.com-brazko\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Flotilla\profiles\kick.com-brazko\Local State
Size 3KB
SHA256 633eea624ce1399bc2b1d005da6c5ee2e951d17253ee566ec812abbc04c694c7
MD5 76c40aa678b7ccffd4fa4def64cc53a1
SHA1 0409d1a497ef52b92126a65f384fe60f3b0006c1
SHA512 bee68a643f15d28b20a6d59aa887fd36aa96dce931aa078233ce3160b49ebfe735e804ae65f0743874e9a1fc6347e61f451aad0c056f739f97f767f977c43584
TLSH
T16B81E772B1AD9D735976D505BD432A43DB75716BE112AF48CADC0A0C01EBAEC2307A17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe5ab6ce.TMP

Path C:\Users\Admin\AppData\Local\Flotilla\profiles\kick.com-brazko\Local State~RFe5ab6ce.TMP
Size 1KB
SHA256 2ad2beb881cb0de749c0c5f5d9cd251b0a4a4f0fc0da44b08ca0b8b77178f992
MD5 c3e6e947a991d780fec269cb822b370f
SHA1 cf7bb01610b36ae3a5fbaca1977452ed517de158
SHA512 6ef2191d1386d308ef8427562084a7bc81474ee6be2d2bfd52b3580ffd0fe2e052f6ec4ae336d66afa413798a1a855165b29c02a3f696adecda742326815b025
TLSH
T1C61175B065A927639A65871CFB53C7834F32722BC553CA0D1FC8050111A6AFC3309C39
MD5 SHA1 SHA512 TLSH

Submit Download

agent.conf

Path C:\Users\Admin\AppData\Local\Flotilla\state\agent.conf
Size 586B
SHA256 11de9181e38eefaed5c644ee0f9251e0ab1499a137f104a6dc00342382aecf32
MD5 0291d13412e829132cb035eb8dc5b17c
SHA1 0109b049596d3092417592e9a1a40343ae562b2c
SHA512 481b21a99a1b1ad3b075b89c4d104e036ad6a9f943daa0cceb6747b1bffc8f2580492949f04541e971c921ccec13fe9ecbd0410a310e022ed3223e7b2a103b55
TLSH
T184F0467255890A3D8D8CEF1F697A41CCBEB373262EE92B001181E219B183C98A4F47E1
MD5 SHA1 SHA512 TLSH

Submit Download

flotilla.pid

Path C:\Users\Admin\AppData\Local\Flotilla\state\flotilla.pid
Size 86B
SHA256 1b9b3cba05f6b6f02934a7723b3ab034651b0153ea88b176832b7a2d426d750c
MD5 bd3f69efee554578bf30bb3a24195d53
SHA1 788e80abf7eaffbbcf853afd337fb8b689e7e2c5
SHA512 b6c5b34cfc2db5c66ea146e66f364dad37c778adc699ba36550ee8653e8928441c7765811deff37a5a7052812f98db61d58d7d4b2415428d37d9bff7146010b4
TLSH
T138A012509042EB2098080F0CB1371D4BC1B3648C30F803054504840815822ACA46D103
MD5 SHA1 SHA512 TLSH

Submit Download

flotilla.exe

Path C:\Users\Admin\AppData\Local\Flotilla\versions\9.9.11-solo.33\flotilla.exe
Size 13.4MB
SHA256 c69a7da796aba7168e1edd6c7b8d573592f17a1a8fb74d3307cc68ccf8203bde
MD5 0d0bcbf2bb061671bacfb953cc4a40d6
SHA1 e5acc02151fc53d6cd6ee357d38df47f5ca30e17
SHA512 ccaeb57e7b7366005367c78c2420e7377f5efbef2d37d4cfd12f179d91af4e53fc588a2b75bedb0f3d5b71736001a37354d1622bb2f956e5262276bda77f2277
SSDEEP 196608:AMGgWWV5cVARrbDHqKNJ9zZTgqemC88xbXVY5i6:AIzrVNJ9dUqey0XVY86
TLSH
T1B5E67B4BE85555E9C1AD9231CAA692137BB17C090B3263C71B60F7383F76BD46EBA310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

flotilla-task-1258798070.xml

Path C:\Users\Admin\AppData\Local\Temp\flotilla-task-1258798070.xml
Size 3KB
SHA256 151b9031fff99cb058ca07428e3a60a2cfde2582a8e3b729ce11fee598d08f0c
MD5 e438c20f95b0408a2774c0d2b07960ae
SHA1 4d95895d6e29088e1562f5f04e20d293504f0800
SHA512 9e18f233284bf3c4b99cf3de41c87c10a683b4194cf3e6376a0ca24296a5f1849fa10f7aa5c5afe8f124e875e241e893006e8fa1af1d9d7f43ad49901cc91bdb
TLSH
T18B61250367FE1119F2F7ABDCAABB50529A67BD595D34D47D00AC060D0BB3A22C861B37
MD5 SHA1 SHA512 TLSH

Submit Download

flotilla-codesign.cer

Path C:\Users\Admin\AppData\Local\Temp\flotilla-trust3968169789\flotilla-codesign.cer
Size 1KB
SHA256 128bbecb7d5d0d2820b137318f0e04e007b60175a34b0821b81ef18a5bae4437
MD5 beebbb1044257de1b8a99e81c2055fb7
SHA1 dbb85ef968841b3f104a365a3c5bee515562ebae
SHA512 b7a9956c95e468c23d0f84a093949d397d11568936d597f666225265af85598ffeef91ecd50566195d9f19cfda57b69a12e450f21dc2b7ba04249b16082c4fe4
TLSH
T1B521B954659C300B05476E17B1C45FAA2F32C7D432F3456E72AC489AF03933278D153E
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1616-210-0x0000029EC3E90000-0x0000029EC3EB2000-memory.dmp

Download

memory/1616-215-0x0000029EDBF80000-0x0000029EDBF9E000-memory.dmp

Download

memory/1616-216-0x0000029EDC260000-0x0000029EDC312000-memory.dmp

Download

memory/1616-217-0x0000029EC3F00000-0x0000029EC3F0A000-memory.dmp

Download

memory/1616-218-0x0000029EDBFD0000-0x0000029EDBFFA000-memory.dmp

Download

memory/1616-219-0x0000029EDBFD0000-0x0000029EDBFF4000-memory.dmp

Download