Analysis
- user interaction
yes - max time kernel
131s - max time network
123s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
02/10/2026, 07:30
General
- Target Fleasion-v2.4.0-Windows.exe
- Size 67.9MB
- Sample261002-jbze8sweqa
- SHA256 cc187c132ab9280c461995494b839a3a98adc948ccf0b2e994958d730be15d7b
Malware Config
Signatures
- Loads dropped DLL 64 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 29 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops desktop.ini file(s) 3 IoCs
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies Internet Explorer settings 1 TTPs 2 IoCs
- Modifies registry class 64 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 7 IoCs
- Suspicious use of FindShellTrayWindow 50 IoCs
- Suspicious use of SendNotifyMessage 49 IoCs
- Suspicious use of SetWindowsHookEx 64 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Fleasion-v2.4.0-Windows.exe"C:\Users\Admin\AppData\Local\Temp\Fleasion-v2.4.0-Windows.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Fleasion-v2.4.0-Windows.exe"C:\Users\Admin\AppData\Local\Temp\Fleasion-v2.4.0-Windows.exe"2⤵
- Loads dropped DLL
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /Query /TN Fleasion_Autostart3⤵
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\FleasionNT\configs"3⤵
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004A8 0x00000000000004B01⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Drops desktop.ini file(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
fleasion.log
fleasion.log
ca.crt
ca.key
MSVCP140.dll
MSVCP140_1.dll
MSVCP140_2.dll
Qt6Core.dll
Qt6Gui.dll
Qt6Network.dll
Qt6Widgets.dll
VCRUNTIME140_1.dll
QtCore.pyd
QtGui.pyd
QtNetwork.pyd
QtWidgets.pyd
sip.cp314-win_amd64.pyd
VCRUNTIME140.dll
_bz2.pyd
_ctypes.pyd
_elementtree.pyd
_hashlib.pyd
_lzma.pyd
_queue.pyd
_socket.pyd
_ssl.pyd
_wmi.pyd
_zstd.pyd
base_library.zip
METADATA
libcrypto-3-x64.dll
libffi-8.dll
libssl-3-x64.dll
INSTALLER
python3.DLL
python314.dll
Lorem ipsum.txt
ucrtbase.dll
memory/1848-1378-0x00007FFD14F80000-0x00007FFD1568C000-memory.dmp
memory/1848-1507-0x00007FFD16370000-0x00007FFD16A53000-memory.dmp
memory/1848-1245-0x00007FFD21D10000-0x00007FFD21D46000-memory.dmp
memory/1848-1248-0x00007FFD1CAC0000-0x00007FFD1CC10000-memory.dmp
memory/1848-1233-0x00007FFD16370000-0x00007FFD16A53000-memory.dmp
memory/1848-1234-0x00007FFD28CD0000-0x00007FFD28CDD000-memory.dmp
memory/1848-1241-0x00007FFD14F80000-0x00007FFD1568C000-memory.dmp
memory/1848-1239-0x00007FFD27890000-0x00007FFD278A4000-memory.dmp
memory/1848-1254-0x00007FFD2D480000-0x00007FFD2D500000-memory.dmp
memory/1848-1255-0x00007FFD18120000-0x00007FFD18204000-memory.dmp
memory/1848-1238-0x00007FFD2D560000-0x00007FFD2D58A000-memory.dmp
memory/1848-1235-0x00007FFD289D0000-0x00007FFD289DF000-memory.dmp
memory/1848-1227-0x00007FFD28D40000-0x00007FFD28D5A000-memory.dmp
memory/1848-1261-0x00007FFD160A0000-0x00007FFD16361000-memory.dmp
memory/1848-1262-0x00007FFD14460000-0x00007FFD1498F000-memory.dmp
memory/1848-1224-0x00007FFD273E0000-0x00007FFD27405000-memory.dmp
memory/1848-1215-0x00007FFD160A0000-0x00007FFD16361000-memory.dmp
memory/1848-1269-0x00007FFD273E0000-0x00007FFD27405000-memory.dmp
memory/1848-1210-0x00007FFD2D480000-0x00007FFD2D500000-memory.dmp
memory/1848-1281-0x00007FFD1CA00000-0x00007FFD1CA3E000-memory.dmp
memory/1848-1282-0x00007FFD1D1B0000-0x00007FFD1D1D6000-memory.dmp
memory/1848-1280-0x00007FFD216A0000-0x00007FFD216BC000-memory.dmp
memory/1848-1279-0x00007FFD23920000-0x00007FFD2392B000-memory.dmp
memory/1848-1278-0x00007FFD131A0000-0x00007FFD1325D000-memory.dmp
memory/1848-1277-0x00007FFD1CA40000-0x00007FFD1CA7E000-memory.dmp
memory/1848-1276-0x00007FFD23930000-0x00007FFD2393B000-memory.dmp
memory/1848-1275-0x00007FFD23DC0000-0x00007FFD23DCD000-memory.dmp
memory/1848-1274-0x00007FFD270C0000-0x00007FFD270CB000-memory.dmp
memory/1848-1273-0x00007FFD1CA80000-0x00007FFD1CABC000-memory.dmp
memory/1848-1272-0x00007FFD13260000-0x00007FFD134CA000-memory.dmp
memory/1848-1283-0x00007FFD11560000-0x00007FFD117EC000-memory.dmp
memory/1848-1284-0x00007FFD289D0000-0x00007FFD289DF000-memory.dmp
memory/1848-1285-0x00007FFD19F10000-0x00007FFD19F28000-memory.dmp
memory/1848-1287-0x00007FFD18FD0000-0x00007FFD18FE2000-memory.dmp
memory/1848-1286-0x00007FFD27890000-0x00007FFD278A4000-memory.dmp
memory/1848-1300-0x00007FFD14F80000-0x00007FFD1568C000-memory.dmp
memory/1848-1309-0x00007FFD21D10000-0x00007FFD21D46000-memory.dmp
memory/1848-1310-0x00007FFD10740000-0x00007FFD110C7000-memory.dmp
memory/1848-1312-0x00007FFD10700000-0x00007FFD10736000-memory.dmp
memory/1848-1311-0x00007FFD1CAC0000-0x00007FFD1CC10000-memory.dmp
memory/1848-1207-0x00007FFD2D500000-0x00007FFD2D52E000-memory.dmp
memory/1848-1205-0x00007FFD2D530000-0x00007FFD2D54A000-memory.dmp
memory/1848-1893-0x00007FFD30D60000-0x00007FFD30DEE000-memory.dmp
memory/1848-1892-0x00007FFD311B0000-0x00007FFD3120E000-memory.dmp
memory/1848-1891-0x00007FFD31210000-0x00007FFD312AE000-memory.dmp
memory/1848-1373-0x00007FFD273E0000-0x00007FFD27405000-memory.dmp
memory/1848-1372-0x00007FFD160A0000-0x00007FFD16361000-memory.dmp
memory/1848-1350-0x00007FFD16370000-0x00007FFD16A53000-memory.dmp
memory/1848-1384-0x00007FFD10740000-0x00007FFD110C7000-memory.dmp
memory/1848-1382-0x00007FFD13260000-0x00007FFD134CA000-memory.dmp
memory/1848-1201-0x00007FFD2D550000-0x00007FFD2D55F000-memory.dmp
memory/1848-1386-0x00007FFD18120000-0x00007FFD18204000-memory.dmp
memory/1848-1385-0x00007FFD10700000-0x00007FFD10736000-memory.dmp
memory/1848-1890-0x00007FFD32FD0000-0x00007FFD32FFB000-memory.dmp
memory/1848-1199-0x00007FFD2D560000-0x00007FFD2D58A000-memory.dmp
memory/1848-1850-0x000002823DA20000-0x000002823DA30000-memory.dmp
memory/1848-1851-0x000002823DA30000-0x000002823DA40000-memory.dmp
memory/1848-1849-0x00007FFD0B2D0000-0x00007FFD0C6F0000-memory.dmp
memory/1848-1824-0x00007FFD273E0000-0x00007FFD27405000-memory.dmp
memory/1848-1423-0x00007FFD14460000-0x00007FFD1498F000-memory.dmp
memory/1848-1450-0x00007FFD11560000-0x00007FFD117EC000-memory.dmp
memory/1848-1454-0x00007FFD19F10000-0x00007FFD19F28000-memory.dmp
memory/1848-1455-0x00007FFD16370000-0x00007FFD16A53000-memory.dmp
memory/1848-1191-0x00007FFD16370000-0x00007FFD16A53000-memory.dmp
memory/1848-1494-0x00007FFD273E0000-0x00007FFD27405000-memory.dmp
memory/1848-1487-0x00007FFD16370000-0x00007FFD16A53000-memory.dmp
memory/1848-1503-0x00007FFD13260000-0x00007FFD134CA000-memory.dmp
memory/1848-1502-0x00007FFD18120000-0x00007FFD18204000-memory.dmp
memory/1848-1493-0x00007FFD160A0000-0x00007FFD16361000-memory.dmp
memory/1848-1247-0x00007FFD2D500000-0x00007FFD2D52E000-memory.dmp
memory/1848-1513-0x00007FFD160A0000-0x00007FFD16361000-memory.dmp
memory/1848-1514-0x00007FFD273E0000-0x00007FFD27405000-memory.dmp
memory/1848-1527-0x00007FFD16370000-0x00007FFD16A53000-memory.dmp
memory/1848-1534-0x00007FFD273E0000-0x00007FFD27405000-memory.dmp
memory/1848-1547-0x00007FFD16370000-0x00007FFD16A53000-memory.dmp
memory/1848-1554-0x00007FFD273E0000-0x00007FFD27405000-memory.dmp
memory/1848-1567-0x00007FFD2F0A0000-0x00007FFD2F0CF000-memory.dmp
memory/1848-1568-0x00007FFD2D630000-0x00007FFD2D6F2000-memory.dmp
memory/1848-1569-0x00007FFD17550000-0x00007FFD1757C000-memory.dmp
memory/1848-1570-0x00007FFD32F80000-0x00007FFD32F90000-memory.dmp
memory/1848-1582-0x00007FFD12D50000-0x00007FFD12D7A000-memory.dmp
memory/1848-1583-0x00007FFD12C60000-0x00007FFD12D41000-memory.dmp
memory/1848-1584-0x00007FFD30FA0000-0x00007FFD30FBA000-memory.dmp
memory/1848-1585-0x00007FFD101D0000-0x00007FFD1030A000-memory.dmp
memory/1848-1586-0x00007FFD0FAB0000-0x00007FFD0FD2A000-memory.dmp
memory/1848-1587-0x00007FFD12C00000-0x00007FFD12C57000-memory.dmp
memory/1848-1595-0x00007FFD2F0A0000-0x00007FFD2F0CF000-memory.dmp
memory/1848-1598-0x00007FFD2D630000-0x00007FFD2D6F2000-memory.dmp
memory/1848-1599-0x00007FFD12BB0000-0x00007FFD12BFE000-memory.dmp
memory/1848-1600-0x00007FFD17550000-0x00007FFD1757C000-memory.dmp
memory/1848-1601-0x00007FFD0F890000-0x00007FFD0FAAB000-memory.dmp
memory/1848-1602-0x00007FFD32F80000-0x00007FFD32F90000-memory.dmp
memory/1848-1603-0x00007FFD0B2D0000-0x00007FFD0C6F0000-memory.dmp
memory/1848-1604-0x00007FFD12D50000-0x00007FFD12D7A000-memory.dmp
memory/1848-1608-0x0000028254610000-0x0000028254620000-memory.dmp
memory/1848-1607-0x0000028254600000-0x0000028254610000-memory.dmp
memory/1848-1606-0x00000282545F0000-0x0000028254600000-memory.dmp
memory/1848-1605-0x00000282525A0000-0x00000282525B0000-memory.dmp
memory/1848-1610-0x0000028254F80000-0x0000028254F90000-memory.dmp
memory/1848-1609-0x0000028254F70000-0x0000028254F80000-memory.dmp
memory/1848-1611-0x00007FFD12C60000-0x00007FFD12D41000-memory.dmp
memory/1848-1618-0x00007FFD160A0000-0x00007FFD16361000-memory.dmp
memory/1848-1642-0x00007FFD12BB0000-0x00007FFD12BFE000-memory.dmp
memory/1848-1643-0x00007FFD0F890000-0x00007FFD0FAAB000-memory.dmp
memory/1848-1640-0x00007FFD0FAB0000-0x00007FFD0FD2A000-memory.dmp
memory/1848-1639-0x00007FFD101D0000-0x00007FFD1030A000-memory.dmp
memory/1848-1644-0x00007FFD0B2D0000-0x00007FFD0C6F0000-memory.dmp
memory/1848-1645-0x00007FFD30FA0000-0x00007FFD30FBA000-memory.dmp
memory/1848-1641-0x00007FFD12C00000-0x00007FFD12C57000-memory.dmp
memory/1848-1628-0x00007FFD13260000-0x00007FFD134CA000-memory.dmp
memory/1848-1631-0x00007FFD10700000-0x00007FFD10736000-memory.dmp
memory/1848-1612-0x00007FFD16370000-0x00007FFD16A53000-memory.dmp
memory/1848-1619-0x00007FFD273E0000-0x00007FFD27405000-memory.dmp
memory/1848-1646-0x00007FFD12C00000-0x00007FFD12C57000-memory.dmp
memory/1848-1647-0x00007FFD0B2D0000-0x00007FFD0C6F0000-memory.dmp
memory/1848-1655-0x00007FFD273E0000-0x00007FFD27405000-memory.dmp
memory/1848-1654-0x00007FFD160A0000-0x00007FFD16361000-memory.dmp
memory/1848-1648-0x00007FFD16370000-0x00007FFD16A53000-memory.dmp
memory/1848-1680-0x00007FFD0B2D0000-0x00007FFD0C6F0000-memory.dmp
memory/1848-1683-0x00007FFD16370000-0x00007FFD16A53000-memory.dmp
memory/1848-1689-0x00007FFD160A0000-0x00007FFD16361000-memory.dmp
memory/1848-1690-0x00007FFD273E0000-0x00007FFD27405000-memory.dmp
memory/1848-1715-0x00007FFD0B2D0000-0x00007FFD0C6F0000-memory.dmp
memory/1848-1725-0x00007FFD160A0000-0x00007FFD16361000-memory.dmp
memory/1848-1719-0x00007FFD16370000-0x00007FFD16A53000-memory.dmp
memory/1848-1726-0x00007FFD273E0000-0x00007FFD27405000-memory.dmp
memory/1848-1751-0x00007FFD0B2D0000-0x00007FFD0C6F0000-memory.dmp
memory/1848-1817-0x00007FFD16370000-0x00007FFD16A53000-memory.dmp
memory/1848-1823-0x00007FFD160A0000-0x00007FFD16361000-memory.dmp
memory/1848-1833-0x00007FFD13260000-0x00007FFD134CA000-memory.dmp
memory/2520-1354-0x000001E1A7CE0000-0x000001E1A7CE1000-memory.dmp
memory/2520-1355-0x000001E1A7CE0000-0x000001E1A7CE1000-memory.dmp
memory/2520-1356-0x000001E1A7CE0000-0x000001E1A7CE1000-memory.dmp
memory/2520-1357-0x000001E1A7CE0000-0x000001E1A7CE1000-memory.dmp
memory/2520-1358-0x000001E1A7CE0000-0x000001E1A7CE1000-memory.dmp
memory/2520-1359-0x000001E1A7CE0000-0x000001E1A7CE1000-memory.dmp
memory/2520-1349-0x000001E1A7CE0000-0x000001E1A7CE1000-memory.dmp
memory/2520-1347-0x000001E1A7CE0000-0x000001E1A7CE1000-memory.dmp