Analysis
- user interaction
yes - max time kernel
81s - max time network
74s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
20/10/2026, 16:38
General
- Target Fleasion-v2.4.1-Windows.exe
- Size 72.7MB
- Sample261020-t5tryscd45
- SHA256 18ca306447f1b095f4352c253f5b0bfed57f35a0e35ea5bc418d48d5cceee7dc
Malware Config
Signatures
- Loads dropped DLL 60 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 28 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of FindShellTrayWindow 6 IoCs
- Suspicious use of SendNotifyMessage 6 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Fleasion-v2.4.1-Windows.exe"C:\Users\Admin\AppData\Local\Temp\Fleasion-v2.4.1-Windows.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Fleasion-v2.4.1-Windows.exe"C:\Users\Admin\AppData\Local\Temp\Fleasion-v2.4.1-Windows.exe"2⤵
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\netsh.exenetsh winhttp show proxy3⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "(Get-AppxPackage -Name 'ROBLOXCorporation.RobloxGDK' | Sort-Object Version -Descending | Select-Object -First 1 -ExpandProperty InstallLocation)"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /Query /TN Fleasion_Autostart3⤵
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004CC 0x00000000000004DC1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
fleasion.log
fleasion.log
fleasion.log
ca.crt
ca.key
settings.json
MSVCP140.dll
MSVCP140_1.dll
Qt6Core.dll
Qt6Gui.dll
Qt6Network.dll
Qt6Widgets.dll
VCRUNTIME140_1.dll
QtCore.pyd
QtNetwork.pyd
QtWidgets.pyd
sip.cp314-win_amd64.pyd
VCRUNTIME140.dll
_bz2.pyd
_ctypes.pyd
_hashlib.pyd
_lzma.pyd
_queue.pyd
_socket.pyd
_ssl.pyd
_wmi.pyd
_zstd.pyd
base_library.zip
METADATA
libcrypto-3-x64.dll
libffi-8.dll
libssl-3-x64.dll
INSTALLER
libscipy_openblas64_-9e3e5a4229c1ca39f10dc82bba9e2b2b.dll
msvcp140-a4c2229bdc2a2a630acdc095b4d86008.dll
_multiarray_umath.cp314-win_amd64.pyd
_umath_linalg.cp314-win_amd64.pyd
python3.DLL
python314.dll
Lorem ipsum.txt
ucrtbase.dll
__PSScriptPolicyTest_rmbexrxv.ytj.psm1
memory/1416-1266-0x00007FFEAC6E0000-0x00007FFEAC71E000-memory.dmp
memory/1416-1381-0x00007FFEAC550000-0x00007FFEAC5D8000-memory.dmp
memory/1416-1234-0x00007FFEBD2F0000-0x00007FFEBD370000-memory.dmp
memory/1416-1226-0x00007FFEB5F70000-0x00007FFEB60C0000-memory.dmp
memory/1416-1225-0x00007FFEB0160000-0x00007FFEB086C000-memory.dmp
memory/1416-1218-0x00007FFEC8F90000-0x00007FFEC8FBA000-memory.dmp
memory/1416-1219-0x00007FFEC2CB0000-0x00007FFEC2CC4000-memory.dmp
memory/1416-1213-0x00007FFEB1510000-0x00007FFEB1BF3000-memory.dmp
memory/1416-1214-0x00007FFEC4C20000-0x00007FFEC4C2F000-memory.dmp
memory/1416-1210-0x00007FFEC5240000-0x00007FFEC524D000-memory.dmp
memory/1416-1256-0x00007FFEC2CB0000-0x00007FFEC2CC4000-memory.dmp
memory/1416-1257-0x00007FFEB0160000-0x00007FFEB086C000-memory.dmp
memory/1416-1255-0x00007FFEC4C20000-0x00007FFEC4C2F000-memory.dmp
memory/1416-1247-0x00007FFEB1510000-0x00007FFEB1BF3000-memory.dmp
memory/1416-1260-0x00007FFEAE710000-0x00007FFEAFA8E000-memory.dmp
memory/1416-1261-0x00007FFEAC720000-0x00007FFEAC959000-memory.dmp
memory/1416-1263-0x00007FFEB3B10000-0x00007FFEB3B46000-memory.dmp
memory/1416-1262-0x00007FFEB8490000-0x00007FFEB84B6000-memory.dmp
memory/1416-1268-0x00007FFEC3CA0000-0x00007FFEC3CAD000-memory.dmp
memory/1416-1267-0x00007FFEAC620000-0x00007FFEAC6DD000-memory.dmp
memory/1416-1207-0x00007FFEC3CB0000-0x00007FFEC3CCA000-memory.dmp
memory/1416-1265-0x00007FFEC3980000-0x00007FFEC398B000-memory.dmp
memory/1416-1264-0x00007FFEC45D0000-0x00007FFEC45DB000-memory.dmp
memory/1416-1269-0x00007FFEC3590000-0x00007FFEC359B000-memory.dmp
memory/1416-1270-0x00007FFEB49A0000-0x00007FFEB49BC000-memory.dmp
memory/1416-1271-0x00007FFEAC5E0000-0x00007FFEAC61E000-memory.dmp
memory/1416-1272-0x00007FFEB30A0000-0x00007FFEB30B8000-memory.dmp
memory/1416-1273-0x00007FFEB2C40000-0x00007FFEB2C52000-memory.dmp
memory/1416-1274-0x00007FFEAC550000-0x00007FFEAC5D8000-memory.dmp
memory/1416-1275-0x00007FFEAC2C0000-0x00007FFEAC54C000-memory.dmp
memory/1416-1280-0x0000020C98AE0000-0x0000020C98AF0000-memory.dmp
memory/1416-1296-0x00007FFEAC5E0000-0x00007FFEAC61E000-memory.dmp
memory/1416-1297-0x00007FFEAB3A0000-0x00007FFEABD27000-memory.dmp
memory/1416-1300-0x00007FFEAB360000-0x00007FFEAB396000-memory.dmp
memory/1416-1299-0x00007FFEB30A0000-0x00007FFEB30B8000-memory.dmp
memory/1416-1200-0x00007FFEB1280000-0x00007FFEB150F000-memory.dmp
memory/1416-1186-0x00007FFEC8F60000-0x00007FFEC8F7A000-memory.dmp
memory/1416-1191-0x00007FFEBD2F0000-0x00007FFEBD370000-memory.dmp
memory/1416-1375-0x00007FFEBD2B0000-0x00007FFEBD2E5000-memory.dmp
memory/1416-1364-0x00007FFEB1510000-0x00007FFEB1BF3000-memory.dmp
memory/1416-1374-0x00007FFEB0160000-0x00007FFEB086C000-memory.dmp
memory/1416-1227-0x00007FFEBD2B0000-0x00007FFEBD2E5000-memory.dmp
memory/1416-1189-0x00007FFEC8F30000-0x00007FFEC8F5E000-memory.dmp
memory/1416-1379-0x00007FFEAB3A0000-0x00007FFEABD27000-memory.dmp
memory/1416-1376-0x00007FFEB5F70000-0x00007FFEB60C0000-memory.dmp
memory/1416-1182-0x00007FFEC8F80000-0x00007FFEC8F8F000-memory.dmp
memory/1416-1399-0x00007FFEAC2C0000-0x00007FFEAC54C000-memory.dmp
memory/1416-1628-0x00007FFEAA010000-0x00007FFEAA22B000-memory.dmp
memory/1416-1180-0x00007FFEC8F90000-0x00007FFEC8FBA000-memory.dmp
memory/1416-1629-0x00007FFEC9160000-0x00007FFEC91AE000-memory.dmp
memory/1416-1605-0x00007FFEB1510000-0x00007FFEB1BF3000-memory.dmp
memory/1416-1621-0x00007FFEAB360000-0x00007FFEAB396000-memory.dmp
memory/1416-1604-0x00007FFEAAB60000-0x00007FFEAABB7000-memory.dmp
memory/1416-1603-0x00007FFEAABC0000-0x00007FFEAAE3A000-memory.dmp
memory/1416-1602-0x00007FFECC030000-0x00007FFECC111000-memory.dmp
memory/1416-1601-0x00007FFECC120000-0x00007FFECC14F000-memory.dmp
memory/1416-1600-0x00007FFECC150000-0x00007FFECC17A000-memory.dmp
memory/1416-1599-0x00007FFEAA010000-0x00007FFEAA22B000-memory.dmp
memory/1416-1598-0x00007FFEC9160000-0x00007FFEC91AE000-memory.dmp
memory/1416-1513-0x00007FFEB1510000-0x00007FFEB1BF3000-memory.dmp
memory/1416-1524-0x00007FFEBD2B0000-0x00007FFEBD2E5000-memory.dmp
memory/1416-1520-0x00007FFEC5240000-0x00007FFEC524D000-memory.dmp
memory/1416-1530-0x00007FFEB1510000-0x00007FFEB1BF3000-memory.dmp
memory/1416-1547-0x00007FFEB1510000-0x00007FFEB1BF3000-memory.dmp
memory/1416-1568-0x00007FFEB1510000-0x00007FFEB1BF3000-memory.dmp
memory/1416-1585-0x00007FFECC150000-0x00007FFECC17A000-memory.dmp
memory/1416-1586-0x00007FFECC120000-0x00007FFECC14F000-memory.dmp
memory/1416-1587-0x00007FFECC030000-0x00007FFECC111000-memory.dmp
memory/1416-1588-0x00007FFEAABC0000-0x00007FFEAAE3A000-memory.dmp
memory/1416-1589-0x00007FFEAAB60000-0x00007FFEAABB7000-memory.dmp
memory/1416-1171-0x00007FFEB1510000-0x00007FFEB1BF3000-memory.dmp
memory/2252-1479-0x000002BBF2090000-0x000002BBF20B6000-memory.dmp
memory/2252-1478-0x000002BBF2030000-0x000002BBF2038000-memory.dmp
memory/2252-1477-0x000002BBF2020000-0x000002BBF202A000-memory.dmp
memory/2252-1476-0x000002BBF1F50000-0x000002BBF1F56000-memory.dmp
memory/2252-1473-0x000002BBF1F40000-0x000002BBF1F48000-memory.dmp
memory/2252-1472-0x000002BBF2460000-0x000002BBF248A000-memory.dmp
memory/2252-1471-0x000002BBF2040000-0x000002BBF205A000-memory.dmp
memory/2252-1470-0x000002BBF2640000-0x000002BBF2844000-memory.dmp
memory/2252-1467-0x000002BBF1F60000-0x000002BBF2012000-memory.dmp
memory/2252-1466-0x000002BBF1F40000-0x000002BBF1F5E000-memory.dmp
memory/2252-1459-0x000002BBF1D90000-0x000002BBF1DB2000-memory.dmp