floxif | 5d322252a07a84ab3c8f33badfa52837dbf216024894a9c5069df9b25378c620

General

Target
1a718599ab481797b5b0716eb4abf630N.exe
Size 164KB
Sample240712-aha7js1ajk
SHA256 5d322252a07a84ab3c8f33badfa52837dbf216024894a9c5069df9b25378c620
MD5 1a718599ab481797b5b0716eb4abf630
SHA1 db8e26aa49e84d22c6a0ef59bb7bdd276bb11794
SHA512 5d43269de3033fd7603a442a6ef996f51d326a271243d4d94dc7250617da27b8f3d114cdeefc786fed99c1250359f249447fa59111e459102c97c0ea50294d72
SSDEEP 3072:c0pofyEM6+JuEjaaKHKp2lQBV+UdE+rECWp7hKsS:c0p4vM6+J9alHK9BV+UdvrEFp7hKsS
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

floxif phorphiex backdoor evasion loader persistence trojan upx worm

Malware Config

Signatures

Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
backdoor trojan floxif

Modifies security service 2 TTPs 1 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	sysmablsvr.exe

Phorphiex payload 1 IoCs

resource	yara_rule
behavioral2/files/0x00090000000234cd-16.dat	family_phorphiex

Phorphiex, Phorpiex
Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
worm trojan loader phorphiex

Windows security bypass 2 TTPs 6 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysmablsvr.exe

Detects Floxif payload 1 IoCs

backdoor

resource	yara_rule
behavioral2/files/0x0009000000023476-1.dat	floxif

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x0009000000023476-1.dat	acprotect

Executes dropped EXE 2 IoCs

pid	Process
2440	sysmablsvr.exe
808	458222399.exe

Loads dropped DLL 1 IoCs

pid	Process
840	1a718599ab481797b5b0716eb4abf630N.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0009000000023476-1.dat	upx
behavioral2/memory/840-4-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/840-21-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysmablsvr.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysmablsvr.exe"	1a718599ab481797b5b0716eb4abf630N.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\e:	1a718599ab481797b5b0716eb4abf630N.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\symsrv.dll	1a718599ab481797b5b0716eb4abf630N.exe
File created	\??\c:\program files\common files\system\symsrv.dll.000	1a718599ab481797b5b0716eb4abf630N.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\sysmablsvr.exe	1a718599ab481797b5b0716eb4abf630N.exe
File opened for modification	C:\Windows\sysmablsvr.exe	1a718599ab481797b5b0716eb4abf630N.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
840	1a718599ab481797b5b0716eb4abf630N.exe
840	1a718599ab481797b5b0716eb4abf630N.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	840	1a718599ab481797b5b0716eb4abf630N.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 840 wrote to memory of 2440	840	1a718599ab481797b5b0716eb4abf630N.exe	86
PID 840 wrote to memory of 2440	840	1a718599ab481797b5b0716eb4abf630N.exe	86
PID 840 wrote to memory of 2440	840	1a718599ab481797b5b0716eb4abf630N.exe	86
PID 2440 wrote to memory of 808	2440	sysmablsvr.exe	90
PID 2440 wrote to memory of 808	2440	sysmablsvr.exe	90
PID 2440 wrote to memory of 808	2440	sysmablsvr.exe	90

C:\Users\Admin\AppData\Local\Temp\1a718599ab481797b5b0716eb4abf630N.exe
"C:\Users\Admin\AppData\Local\Temp\1a718599ab481797b5b0716eb4abf630N.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:840
- C:\Windows\sysmablsvr.exe
  C:\Windows\sysmablsvr.exe
  2⤵
  - Modifies security service
  - Windows security bypass
  - Executes dropped EXE
  - Windows security modification
  - Suspicious use of WriteProcessMemory
  PID:2440
- - C:\Users\Admin\AppData\Local\Temp\458222399.exe
    C:\Users\Admin\AppData\Local\Temp\458222399.exe
    3⤵
    - Executes dropped EXE
    PID:808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

symsrv.dll

Path C:\Program Files\Common Files\System\symsrv.dll
Size 67KB
SHA256 de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
MD5 7574cf2c64f35161ab1292e2f532aabf
SHA1 14ba3fa927a06224dfe587014299e834def4644f
SHA512 4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
SSDEEP 1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZL:c8y93KQjy7G55riF1cMo03V
MD5 SHA1 SHA512 SSDEEP

Submit Download

1857230251.exe

Path C:\Users\Admin\AppData\Local\Temp\1857230251.exe
Size 80KB
SHA256 985da56fb594bf65d8bb993e8e37cd6e78535da6c834945068040faf67e91e7d
MD5 2ff2bb06682812eeb76628bfbe817fbb
SHA1 18e86614d0f4904e1fe97198ccda34b25aab7dae
SHA512 5cd3b5a1e16202893b08c0ae70d3bcd9e7a49197ebf1ded08e01395202022b3b6c2d8837196ef0415fea6497d928b44e03544b934f8e062ddbb6c6f79fb6f440
SSDEEP 1536:pm0MZsv8GxSYZCQGoPTBygAku+XJIE+ch9tYoKRcw+RLJznfl0:p56QIQGoLBygAkMc2oKRcwYBfl0
MD5 SHA1 SHA512 SSDEEP

Submit Download

3321212903.exe

Path C:\Users\Admin\AppData\Local\Temp\3321212903.exe
Size 86KB
SHA256 2ebc4a92f4fdc27d4ab56e57058575a8b18adb076cbd30feea2ecdc8b7fcd41f
MD5 fe1e93f12cca3f7c0c897ef2084e1778
SHA1 fb588491ddad8b24ea555a6a2727e76cec1fade3
SHA512 36e0524c465187ae9ad207c724aee45bcd61cfd3fa66a79f9434d24fcbadc0a743834d5e808e6041f3bd88e75deb5afd34193574f005ed97e4b17c6b0388cb93
SSDEEP 1536:707GMwma6WMXMlXfQlt5JfoFmIwKsWRB4qz9LtNWWNEGHGBlx2dSH:70sDfqt5JfokJ5WRB9JtcWOGmgdSH
MD5 SHA1 SHA512 SSDEEP

Submit Download

458222399.exe

Path C:\Users\Admin\AppData\Local\Temp\458222399.exe
Size 7KB
SHA256 351a2c3c64f6114b3f71f96167b364b821ec5c572bf777fcd6636478500b4d8d
MD5 2ee804f53de2ca40325d076df205e01a
SHA1 ba09c1ec54c7347979aedf1cacb9c41fc55d3d0a
SHA512 c52b5f65e544ed9d788d5dc586623da8164aee63f4b60113833a51bc230ed8025a63959233f15f87fc24b1f35a0a90350cb00052a66d36ce1920a59eb2ac8955
SSDEEP 96:mzNFXvbMUk2d5BDHN9LT+9A7XwLlZCJxSEcUOy2qp3C7tCEI4LOf:MNFfQUk4vJ+6fJx3cUOytpcI4K
MD5 SHA1 SHA512 SSDEEP

Submit Download

B9EA12EC348.tmp

Path C:\Users\Admin\AppData\Local\Temp\A1D26E2\B9EA12EC348.tmp
Size 88KB
SHA256 a992920e64a64763f3dd8c2a431a0f5e56e5b3782a1496de92bc80ee71cca5ba
MD5 ababca6d12d96e8dd2f1d7114b406fae
SHA1 dcd9798e83ec688aacb3de8911492a232cb41a32
SHA512 b7fc70c176bdc74cf68b14e694f3e53142e64d39bd6d3e0f2e3a74ce3178ea606f92f760d21db69d72ae6677545a47c7bf390fb65cd5247a48e239f6ae8f7b8f
SSDEEP 1536:wL0IGzbFmav82XwudP6+0MTqEjXm/D5AKHK:c0poOfP6+JuEjaaKHK
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/840-4-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/840-11-0x0000000076005000-0x0000000076006000-memory.dmp

Download

memory/840-21-0x0000000010000000-0x0000000010030000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads