floxif | 2e08840a9a03c5070d1ff522d39f2918350f6b6f1681ad8afe19c6c8c1c46b4b

General

Target

540e29d433a62e86b834b9689058dd10N.exe
Size

164KB
MD5

540e29d433a62e86b834b9689058dd10
SHA1

29ec51f76995586ede29ab3982e34ce78cc4b0b9
SHA256

2e08840a9a03c5070d1ff522d39f2918350f6b6f1681ad8afe19c6c8c1c46b4b
SHA512

6cde6b3861032dc5347266d7226a535467bceb0ef62a3bbca77a772bdf5bfe05264bf1c8dfb038e44949c91bfb5131cc4607341e99b3715401e6df000d015ac6
SSDEEP

3072:c0poOfa6+Juc7ZaKHKp2lQBV+UdE+rECWp7hKt/b:c0ppi6+JDZlHK9BV+UdvrEFp7hKtj

Score

10^/10

floxif phorphiex backdoor evasion loader persistence trojan upx worm

Malware Config

Signatures

Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
backdoor trojan floxif
Modifies security service 2 TTPs 1 IoCs
evasion

Modify Registry
T1112

Windows Service
T1543.003

Processes:

sysmablsvr.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4" sysmablsvr.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	sysmablsvr.exe

Phorphiex payload 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\A1D26E2\9FABF601D8.tmp	family_phorphiex

Phorphiex, Phorpiex
Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
worm trojan loader phorphiex

Windows security bypass 2 TTPs 6 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

sysmablsvr.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysmablsvr.exe

Detects Floxif payload 1 IoCs

backdoor

Processes:

resource	yara_rule
C:\Program Files\Common Files\System\symsrv.dll	floxif

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
C:\Program Files\Common Files\System\symsrv.dll	acprotect

Executes dropped EXE 1 IoCs

Processes:

sysmablsvr.exe

pid process

208 sysmablsvr.exe
Loads dropped DLL 1 IoCs

Processes:

540e29d433a62e86b834b9689058dd10N.exe

pid process

472 540e29d433a62e86b834b9689058dd10N.exe

pid	process
208	sysmablsvr.exe

pid	process
472	540e29d433a62e86b834b9689058dd10N.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Program Files\Common Files\System\symsrv.dll	upx
behavioral2/memory/472-4-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/472-21-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

sysmablsvr.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysmablsvr.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

540e29d433a62e86b834b9689058dd10N.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysmablsvr.exe"	540e29d433a62e86b834b9689058dd10N.exe

Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Processes:

540e29d433a62e86b834b9689058dd10N.exe

description ioc process

File opened (read-only) \??\e: 540e29d433a62e86b834b9689058dd10N.exe

description	ioc	process
File opened (read-only)	\??\e:	540e29d433a62e86b834b9689058dd10N.exe

Drops file in Program Files directory 2 IoCs

Processes:

540e29d433a62e86b834b9689058dd10N.exe

description	ioc	process
File created	C:\Program Files\Common Files\System\symsrv.dll	540e29d433a62e86b834b9689058dd10N.exe
File created	\??\c:\program files\common files\system\symsrv.dll.000	540e29d433a62e86b834b9689058dd10N.exe

Drops file in Windows directory 2 IoCs

Processes:

540e29d433a62e86b834b9689058dd10N.exe

description	ioc	process
File opened for modification	C:\Windows\sysmablsvr.exe	540e29d433a62e86b834b9689058dd10N.exe
File created	C:\Windows\sysmablsvr.exe	540e29d433a62e86b834b9689058dd10N.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

540e29d433a62e86b834b9689058dd10N.exe

pid process

472 540e29d433a62e86b834b9689058dd10N.exe
472 540e29d433a62e86b834b9689058dd10N.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

540e29d433a62e86b834b9689058dd10N.exe

description pid process

Token: SeDebugPrivilege 472 540e29d433a62e86b834b9689058dd10N.exe

pid	process
472	540e29d433a62e86b834b9689058dd10N.exe
472	540e29d433a62e86b834b9689058dd10N.exe

description	pid	process
Token: SeDebugPrivilege	472	540e29d433a62e86b834b9689058dd10N.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

540e29d433a62e86b834b9689058dd10N.exe

description	pid	process	target process
PID 472 wrote to memory of 208	472	540e29d433a62e86b834b9689058dd10N.exe	sysmablsvr.exe
PID 472 wrote to memory of 208	472	540e29d433a62e86b834b9689058dd10N.exe	sysmablsvr.exe
PID 472 wrote to memory of 208	472	540e29d433a62e86b834b9689058dd10N.exe	sysmablsvr.exe

C:\Users\Admin\AppData\Local\Temp\540e29d433a62e86b834b9689058dd10N.exe
"C:\Users\Admin\AppData\Local\Temp\540e29d433a62e86b834b9689058dd10N.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:472
- C:\Windows\sysmablsvr.exe
  C:\Windows\sysmablsvr.exe
  2⤵
  - Modifies security service
  - Windows security bypass
  - Executes dropped EXE
  - Windows security modification
  PID:208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\System\symsrv.dll

Filesize
67KB

MD5
7574cf2c64f35161ab1292e2f532aabf

SHA1
14ba3fa927a06224dfe587014299e834def4644f

SHA256
de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085

SHA512
4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\A1D26E2\9FABF601D8.tmp

Filesize
88KB

MD5
ababca6d12d96e8dd2f1d7114b406fae

SHA1
dcd9798e83ec688aacb3de8911492a232cb41a32

SHA256
a992920e64a64763f3dd8c2a431a0f5e56e5b3782a1496de92bc80ee71cca5ba

SHA512
b7fc70c176bdc74cf68b14e694f3e53142e64d39bd6d3e0f2e3a74ce3178ea606f92f760d21db69d72ae6677545a47c7bf390fb65cd5247a48e239f6ae8f7b8f

Download Submit
memory/472-4-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/472-11-0x0000000075E55000-0x0000000075E56000-memory.dmp

Filesize
4KB

Download
memory/472-21-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads