Analysis
-
max time kernel
110s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
06/09/2024, 06:15
General
-
Target
9dce2c9f056fa06f5b7f4a8dd575fab0N.exe
-
Size
2.4MB
-
MD5
9dce2c9f056fa06f5b7f4a8dd575fab0
-
SHA1
429d2e7d3b44550ac14a59b6b840d92ae6d9fcae
-
SHA256
64aa5a55e4d08dc075982e5274a898f638d1e109b351a1681c9167c0d1bdd635
-
SHA512
0f77db35412a6ba75ebecaf4b1b51117fd37739c9db194328f10e40054cbf9fb0cfe0fcbfd07f3977d8cc65b9c3e23940d9c42a675bf989b08b01f9bf034e98d
-
SSDEEP
49152:A5+hGSK3y+ytVuKhZAylZQXP7c3pG5uQm9b59moYLQRfVAVs1Ol:A5aGSK3y+czZAGZQTypG+/tYKVAVFl
Malware Config
Signatures
-
Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
-
Detects Floxif payload 1 IoCs
-
Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Drops file in Program Files directory 19 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9dce2c9f056fa06f5b7f4a8dd575fab0N.exe"C:\Users\Admin\AppData\Local\Temp\9dce2c9f056fa06f5b7f4a8dd575fab0N.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\ImageforWindows\imagew64.exe"C:\Program Files (x86)\ImageforWindows\imagew64.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67B
MD50a464a65d02e47797008a4b3f77de871
SHA1d434addcf9a3c5c43f40910f75452980a5318532
SHA256eac83cf30498edfb40b5516e877928dd6c4364d1ec3516fc7d381790946dd362
SHA512b38f50714eddd3978712774d52706ce380b61d2022c309316675aecc9f08a2111ce5063ffa903560e2115d4e36d34a4a9c63dd75001cc76ef67be4025122516b
-
Filesize
722KB
MD57b404a080e648d6fa3edcc387199f478
SHA1950f620b6895b6a6bcc4f421edbda821ee616216
SHA256db12c5c3f8af5d117579236b86903512f2c53c482ca4ccb8832bc4aa097332ad
SHA5127904089bc3b3ea36a50f66087dc4b5317a1b723d37b9d503f03857d4b4544fa3f6ef305de29932caf354d5c01b5a2c7f388d15033defce30d44bdb02fd7c177c
-
Filesize
19B
MD5c5ed5fbbdaefbc2b25173a591ecd3472
SHA132e04fedb37e65a439b460c1186ce0f1b7571dfd
SHA2561ff8ef586179c3c6dbb65105517093d64362c3deb912b9858c8fef67f3593fff
SHA5125be287a8eef77a593edb499037b9e01e6edf9e22e280a5c6e03ced50f175a44c1068d61b03e9d3fbfe5eff1f2b55020d029cdabe3b864d0d7a9b20b434b23924
-
Filesize
1.1MB
MD559855cb4079a692a8afadf08c446bbb3
SHA19c4ba237e221c564f4df977b1fe000cb68919724
SHA25600f75c965f357f05710b5e57d9b9605c094a2e0194ca20fcdc598308a91d888e
SHA5125061b2f8fdf08963a76d5cd3c8f1a6f1252c81bed7f38a6c9dfe86261eac85be105272f97e916124c9c51171acafebac6b9a1591d6377d4fd3d85584d3eb7a6b
-
Filesize
4.1MB
MD50703f9b56d5d9a46eee64627bb07974f
SHA1358cb7ac045dc0091e0b9ae0cd809b9fcd2e1b13
SHA25691682a735d3e128c0d88ee706cbab440467f0aecb8e034b400049c1c203b48c3
SHA5123ceb359ce6bcac8bc88b3d6f18cbec42d8ad335c24983e9a87650c2e57aec3af0525c119b92a90a0e22915ae7e1e3e21375ed8731da7dc3e2d9e9e74f4c755da
-
Filesize
67KB
MD57574cf2c64f35161ab1292e2f532aabf
SHA114ba3fa927a06224dfe587014299e834def4644f
SHA256de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
SHA5124db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
-
Filesize
192KB
-
Filesize
12KB
-
Filesize
192KB