Analysis
-
max time kernel
119s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
06/09/2024, 17:53
General
-
Target
f9ded801c36ce3d955c95916e5626b60N.exe
-
Size
5.1MB
-
MD5
f9ded801c36ce3d955c95916e5626b60
-
SHA1
9cb08a0067a579dfd475c52ff9fb07680fec0bac
-
SHA256
276362b4328bcc601803d1392005dd912b6bf018f89ba59fa745e5294fcac54e
-
SHA512
a3e5b93357084bf9ae73990b8e36935981cef05109fd983cd7a4a8980aea5801cf443b22895a7f3d808a86fc3dad417a0d8b89c566ff0e272ace921ddfe1d4fd
-
SSDEEP
98304:0Qe3XQoI3neqsutviL+SZa2hi2ZWpZbCC9rbjz5a7oCs1TiQq:0Q1uGTSZvjWpZTlb/l1Hq
Malware Config
Signatures
-
Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
-
Detects Floxif payload 1 IoCs
-
Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
UPX packed file 7 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in Program Files directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f9ded801c36ce3d955c95916e5626b60N.exe"C:\Users\Admin\AppData\Local\Temp\f9ded801c36ce3d955c95916e5626b60N.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
\??\c:\376580a565c88e7d71d1d63bd958cff0\install.exec:\376580a565c88e7d71d1d63bd958cff0\.\install.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
834KB
MD5dbfd18f9dd13466964c09d522893c594
SHA106f756afa088e6ebbb510573ddb3edb8c9a3cc57
SHA2563d2bdad60f7fed1243072c1ed268ce3c3d7a0f9c4d8bd5ed811c6d1d868a4ae7
SHA512864e5012e11d85397fcfabde0c6e6b54a77156655c125bef0c85404abc9d386c4fe391116916884fd01c77f17fb28fa793f14378a0036746d0d136fb4240a3f8
-
Filesize
67KB
MD57574cf2c64f35161ab1292e2f532aabf
SHA114ba3fa927a06224dfe587014299e834def4644f
SHA256de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
SHA5124db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
-
Filesize
175B
MD51130c911bf5db4b8f7cf9b6f4b457623
SHA148e734c4bc1a8b5399bff4954e54b268bde9d54c
SHA256eba08cc8182f379392a97f542b350ea0dbbe5e4009472f35af20e3d857eafdf1
SHA51294e2511ef2c53494c2aff0960266491ffc0e54e75185427d1ccedae27c286992c754ca94cbb0c9ea36e3f04cd4eb7f032c551cf2d4b309f292906303f1a75fa0
-
Filesize
9KB
MD5162fc8231b1bd62f1d24024bb70140d5
SHA17fa4601390f1a69b4824ee1334bee772c2941a24
SHA256c68a0fd93e8c64139a42af4fcd4670c6faea3a5d5d1e9dd35b197f7d5268d92b
SHA512a707b5ef0e914ba61e815be5224831441922ed8d933f7a2ffe8aecf41f5a1790a1e45981f19d86aa5eab5ea73d03b0c8e2ab6b9f398ab0154d1c828da6f6beda
-
Filesize
1KB
MD50a6b586fabd072bd7382b5e24194eac7
SHA160e3c7215c1a40fbfb3016d52c2de44592f8ca95
SHA2567912e3fcf2698cf4f8625e563cd8215c6668739cae18bd6f27af2d25bec5c951
SHA512b96b0448e9f0e94a7867b6bb103979e9ef2c0e074bcb85988d450d63de6edcf21dc83bb154aafb7de524af3c3734f0bb1ba649db0408612479322e1aa85be9f4
-
Filesize
841B
MD5f8f6c0e030cb622f065fe47d61da91d7
SHA1cf6fa99747de8f35c6aea52df234c9c57583baa3
SHA256c16727881c47a40077dc5a1f1ea71cbb28e3f4e156c0ae7074c6d7f5ecece21d
SHA512b70c6d67dac5e6a0dbd17e3bcf570a95914482abad20d0304c02da22231070b4bc887720dbae972bc5066457e1273b68fde0805f1c1791e9466a5ca343485cde
-
Filesize
84KB
MD51234c94116cecbb9ea602db8793c2086
SHA1743ff2607683ffb37e871d1d4a81b8b2e53069c4
SHA256f5dbe5a1cd8cdab7c483f17aed9cb485ae8a385b241ac550ce38c84a0c7dd1bc
SHA51263d0bd538f7f99bd14589ba030faee86999f0bbe7117f75c119234cd09dc9d9989557d07f8a824dd0e2618801ea0c7ed07db3f82024b4ddc21af89dc30fe1fff
-
Filesize
226KB
MD536fa686b188b7012c1e616ac0e21004e
SHA113c7e0116993d0829f12abef4080bdf29d955a7b
SHA256dd6b7459aff8b29d19164e429b7e4d3b1f331e06191a86a4f12520b8bd6835b2
SHA5123b9223b9ce488d2dc600349fc96accf9f4b41e99f19ac58734548b8afee36691b6f5ae84a338c4432d922ceab32850b6f5036302e4856a3d8d0075b09e8b2761
-
Filesize
5KB
MD506fba95313f26e300917c6cea4480890
SHA131beee44776f114078fc403e405eaa5936c4bc3b
SHA256594884a8006e24ad5b1578cd7c75aca21171bb079ebdc4f6518905bcf2237ba1
SHA5127dca0f1ab5d3fd1ac8755142a7ca4d085bb0c2f12a7272e56159dadfa22da79ec8261815be71b9f5e7c32f6e8121ecb2443060f7db76feaf01eb193200e67dfd
-
Filesize
4KB
-
Filesize
192KB
-
Filesize
120KB
-
Filesize
4KB
-
Filesize
396KB
-
Filesize
4KB
-
Filesize
192KB
-
Filesize
396KB
-
Filesize
120KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
4KB
-
Filesize
396KB
-
Filesize
396KB
-
Filesize
396KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
396KB
-
Filesize
4KB
-
Filesize
4KB
