Analysis
- max time kernel
131s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
08/09/2024, 18:09
General
- Target 03a65818ca6df8fe723a3ba5346feffe82aeaac0a76ddcc54462dec6de9411b8.exe
- Size 108KB
- Sample240908-wrh5eascrf
- SHA256 03a65818ca6df8fe723a3ba5346feffe82aeaac0a76ddcc54462dec6de9411b8
Malware Config
Signatures
- Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
- Detects Floxif payload 1 IoCs
- Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
- Loads dropped DLL 16 IoCs
- UPX packed file 36 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in Program Files directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 8 IoCs
- Suspicious use of WriteProcessMemory 21 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\03a65818ca6df8fe723a3ba5346feffe82aeaac0a76ddcc54462dec6de9411b8.exe"C:\Users\Admin\AppData\Local\Temp\03a65818ca6df8fe723a3ba5346feffe82aeaac0a76ddcc54462dec6de9411b8.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\03a65818ca6df8fe723a3ba5346feffe82aeaac0a76ddcc54462dec6de9411b8.exe2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\03a65818ca6df8fe723a3ba5346feffe82aeaac0a76ddcc54462dec6de9411b8.exe2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\03a65818ca6df8fe723a3ba5346feffe82aeaac0a76ddcc54462dec6de9411b8.exe2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\03a65818ca6df8fe723a3ba5346feffe82aeaac0a76ddcc54462dec6de9411b8.exe2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\03a65818ca6df8fe723a3ba5346feffe82aeaac0a76ddcc54462dec6de9411b8.exe2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\03a65818ca6df8fe723a3ba5346feffe82aeaac0a76ddcc54462dec6de9411b8.exe2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\03a65818ca6df8fe723a3ba5346feffe82aeaac0a76ddcc54462dec6de9411b8.exe2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3820,i,2904906934812054273,11716976550456127484,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
symsrv.dll
symsrv.dll.000
memory/540-64-0x0000000010000000-0x0000000010030000-memory.dmp
memory/540-133-0x0000000010000000-0x0000000010030000-memory.dmp
memory/540-134-0x0000000000400000-0x000000000044F000-memory.dmp
memory/540-47-0x0000000010000000-0x0000000010030000-memory.dmp
memory/540-17-0x0000000010000000-0x0000000010030000-memory.dmp
memory/540-44-0x0000000000400000-0x000000000044F000-memory.dmp
memory/540-60-0x0000000000400000-0x000000000044F000-memory.dmp
memory/1040-24-0x0000000010000000-0x0000000010030000-memory.dmp
memory/1040-65-0x0000000010000000-0x0000000010030000-memory.dmp
memory/1040-29-0x0000000002360000-0x0000000002390000-memory.dmp
memory/1040-48-0x0000000010000000-0x0000000010030000-memory.dmp
memory/1040-129-0x0000000010000000-0x0000000010030000-memory.dmp
memory/1040-28-0x0000000002360000-0x0000000002390000-memory.dmp
memory/1180-66-0x0000000010000000-0x0000000010030000-memory.dmp
memory/1180-49-0x0000000010000000-0x0000000010030000-memory.dmp
memory/1180-26-0x0000000002250000-0x0000000002280000-memory.dmp
memory/1180-27-0x0000000002250000-0x0000000002280000-memory.dmp
memory/1180-50-0x0000000002250000-0x0000000002280000-memory.dmp
memory/1180-51-0x0000000002250000-0x0000000002280000-memory.dmp
memory/1180-25-0x0000000010000000-0x0000000010030000-memory.dmp
memory/1180-135-0x0000000010000000-0x0000000010030000-memory.dmp
memory/1580-122-0x0000000010000000-0x0000000010030000-memory.dmp
memory/1580-124-0x0000000000400000-0x000000000044F000-memory.dmp
memory/1580-58-0x0000000000400000-0x000000000044F000-memory.dmp
memory/1580-13-0x0000000010000000-0x0000000010030000-memory.dmp
memory/1580-45-0x0000000010000000-0x0000000010030000-memory.dmp
memory/1580-62-0x0000000010000000-0x0000000010030000-memory.dmp
memory/1580-42-0x0000000000400000-0x000000000044F000-memory.dmp
memory/3396-57-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3396-4-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3396-6-0x0000000000402000-0x0000000000405000-memory.dmp
memory/3396-112-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3396-103-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3396-91-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3396-79-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3396-69-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3396-41-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3592-33-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3592-67-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3592-131-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3592-34-0x0000000002200000-0x0000000002230000-memory.dmp
memory/3592-52-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3592-54-0x0000000002200000-0x0000000002230000-memory.dmp
memory/3592-53-0x0000000002200000-0x0000000002230000-memory.dmp
memory/3592-35-0x0000000002200000-0x0000000002230000-memory.dmp
memory/3840-39-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3840-55-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3840-128-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3840-40-0x0000000002000000-0x0000000002030000-memory.dmp
memory/3840-56-0x0000000002000000-0x0000000002030000-memory.dmp
memory/3932-59-0x0000000000400000-0x000000000044F000-memory.dmp
memory/3932-125-0x0000000000400000-0x000000000044F000-memory.dmp
memory/3932-63-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3932-123-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3932-15-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3932-46-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3932-43-0x0000000000400000-0x000000000044F000-memory.dmp