Analysis

  • max time kernel
    111s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-09-2024 04:11

General

  • Target

    a49fec56698a9c7603bfc46649f4b660N.exe

  • Size

    1.2MB

  • MD5

    a49fec56698a9c7603bfc46649f4b660

  • SHA1

    7015feb7583ea07e58e808223d3bcfc7cf152ab3

  • SHA256

    9873a13792db67e79bf4a8c7bec3794ddf285089d330cfe7532256963fb64f5f

  • SHA512

    004abd263a66b3a05e40850fd1c69825ffabfabb3270eeab6c5c0a8a2dbf53129e416e460c3ad66959fa975442b40e409158e0f74e0920fd8195f818d2eb93c8

  • SSDEEP

    24576:FrG5gX9qqY7tl96R7XRe05OkhCOJDLonUc98hJNDpevFDsz5tJrPkMRGJ/qofr:FZtRY73yXReE4m8nR98PVpeszj01qi

Malware Config

Signatures

  • Floxif, Floodfix

    Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.

  • Detects Floxif payload 1 IoCs
  • Event Triggered Execution: AppInit DLLs 1 TTPs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 21 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Network Service Discovery 1 TTPs 9 IoCs

    Attempt to gather information on host's network.

  • Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Drops file in System32 directory 34 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 5 IoCs
  • Modifies registry class 23 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 33 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a49fec56698a9c7603bfc46649f4b660N.exe
    "C:\Users\Admin\AppData\Local\Temp\a49fec56698a9c7603bfc46649f4b660N.exe"
    1⤵
    • Loads dropped DLL
    • Writes to the Master Boot Record (MBR)
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5016
    • C:\Windows\SysWOW64\arp.exe
      arp -a
      2⤵
      • Network Service Discovery
      • System Location Discovery: System Language Discovery
      PID:3540
    • C:\Windows\SysWOW64\arp.exe
      arp -s 10.127.0.1 92-c4-0e-03-c4-47
      2⤵
      • Network Service Discovery
      • System Location Discovery: System Language Discovery
      PID:1948
    • C:\Windows\SysWOW64\arp.exe
      arp -s 10.127.255.255 4d-89-e4-a3-e9-0a
      2⤵
      • Network Service Discovery
      • System Location Discovery: System Language Discovery
      PID:4200
    • C:\Windows\SysWOW64\arp.exe
      arp -s 136.243.76.170 6c-7d-c9-6b-f1-16
      2⤵
      • Network Service Discovery
      • System Location Discovery: System Language Discovery
      PID:3248
    • C:\Windows\SysWOW64\arp.exe
      arp -s 224.0.0.22 99-3e-07-37-42-29
      2⤵
      • Network Service Discovery
      • System Location Discovery: System Language Discovery
      PID:2184
    • C:\Windows\SysWOW64\arp.exe
      arp -s 224.0.0.251 35-dc-88-da-36-b8
      2⤵
      • Network Service Discovery
      • System Location Discovery: System Language Discovery
      PID:2248
    • C:\Windows\SysWOW64\arp.exe
      arp -s 224.0.0.252 8b-f8-4c-7b-cd-da
      2⤵
      • Network Service Discovery
      • System Location Discovery: System Language Discovery
      PID:2292
    • C:\Windows\SysWOW64\arp.exe
      arp -s 239.255.255.250 70-b1-ed-3f-52-3e
      2⤵
      • Network Service Discovery
      • System Location Discovery: System Language Discovery
      PID:2680
    • C:\Windows\SysWOW64\arp.exe
      arp -s 255.255.255.255 13-8e-27-99-0c-c3
      2⤵
      • Network Service Discovery
      • System Location Discovery: System Language Discovery
      PID:2960
    • C:\Windows\SysWOW64\explorer.exe
      explorer C:\Users\Admin\AppData\Local\Temp\a49fec56698a9c7603bfc46649f4b660N
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:1368
    • C:\Windows\SysWOW64\9E3B3C\E37CC5.EXE
      C:\Windows\system32\9E3B3C\E37CC5.EXE
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Loads dropped DLL
      • Writes to the Master Boot Record (MBR)
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:3916
  • C:\Windows\explorer.exe
    C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:4752

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Common Files\System\symsrv.dll

    Filesize

    71KB

    MD5

    4fcd7574537cebec8e75b4e646996643

    SHA1

    efa59bb9050fb656b90d5d40c942fb2a304f2a8b

    SHA256

    8ea3b17e4b783ffc0bc387b81b823bf87af0d57da74541d88ba85314bb232a5d

    SHA512

    7f1a7ef64d332a735db82506b47d84853af870785066d29ccaf4fdeab114079a9f0db400e01ba574776a0d652a248658fe1e8f9659cdced19ad6eea09644ea3e

  • C:\Users\Admin\AppData\Local\Temp\E_N4\cnvpe.fne

    Filesize

    56KB

    MD5

    fb7ea6f8ae09fa7621ee13f86c4f2935

    SHA1

    d93676c39ad0181dad70a662c41fc4c280cce848

    SHA256

    bdc314d45af6a5afaed2663e63817902e80f9a18ba1965947c314b433e05bfb0

    SHA512

    e15111dda54bcab507c20e910f8257d2dec2830bfbc5f69e5286ce37cabb79237ce8fb1c813b2d82fa7bed0c2df89e2940ceebde358162553290224cf0866749

  • C:\Users\Admin\AppData\Local\Temp\E_N4\dp1.fne

    Filesize

    112KB

    MD5

    6d4b2e73f6f8ecff02f19f7e8ef9a8c7

    SHA1

    09c32ca167136a17fd69df8c525ea5ffeca6c534

    SHA256

    fe5783e64aa70fac10c2e42d460732d9770534357329d8bc78576557c165f040

    SHA512

    2fd7a95cb632e9c4ac6b34e5b6b875aae94e73cd4b1f213e78f46dadab4846227a030776461bca08f9d75a1d61a0d45427f7b0c8b71406b7debc14db04b2ce04

  • C:\Users\Admin\AppData\Local\Temp\E_N4\krnln.fnr

    Filesize

    1.1MB

    MD5

    cf46bb62a1ba559ceb0fad7a5d642f28

    SHA1

    80b63dd193e84bfacbe535587dd38471b8ea2c24

    SHA256

    fe4bba1a99b332c8bbd196d3a2f3c78d9edc8f212842ff2efef17eba38427f67

    SHA512

    1f71f31fdc1ef7695d7a6e79218a9192804178bb2af80486de4f8ff3d7e176860813a61fa265bf78fe4ff722a85b72798938d715d8a2a034ac759505197a1058

  • C:\Users\Admin\AppData\Local\Temp\E_N4\shell.fne

    Filesize

    40KB

    MD5

    d54753e7fc3ea03aec0181447969c0e8

    SHA1

    824e7007b6569ae36f174c146ae1b7242f98f734

    SHA256

    192608ff371400c1529aa05f1adba0fe4fdd769fcbf35ee5f8b4f78a838a7ec9

    SHA512

    c25ed4cb38d5d5e95a267979f0f3f9398c04a1bf5822dceb03d6f6d9b4832dfb227f1e6868327e52a0303f45c36b9ba806e75b16bd7419a7c5203c2ecbae838f

  • C:\Windows\SysWOW64\9E3B3C\E37CC5.EXE

    Filesize

    111KB

    MD5

    e2b86e9a37fe4f85bbf0d08af28690a2

    SHA1

    d56b2d2a21cdf5661a17e32be5c71004eb558896

    SHA256

    b05ad065919cee4748075a182d681215c645c7cc3fdf9a06bfd18f7ebb067c91

    SHA512

    6cb065b121f11ee2700b22dd1cf9c9f4d44808261cc9ff2fac36165f42291598b708fa2501264d5c0dfc3df71e7bd6a3d22f9fff70e23d064733e488d49ee082

  • C:\Windows\SysWOW64\9E3B3C\com.run

    Filesize

    260KB

    MD5

    ce2f773275d3fe8b78f4cf067d5e6a0f

    SHA1

    b7135e34d46eb4303147492d5cee5e1ef7b392ab

    SHA256

    eb8099c0ad2d82d9d80530443e2909f3b34be0844d445e844f1c994476c86d2d

    SHA512

    d733dc01c047be56680629a385abdd2aa1598a2b5459269028446da9097b6f6c1e7ade5b74e3ac3809dd8a3f8d1cbbe7fd669f2762be61f9c38fd4a2cca9e063

  • C:\Windows\SysWOW64\9E3B3C\eAPI.fne

    Filesize

    312KB

    MD5

    936745bac5c873ab1a91478d27894626

    SHA1

    9ed92393f95692339ce03a8f1498f80c727e0555

    SHA256

    edfbe514d330e942ecd50dd7331659d59df27668e762d5a00e43df67f5f08630

    SHA512

    32d15337ab7a62ff25802c04bd782f5be36012f1a5251d962226a8e8e2daa7bc0a35b9cbfb67889d3b9dbc5f6cc51f924bae963ae12619249b22f2cc9aa2bbd4

  • memory/1368-23-0x0000000010000000-0x0000000010033000-memory.dmp

    Filesize

    204KB

  • memory/1368-59-0x0000000010000000-0x0000000010033000-memory.dmp

    Filesize

    204KB

  • memory/3916-102-0x0000000003350000-0x000000000336E000-memory.dmp

    Filesize

    120KB

  • memory/3916-98-0x0000000002CA0000-0x0000000002CB1000-memory.dmp

    Filesize

    68KB

  • memory/3916-136-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/3916-126-0x0000000010000000-0x0000000010033000-memory.dmp

    Filesize

    204KB

  • memory/3916-93-0x0000000002630000-0x000000000267A000-memory.dmp

    Filesize

    296KB

  • memory/3916-115-0x0000000003380000-0x00000000033DD000-memory.dmp

    Filesize

    372KB

  • memory/3916-82-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/3916-89-0x0000000010000000-0x0000000010033000-memory.dmp

    Filesize

    204KB

  • memory/3916-87-0x0000000002390000-0x00000000024AD000-memory.dmp

    Filesize

    1.1MB

  • memory/5016-27-0x00000000022A0000-0x00000000022B1000-memory.dmp

    Filesize

    68KB

  • memory/5016-69-0x0000000002380000-0x0000000002394000-memory.dmp

    Filesize

    80KB

  • memory/5016-33-0x00000000022C0000-0x00000000022DE000-memory.dmp

    Filesize

    120KB

  • memory/5016-0-0x0000000000400000-0x0000000000472000-memory.dmp

    Filesize

    456KB

  • memory/5016-17-0x0000000002E80000-0x0000000002F9D000-memory.dmp

    Filesize

    1.1MB

  • memory/5016-122-0x0000000010000000-0x0000000010033000-memory.dmp

    Filesize

    204KB

  • memory/5016-121-0x0000000000400000-0x0000000000472000-memory.dmp

    Filesize

    456KB

  • memory/5016-8-0x0000000000403000-0x0000000000404000-memory.dmp

    Filesize

    4KB

  • memory/5016-3-0x0000000010000000-0x0000000010033000-memory.dmp

    Filesize

    204KB