Analysis

  • max time kernel
    117s
  • max time network
    117s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    14-09-2024 04:40

General

  • Target

    b1abf4371741cd524184b57a83bd79d0N.exe

  • Size

    1.2MB

  • MD5

    b1abf4371741cd524184b57a83bd79d0

  • SHA1

    b03cf124a8a2449673b1dae23cfe872ac60512f3

  • SHA256

    bd9681b94c7678dc0d26814705ec565b03d73ff301f82267a495161ff36f8e55

  • SHA512

    1a2b1eb53cdf910509cf4f4e392428f3afdef3bfcc69aa44ef5235e91725636ef23ca38ab0fda17ad6a4bfe1573deac8f7bc438d9fe6cadd57691af2287d3f44

  • SSDEEP

    24576:RrG5gX9qqY7tl96R7XRe05OkhCOJDLonUc98hJNDpevFDsz5tJrPkMRGJ/qofN:RZtRY73yXReE4m8nR98PVpeszj01qg

Malware Config

Signatures

  • Floxif, Floodfix

    Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.

  • Detects Floxif payload 1 IoCs
  • Event Triggered Execution: AppInit DLLs 1 TTPs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 24 IoCs
  • UPX packed file 23 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Network Service Discovery 1 TTPs 9 IoCs

    Attempt to gather information on host's network.

  • Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Drops file in System32 directory 34 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
  • Modifies registry class 21 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 44 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b1abf4371741cd524184b57a83bd79d0N.exe
    "C:\Users\Admin\AppData\Local\Temp\b1abf4371741cd524184b57a83bd79d0N.exe"
    1⤵
    • Loads dropped DLL
    • Writes to the Master Boot Record (MBR)
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2116
    • C:\Windows\SysWOW64\arp.exe
      arp -a
      2⤵
      • Loads dropped DLL
      • Network Service Discovery
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:2848
    • C:\Windows\SysWOW64\arp.exe
      arp -s 10.127.0.1 32-94-58-5b-be-e1
      2⤵
      • Loads dropped DLL
      • Network Service Discovery
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:2872
    • C:\Windows\SysWOW64\explorer.exe
      explorer C:\Users\Admin\AppData\Local\Temp\b1abf4371741cd524184b57a83bd79d0N
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:2732
    • C:\Windows\SysWOW64\arp.exe
      arp -s 10.127.255.255 83-93-bf-05-21-97
      2⤵
      • Loads dropped DLL
      • Network Service Discovery
      • System Location Discovery: System Language Discovery
      PID:2772
    • C:\Windows\SysWOW64\arp.exe
      arp -s 49.12.169.207 4a-7c-d1-cd-eb-21
      2⤵
      • Loads dropped DLL
      • Network Service Discovery
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:2604
    • C:\Windows\SysWOW64\arp.exe
      arp -s 224.0.0.22 1a-c7-a0-45-d6-9e
      2⤵
      • Loads dropped DLL
      • Network Service Discovery
      • System Location Discovery: System Language Discovery
      PID:2756
    • C:\Windows\SysWOW64\arp.exe
      arp -s 224.0.0.251 cf-58-61-4d-46-7a
      2⤵
      • Loads dropped DLL
      • Network Service Discovery
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:2764
    • C:\Windows\SysWOW64\arp.exe
      arp -s 224.0.0.252 25-76-ea-16-75-88
      2⤵
      • Loads dropped DLL
      • Network Service Discovery
      • System Location Discovery: System Language Discovery
      PID:2616
    • C:\Windows\SysWOW64\arp.exe
      arp -s 239.255.255.250 45-cc-8e-55-8a-d2
      2⤵
      • Loads dropped DLL
      • Network Service Discovery
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:2684
    • C:\Windows\SysWOW64\arp.exe
      arp -s 255.255.255.255 c5-39-fa-d2-99-70
      2⤵
      • Loads dropped DLL
      • Network Service Discovery
      • System Location Discovery: System Language Discovery
      PID:2580
    • C:\Windows\SysWOW64\9E3B3C\E37CC5.EXE
      C:\Windows\system32\9E3B3C\E37CC5.EXE
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Loads dropped DLL
      • Writes to the Master Boot Record (MBR)
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:2768
  • C:\Windows\explorer.exe
    C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    PID:2000

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\9E3B3C\E37CC5.EXE

    Filesize

    111KB

    MD5

    e2b86e9a37fe4f85bbf0d08af28690a2

    SHA1

    d56b2d2a21cdf5661a17e32be5c71004eb558896

    SHA256

    b05ad065919cee4748075a182d681215c645c7cc3fdf9a06bfd18f7ebb067c91

    SHA512

    6cb065b121f11ee2700b22dd1cf9c9f4d44808261cc9ff2fac36165f42291598b708fa2501264d5c0dfc3df71e7bd6a3d22f9fff70e23d064733e488d49ee082

  • C:\Windows\SysWOW64\9E3B3C\cnvpe.fne

    Filesize

    56KB

    MD5

    fb7ea6f8ae09fa7621ee13f86c4f2935

    SHA1

    d93676c39ad0181dad70a662c41fc4c280cce848

    SHA256

    bdc314d45af6a5afaed2663e63817902e80f9a18ba1965947c314b433e05bfb0

    SHA512

    e15111dda54bcab507c20e910f8257d2dec2830bfbc5f69e5286ce37cabb79237ce8fb1c813b2d82fa7bed0c2df89e2940ceebde358162553290224cf0866749

  • C:\Windows\SysWOW64\9E3B3C\com.run

    Filesize

    260KB

    MD5

    ce2f773275d3fe8b78f4cf067d5e6a0f

    SHA1

    b7135e34d46eb4303147492d5cee5e1ef7b392ab

    SHA256

    eb8099c0ad2d82d9d80530443e2909f3b34be0844d445e844f1c994476c86d2d

    SHA512

    d733dc01c047be56680629a385abdd2aa1598a2b5459269028446da9097b6f6c1e7ade5b74e3ac3809dd8a3f8d1cbbe7fd669f2762be61f9c38fd4a2cca9e063

  • C:\Windows\SysWOW64\9E3B3C\eAPI.fne

    Filesize

    312KB

    MD5

    936745bac5c873ab1a91478d27894626

    SHA1

    9ed92393f95692339ce03a8f1498f80c727e0555

    SHA256

    edfbe514d330e942ecd50dd7331659d59df27668e762d5a00e43df67f5f08630

    SHA512

    32d15337ab7a62ff25802c04bd782f5be36012f1a5251d962226a8e8e2daa7bc0a35b9cbfb67889d3b9dbc5f6cc51f924bae963ae12619249b22f2cc9aa2bbd4

  • \Program Files\Common Files\System\symsrv.dll

    Filesize

    71KB

    MD5

    4fcd7574537cebec8e75b4e646996643

    SHA1

    efa59bb9050fb656b90d5d40c942fb2a304f2a8b

    SHA256

    8ea3b17e4b783ffc0bc387b81b823bf87af0d57da74541d88ba85314bb232a5d

    SHA512

    7f1a7ef64d332a735db82506b47d84853af870785066d29ccaf4fdeab114079a9f0db400e01ba574776a0d652a248658fe1e8f9659cdced19ad6eea09644ea3e

  • \Users\Admin\AppData\Local\Temp\E_N4\dp1.fne

    Filesize

    112KB

    MD5

    6d4b2e73f6f8ecff02f19f7e8ef9a8c7

    SHA1

    09c32ca167136a17fd69df8c525ea5ffeca6c534

    SHA256

    fe5783e64aa70fac10c2e42d460732d9770534357329d8bc78576557c165f040

    SHA512

    2fd7a95cb632e9c4ac6b34e5b6b875aae94e73cd4b1f213e78f46dadab4846227a030776461bca08f9d75a1d61a0d45427f7b0c8b71406b7debc14db04b2ce04

  • \Users\Admin\AppData\Local\Temp\E_N4\krnln.fnr

    Filesize

    1.1MB

    MD5

    cf46bb62a1ba559ceb0fad7a5d642f28

    SHA1

    80b63dd193e84bfacbe535587dd38471b8ea2c24

    SHA256

    fe4bba1a99b332c8bbd196d3a2f3c78d9edc8f212842ff2efef17eba38427f67

    SHA512

    1f71f31fdc1ef7695d7a6e79218a9192804178bb2af80486de4f8ff3d7e176860813a61fa265bf78fe4ff722a85b72798938d715d8a2a034ac759505197a1058

  • \Users\Admin\AppData\Local\Temp\E_N4\shell.fne

    Filesize

    40KB

    MD5

    d54753e7fc3ea03aec0181447969c0e8

    SHA1

    824e7007b6569ae36f174c146ae1b7242f98f734

    SHA256

    192608ff371400c1529aa05f1adba0fe4fdd769fcbf35ee5f8b4f78a838a7ec9

    SHA512

    c25ed4cb38d5d5e95a267979f0f3f9398c04a1bf5822dceb03d6f6d9b4832dfb227f1e6868327e52a0303f45c36b9ba806e75b16bd7419a7c5203c2ecbae838f

  • memory/2000-141-0x0000000003A90000-0x0000000003AA0000-memory.dmp

    Filesize

    64KB

  • memory/2116-56-0x00000000003D0000-0x00000000003EE000-memory.dmp

    Filesize

    120KB

  • memory/2116-134-0x0000000010000000-0x0000000010033000-memory.dmp

    Filesize

    204KB

  • memory/2116-103-0x00000000029B0000-0x00000000029CF000-memory.dmp

    Filesize

    124KB

  • memory/2116-17-0x0000000002DE0000-0x0000000002EFD000-memory.dmp

    Filesize

    1.1MB

  • memory/2116-53-0x0000000000320000-0x0000000000331000-memory.dmp

    Filesize

    68KB

  • memory/2116-1-0x0000000000400000-0x0000000000472000-memory.dmp

    Filesize

    456KB

  • memory/2116-15-0x0000000000403000-0x0000000000404000-memory.dmp

    Filesize

    4KB

  • memory/2116-106-0x0000000010000000-0x0000000010033000-memory.dmp

    Filesize

    204KB

  • memory/2116-82-0x0000000002990000-0x00000000029A4000-memory.dmp

    Filesize

    80KB

  • memory/2116-4-0x0000000010000000-0x0000000010033000-memory.dmp

    Filesize

    204KB

  • memory/2116-102-0x0000000000400000-0x0000000000472000-memory.dmp

    Filesize

    456KB

  • memory/2580-50-0x0000000010000000-0x0000000010033000-memory.dmp

    Filesize

    204KB

  • memory/2580-40-0x0000000010000000-0x0000000010033000-memory.dmp

    Filesize

    204KB

  • memory/2604-32-0x0000000010000000-0x0000000010033000-memory.dmp

    Filesize

    204KB

  • memory/2604-25-0x0000000010000000-0x0000000010033000-memory.dmp

    Filesize

    204KB

  • memory/2616-43-0x0000000010000000-0x0000000010033000-memory.dmp

    Filesize

    204KB

  • memory/2684-41-0x0000000010000000-0x0000000010033000-memory.dmp

    Filesize

    204KB

  • memory/2684-51-0x0000000010000000-0x0000000010033000-memory.dmp

    Filesize

    204KB

  • memory/2732-90-0x0000000010000000-0x0000000010033000-memory.dmp

    Filesize

    204KB

  • memory/2732-24-0x0000000010000000-0x0000000010033000-memory.dmp

    Filesize

    204KB

  • memory/2756-33-0x0000000010000000-0x0000000010033000-memory.dmp

    Filesize

    204KB

  • memory/2756-46-0x0000000010000000-0x0000000010033000-memory.dmp

    Filesize

    204KB

  • memory/2764-42-0x0000000010000000-0x0000000010033000-memory.dmp

    Filesize

    204KB

  • memory/2768-131-0x0000000003280000-0x00000000032DD000-memory.dmp

    Filesize

    372KB

  • memory/2768-140-0x00000000033E0000-0x00000000033F0000-memory.dmp

    Filesize

    64KB

  • memory/2768-116-0x00000000022A0000-0x00000000022B1000-memory.dmp

    Filesize

    68KB

  • memory/2768-105-0x0000000010000000-0x0000000010033000-memory.dmp

    Filesize

    204KB

  • memory/2768-112-0x0000000000380000-0x00000000003CA000-memory.dmp

    Filesize

    296KB

  • memory/2768-104-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/2768-108-0x0000000002020000-0x000000000213D000-memory.dmp

    Filesize

    1.1MB

  • memory/2768-155-0x00000000033E0000-0x00000000033F0000-memory.dmp

    Filesize

    64KB

  • memory/2768-153-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/2768-145-0x0000000010000000-0x0000000010033000-memory.dmp

    Filesize

    204KB

  • memory/2768-119-0x00000000022C0000-0x00000000022DE000-memory.dmp

    Filesize

    120KB

  • memory/2768-142-0x0000000010000000-0x0000000010033000-memory.dmp

    Filesize

    204KB

  • memory/2772-29-0x0000000010000000-0x0000000010033000-memory.dmp

    Filesize

    204KB

  • memory/2848-8-0x0000000010000000-0x0000000010033000-memory.dmp

    Filesize

    204KB

  • memory/2848-21-0x0000000010000000-0x0000000010033000-memory.dmp

    Filesize

    204KB

  • memory/2872-31-0x0000000010000000-0x0000000010033000-memory.dmp

    Filesize

    204KB