Analysis
-
max time kernel
95s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
16-09-2024 12:06
Behavioral task
behavioral1
Sample
Trojan.Win32.Floxif.dll
Resource
win7-20240708-en
5 signatures
120 seconds
General
-
Target
Trojan.Win32.Floxif.dll
-
Size
76KB
-
MD5
1669fe7f8e19af85442ab1fa280b0e60
-
SHA1
7853d3a235300c5a68fe4371df0fdea240ee5f99
-
SHA256
7f3c1182072f26c0dc563d47e167e4737768218ad9a1e44c0ce82005f46d0ed2
-
SHA512
b33a66291156a0706512229b36d52bf7f7d0be58c1c49ba0f6f1bb985713ae388319f49fe94021bf59c165fbe1f091efa699a588b9b5bf08b4ad0ae9e8b4a36e
-
SSDEEP
1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZcfGhoxgdE1:c8y93KQjy7G55riF1cMo03uf+E1
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/2384-0-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral2/memory/2384-1-0x0000000010000000-0x0000000010030000-memory.dmp upx -
Program crash 1 IoCs
pid pid_target Process procid_target 2364 2384 WerFault.exe 82 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2384 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4444 wrote to memory of 2384 4444 rundll32.exe 82 PID 4444 wrote to memory of 2384 4444 rundll32.exe 82 PID 4444 wrote to memory of 2384 4444 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Trojan.Win32.Floxif.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Trojan.Win32.Floxif.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2384 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2384 -s 7003⤵
- Program crash
PID:2364
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2384 -ip 23841⤵PID:1412