Analysis

  • max time kernel
    95s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-09-2024 16:23

General

  • Target

    2024-09-16_18b5196c49a9611141dd28e90986e4b5_floxif_magniber.exe

  • Size

    10.2MB

  • MD5

    18b5196c49a9611141dd28e90986e4b5

  • SHA1

    d0714355ee4eca860a45d08ac33ca1761df828dd

  • SHA256

    4994d99b024a69536c6df49657916c91ff00d64d371a27c52be4bf85f45fb037

  • SHA512

    b82c3f8c22652dbf2c96e2b8b2b5e4744626c7896918cb12f7b55fbac9d5b3b37af54b68ccad6ed00d6f4aa257e5fcde9fe178e09fbf13f796e86bfc4b5c5421

  • SSDEEP

    196608:vdad4T0xcsSB5orrcbSsi0s/lmPJ7N3VvXWrqufezvqT:ladCoXrlAJ7N3pXW2uGzyT

Malware Config

Signatures

  • Floxif, Floodfix

    Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.

  • Detects Floxif payload 1 IoCs
  • Event Triggered Execution: AppInit DLLs 1 TTPs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 19 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 11 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 3 IoCs
  • Drops file in Windows directory 17 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Modifies system certificate store 2 TTPs 8 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-09-16_18b5196c49a9611141dd28e90986e4b5_floxif_magniber.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-09-16_18b5196c49a9611141dd28e90986e4b5_floxif_magniber.exe"
    1⤵
    • Loads dropped DLL
    • Enumerates connected drives
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:1784
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2788
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding F6FB611E02A8AD8B3DEA416805925F50
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3568
      • C:\Users\Admin\AppData\Local\Temp\228EEB46-05FE-4B95-8609-571AFBF985FA\lite_installer.exe
        "C:\Users\Admin\AppData\Local\Temp\228EEB46-05FE-4B95-8609-571AFBF985FA\lite_installer.exe" --use-user-default-locale --silent --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4932
      • C:\Users\Admin\AppData\Local\Temp\2C12974A-6B13-415D-8EAA-2DE47EFAEC96\seederexe.exe
        "C:\Users\Admin\AppData\Local\Temp\2C12974A-6B13-415D-8EAA-2DE47EFAEC96\seederexe.exe" "--yqs=" "--yhp=" "--ilight=" "--oem=" "--nopin=n" "--pin_custom=n" "--pin_desktop=n" "--pin_taskbar=y" "--locale=us" "--browser=" "--browser_default=" "--loglevel=trace" "--ess=" "--clids=C:\Users\Admin\AppData\Local\Temp\clids-yasearch.xml" "--sender=C:\Users\Admin\AppData\Local\Temp\E88A71F6-63CE-4A94-9849-9884D7501626\sender.exe" "--is_elevated=yes" "--ui_level=5" "--good_token=x" "--no_opera=n"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1524
        • C:\Users\Admin\AppData\Local\Temp\E88A71F6-63CE-4A94-9849-9884D7501626\sender.exe
          C:\Users\Admin\AppData\Local\Temp\E88A71F6-63CE-4A94-9849-9884D7501626\sender.exe --send "/status.xml?clid=9183476&uuid=c9a81f5f-af40-44d0-952a-58a0468c1582&vnt=Windows 10x64&file-no=8%0A15%0A25%0A45%0A57%0A59%0A102%0A111%0A125%0A129%0A"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Enumerates connected drives
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:13960

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Config.Msi\e57b23a.rbs

    Filesize

    575B

    MD5

    d925e335f6c4c1c0b980b27400b4ad87

    SHA1

    240a13b3476e66e4db6069e1454495a6d0579901

    SHA256

    8b2a8055b09bdffb0b4ae3fac79ee6998e801d4e3439e4c9f468874c01519e61

    SHA512

    4c16aec19b81dd0466e6c2288922f286a829c49605b5e99caa61f5e12a29a63ba4ca2b97b5ea040e276c67a7de881203329c44d125475a871f627187e73e994e

  • C:\Program Files\Common Files\System\symsrv.dll

    Filesize

    67KB

    MD5

    7574cf2c64f35161ab1292e2f532aabf

    SHA1

    14ba3fa927a06224dfe587014299e834def4644f

    SHA256

    de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085

    SHA512

    4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_394487CAFBCFB8C5917AD7A10924C8A7

    Filesize

    1KB

    MD5

    b992a5a50818501b9f24bc14a8e6c904

    SHA1

    1ee982b9bf8deb20deee3481a055796558345527

    SHA256

    280f8cbaeb4f0b82724fbd1da3a8feb073c0d4c823ed75fcd4ef54653bdfeb56

    SHA512

    354e481ede4f1d9d3fea59bb75240c26e928224f9a49ba3b29152f04ecc96b795b4d06291d50a668ef28301f9a44f04b75afdde072b891fc8547fb65c6f4d58c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E

    Filesize

    1KB

    MD5

    324464c40a6b0790924ef9ba0c63c899

    SHA1

    df35543f35ec695ce32e03ff8f1156638aa7f205

    SHA256

    075d6b6934bf557764a3f37220ea39f503797d2d37546bd08241d7fd374dc30f

    SHA512

    70ca65f18f5ffa1c711fab4b6c45d976bc2c346e97a82693cdbc68443892d890ff6a29f059c7493fdd46df77485da43b6afeed3a0c961f4cc0c29be89030fdfe

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_394487CAFBCFB8C5917AD7A10924C8A7

    Filesize

    536B

    MD5

    65581f97a26f915860f28a2c83d47e60

    SHA1

    b625579cdf3985b5a0da2fba7ee4815695a3a629

    SHA256

    2a2894dfc75e5cb91263528acca29a88dc7388a47ed7b129ab49a05f7f18ee1a

    SHA512

    0132a2ebb710d4455e548d7b888849270dbeef5e1818f21bb8a576e40551c8deac794bf2c173d677c80ca72de7dc25cc35a73ab540b63b9e15bd797a0c878533

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E

    Filesize

    536B

    MD5

    5daf1322d8b825ed65cc2b23aa534ed5

    SHA1

    a826bffe21409239739881a55c0c18e8cb9909c9

    SHA256

    0f3357e00adf3b739e368546992dfd12f7da5035fd7881d73248ae3bb1c79f12

    SHA512

    3f858dedba9eceabdca7c82756c9c2240a495e8bc2be7024e8e9135f5cf5de29e8042fe99b6b0875932f9c41defda7d0d4882d3faa2dcc508068ea1f559183bc

  • C:\Users\Admin\AppData\Local\Temp\228EEB46-05FE-4B95-8609-571AFBF985FA\lite_installer.exe

    Filesize

    419KB

    MD5

    aafdfaa7a989ddb216510fc9ae5b877f

    SHA1

    41cf94692968a7d511b6051b7fe2b15c784770cb

    SHA256

    688d0b782437ccfae2944281ade651a2da063f222e80b3510789dbdce8b00fdc

    SHA512

    6e2b76ff6df79c6de6887cf739848d05c894fbd70dc9371fff95e6ccd9938d695c46516cb18ec8edd01e78cad1a6029a3d633895f7ddba4db4bf9cd39271bd44

  • C:\Users\Admin\AppData\Local\Temp\228EEB46-05FE-4B95-8609-571AFBF985FA\lite_installer.exe.tmp

    Filesize

    495KB

    MD5

    3b876be57c1a35fb00ab3716a32cc744

    SHA1

    0ae960957b895f6eeaa143203fa7581e2dbd67f4

    SHA256

    ab5ca08ef035672b847d2445b80f169d96cac26a01b3096812f0cd34659c0226

    SHA512

    9d2e990215c912079d25acc2f8caf5b0d11beb64d39a34f679bcda3576db00a223f0ec9174ff09b4c63b857ac7cd914c4ed55edb04b03ad8a9502b46094ba2c2

  • C:\Users\Admin\AppData\Local\Temp\2C12974A-6B13-415D-8EAA-2DE47EFAEC96\seederexe.exe

    Filesize

    8.6MB

    MD5

    225ba20fa3edd13c9c72f600ff90e6cb

    SHA1

    5f1a9baa85c2afe29619e7cc848036d9174701e4

    SHA256

    35585d12899435e13e186490fcf1d270adbe3c74a1e0578b3d9314858bf2d797

    SHA512

    97e699cffe28d3c3611570d341ccbc1a0f0eec233c377c70e0e20d4ed3b956b6fe200a007f7e601a5724e733c97eaddc39d308b9af58d45f7598f10038d94ab3

  • C:\Users\Admin\AppData\Local\Temp\A1D26E2\AB055846F8.tmp

    Filesize

    10.1MB

    MD5

    de5cc8b280f3a924e2c3f269fe7618a0

    SHA1

    5df9f0fb3c75ade6fd314becf9263249b1b8876e

    SHA256

    167398f1384b8322e60810eaa3cf147e2884580063cb12e19dab484f63a4bbd6

    SHA512

    782500b6140c9f1c5d269b8a269ff5e0515f762f198a60f5b55eaf39eeeee560c3dbc4035a3c83fff0f5889dba38f7621328dd998f90e83cd8ce47cc52432b26

  • C:\Users\Admin\AppData\Local\Temp\E88A71F6-63CE-4A94-9849-9884D7501626\sender.exe

    Filesize

    260KB

    MD5

    f1a8f60c018647902e70cf3869e1563f

    SHA1

    3caf9c51dfd75206d944d4c536f5f5ff8e225ae9

    SHA256

    36022c6ecb3426791e6edee9074a3861fe5b660d98f2b2b7c13b80fe11a75577

    SHA512

    c02dfd6276ad136283230cdf07d30ec2090562e6c60d6c0d4ac3110013780fcafd76e13931be53b924a35cf473d0f5ace2f6b5c3f1f70ce66b40338e53d38d1e

  • C:\Users\Admin\AppData\Local\Temp\E88A71F6-63CE-4A94-9849-9884D7501626\sender.exe.tmp

    Filesize

    337KB

    MD5

    967a5aabc297800f61cf43cbe773a4ba

    SHA1

    4e8d31949ebbe5cbebc3e5c29f24e0aa74f56e80

    SHA256

    0a3b37de2c5d5dffbfaad6e0dbdd9743147d86e78d882c1e4b720e91a400ebbc

    SHA512

    2c0ea7fcf939b28a33806671ab07f8667d23b323cfbfe61e6ca02965a29652537d9badbe2e033d2896d21dd3f999cb9dc22d477d3dbdeab3cd7b0a5c0969ed3e

  • C:\Users\Admin\AppData\Local\Temp\YandexSearch00000.log

    Filesize

    34KB

    MD5

    218da52d4ee549d308925fffc19154b2

    SHA1

    652e13e72266c5c50d691420388c569b894e7b45

    SHA256

    94bda758e2307197331f18ef0a25fa6c113b4a15ccf6363b418acf7334dfaf98

    SHA512

    cb5af907fa6acc54b78b7422af1d048bfadbeca4d0eada6b96ed8017ccf34e4e3e6b602db3649cf6b69fade7010ab88450a2b0d07db0ad81ff2224351c99b29c

  • C:\Users\Admin\AppData\Local\Temp\clids-yasearch.xml

    Filesize

    531B

    MD5

    f1083a9453af8796ae5b0df6d4e8ce57

    SHA1

    2567b4c551c179614d213514bed8ceb20e4f97e8

    SHA256

    637a4d28261e4819483ca7296cf6b6eb5768e2e82b218a3edca4c007b9941788

    SHA512

    fd5993494290326be52da2105ca176c588f490fd9c4a98514178a1459887064b6bd09f4e4168dd1a35a2e5e5b58b887cfc0e595e4b1a8e2a79bc93c2ea1cd880

  • C:\Users\Admin\AppData\Local\Temp\omnija-20242316.zip

    Filesize

    42.1MB

    MD5

    bf952b53408934f1d48596008f252b8d

    SHA1

    758d76532fdb48c4aaf09a24922333c4e1de0d01

    SHA256

    2183a97932f51d5b247646985b4e667d8be45f18731c418479bbd7743c825686

    SHA512

    a510a96e17090ada1a107e0f6d4819787652ab3d38cd17237f255c736817c7cfcb3fd5cf25f56d5693f4923375b2ab9548e9215070e252aae25c3528b2186d99

  • C:\Users\Admin\AppData\Local\Temp\vendor00000.xml

    Filesize

    510B

    MD5

    c528466ba6d4f66966aa31021aa339dc

    SHA1

    ee953f22f33b25d80cbfe250d64fed4d2da80091

    SHA256

    546e928b7127a4515b089f0b913078404b664a5df33c928a281888c25b03760f

    SHA512

    ebd159dbc6f47b6f70e4f47d9de6bc540c86c915c44df7a4dd50c1c6a431303bb06e22382e8a76e9e2399d24263feca64305a74fa4b50314f8b429b141af601c

  • C:\Users\Admin\AppData\Local\Temp\{5B964E0E-B9A3-4276-9ED9-4D5A5720747A}\YandexSearch.msi

    Filesize

    9.8MB

    MD5

    db69b41b1827ccc598a416e0d32e4a39

    SHA1

    acc35592e318c32d0f4ac768f32f1f8243ba230c

    SHA256

    b5a4c7a05785ac51553953bf951c284ff03a9ac7d1cba15fa391d0b6c7aed5cc

    SHA512

    d40479e0dd384a99fefbc8a43381dde21b2633320393566ecdb2895fa88008794b996d7fac3ddae102c6dd516cdb3c14e3e52ff7371472cc0894c444a4b4d867

  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8luf6ers.Admin\places.sqlite-20240916162345.433797.backup

    Filesize

    68KB

    MD5

    314cb7ffb31e3cc676847e03108378ba

    SHA1

    3667d2ade77624e79d9efa08a2f1d33104ac6343

    SHA256

    b6d278384a3684409a2a86f03e4f52869818ce7dd8b5779876960353f7d35dc1

    SHA512

    dc795fa35ea214843a781ee2b2ef551b91b6841a799bef2c6fb1907d90f6c114071a951ebb7b2b30e81d52b594d447a26ab12ddb57c331e854577d11e5febef5

  • C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Bookmarks-20240916162345.496285.backup

    Filesize

    1KB

    MD5

    3adec702d4472e3252ca8b58af62247c

    SHA1

    35d1d2f90b80dca80ad398f411c93fe8aef07435

    SHA256

    2b167248e8136c4d45c2c46e2bff6fb5e5137dd4dfdccde998599be2df2e9335

    SHA512

    7562e093d16ee6305c1bb143a3f5d60dafe8b5de74952709abc68a0c353b65416bf78b1fa1a6720331615898848c1464a7758c5dfe78f8098f77fbfa924784c0

  • C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Preferences-20240916162345.496285.backup

    Filesize

    313B

    MD5

    af006f1bcc57b11c3478be8babc036a8

    SHA1

    c3bb4fa8c905565ca6a1f218e39fe7494910891e

    SHA256

    ed6a32e11cc99728771989b01f5ae813de80c46a59d3dc68c23a4671a343cb8c

    SHA512

    3d20689b0f39b414349c505be607e6bfc1f33ac401cf62a32f36f7114e4a486552f3e74661e90db29402bb85866944e9f8f31baba9605aa0c6def621511a26af

  • C:\Users\Admin\AppData\Roaming\Yandex\ui

    Filesize

    38B

    MD5

    1eba76562545965a2a2d609f7bcb4c11

    SHA1

    125317584f36a64b57c05643c1f6d051ec25b108

    SHA256

    47a1796be97f1407ac025ed151be7b701946a7ddc765f612ab33c6bc6d494a5a

    SHA512

    44bc7052a52147365f2116cac7c52bf53bead803d51a34a6b74e182f9f9fd5c429c7a9285adf76f03a4425b539f4a7d8a878bc560e1430dbe33c6bd028523bb6

  • C:\Windows\Installer\MSIB47B.tmp

    Filesize

    181KB

    MD5

    0c80a997d37d930e7317d6dac8bb7ae1

    SHA1

    018f13dfa43e103801a69a20b1fab0d609ace8a5

    SHA256

    a5dd2f97c6787c335b7807ff9b6966877e9dd811f9e26326837a7d2bd224de86

    SHA512

    fe1caef6d727344c60df52380a6e4ab90ae1a8eb5f96d6054eced1b7734357ce080d944fa518cf1366e14c4c0bd9a41db679738a860800430034a75bb90e51a5

  • C:\Windows\Installer\MSIB576.tmp

    Filesize

    189KB

    MD5

    e6fd0e66cf3bfd3cc04a05647c3c7c54

    SHA1

    6a1b7f1a45fb578de6492af7e2fede15c866739f

    SHA256

    669cc0aae068ced3154acaecb0c692c4c5e61bc2ca95b40395a3399e75fcb9b2

    SHA512

    fc8613f31acaf6155852d3ad6130fc3b76674b463dcdcfcd08a3b367dfd9e5b991e3f0a26994bcaf42f9e863a46a81e2520e77b1d99f703bcb08800bdca4efcb

  • \??\c:\progra~1\common~1\system\symsrv.dll.000

    Filesize

    175B

    MD5

    1130c911bf5db4b8f7cf9b6f4b457623

    SHA1

    48e734c4bc1a8b5399bff4954e54b268bde9d54c

    SHA256

    eba08cc8182f379392a97f542b350ea0dbbe5e4009472f35af20e3d857eafdf1

    SHA512

    94e2511ef2c53494c2aff0960266491ffc0e54e75185427d1ccedae27c286992c754ca94cbb0c9ea36e3f04cd4eb7f032c551cf2d4b309f292906303f1a75fa0

  • memory/1524-109-0x0000000010000000-0x0000000010030000-memory.dmp

    Filesize

    192KB

  • memory/1524-8754-0x0000000010000000-0x0000000010030000-memory.dmp

    Filesize

    192KB

  • memory/1784-239-0x0000000010000000-0x0000000010030000-memory.dmp

    Filesize

    192KB

  • memory/1784-3-0x0000000010000000-0x0000000010030000-memory.dmp

    Filesize

    192KB

  • memory/1784-40-0x0000000000400000-0x0000000000E25000-memory.dmp

    Filesize

    10.1MB

  • memory/1784-703-0x0000000000400000-0x0000000000E25000-memory.dmp

    Filesize

    10.1MB

  • memory/1784-5-0x000000000041F000-0x0000000000423000-memory.dmp

    Filesize

    16KB

  • memory/3568-235-0x0000000010000000-0x0000000010030000-memory.dmp

    Filesize

    192KB

  • memory/3568-46-0x0000000010000000-0x0000000010030000-memory.dmp

    Filesize

    192KB

  • memory/4932-92-0x0000000010000000-0x0000000010030000-memory.dmp

    Filesize

    192KB

  • memory/4932-8779-0x0000000010000000-0x0000000010030000-memory.dmp

    Filesize

    192KB

  • memory/4932-8777-0x0000000000C80000-0x0000000000CE9000-memory.dmp

    Filesize

    420KB

  • memory/13960-8751-0x0000000010000000-0x0000000010030000-memory.dmp

    Filesize

    192KB

  • memory/13960-8775-0x0000000010000000-0x0000000010030000-memory.dmp

    Filesize

    192KB

  • memory/13960-8773-0x0000000000360000-0x00000000003A2000-memory.dmp

    Filesize

    264KB