floxif | a96e85c838f68ed8508a8d79148ba4f237a5b9e2ed8d7bdd1dba1281fb8c42ba

General

Target

a96e85c838f68ed8508a8d79148ba4f237a5b9e2ed8d7bdd1dba1281fb8c42baN.exe
Size

3.5MB
MD5

f9bda3f2a3152e366a79250881d0f560
SHA1

ebfe05d79f0f24bc4a570e8a612045ffc5f95f9a
SHA256

a96e85c838f68ed8508a8d79148ba4f237a5b9e2ed8d7bdd1dba1281fb8c42ba
SHA512

dab51eae63e47a7760ecddbdb30800ea1b5e4ac096177ebf3000c2274c06556e5abc279a2604393804a43b2173fb82b5ad5bdf386000e4167e54fef9518b0174
SSDEEP

98304:FuZwzjch2Mvj39QKU7vMtyeW04Riio4kbMyunx:hzYhvz9QKU7vLiioLfunx

Score

10^/10

floxif backdoor discovery trojan upx

Malware Config

Signatures

Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
backdoor trojan floxif

Detects Floxif payload 1 IoCs

backdoor

resource	yara_rule
behavioral1/files/0x0008000000012102-1.dat	floxif

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x0008000000012102-1.dat	acprotect

Loads dropped DLL 4 IoCs

pid	Process
2376	a96e85c838f68ed8508a8d79148ba4f237a5b9e2ed8d7bdd1dba1281fb8c42baN.exe
2376	a96e85c838f68ed8508a8d79148ba4f237a5b9e2ed8d7bdd1dba1281fb8c42baN.exe
2376	a96e85c838f68ed8508a8d79148ba4f237a5b9e2ed8d7bdd1dba1281fb8c42baN.exe
2376	a96e85c838f68ed8508a8d79148ba4f237a5b9e2ed8d7bdd1dba1281fb8c42baN.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\e:	a96e85c838f68ed8508a8d79148ba4f237a5b9e2ed8d7bdd1dba1281fb8c42baN.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0008000000012102-1.dat	upx
behavioral1/memory/2376-3-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2376-123-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\symsrv.dll	a96e85c838f68ed8508a8d79148ba4f237a5b9e2ed8d7bdd1dba1281fb8c42baN.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll	a96e85c838f68ed8508a8d79148ba4f237a5b9e2ed8d7bdd1dba1281fb8c42baN.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll.tmp	a96e85c838f68ed8508a8d79148ba4f237a5b9e2ed8d7bdd1dba1281fb8c42baN.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll.tmp	a96e85c838f68ed8508a8d79148ba4f237a5b9e2ed8d7bdd1dba1281fb8c42baN.exe
File created	\??\c:\program files\common files\system\symsrv.dll.000	a96e85c838f68ed8508a8d79148ba4f237a5b9e2ed8d7bdd1dba1281fb8c42baN.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a96e85c838f68ed8508a8d79148ba4f237a5b9e2ed8d7bdd1dba1281fb8c42baN.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2376	a96e85c838f68ed8508a8d79148ba4f237a5b9e2ed8d7bdd1dba1281fb8c42baN.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2376	a96e85c838f68ed8508a8d79148ba4f237a5b9e2ed8d7bdd1dba1281fb8c42baN.exe

C:\Users\Admin\AppData\Local\Temp\a96e85c838f68ed8508a8d79148ba4f237a5b9e2ed8d7bdd1dba1281fb8c42baN.exe
"C:\Users\Admin\AppData\Local\Temp\a96e85c838f68ed8508a8d79148ba4f237a5b9e2ed8d7bdd1dba1281fb8c42baN.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX0\DiskGenius.exe

Filesize
1.7MB

MD5
befddc5b5f9d8880a0572517dc879f68

SHA1
5982b22f7bbdc26bd6f1be7c29af574728a9cb72

SHA256
73306b03527380a9ad62bdea718ac575015c406a39b700de0245d4c36889e1c9

SHA512
4f6a7c169ba3d11d9cc4ef9823b3105ee9db43fbb769a098708ad66a5a7e7941563da3e4fc3b0982879bd15e8494befb494687e675c2407869acf71c813b30b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\dos\CTMOUSE.EXE

Filesize
5KB

MD5
8187bd2c296900d51c103c474776ffb8

SHA1
7334471c7dfb5cd41362281032f5bc608560c051

SHA256
f4cef8579a1699045c37ac0ddf03fe0ca361de5c1003ba375c3e08f01a546d01

SHA512
6b5b64d67d7d8fc08f127d5380633307295de72c19c63513779b9b21d9724014dac2ff7b59062bccf64b2b20bc4a0294db7906d5beff5947aaa284b60e1b2e31

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\dos\diskgen.exe

Filesize
1.2MB

MD5
5d14639798e9e8a88e286a67ca12fb49

SHA1
274916ad50735f9f6ba9a863dde61461681dfbed

SHA256
8dfd1ffc37065ca7d1f455ea2612e1ed92e57d46de186be92dae63b92d0b16b5

SHA512
415e1702c9fbcd942a050a74b2dc8c8b26a7b45b70e152661c1c23dfa2590ea540b606388c88233c3697c3c570223d4660e8a630a1584e9aa62617a668d7bea3

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\dos\himem.exe

Filesize
7KB

MD5
738c9970441873717e954baf4a9a97f9

SHA1
1a16e559a85b6409c90239aab4c4dc9240ca8480

SHA256
7b312ef953f1c6ac3ebf6098d18cb3a26d96e936e5e96a6c30b1837bd431ad6b

SHA512
8729037fdc29392ba26a090c7ae4892965827da29f68c9ba4b7889ce45f5b630ada1b54cb8955d3d0f26e542762f2c31c520158d6528184d0176c8af51644491

Download Submit
\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll.tmp

Filesize
416KB

MD5
ab181f07c5a18941364d1db333990356

SHA1
46a0853b713085ebd126b1a24399fef9d193d055

SHA256
eeaa6d70f073ef6bd848ac3692839be9e8026f7bee6f886b84267a5feb6f7b50

SHA512
510663a081d513be41d41f1070eeab14466f0509a3fa588d2bc43b21ca141f108e73d56167d89ddd060855a38e7f25c7b732e19b7e1f5a9614e0f13e41ec97dd

Download Submit
\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll.tmp

Filesize
416KB

MD5
efdb3b5e94edd687014140f998a6afde

SHA1
4a4d9afff3918c04e22a1aff26ae93e7e8883c78

SHA256
3a9799fab237fbc88e7b3f12c47efc59e0e13d5d8c671b102127cfd468c8175d

SHA512
51c8f7d69d8d9501ed328d379b8443272e70af5053e394be370746b175e8c3ba2db663e78d03a531d9805feaccbdef19fe330a6c786649daa82c14f61c3640fe

Download Submit
\Program Files\Common Files\System\symsrv.dll

Filesize
67KB

MD5
7574cf2c64f35161ab1292e2f532aabf

SHA1
14ba3fa927a06224dfe587014299e834def4644f

SHA256
de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085

SHA512
4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\DiskGenius.exe.tmp

Filesize
1.8MB

MD5
7a664693d08d01e5821ede726648a57b

SHA1
df63b5d516804c30a4514b0fb6f622e3ff6774dc

SHA256
9e8f20c44d9b88f218bd86bbb9bb7ced6098f37f619caae509405b7ca18c6aa6

SHA512
ce8e6cd89d7cd1f75d23eed56f7be98dd7c7624bac50a4ef946ae298666a45e95a340187ef7b5cef96ded48f374b62c19d84f8d65c8cb509c9d08402eb1199c9

Download Submit
memory/2376-3-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2376-5-0x0000000000405000-0x0000000000408000-memory.dmp

Filesize
12KB

Download
memory/2376-123-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download

Analysis

Sharing