Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
02-10-2024 01:18
General
-
Target
a96e85c838f68ed8508a8d79148ba4f237a5b9e2ed8d7bdd1dba1281fb8c42baN.exe
-
Size
3.5MB
-
MD5
f9bda3f2a3152e366a79250881d0f560
-
SHA1
ebfe05d79f0f24bc4a570e8a612045ffc5f95f9a
-
SHA256
a96e85c838f68ed8508a8d79148ba4f237a5b9e2ed8d7bdd1dba1281fb8c42ba
-
SHA512
dab51eae63e47a7760ecddbdb30800ea1b5e4ac096177ebf3000c2274c06556e5abc279a2604393804a43b2173fb82b5ad5bdf386000e4167e54fef9518b0174
-
SSDEEP
98304:FuZwzjch2Mvj39QKU7vMtyeW04Riio4kbMyunx:hzYhvz9QKU7vLiioLfunx
Malware Config
Signatures
-
Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
-
Detects Floxif payload 1 IoCs
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 23 IoCs
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
UPX packed file 8 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Program Files directory 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a96e85c838f68ed8508a8d79148ba4f237a5b9e2ed8d7bdd1dba1281fb8c42baN.exe"C:\Users\Admin\AppData\Local\Temp\a96e85c838f68ed8508a8d79148ba4f237a5b9e2ed8d7bdd1dba1281fb8c42baN.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\DiskGenius.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\DiskGenius.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
589KB
MD5164486e4493e455445274bd1a77d4f0e
SHA1962e8b63467823a8b986f3d2b16ce2984aceb4e3
SHA256a34797bb1008c61ee7b41a4d5faf7c1b02e16a0e774532b586fa6714f1fb7e71
SHA512664797097db733528cc5285ab8f96acaaaf7942c03f3c1775dfc31e253838f3168db8270e523c268a30c15e37ea2cee4cad684c33ea582f833762a5090ed705a
-
Filesize
589KB
MD5f45aa0c1ed1aadb66004d7d413054137
SHA189a1dccf5c1c0e3ec9bb9907e50d7ece0f16ac89
SHA256b08092c35d3f84481ebcd9f3a4b8e8922afe83eb1680e208f9f27aaec420c0d8
SHA512d451a58c6fa68f1ef4ad450e336f968880f3aba459d9ce6ffc63ab30b2cb594e7488ab149dab3e2d0d35586b99ff79ddc2f98d0710aef4ff64ca4ea17be9039d
-
Filesize
67KB
MD57574cf2c64f35161ab1292e2f532aabf
SHA114ba3fa927a06224dfe587014299e834def4644f
SHA256de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
SHA5124db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
-
Filesize
175B
MD51130c911bf5db4b8f7cf9b6f4b457623
SHA148e734c4bc1a8b5399bff4954e54b268bde9d54c
SHA256eba08cc8182f379392a97f542b350ea0dbbe5e4009472f35af20e3d857eafdf1
SHA51294e2511ef2c53494c2aff0960266491ffc0e54e75185427d1ccedae27c286992c754ca94cbb0c9ea36e3f04cd4eb7f032c551cf2d4b309f292906303f1a75fa0
-
Filesize
52KB
MD5c457da58a321250b5ecbc401256e3c1f
SHA19f2b226d0a0b8de4d43ecb855a347132d3f36c79
SHA256c0e92becb7ba07fc4f7f68e7512a9b08cb2ebe07901b23f93ea11d5f81a3a6f0
SHA512d37fb3f040a3b148ba23efa882f63e3963a015b824ce4889bdfe2b8614399042151ded2c675f5b02c9e5e525543f046edef92f029e232a73aff0c43ac1bf39d7
-
Filesize
128KB
MD5367629f30957bfc1cc2f2f003419ac54
SHA1f1e703fe53725f6e64851ce1b89462c2e89f677d
SHA2562596cd5d812b81eff9342c00c0a71339a13209cae9477deef9498a51d142b1fb
SHA512fbffce0e282f308c05aed1f97785ded07a265218d7bae825f981fea5576ed800e2dd33e60b6aec726cb3d964c7ed3a3d0770d6e446ea629ca6043c12ded8efe2
-
Filesize
44KB
MD57ae966c943f2eeba62114b1cee1c9c17
SHA11493284cf0f12e590e01c61bd0b61676fce6de97
SHA2565d12e801ad80edebb5c7458cf1fae7a4736f45ae499b0afbe97d57c74d1cf3ec
SHA512b88ec7832d0087256dcef050f5eef85c8f89e4662f11dc93a9d4fe7f82da688e20d6eb1f0a7a743c5e575cb6759d702805570e85bee4748543b40cb08e2bf2d4
-
Filesize
1.7MB
MD5befddc5b5f9d8880a0572517dc879f68
SHA15982b22f7bbdc26bd6f1be7c29af574728a9cb72
SHA25673306b03527380a9ad62bdea718ac575015c406a39b700de0245d4c36889e1c9
SHA5124f6a7c169ba3d11d9cc4ef9823b3105ee9db43fbb769a098708ad66a5a7e7941563da3e4fc3b0982879bd15e8494befb494687e675c2407869acf71c813b30b4
-
Filesize
1.1MB
MD59f571c895d37786aebe10718c87239fa
SHA1ebe93d867efd0bf63c02914e86f4949bb0fdb717
SHA25690ffecc5b22a15dcac5ce403cdb144a89e67093db7f67c934753a8244b5bdd74
SHA512737d350e9db8d5365da2fe51c2e244e5074f632351a015a538fe427f30c2c3c3379425c2d06c4efa62a28038bde5f8873cb8fc0ddad09be5473097c174364850
-
Filesize
56KB
MD5bf3989c0c12c44b93a24394aa2e88c3b
SHA1b6bbd18b4cb0fe8cf85205f6f5cab4b74d334aa5
SHA25691b7bd7969676113a8215e4d2d5cb91cc40bf41c4967fc3306ec54330d6e1df1
SHA512966fb64d61ec04e13e29e04f4c27e0af516a7345241b6621bc24260fb7cde9b77f99a99e6ca9d2b20fceb97534e8159d585d6356e68a6fe97503365b5d47802d
-
Filesize
88KB
MD5772b9ba75742f00221ee8b3a0b844f3f
SHA1212be64729fb52048912dba9be8e678c87a8810f
SHA2569cfb657a71c6a71c9e8e200c64a449807df9c0082044469240dbb78de5f69389
SHA512bd5572048306cd46c202ab3b3608a85a16b42fb4d8737feef77d3b42cefb936deebddfa07f2be96aab5f5305b54df54fa631006d24256ee28b8425a7d578f405
-
Filesize
96KB
MD58a735f4ad3762e2e0a20028fc261d7d9
SHA190a8033a5d8de3c0f777278ea7eeb090435e7d78
SHA2569673e5487a6bf519f6efab920a524b24f49df3ccde7eebb79480f8a82b60cba1
SHA512f8d0dc6c14703e8b2b03fdb64bcdce6e2e3a0e2e736242645d5a75e20f861c683c6ca283e4c79bc77575690a942531e92b8dbd14fe0e978d951cfbfdcd2e54cd
-
Filesize
68KB
MD55c902ee3026c50e259f3ae959728fb2e
SHA1f36200e489835193fd471d537d91f9be5da1b7ff
SHA256b7bd5d7a6044dc3f7bdc744a002925244f99bd336474ee6511c9f759d0aa6b8d
SHA5120f9012c9097d7e809dd993a430a103a64414b7fc903bddda4cc0c4696977f68ce85ab137f042c442e8623d0fe446c7cc84125cde31105c6f40e0075fc0c29b76
-
Filesize
812KB
MD5fdb0a68b2139e0127a0f2f6cf9eac6ed
SHA15157fcb8a31a1428e5c6e68c393559ef308bbf5a
SHA25629e38b70e03ce30013f052e6ce89b81255841c55547d8d82e320d68084d8f7f2
SHA5125b9b042f401be6a653fa6ad1fd822a370b5234351fc206b3d64cd75493ccc78a4b5d0a904dd4675ea5c5429e60416dccddc5c0f4443ac624c6d128134282f21f
-
Filesize
92KB
MD59da3dd3465443572681245d496442532
SHA1e1598d23776b1b98fe46fca0b98d6c62b28ddda9
SHA256fac17ece8cfba6fec8390e6457bcfadb0dc7316c672e59b5d0227c62ae133263
SHA512606100b4cd6bb8bd58c9de0cc731e8528967088808f68248439767c9b8cdfb04bc1819fea402baadad8c5e859b33efaa822b4ae6bb9268117b7b522a8383b9c4
-
Filesize
1.8MB
-
Filesize
1.2MB
-
Filesize
104KB
-
Filesize
1.2MB
-
Filesize
100KB
-
Filesize
48KB
-
Filesize
56KB
-
Filesize
60KB
-
Filesize
76KB
-
Filesize
184KB
-
Filesize
252KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
12KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
192KB