floxif | bf2ec6066fe6f0a38d6d5d1c67a401952d73aee4250dc1af8a604b73c7055753

Analysis

max time kernel
142s
max time network
126s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05-10-2024 14:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bf2ec6066fe6f0a38d6d5d1c67a401952d73aee4250dc1af8a604b73c7055753.exe
Size

10.7MB
MD5

56336f2506c6bcf93b172b9d75f70b12
SHA1

b51437c82322d3a1b4ac8b185ddb3708393e31a8
SHA256

bf2ec6066fe6f0a38d6d5d1c67a401952d73aee4250dc1af8a604b73c7055753
SHA512

de3129fb5fb9dfcb423a38f76c8e8b42c6dac1f6fa55c2a0ed336bec066e68c4c6e2c47af777cd63edbb919cb7f967475bd53b59ead1413ed19a2676913af3cd
SSDEEP

196608:6GgEIGCNGJSn4+rsivKB+o3pUv56toYB5beoCkiTbhaTub8VIH6Op7tq:6GQdNG4is56tjBleoCkIh38VIdZs

Score

10^/10

floxif backdoor discovery trojan upx

Malware Config

Signatures

Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
backdoor trojan floxif

Detects Floxif payload 1 IoCs

backdoor

resource	yara_rule
behavioral1/files/0x00080000000120ff-2.dat	floxif

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x00080000000120ff-2.dat	acprotect

Executes dropped EXE 3 IoCs

pid	Process
3040	sg.tmp
2892	BCompare.exe
1236	Process not Found

Loads dropped DLL 7 IoCs

pid	Process
2236	bf2ec6066fe6f0a38d6d5d1c67a401952d73aee4250dc1af8a604b73c7055753.exe
2236	bf2ec6066fe6f0a38d6d5d1c67a401952d73aee4250dc1af8a604b73c7055753.exe
2236	bf2ec6066fe6f0a38d6d5d1c67a401952d73aee4250dc1af8a604b73c7055753.exe
2892	BCompare.exe
2892	BCompare.exe
2892	BCompare.exe
2892	BCompare.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\e:	bf2ec6066fe6f0a38d6d5d1c67a401952d73aee4250dc1af8a604b73c7055753.exe

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2236-0-0x0000000000400000-0x0000000000591000-memory.dmp	upx
behavioral1/files/0x00080000000120ff-2.dat	upx
behavioral1/memory/2236-4-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2236-65-0x0000000000400000-0x0000000000591000-memory.dmp	upx
behavioral1/memory/2236-68-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2236-67-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2236-73-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2236-78-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2236-83-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2236-88-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2236-94-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2236-97-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\symsrv.dll	bf2ec6066fe6f0a38d6d5d1c67a401952d73aee4250dc1af8a604b73c7055753.exe
File created	\??\c:\program files\common files\system\symsrv.dll.000	bf2ec6066fe6f0a38d6d5d1c67a401952d73aee4250dc1af8a604b73c7055753.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bf2ec6066fe6f0a38d6d5d1c67a401952d73aee4250dc1af8a604b73c7055753.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2236	bf2ec6066fe6f0a38d6d5d1c67a401952d73aee4250dc1af8a604b73c7055753.exe
2892	BCompare.exe
2892	BCompare.exe
2236	bf2ec6066fe6f0a38d6d5d1c67a401952d73aee4250dc1af8a604b73c7055753.exe
2236	bf2ec6066fe6f0a38d6d5d1c67a401952d73aee4250dc1af8a604b73c7055753.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	2236	bf2ec6066fe6f0a38d6d5d1c67a401952d73aee4250dc1af8a604b73c7055753.exe
Token: SeBackupPrivilege	2236	bf2ec6066fe6f0a38d6d5d1c67a401952d73aee4250dc1af8a604b73c7055753.exe
Token: SeRestorePrivilege	2236	bf2ec6066fe6f0a38d6d5d1c67a401952d73aee4250dc1af8a604b73c7055753.exe
Token: 33	2236	bf2ec6066fe6f0a38d6d5d1c67a401952d73aee4250dc1af8a604b73c7055753.exe
Token: SeIncBasePriorityPrivilege	2236	bf2ec6066fe6f0a38d6d5d1c67a401952d73aee4250dc1af8a604b73c7055753.exe
Token: 33	2236	bf2ec6066fe6f0a38d6d5d1c67a401952d73aee4250dc1af8a604b73c7055753.exe
Token: SeIncBasePriorityPrivilege	2236	bf2ec6066fe6f0a38d6d5d1c67a401952d73aee4250dc1af8a604b73c7055753.exe
Token: 33	2236	bf2ec6066fe6f0a38d6d5d1c67a401952d73aee4250dc1af8a604b73c7055753.exe
Token: SeIncBasePriorityPrivilege	2236	bf2ec6066fe6f0a38d6d5d1c67a401952d73aee4250dc1af8a604b73c7055753.exe
Token: SeRestorePrivilege	3040	sg.tmp
Token: 35	3040	sg.tmp
Token: SeSecurityPrivilege	3040	sg.tmp
Token: SeSecurityPrivilege	3040	sg.tmp
Token: 33	2236	bf2ec6066fe6f0a38d6d5d1c67a401952d73aee4250dc1af8a604b73c7055753.exe
Token: SeIncBasePriorityPrivilege	2236	bf2ec6066fe6f0a38d6d5d1c67a401952d73aee4250dc1af8a604b73c7055753.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2892	BCompare.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2892	BCompare.exe
2892	BCompare.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 2240	2236	bf2ec6066fe6f0a38d6d5d1c67a401952d73aee4250dc1af8a604b73c7055753.exe	30
PID 2236 wrote to memory of 2240	2236	bf2ec6066fe6f0a38d6d5d1c67a401952d73aee4250dc1af8a604b73c7055753.exe	30
PID 2236 wrote to memory of 2240	2236	bf2ec6066fe6f0a38d6d5d1c67a401952d73aee4250dc1af8a604b73c7055753.exe	30
PID 2236 wrote to memory of 2240	2236	bf2ec6066fe6f0a38d6d5d1c67a401952d73aee4250dc1af8a604b73c7055753.exe	30
PID 2236 wrote to memory of 3040	2236	bf2ec6066fe6f0a38d6d5d1c67a401952d73aee4250dc1af8a604b73c7055753.exe	32
PID 2236 wrote to memory of 3040	2236	bf2ec6066fe6f0a38d6d5d1c67a401952d73aee4250dc1af8a604b73c7055753.exe	32
PID 2236 wrote to memory of 3040	2236	bf2ec6066fe6f0a38d6d5d1c67a401952d73aee4250dc1af8a604b73c7055753.exe	32
PID 2236 wrote to memory of 3040	2236	bf2ec6066fe6f0a38d6d5d1c67a401952d73aee4250dc1af8a604b73c7055753.exe	32
PID 2236 wrote to memory of 2892	2236	bf2ec6066fe6f0a38d6d5d1c67a401952d73aee4250dc1af8a604b73c7055753.exe	34
PID 2236 wrote to memory of 2892	2236	bf2ec6066fe6f0a38d6d5d1c67a401952d73aee4250dc1af8a604b73c7055753.exe	34
PID 2236 wrote to memory of 2892	2236	bf2ec6066fe6f0a38d6d5d1c67a401952d73aee4250dc1af8a604b73c7055753.exe	34
PID 2236 wrote to memory of 2892	2236	bf2ec6066fe6f0a38d6d5d1c67a401952d73aee4250dc1af8a604b73c7055753.exe	34

C:\Users\Admin\AppData\Local\Temp\bf2ec6066fe6f0a38d6d5d1c67a401952d73aee4250dc1af8a604b73c7055753.exe
"C:\Users\Admin\AppData\Local\Temp\bf2ec6066fe6f0a38d6d5d1c67a401952d73aee4250dc1af8a604b73c7055753.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Windows\system32\cmd.exe
  cmd.exe /c set
  2⤵
  PID:2240
- C:\Users\Admin\AppData\Local\Temp\~368296018540201963~\sg.tmp
  7zG_exe x "C:\Users\Admin\AppData\Local\Temp\bf2ec6066fe6f0a38d6d5d1c67a401952d73aee4250dc1af8a604b73c7055753.exe" -y -aoa -o"C:\Users\Admin\AppData\Local\Temp\~2123921328793078797"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3040
- C:\Users\Admin\AppData\Local\Temp\~2123921328793078797\BCompare.exe
  "C:\Users\Admin\AppData\Local\Temp\~2123921328793078797\BCompare.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:2892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\System\symsrv.dll.000

Filesize
175B

MD5
1130c911bf5db4b8f7cf9b6f4b457623

SHA1
48e734c4bc1a8b5399bff4954e54b268bde9d54c

SHA256
eba08cc8182f379392a97f542b350ea0dbbe5e4009472f35af20e3d857eafdf1

SHA512
94e2511ef2c53494c2aff0960266491ffc0e54e75185427d1ccedae27c286992c754ca94cbb0c9ea36e3f04cd4eb7f032c551cf2d4b309f292906303f1a75fa0

Download Submit
C:\Users\Admin\AppData\Local\Temp\~2123921328793078797\7z.dll

Filesize
1.6MB

MD5
cffc09fd1030a7a2fae01b2890db0ea5

SHA1
85e5236e3d7adf82f0fa49c7bc94493f1886c9df

SHA256
e3feed937081b3e687b9b2e5f8b311e716ba06f52d573f82ba24e65c2deaff42

SHA512
1e99bd4d0ff4d00ddd71acabe2f0026f52a3f90c8af6a0157d47e9e96e97ebb0282acb1315e26a528c9740711604cf302d76717fe14876dcf43c9bf9f8561890

Download Submit
C:\Users\Admin\AppData\Local\Temp\~2123921328793078797\BC4Key.txt

Filesize
550B

MD5
881760b96d1e01fbde3701f34351ec76

SHA1
d1ee291c3b28a68bbe5f0a733667b9a8b3c39bbc

SHA256
5cea4610d402c8e520696102ce6e400d3dc9ffc8e2727d29741141c1b803389b

SHA512
1ff8cab23cabc4d387490a85910d2428ec73a92ae3fcf4964291e99bb6390e048ac0b17f303f723de7955e6249cad59f0a1e7f01cb6d789c99838971aceb5d4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\~2123921328793078797\BCPreferences.xml

Filesize
226B

MD5
db35a0219954a55576190333a7f81b9a

SHA1
e5666092165970beaadc1c23ef7f9636ffb7ed6c

SHA256
95324a6d492efa7f1f34955f483fe9fa6b9ac19fc347cc7284ae24366b753e07

SHA512
a1746ae11ccdc4274d5ec99baa8ed20b9f8943720e706fef8834368fc1394ac08340818e0c90a18a1f5c87cf6be016ddffc883c91c5f21338e90d5f9131619e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\~2123921328793078797\BCState.xml

Filesize
291B

MD5
bc051d6fd57cf2825fa1565e226fe21a

SHA1
fe999cb4c752b67d120b8bc89ea6f4b509493436

SHA256
73b59a31ca40160f75450637373dbbbf80abebfe108b3d5a7f5bbb69d1ca511d

SHA512
b1b86bf20d74df7bceb99a496c9f782e2c65e7ccb93234515cecac823f04b3b6e4015a673ad4bae86bdb862a4e0f6f3f8107bbfff38e55fc358ba21cdb934e2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\~2123921328793078797\BCUnRar.dll

Filesize
314KB

MD5
db55a39d3f2d7d976f4787e81951146a

SHA1
8695e4a9c175be90057f45d57f387939a0853e4d

SHA256
e7e2e4f7c153819bed0505ea8ad00b61b600b6c30488e46b685141b8124cdef6

SHA512
9704a852944465e16c11b391b992bb4dd19e70d7d5b719e6fb464e996efbacdbf9ad0eaa3c062a768e04d3404e9a75bfa043e3befcc525e46cc7eac779bc975d

Download Submit
\Program Files\Common Files\System\symsrv.dll

Filesize
67KB

MD5
7574cf2c64f35161ab1292e2f532aabf

SHA1
14ba3fa927a06224dfe587014299e834def4644f

SHA256
de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085

SHA512
4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab

Download Submit
\Users\Admin\AppData\Local\Temp\~2123921328793078797\BCompare.exe

Filesize
40.0MB

MD5
5f3ac6e8cb53eeed718fac95b911b05e

SHA1
2863981cc8d85f46fec0e018f718f6e0ae3e299d

SHA256
78b7ba482871bfecc9e898d2735dcd198286f6a1a4f18803df1c4800e33b1262

SHA512
6d51b8865660171a36d9f92804dd9f824487798841392179c985e2b52aaba4941aafaa16d06f98c251fcdd7dd31994d0a2aa9c304930e8a715ff22f339dde130

Download Submit
\Users\Admin\AppData\Local\Temp\~2123921328793078797\BCompare.tr

Filesize
434KB

MD5
dfb18f518d0c7abe78476674f33c7d53

SHA1
c35980b3091738a5d1a3e3a24ef1e6948aa1dbca

SHA256
f3d19e37b9d7bd4962b6e63798d74b4d966dfa929e97a12e65bc8a54d5ec7820

SHA512
adcf580245d2b443dde2e4982a53a5137900ef507ccd5b8c964dac73cf8f73e9ee8df92ec6f76fb8e98ccd2661e4731509f2e18a3c3eb7c4028e4b116c83a519

Download Submit
\Users\Admin\AppData\Local\Temp\~368296018540201963~\sg.tmp

Filesize
715KB

MD5
7c4718943bd3f66ebdb47ccca72c7b1e

SHA1
f9edfaa7adb8fa528b2e61b2b251f18da10a6969

SHA256
4cc32d00338fc7b206a7c052297acf9ac304ae7de9d61a2475a116959c1524fc

SHA512
e18c40d646fa4948f90f7471da55489df431f255041ebb6dcef86346f91078c9b27894e27216a4b2fe2a1c5e501c7953c77893cf696930123d28a322d49e1516

Download Submit
memory/2236-83-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2236-0-0x0000000000400000-0x0000000000591000-memory.dmp

Filesize
1.6MB

Download
memory/2236-65-0x0000000000400000-0x0000000000591000-memory.dmp

Filesize
1.6MB

Download
memory/2236-68-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2236-67-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2236-73-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2236-78-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2236-4-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2236-88-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2236-94-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2236-97-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2892-69-0x0000000000400000-0x0000000002C28000-memory.dmp

Filesize
40.2MB

Download
memory/2892-57-0x0000000006410000-0x0000000006411000-memory.dmp

Filesize
4KB

Download