Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
14/10/2024, 13:54
General
-
Target
2024-10-14_b47c46c27211628941ac56bce8dabee1_floxif_mafia.exe
-
Size
1.9MB
-
MD5
b47c46c27211628941ac56bce8dabee1
-
SHA1
b752c2a05786ff2726435d5863bf7e9d65b9295c
-
SHA256
ac4a46960b4dcedc35cd767a914733b8ec09d0732a0cbe5bd6249aef5f98ca29
-
SHA512
74def5bad505478a4f889ff9beda5f9855bb7948a513f21a08659b2f49e0bde3519276026d9ca1ca4227447da4908367577330a0e403e0e95a222255dd9a9757
-
SSDEEP
49152:+WBQz60wsU+6Ufr1CJpiTvx5HzIT6LEnFTt/jC6A4tVxM6aO:CO+6UfrspiTrTIT6LEnXa45MO
Malware Config
Signatures
-
Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
-
Detects Floxif payload 1 IoCs
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 3 IoCs
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Program Files directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-14_b47c46c27211628941ac56bce8dabee1_floxif_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-14_b47c46c27211628941ac56bce8dabee1_floxif_mafia.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\jds240626718.tmp\2024-10-14_b47c46c27211628941ac56bce8dabee1_floxif_mafia.exe"C:\Users\Admin\AppData\Local\Temp\jds240626718.tmp\2024-10-14_b47c46c27211628941ac56bce8dabee1_floxif_mafia.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67KB
MD57574cf2c64f35161ab1292e2f532aabf
SHA114ba3fa927a06224dfe587014299e834def4644f
SHA256de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
SHA5124db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
-
Filesize
175B
MD51130c911bf5db4b8f7cf9b6f4b457623
SHA148e734c4bc1a8b5399bff4954e54b268bde9d54c
SHA256eba08cc8182f379392a97f542b350ea0dbbe5e4009472f35af20e3d857eafdf1
SHA51294e2511ef2c53494c2aff0960266491ffc0e54e75185427d1ccedae27c286992c754ca94cbb0c9ea36e3f04cd4eb7f032c551cf2d4b309f292906303f1a75fa0
-
Filesize
1.6MB
MD58cb5a0001c0887ab7b1f99e599fd95e1
SHA1f13670aca28e2f28ef6b7ca7a4f697306bb1b86f
SHA256cc740d5e5fae84fe400242240539ec2f629bcb6d7511ed08251f4a9b7bc917be
SHA512468e090bff7905374fa24689387fc2dc3afc34e76f34498adde34bb38707cbe6cfdf28ef8b869d2068e6aa7a7769ff81a3f0ae9308b7a0aa34467388eb31c256
-
Filesize
1.6MB
MD584630509a1377db637543dcd2c3cdf58
SHA15359687f72d61ff56a974885157e77be521d1bda
SHA256e03e1fab2f1ffdf4f51225f0ed9f432a1356b01f7688520b44b0ab571a76e63e
SHA512e5975120c00bdc11718c6a2faa29f4644e563cba501967d6da5f37d08faef3b3b0798e3b8cb84fa18c3845f9a7821ebe42001923cbc6d2b0a096ce17f45bbc22
-
Filesize
164KB
MD5a0e48f5f60190dc02c61425a8cc8e059
SHA1b01ce93c52708afa17705b2303d86b148e9fb954
SHA2564c9988f26d033cafd4269d174b16e429bff0671df4d2d4aedcb886a02120d628
SHA512680ec11ad630e641e604ad196c4722db3315801e7fed8e9b14fa1bf585723784a098810d693afe179ff4294dd62995814cc4cc846132104dfb63e02471e0f3b2
-
Filesize
1.8MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
192KB
-
Filesize
1.8MB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
1.6MB