Analysis

  • max time kernel
    16s
  • max time network
    17s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/11/2024, 12:12

Errors

Reason
Machine shutdown

General

  • Target

    0f883120e7c89e23ab672fe5a819774ff9a1054563f83e5f8cc16bf9eacd082cN.exe

  • Size

    4.3MB

  • MD5

    ef8964650a9250cfa383c8dff1a5fa90

  • SHA1

    522902d626a37e65810d16bc5e1d2d3b0adffb8d

  • SHA256

    0f883120e7c89e23ab672fe5a819774ff9a1054563f83e5f8cc16bf9eacd082c

  • SHA512

    a15cbf510ca77821d5939e2f8d4f6039304eb517fdf6972dcd2ad91571fb5416dc6afd1243db36ab7e1d466d4818546c74cdf1f4a9fa6e444df784bc6ff6e1ab

  • SSDEEP

    98304:v94tlQ0aeY51XNURYxaA6qjEb9tRuPmBmWBDLTMTtbslyzRt9cuISY6QF:vklhE9U6476itR+mLPw6lyZY6g

Malware Config

Signatures

  • Floxif family
  • Floxif, Floodfix

    Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.

  • Detects Floxif payload 1 IoCs
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 4 IoCs
  • Drops file in Windows directory 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies data under HKEY_USERS 18 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 40 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0f883120e7c89e23ab672fe5a819774ff9a1054563f83e5f8cc16bf9eacd082cN.exe
    "C:\Users\Admin\AppData\Local\Temp\0f883120e7c89e23ab672fe5a819774ff9a1054563f83e5f8cc16bf9eacd082cN.exe"
    1⤵
    • Loads dropped DLL
    • Enumerates connected drives
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:208
    • \??\c:\6ab220b62523e330606df8\install.exe
      c:\6ab220b62523e330606df8\.\install.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:4452
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3504
  • C:\Windows\system32\LogonUI.exe
    "LogonUI.exe" /flags:0x4 /state0:0xa39bb855 /state1:0x41c64e6d
    1⤵
    • Modifies data under HKEY_USERS
    • Suspicious use of SetWindowsHookEx
    PID:3980

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\6ab220b62523e330606df8\install.exe

    Filesize

    547KB

    MD5

    4138c31964fbcb3b7418e086933324c3

    SHA1

    97cc6f58fb064ab6c4a2f02fb665fef77d30532f

    SHA256

    b72056fc3df6f46069294c243fe5006879bf4a9d8eef388369a590ca41745f29

    SHA512

    40cf2f35c3a944fca93d58d66465f0308197f5485381ff07d3065e0f59e94fc3834313068e4e5e5da395413ff2d3d1c3ff6fa050f2256e118972bf21a5643557

  • C:\6ab220b62523e330606df8\install.res.1033.dll.tmp

    Filesize

    162KB

    MD5

    0117b86ae22a53cd03596b4e591d3e90

    SHA1

    aca287513c9c8a0f535e1201a19123e78f98a307

    SHA256

    07fc0ea97cd48c03ce2c8429a43e3a8592d847fe093d58087120667984a01348

    SHA512

    78c3aa0e035308ca7de94749f878b4d6dc39a63d23397a1886d6dca4883fbb52e0693abebff986da0fe6705a4381486da4fa873f6bcf7239e8d917ae56bf8f15

  • C:\Program Files\Common Files\System\symsrv.dll

    Filesize

    67KB

    MD5

    7574cf2c64f35161ab1292e2f532aabf

    SHA1

    14ba3fa927a06224dfe587014299e834def4644f

    SHA256

    de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085

    SHA512

    4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab

  • C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI5158.txt

    Filesize

    1KB

    MD5

    2401203ed7472e91a6331a0763003bdf

    SHA1

    05eff2e849f201c12a119c98dc46a020aaf5ad8d

    SHA256

    0fbbb8f4875c4e723051dd94b5eec0b3665bdaa53b75ae30958767aa3be3f3c9

    SHA512

    8541b42bbd1c08fc6d2181914b35a7a4bbd2b5f4a35af7b9c2172c510228e92bbaeee3ab9803a6f110a813f85a58830d08a04291b69f5ce14866fddff1b0c2de

  • \??\c:\6ab220b62523e330606df8\globdata.ini

    Filesize

    1KB

    MD5

    0a6b586fabd072bd7382b5e24194eac7

    SHA1

    60e3c7215c1a40fbfb3016d52c2de44592f8ca95

    SHA256

    7912e3fcf2698cf4f8625e563cd8215c6668739cae18bd6f27af2d25bec5c951

    SHA512

    b96b0448e9f0e94a7867b6bb103979e9ef2c0e074bcb85988d450d63de6edcf21dc83bb154aafb7de524af3c3734f0bb1ba649db0408612479322e1aa85be9f4

  • \??\c:\6ab220b62523e330606df8\install.ini

    Filesize

    841B

    MD5

    f8f6c0e030cb622f065fe47d61da91d7

    SHA1

    cf6fa99747de8f35c6aea52df234c9c57583baa3

    SHA256

    c16727881c47a40077dc5a1f1ea71cbb28e3f4e156c0ae7074c6d7f5ecece21d

    SHA512

    b70c6d67dac5e6a0dbd17e3bcf570a95914482abad20d0304c02da22231070b4bc887720dbae972bc5066457e1273b68fde0805f1c1791e9466a5ca343485cde

  • \??\c:\6ab220b62523e330606df8\install.res.1033.dll

    Filesize

    85KB

    MD5

    ff6003014eefc9c30abe20e3e1f5fbe8

    SHA1

    4a5bd05f94545f01efc10232385b8fecad300678

    SHA256

    a522c5ea3250cdd538a9ce7b4a06dfd5123e7eb05eef67509f2b975a8e1d3067

    SHA512

    3adc5c705bab7fa7b50517a5eb3301491f5150b56e1088ed436590458e963da204cd1875af75db89742403476a56a94c3f425c05327767bdb4bbee4859667ac2

  • \??\c:\6ab220b62523e330606df8\vc_red.msi

    Filesize

    222KB

    MD5

    7e641e6a0b456271745c20c3bb8a18f9

    SHA1

    ae6cedcb81dc443611a310140ae4671789dbbf3a

    SHA256

    34c5e7d7ea270ee67f92d34843d89603d6d3b6d9ef5247b43ae3c59c909d380d

    SHA512

    f67d6bf69d094edcc93541332f31b326131ff89672edb30fd349def6952ad8bfd07dc2f0ca5967b48a7589eee5b7a14b9a2c1ebe0cba4ae2324f7957090ea903

  • \??\c:\6ab220b62523e330606df8\vcredist.bmp

    Filesize

    5KB

    MD5

    06fba95313f26e300917c6cea4480890

    SHA1

    31beee44776f114078fc403e405eaa5936c4bc3b

    SHA256

    594884a8006e24ad5b1578cd7c75aca21171bb079ebdc4f6518905bcf2237ba1

    SHA512

    7dca0f1ab5d3fd1ac8755142a7ca4d085bb0c2f12a7272e56159dadfa22da79ec8261815be71b9f5e7c32f6e8121ecb2443060f7db76feaf01eb193200e67dfd

  • memory/208-57-0x00000000750D5000-0x00000000750D6000-memory.dmp

    Filesize

    4KB

  • memory/208-66-0x0000000001000000-0x000000000101E000-memory.dmp

    Filesize

    120KB

  • memory/208-7-0x0000000001000000-0x000000000101E000-memory.dmp

    Filesize

    120KB

  • memory/208-1-0x0000000001005000-0x0000000001006000-memory.dmp

    Filesize

    4KB

  • memory/208-58-0x00000000750C0000-0x0000000075123000-memory.dmp

    Filesize

    396KB

  • memory/208-61-0x0000000001005000-0x0000000001006000-memory.dmp

    Filesize

    4KB

  • memory/208-62-0x00000000750C0000-0x0000000075123000-memory.dmp

    Filesize

    396KB

  • memory/208-5-0x0000000010000000-0x0000000010030000-memory.dmp

    Filesize

    192KB

  • memory/208-65-0x0000000010000000-0x0000000010030000-memory.dmp

    Filesize

    192KB

  • memory/208-100-0x0000000001000000-0x000000000101E000-memory.dmp

    Filesize

    120KB

  • memory/208-67-0x0000000010000000-0x0000000010030000-memory.dmp

    Filesize

    192KB

  • memory/208-101-0x00000000750C0000-0x0000000075123000-memory.dmp

    Filesize

    396KB

  • memory/208-99-0x0000000010000000-0x0000000010030000-memory.dmp

    Filesize

    192KB

  • memory/208-70-0x00000000750C0000-0x0000000075123000-memory.dmp

    Filesize

    396KB

  • memory/208-74-0x00000000750D5000-0x00000000750D6000-memory.dmp

    Filesize

    4KB

  • memory/4452-69-0x00000000742C0000-0x00000000742D7000-memory.dmp

    Filesize

    92KB

  • memory/4452-68-0x0000000002880000-0x0000000002881000-memory.dmp

    Filesize

    4KB

  • memory/4452-45-0x0000000002880000-0x0000000002881000-memory.dmp

    Filesize

    4KB