floxif | e634d790bcb9cf00820223a6782a171aceea378ffbdf7896d55664c70e9030b2

General

Target

2024-11-18_4a836e3e0b5335f5f5ff95dbc9c0e725_mafia_ramnit.exe
Size

386KB
MD5

4a836e3e0b5335f5f5ff95dbc9c0e725
SHA1

8da017453494417c54c25cb361e973f0e0302956
SHA256

e634d790bcb9cf00820223a6782a171aceea378ffbdf7896d55664c70e9030b2
SHA512

af16f038c8ff25d7b2b0a8a6fd5cc90350f0d35585b7fe382c617856e110f9b6ed3a0f27993fb6308eeaf60172615e05cd30df34c7e67162eea72bfaee9d472c
SSDEEP

6144:LGiuvY3oDJfaqaWRzAmJ5N3UMf3VYjnrQ6O6agZCPUgidwvRC4Kmn3:LGiuvY3+fv9NAmZ3UMtYQ69ZNPUnfn3

Score

10^/10

floxif backdoor discovery trojan upx

Malware Config

Signatures

Floxif family
floxif
Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
backdoor trojan floxif

Detects Floxif payload 1 IoCs

backdoor

resource	yara_rule
behavioral2/files/0x0007000000023cc2-7.dat	floxif

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x0007000000023cc2-7.dat	acprotect

Executes dropped EXE 1 IoCs

pid	Process
4836	2024-11-18_4a836e3e0b5335f5f5ff95dbc9c0e725_mafia_ramnitmgr.exe

Loads dropped DLL 1 IoCs

pid	Process
4836	2024-11-18_4a836e3e0b5335f5f5ff95dbc9c0e725_mafia_ramnitmgr.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000a000000023c59-3.dat	upx
behavioral2/memory/4836-4-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral2/memory/4836-9-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/files/0x0007000000023cc2-7.dat	upx
behavioral2/memory/4836-13-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral2/memory/4836-14-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\symsrv.dll	2024-11-18_4a836e3e0b5335f5f5ff95dbc9c0e725_mafia_ramnitmgr.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2308	4836	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-11-18_4a836e3e0b5335f5f5ff95dbc9c0e725_mafia_ramnit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msinfo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-11-18_4a836e3e0b5335f5f5ff95dbc9c0e725_mafia_ramnitmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msinfo32.exe

Checks SCSI registry key(s) 3 TTPs 12 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	msinfo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	msinfo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	msinfo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	msinfo32.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\ECFirmwareMajorRelease	msinfo32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\ECFirmwareMajorRelease	msinfo32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4836	2024-11-18_4a836e3e0b5335f5f5ff95dbc9c0e725_mafia_ramnitmgr.exe
4836	2024-11-18_4a836e3e0b5335f5f5ff95dbc9c0e725_mafia_ramnitmgr.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4836	2024-11-18_4a836e3e0b5335f5f5ff95dbc9c0e725_mafia_ramnitmgr.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4428 wrote to memory of 4836	4428	2024-11-18_4a836e3e0b5335f5f5ff95dbc9c0e725_mafia_ramnit.exe	84
PID 4428 wrote to memory of 4836	4428	2024-11-18_4a836e3e0b5335f5f5ff95dbc9c0e725_mafia_ramnit.exe	84
PID 4428 wrote to memory of 4836	4428	2024-11-18_4a836e3e0b5335f5f5ff95dbc9c0e725_mafia_ramnit.exe	84
PID 4428 wrote to memory of 4708	4428	2024-11-18_4a836e3e0b5335f5f5ff95dbc9c0e725_mafia_ramnit.exe	85
PID 4428 wrote to memory of 4708	4428	2024-11-18_4a836e3e0b5335f5f5ff95dbc9c0e725_mafia_ramnit.exe	85
PID 4428 wrote to memory of 4708	4428	2024-11-18_4a836e3e0b5335f5f5ff95dbc9c0e725_mafia_ramnit.exe	85
PID 4428 wrote to memory of 1372	4428	2024-11-18_4a836e3e0b5335f5f5ff95dbc9c0e725_mafia_ramnit.exe	97
PID 4428 wrote to memory of 1372	4428	2024-11-18_4a836e3e0b5335f5f5ff95dbc9c0e725_mafia_ramnit.exe	97
PID 4428 wrote to memory of 1372	4428	2024-11-18_4a836e3e0b5335f5f5ff95dbc9c0e725_mafia_ramnit.exe	97

C:\Users\Admin\AppData\Local\Temp\2024-11-18_4a836e3e0b5335f5f5ff95dbc9c0e725_mafia_ramnit.exe
"C:\Users\Admin\AppData\Local\Temp\2024-11-18_4a836e3e0b5335f5f5ff95dbc9c0e725_mafia_ramnit.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4428
- C:\Users\Admin\AppData\Local\Temp\2024-11-18_4a836e3e0b5335f5f5ff95dbc9c0e725_mafia_ramnitmgr.exe
  C:\Users\Admin\AppData\Local\Temp\2024-11-18_4a836e3e0b5335f5f5ff95dbc9c0e725_mafia_ramnitmgr.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4836
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4836 -s 388
    3⤵
    - Program crash
    PID:2308
- C:\Windows\SysWOW64\msinfo32.exe
  /nfo C:\Users\Admin\AppData\Local\Temp\seagull.nfo
  2⤵
  - System Location Discovery: System Language Discovery
  - Checks SCSI registry key(s)
  - Enumerates system info in registry
  PID:4708
- C:\Windows\SysWOW64\msinfo32.exe
  C:\Users\Admin\AppData\Local\Temp\SysInfo.nfo
  2⤵
  - System Location Discovery: System Language Discovery
  - Checks SCSI registry key(s)
  - Enumerates system info in registry
  PID:1372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4836 -ip 4836
1⤵
PID:4060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\System\symsrv.dll

Filesize
67KB

MD5
7574cf2c64f35161ab1292e2f532aabf

SHA1
14ba3fa927a06224dfe587014299e834def4644f

SHA256
de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085

SHA512
4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\2024-11-18_4a836e3e0b5335f5f5ff95dbc9c0e725_mafia_ramnitmgr.exe

Filesize
177KB

MD5
5c65d0f7ed0cf850e4e9cc219233d133

SHA1
093b25fe1598dbce3c9cb3aaf7da89f9e6fa321c

SHA256
c25c2eaf1dd5165bf46a36d9420d7fe718cb866831b91f22f55561fed08c7f4a

SHA512
2d404c860e037bc7b7e400ff2369de91599f15780d82364f119b356706aa3140499816c00a2bf99ba443206788ab0da527b16c3057372f803c5c112c2eae5d74

Download Submit
C:\Users\Admin\AppData\Local\Temp\SysInfo.nfo

Filesize
38KB

MD5
b44b594179bea6d27e38182f3a410f27

SHA1
eb04c15fce0e4e7242af52862bf6363f763edb3e

SHA256
b50426a8b5de21a96054006241e484cfb34c7f12bb89fc167e2de3e74ae36059

SHA512
3f2c959fbef2c8cda0dd26a286c53304bdb4a6b19424e56708224eb424f4988be1b77b6e5aa7289c42fb43c57d7905a66cb9642ce59dfd89d577d14d8cec681d

Download Submit
C:\Users\Admin\AppData\Local\Temp\seagull.nfo

Filesize
25KB

MD5
f7b96d008b0fa8f482e7157f2f28a081

SHA1
639976a79015ece810a0fde03a2e95f1da4a477e

SHA256
d61f89d13656fca680810a1773ac07bdf3c1adb3dc776c503d80838e124cc752

SHA512
0b7bddc30ed8c150c83899f8360f2ee08cd3a11281574aadbef7ddeb5faf02172fd5dcd9e8ebb4509090016979f808011e317af1fe848d656c51e4fbfa5f6197

Download Submit
memory/4428-0-0x0000000000710000-0x0000000000775000-memory.dmp

Filesize
404KB

Download
memory/4428-19-0x0000000000710000-0x0000000000775000-memory.dmp

Filesize
404KB

Download
memory/4836-4-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4836-9-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/4836-12-0x0000000000500000-0x0000000000501000-memory.dmp

Filesize
4KB

Download
memory/4836-13-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4836-14-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads