floxif | e634d790bcb9cf00820223a6782a171aceea378ffbdf7896d55664c70e9030b2

General

Target

2024-11-18_4a836e3e0b5335f5f5ff95dbc9c0e725_mafia_ramnit.exe
Size

386KB
MD5

4a836e3e0b5335f5f5ff95dbc9c0e725
SHA1

8da017453494417c54c25cb361e973f0e0302956
SHA256

e634d790bcb9cf00820223a6782a171aceea378ffbdf7896d55664c70e9030b2
SHA512

af16f038c8ff25d7b2b0a8a6fd5cc90350f0d35585b7fe382c617856e110f9b6ed3a0f27993fb6308eeaf60172615e05cd30df34c7e67162eea72bfaee9d472c
SSDEEP

6144:LGiuvY3oDJfaqaWRzAmJ5N3UMf3VYjnrQ6O6agZCPUgidwvRC4Kmn3:LGiuvY3+fv9NAmZ3UMtYQ69ZNPUnfn3

Score

10^/10

floxif backdoor discovery trojan upx

Malware Config

Signatures

Floxif family
floxif
Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
backdoor trojan floxif

Detects Floxif payload 1 IoCs

backdoor

resource	yara_rule
behavioral2/files/0x0008000000023c76-7.dat	floxif

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x0008000000023c76-7.dat	acprotect

Executes dropped EXE 1 IoCs

pid	Process
5112	2024-11-18_4a836e3e0b5335f5f5ff95dbc9c0e725_mafia_ramnitmgr.exe

Loads dropped DLL 1 IoCs

pid	Process
5112	2024-11-18_4a836e3e0b5335f5f5ff95dbc9c0e725_mafia_ramnitmgr.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000c000000023b84-3.dat	upx
behavioral2/memory/5112-4-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral2/memory/5112-10-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/files/0x0008000000023c76-7.dat	upx
behavioral2/memory/5112-16-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/5112-15-0x0000000000400000-0x000000000045B000-memory.dmp	upx

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\symsrv.dll	2024-11-18_4a836e3e0b5335f5f5ff95dbc9c0e725_mafia_ramnitmgr.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4452	5112	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-11-18_4a836e3e0b5335f5f5ff95dbc9c0e725_mafia_ramnit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-11-18_4a836e3e0b5335f5f5ff95dbc9c0e725_mafia_ramnitmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msinfo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msinfo32.exe

Checks SCSI registry key(s) 3 TTPs 12 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	msinfo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	msinfo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	msinfo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	msinfo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	msinfo32.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\ECFirmwareMajorRelease	msinfo32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\ECFirmwareMajorRelease	msinfo32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msinfo32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5112	2024-11-18_4a836e3e0b5335f5f5ff95dbc9c0e725_mafia_ramnitmgr.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 5112	1636	2024-11-18_4a836e3e0b5335f5f5ff95dbc9c0e725_mafia_ramnit.exe	84
PID 1636 wrote to memory of 5112	1636	2024-11-18_4a836e3e0b5335f5f5ff95dbc9c0e725_mafia_ramnit.exe	84
PID 1636 wrote to memory of 5112	1636	2024-11-18_4a836e3e0b5335f5f5ff95dbc9c0e725_mafia_ramnit.exe	84
PID 1636 wrote to memory of 4396	1636	2024-11-18_4a836e3e0b5335f5f5ff95dbc9c0e725_mafia_ramnit.exe	85
PID 1636 wrote to memory of 4396	1636	2024-11-18_4a836e3e0b5335f5f5ff95dbc9c0e725_mafia_ramnit.exe	85
PID 1636 wrote to memory of 4396	1636	2024-11-18_4a836e3e0b5335f5f5ff95dbc9c0e725_mafia_ramnit.exe	85
PID 1636 wrote to memory of 1072	1636	2024-11-18_4a836e3e0b5335f5f5ff95dbc9c0e725_mafia_ramnit.exe	98
PID 1636 wrote to memory of 1072	1636	2024-11-18_4a836e3e0b5335f5f5ff95dbc9c0e725_mafia_ramnit.exe	98
PID 1636 wrote to memory of 1072	1636	2024-11-18_4a836e3e0b5335f5f5ff95dbc9c0e725_mafia_ramnit.exe	98

C:\Users\Admin\AppData\Local\Temp\2024-11-18_4a836e3e0b5335f5f5ff95dbc9c0e725_mafia_ramnit.exe
"C:\Users\Admin\AppData\Local\Temp\2024-11-18_4a836e3e0b5335f5f5ff95dbc9c0e725_mafia_ramnit.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Users\Admin\AppData\Local\Temp\2024-11-18_4a836e3e0b5335f5f5ff95dbc9c0e725_mafia_ramnitmgr.exe
  C:\Users\Admin\AppData\Local\Temp\2024-11-18_4a836e3e0b5335f5f5ff95dbc9c0e725_mafia_ramnitmgr.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:5112
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5112 -s 384
    3⤵
    - Program crash
    PID:4452
- C:\Windows\SysWOW64\msinfo32.exe
  /nfo C:\Users\Admin\AppData\Local\Temp\seagull.nfo
  2⤵
  - System Location Discovery: System Language Discovery
  - Checks SCSI registry key(s)
  - Enumerates system info in registry
  PID:4396
- C:\Windows\SysWOW64\msinfo32.exe
  C:\Users\Admin\AppData\Local\Temp\SysInfo.nfo
  2⤵
  - System Location Discovery: System Language Discovery
  - Checks SCSI registry key(s)
  - Enumerates system info in registry
  PID:1072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 5112 -ip 5112
1⤵
PID:4200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\System\symsrv.dll

Filesize
67KB

MD5
7574cf2c64f35161ab1292e2f532aabf

SHA1
14ba3fa927a06224dfe587014299e834def4644f

SHA256
de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085

SHA512
4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\2024-11-18_4a836e3e0b5335f5f5ff95dbc9c0e725_mafia_ramnitmgr.exe

Filesize
177KB

MD5
5c65d0f7ed0cf850e4e9cc219233d133

SHA1
093b25fe1598dbce3c9cb3aaf7da89f9e6fa321c

SHA256
c25c2eaf1dd5165bf46a36d9420d7fe718cb866831b91f22f55561fed08c7f4a

SHA512
2d404c860e037bc7b7e400ff2369de91599f15780d82364f119b356706aa3140499816c00a2bf99ba443206788ab0da527b16c3057372f803c5c112c2eae5d74

Download Submit
C:\Users\Admin\AppData\Local\Temp\SysInfo.nfo

Filesize
176KB

MD5
398496a470265f8ae6de77ab47784f66

SHA1
c43e9a5926d5e741dde2183ab5ff827832d64ee9

SHA256
bd7539e93941665f2a26d644c73a40bcc68ff81970eb5013f6ecb9113eabd5b3

SHA512
3e18519731df39069171ee9a16b18b9c883027f9d69ef802817a4c18d60f89abccdaf83d46de77bee43e92ae9cb2c09408475fe8d96b15a69a8b2169dd9def28

Download Submit
C:\Users\Admin\AppData\Local\Temp\seagull.nfo

Filesize
163KB

MD5
345e09d330a9469f60e854b9db745093

SHA1
909bbe8b09061674e2e345374571afbed477741e

SHA256
ebb6f4b38cc4ba96b70b639ad3b521402e0eec36a76c29789688a4f1c34544d1

SHA512
c03ff4cf567baf776697c6170c315b6d753341008f9a6e715132f5255ef913b28b3390abb3982f55a53094af2ee88d2917b8996e7086c718ff214027e006d913

Download Submit
memory/1636-0-0x0000000000B90000-0x0000000000BF5000-memory.dmp

Filesize
404KB

Download
memory/1636-21-0x0000000000B90000-0x0000000000BF5000-memory.dmp

Filesize
404KB

Download
memory/5112-4-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/5112-10-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/5112-12-0x0000000000640000-0x0000000000641000-memory.dmp

Filesize
4KB

Download
memory/5112-16-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/5112-15-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads