floxif | 4686bae5d7fdd4d953ba7eefade8a31ef4b7bd0057273c876ee1c8697bd31a46

Analysis

max time kernel
15s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
18/11/2024, 16:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4686bae5d7fdd4d953ba7eefade8a31ef4b7bd0057273c876ee1c8697bd31a46.exe
Size

558KB
MD5

7fea8688212206c4a28dc21d6b178fba
SHA1

c4b76bb85e92a4300e55608fc746ffd88d71493c
SHA256

4686bae5d7fdd4d953ba7eefade8a31ef4b7bd0057273c876ee1c8697bd31a46
SHA512

a57558df468e0b41e00a1e21ac8f57348f180469ac17c65c2a1b2ce573ee00c5e14f35eeb746229035b08a7d4ca4343e4229e9215dae4ca56ceb85acd696aecc
SSDEEP

12288:KN58fsMMSsMMfBvMcsCMcs/FSaUFRFmALnqzwtG4cR1Mq5JIPMRGM4h/qof1:K/8fsMMSsMMfBvMcsCMcs/fUFRF3htj3

Score

10^/10

floxif backdoor discovery trojan upx

Malware Config

Signatures

Floxif family
floxif
Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
backdoor trojan floxif

Detects Floxif payload 1 IoCs

backdoor

resource	yara_rule
behavioral1/files/0x00080000000120fd-1.dat	floxif

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x00080000000120fd-1.dat	acprotect

Loads dropped DLL 1 IoCs

pid	Process
2532	4686bae5d7fdd4d953ba7eefade8a31ef4b7bd0057273c876ee1c8697bd31a46.exe

Network Service Discovery 1 TTPs 9 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
1504	arp.exe
2712	arp.exe
2804	arp.exe
2776	arp.exe
2192	arp.exe
2088	arp.exe
2748	arp.exe
2368	arp.exe
2716	arp.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00080000000120fd-1.dat	upx
behavioral1/memory/2532-3-0x0000000010000000-0x0000000010033000-memory.dmp	upx
behavioral1/memory/2532-26-0x0000000010000000-0x0000000010033000-memory.dmp	upx

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\symsrv.dll	4686bae5d7fdd4d953ba7eefade8a31ef4b7bd0057273c876ee1c8697bd31a46.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	arp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	arp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	arp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	arp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	arp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4686bae5d7fdd4d953ba7eefade8a31ef4b7bd0057273c876ee1c8697bd31a46.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	arp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	arp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	arp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	arp.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
480	Process not Found

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2532	4686bae5d7fdd4d953ba7eefade8a31ef4b7bd0057273c876ee1c8697bd31a46.exe
Token: SeDebugPrivilege	2532	4686bae5d7fdd4d953ba7eefade8a31ef4b7bd0057273c876ee1c8697bd31a46.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 2776	2532	4686bae5d7fdd4d953ba7eefade8a31ef4b7bd0057273c876ee1c8697bd31a46.exe	29
PID 2532 wrote to memory of 2776	2532	4686bae5d7fdd4d953ba7eefade8a31ef4b7bd0057273c876ee1c8697bd31a46.exe	29
PID 2532 wrote to memory of 2776	2532	4686bae5d7fdd4d953ba7eefade8a31ef4b7bd0057273c876ee1c8697bd31a46.exe	29
PID 2532 wrote to memory of 2776	2532	4686bae5d7fdd4d953ba7eefade8a31ef4b7bd0057273c876ee1c8697bd31a46.exe	29
PID 2532 wrote to memory of 2368	2532	4686bae5d7fdd4d953ba7eefade8a31ef4b7bd0057273c876ee1c8697bd31a46.exe	31
PID 2532 wrote to memory of 2368	2532	4686bae5d7fdd4d953ba7eefade8a31ef4b7bd0057273c876ee1c8697bd31a46.exe	31
PID 2532 wrote to memory of 2368	2532	4686bae5d7fdd4d953ba7eefade8a31ef4b7bd0057273c876ee1c8697bd31a46.exe	31
PID 2532 wrote to memory of 2368	2532	4686bae5d7fdd4d953ba7eefade8a31ef4b7bd0057273c876ee1c8697bd31a46.exe	31
PID 2532 wrote to memory of 2192	2532	4686bae5d7fdd4d953ba7eefade8a31ef4b7bd0057273c876ee1c8697bd31a46.exe	32
PID 2532 wrote to memory of 2192	2532	4686bae5d7fdd4d953ba7eefade8a31ef4b7bd0057273c876ee1c8697bd31a46.exe	32
PID 2532 wrote to memory of 2192	2532	4686bae5d7fdd4d953ba7eefade8a31ef4b7bd0057273c876ee1c8697bd31a46.exe	32
PID 2532 wrote to memory of 2192	2532	4686bae5d7fdd4d953ba7eefade8a31ef4b7bd0057273c876ee1c8697bd31a46.exe	32
PID 2532 wrote to memory of 2716	2532	4686bae5d7fdd4d953ba7eefade8a31ef4b7bd0057273c876ee1c8697bd31a46.exe	33
PID 2532 wrote to memory of 2716	2532	4686bae5d7fdd4d953ba7eefade8a31ef4b7bd0057273c876ee1c8697bd31a46.exe	33
PID 2532 wrote to memory of 2716	2532	4686bae5d7fdd4d953ba7eefade8a31ef4b7bd0057273c876ee1c8697bd31a46.exe	33
PID 2532 wrote to memory of 2716	2532	4686bae5d7fdd4d953ba7eefade8a31ef4b7bd0057273c876ee1c8697bd31a46.exe	33
PID 2532 wrote to memory of 2804	2532	4686bae5d7fdd4d953ba7eefade8a31ef4b7bd0057273c876ee1c8697bd31a46.exe	34
PID 2532 wrote to memory of 2804	2532	4686bae5d7fdd4d953ba7eefade8a31ef4b7bd0057273c876ee1c8697bd31a46.exe	34
PID 2532 wrote to memory of 2804	2532	4686bae5d7fdd4d953ba7eefade8a31ef4b7bd0057273c876ee1c8697bd31a46.exe	34
PID 2532 wrote to memory of 2804	2532	4686bae5d7fdd4d953ba7eefade8a31ef4b7bd0057273c876ee1c8697bd31a46.exe	34
PID 2532 wrote to memory of 2712	2532	4686bae5d7fdd4d953ba7eefade8a31ef4b7bd0057273c876ee1c8697bd31a46.exe	38
PID 2532 wrote to memory of 2712	2532	4686bae5d7fdd4d953ba7eefade8a31ef4b7bd0057273c876ee1c8697bd31a46.exe	38
PID 2532 wrote to memory of 2712	2532	4686bae5d7fdd4d953ba7eefade8a31ef4b7bd0057273c876ee1c8697bd31a46.exe	38
PID 2532 wrote to memory of 2712	2532	4686bae5d7fdd4d953ba7eefade8a31ef4b7bd0057273c876ee1c8697bd31a46.exe	38
PID 2532 wrote to memory of 1504	2532	4686bae5d7fdd4d953ba7eefade8a31ef4b7bd0057273c876ee1c8697bd31a46.exe	39
PID 2532 wrote to memory of 1504	2532	4686bae5d7fdd4d953ba7eefade8a31ef4b7bd0057273c876ee1c8697bd31a46.exe	39
PID 2532 wrote to memory of 1504	2532	4686bae5d7fdd4d953ba7eefade8a31ef4b7bd0057273c876ee1c8697bd31a46.exe	39
PID 2532 wrote to memory of 1504	2532	4686bae5d7fdd4d953ba7eefade8a31ef4b7bd0057273c876ee1c8697bd31a46.exe	39
PID 2532 wrote to memory of 2748	2532	4686bae5d7fdd4d953ba7eefade8a31ef4b7bd0057273c876ee1c8697bd31a46.exe	42
PID 2532 wrote to memory of 2748	2532	4686bae5d7fdd4d953ba7eefade8a31ef4b7bd0057273c876ee1c8697bd31a46.exe	42
PID 2532 wrote to memory of 2748	2532	4686bae5d7fdd4d953ba7eefade8a31ef4b7bd0057273c876ee1c8697bd31a46.exe	42
PID 2532 wrote to memory of 2748	2532	4686bae5d7fdd4d953ba7eefade8a31ef4b7bd0057273c876ee1c8697bd31a46.exe	42
PID 2532 wrote to memory of 2088	2532	4686bae5d7fdd4d953ba7eefade8a31ef4b7bd0057273c876ee1c8697bd31a46.exe	43
PID 2532 wrote to memory of 2088	2532	4686bae5d7fdd4d953ba7eefade8a31ef4b7bd0057273c876ee1c8697bd31a46.exe	43
PID 2532 wrote to memory of 2088	2532	4686bae5d7fdd4d953ba7eefade8a31ef4b7bd0057273c876ee1c8697bd31a46.exe	43
PID 2532 wrote to memory of 2088	2532	4686bae5d7fdd4d953ba7eefade8a31ef4b7bd0057273c876ee1c8697bd31a46.exe	43

C:\Users\Admin\AppData\Local\Temp\4686bae5d7fdd4d953ba7eefade8a31ef4b7bd0057273c876ee1c8697bd31a46.exe
"C:\Users\Admin\AppData\Local\Temp\4686bae5d7fdd4d953ba7eefade8a31ef4b7bd0057273c876ee1c8697bd31a46.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Windows\SysWOW64\arp.exe
  arp -a
  2⤵
  - Network Service Discovery
  - System Location Discovery: System Language Discovery
  PID:2776
- C:\Windows\SysWOW64\arp.exe
  arp -s 10.127.0.1 5b-06-f6-c5-8d-b9
  2⤵
  - Network Service Discovery
  - System Location Discovery: System Language Discovery
  PID:2368
- C:\Windows\SysWOW64\arp.exe
  arp -s 10.127.255.255 ff-bb-f6-11-8f-81
  2⤵
  - Network Service Discovery
  - System Location Discovery: System Language Discovery
  PID:2192
- C:\Windows\SysWOW64\arp.exe
  arp -s 136.243.76.21 c8-11-db-b2-ce-a5
  2⤵
  - Network Service Discovery
  - System Location Discovery: System Language Discovery
  PID:2716
- C:\Windows\SysWOW64\arp.exe
  arp -s 224.0.0.22 96-ff-3f-7c-c7-49
  2⤵
  - Network Service Discovery
  - System Location Discovery: System Language Discovery
  PID:2804
- C:\Windows\SysWOW64\arp.exe
  arp -s 224.0.0.251 3b-dc-b3-21-49-79
  2⤵
  - Network Service Discovery
  - System Location Discovery: System Language Discovery
  PID:2712
- C:\Windows\SysWOW64\arp.exe
  arp -s 224.0.0.252 7b-dc-6f-cb-bf-3f
  2⤵
  - Network Service Discovery
  - System Location Discovery: System Language Discovery
  PID:1504
- C:\Windows\SysWOW64\arp.exe
  arp -s 239.255.255.250 67-ce-e9-69-44-18
  2⤵
  - Network Service Discovery
  - System Location Discovery: System Language Discovery
  PID:2748
- C:\Windows\SysWOW64\arp.exe
  arp -s 255.255.255.255 bb-1e-51-09-ae-75
  2⤵
  - Network Service Discovery
  - System Location Discovery: System Language Discovery
  PID:2088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\mass.dat

Filesize
335B

MD5
e826223ecdd11beb63309ee6af26981a

SHA1
9383c5bb7417af0e6c6f971303fa2f2eaadfced8

SHA256
4e775ebcbfaf554e32aad75c5c47fe1f157eadd95047a2602680185d849cd7f7

SHA512
5b0a99a65fb9652a75ffdfffa92e0fd3ea702242360de5dd0b0bb9feb9dc05129754d2c09ec2f87d54f90a1699237905caeffa2a413a9923b0fcf89e52f4000d

Download Submit
C:\Users\Admin\AppData\Local\Temp\mass.dat

Filesize
620B

MD5
13f8681b5e18a9b93d82197492b65914

SHA1
445282666db6292d7d7423bbeb2209731965a6ee

SHA256
cea35511d19f32ec394badf0397f00a6621f82249ddc78ace16a277072924482

SHA512
6851d273437d98f5fbb7b780066fbf3d34672205a2a320753e596f5c6cb31adfdb34f37c28a1889ea371eaaeb308b5bad031270521ac1ac3265071f07c002ffd

Download Submit
C:\Users\Admin\AppData\Local\Temp\mass.dat

Filesize
912B

MD5
5c008a5ab93b058833b974c8fb178436

SHA1
c9f2d6cb619efa823f0cc2d4befc89f96d00fc7f

SHA256
6e9f693e31d5d936e54b5595020429224cdf79f7533564ad103b72d96bd48f8b

SHA512
7296e09f96dc5a1481afc53c384d8b98fba36bce0f3dc00818f02346d5dcbf54c3af8d658ace4f568b2045fedb32e338d5adcbe681aba98d8d9877b8dd4af04e

Download Submit
\Program Files\Common Files\System\symsrv.dll

Filesize
71KB

MD5
4fcd7574537cebec8e75b4e646996643

SHA1
efa59bb9050fb656b90d5d40c942fb2a304f2a8b

SHA256
8ea3b17e4b783ffc0bc387b81b823bf87af0d57da74541d88ba85314bb232a5d

SHA512
7f1a7ef64d332a735db82506b47d84853af870785066d29ccaf4fdeab114079a9f0db400e01ba574776a0d652a248658fe1e8f9659cdced19ad6eea09644ea3e

Download Submit
memory/2532-3-0x0000000010000000-0x0000000010033000-memory.dmp

Filesize
204KB

Download
memory/2532-5-0x000000000043D000-0x0000000000440000-memory.dmp

Filesize
12KB

Download
memory/2532-26-0x0000000010000000-0x0000000010033000-memory.dmp

Filesize
204KB

Download