floxif | 4bde9da1797d010b32313fec6aebd5bef6f8e9c9f01745ab1569880de1db262f

Analysis

max time kernel
94s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19/11/2024, 02:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4bde9da1797d010b32313fec6aebd5bef6f8e9c9f01745ab1569880de1db262fN.exe
Size

3.7MB
MD5

fdee1f6b44abb7bc3a808046d964ba20
SHA1

c6675ff9ba2a2f4167ab6bc8420619640346d117
SHA256

4bde9da1797d010b32313fec6aebd5bef6f8e9c9f01745ab1569880de1db262f
SHA512

bed289fc0a6a4501cfdbef1167b67c48deeb6cd1783687bde221c612f095b565ab61a0000c19ffce4047ca3aa9aff445327555779fe59f4dab6b626bcf3fbf81
SSDEEP

98304:IWMpvfckkBJM/tBFENRK+pvpIpW1afQtU1/j:IWMpvfpq2BELKmvYx

Score

10^/10

floxif backdoor discovery persistence trojan upx

Malware Config

Signatures

Floxif family
floxif
Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
backdoor trojan floxif

Detects Floxif payload 1 IoCs

backdoor

resource	yara_rule
behavioral2/files/0x000c000000023b94-1.dat	floxif

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000c000000023b94-1.dat	acprotect

Executes dropped EXE 1 IoCs

pid	Process
2792	install.exe

Loads dropped DLL 3 IoCs

pid	Process
5088	4bde9da1797d010b32313fec6aebd5bef6f8e9c9f01745ab1569880de1db262fN.exe
2792	install.exe
2792	install.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	4bde9da1797d010b32313fec6aebd5bef6f8e9c9f01745ab1569880de1db262fN.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	install.exe
File opened (read-only)	\??\S:	install.exe
File opened (read-only)	\??\T:	install.exe
File opened (read-only)	\??\B:	install.exe
File opened (read-only)	\??\G:	install.exe
File opened (read-only)	\??\I:	install.exe
File opened (read-only)	\??\K:	install.exe
File opened (read-only)	\??\Q:	install.exe
File opened (read-only)	\??\R:	install.exe
File opened (read-only)	\??\W:	install.exe
File opened (read-only)	\??\E:	install.exe
File opened (read-only)	\??\H:	install.exe
File opened (read-only)	\??\V:	install.exe
File opened (read-only)	\??\X:	install.exe
File opened (read-only)	\??\Z:	install.exe
File opened (read-only)	\??\L:	install.exe
File opened (read-only)	\??\P:	install.exe
File opened (read-only)	\??\J:	install.exe
File opened (read-only)	\??\N:	install.exe
File opened (read-only)	\??\O:	install.exe
File opened (read-only)	\??\U:	install.exe
File opened (read-only)	\??\Y:	install.exe
File opened (read-only)	\??\e:	4bde9da1797d010b32313fec6aebd5bef6f8e9c9f01745ab1569880de1db262fN.exe
File opened (read-only)	\??\A:	install.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000c000000023b94-1.dat	upx
behavioral2/memory/5088-4-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/5088-106-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/5088-173-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\symsrv.dll	4bde9da1797d010b32313fec6aebd5bef6f8e9c9f01745ab1569880de1db262fN.exe
File created	\??\c:\program files\common files\system\symsrv.dll.000	4bde9da1797d010b32313fec6aebd5bef6f8e9c9f01745ab1569880de1db262fN.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4bde9da1797d010b32313fec6aebd5bef6f8e9c9f01745ab1569880de1db262fN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	install.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5088	4bde9da1797d010b32313fec6aebd5bef6f8e9c9f01745ab1569880de1db262fN.exe
5088	4bde9da1797d010b32313fec6aebd5bef6f8e9c9f01745ab1569880de1db262fN.exe

Suspicious use of AdjustPrivilegeToken 31 IoCs

description	pid	Process
Token: SeDebugPrivilege	5088	4bde9da1797d010b32313fec6aebd5bef6f8e9c9f01745ab1569880de1db262fN.exe
Token: SeSecurityPrivilege	4792	msiexec.exe
Token: SeCreateTokenPrivilege	2792	install.exe
Token: SeAssignPrimaryTokenPrivilege	2792	install.exe
Token: SeLockMemoryPrivilege	2792	install.exe
Token: SeIncreaseQuotaPrivilege	2792	install.exe
Token: SeMachineAccountPrivilege	2792	install.exe
Token: SeTcbPrivilege	2792	install.exe
Token: SeSecurityPrivilege	2792	install.exe
Token: SeTakeOwnershipPrivilege	2792	install.exe
Token: SeLoadDriverPrivilege	2792	install.exe
Token: SeSystemProfilePrivilege	2792	install.exe
Token: SeSystemtimePrivilege	2792	install.exe
Token: SeProfSingleProcessPrivilege	2792	install.exe
Token: SeIncBasePriorityPrivilege	2792	install.exe
Token: SeCreatePagefilePrivilege	2792	install.exe
Token: SeCreatePermanentPrivilege	2792	install.exe
Token: SeBackupPrivilege	2792	install.exe
Token: SeRestorePrivilege	2792	install.exe
Token: SeShutdownPrivilege	2792	install.exe
Token: SeDebugPrivilege	2792	install.exe
Token: SeAuditPrivilege	2792	install.exe
Token: SeSystemEnvironmentPrivilege	2792	install.exe
Token: SeChangeNotifyPrivilege	2792	install.exe
Token: SeRemoteShutdownPrivilege	2792	install.exe
Token: SeUndockPrivilege	2792	install.exe
Token: SeSyncAgentPrivilege	2792	install.exe
Token: SeEnableDelegationPrivilege	2792	install.exe
Token: SeManageVolumePrivilege	2792	install.exe
Token: SeImpersonatePrivilege	2792	install.exe
Token: SeCreateGlobalPrivilege	2792	install.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5088 wrote to memory of 2792	5088	4bde9da1797d010b32313fec6aebd5bef6f8e9c9f01745ab1569880de1db262fN.exe	85
PID 5088 wrote to memory of 2792	5088	4bde9da1797d010b32313fec6aebd5bef6f8e9c9f01745ab1569880de1db262fN.exe	85
PID 5088 wrote to memory of 2792	5088	4bde9da1797d010b32313fec6aebd5bef6f8e9c9f01745ab1569880de1db262fN.exe	85

C:\Users\Admin\AppData\Local\Temp\4bde9da1797d010b32313fec6aebd5bef6f8e9c9f01745ab1569880de1db262fN.exe
"C:\Users\Admin\AppData\Local\Temp\4bde9da1797d010b32313fec6aebd5bef6f8e9c9f01745ab1569880de1db262fN.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5088
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\install.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\install.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2792

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\System\symsrv.dll

Filesize
67KB

MD5
7574cf2c64f35161ab1292e2f532aabf

SHA1
14ba3fa927a06224dfe587014299e834def4644f

SHA256
de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085

SHA512
4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\eula.1033.txt

Filesize
14KB

MD5
0bf757a9b434139aeeb7efe413b0e60e

SHA1
fb70177080ff59dd1946107b632cd848d1761130

SHA256
cae6d6b3ce31613a6578471552933f4b8b7cef223f7c2b98efcb4bee97b34cfa

SHA512
17830dd34b1a4425492c3a93d4e2b852cfc5b6ad5b51692201471b7e3bc9e3e945a77364f93fc0b6abb5767fa2884b3461e08cb05d5cd23ae6ed300ea1d4d11d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\eula.1049.txt

Filesize
35KB

MD5
bd5fb8f82f3956acec70d6f2651e8b6e

SHA1
d6643bd816ff7352726b0f8b7ef607265c8679df

SHA256
7c66b9a4448c494fd2f73b72d053f4636494906b170671675edbc8f474339b85

SHA512
389678047556c93b6a83816e44651c63f15f91a741e4a0de91bf4a7e9e1d8731f8f75cdd68c408d97d0f9476c91ea928654637a98bd1a6cc08d184b93002c163

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\globdata.ini

Filesize
1KB

MD5
92a9351b7484149869a777d840b3d828

SHA1
76272f9700ddaae97dd2001cc17566d1464e5366

SHA256
c23095bfba5d9a895b484f4923c134335c03345cd24709cc7d269ca45e51f2a0

SHA512
654945e2a4e2a107c94274fe7811ebb23f2389c8c248cd980ff446f60d686768a2e2c876609bb23130072102547df5c75d039809e6149d5c99409d1d19d0d1bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\install.exe

Filesize
595KB

MD5
ff977f9cde2cdb16fa62a7d4d250f8cb

SHA1
9461780db5e5317f4c1bb30d72d4bfd823bea075

SHA256
d446c9471ece9af75f91c984fc09050e1d0fd4f76c00fde087a63da717ef18d7

SHA512
9fa9681d5bdc201dc6e86c66cd5f23896b842f300c4f48e66850903496e19b43268597c1090fb477fb795bc999c6816d70ab3f100b43b4a049026ddf7ddb7cdf

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\install.ini

Filesize
4KB

MD5
d04d2351f1d4428584f14799117878cd

SHA1
0ce431f96a13305884739567d49792bf9a5ab4f4

SHA256
914b8dc9cc5fc6782cbac33d2825df9a749fb9ae1ec7fd6f14989c3b3f9d22fb

SHA512
8d2f2a09e724f027a877d19025f1ab4449c2b41496c573881d321de68c59986b32f6a2911c1be1531d0a3fef31598ef436d25dff4a9f6ed15230f7e70f133def

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\install.res.1033.dll

Filesize
79KB

MD5
106aae09947bac0b6ee222a4406a39e1

SHA1
c0d69473c175b30bf49634b3af1cfafe48a088fd

SHA256
8cf095078bcac57a880b19d6211d075e081fefd4de679c3433a17ed8a29aef3b

SHA512
aa37be1745aca1e94a3c738d46f80b236c68053f3ae4b73f210075ce059840b81cfc8e1265f67d93762f0d8270cf2fdc3bcf7ab2ffb782fb29a1e761c2f26ec0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jsredist.msi

Filesize
1.8MB

MD5
45a450fa2307ab868e50953f5ab96ae1

SHA1
576b99bb7c5afe283fdfdfd1f0a0001a055c8098

SHA256
0917a777c6bfedf5c61a467ba82cfc0adfe43748909762965f9fb9a3d25a8c76

SHA512
6fb20ef3a31830ce9f30b0adc90ac530cabe5fe95a3e551306d9594b982ccc4dc38becdb99a928128d6736998406110f209ccbadc3c7ffb1bc0e8381d80328a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vjredist.bmp

Filesize
5KB

MD5
06fba95313f26e300917c6cea4480890

SHA1
31beee44776f114078fc403e405eaa5936c4bc3b

SHA256
594884a8006e24ad5b1578cd7c75aca21171bb079ebdc4f6518905bcf2237ba1

SHA512
7dca0f1ab5d3fd1ac8755142a7ca4d085bb0c2f12a7272e56159dadfa22da79ec8261815be71b9f5e7c32f6e8121ecb2443060f7db76feaf01eb193200e67dfd

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vjscustom.1033.dll

Filesize
41KB

MD5
b4fac2c09096b4875e2617a1efd2a918

SHA1
09d03358a3c15ca85bd58fdb915a2ae3bb8e723d

SHA256
c6d87e314fa5246941891889afbb0fbd9976978e993f367e61daab42018a7f57

SHA512
727deedc706fc252cffd3784d7f9b02e3f4a5b80b98bfad85450307ee517776ac1468f14f7bcad9d35543e3e30f26bf0d252471afba34cc1e88970dfd3ad0400

Download Submit
memory/2792-98-0x00000000023A0000-0x00000000023A1000-memory.dmp

Filesize
4KB

Download
memory/5088-6-0x0000000001006000-0x0000000001007000-memory.dmp

Filesize
4KB

Download
memory/5088-105-0x0000000075085000-0x0000000075086000-memory.dmp

Filesize
4KB

Download
memory/5088-106-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/5088-4-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/5088-173-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download