Analysis
-
max time kernel
148s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
10-12-2024 21:10
General
-
Target
3490d1efa36967fdbd4afac32cfadd8fe121624ce340edf3e49026c1c12cc43b.exe
-
Size
3.7MB
-
MD5
c956725417c0dc16f327cfffd74c8bab
-
SHA1
76d251e85a0643f6f9914c5a478e0ad1d6f829ed
-
SHA256
3490d1efa36967fdbd4afac32cfadd8fe121624ce340edf3e49026c1c12cc43b
-
SHA512
60c61e23bffe531098b51fb13120e74e69768db1c6aafcaf5cac9e835c3ba2e886127d073aae41c1ef211346de037b8015589917a21e32922e298df02329ca87
-
SSDEEP
98304:IvwcjndswXpa/+AMVSN9Ai96qmN8jDEEfTxZ65WtTrpmepO:ID5tdVAKqg83pZnrcepO
Malware Config
Signatures
-
Floxif family
-
Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
-
Detects Floxif payload 1 IoCs
-
Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
-
Loads dropped DLL 6 IoCs
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
UPX packed file 9 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Program Files directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3490d1efa36967fdbd4afac32cfadd8fe121624ce340edf3e49026c1c12cc43b.exe"C:\Users\Admin\AppData\Local\Temp\3490d1efa36967fdbd4afac32cfadd8fe121624ce340edf3e49026c1c12cc43b.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
175B
MD51130c911bf5db4b8f7cf9b6f4b457623
SHA148e734c4bc1a8b5399bff4954e54b268bde9d54c
SHA256eba08cc8182f379392a97f542b350ea0dbbe5e4009472f35af20e3d857eafdf1
SHA51294e2511ef2c53494c2aff0960266491ffc0e54e75185427d1ccedae27c286992c754ca94cbb0c9ea36e3f04cd4eb7f032c551cf2d4b309f292906303f1a75fa0
-
Filesize
1KB
MD5c6e0adffbf4a43d27c6c9e3eaaf877f9
SHA187132e08e141df3efd1cabe97114bb3318c4279f
SHA256210f2017c649d088ef5c048a7c9f284cb0320b58d00a0dc4bcd68487bca4bc81
SHA512af3387dc72e015c97b2e1f78c53f8e6eaec28212c4f06083cdd78c5b2d0ccc611e05a591afa9d0be18d0edf2e5e0111fabfac4e9c1528605efc7bd68c4f8021a
-
Filesize
67KB
MD57574cf2c64f35161ab1292e2f532aabf
SHA114ba3fa927a06224dfe587014299e834def4644f
SHA256de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
SHA5124db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
-
Filesize
15KB
MD505bf02da51e717f79f6b5cbea7bc0710
SHA107471a64ef4dba9dc19ce68ae6cce683af7df86d
SHA256ca092ba7f275b0c9000098cdd1a9876fe8dc050fcb40a0e8a1ab8335236e9dc5
SHA512c09e475babd5eb675cdf903b2b754b8b68450a731cb520f3dcbf9abe0ed03d19256f009429977d3a51decb3a2a938be0b28dbafeb407409fa85e54da6dbaaad6
-
Filesize
5KB
MD5ab1db56369412fe8476fefffd11e4cc0
SHA1daad036a83b2ee2fa86d840a34a341100552e723
SHA2566f14c8f01f50a30743dac68c5ac813451463dfb427eb4e35fcdfe2410e1a913b
SHA5128d886643b4fc24adf78f76b663227d6e61863f89e0cbd49548f40dd040666ca94ea46bec9e336850e4f300995d56e6dc85b689c8e09ff46758822d280f06b03d
-
Filesize
12KB
MD50d7ad4f45dc6f5aa87f606d0331c6901
SHA148df0911f0484cbe2a8cdd5362140b63c41ee457
SHA2563eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
SHA512c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
-
Filesize
9KB
MD5466179e1c8ee8a1ff5e4427dbb6c4a01
SHA1eb607467009074278e4bd50c7eab400e95ae48f7
SHA2561e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172
SHA5127508a29c722d45297bfb090c8eb49bd1560ef7d4b35413f16a8aed62d3b1030a93d001a09de98c2b9fea9acf062dc99a7278786f4ece222e7436b261d14ca817
-
Filesize
432KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
192KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
4KB
-
Filesize
192KB
-
Filesize
432KB
-
Filesize
192KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
4KB
-
Filesize
192KB
-
Filesize
432KB
-
Filesize
192KB
-
Filesize
432KB