floxif | e557779ae211b7e68ac1e3b1a2858e6b3720d8cfe7e8faf3cd53df763422d5fc

General

Target

2024-12-11_5632a49f9d368cd4956eece3dfbf9518_floxif_mafia.exe
Size

1.8MB
MD5

5632a49f9d368cd4956eece3dfbf9518
SHA1

bd7111c71e51c16a17bc16353f04a2e8aa4f62cc
SHA256

e557779ae211b7e68ac1e3b1a2858e6b3720d8cfe7e8faf3cd53df763422d5fc
SHA512

3439613688b5dfac86121a8a70f3160e736da6ccb8594e6f32778b665118864228caeb937af285c0b32c41f5909445fef6c2cd3c075a49c90a27716840e10092
SSDEEP

49152:opEYgw15kZV2HXsMnmjEREseBSsxHnfXsrHYihYiVi5:65YuYV

Score

10^/10

floxif backdoor discovery trojan upx

Malware Config

Signatures

Floxif family
floxif
Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
backdoor trojan floxif

Detects Floxif payload 1 IoCs

backdoor

resource	yara_rule
behavioral2/files/0x0009000000023c95-1.dat	floxif

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	2024-12-11_5632a49f9d368cd4956eece3dfbf9518_floxif_mafia64.exe

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x0009000000023c95-1.dat	acprotect

Executes dropped EXE 1 IoCs

pid	Process
1532	2024-12-11_5632a49f9d368cd4956eece3dfbf9518_floxif_mafia64.exe

Loads dropped DLL 1 IoCs

pid	Process
4668	2024-12-11_5632a49f9d368cd4956eece3dfbf9518_floxif_mafia.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\e:	2024-12-11_5632a49f9d368cd4956eece3dfbf9518_floxif_mafia.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0009000000023c95-1.dat	upx
behavioral2/memory/4668-3-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/4668-20-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/4668-24-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/4668-28-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/4668-34-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/4668-39-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\symsrv.dll	2024-12-11_5632a49f9d368cd4956eece3dfbf9518_floxif_mafia.exe
File created	\??\c:\program files\common files\system\symsrv.dll.000	2024-12-11_5632a49f9d368cd4956eece3dfbf9518_floxif_mafia.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-12-11_5632a49f9d368cd4956eece3dfbf9518_floxif_mafia.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
764	Notepad.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1532	2024-12-11_5632a49f9d368cd4956eece3dfbf9518_floxif_mafia64.exe
1532	2024-12-11_5632a49f9d368cd4956eece3dfbf9518_floxif_mafia64.exe
1532	2024-12-11_5632a49f9d368cd4956eece3dfbf9518_floxif_mafia64.exe
1532	2024-12-11_5632a49f9d368cd4956eece3dfbf9518_floxif_mafia64.exe
4668	2024-12-11_5632a49f9d368cd4956eece3dfbf9518_floxif_mafia.exe
4668	2024-12-11_5632a49f9d368cd4956eece3dfbf9518_floxif_mafia.exe
4668	2024-12-11_5632a49f9d368cd4956eece3dfbf9518_floxif_mafia.exe
4668	2024-12-11_5632a49f9d368cd4956eece3dfbf9518_floxif_mafia.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4668	2024-12-11_5632a49f9d368cd4956eece3dfbf9518_floxif_mafia.exe
Token: SeDebugPrivilege	4668	2024-12-11_5632a49f9d368cd4956eece3dfbf9518_floxif_mafia.exe
Token: SeDebugPrivilege	1532	2024-12-11_5632a49f9d368cd4956eece3dfbf9518_floxif_mafia64.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4668 wrote to memory of 1532	4668	2024-12-11_5632a49f9d368cd4956eece3dfbf9518_floxif_mafia.exe	84
PID 4668 wrote to memory of 1532	4668	2024-12-11_5632a49f9d368cd4956eece3dfbf9518_floxif_mafia.exe	84
PID 1532 wrote to memory of 764	1532	2024-12-11_5632a49f9d368cd4956eece3dfbf9518_floxif_mafia64.exe	101
PID 1532 wrote to memory of 764	1532	2024-12-11_5632a49f9d368cd4956eece3dfbf9518_floxif_mafia64.exe	101

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2024-12-11_5632a49f9d368cd4956eece3dfbf9518_floxif_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-12-11_5632a49f9d368cd4956eece3dfbf9518_floxif_mafia.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4668
- C:\Users\Admin\AppData\Local\Temp\2024-12-11_5632a49f9d368cd4956eece3dfbf9518_floxif_mafia64.exe
  C:\Users\Admin\AppData\Local\Temp\2024-12-11_5632a49f9d368cd4956eece3dfbf9518_floxif_mafia.exe
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1532
- - C:\Windows\System32\Notepad.exe
    Notepad.exe C:\Users\Admin\Desktop\Rkill.txt
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\System\symsrv.dll

Filesize
67KB

MD5
7574cf2c64f35161ab1292e2f532aabf

SHA1
14ba3fa927a06224dfe587014299e834def4644f

SHA256
de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085

SHA512
4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab

Download Submit
C:\Program Files\Common Files\System\symsrv.dll.000

Filesize
175B

MD5
1130c911bf5db4b8f7cf9b6f4b457623

SHA1
48e734c4bc1a8b5399bff4954e54b268bde9d54c

SHA256
eba08cc8182f379392a97f542b350ea0dbbe5e4009472f35af20e3d857eafdf1

SHA512
94e2511ef2c53494c2aff0960266491ffc0e54e75185427d1ccedae27c286992c754ca94cbb0c9ea36e3f04cd4eb7f032c551cf2d4b309f292906303f1a75fa0

Download Submit
C:\Users\Admin\AppData\Local\Temp\2024-12-11_5632a49f9d368cd4956eece3dfbf9518_floxif_mafia64.exe

Filesize
954KB

MD5
b89900b5738458eac981f4fb156ae71c

SHA1
d9b5b103472ef35f417f57c91be23be68159880b

SHA256
32e0bcbcf977e09b9e720a318ece222290334c599c03f07b447734399d05b235

SHA512
792ffa236e3d51ee9109d4b4881628320faf77aec79202f64c975617589d9b67609f85edde2b3d8eac5b7ac5db2ff6a1be0bab3fb325e9ea68e9fe495f531cad

Download Submit
C:\Users\Admin\Desktop\Rkill.txt

Filesize
514B

MD5
4748e8bc20393b0eba2ec46550720d40

SHA1
2d2938d66d1365f918464d147ef5fc0c33051c1d

SHA256
ecf35b01f5e6db3d1b766d8cb67d1280c9318ea7285b233f2c5fcf6c2f298826

SHA512
5d0394f15efeeff0c2b60e8870f91789f3e310f354dc45137f89aa77afefe645d22ebdb5ab7f319b52c554f8f37bf4d74f19ce92d5408f341e58a253fe02492c

Download Submit
C:\Users\Admin\Desktop\Rkill.txt

Filesize
3KB

MD5
ef21ff2a7d16e5128269395e3a68b990

SHA1
67e05ce6931264d7ae9535aa17bdf98eae3a4f10

SHA256
867db830ddddfb05d968b0e6c0380036197dea647bc47ccf127db585c1e1d945

SHA512
6404364c84399568dea7cbab4c8685a33eceb72e5e7749865d5f52e8259340290dad6ed7474c8d16742d2510f9ffdb34027c87dcf63b396ef728b932bfdbf437

Download Submit
memory/4668-5-0x0000000000531000-0x0000000000532000-memory.dmp

Filesize
4KB

Download
memory/4668-20-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/4668-21-0x0000000000530000-0x00000000006EC000-memory.dmp

Filesize
1.7MB

Download
memory/4668-24-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/4668-28-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/4668-3-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/4668-34-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/4668-39-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/4668-37-0x0000000000530000-0x00000000006EC000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing