floxif | 721a997269bf8691bb46b40baa9d920f09ddb74e61f8da2f5d15270253145403

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2024 06:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

721a997269bf8691bb46b40baa9d920f09ddb74e61f8da2f5d15270253145403N.exe
Size

386KB
MD5

d673e2ef1609f1e6c5e7e2d186e336c0
SHA1

7844f94ea2f1d99319b32f67d0d4619e0e64225f
SHA256

721a997269bf8691bb46b40baa9d920f09ddb74e61f8da2f5d15270253145403
SHA512

a3d9f5046a8438d1168f8fff22adb0b86ebae2ec53d1ce0a3c774b8a06e787396332afd25a1394340b199c11599670c56ef11ff68df3ab8d9ed42d17ebda98d5
SSDEEP

12288:gTKWWpP8afBmqx/uDmf8mDiy7/5/QWPCY+NBjvrEH7Jt:gTx+PLf4mGvOl7/V4Y+DrEH7Jt

Score

10^/10

floxif backdoor discovery persistence privilege_escalation trojan upx

Malware Config

Signatures

Floxif family
floxif
Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
backdoor trojan floxif

Detects Floxif payload 1 IoCs

backdoor

resource	yara_rule
behavioral2/files/0x000c000000023b08-2.dat	floxif

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000c000000023b08-2.dat	acprotect

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 1 IoCs

pid	Process
1480	A4ARegFix.exe

Loads dropped DLL 9 IoCs

pid	Process
4264	721a997269bf8691bb46b40baa9d920f09ddb74e61f8da2f5d15270253145403N.exe
4264	721a997269bf8691bb46b40baa9d920f09ddb74e61f8da2f5d15270253145403N.exe
4264	721a997269bf8691bb46b40baa9d920f09ddb74e61f8da2f5d15270253145403N.exe
4264	721a997269bf8691bb46b40baa9d920f09ddb74e61f8da2f5d15270253145403N.exe
4264	721a997269bf8691bb46b40baa9d920f09ddb74e61f8da2f5d15270253145403N.exe
4304	regsvr32.exe
4304	regsvr32.exe
1232	regsvr32.exe
4264	721a997269bf8691bb46b40baa9d920f09ddb74e61f8da2f5d15270253145403N.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\e:	721a997269bf8691bb46b40baa9d920f09ddb74e61f8da2f5d15270253145403N.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000c000000023b08-2.dat	upx
behavioral2/memory/4264-4-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/4264-102-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/4264-112-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/4304-130-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/4304-135-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/4264-209-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/4264-221-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ASIO4ALL v2\asio4all64.dll	721a997269bf8691bb46b40baa9d920f09ddb74e61f8da2f5d15270253145403N.exe
File created	C:\Program Files (x86)\ASIO4ALL v2\A4ARegFix.exe	721a997269bf8691bb46b40baa9d920f09ddb74e61f8da2f5d15270253145403N.exe
File created	C:\Program Files (x86)\ASIO4ALL v2\ASIO4ALL Web Site.url	721a997269bf8691bb46b40baa9d920f09ddb74e61f8da2f5d15270253145403N.exe
File created	C:\Program Files (x86)\ASIO4ALL v2\uninstall.exe	721a997269bf8691bb46b40baa9d920f09ddb74e61f8da2f5d15270253145403N.exe
File opened for modification	C:\Program Files (x86)\ASIO4ALL v2\A4ARegFix.exe	721a997269bf8691bb46b40baa9d920f09ddb74e61f8da2f5d15270253145403N.exe
File created	C:\Program Files\Common Files\System\symsrv.dll	721a997269bf8691bb46b40baa9d920f09ddb74e61f8da2f5d15270253145403N.exe
File created	\??\c:\program files\common files\system\symsrv.dll.000	721a997269bf8691bb46b40baa9d920f09ddb74e61f8da2f5d15270253145403N.exe
File created	C:\Program Files (x86)\ASIO4ALL v2\asio4all.dll	721a997269bf8691bb46b40baa9d920f09ddb74e61f8da2f5d15270253145403N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	721a997269bf8691bb46b40baa9d920f09ddb74e61f8da2f5d15270253145403N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{232685C6-6548-49D8-846D-4141A3EF7560}	721a997269bf8691bb46b40baa9d920f09ddb74e61f8da2f5d15270253145403N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{232685C6-6548-49D8-846D-4141A3EF7560}\InprocServer32\ = "C:\\Program Files (x86)\\ASIO4ALL v2\\asio4all.dll"	721a997269bf8691bb46b40baa9d920f09ddb74e61f8da2f5d15270253145403N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{232685C6-6548-49D8-846D-4141A3EF7560}\ = "ASIO4ALL v2"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{232685C6-6548-49D8-846D-4141A3EF7560}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{232685C6-6548-49D8-846D-4141A3EF7560}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{232685C6-6548-49D8-846D-4141A3EF7560}\InprocServer32\ = "C:\\Program Files (x86)\\ASIO4ALL v2\\asio4all64.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{232685C6-6548-49D8-846D-4141A3EF7560}\ = "ASIO4ALL v2"	721a997269bf8691bb46b40baa9d920f09ddb74e61f8da2f5d15270253145403N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{232685C6-6548-49D8-846D-4141A3EF7560}\InprocServer32	721a997269bf8691bb46b40baa9d920f09ddb74e61f8da2f5d15270253145403N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{232685C6-6548-49D8-846D-4141A3EF7560}\InprocServer32\ThreadingModel = "Apartment"	721a997269bf8691bb46b40baa9d920f09ddb74e61f8da2f5d15270253145403N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{232685C6-6548-49D8-846D-4141A3EF7560}	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4264	721a997269bf8691bb46b40baa9d920f09ddb74e61f8da2f5d15270253145403N.exe
4264	721a997269bf8691bb46b40baa9d920f09ddb74e61f8da2f5d15270253145403N.exe
4264	721a997269bf8691bb46b40baa9d920f09ddb74e61f8da2f5d15270253145403N.exe
4264	721a997269bf8691bb46b40baa9d920f09ddb74e61f8da2f5d15270253145403N.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4264	721a997269bf8691bb46b40baa9d920f09ddb74e61f8da2f5d15270253145403N.exe
Token: SeDebugPrivilege	4304	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4264 wrote to memory of 4304	4264	721a997269bf8691bb46b40baa9d920f09ddb74e61f8da2f5d15270253145403N.exe	89
PID 4264 wrote to memory of 4304	4264	721a997269bf8691bb46b40baa9d920f09ddb74e61f8da2f5d15270253145403N.exe	89
PID 4264 wrote to memory of 4304	4264	721a997269bf8691bb46b40baa9d920f09ddb74e61f8da2f5d15270253145403N.exe	89
PID 4304 wrote to memory of 1232	4304	regsvr32.exe	90
PID 4304 wrote to memory of 1232	4304	regsvr32.exe	90
PID 4264 wrote to memory of 1480	4264	721a997269bf8691bb46b40baa9d920f09ddb74e61f8da2f5d15270253145403N.exe	91
PID 4264 wrote to memory of 1480	4264	721a997269bf8691bb46b40baa9d920f09ddb74e61f8da2f5d15270253145403N.exe	91

C:\Users\Admin\AppData\Local\Temp\721a997269bf8691bb46b40baa9d920f09ddb74e61f8da2f5d15270253145403N.exe
"C:\Users\Admin\AppData\Local\Temp\721a997269bf8691bb46b40baa9d920f09ddb74e61f8da2f5d15270253145403N.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4264
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\system32\regsvr32.exe" -s "C:\Program Files (x86)\ASIO4ALL v2\asio4all64.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4304
- - C:\Windows\system32\regsvr32.exe
    -s "C:\Program Files (x86)\ASIO4ALL v2\asio4all64.dll"
    3⤵
    - Loads dropped DLL
    - Modifies registry class
    PID:1232
- C:\Program Files (x86)\ASIO4ALL v2\A4ARegFix.exe
  "C:\Program Files (x86)\ASIO4ALL v2\A4ARegFix.exe"
  2⤵
  - Executes dropped EXE
  PID:1480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\ASIO4ALL v2\A4ARegFix.exe

Filesize
90KB

MD5
a48bbddcb6771a48a6f71258ec6d2371

SHA1
e0ce96abb0eb771058ef1e6e4c8babb0539d61b9

SHA256
c3bbbc8c4b502f910c3613b614e159ffe407f343abb2e208f4bb7bd6c7b4ca0f

SHA512
374fe784b3f6e663a40f300bcc4611485ec10ed38b276b0c99a432d1cfcba77b1686b8b445bc7647447a697278f2d452bd3ac30caf9a612c5fed3f71a4c61e14

Download Submit
C:\Program Files (x86)\ASIO4ALL v2\asio4all.dll

Filesize
284KB

MD5
a3ed58bfbe5f28345d9abf33ed7f24dd

SHA1
db8d1f25d2a672591c7097918e6623c14b418fad

SHA256
b65f50fe03376f5dfe6839d13f29f1470a9e3ae1ab5b0b130d3952cad4eeb520

SHA512
f423c840a86a0da933757269dd0190e4f535054f0adb7bd8d1043d41cb251ddd7651d17e841a8e27f511f61d30a988ea45b4b4ef1477a8418cea6be40440756a

Download Submit
C:\Program Files (x86)\ASIO4ALL v2\asio4all64.dll

Filesize
315KB

MD5
272e108a3fd586e3d8e2810b65e574cb

SHA1
5452364b390955a536240c30e29906d1db922a51

SHA256
9140e096d3db97403d61f10e929d5c55067041398fca1f3270710a8116ac3686

SHA512
f74deba85d252372520ea0c73dad86cce5070852f7188d918d1a8334b9dab0b8aa186db14ac95cad7e7376326884ff437d688e765486c6c84dcbc273b5f4ceec

Download Submit
C:\Program Files\Common Files\System\symsrv.dll

Filesize
67KB

MD5
7574cf2c64f35161ab1292e2f532aabf

SHA1
14ba3fa927a06224dfe587014299e834def4644f

SHA256
de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085

SHA512
4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab

Download Submit
C:\Program Files\Common Files\System\symsrv.dll.000

Filesize
175B

MD5
1130c911bf5db4b8f7cf9b6f4b457623

SHA1
48e734c4bc1a8b5399bff4954e54b268bde9d54c

SHA256
eba08cc8182f379392a97f542b350ea0dbbe5e4009472f35af20e3d857eafdf1

SHA512
94e2511ef2c53494c2aff0960266491ffc0e54e75185427d1ccedae27c286992c754ca94cbb0c9ea36e3f04cd4eb7f032c551cf2d4b309f292906303f1a75fa0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk6C19.tmp\InstallOptions.dll

Filesize
15KB

MD5
0a9fb96a7579b685ec36b17fc354e6a3

SHA1
355754104dd47d5fcf8918dee0dc2e2ee53390a6

SHA256
b34fb342f21d690aac024b6f48a597e78d15791ef480ac55159cd585d0f64af7

SHA512
67870206fa7f1e7df45c8c1bc2f51fb430f0a048a2bdb55a4a41525388ca3b50203784537f139169705a03db4bb13b591162a79a5d2df81a4d11fd849615c86b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk6C19.tmp\System.dll

Filesize
12KB

MD5
564bb0373067e1785cba7e4c24aab4bf

SHA1
7c9416a01d821b10b2eef97b80899d24014d6fc1

SHA256
7a9ddee34562cd3703f1502b5c70e99cd5bba15de2b6845a3555033d7f6cb2a5

SHA512
22c61a323cb9293d7ec5c7e7e60674d0e2f7b29d55be25eb3c128ea2cd7440a1400cee17c43896b996278007c0d247f331a9b8964e3a40a0eb1404a9596c4472

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk6C19.tmp\ioSpecial.ini

Filesize
1KB

MD5
8502f834786e8c7eea4b134c88f68a3d

SHA1
70f2582b32513a6c2d1b48a0b869164410d03979

SHA256
a4e3165a946665924c6fcc1cc8b5d1b23bd5978557fe4db92bc345bfff78e75a

SHA512
aeb8cea8c94d20b0c7b8906268d8f0eb4e960e7ab71ba1fd3c4d828b5b265f8eb4e8a558efce4bbb69c4352c958e8f3019559ab4be400745e4318cc2372423b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk6C19.tmp\ioSpecial.ini

Filesize
1KB

MD5
9ec0325c2bb25d34e5fc7754a1069348

SHA1
12cc0c1a2bebc5984f04fe28c47a6e101ab6a1cb

SHA256
bd837fa742c15f0036235d2b2ba2807872027c39b59a2787075e4f74f70d7d3b

SHA512
daad8898962d273976fff68fe8c5c51403aefa3a8aa35b9e924dc01a44c41b6975d704947366fd9998779cede76767378010e5cb4eb0bf5a8bb7401a24d1faa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk6C19.tmp\ioSpecial.ini

Filesize
1KB

MD5
eb7fb8830d17d07eec31ab1252ebf12f

SHA1
68d4e151756636ec4056c22932af7cbc750ca3dd

SHA256
a87d676352288bd33abcbe01954d4959f1be3c8631e3b9cca37ca1734da09262

SHA512
6784f3a07606d7653de286a2e48931464f3cafb49859036cfd8a41da20fe42d5b920664bf765f2af8eb48fc7fca600e75da8fb4bffec5893287c383242b10387

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk6C19.tmp\ioSpecial.ini

Filesize
1KB

MD5
6d547c67aa4cdd7003b1bde7245506f8

SHA1
d8b8dfdc1e30032a3673b1ff13eb0f7e6c1e670e

SHA256
a6766baef9c6c136803cc5e14cb5183f22bda92fc0bf148350e56205ad7e06d1

SHA512
f315788b0987f0e190d7bd2b3c7dc0cdfee86386d6ae5318cb870c7553ac73d4d92006a86e938286ec52492900e3b057db83bd9e38e0ad3260b5e9e517f7000f

Download Submit
memory/4264-96-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/4264-6-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/4264-109-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/4264-126-0x0000000005750000-0x00000000058AE000-memory.dmp

Filesize
1.4MB

Download
memory/4264-222-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/4264-103-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/4264-221-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/4264-102-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/4264-101-0x0000000000403000-0x0000000000404000-memory.dmp

Filesize
4KB

Download
memory/4264-0-0x0000000000403000-0x0000000000404000-memory.dmp

Filesize
4KB

Download
memory/4264-112-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/4264-208-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/4264-209-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/4264-4-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/4304-135-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/4304-130-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download