Analysis
-
max time kernel
117s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
26-12-2024 19:18
General
-
Target
a097fd102b97cdf490488bd4eb878af4ba5f663cf0eca2ce30f1ed535a6998efN.exe
-
Size
884KB
-
MD5
9e1cb13c84639f2a1ebf79a45bb75500
-
SHA1
6c732825b11424fbe8855c75667f2df155ca70c3
-
SHA256
a097fd102b97cdf490488bd4eb878af4ba5f663cf0eca2ce30f1ed535a6998ef
-
SHA512
f66bda2dfd428eead11bcebe1a1aae8466bb59782aa4b61060ebdbdf6c1b7c668bcd68094ea927f52d0568527dff77ab527713690db35f00041a8d1cdfc92b8b
-
SSDEEP
12288:Za3RMY7v3qnCiiErQohh0F4pCJ8lnyOQwlsZk03iGFRABjvrEH7rsS:4+kv6CCrjlnyOQ9q0SGirEH7rl
Malware Config
Signatures
-
Floxif family
-
Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
-
Modifies security service 2 TTPs 1 IoCs
-
Detects Floxif payload 1 IoCs
-
Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
-
Loads dropped DLL 1 IoCs
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Program Files directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a097fd102b97cdf490488bd4eb878af4ba5f663cf0eca2ce30f1ed535a6998efN.exe"C:\Users\Admin\AppData\Local\Temp\a097fd102b97cdf490488bd4eb878af4ba5f663cf0eca2ce30f1ed535a6998efN.exe"1⤵
- Modifies security service
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1AppInit DLLs
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1AppInit DLLs
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67KB
MD57574cf2c64f35161ab1292e2f532aabf
SHA114ba3fa927a06224dfe587014299e834def4644f
SHA256de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
SHA5124db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
-
Filesize
175B
MD51130c911bf5db4b8f7cf9b6f4b457623
SHA148e734c4bc1a8b5399bff4954e54b268bde9d54c
SHA256eba08cc8182f379392a97f542b350ea0dbbe5e4009472f35af20e3d857eafdf1
SHA51294e2511ef2c53494c2aff0960266491ffc0e54e75185427d1ccedae27c286992c754ca94cbb0c9ea36e3f04cd4eb7f032c551cf2d4b309f292906303f1a75fa0
-
Filesize
2KB
MD5a2f594606204dc3539215e0e191a31c3
SHA138ce5458ed33f620dfa96953bd21a468b241c606
SHA2563dd5f9348c766b63d4a3e36d6847f80316143d068fc98d82a3da5a89cfe60974
SHA512414b499ca616174eda2f959d15340410965ad395c70ccd9bdcc5ccfd5d071c55d3a3395539649f2b8380de10cee4cf3bcf9aaaff1d77c975ff461f394f7d1f97
-
Filesize
812KB
-
Filesize
192KB
-
Filesize
812KB
-
Filesize
812KB
-
Filesize
192KB
-
Filesize
812KB
-
Filesize
812KB
-
Filesize
812KB
-
Filesize
812KB
-
Filesize
812KB
-
Filesize
192KB
-
Filesize
16KB
-
Filesize
812KB
-
Filesize
812KB
-
Filesize
812KB
-
Filesize
812KB
-
Filesize
812KB
-
Filesize
812KB
-
Filesize
812KB
-
Filesize
812KB
-
Filesize
192KB
-
Filesize
812KB
-
Filesize
812KB
-
Filesize
812KB
-
Filesize
192KB