floxif | e9b15b20632c0bc7e12cf25a5f090f6ddab72e307c1f08b7eeccea1ff5d0ac5b

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
27-12-2024 03:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e9b15b20632c0bc7e12cf25a5f090f6ddab72e307c1f08b7eeccea1ff5d0ac5b.exe
Size

3.3MB
MD5

8814f6676f299c514df1c2b855e7f4cc
SHA1

5ac956b893e336e7bc53b4eb0aa5c44f5efbc53a
SHA256

e9b15b20632c0bc7e12cf25a5f090f6ddab72e307c1f08b7eeccea1ff5d0ac5b
SHA512

4f60cc36dd5f9bcc31d31d68306fcbc506c7fb9e20cb94f20a6570b2deff5615a0043f56644754a51bc2acce368c9955dd1c37fb32803d88f950e3ca7436c0d1
SSDEEP

49152:9jpCiSC7VLqrZu1xBwnIYl5+792VwknqotEFMkY+UBMoEnRqlrMz0FBcbZAjxnMj:9Or6PE+79edqj27+UBxcRqlr1BSuMj

Score

10^/10

floxif backdoor discovery persistence privilege_escalation trojan upx

Malware Config

Signatures

Floxif family
floxif
Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
backdoor trojan floxif

Detects Floxif payload 1 IoCs

backdoor

resource	yara_rule
behavioral1/files/0x000900000001683c-2.dat	floxif

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x000900000001683c-2.dat	acprotect

Executes dropped EXE 1 IoCs

pid	Process
2032	DiskCleaner.exe

Loads dropped DLL 12 IoCs

pid	Process
2748	e9b15b20632c0bc7e12cf25a5f090f6ddab72e307c1f08b7eeccea1ff5d0ac5b.exe
2748	e9b15b20632c0bc7e12cf25a5f090f6ddab72e307c1f08b7eeccea1ff5d0ac5b.exe
2748	e9b15b20632c0bc7e12cf25a5f090f6ddab72e307c1f08b7eeccea1ff5d0ac5b.exe
2032	DiskCleaner.exe
2032	DiskCleaner.exe
2032	DiskCleaner.exe
2032	DiskCleaner.exe
2032	DiskCleaner.exe
2032	DiskCleaner.exe
2032	DiskCleaner.exe
2032	DiskCleaner.exe
2748	e9b15b20632c0bc7e12cf25a5f090f6ddab72e307c1f08b7eeccea1ff5d0ac5b.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\e:	e9b15b20632c0bc7e12cf25a5f090f6ddab72e307c1f08b7eeccea1ff5d0ac5b.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2748-0-0x0000000000400000-0x0000000000430000-memory.dmp	upx
behavioral1/files/0x000900000001683c-2.dat	upx
behavioral1/memory/2748-4-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2748-179-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2748-178-0x0000000000400000-0x0000000000430000-memory.dmp	upx

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\symsrv.dll	e9b15b20632c0bc7e12cf25a5f090f6ddab72e307c1f08b7eeccea1ff5d0ac5b.exe
File created	\??\c:\program files\common files\system\symsrv.dll.000	e9b15b20632c0bc7e12cf25a5f090f6ddab72e307c1f08b7eeccea1ff5d0ac5b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e9b15b20632c0bc7e12cf25a5f090f6ddab72e307c1f08b7eeccea1ff5d0ac5b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DiskCleaner.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2748	e9b15b20632c0bc7e12cf25a5f090f6ddab72e307c1f08b7eeccea1ff5d0ac5b.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2748	e9b15b20632c0bc7e12cf25a5f090f6ddab72e307c1f08b7eeccea1ff5d0ac5b.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 2032	2748	e9b15b20632c0bc7e12cf25a5f090f6ddab72e307c1f08b7eeccea1ff5d0ac5b.exe	31
PID 2748 wrote to memory of 2032	2748	e9b15b20632c0bc7e12cf25a5f090f6ddab72e307c1f08b7eeccea1ff5d0ac5b.exe	31
PID 2748 wrote to memory of 2032	2748	e9b15b20632c0bc7e12cf25a5f090f6ddab72e307c1f08b7eeccea1ff5d0ac5b.exe	31
PID 2748 wrote to memory of 2032	2748	e9b15b20632c0bc7e12cf25a5f090f6ddab72e307c1f08b7eeccea1ff5d0ac5b.exe	31

C:\Users\Admin\AppData\Local\Temp\e9b15b20632c0bc7e12cf25a5f090f6ddab72e307c1f08b7eeccea1ff5d0ac5b.exe
"C:\Users\Admin\AppData\Local\Temp\e9b15b20632c0bc7e12cf25a5f090f6ddab72e307c1f08b7eeccea1ff5d0ac5b.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\DiskCleaner.exe
  "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\DiskCleaner.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\AppMetrics.dll

Filesize
110KB

MD5
cd45c1e5d4b777dea8d505f77677756b

SHA1
d605d5f097a2de3b1ba097b59a364b6a9308132a

SHA256
905c67e4005e6ae0dca1d853a52951dc0a34da4a7534e9de3d920c5b372ebf11

SHA512
bcc8ef264757aee34990c6a756c5d78ebc057c9180dc2b70166c9fbfa3eb250618a6d266359cebbd26a631759474eda2eeabb81a1b791534c753aa977defa3e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Config.dll

Filesize
41KB

MD5
43b4c18da30b1dc7f7191cc02fd11e98

SHA1
f2bf81b48368e90385e7ed2e077fb8a2c0b70d6c

SHA256
9099a5a8fe7f2f8cdf4a7774a07450094d9cfa03a3b32a51baec897e3d93466f

SHA512
af1e3d0cc85af0941131e20c74ea50dcce02058d663027873f033007bfab9e3e88f5d72e65bf68b436b4ad3a8fd24dd07d541adc3e0134afa38f99df5821e2f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\DiskCleaner.dll

Filesize
713KB

MD5
f7c024b6270c61b86dc78ed53a0164b5

SHA1
00afe5ddf074f2faa28e598bbe1f339a75bff720

SHA256
3c0712c60b54fa397790fea518023d8dcdcc2423091f088ade02a6b889b95547

SHA512
63db647887d3ac59454fd9f86a1699bcf8513a2544e0b3e4677dd39cd4142b9829cd56859fc6ceaf8d1fb026cc9c827104a27ca2950d5c9988ac2dcb57b018b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\DiskCleaner.exe

Filesize
50KB

MD5
59f2aeabb49a8c36e64cff1dec9932da

SHA1
c85c4baa95198cf3718aaa416f43ba0bfa976736

SHA256
fdc85dfc0f8aec493147b572ca7cc9f21fe5c8fc04da0e7734fc8c0c98d810e0

SHA512
a837abe3c4575ef1cecd3be3c6290456225305f0dd33162bb0690e463806b55a7933076224156b0c581581b57166ad1673e31f976fcb7f7836d9177d8afa9ec0

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Languages.dll

Filesize
100KB

MD5
a3095436c539d73ed776043ea0efe875

SHA1
1c1d2ffe9bdabf503abc6ec7a849e008fa0dea8f

SHA256
93d2e2d15e99354400bec8ec20e69c2ff64fe4282c5074f56a3517ff924bd901

SHA512
a4cef8c9462994d5c3479fa2941f5f7ddfbc978be9d23cc21134a6ffa34efaf28769d05f55bb62cc3a9cd760a0ceb085655f2fb41bcd07036dfadf712f8d6520

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\LockDll.dll

Filesize
579KB

MD5
a819a258502ab21e1998a1cbdd8001e6

SHA1
231641fc2e56aa671823282c8f77048d368cbfff

SHA256
e2d9c525f62d3dc56b17dbf05d6412bae898b6b905c45fc7ed6de4322ff8a90c

SHA512
14eaa3ccedd9bdfac096b072bfe4c6d88cd5a569cce78c6f371e3ea2bb53c0738e7bea130e49906f676a222ec3bb7152988bd70c58f00cf8c14180014cdc9ce3

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ObjectAdmin.dll

Filesize
80KB

MD5
dfec05724ba90c20f0053b001e9d6e83

SHA1
7f34a9a867c08acb84629faaf064a41ccb8b0285

SHA256
69ddc9b220e3ca3ea012ec2912befc1c731f266a86d63f36db6fc2c0af6cd7d1

SHA512
590eee3676be78f1b5b97a5980e43509388ba1eb79227352187bc2d7560a814fd31dd41ab398f4323a781d89dab80ee5c2bdd71b90bb8f189c7109fadcca11f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ScanFile.dll

Filesize
77KB

MD5
14c671615b6eeace4267e8a412803c1b

SHA1
52a60c27378561f7ee9f6a62a854cd9b7b625ba1

SHA256
6af94061b01861650a1297dc31bf3e6696d13b85334e717a98e906ec1b7ae0b1

SHA512
2c8b7a568824fe9498215d26bf821e0151c432ee0603e673101a1f54e630ec95cb1f0782543e2442145567694fab4a6e10c4b28eff7929bf5d88277672e56b27

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ShortcutFixer.dll

Filesize
61KB

MD5
a33cea5bd1c42aac1c2e2db57e518ddd

SHA1
2fd5ccac8e6e607c676b5eb74e70578ecd1c2491

SHA256
31294c6f488b690e5214c65940f2406c5dfcd986351422e9d921f0e862afa117

SHA512
6371833c28bf7e62cb625951e6719f2511a8c6b06cf92bb84ddf6898e222df5e9c623d172bad2bcdc104126af59e3d5d5515f6638919b19de6c0da13d912ec11

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\languages\english.lng

Filesize
174KB

MD5
ab268853627230260d996b06356df637

SHA1
50236636ed4dc8bf5f406217501780502d294df5

SHA256
0019c669dc35a24dbfc9a1848c583a74880c5a36d9ce3f8cb96fa97cc16ebc85

SHA512
b5225b97aef39ba31ba9a9e96558537f0986252c8a12b562500a11b3151bc453cb967f74c9b2ab840bcb3441e15c162905c6aaff7a144a7e57454d61fed43eb3

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\zlib1.dll

Filesize
92KB

MD5
6d723ceabcac4aaec2c3fe7a41120fda

SHA1
2e6c5cf78339209e884a081f11eb3f44702fd58c

SHA256
10b82d48a764ed9b5b842f92bef949cbd4d84c734654b1253fced9f5fee734ec

SHA512
f1fe3254c23689395a152224dc74798ae4bfc2e76fcae9fbb03376f368cced6962611905170c474a892b86b298f35a12b278a3cb2f4a6cbdcd5d3f6984eb94e1

Download Submit
\Program Files\Common Files\System\symsrv.dll

Filesize
67KB

MD5
7574cf2c64f35161ab1292e2f532aabf

SHA1
14ba3fa927a06224dfe587014299e834def4644f

SHA256
de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085

SHA512
4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab

Download Submit
\Users\Admin\AppData\Local\Temp\7ZipSfx.000\AppMetrics.dll.tmp

Filesize
187KB

MD5
59c5f84acc99cb0ecfc074eb830884b2

SHA1
6d8c5757c4a51649b88e96056d5eb0d0d3ca0a26

SHA256
e59fdca1559e5d8286742d2f9579638d85c72a34905c48edd754620285fac291

SHA512
18916a2589caf5bb327c116570abd6ffefd10c99c5dfdbb6a012e1c635a53499260ab68c80a533d5e3a230b13b9134ef8e145d4ded9ef6e228f558759a0b8af3

Download Submit
\Users\Admin\AppData\Local\Temp\7ZipSfx.000\DiskCleaner.dll.tmp

Filesize
790KB

MD5
df2c0e19bd3ca64981e261137df8f3a8

SHA1
10c9402e2870f0fbd8278411b308632831776406

SHA256
3342368c92b7907a40c8802d78f77c361bac99d482c6945428805f9c5cc27ad6

SHA512
5b3cc348f01f2fa9187d8ecb82ae83772513591278ab51a24d62921b300c34f8b8652c8c6372b388d613583f87ce98beb04847385bb3aa24e474ab95b5dbffd5

Download Submit
memory/2032-152-0x0000000073700000-0x00000000737B0000-memory.dmp

Filesize
704KB

Download
memory/2748-0-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2748-4-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2748-179-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2748-178-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download