Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
28-12-2024 18:26
General
-
Target
2024-12-28_2311af7a51179653ab13a1de7b1cd9d5_floxif_icedid.exe
-
Size
13.9MB
-
MD5
2311af7a51179653ab13a1de7b1cd9d5
-
SHA1
e97369fc9862180dcc5753e987910cb93fbe2021
-
SHA256
acb3d014eab258d3e2dbcc82461fda0a3a37bc82b4cf743e9744c8cffc995e48
-
SHA512
3fb2e29c0f21b2e2a246d77c521f971ca70cb38ca95b913629e233123821168d711204c418a5170ceeda33c55f3358936dd63da8026315b79d41f294f05a74bf
-
SSDEEP
393216:x2hgHwxYYqFvrOylDN3FlgAxopoz007WL:x1HitfKbiAxoa407WL
Malware Config
Signatures
-
Floxif family
-
Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
-
Detects Floxif payload 1 IoCs
-
Drops file in Drivers directory 6 IoCs
-
Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 11 IoCs
-
Adds Run key to start application 2 TTPs 3 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory 21 IoCs
-
UPX packed file 27 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 11 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 11 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 30 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-28_2311af7a51179653ab13a1de7b1cd9d5_floxif_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-28_2311af7a51179653ab13a1de7b1cd9d5_floxif_icedid.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\BMW_KEY\InstDrv.exe"C:\Program Files\BMW_KEY\InstDrv.exe" BMW_INS2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32 setupapi.dll,InstallHinfSection FtdiBus 128 C:\Program Files\BMW_KEY\Drivers\USBDriver\FTDIBUS.INF3⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\runonce.exe"C:\Windows\system32\runonce.exe" -r4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\grpconv.exe"C:\Windows\System32\grpconv.exe" -o5⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\SysWOW64\rundll32.exerundll32 setupapi.dll,InstallHinfSection FtdiPort 128 C:\Program Files\BMW_KEY\Drivers\USBDriver\FTDIport.INF3⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\runonce.exe"C:\Windows\system32\runonce.exe" -r4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\grpconv.exe"C:\Windows\System32\grpconv.exe" -o5⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\SysWOW64\rundll32.exerundll32 setupapi.dll,InstallHinfSection FtdiPort232 128 C:\Program Files\BMW_KEY\Drivers\USBDriver\FTDIport.INF3⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\runonce.exe"C:\Windows\system32\runonce.exe" -r4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\grpconv.exe"C:\Windows\System32\grpconv.exe" -o5⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1AppInit DLLs
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1AppInit DLLs
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
100KB
MD5cdf91fb3cf82d2a5682c42714d8cb9c2
SHA1749ce7db573f421bc520786e17ca0efa26822d81
SHA2563392bf2a67f3774b58332fd1e45a3bddf87ca25edc3c40ef0c266f15e962114f
SHA512f826acad305155b489b5403f04f6348bdec1c88c9798c871681cc1e7a5f3451a8cb4275d1b6055108d71c9947861d55fb08789016f39aed99728ad3f2c268f25
-
Filesize
104KB
MD5e3974afac60ee2c3ec118d560c7fe98c
SHA1b6c353060d15d4aa136605cfa1721d1c21efc64d
SHA256c8e47ba55381bd3df5484a65c4682adf84f694e72b972a0f1c312bac2c0b5dad
SHA512d9bc13c509a7f753fac04368be146d6bc4f234dfa9a8ccb0f02c96c0f5299041095cc783fda0d9672eca10e7516874af4bd757d09bb72639616f3f3c2c7e3c8a
-
Filesize
172KB
MD5aa8046aa6726e0a2b0cda65fb5d2cd8d
SHA19decf4ee4cfabe32e05af7b0e8ea2ea872e01a18
SHA256391644ee8db7dd5fe5ceaf612ea963280a54e4f4e03af8faf2008c35039a3c06
SHA51218e6c3f7a6dfd9f8271266df362fde7e1ee7db7ccca14913f4b785130a712b22f7bfa4fc757736c840aadcb94c05453964654ec7ce82d5013a1dfcdfb837cf50
-
Filesize
46KB
MD5b283f1bc1ff852bd232449a4b3e3ce63
SHA11735a5f442a52ae782217da90596c6f62c16af45
SHA256e9e97433b39c0c20d9602b13dc0b5db06212cdbd2ccf733b1f0ffa94bd7567aa
SHA5120898ee85a25900b508895444b43b0c10ad17dcb24e97af56aaf1a69797932c4b554006a8f5226914c9abf93c433d486d1cba1016f7f354703c373349c75ba0a2
-
Filesize
133B
MD5575fd6d0b71eb70778ea4ff9ae31f275
SHA1d100eb720461686cee42600d339c94079dfb15a1
SHA256457c90c856d737267cf28a7215e72e15929ac96b079562d600c5b36e861b3224
SHA5122abc121b0555a7e0642666f5fa7920aac18f257c098c9ee036fd4ce5830e6604e67fdece1f68532d520ed0d6f4d4c9a396ff363f59ba8329b1f3c2ae8cc0a102
-
Filesize
184KB
MD59a411917e84142c706358a74e753ab38
SHA15ee4d0293fc2b5e916a5cd3ebe5ffd25dfc28c09
SHA2563b0129a0fcd4f5ca649444358afdf852c878a2f539be897bf0519d07e8561413
SHA512e7c48120e09bf389968268d5986922439a95d8ea604ba26fb8d2fbbcbf5cb559b14ce1b267b3685b8aca494eab54d740c66a2a4b9d81035a2ef198ca1c17635f
-
Filesize
1.9MB
MD5731bc6cdbc7bf9dc87a85dd87ac8caa9
SHA1824cbf34b70f60d61947aebb558a8a12b49d342c
SHA256c0b575b8c46beaa3db633e77c6652712deef46bcbf4a2d55879185377f6d72bf
SHA51223304a16b9bc73ced771d451e30157c951279bec5a9012ed028834742fe82f30bb63494bfd1ad13252800e2f409c3b3cfe3a02a12e9f720fbe249fa774415095
-
Filesize
2KB
MD5850d4cc5fabf66b5832ea4877b064c16
SHA1fbecea98c87e2c90122e50c26b4f7e0bea699616
SHA25657ec958458b8c6d99559a72473c7f2bcfb2b0ea4306598a50a72a4955668ae19
SHA5123c5564dd868f9e5ca1324379066cf3eb705bb8a7af07b9161d119ee0ecb7a3b169d60f12aaa856649ced91fb56bc359d4a676f49549c99b35c5447bcc3ad972b
-
Filesize
3KB
MD5469fde18639bac64ef50854687a0866e
SHA120d412c1d418ec6b8f1bc7bca74c98475fde6702
SHA256c8b7acc471066bc7acf13768fcd35f3281851a476bace4e647d3928d00b5bb8f
SHA51249da391e44778332d3e60b244c53d5593e10b981464a3b346948e816423209a0db698a1bd0a47feeabb2d12a3d2561c8500f7b1bd0abe29162c7fedf858fcd80
-
Filesize
621KB
MD5b61ef16354ba4970ac1190ad65ad642a
SHA1cb753b1ea0d103572d3bfec51a80940db4a6a6b0
SHA256080412360fc5bb363888fd7a5369c639447ada15c6117917f28c9c505daf2310
SHA5123abaddb6d4312a838c18dd94541fdbcf38d6e8e2021e7a9286e3f83a0387899aa7b55c4de0df4e158a07b86a6694dfe1375b1d65525d1b86fe2c2024610ddb60
-
Filesize
40KB
MD539cf0cc9ab7eb34cbeb4df27730cd394
SHA1c110f6739bfddf9aa8f52f554196111c6528ca87
SHA2569ebcff6ad7c9c4011afc3ea37e3bb1e9c6a4d8ffa9d8e4f5137a50dc0a06767d
SHA5123b7341baec5157aaba7664f159cc7322e404f64f43f7c5003328b23fbf995d209837d62335fa8125dac130481938bb4cb9dd5cae79cb98024253d4cb8a3e19ce
-
Filesize
67KB
MD57574cf2c64f35161ab1292e2f532aabf
SHA114ba3fa927a06224dfe587014299e834def4644f
SHA256de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
SHA5124db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
-
Filesize
175B
MD51130c911bf5db4b8f7cf9b6f4b457623
SHA148e734c4bc1a8b5399bff4954e54b268bde9d54c
SHA256eba08cc8182f379392a97f542b350ea0dbbe5e4009472f35af20e3d857eafdf1
SHA51294e2511ef2c53494c2aff0960266491ffc0e54e75185427d1ccedae27c286992c754ca94cbb0c9ea36e3f04cd4eb7f032c551cf2d4b309f292906303f1a75fa0
-
Filesize
8KB
MD56a78e7cc5f564cdc7b6e15b393061367
SHA1a6d419470599f24dd04e3427f3e4870d466e2ce6
SHA256bf7ab27f4c352a1a5913e1ab85e437c564f5123881c2736a3d224d4902cf85eb
SHA51252ab589039b9302c661eb835ad2bb85a5f8b8d665bfd83513cb8e441b8bcfbb684e5cd085b9ec35801c410be3948a52ae14c90563058d2b1b430e28c9f94c08c
-
Filesize
8KB
MD51f6f5a5ca3f5c02e921c416336ae1f95
SHA1d4ce2551063167363a360f357de0db5391ec978f
SHA2561560975fd16e80bd896240affa0c097a96b2c8ca0316dbf58926ec5165fb2990
SHA5127aec7f0356f63f37cfdeb53ff8f3b450dcbd6d2e67984186d7a1c651df4395d18665f6c641fbfb13f650ada933faa7d6d98ff29ee8315d4a4ca38ce0bc646f1c
-
Filesize
99KB
MD5bc6929cf43081a4de421ab6af50aa4b1
SHA195c05ab09fec65f8bd2ab99fd0267b231a04060f
SHA2567523a64eb26ad746666a12d988069aeec9d89c03a2c026c0878a7f73d204b03c
SHA512d013e5c0e3fbb5a478bea05e85fedfa038df6c8dd2e4b0b777870a5ec7a0a79b841096384f1e0be76f5a6dc85f7819647681b37253f9a3596522db54d78b79b3
-
Filesize
13.8MB
MD51209885b28a318d00d613b047e1c5b9b
SHA10165018d686f6e11ce7efd0f71c8d2e4ad1feb0e
SHA2565cb9a0358e079d691c617bf8611c0e0370cd6498ff7d0eac5b0a709f57a46301
SHA5121932ffa6621d43b58c4870ef2cc1bbcf0c6998bcd2c3e3b925ed84d688b5d3a388894881c2f06cca6687d910bfa653e2a999994096dad071a0edf9ee1f69abf8
-
Filesize
59KB
MD5678a73f56ddf84a08c31123c386e9967
SHA1cadfb220a6e5168af8361e3ca25d9f082f0df0c4
SHA256cefce93abf0928fbc361cc953b49d33bcc0376c4477d0ac1840e6b94c6de2e4f
SHA512f7fd19f249fa53965ef517235a54b279050b8033c2dd917444c76cd5737c9a06b9e4fba14957b2383d1c17f0d221badee0d4632f49d56b602c810a229d127978
-
Filesize
32KB
MD51452ce75a9ac31d29d552f3bcd62e64e
SHA19c55824bd4f8bd46d05388b017113201de6f5a1d
SHA256e49ba33c49c921322c807d0ef21815cff0af3fc32c269c9f4cf32d57705b9c62
SHA51236d64f5250d167722cbf69f6259d87d04067ff3a779f7a4d8686a8566d7373e824a51933378d3dfca65cb341e6a096d9758c64cc17ceaafed4c7a6a870c19161
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
660KB
-
Filesize
192KB
-
Filesize
660KB
-
Filesize
192KB
-
Filesize
660KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
192KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
12KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
192KB
