Analysis
-
max time kernel
96s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
29-12-2024 18:31
General
-
Target
2024-12-29_bb5d5da1d5466da7c8f9f9934107a356_floxif_luca-stealer_magniber.exe
-
Size
10.2MB
-
MD5
bb5d5da1d5466da7c8f9f9934107a356
-
SHA1
fb50610d4d522d193efedb2bda725c7dc7bb8056
-
SHA256
631355e89fe833494f9e95afdd8e7184ac9eb48bf07538926efc0c490571d7f9
-
SHA512
1a197ea852eaeacb5cad5681a1d25c0b9ba980e286bceaea45de00e1b595d7fec837bfccfa7999bf0b3882f80d767bab5c0cdb453ddf38a221f9cb1d5be8f029
-
SSDEEP
196608:adad4T0xcsSB5orrcbSsi0s/lmPJ7N3VvXWrqufezvqG:GadCoXrlAJ7N3pXW2uGzyG
Malware Config
Signatures
-
Floxif family
-
Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
-
Detects Floxif payload 1 IoCs
-
Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 18 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 47 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
UPX packed file 11 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Program Files directory 2 IoCs
-
Drops file in Windows directory 17 IoCs
-
Browser Information Discovery 1 TTPs
Enumerate browser information.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer settings 1 TTPs 2 IoCs
-
Modifies system certificate store 2 TTPs 8 IoCs
-
Suspicious behavior: EnumeratesProcesses 16 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-29_bb5d5da1d5466da7c8f9f9934107a356_floxif_luca-stealer_magniber.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-29_bb5d5da1d5466da7c8f9f9934107a356_floxif_luca-stealer_magniber.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 012E52EBB1BA79BCF648C2DB0B5A27012⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1A6848DA-3673-48C3-A6CE-874D323BCAB8\lite_installer.exe"C:\Users\Admin\AppData\Local\Temp\1A6848DA-3673-48C3-A6CE-874D323BCAB8\lite_installer.exe" --use-user-default-locale --silent --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\BBCA8892-3ACE-4214-B9D2-3613D67CF9A6\seederexe.exe"C:\Users\Admin\AppData\Local\Temp\BBCA8892-3ACE-4214-B9D2-3613D67CF9A6\seederexe.exe" "--yqs=" "--yhp=" "--ilight=" "--oem=" "--nopin=n" "--pin_custom=n" "--pin_desktop=n" "--pin_taskbar=y" "--locale=us" "--browser=" "--browser_default=" "--loglevel=trace" "--ess=" "--clids=C:\Users\Admin\AppData\Local\Temp\clids-yasearch.xml" "--sender=C:\Users\Admin\AppData\Local\Temp\1034FADE-DE80-45E1-9AD3-DA976FD87FBA\sender.exe" "--is_elevated=yes" "--ui_level=5" "--good_token=x" "--no_opera=n"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1034FADE-DE80-45E1-9AD3-DA976FD87FBA\sender.exeC:\Users\Admin\AppData\Local\Temp\1034FADE-DE80-45E1-9AD3-DA976FD87FBA\sender.exe --send "/status.xml?clid=2414917&uuid=f297d378-95e6-4608-a124-4be154b786e5&vnt=Windows 10x64&file-no=8%0A15%0A25%0A45%0A57%0A59%0A102%0A111%0A125%0A129%0A"4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
-
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
575B
MD55b867b7f03ac3ec46b186b0c263b76dd
SHA183dc4f4858fab0c6f978b5aeac29d0ac31bb6d6a
SHA25656f2136c76e092f935e50407040bec33bfe4cc89b1878090d90111cb4cffc867
SHA5127ad0ce339d03744c64372099282251cc57db83126ebe1a41a42a97efd9fa52c23fa08b9812edb1140e927fbe075028a1282c52bbb74d280491b31f45b144d24e
-
Filesize
67KB
MD57574cf2c64f35161ab1292e2f532aabf
SHA114ba3fa927a06224dfe587014299e834def4644f
SHA256de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
SHA5124db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
-
Filesize
1KB
MD5740959436988f1c44208ddb07086c963
SHA13926a413a3fa7e3ebabe7a26fd6a57f77468b48f
SHA256f14f4b48dbc7b7f5a6f1196738e4d580254a08afbda1025096db7c43594f3544
SHA512ab1f1ba1a29ebbf5d84457d4eabe369e290324d40987dc8e0779eb1c311e980e16a6f101892f85db3a342f0ffcade5311e20380e301df0dedafcfea30b584520
-
Filesize
1KB
MD52ce7d38642a7377b048c5138fca9214a
SHA1dc4281273bada40898b040d11f832d566ff72b58
SHA2566079c97828fb8e96383a73056c135ff9f0dc2f1f2d2ee709fc63d23125030b0c
SHA512c9bdf227f0fda8eda3d110905057a103090e3314d75d35ca3aa5fa20119cf8961407a1fde673296607bfb7069c242058853df506896e084fb4bbcfce0a356345
-
Filesize
536B
MD5d7efa10377c4aa63937dc8f7d0884d56
SHA1f091781c13ba7e1b8cdb190daa7f5124a59bf20d
SHA25699fa5b4925e156cac775abea3cc1c45de55302b9a6a0dd56d2c88a110d7142bb
SHA5122b47ea68e262d2ad8be087682df6d846f089e8e8844c3c749cd31b662703983e1246b46905881d4d085deb02e30cd775af1beca4a378d29831884d871c30c8b6
-
Filesize
536B
MD5593075cb7a42a9fecc65bf8903d05e91
SHA16d149efdbff245260bd39e22cf8e477bc2ad6a50
SHA2568ca766cea459aced218f69591dc96e84f38b4751ca3b4f50cabac0ab314fdfb4
SHA512fd9d1503afdd03cd58125ccc465023dbfde2a3d31269c028074556d4a2adbaa2dc86e0237f5696571c3b073752de637f7a62334c246820589082196a40337df4
-
Filesize
260KB
MD5f1a8f60c018647902e70cf3869e1563f
SHA13caf9c51dfd75206d944d4c536f5f5ff8e225ae9
SHA25636022c6ecb3426791e6edee9074a3861fe5b660d98f2b2b7c13b80fe11a75577
SHA512c02dfd6276ad136283230cdf07d30ec2090562e6c60d6c0d4ac3110013780fcafd76e13931be53b924a35cf473d0f5ace2f6b5c3f1f70ce66b40338e53d38d1e
-
Filesize
337KB
MD5b3078f0a27d8656e92511d269b2b318b
SHA1b48d797bf98d2f030ba29e3e194b443a7fa78606
SHA256b03c1f89cd88fa858561c60ae91519a913296c5050ff93b88437f37ed483ab01
SHA512592324ce0b268a51294ca01f1ba39595996ec0b5cb17cae1bab9e0cb3f55aeac8514a3b75641fc56b3923c4c71a2b24345f92ff84a2836133c2d7d99c5078cbc
-
Filesize
419KB
MD5aafdfaa7a989ddb216510fc9ae5b877f
SHA141cf94692968a7d511b6051b7fe2b15c784770cb
SHA256688d0b782437ccfae2944281ade651a2da063f222e80b3510789dbdce8b00fdc
SHA5126e2b76ff6df79c6de6887cf739848d05c894fbd70dc9371fff95e6ccd9938d695c46516cb18ec8edd01e78cad1a6029a3d633895f7ddba4db4bf9cd39271bd44
-
Filesize
495KB
MD5f8a1d32bbf7c4b297a2ad6d5140d5aa4
SHA1a9da80ca1c399a5882612e4b58e02079189df906
SHA2563cfe1dd6fdf4c858b378c2866d1f15d0f878dacc6e9dc4517f06435dece0cc42
SHA5127908f790b2cbb945eccbd1c796ec596fd5ede4b5d595f31b29dcc44448bb2ca90e2244af3bc16cb48a4c1103fa04700b3e9effc68b60ce96d56cf0b6f9050e6b
-
Filesize
10.1MB
MD5a6e544cd5444adbb28a23ad13e021af6
SHA17e6202eb5a6d1b7d8dc8ccd1358c615ea08f231c
SHA256b385bafcb39d1f1058984f10820492b95c3a4532eb8e72d3a155b7e3ad34b3ab
SHA512c06e102c25e04365f907a68762c392226986bc872175b068a3c2501ad6d1624091580e1052205b557252b34410b55603d01a1c60b2701ecf25cab7a894ef4023
-
Filesize
8.6MB
MD5225ba20fa3edd13c9c72f600ff90e6cb
SHA15f1a9baa85c2afe29619e7cc848036d9174701e4
SHA25635585d12899435e13e186490fcf1d270adbe3c74a1e0578b3d9314858bf2d797
SHA51297e699cffe28d3c3611570d341ccbc1a0f0eec233c377c70e0e20d4ed3b956b6fe200a007f7e601a5724e733c97eaddc39d308b9af58d45f7598f10038d94ab3
-
Filesize
34KB
MD5de53c3292f55ae9feede02f845e6fef1
SHA1ff856a3c17ad7af27372606a591caada2c9d61a5
SHA25680c754d39f1d819707c6867d5029139809ac74e090a8b2a61093db1a8ffc9d03
SHA51291e2fcd4fc7653727ac50455523dcb16b93b7014623856f3746a629f6206e5540e6a08adbc858e0f44e9159b8fe06e1164e1322173a42bc0c9a5c2a62ed48fa7
-
Filesize
530B
MD5c0cfa158f6441d43bb397b15ca1675f3
SHA1afbab04c2907398d7f235b784f485bc18d3c1e72
SHA256add07fef94e1b178b2249b4e3e08617462ee947af47e8fea482ef709ed10ca3d
SHA512b0b78c5ad8629975d78d8db5c508eb9d361f322664e899623fd2d45f1eeedef828b91c02f514f5180300b081c1d049a99e69a1a2da558c8349cb23beea02e185
-
Filesize
42.1MB
MD5bf952b53408934f1d48596008f252b8d
SHA1758d76532fdb48c4aaf09a24922333c4e1de0d01
SHA2562183a97932f51d5b247646985b4e667d8be45f18731c418479bbd7743c825686
SHA512a510a96e17090ada1a107e0f6d4819787652ab3d38cd17237f255c736817c7cfcb3fd5cf25f56d5693f4923375b2ab9548e9215070e252aae25c3528b2186d99
-
Filesize
509B
MD505e3ea69740948960f63ad39f75944da
SHA1a130186e3072180eddd8cacb54d337f88779d057
SHA2565ded61233d99c2834af07bff0690a6a0e9c745229c59c5f4fb7aeb0ecc9c71cd
SHA51297c303c5b3cf7f2074bb093bf8e3640e1b6051294e7d2df9dd5b6957e42f1cff6032f1e82233e3fcae5d06404501204ea1f7e2f25ba645f119079e957c571bdd
-
Filesize
9.8MB
MD57d0bbbe45fcdf75ccc2ef62438f2e362
SHA1150a12869119484b43028b76f984d29cd5aa310b
SHA256278495b4f83bbf9ba5d1e9be4cabbb286b06a2e74e54448a91ac117847d184f2
SHA512f2de2bd795e68b3c6d95fa372fc6101076079d86d9eeb1bd2f05caac025fd3749617ea3713f992d4c2e781afd761591596136edc2d3e4ddc788c76da6fa095f0
-
Filesize
68KB
MD5314cb7ffb31e3cc676847e03108378ba
SHA13667d2ade77624e79d9efa08a2f1d33104ac6343
SHA256b6d278384a3684409a2a86f03e4f52869818ce7dd8b5779876960353f7d35dc1
SHA512dc795fa35ea214843a781ee2b2ef551b91b6841a799bef2c6fb1907d90f6c114071a951ebb7b2b30e81d52b594d447a26ab12ddb57c331e854577d11e5febef5
-
Filesize
1KB
MD53adec702d4472e3252ca8b58af62247c
SHA135d1d2f90b80dca80ad398f411c93fe8aef07435
SHA2562b167248e8136c4d45c2c46e2bff6fb5e5137dd4dfdccde998599be2df2e9335
SHA5127562e093d16ee6305c1bb143a3f5d60dafe8b5de74952709abc68a0c353b65416bf78b1fa1a6720331615898848c1464a7758c5dfe78f8098f77fbfa924784c0
-
Filesize
313B
MD5af006f1bcc57b11c3478be8babc036a8
SHA1c3bb4fa8c905565ca6a1f218e39fe7494910891e
SHA256ed6a32e11cc99728771989b01f5ae813de80c46a59d3dc68c23a4671a343cb8c
SHA5123d20689b0f39b414349c505be607e6bfc1f33ac401cf62a32f36f7114e4a486552f3e74661e90db29402bb85866944e9f8f31baba9605aa0c6def621511a26af
-
Filesize
38B
MD5d8e6aec2fbbd0456636902de16c9f552
SHA16b26a51c17833c680709996b4749dc5df9355575
SHA256a6f71ea07fd73ef56d598a3944f0f1fc995c0b28e92cbd3d185789db9d2d646e
SHA512ebb95fbffbd5f1f0fe286d89c1bc5903426b54c1506bd775180f3b70178a7f3b7c1ae5570357b4e6c961f20bdc967f4c038ca6bf8f9cbea531f3fde26ed36bfc
-
Filesize
181KB
MD50c80a997d37d930e7317d6dac8bb7ae1
SHA1018f13dfa43e103801a69a20b1fab0d609ace8a5
SHA256a5dd2f97c6787c335b7807ff9b6966877e9dd811f9e26326837a7d2bd224de86
SHA512fe1caef6d727344c60df52380a6e4ab90ae1a8eb5f96d6054eced1b7734357ce080d944fa518cf1366e14c4c0bd9a41db679738a860800430034a75bb90e51a5
-
Filesize
189KB
MD5e6fd0e66cf3bfd3cc04a05647c3c7c54
SHA16a1b7f1a45fb578de6492af7e2fede15c866739f
SHA256669cc0aae068ced3154acaecb0c692c4c5e61bc2ca95b40395a3399e75fcb9b2
SHA512fc8613f31acaf6155852d3ad6130fc3b76674b463dcdcfcd08a3b367dfd9e5b991e3f0a26994bcaf42f9e863a46a81e2520e77b1d99f703bcb08800bdca4efcb
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
12KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
420KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
264KB