floxif | 631355e89fe833494f9e95afdd8e7184ac9eb48bf07538926efc0c490571d7f9

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
29-12-2024 18:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-12-29_bb5d5da1d5466da7c8f9f9934107a356_floxif_luca-stealer_magniber.exe
Size

10.2MB
MD5

bb5d5da1d5466da7c8f9f9934107a356
SHA1

fb50610d4d522d193efedb2bda725c7dc7bb8056
SHA256

631355e89fe833494f9e95afdd8e7184ac9eb48bf07538926efc0c490571d7f9
SHA512

1a197ea852eaeacb5cad5681a1d25c0b9ba980e286bceaea45de00e1b595d7fec837bfccfa7999bf0b3882f80d767bab5c0cdb453ddf38a221f9cb1d5be8f029
SSDEEP

196608:adad4T0xcsSB5orrcbSsi0s/lmPJ7N3VvXWrqufezvqG:GadCoXrlAJ7N3pXW2uGzyG

Score

10^/10

floxif backdoor discovery spyware stealer trojan upx

Malware Config

Signatures

Floxif family
floxif
Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
backdoor trojan floxif

Detects Floxif payload 1 IoCs

backdoor

resource	yara_rule
behavioral1/files/0x0007000000012117-1.dat	floxif

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x0007000000012117-1.dat	acprotect

Executes dropped EXE 3 IoCs

pid	Process
2816	lite_installer.exe
2180	seederexe.exe
14328	sender.exe

Loads dropped DLL 14 IoCs

pid	Process
2700	2024-12-29_bb5d5da1d5466da7c8f9f9934107a356_floxif_luca-stealer_magniber.exe
3008	MsiExec.exe
3008	MsiExec.exe
3008	MsiExec.exe
3008	MsiExec.exe
3008	MsiExec.exe
3008	MsiExec.exe
3008	MsiExec.exe
3008	MsiExec.exe
3008	MsiExec.exe
3008	MsiExec.exe
3008	MsiExec.exe
3008	MsiExec.exe
2180	seederexe.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Blocklisted process makes network request 1 IoCs

flow	pid	Process
8	2148	msiexec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 47 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	2024-12-29_bb5d5da1d5466da7c8f9f9934107a356_floxif_luca-stealer_magniber.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	2024-12-29_bb5d5da1d5466da7c8f9f9934107a356_floxif_luca-stealer_magniber.exe
File opened (read-only)	\??\H:	2024-12-29_bb5d5da1d5466da7c8f9f9934107a356_floxif_luca-stealer_magniber.exe
File opened (read-only)	\??\K:	2024-12-29_bb5d5da1d5466da7c8f9f9934107a356_floxif_luca-stealer_magniber.exe
File opened (read-only)	\??\P:	2024-12-29_bb5d5da1d5466da7c8f9f9934107a356_floxif_luca-stealer_magniber.exe
File opened (read-only)	\??\Q:	2024-12-29_bb5d5da1d5466da7c8f9f9934107a356_floxif_luca-stealer_magniber.exe
File opened (read-only)	\??\V:	2024-12-29_bb5d5da1d5466da7c8f9f9934107a356_floxif_luca-stealer_magniber.exe
File opened (read-only)	\??\W:	2024-12-29_bb5d5da1d5466da7c8f9f9934107a356_floxif_luca-stealer_magniber.exe
File opened (read-only)	\??\e:	2024-12-29_bb5d5da1d5466da7c8f9f9934107a356_floxif_luca-stealer_magniber.exe
File opened (read-only)	\??\E:	2024-12-29_bb5d5da1d5466da7c8f9f9934107a356_floxif_luca-stealer_magniber.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\N:	2024-12-29_bb5d5da1d5466da7c8f9f9934107a356_floxif_luca-stealer_magniber.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\M:	2024-12-29_bb5d5da1d5466da7c8f9f9934107a356_floxif_luca-stealer_magniber.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\S:	2024-12-29_bb5d5da1d5466da7c8f9f9934107a356_floxif_luca-stealer_magniber.exe
File opened (read-only)	\??\B:	2024-12-29_bb5d5da1d5466da7c8f9f9934107a356_floxif_luca-stealer_magniber.exe
File opened (read-only)	\??\X:	2024-12-29_bb5d5da1d5466da7c8f9f9934107a356_floxif_luca-stealer_magniber.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	2024-12-29_bb5d5da1d5466da7c8f9f9934107a356_floxif_luca-stealer_magniber.exe
File opened (read-only)	\??\U:	2024-12-29_bb5d5da1d5466da7c8f9f9934107a356_floxif_luca-stealer_magniber.exe
File opened (read-only)	\??\Z:	2024-12-29_bb5d5da1d5466da7c8f9f9934107a356_floxif_luca-stealer_magniber.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	2024-12-29_bb5d5da1d5466da7c8f9f9934107a356_floxif_luca-stealer_magniber.exe
File opened (read-only)	\??\J:	2024-12-29_bb5d5da1d5466da7c8f9f9934107a356_floxif_luca-stealer_magniber.exe
File opened (read-only)	\??\O:	2024-12-29_bb5d5da1d5466da7c8f9f9934107a356_floxif_luca-stealer_magniber.exe
File opened (read-only)	\??\R:	2024-12-29_bb5d5da1d5466da7c8f9f9934107a356_floxif_luca-stealer_magniber.exe
File opened (read-only)	\??\Y:	2024-12-29_bb5d5da1d5466da7c8f9f9934107a356_floxif_luca-stealer_magniber.exe
File opened (read-only)	\??\I:	2024-12-29_bb5d5da1d5466da7c8f9f9934107a356_floxif_luca-stealer_magniber.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0007000000012117-1.dat	upx
behavioral1/memory/2700-3-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2700-288-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\symsrv.dll	2024-12-29_bb5d5da1d5466da7c8f9f9934107a356_floxif_luca-stealer_magniber.exe

Drops file in Windows directory 16 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIABAE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIABBE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIABEE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAC3D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\f76a7b5.ipi	msiexec.exe
File created	C:\Windows\Installer\f76a7b4.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIACFB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\f76a7b4.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAA84.tmp	msiexec.exe
File created	C:\Windows\Installer\f76a7b5.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIACAC.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAC6D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAD79.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA9F6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAA54.tmp	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-12-29_bb5d5da1d5466da7c8f9f9934107a356_floxif_luca-stealer_magniber.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lite_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	seederexe.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\SearchScopes	seederexe.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	seederexe.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C	2024-12-29_bb5d5da1d5466da7c8f9f9934107a356_floxif_luca-stealer_magniber.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C\Blob = 030000000100000014000000d89e3bd43d5d909b47a18977aa9d5ce36cee184c1400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb040000000100000010000000285ec909c4ab0d2d57f5086b225799aa0f000000010000003000000013baa039635f1c5292a8c2f36aae7e1d25c025202e9092f5b0f53f5f752dfa9c71b3d1b8d9a6358fcee6ec75622fabf9190000000100000010000000ea6089055218053dd01e37e1d806eedf1800000001000000100000002aa1c05e2ae606f198c2c5e937c97aa22000000001000000850500003082058130820469a00302010202103972443af922b751d7d36c10dd313595300d06092a864886f70d01010c0500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3139303331323030303030305a170d3238313233313233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a381f23081ef301f0603551d23041830168014a0110a233e96f107ece2af29ef82a57fd030a4b4301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff30110603551d20040a300830060604551d200030430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010c05000382010100188751dc74213d9c8ae027b733d02eccecf0e6cb5e11de226f9b758e9e72fee4d6feaa1f9c962def034a7eaef48d6f723c433bc03febb8df5caaa9c6aef2fcd8eea37b43f686367c14e0cdf4f73ffedeb8b48af09196fefd43647efdccd201a17d7df81919c9422b13bf588bbaa4a266047688914e0c8914cea24dc932b3bae8141abc71f15bf0410b98000a220310e50cb1f9cd923719ed3bf1e43ab6f945132675afbbaaef3f7b773bd2c402913d1900d3175c39db3f7b180d45cd9385962f5ddf59164f3f51bdd545183fed4a8ee80661742316b50d50732744477f105d892a6b853114c4e8a96a4c80bc6a78cfb87f8e7672990c9dfed7910816a1a35f95	2024-12-29_bb5d5da1d5466da7c8f9f9934107a356_floxif_luca-stealer_magniber.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
2700	2024-12-29_bb5d5da1d5466da7c8f9f9934107a356_floxif_luca-stealer_magniber.exe
2700	2024-12-29_bb5d5da1d5466da7c8f9f9934107a356_floxif_luca-stealer_magniber.exe
2148	msiexec.exe
2148	msiexec.exe
2816	lite_installer.exe
2816	lite_installer.exe
2816	lite_installer.exe
2816	lite_installer.exe
2180	seederexe.exe
14328	sender.exe
14328	sender.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2700	2024-12-29_bb5d5da1d5466da7c8f9f9934107a356_floxif_luca-stealer_magniber.exe
Token: SeShutdownPrivilege	2700	2024-12-29_bb5d5da1d5466da7c8f9f9934107a356_floxif_luca-stealer_magniber.exe
Token: SeIncreaseQuotaPrivilege	2700	2024-12-29_bb5d5da1d5466da7c8f9f9934107a356_floxif_luca-stealer_magniber.exe
Token: SeRestorePrivilege	2148	msiexec.exe
Token: SeTakeOwnershipPrivilege	2148	msiexec.exe
Token: SeSecurityPrivilege	2148	msiexec.exe
Token: SeCreateTokenPrivilege	2700	2024-12-29_bb5d5da1d5466da7c8f9f9934107a356_floxif_luca-stealer_magniber.exe
Token: SeAssignPrimaryTokenPrivilege	2700	2024-12-29_bb5d5da1d5466da7c8f9f9934107a356_floxif_luca-stealer_magniber.exe
Token: SeLockMemoryPrivilege	2700	2024-12-29_bb5d5da1d5466da7c8f9f9934107a356_floxif_luca-stealer_magniber.exe
Token: SeIncreaseQuotaPrivilege	2700	2024-12-29_bb5d5da1d5466da7c8f9f9934107a356_floxif_luca-stealer_magniber.exe
Token: SeMachineAccountPrivilege	2700	2024-12-29_bb5d5da1d5466da7c8f9f9934107a356_floxif_luca-stealer_magniber.exe
Token: SeTcbPrivilege	2700	2024-12-29_bb5d5da1d5466da7c8f9f9934107a356_floxif_luca-stealer_magniber.exe
Token: SeSecurityPrivilege	2700	2024-12-29_bb5d5da1d5466da7c8f9f9934107a356_floxif_luca-stealer_magniber.exe
Token: SeTakeOwnershipPrivilege	2700	2024-12-29_bb5d5da1d5466da7c8f9f9934107a356_floxif_luca-stealer_magniber.exe
Token: SeLoadDriverPrivilege	2700	2024-12-29_bb5d5da1d5466da7c8f9f9934107a356_floxif_luca-stealer_magniber.exe
Token: SeSystemProfilePrivilege	2700	2024-12-29_bb5d5da1d5466da7c8f9f9934107a356_floxif_luca-stealer_magniber.exe
Token: SeSystemtimePrivilege	2700	2024-12-29_bb5d5da1d5466da7c8f9f9934107a356_floxif_luca-stealer_magniber.exe
Token: SeProfSingleProcessPrivilege	2700	2024-12-29_bb5d5da1d5466da7c8f9f9934107a356_floxif_luca-stealer_magniber.exe
Token: SeIncBasePriorityPrivilege	2700	2024-12-29_bb5d5da1d5466da7c8f9f9934107a356_floxif_luca-stealer_magniber.exe
Token: SeCreatePagefilePrivilege	2700	2024-12-29_bb5d5da1d5466da7c8f9f9934107a356_floxif_luca-stealer_magniber.exe
Token: SeCreatePermanentPrivilege	2700	2024-12-29_bb5d5da1d5466da7c8f9f9934107a356_floxif_luca-stealer_magniber.exe
Token: SeBackupPrivilege	2700	2024-12-29_bb5d5da1d5466da7c8f9f9934107a356_floxif_luca-stealer_magniber.exe
Token: SeRestorePrivilege	2700	2024-12-29_bb5d5da1d5466da7c8f9f9934107a356_floxif_luca-stealer_magniber.exe
Token: SeShutdownPrivilege	2700	2024-12-29_bb5d5da1d5466da7c8f9f9934107a356_floxif_luca-stealer_magniber.exe
Token: SeDebugPrivilege	2700	2024-12-29_bb5d5da1d5466da7c8f9f9934107a356_floxif_luca-stealer_magniber.exe
Token: SeAuditPrivilege	2700	2024-12-29_bb5d5da1d5466da7c8f9f9934107a356_floxif_luca-stealer_magniber.exe
Token: SeSystemEnvironmentPrivilege	2700	2024-12-29_bb5d5da1d5466da7c8f9f9934107a356_floxif_luca-stealer_magniber.exe
Token: SeChangeNotifyPrivilege	2700	2024-12-29_bb5d5da1d5466da7c8f9f9934107a356_floxif_luca-stealer_magniber.exe
Token: SeRemoteShutdownPrivilege	2700	2024-12-29_bb5d5da1d5466da7c8f9f9934107a356_floxif_luca-stealer_magniber.exe
Token: SeUndockPrivilege	2700	2024-12-29_bb5d5da1d5466da7c8f9f9934107a356_floxif_luca-stealer_magniber.exe
Token: SeSyncAgentPrivilege	2700	2024-12-29_bb5d5da1d5466da7c8f9f9934107a356_floxif_luca-stealer_magniber.exe
Token: SeEnableDelegationPrivilege	2700	2024-12-29_bb5d5da1d5466da7c8f9f9934107a356_floxif_luca-stealer_magniber.exe
Token: SeManageVolumePrivilege	2700	2024-12-29_bb5d5da1d5466da7c8f9f9934107a356_floxif_luca-stealer_magniber.exe
Token: SeImpersonatePrivilege	2700	2024-12-29_bb5d5da1d5466da7c8f9f9934107a356_floxif_luca-stealer_magniber.exe
Token: SeCreateGlobalPrivilege	2700	2024-12-29_bb5d5da1d5466da7c8f9f9934107a356_floxif_luca-stealer_magniber.exe
Token: SeRestorePrivilege	2148	msiexec.exe
Token: SeTakeOwnershipPrivilege	2148	msiexec.exe
Token: SeRestorePrivilege	2148	msiexec.exe
Token: SeTakeOwnershipPrivilege	2148	msiexec.exe
Token: SeRestorePrivilege	2148	msiexec.exe
Token: SeTakeOwnershipPrivilege	2148	msiexec.exe
Token: SeRestorePrivilege	2148	msiexec.exe
Token: SeTakeOwnershipPrivilege	2148	msiexec.exe
Token: SeRestorePrivilege	2148	msiexec.exe
Token: SeTakeOwnershipPrivilege	2148	msiexec.exe
Token: SeRestorePrivilege	2148	msiexec.exe
Token: SeTakeOwnershipPrivilege	2148	msiexec.exe
Token: SeRestorePrivilege	2148	msiexec.exe
Token: SeTakeOwnershipPrivilege	2148	msiexec.exe
Token: SeRestorePrivilege	2148	msiexec.exe
Token: SeTakeOwnershipPrivilege	2148	msiexec.exe
Token: SeRestorePrivilege	2148	msiexec.exe
Token: SeTakeOwnershipPrivilege	2148	msiexec.exe
Token: SeRestorePrivilege	2148	msiexec.exe
Token: SeTakeOwnershipPrivilege	2148	msiexec.exe
Token: SeRestorePrivilege	2148	msiexec.exe
Token: SeTakeOwnershipPrivilege	2148	msiexec.exe
Token: SeRestorePrivilege	2148	msiexec.exe
Token: SeTakeOwnershipPrivilege	2148	msiexec.exe
Token: SeRestorePrivilege	2148	msiexec.exe
Token: SeTakeOwnershipPrivilege	2148	msiexec.exe
Token: SeRestorePrivilege	2148	msiexec.exe
Token: SeTakeOwnershipPrivilege	2148	msiexec.exe
Token: SeRestorePrivilege	2148	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2700	2024-12-29_bb5d5da1d5466da7c8f9f9934107a356_floxif_luca-stealer_magniber.exe
2700	2024-12-29_bb5d5da1d5466da7c8f9f9934107a356_floxif_luca-stealer_magniber.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 3008	2148	msiexec.exe	31
PID 2148 wrote to memory of 3008	2148	msiexec.exe	31
PID 2148 wrote to memory of 3008	2148	msiexec.exe	31
PID 2148 wrote to memory of 3008	2148	msiexec.exe	31
PID 2148 wrote to memory of 3008	2148	msiexec.exe	31
PID 2148 wrote to memory of 3008	2148	msiexec.exe	31
PID 2148 wrote to memory of 3008	2148	msiexec.exe	31
PID 3008 wrote to memory of 2816	3008	MsiExec.exe	32
PID 3008 wrote to memory of 2816	3008	MsiExec.exe	32
PID 3008 wrote to memory of 2816	3008	MsiExec.exe	32
PID 3008 wrote to memory of 2816	3008	MsiExec.exe	32
PID 3008 wrote to memory of 2816	3008	MsiExec.exe	32
PID 3008 wrote to memory of 2816	3008	MsiExec.exe	32
PID 3008 wrote to memory of 2816	3008	MsiExec.exe	32
PID 3008 wrote to memory of 2180	3008	MsiExec.exe	33
PID 3008 wrote to memory of 2180	3008	MsiExec.exe	33
PID 3008 wrote to memory of 2180	3008	MsiExec.exe	33
PID 3008 wrote to memory of 2180	3008	MsiExec.exe	33
PID 2180 wrote to memory of 14328	2180	seederexe.exe	34
PID 2180 wrote to memory of 14328	2180	seederexe.exe	34
PID 2180 wrote to memory of 14328	2180	seederexe.exe	34
PID 2180 wrote to memory of 14328	2180	seederexe.exe	34

C:\Users\Admin\AppData\Local\Temp\2024-12-29_bb5d5da1d5466da7c8f9f9934107a356_floxif_luca-stealer_magniber.exe
"C:\Users\Admin\AppData\Local\Temp\2024-12-29_bb5d5da1d5466da7c8f9f9934107a356_floxif_luca-stealer_magniber.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2700

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B63C2281D053DF034765A49F27510532
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3008
- - C:\Users\Admin\AppData\Local\Temp\2FB4959F-68F9-44A6-910A-65F94DE92514\lite_installer.exe
    "C:\Users\Admin\AppData\Local\Temp\2FB4959F-68F9-44A6-910A-65F94DE92514\lite_installer.exe" --use-user-default-locale --silent --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2816
- - C:\Users\Admin\AppData\Local\Temp\CAC1A1B0-FC58-4914-B581-501194F658B9\seederexe.exe
    "C:\Users\Admin\AppData\Local\Temp\CAC1A1B0-FC58-4914-B581-501194F658B9\seederexe.exe" "--yqs=" "--yhp=" "--ilight=" "--oem=" "--nopin=n" "--pin_custom=n" "--pin_desktop=n" "--pin_taskbar=y" "--locale=us" "--browser=" "--browser_default=" "--loglevel=trace" "--ess=" "--clids=C:\Users\Admin\AppData\Local\Temp\clids-yasearch.xml" "--sender=C:\Users\Admin\AppData\Local\Temp\C1216664-F4B9-49D8-A447-72161F3CF8B8\sender.exe" "--is_elevated=yes" "--ui_level=5" "--good_token=x" "--no_opera=n"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2180
  - - C:\Users\Admin\AppData\Local\Temp\C1216664-F4B9-49D8-A447-72161F3CF8B8\sender.exe
      C:\Users\Admin\AppData\Local\Temp\C1216664-F4B9-49D8-A447-72161F3CF8B8\sender.exe --send "/status.xml?clid=2414917&uuid=fcffd4fd-9B8E-4CAC-8E38-5C0E00F9db46&vnt=Windows 7x64&file-no=6%0A15%0A25%0A45%0A57%0A59%0A111%0A125%0A129%0A"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:14328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f76a7b6.rbs

Filesize
575B

MD5
6b97603464fd9b600a6734f735d85843

SHA1
64fd61821337d3c0beb430b4a72caafefde9803e

SHA256
bb571c966008882bc9769b97c1ab4f0c7e09dbb212918ca87e69c20fe98a8267

SHA512
39b81e1fdb988f2d1a082ed753017c8690b360237a8439528159cbfc78a300c81ac5f03824730bcce2d217361518862e8a3476be82af62024b0e359b5f6a1812

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a6f4dd9a8a812bcfaa9efdec60eead58

SHA1
40c938d3b5965a174bb4fe21962c7ab44c578553

SHA256
8dc8438a329dbefd29c63e48be3bf30f59bcf4a9cf85df3d883fd3f930ca03ff

SHA512
164810eaea8d5fa28bc9e5ea9fc217dba8c26492c8dd0b71d562626b460c9f685dae47b7a03f8effe7a73d7f5f906c959255369009b3bc2e2569def4ff4b9cd0

Download Submit
C:\Users\Admin\AppData\Local\Temp\2FB4959F-68F9-44A6-910A-65F94DE92514\lite_installer.exe

Filesize
419KB

MD5
aafdfaa7a989ddb216510fc9ae5b877f

SHA1
41cf94692968a7d511b6051b7fe2b15c784770cb

SHA256
688d0b782437ccfae2944281ade651a2da063f222e80b3510789dbdce8b00fdc

SHA512
6e2b76ff6df79c6de6887cf739848d05c894fbd70dc9371fff95e6ccd9938d695c46516cb18ec8edd01e78cad1a6029a3d633895f7ddba4db4bf9cd39271bd44

Download Submit
C:\Users\Admin\AppData\Local\Temp\CAC1A1B0-FC58-4914-B581-501194F658B9\seederexe.exe

Filesize
8.6MB

MD5
225ba20fa3edd13c9c72f600ff90e6cb

SHA1
5f1a9baa85c2afe29619e7cc848036d9174701e4

SHA256
35585d12899435e13e186490fcf1d270adbe3c74a1e0578b3d9314858bf2d797

SHA512
97e699cffe28d3c3611570d341ccbc1a0f0eec233c377c70e0e20d4ed3b956b6fe200a007f7e601a5724e733c97eaddc39d308b9af58d45f7598f10038d94ab3

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA45C.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\OMNIJA~1.ZIP

Filesize
41.3MB

MD5
1d6cfd7db58008d1b44328c5a3a4220c

SHA1
8e8304bfd7a73b9ae8415b6cbd273e612868a2b2

SHA256
915e46dcc29d6fee123c4b8e88d846ac95ffd4a6f4eb956dc882d305ee1b8256

SHA512
4c17160aa83abeff897462f981226902dd6694817ad95f246511fc63c637bdffa0989a3db00c4309fa673a13b4993c509df538ddad482d1be8b4058749ee93f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA46F.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\YandexSearch00000.log

Filesize
34KB

MD5
bf7d77443aa554132af0882d6dac737e

SHA1
58b34dab158f505e1d4ab100288ab81acb2873f4

SHA256
04a4e2202d963970684412741371a7149eeef02d9af71c95447b24f641a359ab

SHA512
b4d75297a2e8eea20960b7d2963db3572b8c10b8f84bc39cd40332e98d511ab593fa0535478fa4edbe80dbf8359be19c59b1e5bf283d010cdfe2714e40fa9470

Download Submit
C:\Users\Admin\AppData\Local\Temp\clids-yasearch.xml

Filesize
530B

MD5
c0cfa158f6441d43bb397b15ca1675f3

SHA1
afbab04c2907398d7f235b784f485bc18d3c1e72

SHA256
add07fef94e1b178b2249b4e3e08617462ee947af47e8fea482ef709ed10ca3d

SHA512
b0b78c5ad8629975d78d8db5c508eb9d361f322664e899623fd2d45f1eeedef828b91c02f514f5180300b081c1d049a99e69a1a2da558c8349cb23beea02e185

Download Submit
C:\Users\Admin\AppData\Local\Temp\vendor00000.xml

Filesize
509B

MD5
05e3ea69740948960f63ad39f75944da

SHA1
a130186e3072180eddd8cacb54d337f88779d057

SHA256
5ded61233d99c2834af07bff0690a6a0e9c745229c59c5f4fb7aeb0ecc9c71cd

SHA512
97c303c5b3cf7f2074bb093bf8e3640e1b6051294e7d2df9dd5b6957e42f1cff6032f1e82233e3fcae5d06404501204ea1f7e2f25ba645f119079e957c571bdd

Download Submit
C:\Users\Admin\AppData\Local\Temp\{5B964E0E-B9A3-4276-9ED9-4D5A5720747A}\YandexSearch.msi

Filesize
9.8MB

MD5
7d0bbbe45fcdf75ccc2ef62438f2e362

SHA1
150a12869119484b43028b76f984d29cd5aa310b

SHA256
278495b4f83bbf9ba5d1e9be4cabbb286b06a2e74e54448a91ac117847d184f2

SHA512
f2de2bd795e68b3c6d95fa372fc6101076079d86d9eeb1bd2f05caac025fd3749617ea3713f992d4c2e781afd761591596136edc2d3e4ddc788c76da6fa095f0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.Admin\places.sqlite-20241229184332.224600.backup

Filesize
68KB

MD5
314cb7ffb31e3cc676847e03108378ba

SHA1
3667d2ade77624e79d9efa08a2f1d33104ac6343

SHA256
b6d278384a3684409a2a86f03e4f52869818ce7dd8b5779876960353f7d35dc1

SHA512
dc795fa35ea214843a781ee2b2ef551b91b6841a799bef2c6fb1907d90f6c114071a951ebb7b2b30e81d52b594d447a26ab12ddb57c331e854577d11e5febef5

Download Submit
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Bookmarks-20241229184332.552200.backup

Filesize
1KB

MD5
3adec702d4472e3252ca8b58af62247c

SHA1
35d1d2f90b80dca80ad398f411c93fe8aef07435

SHA256
2b167248e8136c4d45c2c46e2bff6fb5e5137dd4dfdccde998599be2df2e9335

SHA512
7562e093d16ee6305c1bb143a3f5d60dafe8b5de74952709abc68a0c353b65416bf78b1fa1a6720331615898848c1464a7758c5dfe78f8098f77fbfa924784c0

Download Submit
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Preferences-20241229184332.552200.backup

Filesize
313B

MD5
af006f1bcc57b11c3478be8babc036a8

SHA1
c3bb4fa8c905565ca6a1f218e39fe7494910891e

SHA256
ed6a32e11cc99728771989b01f5ae813de80c46a59d3dc68c23a4671a343cb8c

SHA512
3d20689b0f39b414349c505be607e6bfc1f33ac401cf62a32f36f7114e4a486552f3e74661e90db29402bb85866944e9f8f31baba9605aa0c6def621511a26af

Download Submit
C:\Users\Admin\AppData\Roaming\Yandex\ui

Filesize
36B

MD5
94b8c570da65f0382dc628911bdf6e3c

SHA1
de4edb7fc56c7b00a8bc99c1af8a42b0bc54d4ed

SHA256
7f4d018a7906cd70fac14503784256b9567277a4329974a93e7be007238ec8bb

SHA512
728c38c4a1726e30edcdcd6b0ae304856bb7c8408914cf2db7292e028988348dcfe959e89cee33f661728d47defec0dacab5ce1417c11fcd4c0a0c26e81902b9

Download Submit
C:\Windows\Installer\MSIA9F6.tmp

Filesize
181KB

MD5
0c80a997d37d930e7317d6dac8bb7ae1

SHA1
018f13dfa43e103801a69a20b1fab0d609ace8a5

SHA256
a5dd2f97c6787c335b7807ff9b6966877e9dd811f9e26326837a7d2bd224de86

SHA512
fe1caef6d727344c60df52380a6e4ab90ae1a8eb5f96d6054eced1b7734357ce080d944fa518cf1366e14c4c0bd9a41db679738a860800430034a75bb90e51a5

Download Submit
C:\Windows\Installer\MSIAA54.tmp

Filesize
189KB

MD5
e6fd0e66cf3bfd3cc04a05647c3c7c54

SHA1
6a1b7f1a45fb578de6492af7e2fede15c866739f

SHA256
669cc0aae068ced3154acaecb0c692c4c5e61bc2ca95b40395a3399e75fcb9b2

SHA512
fc8613f31acaf6155852d3ad6130fc3b76674b463dcdcfcd08a3b367dfd9e5b991e3f0a26994bcaf42f9e863a46a81e2520e77b1d99f703bcb08800bdca4efcb

Download Submit
\Program Files\Common Files\System\symsrv.dll

Filesize
67KB

MD5
7574cf2c64f35161ab1292e2f532aabf

SHA1
14ba3fa927a06224dfe587014299e834def4644f

SHA256
de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085

SHA512
4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab

Download Submit
\Users\Admin\AppData\Local\Temp\C1216664-F4B9-49D8-A447-72161F3CF8B8\sender.exe

Filesize
260KB

MD5
f1a8f60c018647902e70cf3869e1563f

SHA1
3caf9c51dfd75206d944d4c536f5f5ff8e225ae9

SHA256
36022c6ecb3426791e6edee9074a3861fe5b660d98f2b2b7c13b80fe11a75577

SHA512
c02dfd6276ad136283230cdf07d30ec2090562e6c60d6c0d4ac3110013780fcafd76e13931be53b924a35cf473d0f5ace2f6b5c3f1f70ce66b40338e53d38d1e

Download Submit
memory/2700-3-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2700-288-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2700-5-0x0000000000411000-0x0000000000414000-memory.dmp

Filesize
12KB

Download