floxif | 7b1d1317dc53d410b3b8c7f09e3affa4cd7ebbfae80c89a3147752c461503e7b

Analysis

max time kernel
94s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2024 00:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7b1d1317dc53d410b3b8c7f09e3affa4cd7ebbfae80c89a3147752c461503e7b.exe
Size

295KB
MD5

20fecfdda605a23d8236b0d515156c89
SHA1

b47402b373a3c7ff0a96dbf42f498d12448a840d
SHA256

7b1d1317dc53d410b3b8c7f09e3affa4cd7ebbfae80c89a3147752c461503e7b
SHA512

02625a91892b839f7d859b9952334acf37cce18789743abbabf9f706f6432d2d787240658080cf0ba2cd708e524c9513028cc018c309875074638bbf9795ef99
SSDEEP

6144:5BYvHkL6agJ2uMYKNUhJ5E5wW+u3BV+UdvrEFp7hK1o:5mvkL61J2uyiJ5E5Ou3BjvrEH7Wo

Score

10^/10

floxif backdoor bootkit discovery persistence privilege_escalation trojan upx

Malware Config

Signatures

Floxif family
floxif
Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
backdoor trojan floxif

Detects Floxif payload 1 IoCs

backdoor

resource	yara_rule
behavioral2/files/0x0008000000023ca1-1.dat	floxif

Downloads MZ/PE file
Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x0008000000023ca1-1.dat	acprotect

Executes dropped EXE 2 IoCs

pid	Process
992	CS16Launcher.exe
3092	hl.exe

Loads dropped DLL 19 IoCs

pid	Process
4236	7b1d1317dc53d410b3b8c7f09e3affa4cd7ebbfae80c89a3147752c461503e7b.exe
992	CS16Launcher.exe
992	CS16Launcher.exe
3092	hl.exe
3092	hl.exe
3092	hl.exe
3092	hl.exe
3092	hl.exe
3092	hl.exe
3092	hl.exe
3092	hl.exe
3092	hl.exe
3092	hl.exe
3092	hl.exe
3092	hl.exe
3092	hl.exe
3092	hl.exe
3092	hl.exe
3092	hl.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\e:	7b1d1317dc53d410b3b8c7f09e3affa4cd7ebbfae80c89a3147752c461503e7b.exe
File opened (read-only)	\??\e:	CS16Launcher.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	hl.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0008000000023ca1-1.dat	upx
behavioral2/memory/4236-4-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/4236-21-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/992-27-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/3092-168-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/992-190-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/992-209-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/3092-213-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\symsrv.dll	7b1d1317dc53d410b3b8c7f09e3affa4cd7ebbfae80c89a3147752c461503e7b.exe
File created	\??\c:\progra~1\common~1\system\symsrv.dll.000	CS16Launcher.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7b1d1317dc53d410b3b8c7f09e3affa4cd7ebbfae80c89a3147752c461503e7b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CS16Launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hl.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4236	7b1d1317dc53d410b3b8c7f09e3affa4cd7ebbfae80c89a3147752c461503e7b.exe
4236	7b1d1317dc53d410b3b8c7f09e3affa4cd7ebbfae80c89a3147752c461503e7b.exe
992	CS16Launcher.exe
992	CS16Launcher.exe
3092	hl.exe
3092	hl.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4236	7b1d1317dc53d410b3b8c7f09e3affa4cd7ebbfae80c89a3147752c461503e7b.exe
Token: SeDebugPrivilege	992	CS16Launcher.exe
Token: SeDebugPrivilege	3092	hl.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3092	hl.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4236 wrote to memory of 992	4236	7b1d1317dc53d410b3b8c7f09e3affa4cd7ebbfae80c89a3147752c461503e7b.exe	83
PID 4236 wrote to memory of 992	4236	7b1d1317dc53d410b3b8c7f09e3affa4cd7ebbfae80c89a3147752c461503e7b.exe	83
PID 4236 wrote to memory of 992	4236	7b1d1317dc53d410b3b8c7f09e3affa4cd7ebbfae80c89a3147752c461503e7b.exe	83
PID 992 wrote to memory of 3092	992	CS16Launcher.exe	84
PID 992 wrote to memory of 3092	992	CS16Launcher.exe	84
PID 992 wrote to memory of 3092	992	CS16Launcher.exe	84

C:\Users\Admin\AppData\Local\Temp\7b1d1317dc53d410b3b8c7f09e3affa4cd7ebbfae80c89a3147752c461503e7b.exe
"C:\Users\Admin\AppData\Local\Temp\7b1d1317dc53d410b3b8c7f09e3affa4cd7ebbfae80c89a3147752c461503e7b.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4236
- C:\Users\Admin\AppData\Local\Temp\CS16Launcher.exe
  "C:\Users\Admin\AppData\Local\Temp\7b1d1317dc53d410b3b8c7f09e3affa4cd7ebbfae80c89a3147752c461503e7b.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Enumerates connected drives
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:992
- - C:\Users\Admin\AppData\Local\Temp\hl.exe
    -steam -game cstrike -noforcemparms -noforcemaccel
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Writes to the Master Boot Record (MBR)
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:3092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\System\symsrv.dll

Filesize
67KB

MD5
7574cf2c64f35161ab1292e2f532aabf

SHA1
14ba3fa927a06224dfe587014299e834def4644f

SHA256
de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085

SHA512
4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\CS16Launcher.exe

Filesize
219KB

MD5
002569d719a892cefdee47b40fb9de9d

SHA1
c87baaf1db6f143eafceafb0e10be366a729cff7

SHA256
a8b816e969bbb052ac822e0dcd4ef7021dd0e14bde5a17e58f9756cfd4209746

SHA512
00f19ef8b9ef56a889f31896bfba7171bb43e48a2fc2d514a38952c6d1ce122b53a516b2425cd2ff2313f2aec834bf5a438450cb12248719200bfce89e128321

Download Submit
C:\Users\Admin\AppData\Local\Temp\CS16Launcher.exe.tmp

Filesize
295KB

MD5
305c9e4db77d87221c43ec9003eb0f81

SHA1
06a98b27c8cde32a613d6e9f486df45d27c0eec4

SHA256
8b020dc2a8c8c2f35756f0b38791b12a3bab9bd66e2d59f379085dca489dc195

SHA512
af70b1ea9a7d9bc6d0125a19c31ee5f7b585190ce30c9a9c976e0fc57ac6b1e48897c493be6cbb40bc5da4193abbbde7681e7cc9c287bfd5e51e4bd5519a941e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Mss32.dll

Filesize
343KB

MD5
f520185e02e8a5d85860669176bc4adc

SHA1
cea8e9ff14994c89ad86cf891c89fea42a39250a

SHA256
fe62f1eb6ba407df77619d16927abbefad3c726014f6bd1f8c37a7c3d6b781cc

SHA512
b434e77a17cdac0109b698d0fccdd25dcdb15090a9fd0427504cc7f616673fa6c7307f07fb22cc2fc1e915887c0f9dc025aa8d38f51503f91df6a9ccee5ebe58

Download Submit
C:\Users\Admin\AppData\Local\Temp\cstrike\valve.rc

Filesize
356B

MD5
49b89267ce7c9daee488b41c7ecbae66

SHA1
8686b5c577bd192e68a5a7bcb5b08c8395d27812

SHA256
5b1b2dd68c2ff1fc6cda3f415cfa7087884ca075c371574aa19c1e4474c4d540

SHA512
9790a5b972e94f1809f56c73c27d622a3829a182c7710cbbc4c5f9039337d2f498cdadbfe1930b2b20ce450234638e30eef5873a6e10411555c3ce4181a60d47

Download Submit
C:\Users\Admin\AppData\Local\Temp\filesystem_steam.dll

Filesize
120KB

MD5
18d55998df6a48193499f859f8bfebd9

SHA1
1ee59996d6ca8eec43caa7488bcec58c7d4ba5f3

SHA256
dc9bfd575a29abbe1d542ce41143f388cd56b2280f25af64c1699b43a04c1125

SHA512
b3818e7fea8d2042466774ecd9c8f2bee6444ecfb0f7f56e73e9c9854c5360969de39501e5439bc50dc894aafe5113ea1001d67280e267b024c6ccfc567261c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\hl.exe

Filesize
84KB

MD5
2098ccf443433129b556c2849fe99e26

SHA1
074ddbaff48c88b3b5c8f881c35d2be2bb19a249

SHA256
4a899986a879ffd4b7e2d819c49b47cb362d849e86917da1f1931ef476b414af

SHA512
fb4dcfd5371c89af775367d9f2ba72bfd42f8b483ba31b0e839b66f065e5e7a1ec34bf4504aaad17e38502be6917f0b3e415add81dc84fc6942996c0a8f95a10

Download Submit
C:\Users\Admin\AppData\Local\Temp\hw.dll

Filesize
1.8MB

MD5
a0bc2e53bb55121719af9386ac2ff588

SHA1
1642aa1bfd63585fb324b8d23806efead856a3c9

SHA256
7802a1fcc2ab1749399e455faae907c0df3194386160dc4fa0164c427662fdc2

SHA512
e3a2b2ed965d15833ded927c6566a5facf11d1d654b65f2bbce70405013f2fe13009fe61b5488821f0846fd6cf0a5c5f2fd15a1a93c61c97540c917bd5040c92

Download Submit
C:\Users\Admin\AppData\Local\Temp\hwpatcher.dll

Filesize
69KB

MD5
3531565d73be13ffdeabc638d0d32ece

SHA1
59e17ec1365012e143b559a5e33ea1792f5264e0

SHA256
ad16e56157ceae1169edb1bfa6c902ce85d3f5e23815403d27ccff32efb1a4f2

SHA512
5dc99ef4a12f0feb05f78b911fed456cb81470caf011ecdc5b75485b29e3b4025ff9ae6a51870a9752cbd66f13971b06dd74e6c803ede7c5a4dc0371a2d18235

Download Submit
C:\Users\Admin\AppData\Local\Temp\platform\config\MasterServers.vdf

Filesize
257B

MD5
79e8cbef4f9bcae4515d77059f2a5cd4

SHA1
29f708d3dd29e1a47837b75c4bd40d95661d563e

SHA256
127c6947762873f0056b613de689c6788d64d311cb8d6c48076ca0c9986c173d

SHA512
849d7dcea9a2f3adc7204903530c9cc5d254b9e32135dfb0afa070a845f51daccb45f1ff6d145b942e918c51caa1b091ee331b0f2f10fb26fc6b9b888032551b

Download Submit
C:\Users\Admin\AppData\Local\Temp\rjgu8cW6.dat

Filesize
40KB

MD5
e1cd35bbc28f73b7481e8835ee0f0b13

SHA1
ef40d489c61b178b54f8116548662ee876e0133f

SHA256
6ecef9ef0f62491d595b2f32c69b53c53a1b3a8a7c9dea39d56c6861f5b93bdf

SHA512
baf6f9063f95e6d699088ec4c0611825e030382ff913084feb7f913cc8f011d079b6c7143359391d8e30a5e26ac5a5358882b20e3ac31c5afdbe8867ff6f62a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\steam.dll

Filesize
322KB

MD5
94d9e620da6bd5fe5a4d20aebb15ec6d

SHA1
3c63d12fd2fda36048461c3a74ef228bb58da61a

SHA256
88f7c7fe458ec238599dc57063a69b6417902f1e3591c6239af7c400954f764e

SHA512
d1fe188954b45d2db40dcb06b44fb60dfe09fd0e0118ddebb27cb294202c2f59b49009e99d28e200078b22061d48d5b3de6251f255426087337c9fc462a74af7

Download Submit
C:\Users\Admin\AppData\Local\Temp\steam_api.dll

Filesize
65KB

MD5
fa11b8cf4197e8de4a9e04f97bc1b159

SHA1
aeba89ce6faa209587a7a91c6f5f68fb6a0ddf00

SHA256
a903b462678281ec5a796fab528f7258b18455dc5e42b87389ba96d2359e4777

SHA512
0df1faa6e3480b1a64451d4eac8b9c17c0bbe52138314ffec6c1d968fb4c06570c24c4ca532f7f4261aa295fa8e7dd15039c62318eb3cb562370bc14e61bc32c

Download Submit
C:\Users\Admin\AppData\Local\Temp\steam_api_c.dll

Filesize
68KB

MD5
6baefb250616105b06438d6742d1ebde

SHA1
bd5b8f0113ab76dd8e35d6c446ab0286450f5666

SHA256
02fe1504d1ff75a0ed34e4cd8000639711d0481b9ad888dc96ccf8eadddc4753

SHA512
4389235cd5077f5fa9774f5ef2b4a2122de357c897b30658ad3c581e8d8991cf987159849392fd6776a80bc57ab563eda5b0c1e6e167e4a61954e117ac963a45

Download Submit
C:\Users\Admin\AppData\Local\Temp\vgui.dll

Filesize
344KB

MD5
d44ee82601ae62ede3e224269a0bbf53

SHA1
2d00b1d5e052584c6c86ec08795d56d2181a91ee

SHA256
0d4472d21443de839080860a300cca6b9436508f329d33d712e5c9bc07d4d998

SHA512
00dba1a1d88bbc8f77f86ac45068d3f071805a13bf30c7f5c3f3168d3b799e773a1a3a7decab7931a9104bfe91dc8d60cc54b9e82a12e01b29dfe13c4fd1d398

Download Submit
C:\Users\Admin\AppData\Local\Temp\wwwupdate.db

Filesize
12KB

MD5
357fa1189fa3104be03cf55422cb408d

SHA1
f63997c168c2a111f2d5665fe381fa9b46d3c1ff

SHA256
5c95522e7018f5f8e7705551f64430206d9d3e20ffa8a676c4ddc04e9c736265

SHA512
1a5101a42ac1970aa57a8d7fdba8cdc0bdcce85a50f9fd41b2541e23e4176317133d6ef61f4d3f239be4a36f11fb7408b00d70193c9bbb3e68ed2b9a1b47448e

Download Submit
memory/992-190-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/992-208-0x0000000000650000-0x000000000068C000-memory.dmp

Filesize
240KB

Download
memory/992-27-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/992-209-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/3092-214-0x0000000004930000-0x0000000005B5A000-memory.dmp

Filesize
18.2MB

Download
memory/3092-182-0x00000000005A0000-0x00000000005C0000-memory.dmp

Filesize
128KB

Download
memory/3092-186-0x0000000000F40000-0x0000000000F55000-memory.dmp

Filesize
84KB

Download
memory/3092-191-0x0000000004930000-0x0000000005B5A000-memory.dmp

Filesize
18.2MB

Download
memory/3092-213-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/3092-175-0x00000000005A0000-0x00000000005AF000-memory.dmp

Filesize
60KB

Download
memory/3092-203-0x00000000011E0000-0x00000000011F5000-memory.dmp

Filesize
84KB

Download
memory/3092-168-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/3092-200-0x0000000001180000-0x00000000011D8000-memory.dmp

Filesize
352KB

Download
memory/3092-198-0x0000000004930000-0x0000000005B5A000-memory.dmp

Filesize
18.2MB

Download
memory/4236-11-0x0000000000160000-0x000000000019C000-memory.dmp

Filesize
240KB

Download
memory/4236-4-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/4236-7-0x0000000000162000-0x0000000000163000-memory.dmp

Filesize
4KB

Download
memory/4236-21-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/4236-22-0x0000000000160000-0x000000000019C000-memory.dmp

Filesize
240KB

Download