Analysis
-
max time kernel
93s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
31-12-2024 01:52
General
-
Target
0ab7f5964dd513b56e0c6e2191e4dcfe178257eaa2927190ba2af4d7f9c7ee4cN.exe
-
Size
493KB
-
MD5
59d66bd192148f34b37c546082fa1ab0
-
SHA1
0b581f121f5f15494fd44020ce699bb78a13e01a
-
SHA256
0ab7f5964dd513b56e0c6e2191e4dcfe178257eaa2927190ba2af4d7f9c7ee4c
-
SHA512
8ecf9d1f5bf1e793487cb10276df9141b8f0937524ef834652a65b225d712da11e5da7a1f450df54b9890ae9d1c92e4ffd1749def23d431e63cb0c20a6f2638b
-
SSDEEP
12288:Kkc7YgThY9ZQ9teoAPgFuR6l98WZm42ZIvH+NPBjvrEH7Y:sLThY49ovPy8WZm426+N9rEH7Y
Malware Config
Signatures
-
Floxif family
-
Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
-
Detects Floxif payload 1 IoCs
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
-
Loads dropped DLL 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Program Files directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0ab7f5964dd513b56e0c6e2191e4dcfe178257eaa2927190ba2af4d7f9c7ee4cN.exe"C:\Users\Admin\AppData\Local\Temp\0ab7f5964dd513b56e0c6e2191e4dcfe178257eaa2927190ba2af4d7f9c7ee4cN.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67KB
MD57574cf2c64f35161ab1292e2f532aabf
SHA114ba3fa927a06224dfe587014299e834def4644f
SHA256de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
SHA5124db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
-
Filesize
461B
MD53f42ca2c21c42802866764cc88a2cd37
SHA19f40622028614d1171247f383e9b04a1b24f167a
SHA256f624b7d3f9a9fca813f12c175293390f3eaa0cb09c96bcddfe55ef7af5cb8cfb
SHA5128f674c9a8beaee6d90778b99245e90a102e5ba314c076ea247bd4333d2ccdb6672fc4be7a116f52ffc46126f0c066a26a2595a55cd74eb09053886de04082a4c
-
Filesize
659B
MD55e1f607113158dd97be32a1086824549
SHA1eab32ebe6cad3318fb454717acdc500e2ca98971
SHA256d5e572f2b44b44e6800ae4c538f402839ea7e68d72f4d788e0a35ce438fb7053
SHA5125c67c2f2907759c2dec6518da64d8fdf5281593c85d446fe79ec707752d398ed375d29d47ef22122f105cbe7499a38875989276ec5ec58078d167842a56307b7
-
Filesize
192KB
-
Filesize
4KB
-
Filesize
192KB
-
Filesize
432KB