Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
01/01/2025, 00:32
General
-
Target
2025-01-01_5dc4d47204f1e26c256ab471c1d4a448_floxif_mafia.exe
-
Size
2.4MB
-
MD5
5dc4d47204f1e26c256ab471c1d4a448
-
SHA1
7a8eeed10c7d4ee6e1519afe399979ec0ba70f74
-
SHA256
e0abdc46ed11e047ec13ac55bf5d3f0a6bd73177a5d95f6ff21346c8ac849b60
-
SHA512
59bd804a23ea91e4537a471098a523f9d56e41dfbbff81add3b3f9ed9581ac72ee8ad97a2a9283d2d45f484b1fab7f80eced5324b833dd976d23dda24f1a6b96
-
SSDEEP
49152:7TuE7AkqIxGrGYyZa/tgrYJUGfZC3wA6EylfwEaFW31qju:uE7AfrlyutLxC3sEwwM3Uju
Malware Config
Signatures
-
Floxif family
-
Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
-
Detects Floxif payload 1 IoCs
-
Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 5 IoCs
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Network Service Discovery 1 TTPs 9 IoCs
Attempt to gather information on host's network.
-
Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
UPX packed file 9 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Program Files directory 46 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 13 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
NSIS installer 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 36 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-01_5dc4d47204f1e26c256ab471c1d4a448_floxif_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-01_5dc4d47204f1e26c256ab471c1d4a448_floxif_mafia.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\arp.exearp -a2⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\arp.exearp -s 10.127.0.1 eb-8d-b5-58-be-f12⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\arp.exearp -s 10.127.255.255 7c-c6-18-f0-20-0d2⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\arp.exearp -s 136.243.69.123 3f-32-70-fb-8b-882⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\arp.exearp -s 224.0.0.22 63-2f-95-fc-e6-0f2⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\arp.exearp -s 224.0.0.251 9c-8d-93-7d-46-2f2⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\arp.exearp -s 224.0.0.252 e6-70-e2-d7-29-6e2⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\arp.exearp -s 239.255.255.250 ec-0b-f6-d1-19-922⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\arp.exearp -s 255.255.255.255 85-45-e6-99-83-dc2⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\minidownload.exe"C:\Users\Admin\AppData\Local\Temp\minidownload.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files (x86)\SogouSoftware\SogouSoftware.exe"C:\Program Files (x86)\SogouSoftware\SogouSoftware.exe" /Loader /DownLoad?status=true&softurl=https%3A%2F%2Fxiazai.sogou.com%2Fcomm%2Fredir%3Fsoftdown%3D1%26u%3DG30HdQ8G4ngDpbEHfW1gEXYhwD6lzpDc8HlTAHx7scbrxDthotkHK0HexvlOWvJbJd76eqnPU0MQPeaLH3gS2w..%26pcid%3D-2241203717467645359%26fr%3Dxiazai%26source%3Dxixi%26filename%3Dpdfwjt.zip&iconurl=https%3A%2F%2Fpic.cr173.com%2Fup%2F2014-4%2F201449152326.jpg&softname=PDF%E8%BD%AC%E6%8D%A2%E9%80%9A&softsize=19.05MB2⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\arp.exearp -d2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Event Triggered Execution
1AppInit DLLs
1Pre-OS Boot
1Bootkit
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
232KB
MD50bc2d003fcfe3fa65f4c3ba7a015fa41
SHA172ed85bc1c57259b4f2ed36d16ce3fed4e30607c
SHA256388069590fb9569b6c498f941d0565416cb52fc803648ee21b8c59917c63eb4b
SHA512ae8d83e6ca21ee9b0d5e5845fac3a4dc01c6038243da36b4360b2f42763478265cdafc89072c47672b9738de1930e5e5191e2bf91715055cbd16a949d313ff24
-
Filesize
450KB
MD5b1ce2dba9515e144908aa34ac77f5a46
SHA10a3e601eeba273a16d815c5e59793eb73db9daad
SHA2565a7349e46f16ec394af8575b666c132c010bacaa2c59da472b842ffeccc5623f
SHA512d0a78b5de9126b8126b531fb8f72ae375aac898930dccd8a61f173c28470895daab56b368c34a5925020dfdc642785651445967904d8756bb1ce7c1d2f95525a
-
Filesize
531KB
MD5c21db0d4dd67f7182a333b55c5640e01
SHA12352cbbfdcfd0915fca60f02cc41c733c8d0af68
SHA25626cfeccbe406b142e84a08dab15efa3b2dbbaf4bac74cdfc31c87769e3e80bfa
SHA5125daaef0acdc8fe7e33104ebad24882094d59c5982fd168a8e1b6378d1c69852c342e4e66fda66e72ed9ee24bd79ad94072bddfba70edf5410738e75aae3182c8
-
Filesize
53B
MD5113136892f2137aa0116093a524ade0b
SHA1a0284943f8ddfe69ceec90833e66d96bdf4a97f0
SHA256ebbf7e8800c3446bc3a195fa53573bde1073b0bf7581a614372f1391a9286d02
SHA512d3201cc19ae702a9813aa8bc39612ebaa48138903e9ede64dcadff213691f6e711876aa4fa083887c545325d5d8bf70649523c528090542459f2b01697180e99
-
Filesize
71KB
MD54fcd7574537cebec8e75b4e646996643
SHA1efa59bb9050fb656b90d5d40c942fb2a304f2a8b
SHA2568ea3b17e4b783ffc0bc387b81b823bf87af0d57da74541d88ba85314bb232a5d
SHA5127f1a7ef64d332a735db82506b47d84853af870785066d29ccaf4fdeab114079a9f0db400e01ba574776a0d652a248658fe1e8f9659cdced19ad6eea09644ea3e
-
Filesize
1.9MB
MD50618e9851ea4a522abeded8d40c2f19e
SHA1c6772967fdf545e32d28f3b46e97aec5b9ff99f5
SHA256506c374fbdf14420306e2da8d123c2138c2ceabd2046178317508a25949d3dc4
SHA512b8c4816d81aa14646a3b690da76c0d33f59b7d419305638747503dba6bb84a63b906fe7d0ced59850ad25db37c1e0e6f3bd614a902f2f5ffb3d2bf74ec4e571f
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
2.3MB
-
Filesize
4KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
2.3MB
-
Filesize
480KB
-
Filesize
204KB
-
Filesize
480KB
-
Filesize
204KB
-
Filesize
480KB
-
Filesize
480KB
-
Filesize
480KB
-
Filesize
204KB
-
Filesize
204KB