floxif | c60d6ab9552bf57f5a95c8835693b958648cb72c52c207b86292376d1d8ca383

Analysis

max time kernel
143s
max time network
133s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04-01-2025 05:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c60d6ab9552bf57f5a95c8835693b958648cb72c52c207b86292376d1d8ca383.exe
Size

2.4MB
MD5

6d592a952b91fa890dcd024d16ff4753
SHA1

bfe99e05f4db37255286652c7e32ed4e7a76ee45
SHA256

c60d6ab9552bf57f5a95c8835693b958648cb72c52c207b86292376d1d8ca383
SHA512

ee7e8aa3a2421ac75dade6b5ba5e414c4d81f8ea12b5aac731afde9d3b90d81bbf38ed70786375e0b68bfbad066350b67cf5eec0663bcfdd725f03ccf3f24bf0
SSDEEP

49152:hKfS38tcDPhGY8YlRNyNfCf264ulHpwHdO5Gh4uGcBzYPsr:tqIAboNyq7nlHGHdO5Gh4uVzUsr

Score

10^/10

floxif backdoor discovery persistence privilege_escalation trojan upx

Malware Config

Signatures

Floxif family
floxif
Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
backdoor trojan floxif

Detects Floxif payload 1 IoCs

backdoor

resource	yara_rule
behavioral1/files/0x000700000001211a-2.dat	floxif

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x000700000001211a-2.dat	acprotect

Executes dropped EXE 2 IoCs

pid	Process
2572	Dism++x64.exe
1200	Process not Found

Loads dropped DLL 7 IoCs

pid	Process
2316	c60d6ab9552bf57f5a95c8835693b958648cb72c52c207b86292376d1d8ca383.exe
1620	c60d6ab9552bf57f5a95c8835693b958648cb72c52c207b86292376d1d8ca383.exe
1620	c60d6ab9552bf57f5a95c8835693b958648cb72c52c207b86292376d1d8ca383.exe
1620	c60d6ab9552bf57f5a95c8835693b958648cb72c52c207b86292376d1d8ca383.exe
1620	c60d6ab9552bf57f5a95c8835693b958648cb72c52c207b86292376d1d8ca383.exe
2572	Dism++x64.exe
2572	Dism++x64.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\e:	c60d6ab9552bf57f5a95c8835693b958648cb72c52c207b86292376d1d8ca383.exe

UPX packed file 14 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2316-0-0x0000000000400000-0x0000000000432000-memory.dmp	upx
behavioral1/files/0x000700000001211a-2.dat	upx
behavioral1/memory/2316-4-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/1620-85-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2316-108-0x0000000000400000-0x0000000000432000-memory.dmp	upx
behavioral1/memory/2316-110-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/1620-117-0x0000000000400000-0x0000000000432000-memory.dmp	upx
behavioral1/memory/1620-118-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2316-120-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2316-128-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2316-134-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2316-140-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2316-148-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2316-152-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\symsrv.dll	c60d6ab9552bf57f5a95c8835693b958648cb72c52c207b86292376d1d8ca383.exe
File created	\??\c:\program files\common files\system\symsrv.dll.000	c60d6ab9552bf57f5a95c8835693b958648cb72c52c207b86292376d1d8ca383.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c60d6ab9552bf57f5a95c8835693b958648cb72c52c207b86292376d1d8ca383.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c60d6ab9552bf57f5a95c8835693b958648cb72c52c207b86292376d1d8ca383.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	Dism++x64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	Dism++x64.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2316	c60d6ab9552bf57f5a95c8835693b958648cb72c52c207b86292376d1d8ca383.exe
2316	c60d6ab9552bf57f5a95c8835693b958648cb72c52c207b86292376d1d8ca383.exe
2316	c60d6ab9552bf57f5a95c8835693b958648cb72c52c207b86292376d1d8ca383.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	2316	c60d6ab9552bf57f5a95c8835693b958648cb72c52c207b86292376d1d8ca383.exe
Token: SeDebugPrivilege	1620	c60d6ab9552bf57f5a95c8835693b958648cb72c52c207b86292376d1d8ca383.exe
Token: SeBackupPrivilege	2572	Dism++x64.exe
Token: SeRestorePrivilege	2572	Dism++x64.exe
Token: SeSecurityPrivilege	2572	Dism++x64.exe
Token: 35	2572	Dism++x64.exe
Token: SeLoadDriverPrivilege	2572	Dism++x64.exe
Token: SeBackupPrivilege	2572	Dism++x64.exe
Token: SeRestorePrivilege	2572	Dism++x64.exe
Token: SeShutdownPrivilege	2572	Dism++x64.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2572	Dism++x64.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 1620	2316	c60d6ab9552bf57f5a95c8835693b958648cb72c52c207b86292376d1d8ca383.exe	30
PID 2316 wrote to memory of 1620	2316	c60d6ab9552bf57f5a95c8835693b958648cb72c52c207b86292376d1d8ca383.exe	30
PID 2316 wrote to memory of 1620	2316	c60d6ab9552bf57f5a95c8835693b958648cb72c52c207b86292376d1d8ca383.exe	30
PID 2316 wrote to memory of 1620	2316	c60d6ab9552bf57f5a95c8835693b958648cb72c52c207b86292376d1d8ca383.exe	30
PID 1620 wrote to memory of 2572	1620	c60d6ab9552bf57f5a95c8835693b958648cb72c52c207b86292376d1d8ca383.exe	31
PID 1620 wrote to memory of 2572	1620	c60d6ab9552bf57f5a95c8835693b958648cb72c52c207b86292376d1d8ca383.exe	31
PID 1620 wrote to memory of 2572	1620	c60d6ab9552bf57f5a95c8835693b958648cb72c52c207b86292376d1d8ca383.exe	31
PID 1620 wrote to memory of 2572	1620	c60d6ab9552bf57f5a95c8835693b958648cb72c52c207b86292376d1d8ca383.exe	31

C:\Users\Admin\AppData\Local\Temp\c60d6ab9552bf57f5a95c8835693b958648cb72c52c207b86292376d1d8ca383.exe
"C:\Users\Admin\AppData\Local\Temp\c60d6ab9552bf57f5a95c8835693b958648cb72c52c207b86292376d1d8ca383.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Users\Admin\AppData\Local\Temp\c60d6ab9552bf57f5a95c8835693b958648cb72c52c207b86292376d1d8ca383.exe
  "C:\Users\Admin\AppData\Local\Temp\c60d6ab9552bf57f5a95c8835693b958648cb72c52c207b86292376d1d8ca383.exe" -sfxwaitall:0 "Dism++x64.exe"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1620
- - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dism++x64.exe
    "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dism++x64.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:2572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\System\symsrv.dll.000

Filesize
175B

MD5
1130c911bf5db4b8f7cf9b6f4b457623

SHA1
48e734c4bc1a8b5399bff4954e54b268bde9d54c

SHA256
eba08cc8182f379392a97f542b350ea0dbbe5e4009472f35af20e3d857eafdf1

SHA512
94e2511ef2c53494c2aff0960266491ffc0e54e75185427d1ccedae27c286992c754ca94cbb0c9ea36e3f04cd4eb7f032c551cf2d4b309f292906303f1a75fa0

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Config\Config.ini

Filesize
122B

MD5
99a382ab784678529c30421668312370

SHA1
7f9036095ca8ab5d7a9831dea000ea0b0431b721

SHA256
cd17ef87da96ae803baac8bf19f02ed531b5546f240bd476df1eae80e12279fc

SHA512
983e26e7343ed82ee2c0b90d04abb78dd6a41ba762cc434324f87485f2e67339885a19768d3435ecdc6659fdc389cc72b07a6636d361d64a6953c19c71f49c69

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Config\Data.zip

Filesize
46KB

MD5
c3df4642551b01ee38bc10bc4a06bad6

SHA1
367b747a7032b9490a417c4fceff38c41cf987a7

SHA256
8d524539f83a6416dbb4fdde697a4bd8d870ddf25b162e874bfc9c56122a03dc

SHA512
9797038119d126ac5c320acbe1e2b7c670c974dfac31775146538009dbc694481d7bc4ea25b660cc39cdb1ad1320785b5ed07e6959b5062b7f5d9b02dbc7f665

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Config\Languages\en.zip

Filesize
36KB

MD5
fd842ba14e068be060d796189a3e8c5f

SHA1
b0c6051409681a584ac2070ab858a8e01bf2d299

SHA256
092c7cdf37233abb37cb47790bf235cdc170ea02c4bcdf0cbbf334e0602cf6dc

SHA512
0ffd176816d392a2922762deecd8506681f756fdb9f8ee4c88a9c6194e8348eb5db07990eebbaf2f3b15b2a6b3d2d96bb2371d4b0f31262e11d49fea1059897a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Config\default.ui.zip

Filesize
31KB

MD5
e4b7bef45a8f48832ba59396509dcb76

SHA1
bb7d11922ad75faf8cdbd07bf3637b949c5c99b1

SHA256
1a90365ac33c37eeae4dd712f84062466c10948cf5b567574055e0b8b0f70534

SHA512
fc2bc50c415909b56ff43fc54f3c0e6fc1be98ecca70cc0d9dd2e9310512be1d5a3992387fffd9078291f591860e9d3c799ac6f79bdb25cb868a7b3734b7e1f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dism++x64.exe

Filesize
1.0MB

MD5
a1a058ff98dc1f9320195b398aa06167

SHA1
d974136e6dc4b1726b50a770ec8d6f0f4fc859a7

SHA256
16bbdb339173d25b4332b377da96e80809aabfe6739cf35d5e70484f08cfdc42

SHA512
8517354f8579905a5ff1b581aee79ac4632d83bf1672490b653caf5807e902745ae1df109083ea895ac63f0a106786390d5e769a220dc21af8f8a7a9585dddc8

Download Submit
\??\c:\users\admin\appdata\local\temp\7zipsfx.000\Config\amd64\CBSHost.dll

Filesize
175KB

MD5
dd139df87a896b894335e03ece2973bf

SHA1
c6eb8a276897acc4e1f34dc25df138b2c30f7918

SHA256
6a1075f4fab4acd2722e8946cba7b23508d120367c84aae3e83284124227013a

SHA512
1a6296ab7411771e1fd8147086cbcade6f761e10b44975086fc03a0f058faaa0acef692b97a56f2ddad3f66241c0fb1b7d6d7e897888cb53f86a9734ceed5874

Download Submit
\??\c:\users\admin\appdata\local\temp\7zipsfx.000\Config\amd64\NCleaner.dll

Filesize
54KB

MD5
c2058bcb1607ffb1a9fefd67c2e8f94a

SHA1
3b37a3add98dc237113028766aae063c3370112c

SHA256
141587ad11529d238dc7b63d7f30002ff042c3b06282d075e44e9c5af07ccc17

SHA512
7bf8ae797e915491134a311ad7e2b9cb11c851c096cb8cc8942d50e91503bd7641b2273f3dadc9b1a0f912d9459b74b16cd912dab79dd0877301aff5b0e96c8a

Download Submit
\??\c:\users\admin\appdata\local\temp\7zipsfx.000\Config\amd64\bcdboot.exe

Filesize
188KB

MD5
be14be7c8f7f0f4e397b89979cb9cf6b

SHA1
7f59be597069c91c8caddf08d12ba8fbbd65b66f

SHA256
309f3eccb0093cc6cc98f858bd3ce67b00bb810728ffb177b7bd287fb3c92b97

SHA512
0cf26478d1b80a6b68853e298e944bce6d2e21fbbe7a6711ddaa66e2b9f2bca0f941a6ee2f694b05d5b7588339181104d1b74fd49a991e2cb0e86b72e124b7cc

Download Submit
\??\c:\users\admin\appdata\local\temp\7zipsfx.000\Config\amd64\wimgapi.dll

Filesize
754KB

MD5
80826a2374b051468ffbd6e85993137d

SHA1
d66082ee8d3478f6b606336fec00f9d748ab9427

SHA256
e51344884512b486ff1de3c30e554b0e1cb6ffb8ed4e3bdd31a29a76454f5562

SHA512
5c07620f08e77b1c82baa3f4685b730b3bd1fd324931f04a10d5593d0263da0f76311f2012b33a7a3c7200c1093dbec9e84dc724031b9231537e4362064a7284

Download Submit
\??\c:\users\admin\appdata\local\temp\7zipsfx.000\Config\x86\CBSHost.dll

Filesize
122KB

MD5
9966252f6b62752f38bde0ff2970300d

SHA1
4c02d8470093db823f371bfc023d44ab80ad4970

SHA256
059f28e9b517b9345a30e409f1e7eecaab2d643a180dfa8fb1d105cac137cbb2

SHA512
f1c198b1e9b52fe8b96fbed9312328e73f4f5d989f72686b61b13abed9676fdd352e07bf4a48ed767ab6a38830489133f7cc217791a425fbf79c6b4a2c9cd82c

Download Submit
\??\c:\users\admin\appdata\local\temp\7zipsfx.000\Config\x86\NCleaner.dll

Filesize
35KB

MD5
8fd2598d9c61ed8dff6d7bf661bf8287

SHA1
c106545a52667ea5e6db8d16ee1744c4dab97587

SHA256
a1f16902ff0594a80da523dff4b8340b231188125dbfb87fe3e2f0ce23276253

SHA512
04859d231bcfda0160272fd6821a3c4442fb539d797d9684ac6714c9a5f96178f20fa1b3d03a8c18e455b47d4b2f13f66f086cb3fcb34d1bec3c4cc96a19bc7e

Download Submit
\??\c:\users\admin\appdata\local\temp\7zipsfx.000\Config\x86\bcdboot.exe

Filesize
158KB

MD5
805a3acfb09848ce0255d20f7b993313

SHA1
aea9a8992b7971890c033802cd273b12d242de90

SHA256
0b85157e004ee59cfe054ad5bda6d8a9c3e3270d002befb07cddc6acb7497388

SHA512
13c65a8b5f8fc2208a1e783f3fc52d4bb5c6aa75cb342da92235283b715122259d8b9ed9802a4873506ce35e33b54a28812600360682f77c3a6d4f30eb01633e

Download Submit
\??\c:\users\admin\appdata\local\temp\7zipsfx.000\Config\x86\wimgapi.dll

Filesize
596KB

MD5
75faa0992273718b30295af7dd378cc3

SHA1
786fbafd2f8d156092786917b6157bfd8ec092b0

SHA256
e3e3eb7e2ed4aed86965bb42ffa6c10388acf62ae33d236dc613348fc7e120f9

SHA512
6face2b6d1be6260d81b65572117719192067e6d6a7f885d1e7824abac68f35513e81e6bb764575bd9a61a02b1a3790fdb9c5ebad9494b184f6bff38429deed6

Download Submit
\Program Files\Common Files\System\symsrv.dll

Filesize
67KB

MD5
7574cf2c64f35161ab1292e2f532aabf

SHA1
14ba3fa927a06224dfe587014299e834def4644f

SHA256
de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085

SHA512
4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab

Download Submit
\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Config\x86\CBSHost.dll.tmp

Filesize
198KB

MD5
528a56892192c492ef66bb37fe3cee36

SHA1
7ff416a349dbd0bb734b7cefaaeefe4c51136e97

SHA256
455bc45cda834554f656c9c2a4fbf8a3400aa46896cb45cfbf6d6f5c6b3d05ad

SHA512
63c8afca866961794cd77a14df651b464b8a7b6333913b99b1ca44bb1966af9bc39b2868bc373dfc41e8a6caf2f92e6fd15116dee4db095b80532db082cf42f6

Download Submit
memory/1620-117-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1620-121-0x00000000002D0000-0x0000000000300000-memory.dmp

Filesize
192KB

Download
memory/1620-118-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/1620-85-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2316-4-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2316-0-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2316-110-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2316-120-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2316-108-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2316-128-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2316-134-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2316-140-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2316-148-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2316-152-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2572-124-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/2572-106-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download