Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
04-01-2025 05:17
General
-
Target
c60d6ab9552bf57f5a95c8835693b958648cb72c52c207b86292376d1d8ca383.exe
-
Size
2.4MB
-
MD5
6d592a952b91fa890dcd024d16ff4753
-
SHA1
bfe99e05f4db37255286652c7e32ed4e7a76ee45
-
SHA256
c60d6ab9552bf57f5a95c8835693b958648cb72c52c207b86292376d1d8ca383
-
SHA512
ee7e8aa3a2421ac75dade6b5ba5e414c4d81f8ea12b5aac731afde9d3b90d81bbf38ed70786375e0b68bfbad066350b67cf5eec0663bcfdd725f03ccf3f24bf0
-
SSDEEP
49152:hKfS38tcDPhGY8YlRNyNfCf264ulHpwHdO5Gh4uGcBzYPsr:tqIAboNyq7nlHGHdO5Gh4uVzUsr
Malware Config
Signatures
-
Floxif family
-
Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
-
Detects Floxif payload 1 IoCs
-
Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 3 IoCs
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
UPX packed file 13 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Program Files directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious use of AdjustPrivilegeToken 10 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c60d6ab9552bf57f5a95c8835693b958648cb72c52c207b86292376d1d8ca383.exe"C:\Users\Admin\AppData\Local\Temp\c60d6ab9552bf57f5a95c8835693b958648cb72c52c207b86292376d1d8ca383.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c60d6ab9552bf57f5a95c8835693b958648cb72c52c207b86292376d1d8ca383.exe"C:\Users\Admin\AppData\Local\Temp\c60d6ab9552bf57f5a95c8835693b958648cb72c52c207b86292376d1d8ca383.exe" -sfxwaitall:0 "Dism++x64.exe"2⤵
- Checks computer location settings
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dism++x64.exe"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dism++x64.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67KB
MD57574cf2c64f35161ab1292e2f532aabf
SHA114ba3fa927a06224dfe587014299e834def4644f
SHA256de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
SHA5124db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
-
Filesize
175B
MD51130c911bf5db4b8f7cf9b6f4b457623
SHA148e734c4bc1a8b5399bff4954e54b268bde9d54c
SHA256eba08cc8182f379392a97f542b350ea0dbbe5e4009472f35af20e3d857eafdf1
SHA51294e2511ef2c53494c2aff0960266491ffc0e54e75185427d1ccedae27c286992c754ca94cbb0c9ea36e3f04cd4eb7f032c551cf2d4b309f292906303f1a75fa0
-
Filesize
122B
MD599a382ab784678529c30421668312370
SHA17f9036095ca8ab5d7a9831dea000ea0b0431b721
SHA256cd17ef87da96ae803baac8bf19f02ed531b5546f240bd476df1eae80e12279fc
SHA512983e26e7343ed82ee2c0b90d04abb78dd6a41ba762cc434324f87485f2e67339885a19768d3435ecdc6659fdc389cc72b07a6636d361d64a6953c19c71f49c69
-
Filesize
46KB
MD5c3df4642551b01ee38bc10bc4a06bad6
SHA1367b747a7032b9490a417c4fceff38c41cf987a7
SHA2568d524539f83a6416dbb4fdde697a4bd8d870ddf25b162e874bfc9c56122a03dc
SHA5129797038119d126ac5c320acbe1e2b7c670c974dfac31775146538009dbc694481d7bc4ea25b660cc39cdb1ad1320785b5ed07e6959b5062b7f5d9b02dbc7f665
-
Filesize
36KB
MD5fd842ba14e068be060d796189a3e8c5f
SHA1b0c6051409681a584ac2070ab858a8e01bf2d299
SHA256092c7cdf37233abb37cb47790bf235cdc170ea02c4bcdf0cbbf334e0602cf6dc
SHA5120ffd176816d392a2922762deecd8506681f756fdb9f8ee4c88a9c6194e8348eb5db07990eebbaf2f3b15b2a6b3d2d96bb2371d4b0f31262e11d49fea1059897a
-
Filesize
175KB
MD5dd139df87a896b894335e03ece2973bf
SHA1c6eb8a276897acc4e1f34dc25df138b2c30f7918
SHA2566a1075f4fab4acd2722e8946cba7b23508d120367c84aae3e83284124227013a
SHA5121a6296ab7411771e1fd8147086cbcade6f761e10b44975086fc03a0f058faaa0acef692b97a56f2ddad3f66241c0fb1b7d6d7e897888cb53f86a9734ceed5874
-
Filesize
754KB
MD580826a2374b051468ffbd6e85993137d
SHA1d66082ee8d3478f6b606336fec00f9d748ab9427
SHA256e51344884512b486ff1de3c30e554b0e1cb6ffb8ed4e3bdd31a29a76454f5562
SHA5125c07620f08e77b1c82baa3f4685b730b3bd1fd324931f04a10d5593d0263da0f76311f2012b33a7a3c7200c1093dbec9e84dc724031b9231537e4362064a7284
-
Filesize
31KB
MD5e4b7bef45a8f48832ba59396509dcb76
SHA1bb7d11922ad75faf8cdbd07bf3637b949c5c99b1
SHA2561a90365ac33c37eeae4dd712f84062466c10948cf5b567574055e0b8b0f70534
SHA512fc2bc50c415909b56ff43fc54f3c0e6fc1be98ecca70cc0d9dd2e9310512be1d5a3992387fffd9078291f591860e9d3c799ac6f79bdb25cb868a7b3734b7e1f6
-
Filesize
1.0MB
MD5a1a058ff98dc1f9320195b398aa06167
SHA1d974136e6dc4b1726b50a770ec8d6f0f4fc859a7
SHA25616bbdb339173d25b4332b377da96e80809aabfe6739cf35d5e70484f08cfdc42
SHA5128517354f8579905a5ff1b581aee79ac4632d83bf1672490b653caf5807e902745ae1df109083ea895ac63f0a106786390d5e769a220dc21af8f8a7a9585dddc8
-
Filesize
396KB
-
Filesize
192KB
-
Filesize
200KB
-
Filesize
4KB
-
Filesize
200KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
4KB
-
Filesize
396KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
200KB