Overview

overview

10

Static

static

3

422645839d...bN.exe

windows7-x64

10

422645839d...bN.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    16s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20241023-en
  • resource tags

    arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
  • submitted
    04-01-2025 15:44

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    422645839d0cd93030f6c44292cd8dea0757379d157b49abbbea91080d1afcabN.exe

  • Size

    1.2MB

  • MD5

    8c3978a16bcad26e0c26ca69c1bc9f50

  • SHA1

    3c6177c97bb8a1232d49111625d0fed5edef45e1

  • SHA256

    422645839d0cd93030f6c44292cd8dea0757379d157b49abbbea91080d1afcab

  • SHA512

    34cc81d3aaaea48c61f9ada775fe320fd9fccc545955603fb972fb52944f439dc18190c7a2f0a6ac4270acacd9141218e130c6319dac6872e6bd8d30e00ed5f6

  • SSDEEP

    24576:p2brn/kG9Pwrn/POzMQGEvGH3RDDtAi1PDxwQo79mRUwbSlcfSgQ+n81TrEH7e:porn/x9Pwrn/POzMQGEvGHtDtN1dwQXq

Score
10/10
floxifbackdoorbootkitdiscoverypersistencetrojanupx

Malware Config

Signatures

  • Floxif family
    floxif
  • Floxif, Floodfix

    Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.

    backdoortrojanfloxif
  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Detects Floxif payload 1 IoCs
    backdoor
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 6 IoCs
  • Drops desktop.ini file(s) 35 IoCs
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops autorun.inf file 1 TTPs 35 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Kills process with taskkill 1 IoCs
    evasion
  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 23 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\422645839d0cd93030f6c44292cd8dea0757379d157b49abbbea91080d1afcabN.exe
    "C:\Users\Admin\AppData\Local\Temp\422645839d0cd93030f6c44292cd8dea0757379d157b49abbbea91080d1afcabN.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Loads dropped DLL
    • Drops desktop.ini file(s)
    • Writes to the Master Boot Record (MBR)
    • Drops autorun.inf file
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1656
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Users\Admin\AppData\Local\Temp\CQ.bat
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2612
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /im qq.exe /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2084
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Users\Admin\AppData\Local\Temp\temp.bat
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2824
      • C:\Windows\SysWOW64\cacls.exe
        cacls "C:\Program Files\Windows Media Player\0" /d everyone /e
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2808
    • C:\Program Files\Windows Media Player\0\e\e\3\7\c\c\5\a\d\e\1\1\9\e\3\b\3\c\8\c\0\2\1\a\2\f\1\6\8\b\4\autorun.inf\svchost.exe¡¡
      "C:\Program Files\Windows Media Player\0\e\e\3\7\c\c\5\a\d\e\1\1\9\e\3\b\3\c\8\c\0\2\1\a\2\f\1\6\8\b\4\autorun.inf\svchost.exe¡¡" pid 1656"C:\Users\Admin\AppData\Local\Temp\422645839d0cd93030f6c44292cd8dea0757379d157b49abbbea91080d1afcabN.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Enumerates connected drives
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2912
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1656 -s 544
      2⤵
      • Program crash
      PID:2704

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Windows Media Player\0\e\e\3\7\c\c\5\a\d\e\1\1\9\e\3\b\3\c\8\c\0\2\1\a\2\f\1\6\8\b\4\autorun.inf\svchost.exe¡¡
    Filesize

    1.2MB

    MD5

    8c3978a16bcad26e0c26ca69c1bc9f50

    SHA1

    3c6177c97bb8a1232d49111625d0fed5edef45e1

    SHA256

    422645839d0cd93030f6c44292cd8dea0757379d157b49abbbea91080d1afcab

    SHA512

    34cc81d3aaaea48c61f9ada775fe320fd9fccc545955603fb972fb52944f439dc18190c7a2f0a6ac4270acacd9141218e130c6319dac6872e6bd8d30e00ed5f6

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\CQ.bat
    Filesize

    30B

    MD5

    458d6a0f8398f6fa8bda7bb2ba5be353

    SHA1

    eec02a1cf5047cee3d4dee32ef13498c49a61154

    SHA256

    66142298d915314ddb48b417e96b48936e71a190d8f7cd8ae5a053cbe2746ddc

    SHA512

    c4fad6cafa4b17da18f5beceb65f91414c9fa0774c99caeadc87bc44f5faee6425208c78f6f111bec71b2e0cf58922c4bb62a0e3247b2af7699113a76c11c730

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\temp.bat
    Filesize

    72B

    MD5

    593ce3f439bb49aa3ef95af11b146c18

    SHA1

    1475674af547f66b3de40d5afde11fcb558a53eb

    SHA256

    886e68d9e6edb3b9ed472e9990fb9b0822c3be5e4cf6066af986edfac465546b

    SHA512

    76378b3017f75e0dbbf03a8bedf12b5b80c2d5da7a108ab7024acbbb7deac44ed16e054b53e86f9c8aef210f3a9cb3d1d39e43a698281b92149501c39d863349

    Download Submit

  • \Program Files\Common Files\System\symsrv.dll
    Filesize

    67KB

    MD5

    7574cf2c64f35161ab1292e2f532aabf

    SHA1

    14ba3fa927a06224dfe587014299e834def4644f

    SHA256

    de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085

    SHA512

    4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab

    Download Submit

  • \Users\Admin\AppData\Local\Temp\E_N4\Md5.fne
    Filesize

    28KB

    MD5

    992322b55f2684fe4c83b8e94dd54adb

    SHA1

    0990c5d0da44f3dfa45208c8d7d6ca27614dc165

    SHA256

    d3204ab23cfb93ec59c26624b46c436da7545bb91cbca0d9801b8e3ac0df3ead

    SHA512

    471ae13171f3f15f53126b04ada3157b4d194cec2d6b14502b1ea17962b163360f7e6a60187c1d15795c61955a64b19c1c68fcc5af6c7ee80ba3be6af1dcbf5b

    Download Submit

  • \Users\Admin\AppData\Local\Temp\E_N4\krnln.fnr
    Filesize

    1.0MB

    MD5

    4b30dbe1a79b2b7572ff637cb3765ced

    SHA1

    b08eba0e9bdb62d426db8d2b3d451152a56f79a1

    SHA256

    4208bdf90e97398a452d459d89562bda361bc6e911a385c4e31481a776f69e6d

    SHA512

    40e99c4a9d160a734a1675d75209dd88c7389c95cf0d0b6101f7e9edb2f3ebfe85e7170f0f4bae8a2e9533048bd5ecd414797b02ef257aecd90431f0c29ccfce

    Download Submit

  • memory/1656-52-0x0000000002E80000-0x0000000002EE1000-memory.dmp

    Filesize

    388KB

    Download

  • memory/1656-54-0x0000000000400000-0x0000000000461000-memory.dmp

    Filesize

    388KB

    Download

  • memory/1656-6-0x0000000000403000-0x0000000000404000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1656-13-0x0000000002D60000-0x0000000002E7A000-memory.dmp

    Filesize

    1.1MB

    Download

  • memory/1656-1-0x0000000000400000-0x0000000000461000-memory.dmp

    Filesize

    388KB

    Download

  • memory/1656-4-0x0000000010000000-0x0000000010030000-memory.dmp

    Filesize

    192KB

    Download

  • memory/1656-41-0x0000000002E80000-0x0000000002EE1000-memory.dmp

    Filesize

    388KB

    Download

  • memory/1656-50-0x0000000000400000-0x0000000000461000-memory.dmp

    Filesize

    388KB

    Download

  • memory/1656-51-0x0000000010000000-0x0000000010030000-memory.dmp

    Filesize

    192KB

    Download

  • memory/2912-46-0x0000000010000000-0x0000000010030000-memory.dmp

    Filesize

    192KB

    Download

  • memory/2912-47-0x0000000000400000-0x0000000000461000-memory.dmp

    Filesize

    388KB

    Download

  • memory/2912-56-0x0000000010000000-0x0000000010030000-memory.dmp

    Filesize

    192KB

    Download

  • memory/2912-57-0x0000000010000000-0x0000000010030000-memory.dmp

    Filesize

    192KB

    Download

  • memory/2912-58-0x0000000010000000-0x0000000010030000-memory.dmp

    Filesize

    192KB

    Download

  • memory/2912-59-0x0000000000400000-0x0000000000461000-memory.dmp

    Filesize

    388KB

    Download