Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
09/01/2025, 08:31
General
-
Target
ccc04df196aa4c443a83bca8356f712ca5305414e2dc9a6ffabbdfd3af1a1467.exe
-
Size
620KB
-
MD5
b5c86f732b7213c654d1ab965f08748a
-
SHA1
c1349317b60c85fec596af2d9e805ed4dc1bd4df
-
SHA256
ccc04df196aa4c443a83bca8356f712ca5305414e2dc9a6ffabbdfd3af1a1467
-
SHA512
672b5443d9372160a6cb195197247534a39280e6a2d20a3e7317a64ff1754cd210866dd9c2067608b037425f915f1c3b5d9f9d1f7472a038c4ccfad9284f44e0
-
SSDEEP
12288:regtabQWMONeeC/s7+H3IqNARN0QJgfzN7a95vqTBjvrEH7f:aKZOQy+TuXgfzlq5vsrEH7f
Malware Config
Signatures
-
Floxif family
-
Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
-
Detects Floxif payload 1 IoCs
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
-
Loads dropped DLL 2 IoCs
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Program Files directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ccc04df196aa4c443a83bca8356f712ca5305414e2dc9a6ffabbdfd3af1a1467.exe"C:\Users\Admin\AppData\Local\Temp\ccc04df196aa4c443a83bca8356f712ca5305414e2dc9a6ffabbdfd3af1a1467.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
570KB
MD5f0e90c2f54d82a6f1a51b29a88f82790
SHA12ae50a2a020063096de1c0e98d7e7e0f3ada3826
SHA256125d98c14ac5acaac0b42b49a724829373a128641e1ffe86a53497783cfa5416
SHA512829ca7a2b9078557af6bad4867be203bfd031c0fe4f4c8b334a204fac17de0b4ee0ec7c4e687e6bf3945c12e564172b42df8fff9b6b4fef5e4dc8dec66e05bae
-
Filesize
136KB
MD508ae49246dba9a042983d2dd00c7cf1d
SHA18edd18b68312d8b4c2e13a2698c46632f87c2df2
SHA25656ab6f035e36dc711fac1168474056cfe42dca18a215866f176986917c8d0c18
SHA51222d1cf5dc7a43e363d692c3c2db1660d114114505decaa10022e5bd5b9d10407c64a0e54f5bb149e4b29203daf31ef9b4e0bc61eb1cdc54efec944fce862d257
-
Filesize
471KB
MD5cef5409347c540341b3286daa2cd2806
SHA12067ad95a4623c6c573c26bd6bd856264c33137a
SHA256e436b03b0c95d8b82d18892ffc90ff17198ac552491cc77da4fa5c1c0d41f7e6
SHA51298a7754fd49e0ec93eeaae76f8a0a29836b49d3ba3233913987f5a3e22b0278229636a9b18a6c9c173728be71ae26f536aba60162931480367863d44bb96d130
-
Filesize
67KB
MD57574cf2c64f35161ab1292e2f532aabf
SHA114ba3fa927a06224dfe587014299e834def4644f
SHA256de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
SHA5124db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
-
Filesize
646KB
MD55020c184a14d18efbdaac5380838c3e8
SHA19d7aea758023f8f6f3f43f122a5b99b92640a6d5
SHA25607e698ae2484992d5eb42e2d0b6ec241dc2749aa213cdf579fa18f917d991282
SHA512dd8fa3e480b76fe9f0fb616fbeacca481ca2957c85c91b341e7a5a9135ff6e3ce879bb6f17adc28d78b8df17360e9017aff504f2d8915d912b9d697a9868af89
-
Filesize
140KB
-
Filesize
192KB
-
Filesize
12KB
-
Filesize
192KB
-
Filesize
140KB