Overview

overview

10

Static

static

1

e6712ae2ce...3N.exe

windows7-x64

10

e6712ae2ce...3N.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    27-01-2025 13:52

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    e6712ae2ce83ee6067944d8f7036a0c9e700b5336e1877801ed4fc4ef9484023N.exe

  • Size

    971KB

  • MD5

    2f483b8b5b15e945811467511ebc3af0

  • SHA1

    7b7bbbcefe291db7f243124ca840ce5c54a8e646

  • SHA256

    e6712ae2ce83ee6067944d8f7036a0c9e700b5336e1877801ed4fc4ef9484023

  • SHA512

    400b1c5cc6e39f6a79e8fdc0b8cfe91f1b27c1c83619795aba73929707371498b999085cc1a69cea8ae13a212100be44fe6cc307d69644aa9c746636d5da033e

  • SSDEEP

    24576:TMjrW64T8eVpJ5V5N/7flrXyCBQR80FBmjRLrEH7p:Qjy64X31drPQR80FkjR8

Score
10/10
floxifbackdoordiscoverytrojanupx

Malware Config

Signatures

  • Floxif family
    floxif
  • Floxif, Floodfix

    Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.

    backdoortrojanfloxif
  • Detects Floxif payload 1 IoCs
    backdoor
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Loads dropped DLL 4 IoCs
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e6712ae2ce83ee6067944d8f7036a0c9e700b5336e1877801ed4fc4ef9484023N.exe
    "C:\Users\Admin\AppData\Local\Temp\e6712ae2ce83ee6067944d8f7036a0c9e700b5336e1877801ed4fc4ef9484023N.exe"
    1⤵
    • Loads dropped DLL
    • Enumerates connected drives
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2672

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\DriverPack Notifier\DriverPackNotifier.exe
    Filesize

    252KB

    MD5

    d663176b9297a432309140315169274c

    SHA1

    0f49833354b2b172491d8a32fd70c2bb35ae0535

    SHA256

    0659388dba26d26eada6d82ed38f22fb2b0a264d1cc4667cce7f4523c72d59be

    SHA512

    390372fba7408330c41db3c63b89ac67160c81e0f3e4cd9ec5ba656b41152bf48bd7b6c1a62b6c117ea3982da2d8c7e48b676da0f264f7c6887c8d8fc7e61878

    Download Submit

  • C:\Program Files (x86)\DriverPack Notifier\Uninstall.exe
    Filesize

    252KB

    MD5

    11fbd8034e2c62a0b5dbe718cac49096

    SHA1

    a8ff9efe00511577fb187245587e083b60c61451

    SHA256

    18ae5af757dc585b6bd461caaf7af264eeceb59983cf64f7312a9a6eec900396

    SHA512

    b1f25ab99b593f3ec5857c44341dec4c45fa5801316a2f073142f040b131279dba2bf79215afc373fa3ec6494e897870afa12ea1656ea0734bfabc5ac7daa1fa

    Download Submit

  • C:\Program Files (x86)\DriverPack Notifier\bin\Tools\wget.exe
    Filesize

    399KB

    MD5

    eb64098c7dab31d0e28b86f8152401fa

    SHA1

    e6a2d7cd085612c7030e6a91403d9b6816d423fe

    SHA256

    11c5d6eb7113d9f493a9e79c5cf0414428dc29eef1d901401177239452a3990e

    SHA512

    07e3215ad2d42a123ef4df4ca2cf60e95d81ad2e732d0896f5623b722c83a9533b64fb6adf8734c474f8a6800477100e54c5f49e7d9d548749dc60ffb6677de5

    Download Submit

  • \Program Files (x86)\DriverPack Notifier\DriverPackNotifier.exe.tmp
    Filesize

    328KB

    MD5

    0c6db008a1368e089f3d18494d1dcf64

    SHA1

    e1a761ebb6db9cfaabe4b1f4a7d2568b3136c6d1

    SHA256

    c0865d7b287b8dc111bf91be8a7da9f3ac159d151f1dd1e300e42d12a17a824c

    SHA512

    cec31d868a2baf98baa69180d127e9eb1e28c3002ab906138c84ddf2f378cfff1cfb3cc060a0e0d8dfb7d0fa635f193763f550468d2e3da662520d0fac15048a

    Download Submit

  • \Program Files (x86)\DriverPack Notifier\Uninstall.exe.tmp
    Filesize

    328KB

    MD5

    3fc555856a3365e228c17a8f03659029

    SHA1

    fa90babc4b403414bb00433ffe9e636cc238bb22

    SHA256

    97e9bb5a123aa72f7fd77e4d39d495e7b88a83701926efc7a73f8830a575a1c5

    SHA512

    0dc0f244d7331d5419961fcb2f66ee8fb0da2e9de9a9925a7a9ae82c7e6f5761273e3821cb743c3e85e5bea51ba0a64b09399904e0d569f26bb5988849f2dc0f

    Download Submit

  • \Program Files (x86)\DriverPack Notifier\bin\Tools\wget.exe.tmp
    Filesize

    475KB

    MD5

    db7d972b69923f90df1bdb810d60e5d0

    SHA1

    4d7439d3532ff5ebda80ad5adf48c8e8d3c7a180

    SHA256

    7b24a365f2c34b95d535b4e89e9003886cd487c52287d676c22429d3e08d5dfb

    SHA512

    0ddc7052120de3517163d338baa23b46c5ed0a3b0471c44d894ed078c0b655a3191e60a97446f44a6556b1bd2480738fdcc70c6282cabf180e3fd0c540226d74

    Download Submit

  • \Program Files\Common Files\System\symsrv.dll
    Filesize

    67KB

    MD5

    7574cf2c64f35161ab1292e2f532aabf

    SHA1

    14ba3fa927a06224dfe587014299e834def4644f

    SHA256

    de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085

    SHA512

    4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab

    Download Submit

  • memory/2672-3-0x0000000010000000-0x0000000010030000-memory.dmp

    Filesize

    192KB

    Download

  • memory/2672-5-0x000000000040F000-0x0000000000412000-memory.dmp

    Filesize

    12KB

    Download

  • memory/2672-94-0x0000000002EA0000-0x0000000002F8F000-memory.dmp

    Filesize

    956KB

    Download

  • memory/2672-101-0x0000000010000000-0x0000000010030000-memory.dmp

    Filesize

    192KB

    Download

  • memory/2672-102-0x0000000002EA0000-0x0000000002EA2000-memory.dmp

    Filesize

    8KB

    Download