Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
28/01/2025, 00:18
General
-
Target
807376f59600671c258c4cf5cfaf89b3933bdef73cd425dae5f0e6fc315b3af1.exe
-
Size
3.7MB
-
MD5
11f6f0550436ad955c7c2b4f41a94896
-
SHA1
5443a7d9add5d0530621f2dbae5b27bdcf23a565
-
SHA256
807376f59600671c258c4cf5cfaf89b3933bdef73cd425dae5f0e6fc315b3af1
-
SHA512
0ac800c1e460a01f6326c18d508e2db30338e5c0bdd0b2a11eaba81e592e4c13e8f9035a1b1b2c82c6bbe1231a4a67bcec7377d1e1c358b29ddb7e802a25d7f7
-
SSDEEP
98304:35MQvY/NFRjQUEaUJhtH/Ll3AzrIdHM3AUDOE:J0dULh/Ll3grIdHM3AUDOE
Malware Config
Signatures
-
Floxif family
-
Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
-
Detects Floxif payload 1 IoCs
-
Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
-
Manipulates Digital Signatures 1 IoCs
Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 12 IoCs
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory 54 IoCs
-
UPX packed file 15 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Program Files directory 5 IoCs
-
Drops file in Windows directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 16 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\807376f59600671c258c4cf5cfaf89b3933bdef73cd425dae5f0e6fc315b3af1.exe"C:\Users\Admin\AppData\Local\Temp\807376f59600671c258c4cf5cfaf89b3933bdef73cd425dae5f0e6fc315b3af1.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cetrainers\CETA681.tmp\807376f59600671c258c4cf5cfaf89b3933bdef73cd425dae5f0e6fc315b3af1.exe"C:\Users\Admin\AppData\Local\Temp\cetrainers\CETA681.tmp\807376f59600671c258c4cf5cfaf89b3933bdef73cd425dae5f0e6fc315b3af1.exe" -ORIGIN:"C:\Users\Admin\AppData\Local\Temp\"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cetrainers\CETA681.tmp\extracted\807376f59600671c258c4cf5cfaf89b3933bdef73cd425dae5f0e6fc315b3af1.exeC:\Users\Admin\AppData\Local\Temp\cetrainers\CETA681.tmp\extracted\807376f59600671c258c4cf5cfaf89b3933bdef73cd425dae5f0e6fc315b3af1.exe "C:\Users\Admin\AppData\Local\Temp\cetrainers\CETA681.tmp\extracted\CET_TRAINER.CETRAINER" "-ORIGIN:C:\Users\Admin\AppData\Local\Temp\"3⤵
- Manipulates Digital Signatures
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67KB
MD57574cf2c64f35161ab1292e2f532aabf
SHA114ba3fa927a06224dfe587014299e834def4644f
SHA256de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
SHA5124db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
-
Filesize
3.8MB
MD501b29e41c3bf9514c28cd960b1911b0d
SHA156e45c5779353aeaa12e17b8b73030952c25c788
SHA256fb1317f4f7a7c5013ef2e94da325f03859e7d83617ed1cf46469d5295efcbecb
SHA512aeb378a1f4aafaae98931b5fb9d9463bf7a85c13b27a767efc280756e3f21b837738d26d14dec1d3be5d72d593814e186e8ae1522f7a0203b31f782eee1808a3
-
Filesize
196KB
MD5808de473370ef6b5d98ab752f245a3ca
SHA1800bd4ad10c17471829693fac3cee4502b14f029
SHA25665cbed2e8db313b8966638e40eb27f94156c294eb060b28a02c130d146518c39
SHA512fafaff03ad502523b3627e59e1026b8af4217a80215782a90667bc4f4c330871d8c3d890f2601b68ec9a42c0171d12b9e5b87067c95dcad1132b0a8979c56a4c
-
Filesize
272KB
MD54dc6d9cbac7fbccd877b7c278f5be779
SHA129eda075af08fe23404eabc2337df66e88df2618
SHA256e6ee64b22e67865e9c098a2d2b36a88b869fd75d1ec60be6fe7578e86b3e21f7
SHA5125e5e4355890371dddbd0391e00132bc3dbd7e5027f2c7b4fe1f0a20f5cc4f1f095409d64b5a68e042ef962a5233c08668e8e26e753dbd336ad8861e6d725a91f
-
Filesize
8.7MB
MD580345e6e05633a783e39a49e707578b5
SHA1bc393ba85741a957c0d46e5795a2e5749b2ca5a8
SHA256a1a7ab9eb55cb449f98473cc31ec66f4805cc5273dde67ae19cfcd794599c411
SHA5121c2447d1557bb2527b20b3b036008921c1390a17c1c419b7ca377b81d21cb648095d6c177e669c5374926eb4f48b66b71b8cb65e346a5342671eccd1bf018109
-
Filesize
7.0MB
MD5d34a325ac7de41aba31b49b8ca6223dc
SHA1d266583df43ccd64a789cf5a348cc13d4773b3b0
SHA256f207c438301241ded35b175bbc13ea6663925abab7aa4b4c455d8aeec4e5a2a2
SHA5128b919c3a9e04c2dd25f5a4f26ace298adb12fc703f349e8fad8bd807d980111c1d2ad9f20102433ab7d3d78d937a9617c3cb985b52ed87e72141ce13d7031a01
-
Filesize
65KB
MD586a624a5531a5a8a5d7f5103dcb158e2
SHA17a20a451d76bef93f211f39af2267b1a97c84504
SHA25645fac27f69fa3a767d56a75d09d9d6c726480695cbf175062a2f5baf625151d1
SHA512ea624de4e9a90121198c726cf41c07a6ca1772250083bd9157151c089e67a4ee9ba19efaf2b5391b5764fd315156b501279eeba27d634ab4fc1891b41eaf5cba
-
Filesize
5KB
MD5d8f9b4a10a48ebd8936255f6215c8a43
SHA17d8ff0012fa9d9dcf189c6df963f1c627f2ccb76
SHA256d4347332b232622283e7dd3781f64966bd1097d06cca7052b467cf99e62898f2
SHA51267db5dc65fef66fe3a1920c5f406091d17eeae27266039af392a166d63686b8fc61b94684f2b97762995aefa42d2d15148213ecef64cc0df04de19320abba97a
-
Filesize
329KB
MD52730ff589ae86ef10d94952769f9404f
SHA18010834297a6aa488e6bf90eceaaf9e60bb60c6e
SHA256faf0850051ba175347e40481da9e2cc3a122a09d428925042932be555db06e6b
SHA5125fb35eb364603568b67ce0d19371016a382bc62500de807a12492ceacd5d2b765e0908e2e7e9798446b6c005c0e48c0da74c1a0f9d55c49a8ef4eb3c3d1307e0
-
Filesize
406KB
MD51cee7b9841467e6b755f80087d3bc001
SHA16c720dd7b1b153d7a3f64b6292442fb051e575c5
SHA256c723c76ef48d5dc6269d5fa2b15b1aa56d2e383cd4859fd6efb0a9d010675df8
SHA5129bad6ed96abae071365cd520ba7c821b450c912a810a42cd7ed7c052cf42aa42b6bf45ed73ad7cb610724a389b3aaf65f1b23c45834381ecad53552ed5684cd2
-
Filesize
1.2MB
MD59139604740814e53298a5e8428ba29d7
SHA1c7bf8947e9276a311c4807ea4a57b504f95703c9
SHA256150782fca5e188762a41603e2d5c7aad6b6419926bcadf350ebf84328e50948f
SHA5120b99259e9c0ee566d55cc53c4a7eabf025ed95973edc80ded594023a33f8273cd5d3f3053993f771f9db8a9d234e988cba73845c19ddc6e629e15a243c54cd5d
-
Filesize
175B
MD51130c911bf5db4b8f7cf9b6f4b457623
SHA148e734c4bc1a8b5399bff4954e54b268bde9d54c
SHA256eba08cc8182f379392a97f542b350ea0dbbe5e4009472f35af20e3d857eafdf1
SHA51294e2511ef2c53494c2aff0960266491ffc0e54e75185427d1ccedae27c286992c754ca94cbb0c9ea36e3f04cd4eb7f032c551cf2d4b309f292906303f1a75fa0
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
4KB
-
Filesize
192KB
-
Filesize
344KB
-
Filesize
344KB
-
Filesize
9.1MB
-
Filesize
7.2MB
-
Filesize
344KB
-
Filesize
7.2MB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
4KB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
192KB
-
Filesize
9.1MB
-
Filesize
192KB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
12KB
-
Filesize
9.1MB
-
Filesize
4KB
-
Filesize
192KB
-
Filesize
9.1MB
-
Filesize
192KB
-
Filesize
9.1MB
-
Filesize
192KB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
12KB
-
Filesize
192KB
-
Filesize
9.1MB