floxif | 372362b50557bf678a924d340f17399f8595a78ef51bba706b04571718b1c851

Analysis

max time kernel
104s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20250313-en
resource tags

arch:x64arch:x86image:win10v2004-20250313-enlocale:en-usos:windows10-2004-x64system
submitted
03/04/2025, 23:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-04-03_38058339fdd2912c35147a02d93fd036_black-basta_floxif_luca-stealer_remcos_rhadamanthys.exe
Size

16.8MB
MD5

38058339fdd2912c35147a02d93fd036
SHA1

7ce1111ba299613a6873d0427caca1979bd69504
SHA256

372362b50557bf678a924d340f17399f8595a78ef51bba706b04571718b1c851
SHA512

8604e3078f41a48c83d4c0bd422aca935fb6e3012cd86d7d68251d04858ffd25ed2b3da92069a711f52f321f977f1bec5a9977eb81c9324ba867e0bd5ce8e6d1
SSDEEP

393216:KUfoCkhfO/zFXGW/F/P9wXiXzThtaio4JfRs9:pRkdObGXYzt4kRk

Score

10^/10

floxif backdoor discovery execution trojan upx

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

https://mrodevicemgr.officeapps.live.com/mrodevicemgrsvc/api/v2/C2RReleaseData

Signatures

Floxif family
floxif
Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
backdoor trojan floxif

Detects Floxif payload 1 IoCs

backdoor

resource	yara_rule
behavioral1/files/0x00080000000241cc-1.dat	floxif

Blocklisted process makes network request 1 IoCs

flow	pid	Process
28	4764	powershell.exe

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x00080000000241cc-1.dat	acprotect

Executes dropped EXE 4 IoCs

pid	Process
1888	files.dat
5564	rld15511.exe
5760	2025-04-03_38058339fdd2912c35147a02d93fd036_black-basta_floxif_luca-stealer_remcos_rhadamanthys.exe
2264	oinstrun.exe

Loads dropped DLL 2 IoCs

pid	Process
5468	2025-04-03_38058339fdd2912c35147a02d93fd036_black-basta_floxif_luca-stealer_remcos_rhadamanthys.exe
5760	2025-04-03_38058339fdd2912c35147a02d93fd036_black-basta_floxif_luca-stealer_remcos_rhadamanthys.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4764	powershell.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\e:	2025-04-03_38058339fdd2912c35147a02d93fd036_black-basta_floxif_luca-stealer_remcos_rhadamanthys.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00080000000241cc-1.dat	upx
behavioral1/memory/5468-3-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/5468-76-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/5760-82-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/5760-97-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\symsrv.dll	2025-04-03_38058339fdd2912c35147a02d93fd036_black-basta_floxif_luca-stealer_remcos_rhadamanthys.exe
File created	\??\c:\program files\common files\system\symsrv.dll.000	2025-04-03_38058339fdd2912c35147a02d93fd036_black-basta_floxif_luca-stealer_remcos_rhadamanthys.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-04-03_38058339fdd2912c35147a02d93fd036_black-basta_floxif_luca-stealer_remcos_rhadamanthys.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-04-03_38058339fdd2912c35147a02d93fd036_black-basta_floxif_luca-stealer_remcos_rhadamanthys.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	files.dat
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rld15511.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1696	PING.EXE
1892	PING.EXE

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
1696	PING.EXE
1892	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4764	powershell.exe
5468	2025-04-03_38058339fdd2912c35147a02d93fd036_black-basta_floxif_luca-stealer_remcos_rhadamanthys.exe
5468	2025-04-03_38058339fdd2912c35147a02d93fd036_black-basta_floxif_luca-stealer_remcos_rhadamanthys.exe
4764	powershell.exe
2264	oinstrun.exe
2264	oinstrun.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5468	2025-04-03_38058339fdd2912c35147a02d93fd036_black-basta_floxif_luca-stealer_remcos_rhadamanthys.exe
Token: SeIncreaseQuotaPrivilege	5816	WMIC.exe
Token: SeSecurityPrivilege	5816	WMIC.exe
Token: SeTakeOwnershipPrivilege	5816	WMIC.exe
Token: SeLoadDriverPrivilege	5816	WMIC.exe
Token: SeSystemProfilePrivilege	5816	WMIC.exe
Token: SeSystemtimePrivilege	5816	WMIC.exe
Token: SeProfSingleProcessPrivilege	5816	WMIC.exe
Token: SeIncBasePriorityPrivilege	5816	WMIC.exe
Token: SeCreatePagefilePrivilege	5816	WMIC.exe
Token: SeBackupPrivilege	5816	WMIC.exe
Token: SeRestorePrivilege	5816	WMIC.exe
Token: SeShutdownPrivilege	5816	WMIC.exe
Token: SeDebugPrivilege	5816	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5816	WMIC.exe
Token: SeRemoteShutdownPrivilege	5816	WMIC.exe
Token: SeUndockPrivilege	5816	WMIC.exe
Token: SeManageVolumePrivilege	5816	WMIC.exe
Token: 33	5816	WMIC.exe
Token: 34	5816	WMIC.exe
Token: 35	5816	WMIC.exe
Token: 36	5816	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5816	WMIC.exe
Token: SeSecurityPrivilege	5816	WMIC.exe
Token: SeTakeOwnershipPrivilege	5816	WMIC.exe
Token: SeLoadDriverPrivilege	5816	WMIC.exe
Token: SeSystemProfilePrivilege	5816	WMIC.exe
Token: SeSystemtimePrivilege	5816	WMIC.exe
Token: SeProfSingleProcessPrivilege	5816	WMIC.exe
Token: SeIncBasePriorityPrivilege	5816	WMIC.exe
Token: SeCreatePagefilePrivilege	5816	WMIC.exe
Token: SeBackupPrivilege	5816	WMIC.exe
Token: SeRestorePrivilege	5816	WMIC.exe
Token: SeShutdownPrivilege	5816	WMIC.exe
Token: SeDebugPrivilege	5816	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5816	WMIC.exe
Token: SeRemoteShutdownPrivilege	5816	WMIC.exe
Token: SeUndockPrivilege	5816	WMIC.exe
Token: SeManageVolumePrivilege	5816	WMIC.exe
Token: 33	5816	WMIC.exe
Token: 34	5816	WMIC.exe
Token: 35	5816	WMIC.exe
Token: 36	5816	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4512	WMIC.exe
Token: SeSecurityPrivilege	4512	WMIC.exe
Token: SeTakeOwnershipPrivilege	4512	WMIC.exe
Token: SeLoadDriverPrivilege	4512	WMIC.exe
Token: SeSystemProfilePrivilege	4512	WMIC.exe
Token: SeSystemtimePrivilege	4512	WMIC.exe
Token: SeProfSingleProcessPrivilege	4512	WMIC.exe
Token: SeIncBasePriorityPrivilege	4512	WMIC.exe
Token: SeCreatePagefilePrivilege	4512	WMIC.exe
Token: SeBackupPrivilege	4512	WMIC.exe
Token: SeRestorePrivilege	4512	WMIC.exe
Token: SeShutdownPrivilege	4512	WMIC.exe
Token: SeDebugPrivilege	4512	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4512	WMIC.exe
Token: SeRemoteShutdownPrivilege	4512	WMIC.exe
Token: SeUndockPrivilege	4512	WMIC.exe
Token: SeManageVolumePrivilege	4512	WMIC.exe
Token: 33	4512	WMIC.exe
Token: 34	4512	WMIC.exe
Token: 35	4512	WMIC.exe
Token: 36	4512	WMIC.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 5468 wrote to memory of 5244	5468	2025-04-03_38058339fdd2912c35147a02d93fd036_black-basta_floxif_luca-stealer_remcos_rhadamanthys.exe	88
PID 5468 wrote to memory of 5244	5468	2025-04-03_38058339fdd2912c35147a02d93fd036_black-basta_floxif_luca-stealer_remcos_rhadamanthys.exe	88
PID 5468 wrote to memory of 2344	5468	2025-04-03_38058339fdd2912c35147a02d93fd036_black-basta_floxif_luca-stealer_remcos_rhadamanthys.exe	90
PID 5468 wrote to memory of 2344	5468	2025-04-03_38058339fdd2912c35147a02d93fd036_black-basta_floxif_luca-stealer_remcos_rhadamanthys.exe	90
PID 5244 wrote to memory of 5816	5244	cmd.exe	92
PID 5244 wrote to memory of 5816	5244	cmd.exe	92
PID 5468 wrote to memory of 5288	5468	2025-04-03_38058339fdd2912c35147a02d93fd036_black-basta_floxif_luca-stealer_remcos_rhadamanthys.exe	93
PID 5468 wrote to memory of 5288	5468	2025-04-03_38058339fdd2912c35147a02d93fd036_black-basta_floxif_luca-stealer_remcos_rhadamanthys.exe	93
PID 5288 wrote to memory of 1888	5288	cmd.exe	95
PID 5288 wrote to memory of 1888	5288	cmd.exe	95
PID 5288 wrote to memory of 1888	5288	cmd.exe	95
PID 5468 wrote to memory of 3492	5468	2025-04-03_38058339fdd2912c35147a02d93fd036_black-basta_floxif_luca-stealer_remcos_rhadamanthys.exe	97
PID 5468 wrote to memory of 3492	5468	2025-04-03_38058339fdd2912c35147a02d93fd036_black-basta_floxif_luca-stealer_remcos_rhadamanthys.exe	97
PID 3492 wrote to memory of 4512	3492	cmd.exe	99
PID 3492 wrote to memory of 4512	3492	cmd.exe	99
PID 5468 wrote to memory of 4764	5468	2025-04-03_38058339fdd2912c35147a02d93fd036_black-basta_floxif_luca-stealer_remcos_rhadamanthys.exe	100
PID 5468 wrote to memory of 4764	5468	2025-04-03_38058339fdd2912c35147a02d93fd036_black-basta_floxif_luca-stealer_remcos_rhadamanthys.exe	100
PID 5468 wrote to memory of 4764	5468	2025-04-03_38058339fdd2912c35147a02d93fd036_black-basta_floxif_luca-stealer_remcos_rhadamanthys.exe	100
PID 5468 wrote to memory of 5564	5468	2025-04-03_38058339fdd2912c35147a02d93fd036_black-basta_floxif_luca-stealer_remcos_rhadamanthys.exe	108
PID 5468 wrote to memory of 5564	5468	2025-04-03_38058339fdd2912c35147a02d93fd036_black-basta_floxif_luca-stealer_remcos_rhadamanthys.exe	108
PID 5468 wrote to memory of 5564	5468	2025-04-03_38058339fdd2912c35147a02d93fd036_black-basta_floxif_luca-stealer_remcos_rhadamanthys.exe	108
PID 5564 wrote to memory of 5760	5564	rld15511.exe	109
PID 5564 wrote to memory of 5760	5564	rld15511.exe	109
PID 5564 wrote to memory of 5760	5564	rld15511.exe	109
PID 5564 wrote to memory of 2120	5564	rld15511.exe	110
PID 5564 wrote to memory of 2120	5564	rld15511.exe	110
PID 5564 wrote to memory of 2120	5564	rld15511.exe	110
PID 2120 wrote to memory of 1696	2120	cmd.exe	112
PID 2120 wrote to memory of 1696	2120	cmd.exe	112
PID 2120 wrote to memory of 1696	2120	cmd.exe	112
PID 5760 wrote to memory of 5960	5760	2025-04-03_38058339fdd2912c35147a02d93fd036_black-basta_floxif_luca-stealer_remcos_rhadamanthys.exe	114
PID 5760 wrote to memory of 5960	5760	2025-04-03_38058339fdd2912c35147a02d93fd036_black-basta_floxif_luca-stealer_remcos_rhadamanthys.exe	114
PID 2120 wrote to memory of 1892	2120	cmd.exe	116
PID 2120 wrote to memory of 1892	2120	cmd.exe	116
PID 2120 wrote to memory of 1892	2120	cmd.exe	116
PID 5760 wrote to memory of 5796	5760	2025-04-03_38058339fdd2912c35147a02d93fd036_black-basta_floxif_luca-stealer_remcos_rhadamanthys.exe	117
PID 5760 wrote to memory of 5796	5760	2025-04-03_38058339fdd2912c35147a02d93fd036_black-basta_floxif_luca-stealer_remcos_rhadamanthys.exe	117
PID 5960 wrote to memory of 2244	5960	cmd.exe	119
PID 5960 wrote to memory of 2244	5960	cmd.exe	119
PID 5760 wrote to memory of 3408	5760	2025-04-03_38058339fdd2912c35147a02d93fd036_black-basta_floxif_luca-stealer_remcos_rhadamanthys.exe	121
PID 5760 wrote to memory of 3408	5760	2025-04-03_38058339fdd2912c35147a02d93fd036_black-basta_floxif_luca-stealer_remcos_rhadamanthys.exe	121
PID 3408 wrote to memory of 4816	3408	cmd.exe	123
PID 3408 wrote to memory of 4816	3408	cmd.exe	123
PID 5760 wrote to memory of 2264	5760	2025-04-03_38058339fdd2912c35147a02d93fd036_black-basta_floxif_luca-stealer_remcos_rhadamanthys.exe	124
PID 5760 wrote to memory of 2264	5760	2025-04-03_38058339fdd2912c35147a02d93fd036_black-basta_floxif_luca-stealer_remcos_rhadamanthys.exe	124

C:\Users\Admin\AppData\Local\Temp\2025-04-03_38058339fdd2912c35147a02d93fd036_black-basta_floxif_luca-stealer_remcos_rhadamanthys.exe
"C:\Users\Admin\AppData\Local\Temp\2025-04-03_38058339fdd2912c35147a02d93fd036_black-basta_floxif_luca-stealer_remcos_rhadamanthys.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5468
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\2025-04-03_38058339fdd2912c35147a02d93fd036_black-basta_floxif_luca-stealer_remcos_rhadamanthys.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5244
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\2025-04-03_38058339fdd2912c35147a02d93fd036_black-basta_floxif_luca-stealer_remcos_rhadamanthys.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5816
- C:\Windows\system32\reg.exe
  "C:\Windows\Sysnative\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled /t REG_DWORD /d 1 /f
  2⤵
  PID:2344
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /D /c files.dat -y -pkmsauto
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5288
- - C:\Users\Admin\AppData\Local\Temp\files\files.dat
    files.dat -y -pkmsauto
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1888
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\files"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3492
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\files"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4512
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -nop -command "& { (New-Object Net.WebClient).DownloadFile('https://mrodevicemgr.officeapps.live.com/mrodevicemgrsvc/api/v2/C2RReleaseData', 'C:\Users\Admin\AppData\Local\Temp\ver.txt') }"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4764
- C:\Users\Admin\AppData\Local\Temp\rld15511.exe
  "C:\Users\Admin\AppData\Local\Temp\rld15511.exe" "C:\Users\Admin\AppData\Local\Temp\2025-04-03_38058339fdd2912c35147a02d93fd036_black-basta_floxif_luca-stealer_remcos_rhadamanthys.exe" 1000
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5564
- - C:\Users\Admin\AppData\Local\Temp\2025-04-03_38058339fdd2912c35147a02d93fd036_black-basta_floxif_luca-stealer_remcos_rhadamanthys.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-04-03_38058339fdd2912c35147a02d93fd036_black-basta_floxif_luca-stealer_remcos_rhadamanthys.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5760
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\Sysnative\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\2025-04-03_38058339fdd2912c35147a02d93fd036_black-basta_floxif_luca-stealer_remcos_rhadamanthys.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5960
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\2025-04-03_38058339fdd2912c35147a02d93fd036_black-basta_floxif_luca-stealer_remcos_rhadamanthys.exe"
        5⤵
        
        PID:2244
  - - C:\Windows\system32\reg.exe
      "C:\Windows\Sysnative\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled /t REG_DWORD /d 1 /f
      4⤵
      PID:5796
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\Sysnative\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\files"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3408
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\files"
        5⤵
        
        PID:4816
  - - C:\Users\Admin\AppData\Local\Temp\oinstrun.exe
      "C:\Users\Admin\AppData\Local\Temp\oinstrun.exe" "C:\Users\Admin\AppData\Local\Temp\2025-04-03_38058339fdd2912c35147a02d93fd036_black-basta_floxif_luca-stealer_remcos_rhadamanthys.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:2264
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\SelfD30459.bat
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2120
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 1 localhost
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:1696
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 1 localhost
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:1892

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4b4 0x304
1⤵
PID:1544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\System\symsrv.dll

Filesize
67KB

MD5
7574cf2c64f35161ab1292e2f532aabf

SHA1
14ba3fa927a06224dfe587014299e834def4644f

SHA256
de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085

SHA512
4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\2025-04-03_38058339fdd2912c35147a02d93fd036_black-basta_floxif_luca-stealer_remcos_rhadamanthys.exe

Filesize
16.8MB

MD5
38058339fdd2912c35147a02d93fd036

SHA1
7ce1111ba299613a6873d0427caca1979bd69504

SHA256
372362b50557bf678a924d340f17399f8595a78ef51bba706b04571718b1c851

SHA512
8604e3078f41a48c83d4c0bd422aca935fb6e3012cd86d7d68251d04858ffd25ed2b3da92069a711f52f321f977f1bec5a9977eb81c9324ba867e0bd5ce8e6d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\A1D26E2\3D9514F8155C.tmp

Filesize
16.7MB

MD5
9b3fb0ecd6f386cd5de681bb94aa5b41

SHA1
bc056e85655557d947b44eee9fcc07669e7caa08

SHA256
9aa6753d204409cde394b1c9dcfe8054be04166843f63f8847710861de9508be

SHA512
330325023064ffb7541a104c222a22d15b9f9a257f4f2658fcb564b1257d7ad03e568adf97e7f16c2a5cb4de6ed43f823371ca6ab43acf47b8b0975e1948422e

Download Submit
C:\Users\Admin\AppData\Local\Temp\SelfD30459.bat

Filesize
157B

MD5
f3b2d9bb9dbe16a9a7b9235582014789

SHA1
ba17acad585ca2640a154290cfffc3b86db46bf2

SHA256
2e7b2d4cfc5083001e8183ae5ef0b60ec49e4b6b629c43bb41b2e36ee253311c

SHA512
0123daed25bde3e8a15ed0f36ec99688916b68d7448d91a1a985cba327f232be18a7940ee1c66413d1dbe507d9d52131ba1f510e995d9a728a4641d6579c102a

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vx0zabch.ndm.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\files\configure.xml

Filesize
1KB

MD5
2a798f1fe71e7e78983e1b81f29e627b

SHA1
36674d34cce4a5afccaac4e339ac876f1bce2ca8

SHA256
f2980edd3fd3ed28f520150ba1dfb4b43fa2d2eb4b9f6ebc9634f53c99478f37

SHA512
bfc17e6b080b4faccd915795a4bee083112e1d7f67fe6bc455a2abc47676dcfca75002c7b0c25cd992c1e6c4dd9534c170aad58a29ad2441cf37c4dbaf13f5f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\files\files.dat

Filesize
765KB

MD5
bb5569b15d68c10b7ff2d96b45825120

SHA1
d6d2ed450aae4552f550f59bffe3dd42d8377835

SHA256
4e3b13b56bec0e41778e6506430282bbbd75ccaa600fd4b645ce37dd95b44c8e

SHA512
640a9ae2d40c272638485d37fad4ed83c9c215ce60a0bd3d50db9f033aa79d4c7fc276d018b05f0b1d8446f5e84a7350c857ee8097c05a472c26bfb446038957

Download Submit
C:\Users\Admin\AppData\Local\Temp\oinstrun.exe

Filesize
14KB

MD5
32973232138fc6b30d913167096c059d

SHA1
d6a7cb95d5525ea3d7286749663e12c1addb3104

SHA256
4a01c55f4727b3771c2672421aa2c5c20534ad0530449ed168a16a3d33345d3d

SHA512
ce0ca843705f7059bad14260a48647797a6cb2d84c162aa943eb090a7d18f708a3403d94f92fbc67c1b1216f941bf591f358e35fef76db34125f37595e256b9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\rld15511.exe

Filesize
16KB

MD5
fc8ec75b7b5f3a2be9fdc67ee8808afa

SHA1
e5723567f6f3d12c2eaea3d07955cf5a259c8a8f

SHA256
03382bd8037a9cf6905c87b98b6768bd93fec22faf2f4092d81ac970703ea14f

SHA512
c83ee781775fef4f65244b108bd9ac88643340375b0a2880af9c5d44259ea2f416130c01da0279eb2683988fdf7fc1f8a91e5b013bef28ceb3a086da5ac8bc2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\ver.txt

Filesize
55KB

MD5
a061802f11d659bc2ad65a8489dfce7c

SHA1
c2413dacbc043b9da3cca854ebbacc7023c9975c

SHA256
3ec410fda561f1be02b09a561e431c1e4648c7f46de2318b1efa21396d101de0

SHA512
01082c6e1cd05cf9601908c6f38bf7e76512bfe0cb371028891c7eb3742e321009798a10d26adecda53bb4cccfbf9c647f0b7c6ef5c5b8e5b71f9220ea16bbce

Download Submit
memory/4764-36-0x0000000004B00000-0x0000000004B22000-memory.dmp

Filesize
136KB

Download
memory/4764-35-0x0000000004FC0000-0x00000000055E8000-memory.dmp

Filesize
6.2MB

Download
memory/4764-54-0x0000000005AF0000-0x0000000005B3C000-memory.dmp

Filesize
304KB

Download
memory/4764-55-0x0000000007100000-0x000000000777A000-memory.dmp

Filesize
6.5MB

Download
memory/4764-56-0x0000000005FC0000-0x0000000005FDA000-memory.dmp

Filesize
104KB

Download
memory/4764-48-0x00000000056F0000-0x0000000005A44000-memory.dmp

Filesize
3.3MB

Download
memory/4764-38-0x0000000004E80000-0x0000000004EE6000-memory.dmp

Filesize
408KB

Download
memory/4764-34-0x0000000000B90000-0x0000000000BC6000-memory.dmp

Filesize
216KB

Download
memory/4764-37-0x0000000004DA0000-0x0000000004E06000-memory.dmp

Filesize
408KB

Download
memory/4764-53-0x0000000005AB0000-0x0000000005ACE000-memory.dmp

Filesize
120KB

Download
memory/5468-76-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/5468-7-0x000000000054D000-0x0000000000550000-memory.dmp

Filesize
12KB

Download
memory/5468-3-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/5760-82-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/5760-97-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download