Analysis
-
max time kernel
150s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20250313-en -
resource tags
-
submitted
03/04/2025, 17:04
General
-
Target
2025-04-03_511e7ba3b99b33a5bf30988fda35eb65_black-basta_cobalt-strike_floxif_luca-stealer_swisyn.exe
-
Size
590KB
-
MD5
511e7ba3b99b33a5bf30988fda35eb65
-
SHA1
8e7ab31d7962dcca4c67c054d00816109139357c
-
SHA256
63a1c6214d0b054a3f4ba490ad61ee07f05f5fa7d5a79fffacd4b24b4e84722e
-
SHA512
4199e749a5e7d80a14d9f0c3949357e894a796b11f4449559da0c333592c60a79aebcef86ad054707c2c59d0427d90714d84652e16ec52b67da3e0c95008a842
-
SSDEEP
12288:cFUNDa6FAhDaXkDOymC2+7Mdjm7sBjvrEH78n:cFOa6FwaXkqi7Mdjm7GrEH78n
Malware Config
Signatures
-
Floxif family
-
Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
-
Detects Floxif payload 1 IoCs
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
-
Executes dropped EXE 16 IoCs
-
Loads dropped DLL 2 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Drops file in System32 directory 2 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Program Files directory 1 IoCs
-
Drops file in Windows directory 6 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 17 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 34 IoCs
-
Suspicious use of WriteProcessMemory 48 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-04-03_511e7ba3b99b33a5bf30988fda35eb65_black-basta_cobalt-strike_floxif_luca-stealer_swisyn.exe"C:\Users\Admin\AppData\Local\Temp\2025-04-03_511e7ba3b99b33a5bf30988fda35eb65_black-basta_cobalt-strike_floxif_luca-stealer_swisyn.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\users\admin\appdata\local\temp\2025-04-03_511e7ba3b99b33a5bf30988fda35eb65_black-basta_cobalt-strike_floxif_luca-stealer_swisyn.exec:\users\admin\appdata\local\temp\2025-04-03_511e7ba3b99b33a5bf30988fda35eb65_black-basta_cobalt-strike_floxif_luca-stealer_swisyn.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\users\admin\appdata\local\temp\2025-04-03_511e7ba3b99b33a5bf30988fda35eb65_black-basta_cobalt-strike_floxif_luca-stealer_swisyn.exec:\users\admin\appdata\local\temp\2025-04-03_511e7ba3b99b33a5bf30988fda35eb65_black-basta_cobalt-strike_floxif_luca-stealer_swisyn.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\Resources\Themes\icsys.icn.exeC:\Windows\Resources\Themes\icsys.icn.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\Resources\Themes\icsys.icn.exeC:\Windows\Resources\Themes\icsys.icn.exe2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe3⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE4⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe5⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c c:\windows\resources\themes\explorer.exe RO1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe RO2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c c:\windows\resources\svchost.exe RO1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe RO2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c c:\windows\resources\themes\explorer.exe RO1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe RO2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c c:\windows\resources\svchost.exe RO1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe RO2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c c:\windows\resources\themes\explorer.exe RO1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe RO2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c c:\windows\resources\svchost.exe RO1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe RO2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c c:\windows\resources\themes\explorer.exe RO1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe RO2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c c:\windows\resources\svchost.exe RO1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe RO2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67KB
MD57574cf2c64f35161ab1292e2f532aabf
SHA114ba3fa927a06224dfe587014299e834def4644f
SHA256de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
SHA5124db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
-
Filesize
454KB
MD5f21483959040409ca50c09395178d42c
SHA1d43d5e0f497b0a99f83a0616f1426ae7725e229b
SHA256e73e70c6e5ecafdd43384ce6f2caaac2b4b01d2c1934124a3153f1ef1a662b44
SHA5125590f4da3ba20e5c72d35c13d68974c62db3232a08a2aae0f2ed307c2c73cce7f320eb066dfa889145bf6e979d1b26aae8f04d49a9df3c2ebdb1d8541c3e81c8
-
Filesize
378KB
MD5505d4ac9f6aeabcf2541f397fe8064c9
SHA11b030d3e59a5efded4a2b3ee9dfb76bfa3a049b7
SHA2569975d797441037f8a902c756e43ceb5317a22ed950525976d80e77e2b5b69c0c
SHA5121ddfeaf3264238fe7005292588381fa233b7406a9c25b299f73caa6e37f0640b9e4acb66fbbb4c9d3d62a974cd1bc7b78deb64f6afc7bcbd7b4a9d94761b895c
-
Filesize
135KB
MD53971e2f43c6cb9ee11ab773e1577a313
SHA1a4c197cbc8ff502efdb3ee9fe6b2710d7a3d236e
SHA2564273d79b1413e81532ea6f1afe85c06cf8470771fe069c5f7b6f3df6776eebcd
SHA5128a2febb040d85c30a240aa1a20a6c61254c83cc3ebf65ec4654f89f1e92d35608d7a6cfa401695716aebe0a67e45ad2baa1a42ca9df743dfa4c41da56343e001
-
Filesize
135KB
MD536a79c96a9688684908613b096668897
SHA1ef66caf632892e8f92a903a15f7d545fc98797bf
SHA256d05eddfa333dca7a3e19dc6f20ab56e9785766ae5e18094cb4cb17934720a30b
SHA5125c2ccc1185cde5d354872961db976a3fb14ae3ab56c95065ab37cb2905242534bdd6ba91011fa43dc92005c58169ec213bca7f60d7ae53ef632d7c9eabf8f02b
-
Filesize
135KB
MD5c358764de624bc47cc0b1c93b432ecfc
SHA1c0c2e536be9c5e7a2d6ebc8941c766a0a9e6eb69
SHA2563d35333d4c2f93cee9844819b7fd48018e173061bd8ee72a7fd6a56cf0e52288
SHA51248ae36e405d3c49b6a7636537f62069d4c220fda0f4f41646d785ec25293b01836e957878dceef76eb923311fbdbe3070e7e189a3c11046fada6a8a33060fb34
-
Filesize
135KB
MD5cc1f32ed24a8d5c9e6f2830bd2ad8a7e
SHA13a3f19352fd95058f02518fd7a061a2b2a65e42a
SHA2568af1dcd0281087ec618c9897a426ab2e4035e0fe37b36e584b4670c8da21d8ce
SHA512d6ab198cedd5308b4ffc2146b7dd510c19638c34ab5bf51980c11e0dc874452006c498a964a722927171bcfa6b2febcfdcc1acd65e3677f022b22ce9468e78aa
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
192KB
-
Filesize
12KB
-
Filesize
192KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
124KB