Analysis
- max time kernel
148s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
15/04/2026, 14:06
General
- Target 2026-04-15_0f26b4628045a04d0a8bfbc990111a32_darkgate_elex_floxif_glassworm_remcos_stop.exe
- Size 5.8MB
- Sample260415-reffjaa181
- SHA256 722f93cb6bcf8f011108063faac1f0b3d31da25ab8457ccf5d62c6291f05e82d
Malware Config
Signatures
- Family: Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
- Detects Floxif payload 1 IoCs
- Custom signatureDetects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 4 IoCs
- Custom signatureDetects executables containing SQL queries to confidential data stores. Observed in infostealers 4 IoCs
- Custom signatureUPX dump on OEP (original entry point) 9 IoCs
- A potential corporate email address has been identified in the URL: [email protected]
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL 1 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Installs/modifies Browser Helper Object 2 TTPs 8 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
- UPX packed file 9 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 20 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies Internet Explorer settings 1 TTPs 22 IoCs
- Modifies registry class 17 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 7 IoCs
- Suspicious use of FindShellTrayWindow 8 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
- Suspicious use of SetWindowsHookEx 11 IoCs
- Suspicious use of WriteProcessMemory 46 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_0f26b4628045a04d0a8bfbc990111a32_darkgate_elex_floxif_glassworm_remcos_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-15_0f26b4628045a04d0a8bfbc990111a32_darkgate_elex_floxif_glassworm_remcos_stop.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html2⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html3⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2000 -prefsLen 27099 -prefMapHandle 2004 -prefMapSize 270279 -ipcHandle 2080 -initialChannelId {3983aafa-b9b6-4caa-896b-ca3af301a99f} -parentPid 3820 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3820" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu4⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2480 -prefsLen 27135 -prefMapHandle 2484 -prefMapSize 270279 -ipcHandle 2492 -initialChannelId {4fd2b88e-1d13-4c68-b4f5-730fdf687b4c} -parentPid 3820 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3820" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket4⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3796 -prefsLen 25164 -prefMapHandle 3800 -prefMapSize 270279 -jsInitHandle 3804 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3812 -initialChannelId {f3ca5eef-d432-4eaf-bee5-7c148a62e30e} -parentPid 3820 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3820" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab4⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3960 -prefsLen 27276 -prefMapHandle 3964 -prefMapSize 270279 -ipcHandle 4048 -initialChannelId {6424f552-4291-48e3-9782-294995f1ed09} -parentPid 3820 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3820" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd4⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3016 -prefsLen 34775 -prefMapHandle 4428 -prefMapSize 270279 -jsInitHandle 4432 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2832 -initialChannelId {88a6d1c1-dc0c-4a63-82a2-1055d8622a5a} -parentPid 3820 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3820" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab4⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4948 -prefsLen 35012 -prefMapHandle 4952 -prefMapSize 270279 -ipcHandle 4928 -initialChannelId {09d26371-aa28-4073-978b-536f3641f7ff} -parentPid 3820 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3820" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility4⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5068 -prefsLen 32900 -prefMapHandle 5060 -prefMapSize 270279 -jsInitHandle 5056 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5044 -initialChannelId {bc7d733b-5a57-4f86-81e2-478d5c918be2} -parentPid 3820 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3820" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab4⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5344 -prefsLen 32952 -prefMapHandle 5348 -prefMapSize 270279 -jsInitHandle 5352 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5168 -initialChannelId {72c5cfc1-1b75-4c63-8b3a-f2a2408b8d21} -parentPid 3820 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3820" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab4⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5512 -prefsLen 32952 -prefMapHandle 5516 -prefMapSize 270279 -jsInitHandle 5520 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5528 -initialChannelId {6586f292-61a0-494f-9efe-9b9790ca0ac1} -parentPid 3820 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3820" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab4⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3840 -prefsLen 32952 -prefMapHandle 4284 -prefMapSize 270279 -jsInitHandle 4292 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3912 -initialChannelId {55b7d245-d6ce-4d25-8f9b-a383e6efce5d} -parentPid 3820 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3820" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab4⤵
- Checks processor information in registry
-
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMIECC64.dll"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMGetAll64.dll"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\downlWithIDM64.dll"2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Browser Extensions
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
symsrv.dll
symsrv.dll.000
CD1C116DEEE8F4F97C1806976E10E7E2B349E486
tmpaddon
tmpaddon
data.safe.tmp
data.safe.tmp
events
06869768-a2ca-44c1-86f1-44554d27ba01
256cace3-d882-48fd-a5a5-41a5ede3e404
6586d277-89dd-4d23-b915-c3ad54b63895
bf230db1-0794-4991-9ff1-510c30404c83
c7b75e82-0f88-4819-974c-333c8e51f1ef
f96f1203-f4e1-4b00-b03b-71db5edd0b78
extensions.json
gmpopenh264.dll
gmpopenh264.info
manifest.json
widevinecdm.dll
prefs-1.js
prefs.js
prefs.js
recovery.baklz4
3870112724rsegmnoittet-es.sqlite
memory/548-414-0x0000000000400000-0x0000000000520000-memory.dmp
memory/1844-412-0x0000000000C90000-0x0000000000DB0000-memory.dmp
memory/3220-413-0x0000000000880000-0x00000000009A0000-memory.dmp
memory/3580-415-0x00000000013E0000-0x0000000001500000-memory.dmp
memory/3932-10-0x0000000000E00000-0x0000000000F20000-memory.dmp
memory/5104-12-0x0000000000970000-0x0000000000F41000-memory.dmp
memory/5104-13-0x00000000020D0000-0x00000000021F0000-memory.dmp
memory/5104-418-0x0000000010000000-0x0000000010030000-memory.dmp
memory/5104-430-0x0000000000970000-0x0000000000F41000-memory.dmp
memory/5104-5-0x0000000000971000-0x0000000000972000-memory.dmp
memory/5104-432-0x0000000010000000-0x0000000010030000-memory.dmp
memory/5104-416-0x0000000000970000-0x0000000000F41000-memory.dmp
memory/5104-11-0x0000000010000000-0x0000000010030000-memory.dmp
memory/5104-391-0x00000000020D0000-0x00000000021F0000-memory.dmp
memory/5104-3-0x0000000010000000-0x0000000010030000-memory.dmp
memory/5104-392-0x0000000010000000-0x0000000010030000-memory.dmp
memory/5104-14-0x0000000010000000-0x0000000010030000-memory.dmp
memory/5104-656-0x0000000010000000-0x0000000010030000-memory.dmp
memory/5104-768-0x00000000020D0000-0x00000000021F0000-memory.dmp
memory/5104-767-0x0000000000970000-0x0000000000F41000-memory.dmp
memory/5104-776-0x0000000010000000-0x0000000010030000-memory.dmp