Analysis
- max time kernel
149s - max time network
146s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
16/04/2026, 02:41
General
- Target 2026-04-16_cad25b921886496cf56280679a4b7a58_amadey_elex_floxif_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 258KB
- Sample260416-c6kr1aev3p
- SHA256 a3f1938d813a32cc8ed1d58d6883943e81558ed14e7d794f9c7c5564ca18f4b8
Malware Config
Signatures
- Family: Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
- Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
- Modifies visibility of hidden/system files in Explorer 2 TTPs 1 IoCs
- Detects Floxif payload 1 IoCs
- Custom signatureUPX dump on OEP (original entry point) 5 IoCs
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 1 IoCs
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Network Service Discovery 1 TTPs 8 IoCs
Attempt to gather information on host's network.
- UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 5 IoCs
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious behavior: LoadsDriver 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-16_cad25b921886496cf56280679a4b7a58_amadey_elex_floxif_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-16_cad25b921886496cf56280679a4b7a58_amadey_elex_floxif_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- Modifies visibility of file extensions in Explorer
- Modifies visibility of hidden/system files in Explorer
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\arp.exearp -a2⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\arp.exearp -s 10.127.0.1 20-de-37-05-b4-c72⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\arp.exearp -s 10.127.255.255 45-20-92-05-6d-e42⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\arp.exearp -s 224.0.0.22 00-6a-2c-d9-af-1d2⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\arp.exearp -s 224.0.0.251 fa-eb-9a-fe-a3-812⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\arp.exearp -s 224.0.0.252 3e-e3-5b-a5-fe-752⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\arp.exearp -s 239.255.255.250 ed-8d-61-0b-0b-882⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\arp.exearp -s 255.255.255.255 53-f3-48-e3-09-d22⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\arp.exearp -d2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Temp\fhnjg.sysC:\Users\Admin\AppData\Local\Temp\fhnjg.sys1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\ohftm.sysC:\Users\Admin\AppData\Local\Temp\ohftm.sys1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
symsrv.dll
1C7CAB4127C.tmp
fhnjg.sys
memory/1932-14-0x000001BA97AB0000-0x000001BA97BCE000-memory.dmp
memory/4732-20-0x0000000000840000-0x000000000085C000-memory.dmp
memory/4732-13-0x0000000000841000-0x0000000000842000-memory.dmp
memory/4732-5-0x0000000010000000-0x0000000010033000-memory.dmp
memory/4732-19-0x0000000010000000-0x0000000010033000-memory.dmp
memory/4732-0-0x0000000000840000-0x000000000085C000-memory.dmp
memory/4732-21-0x0000000010000000-0x0000000010033000-memory.dmp
memory/4732-22-0x0000000003890000-0x0000000003B1B000-memory.dmp
memory/4732-26-0x0000000010000000-0x0000000010033000-memory.dmp
memory/4732-27-0x0000000003890000-0x0000000003B1B000-memory.dmp
memory/4732-33-0x0000000003890000-0x0000000003B1B000-memory.dmp
memory/4732-43-0x0000000003890000-0x0000000003B1B000-memory.dmp
memory/4732-61-0x0000000003890000-0x0000000003B1B000-memory.dmp
memory/4732-64-0x0000000003890000-0x0000000003B1B000-memory.dmp