Analysis
- max time kernel
149s - max time network
117s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
23/04/2026, 17:13
General
- Target 2026-04-23_6215084c785d1bf9b0ae95298c796a93_driverpack_elex_floxif_wannacry.exe
- Size 37.7MB
- Sample260423-vrt18scs9x
- SHA256 6d8afadcee636e0e65c0292125a9e0853119c990c57d36f2e5cff9252ca7172e
Malware Config
Signatures
- Family: Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
- Detects Floxif payload 1 IoCs
- Custom signatureUPX dump on OEP (original entry point) 4 IoCs
- Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
- ACProtect 1.3x - 1.4x DLL software 2 IoCs
Detects file using ACProtect software.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 47 IoCs
- UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-23_6215084c785d1bf9b0ae95298c796a93_driverpack_elex_floxif_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-23_6215084c785d1bf9b0ae95298c796a93_driverpack_elex_floxif_wannacry.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\XnConvert-win-x64\xnconvert.exe"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\XnConvert-win-x64\xnconvert.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
symsrv.dll
AVIFlib.dll
rwz_sdk.dll
Qt5ConcurrentXn.dll
Qt5CoreXn.dll
Qt5GuiXn.dll
Qt5NetworkXn.dll
Qt5SvgXn.dll
Qt5WidgetsXn.dll
Qt5WinExtrasXn.dll
Qt5XmlXn.dll
XMPCore.dll
libcrypto-1_1-x64.dll
libraw.dll
libssl-1_1-x64.dll
msvcp140.dll
msvcp140_1.dll
OpenEXR.dll
VTFLib.dll
heif.dll
libJPEGXL.dll
libflif.dll
libwebp.dll
openjp2.dll
qwindows.dll
qwindowsvistastyle.dll
qt.conf
vcomp140.dll
vcruntime140.dll
vcruntime140_1.dll
xnconvert.exe
memory/1804-657-0x0000000010000000-0x0000000010030000-memory.dmp
memory/1804-665-0x0000000000AF0000-0x0000000000BAB000-memory.dmp
memory/1804-4-0x0000000010000000-0x0000000010030000-memory.dmp
memory/1804-705-0x0000000000AF0000-0x0000000000BAB000-memory.dmp
memory/1804-681-0x0000000000AF0000-0x0000000000BAB000-memory.dmp
memory/1804-656-0x0000000000AF0000-0x0000000000BAB000-memory.dmp
memory/4896-627-0x000002060EF40000-0x000002060EF50000-memory.dmp
memory/4896-659-0x000002060EF20000-0x000002060EF29000-memory.dmp
memory/4896-658-0x000002060D6C0000-0x000002060D72F000-memory.dmp
memory/4896-660-0x000002060EF40000-0x000002060EF50000-memory.dmp
memory/4896-623-0x000002060EF30000-0x000002060EF31000-memory.dmp
memory/4896-671-0x000002060D6C0000-0x000002060D72F000-memory.dmp
memory/4896-622-0x00007FFBDE5C0000-0x00007FFBDEB0C000-memory.dmp
memory/4896-619-0x00007FF60BCF0000-0x00007FF60C3EE000-memory.dmp