Analysis
- max time kernel
149s - max time network
135s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
10/07/2026, 13:28
General
- Target 2026-07-10_7e0630aadc2dde2e80c110fb9aa0743f_darkgate_elex_floxif_rhadamanthys_smoke-loader.exe
- Size 8.0MB
- Sample260710-qqpb5sat3n
- SHA256 8a7847d773e2dd11207799e2a4af963921566c7868d5de1f34ebd8c0ce32f79d
Malware Config
Signatures
- Family: Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
- Detects Floxif payload 1 IoCs
- UPX dump on OEP (original entry point) 3 IoCs
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
- Loads dropped DLL 1 IoCs
- UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-10_7e0630aadc2dde2e80c110fb9aa0743f_darkgate_elex_floxif_rhadamanthys_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-10_7e0630aadc2dde2e80c110fb9aa0743f_darkgate_elex_floxif_rhadamanthys_smoke-loader.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
symsrv.dll
memory/5168-4-0x0000000010000000-0x0000000010030000-memory.dmp
memory/5168-32-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/5168-42-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/5168-41-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/5168-57-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/5168-76-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/5168-81-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/5168-83-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/5168-115-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/5168-118-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/5168-133-0x0000000010000000-0x0000000010030000-memory.dmp
memory/5168-117-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/5168-116-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/5168-114-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/5168-94-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/5168-89-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/5168-84-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/5168-113-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/5168-112-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/5168-111-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/5168-79-0x0000000002B90000-0x0000000002BA4000-memory.dmp
memory/5168-78-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/5168-75-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/5168-72-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/5168-71-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/5168-70-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/5168-69-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/5168-68-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/5168-67-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/5168-66-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/5168-65-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/5168-64-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/5168-63-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/5168-62-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/5168-61-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/5168-58-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/5168-56-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/5168-55-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/5168-54-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/5168-53-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/5168-52-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/5168-51-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/5168-50-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/5168-49-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/5168-48-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/5168-47-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/5168-46-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/5168-45-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/5168-73-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/5168-59-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/5168-60-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/5168-40-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/5168-39-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/5168-38-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/5168-37-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/5168-36-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/5168-35-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/5168-34-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/5168-31-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/5168-30-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/5168-29-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/5168-28-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/5168-27-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/5168-26-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/5168-24-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/5168-23-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/5168-22-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/5168-21-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/5168-20-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/5168-19-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/5168-18-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/5168-17-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/5168-16-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/5168-15-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/5168-13-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/5168-12-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/5168-33-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/5168-25-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/5168-14-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/5168-6-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/5168-44-0x000000007FCD0000-0x000000007FE96000-memory.dmp