Analysis
- max time kernel
149s - max time network
130s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
15/07/2026, 15:47
General
- Target 2026-07-15_25e8e282dabb91ddc49ab54699e792d9_darkgate_elex_floxif_rhadamanthys_smoke-loader.exe
- Size 8.0MB
- Sample260715-s8cr6sbs8y
- SHA256 823932e7fd469c77a6e1f712e4dbdf5b1e5d582158b7eec1b7ee7792ef9873c0
Malware Config
Signatures
- Family: Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
- Detects Floxif payload 1 IoCs
- UPX dump on OEP (original entry point) 3 IoCs
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
- Loads dropped DLL 1 IoCs
- UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-15_25e8e282dabb91ddc49ab54699e792d9_darkgate_elex_floxif_rhadamanthys_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-15_25e8e282dabb91ddc49ab54699e792d9_darkgate_elex_floxif_rhadamanthys_smoke-loader.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
symsrv.dll
memory/3460-3-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3460-13-0x000000007FC80000-0x000000007FE46000-memory.dmp
memory/3460-14-0x000000007FC80000-0x000000007FE46000-memory.dmp
memory/3460-21-0x000000007FC80000-0x000000007FE46000-memory.dmp
memory/3460-54-0x000000007FC80000-0x000000007FE46000-memory.dmp
memory/3460-52-0x000000007FC80000-0x000000007FE46000-memory.dmp
memory/3460-50-0x000000007FC80000-0x000000007FE46000-memory.dmp
memory/3460-49-0x000000007FC80000-0x000000007FE46000-memory.dmp
memory/3460-48-0x000000007FC80000-0x000000007FE46000-memory.dmp
memory/3460-47-0x000000007FC80000-0x000000007FE46000-memory.dmp
memory/3460-46-0x000000007FC80000-0x000000007FE46000-memory.dmp
memory/3460-45-0x000000007FC80000-0x000000007FE46000-memory.dmp
memory/3460-44-0x000000007FC80000-0x000000007FE46000-memory.dmp
memory/3460-43-0x000000007FC80000-0x000000007FE46000-memory.dmp
memory/3460-42-0x000000007FC80000-0x000000007FE46000-memory.dmp
memory/3460-41-0x000000007FC80000-0x000000007FE46000-memory.dmp
memory/3460-40-0x000000007FC80000-0x000000007FE46000-memory.dmp
memory/3460-39-0x000000007FC80000-0x000000007FE46000-memory.dmp
memory/3460-37-0x000000007FC80000-0x000000007FE46000-memory.dmp
memory/3460-36-0x000000007FC80000-0x000000007FE46000-memory.dmp
memory/3460-35-0x000000007FC80000-0x000000007FE46000-memory.dmp
memory/3460-34-0x000000007FC80000-0x000000007FE46000-memory.dmp
memory/3460-32-0x000000007FC80000-0x000000007FE46000-memory.dmp
memory/3460-31-0x000000007FC80000-0x000000007FE46000-memory.dmp
memory/3460-30-0x000000007FC80000-0x000000007FE46000-memory.dmp
memory/3460-29-0x000000007FC80000-0x000000007FE46000-memory.dmp
memory/3460-28-0x000000007FC80000-0x000000007FE46000-memory.dmp
memory/3460-27-0x000000007FC80000-0x000000007FE46000-memory.dmp
memory/3460-26-0x000000007FC80000-0x000000007FE46000-memory.dmp
memory/3460-25-0x000000007FC80000-0x000000007FE46000-memory.dmp
memory/3460-24-0x000000007FC80000-0x000000007FE46000-memory.dmp
memory/3460-23-0x000000007FC80000-0x000000007FE46000-memory.dmp
memory/3460-22-0x000000007FC80000-0x000000007FE46000-memory.dmp
memory/3460-51-0x000000007FC80000-0x000000007FE46000-memory.dmp
memory/3460-38-0x000000007FC80000-0x000000007FE46000-memory.dmp
memory/3460-33-0x000000007FC80000-0x000000007FE46000-memory.dmp
memory/3460-19-0x000000007FC80000-0x000000007FE46000-memory.dmp
memory/3460-18-0x000000007FC80000-0x000000007FE46000-memory.dmp
memory/3460-17-0x000000007FC80000-0x000000007FE46000-memory.dmp
memory/3460-16-0x000000007FC80000-0x000000007FE46000-memory.dmp
memory/3460-15-0x000000007FC80000-0x000000007FE46000-memory.dmp
memory/3460-12-0x000000007FC80000-0x000000007FE46000-memory.dmp
memory/3460-6-0x000000007FC80000-0x000000007FE46000-memory.dmp
memory/3460-75-0x000000007FC80000-0x000000007FE46000-memory.dmp
memory/3460-76-0x000000007FC80000-0x000000007FE46000-memory.dmp
memory/3460-73-0x000000007FC80000-0x000000007FE46000-memory.dmp
memory/3460-81-0x000000007FC80000-0x000000007FE46000-memory.dmp
memory/3460-127-0x000000007FC80000-0x000000007FE46000-memory.dmp
memory/3460-126-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3460-80-0x000000007FC80000-0x000000007FE46000-memory.dmp
memory/3460-79-0x0000000002B10000-0x0000000002B24000-memory.dmp
memory/3460-78-0x000000007FC80000-0x000000007FE46000-memory.dmp
memory/3460-77-0x000000007FC80000-0x000000007FE46000-memory.dmp
memory/3460-74-0x000000007FC80000-0x000000007FE46000-memory.dmp
memory/3460-72-0x000000007FC80000-0x000000007FE46000-memory.dmp
memory/3460-71-0x000000007FC80000-0x000000007FE46000-memory.dmp
memory/3460-70-0x000000007FC80000-0x000000007FE46000-memory.dmp
memory/3460-69-0x000000007FC80000-0x000000007FE46000-memory.dmp
memory/3460-68-0x000000007FC80000-0x000000007FE46000-memory.dmp
memory/3460-67-0x000000007FC80000-0x000000007FE46000-memory.dmp
memory/3460-66-0x000000007FC80000-0x000000007FE46000-memory.dmp
memory/3460-65-0x000000007FC80000-0x000000007FE46000-memory.dmp
memory/3460-64-0x000000007FC80000-0x000000007FE46000-memory.dmp
memory/3460-63-0x000000007FC80000-0x000000007FE46000-memory.dmp
memory/3460-62-0x000000007FC80000-0x000000007FE46000-memory.dmp
memory/3460-61-0x000000007FC80000-0x000000007FE46000-memory.dmp
memory/3460-60-0x000000007FC80000-0x000000007FE46000-memory.dmp
memory/3460-59-0x000000007FC80000-0x000000007FE46000-memory.dmp
memory/3460-58-0x000000007FC80000-0x000000007FE46000-memory.dmp
memory/3460-57-0x000000007FC80000-0x000000007FE46000-memory.dmp
memory/3460-56-0x000000007FC80000-0x000000007FE46000-memory.dmp
memory/3460-55-0x000000007FC80000-0x000000007FE46000-memory.dmp
memory/3460-128-0x000000007FC80000-0x000000007FE46000-memory.dmp
memory/3460-129-0x000000007FC80000-0x000000007FE46000-memory.dmp