Analysis
- user interaction
yes - max time kernel
30s - max time network
32s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-en - resource tags
- submitted
06/08/2026, 08:33
General
- Target Floxif.exe
- Size 532KB
- Sample260806-kf9mfagl21
- SHA256 812af0ec9e1dfd8f48b47fd148bafe6eecb42d0a304bc0e4539750dd23820a7f
Malware Config
Signatures
- Family: Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
- Detects Floxif payload 1 IoCs
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
- Loads dropped DLL 1 IoCs
- UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 1 IoCs
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 18 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of FindShellTrayWindow 30 IoCs
- Suspicious use of SendNotifyMessage 30 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Floxif.exe"C:\Users\Admin\AppData\Local\Temp\Floxif.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4296 -s 4762⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4296 -ip 42961⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
symsrv.dll
memory/2660-19-0x000001C47F650000-0x000001C47F651000-memory.dmp
memory/2660-10-0x000001C47F650000-0x000001C47F651000-memory.dmp
memory/2660-11-0x000001C47F650000-0x000001C47F651000-memory.dmp
memory/2660-9-0x000001C47F650000-0x000001C47F651000-memory.dmp
memory/2660-21-0x000001C47F650000-0x000001C47F651000-memory.dmp
memory/2660-20-0x000001C47F650000-0x000001C47F651000-memory.dmp
memory/2660-18-0x000001C47F650000-0x000001C47F651000-memory.dmp
memory/2660-17-0x000001C47F650000-0x000001C47F651000-memory.dmp
memory/2660-16-0x000001C47F650000-0x000001C47F651000-memory.dmp
memory/2660-15-0x000001C47F650000-0x000001C47F651000-memory.dmp
memory/4296-8-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4296-6-0x0000000000990000-0x0000000000A05000-memory.dmp
memory/4296-4-0x0000000010000000-0x0000000010030000-memory.dmp