Analysis
- max time kernel
149s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
08/08/2026, 15:22
General
- Target 2026-08-08_f4288986b9556a79ca9c38491f7a91d8_amadey_elex_floxif_icedid_remcos_smoke-loader_stop.exe
- Size 4.2MB
- Sample260808-ssd1asyhrf
- SHA256 dd776af41e39fa4823c9ca2423c2759a6803335509d35254ac71b059d93541c9
Malware Config
Signatures
- Family: Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
- Detects Floxif payload 1 IoCs
- UPX dump on OEP (original entry point) 3 IoCs
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
- Loads dropped DLL 3 IoCs
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies Internet Explorer settings 1 TTPs 4 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_f4288986b9556a79ca9c38491f7a91d8_amadey_elex_floxif_icedid_remcos_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_f4288986b9556a79ca9c38491f7a91d8_amadey_elex_floxif_icedid_remcos_smoke-loader_stop.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
symsrv.dll
symsrv.dll.000
240647484.dll
b382b710b61ff7d2bfd725e6cdcc928f.htm
addvote[1].css
board.default[1].css
cameron.responsive[1].css
colorset3[1].css
default.min[1].css
editor.htm
font_awesome.min[1].css
jquery_ui.min[1].css
layout[1].css
neatSign[1].css
neat_news_ticker[1].css
neat_side[1].css
neat_side_list[1].css
style[1].css
style[2].css
xe.min[1].css
memory/2792-56-0x0000000077560000-0x0000000077585000-memory.dmp
memory/2792-31-0x0000000077560000-0x0000000077585000-memory.dmp
memory/2792-61-0x0000000075130000-0x0000000075340000-memory.dmp
memory/2792-60-0x0000000076120000-0x00000000766D3000-memory.dmp
memory/2792-59-0x0000000075F70000-0x000000007601F000-memory.dmp
memory/2792-58-0x0000000000400000-0x0000000000715000-memory.dmp
memory/2792-63-0x0000000074A60000-0x0000000074AD4000-memory.dmp
memory/2792-55-0x0000000075130000-0x0000000075340000-memory.dmp
memory/2792-54-0x0000000076120000-0x00000000766D3000-memory.dmp
memory/2792-53-0x0000000075F70000-0x000000007601F000-memory.dmp
memory/2792-52-0x0000000000400000-0x0000000000715000-memory.dmp
memory/2792-51-0x0000000074A60000-0x0000000074AD4000-memory.dmp
memory/2792-50-0x0000000075130000-0x0000000075340000-memory.dmp
memory/2792-49-0x0000000076120000-0x00000000766D3000-memory.dmp
memory/2792-48-0x0000000075F70000-0x000000007601F000-memory.dmp
memory/2792-47-0x0000000000400000-0x0000000000715000-memory.dmp
memory/2792-46-0x0000000074A60000-0x0000000074AD4000-memory.dmp
memory/2792-45-0x0000000075100000-0x000000007512C000-memory.dmp
memory/2792-44-0x0000000075130000-0x0000000075340000-memory.dmp
memory/2792-43-0x0000000075720000-0x0000000075803000-memory.dmp
memory/2792-42-0x0000000076120000-0x00000000766D3000-memory.dmp
memory/2792-40-0x0000000075460000-0x000000007553C000-memory.dmp
memory/2792-39-0x0000000000400000-0x0000000000715000-memory.dmp
memory/2792-38-0x0000000075100000-0x000000007512C000-memory.dmp
memory/2792-37-0x0000000075130000-0x0000000075340000-memory.dmp
memory/2792-35-0x0000000076120000-0x00000000766D3000-memory.dmp
memory/2792-30-0x0000000000400000-0x0000000000715000-memory.dmp
memory/2792-29-0x0000000000400000-0x0000000000715000-memory.dmp
memory/2792-28-0x0000000077560000-0x0000000077585000-memory.dmp
memory/2792-26-0x0000000075B20000-0x0000000075B9A000-memory.dmp
memory/2792-27-0x0000000075100000-0x000000007512C000-memory.dmp
memory/2792-25-0x0000000000400000-0x0000000000715000-memory.dmp
memory/2792-24-0x0000000077560000-0x0000000077585000-memory.dmp
memory/2792-23-0x0000000075100000-0x000000007512C000-memory.dmp
memory/2792-22-0x0000000075B20000-0x0000000075B9A000-memory.dmp
memory/2792-21-0x0000000000400000-0x0000000000715000-memory.dmp
memory/2792-20-0x0000000075B20000-0x0000000075B9A000-memory.dmp
memory/2792-19-0x0000000000400000-0x0000000000715000-memory.dmp
memory/2792-17-0x0000000075100000-0x000000007512C000-memory.dmp
memory/2792-18-0x000000000055E000-0x000000000055F000-memory.dmp
memory/2792-15-0x0000000000400000-0x0000000000715000-memory.dmp
memory/2792-62-0x0000000075100000-0x000000007512C000-memory.dmp
memory/2792-73-0x0000000076120000-0x00000000766D3000-memory.dmp
memory/2792-78-0x0000000000400000-0x0000000000715000-memory.dmp
memory/2792-77-0x0000000075130000-0x0000000075340000-memory.dmp
memory/2792-76-0x0000000076120000-0x00000000766D3000-memory.dmp
memory/2792-75-0x0000000000400000-0x0000000000715000-memory.dmp
memory/2792-74-0x0000000075130000-0x0000000075340000-memory.dmp
memory/2792-64-0x0000000000400000-0x0000000000715000-memory.dmp
memory/2792-65-0x0000000075460000-0x000000007553C000-memory.dmp
memory/2792-66-0x0000000075F70000-0x000000007601F000-memory.dmp
memory/2792-67-0x0000000076120000-0x00000000766D3000-memory.dmp
memory/2792-68-0x0000000075720000-0x0000000075803000-memory.dmp
memory/2792-69-0x0000000075130000-0x0000000075340000-memory.dmp
memory/2792-70-0x0000000075100000-0x000000007512C000-memory.dmp
memory/2792-71-0x0000000074A60000-0x0000000074AD4000-memory.dmp
memory/2792-72-0x0000000000400000-0x0000000000715000-memory.dmp
memory/2792-57-0x0000000074A60000-0x0000000074AD4000-memory.dmp
memory/2792-41-0x0000000075F70000-0x000000007601F000-memory.dmp
memory/2792-36-0x0000000075720000-0x0000000075803000-memory.dmp
memory/2792-32-0x0000000000400000-0x0000000000715000-memory.dmp
memory/2792-34-0x0000000075F70000-0x000000007601F000-memory.dmp
memory/2792-33-0x0000000000400000-0x0000000000715000-memory.dmp
memory/2792-16-0x0000000075B20000-0x0000000075B9A000-memory.dmp
memory/2792-14-0x0000000075B20000-0x0000000075B9A000-memory.dmp
memory/2792-382-0x0000000000400000-0x0000000000715000-memory.dmp
memory/2792-390-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2792-392-0x000000000055E000-0x000000000055F000-memory.dmp
memory/2792-393-0x0000000000400000-0x0000000000715000-memory.dmp
memory/2792-395-0x0000000000400000-0x0000000000715000-memory.dmp
memory/2792-397-0x0000000000400000-0x0000000000715000-memory.dmp
memory/2792-398-0x0000000000400000-0x0000000000715000-memory.dmp
memory/2792-400-0x0000000000400000-0x0000000000715000-memory.dmp
memory/2792-401-0x0000000000400000-0x0000000000715000-memory.dmp
memory/2792-4-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2792-403-0x0000000000400000-0x0000000000715000-memory.dmp
memory/2792-405-0x0000000000400000-0x0000000000715000-memory.dmp
memory/2792-407-0x0000000000400000-0x0000000000715000-memory.dmp
memory/2792-413-0x0000000000400000-0x0000000000715000-memory.dmp
memory/2792-417-0x0000000000400000-0x0000000000715000-memory.dmp
memory/2792-418-0x0000000000400000-0x0000000000715000-memory.dmp
memory/2792-420-0x0000000000400000-0x0000000000715000-memory.dmp
memory/2792-421-0x0000000000400000-0x0000000000715000-memory.dmp
memory/2792-422-0x0000000000400000-0x0000000000715000-memory.dmp