Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
08/08/2026, 16:22
General
- Target 2026-08-08_2e119f2823f1d4a79437532e3071eb9e_amadey_elex_floxif_icedid_remcos_smoke-loader_stop.exe
- Size 3.5MB
- Sample260808-tvdb8avsft
- SHA256 04bd12d6b1fc185c32b4a40998efa955f44ad5958354980a17e48e991a77a0ad
Malware Config
Signatures
- Family: Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
- Detects Floxif payload 1 IoCs
- UPX dump on OEP (original entry point) 3 IoCs
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
- Loads dropped DLL 3 IoCs
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies Internet Explorer settings 1 TTPs 4 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2e119f2823f1d4a79437532e3071eb9e_amadey_elex_floxif_icedid_remcos_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_2e119f2823f1d4a79437532e3071eb9e_amadey_elex_floxif_icedid_remcos_smoke-loader_stop.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
symsrv.dll
symsrv.dll.000
55204E0101C.tmp
240670000.dll
bdc069ece468ae16fc93c865f2dfb2bd.htm
ads[3].htm
memory/4124-38-0x0000000074660000-0x000000007468C000-memory.dmp
memory/4124-27-0x0000000074660000-0x000000007468C000-memory.dmp
memory/4124-18-0x000000000055E000-0x000000000055F000-memory.dmp
memory/4124-25-0x0000000000400000-0x0000000000715000-memory.dmp
memory/4124-34-0x0000000076CE0000-0x0000000076D8F000-memory.dmp
memory/4124-32-0x0000000000400000-0x0000000000715000-memory.dmp
memory/4124-36-0x00000000764F0000-0x00000000765D3000-memory.dmp
memory/4124-35-0x0000000075300000-0x00000000758B3000-memory.dmp
memory/4124-33-0x0000000000400000-0x0000000000715000-memory.dmp
memory/4124-30-0x0000000000400000-0x0000000000715000-memory.dmp
memory/4124-40-0x0000000076D90000-0x0000000076E6C000-memory.dmp
memory/4124-61-0x0000000074A90000-0x0000000074CA0000-memory.dmp
memory/4124-63-0x0000000074340000-0x00000000743B4000-memory.dmp
memory/4124-66-0x0000000076CE0000-0x0000000076D8F000-memory.dmp
memory/4124-65-0x0000000076D90000-0x0000000076E6C000-memory.dmp
memory/4124-64-0x0000000000400000-0x0000000000715000-memory.dmp
memory/4124-62-0x0000000074660000-0x000000007468C000-memory.dmp
memory/4124-60-0x0000000075300000-0x00000000758B3000-memory.dmp
memory/4124-59-0x0000000076CE0000-0x0000000076D8F000-memory.dmp
memory/4124-58-0x0000000000400000-0x0000000000715000-memory.dmp
memory/4124-57-0x0000000074340000-0x00000000743B4000-memory.dmp
memory/4124-56-0x0000000075AB0000-0x0000000075AD5000-memory.dmp
memory/4124-55-0x0000000074A90000-0x0000000074CA0000-memory.dmp
memory/4124-54-0x0000000075300000-0x00000000758B3000-memory.dmp
memory/4124-53-0x0000000076CE0000-0x0000000076D8F000-memory.dmp
memory/4124-52-0x0000000000400000-0x0000000000715000-memory.dmp
memory/4124-51-0x0000000074340000-0x00000000743B4000-memory.dmp
memory/4124-50-0x0000000074A90000-0x0000000074CA0000-memory.dmp
memory/4124-47-0x0000000000400000-0x0000000000715000-memory.dmp
memory/4124-49-0x0000000075300000-0x00000000758B3000-memory.dmp
memory/4124-48-0x0000000076CE0000-0x0000000076D8F000-memory.dmp
memory/4124-46-0x0000000074340000-0x00000000743B4000-memory.dmp
memory/4124-44-0x0000000074A90000-0x0000000074CA0000-memory.dmp
memory/4124-26-0x0000000076470000-0x00000000764EA000-memory.dmp
memory/4124-39-0x0000000000400000-0x0000000000715000-memory.dmp
memory/4124-45-0x0000000074660000-0x000000007468C000-memory.dmp
memory/4124-43-0x00000000764F0000-0x00000000765D3000-memory.dmp
memory/4124-41-0x0000000076CE0000-0x0000000076D8F000-memory.dmp
memory/4124-4-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4124-37-0x0000000074A90000-0x0000000074CA0000-memory.dmp
memory/4124-31-0x0000000075AB0000-0x0000000075AD5000-memory.dmp
memory/4124-29-0x0000000000400000-0x0000000000715000-memory.dmp
memory/4124-14-0x0000000076470000-0x00000000764EA000-memory.dmp
memory/4124-28-0x0000000075AB0000-0x0000000075AD5000-memory.dmp
memory/4124-42-0x0000000075300000-0x00000000758B3000-memory.dmp
memory/4124-24-0x0000000075AB0000-0x0000000075AD5000-memory.dmp
memory/4124-23-0x0000000074660000-0x000000007468C000-memory.dmp
memory/4124-22-0x0000000076470000-0x00000000764EA000-memory.dmp
memory/4124-21-0x0000000000400000-0x0000000000715000-memory.dmp
memory/4124-20-0x0000000076470000-0x00000000764EA000-memory.dmp
memory/4124-19-0x0000000000400000-0x0000000000715000-memory.dmp
memory/4124-17-0x0000000074660000-0x000000007468C000-memory.dmp
memory/4124-16-0x0000000076470000-0x00000000764EA000-memory.dmp
memory/4124-15-0x0000000000400000-0x0000000000715000-memory.dmp
memory/4124-78-0x0000000000400000-0x0000000000715000-memory.dmp
memory/4124-76-0x0000000075300000-0x00000000758B3000-memory.dmp
memory/4124-77-0x0000000074A90000-0x0000000074CA0000-memory.dmp
memory/4124-75-0x0000000000400000-0x0000000000715000-memory.dmp
memory/4124-74-0x0000000074A90000-0x0000000074CA0000-memory.dmp
memory/4124-72-0x0000000000400000-0x0000000000715000-memory.dmp
memory/4124-69-0x0000000074A90000-0x0000000074CA0000-memory.dmp
memory/4124-67-0x0000000075300000-0x00000000758B3000-memory.dmp
memory/4124-73-0x0000000075300000-0x00000000758B3000-memory.dmp
memory/4124-71-0x0000000074340000-0x00000000743B4000-memory.dmp
memory/4124-70-0x0000000074660000-0x000000007468C000-memory.dmp
memory/4124-68-0x00000000764F0000-0x00000000765D3000-memory.dmp
memory/4124-277-0x0000000000400000-0x0000000000715000-memory.dmp
memory/4124-279-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4124-280-0x000000000055E000-0x000000000055F000-memory.dmp
memory/4124-281-0x0000000000400000-0x0000000000715000-memory.dmp
memory/4124-285-0x0000000000400000-0x0000000000715000-memory.dmp
memory/4124-287-0x0000000000400000-0x0000000000715000-memory.dmp
memory/4124-288-0x0000000000400000-0x0000000000715000-memory.dmp
memory/4124-290-0x0000000000400000-0x0000000000715000-memory.dmp
memory/4124-292-0x0000000000400000-0x0000000000715000-memory.dmp
memory/4124-293-0x0000000000400000-0x0000000000715000-memory.dmp
memory/4124-294-0x0000000000400000-0x0000000000715000-memory.dmp
memory/4124-296-0x0000000000400000-0x0000000000715000-memory.dmp
memory/4124-297-0x0000000000400000-0x0000000000715000-memory.dmp
memory/4124-298-0x0000000000400000-0x0000000000715000-memory.dmp
memory/4124-300-0x0000000000400000-0x0000000000715000-memory.dmp
memory/4124-301-0x0000000000400000-0x0000000000715000-memory.dmp
memory/4124-303-0x0000000000400000-0x0000000000715000-memory.dmp
memory/4124-305-0x0000000000400000-0x0000000000715000-memory.dmp
memory/4124-307-0x0000000000400000-0x0000000000715000-memory.dmp