Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
08/08/2026, 17:55
General
- Target 2026-08-08_526358321f717f4f92194e0077c0d62f_amadey_elex_floxif_icedid_remcos_smoke-loader_stop.exe
- Size 3.6MB
- Sample260808-wheevssbjc
- SHA256 76936150268740fea4c35c092d20cd3067e6cfe3cacb7b40654b6c64c7d36f68
Malware Config
Signatures
- Family: Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
- Detects Floxif payload 1 IoCs
- UPX dump on OEP (original entry point) 3 IoCs
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
- Loads dropped DLL 3 IoCs
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies Internet Explorer settings 1 TTPs 4 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_526358321f717f4f92194e0077c0d62f_amadey_elex_floxif_icedid_remcos_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_526358321f717f4f92194e0077c0d62f_amadey_elex_floxif_icedid_remcos_smoke-loader_stop.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
symsrv.dll
symsrv.dll.000
240669359.dll
643ee2975f8bff2c7164d1cf829b3125.htm
addvote[1]_2.css
board.default[1]_2.css
cameron.responsive[1]_2.css
colorset3[1].css
default.min[1]_2.css
font_awesome.min[2]_2.css
jquery_ui.min[1]_2.css
layout[1]_2.css
neatSign[1]_2.css
neat_news_ticker[1]_2.css
neat_side[1]_2.css
neat_side_list[2]_2.css
style[4].css
style[5]_2.css
xe.min[2]_2.css
memory/1844-53-0x00000000772E0000-0x000000007738F000-memory.dmp
memory/1844-42-0x0000000076560000-0x0000000076B13000-memory.dmp
memory/1844-74-0x0000000075370000-0x0000000075580000-memory.dmp
memory/1844-75-0x0000000000400000-0x0000000000713000-memory.dmp
memory/1844-76-0x0000000076560000-0x0000000076B13000-memory.dmp
memory/1844-77-0x0000000075370000-0x0000000075580000-memory.dmp
memory/1844-78-0x0000000000400000-0x0000000000713000-memory.dmp
memory/1844-71-0x0000000074C20000-0x0000000074C94000-memory.dmp
memory/1844-57-0x0000000074C20000-0x0000000074C94000-memory.dmp
memory/1844-45-0x00000000752C0000-0x00000000752EC000-memory.dmp
memory/1844-36-0x0000000075A60000-0x0000000075B43000-memory.dmp
memory/1844-32-0x0000000000400000-0x0000000000713000-memory.dmp
memory/1844-33-0x00000000772E0000-0x000000007738F000-memory.dmp
memory/1844-30-0x0000000076500000-0x0000000076525000-memory.dmp
memory/1844-72-0x0000000000400000-0x0000000000713000-memory.dmp
memory/1844-70-0x00000000752C0000-0x00000000752EC000-memory.dmp
memory/1844-69-0x0000000075370000-0x0000000075580000-memory.dmp
memory/1844-68-0x0000000075A60000-0x0000000075B43000-memory.dmp
memory/1844-67-0x0000000076560000-0x0000000076B13000-memory.dmp
memory/1844-66-0x00000000772E0000-0x000000007738F000-memory.dmp
memory/1844-65-0x00000000773B0000-0x000000007748C000-memory.dmp
memory/1844-64-0x0000000000400000-0x0000000000713000-memory.dmp
memory/1844-63-0x0000000074C20000-0x0000000074C94000-memory.dmp
memory/1844-62-0x00000000752C0000-0x00000000752EC000-memory.dmp
memory/1844-61-0x0000000075370000-0x0000000075580000-memory.dmp
memory/1844-60-0x0000000076560000-0x0000000076B13000-memory.dmp
memory/1844-59-0x00000000772E0000-0x000000007738F000-memory.dmp
memory/1844-58-0x0000000000400000-0x0000000000713000-memory.dmp
memory/1844-56-0x0000000076500000-0x0000000076525000-memory.dmp
memory/1844-55-0x0000000075370000-0x0000000075580000-memory.dmp
memory/1844-54-0x0000000076560000-0x0000000076B13000-memory.dmp
memory/1844-2-0x0000000010000000-0x0000000010030000-memory.dmp
memory/1844-52-0x0000000000400000-0x0000000000713000-memory.dmp
memory/1844-51-0x0000000074C20000-0x0000000074C94000-memory.dmp
memory/1844-50-0x0000000075370000-0x0000000075580000-memory.dmp
memory/1844-49-0x0000000076560000-0x0000000076B13000-memory.dmp
memory/1844-48-0x00000000772E0000-0x000000007738F000-memory.dmp
memory/1844-47-0x0000000000400000-0x0000000000713000-memory.dmp
memory/1844-46-0x0000000074C20000-0x0000000074C94000-memory.dmp
memory/1844-44-0x0000000075370000-0x0000000075580000-memory.dmp
memory/1844-43-0x0000000075A60000-0x0000000075B43000-memory.dmp
memory/1844-73-0x0000000076560000-0x0000000076B13000-memory.dmp
memory/1844-41-0x00000000772E0000-0x000000007738F000-memory.dmp
memory/1844-40-0x00000000773B0000-0x000000007748C000-memory.dmp
memory/1844-39-0x0000000000400000-0x0000000000713000-memory.dmp
memory/1844-38-0x00000000752C0000-0x00000000752EC000-memory.dmp
memory/1844-37-0x0000000075370000-0x0000000075580000-memory.dmp
memory/1844-35-0x0000000076560000-0x0000000076B13000-memory.dmp
memory/1844-31-0x0000000000400000-0x0000000000713000-memory.dmp
memory/1844-29-0x0000000000400000-0x0000000000713000-memory.dmp
memory/1844-28-0x0000000000400000-0x0000000000713000-memory.dmp
memory/1844-27-0x0000000076500000-0x0000000076525000-memory.dmp
memory/1844-26-0x00000000752C0000-0x00000000752EC000-memory.dmp
memory/1844-25-0x0000000076D80000-0x0000000076DFA000-memory.dmp
memory/1844-24-0x0000000000400000-0x0000000000713000-memory.dmp
memory/1844-23-0x0000000076500000-0x0000000076525000-memory.dmp
memory/1844-22-0x00000000752C0000-0x00000000752EC000-memory.dmp
memory/1844-20-0x0000000000400000-0x0000000000713000-memory.dmp
memory/1844-19-0x0000000076D80000-0x0000000076DFA000-memory.dmp
memory/1844-18-0x0000000000400000-0x0000000000713000-memory.dmp
memory/1844-17-0x00000000752C0000-0x00000000752EC000-memory.dmp
memory/1844-16-0x0000000076D80000-0x0000000076DFA000-memory.dmp
memory/1844-15-0x0000000000400000-0x0000000000713000-memory.dmp
memory/1844-34-0x000000000055E000-0x000000000055F000-memory.dmp
memory/1844-14-0x0000000076D80000-0x0000000076DFA000-memory.dmp
memory/1844-271-0x0000000000400000-0x0000000000713000-memory.dmp
memory/1844-273-0x0000000010000000-0x0000000010030000-memory.dmp
memory/1844-274-0x000000000055E000-0x000000000055F000-memory.dmp
memory/1844-276-0x0000000000400000-0x0000000000713000-memory.dmp
memory/1844-278-0x0000000000400000-0x0000000000713000-memory.dmp
memory/1844-279-0x0000000000400000-0x0000000000713000-memory.dmp
memory/1844-280-0x0000000000400000-0x0000000000713000-memory.dmp
memory/1844-283-0x0000000000400000-0x0000000000713000-memory.dmp
memory/1844-284-0x0000000000400000-0x0000000000713000-memory.dmp
memory/1844-21-0x0000000076D80000-0x0000000076DFA000-memory.dmp
memory/1844-286-0x0000000000400000-0x0000000000713000-memory.dmp
memory/1844-287-0x0000000000400000-0x0000000000713000-memory.dmp
memory/1844-288-0x0000000000400000-0x0000000000713000-memory.dmp
memory/1844-290-0x0000000000400000-0x0000000000713000-memory.dmp
memory/1844-291-0x0000000000400000-0x0000000000713000-memory.dmp
memory/1844-293-0x0000000000400000-0x0000000000713000-memory.dmp
memory/1844-294-0x0000000000400000-0x0000000000713000-memory.dmp