Analysis
- max time kernel
149s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
08/08/2026, 17:55
General
- Target 2026-08-08_526358321f717f4f92194e0077c0d62f_amadey_elex_floxif_icedid_remcos_smoke-loader_stop.exe
- Size 3.6MB
- Sample260808-wheevssbjc
- SHA256 76936150268740fea4c35c092d20cd3067e6cfe3cacb7b40654b6c64c7d36f68
Malware Config
Signatures
- Family: Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
- Detects Floxif payload 1 IoCs
- UPX dump on OEP (original entry point) 3 IoCs
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
- Loads dropped DLL 3 IoCs
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies Internet Explorer settings 1 TTPs 4 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_526358321f717f4f92194e0077c0d62f_amadey_elex_floxif_icedid_remcos_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_526358321f717f4f92194e0077c0d62f_amadey_elex_floxif_icedid_remcos_smoke-loader_stop.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
symsrv.dll
symsrv.dll.000
240726984.dll
643ee2975f8bff2c7164d1cf829b3125.htm
1d71e8ccef604e688164a6ba10ed2adb[1].jpg
addvote[1]_2.css
board.default[1]_2.css
cameron.responsive[1]_2.css
colorset3[1].css
default.min[1]_2.css
font_awesome.min[2]_2.css
jquery_ui.min[1]_2.css
layout[1]_2.css
neatSign[1]_2.css
neat_news_ticker[1]_2.css
neat_side[1]_2.css
neat_side_list[1]_2.css
style[4].css
style[5]_2.css
xe.min[2]_2.css
memory/5016-54-0x0000000075AB0000-0x000000007608C000-memory.dmp
memory/5016-40-0x0000000076560000-0x0000000076642000-memory.dmp
memory/5016-66-0x0000000075AB0000-0x000000007608C000-memory.dmp
memory/5016-67-0x0000000076B10000-0x0000000076C65000-memory.dmp
memory/5016-68-0x0000000075220000-0x0000000075447000-memory.dmp
memory/5016-71-0x0000000000400000-0x0000000000713000-memory.dmp
memory/5016-72-0x0000000075AB0000-0x000000007608C000-memory.dmp
memory/5016-73-0x0000000075220000-0x0000000075447000-memory.dmp
memory/5016-74-0x0000000000400000-0x0000000000713000-memory.dmp
memory/5016-101-0x0000000074990000-0x0000000074A11000-memory.dmp
memory/5016-94-0x0000000074990000-0x0000000074A11000-memory.dmp
memory/5016-28-0x0000000000400000-0x0000000000713000-memory.dmp
memory/5016-32-0x0000000000400000-0x0000000000713000-memory.dmp
memory/5016-26-0x0000000074D50000-0x0000000074D7E000-memory.dmp
memory/5016-63-0x0000000000400000-0x0000000000713000-memory.dmp
memory/5016-90-0x0000000074990000-0x0000000074A11000-memory.dmp
memory/5016-86-0x0000000075550000-0x0000000075601000-memory.dmp
memory/5016-65-0x0000000075550000-0x0000000075601000-memory.dmp
memory/5016-62-0x0000000074990000-0x0000000074A11000-memory.dmp
memory/5016-60-0x0000000075220000-0x0000000075447000-memory.dmp
memory/5016-61-0x0000000074D50000-0x0000000074D7E000-memory.dmp
memory/5016-59-0x0000000075AB0000-0x000000007608C000-memory.dmp
memory/5016-57-0x0000000000400000-0x0000000000713000-memory.dmp
memory/5016-55-0x0000000075220000-0x0000000075447000-memory.dmp
memory/5016-30-0x0000000075500000-0x0000000075525000-memory.dmp
memory/5016-52-0x0000000000400000-0x0000000000713000-memory.dmp
memory/5016-50-0x0000000075220000-0x0000000075447000-memory.dmp
memory/5016-49-0x0000000075AB0000-0x000000007608C000-memory.dmp
memory/5016-48-0x0000000075550000-0x0000000075601000-memory.dmp
memory/5016-47-0x0000000000400000-0x0000000000713000-memory.dmp
memory/5016-44-0x0000000075220000-0x0000000075447000-memory.dmp
memory/5016-43-0x0000000076B10000-0x0000000076C65000-memory.dmp
memory/5016-42-0x0000000075AB0000-0x000000007608C000-memory.dmp
memory/5016-64-0x0000000076560000-0x0000000076642000-memory.dmp
memory/5016-39-0x0000000000400000-0x0000000000713000-memory.dmp
memory/5016-37-0x0000000075220000-0x0000000075447000-memory.dmp
memory/5016-36-0x0000000076B10000-0x0000000076C65000-memory.dmp
memory/5016-34-0x0000000075AB0000-0x000000007608C000-memory.dmp
memory/5016-69-0x0000000074D50000-0x0000000074D7E000-memory.dmp
memory/5016-70-0x0000000074990000-0x0000000074A11000-memory.dmp
memory/5016-58-0x0000000075550000-0x0000000075601000-memory.dmp
memory/5016-56-0x0000000074990000-0x0000000074A11000-memory.dmp
memory/5016-53-0x0000000075550000-0x0000000075601000-memory.dmp
memory/5016-51-0x0000000074990000-0x0000000074A11000-memory.dmp
memory/5016-46-0x0000000074990000-0x0000000074A11000-memory.dmp
memory/5016-45-0x0000000074D50000-0x0000000074D7E000-memory.dmp
memory/5016-41-0x0000000075550000-0x0000000075601000-memory.dmp
memory/5016-38-0x0000000074D50000-0x0000000074D7E000-memory.dmp
memory/5016-33-0x0000000075550000-0x0000000075601000-memory.dmp
memory/5016-29-0x0000000000400000-0x0000000000713000-memory.dmp
memory/5016-31-0x0000000000400000-0x0000000000713000-memory.dmp
memory/5016-24-0x0000000000400000-0x0000000000713000-memory.dmp
memory/5016-21-0x00000000775F0000-0x000000007766E000-memory.dmp
memory/5016-20-0x0000000000400000-0x0000000000713000-memory.dmp
memory/5016-15-0x0000000000400000-0x0000000000713000-memory.dmp
memory/5016-18-0x0000000000400000-0x0000000000713000-memory.dmp
memory/5016-16-0x00000000775F0000-0x000000007766E000-memory.dmp
memory/5016-14-0x00000000775F0000-0x000000007766E000-memory.dmp
memory/5016-27-0x0000000075500000-0x0000000075525000-memory.dmp
memory/5016-25-0x00000000775F0000-0x000000007766E000-memory.dmp
memory/5016-23-0x0000000075500000-0x0000000075525000-memory.dmp
memory/5016-19-0x00000000775F0000-0x000000007766E000-memory.dmp
memory/5016-35-0x000000000055E000-0x000000000055F000-memory.dmp
memory/5016-22-0x0000000074D50000-0x0000000074D7E000-memory.dmp
memory/5016-17-0x0000000074D50000-0x0000000074D7E000-memory.dmp
memory/5016-326-0x0000000010000000-0x0000000010030000-memory.dmp
memory/5016-327-0x000000000055E000-0x000000000055F000-memory.dmp
memory/5016-4-0x0000000010000000-0x0000000010030000-memory.dmp