floxif | 150f33fabc61c8386bdf48175ff46a48fbbf0513121c00ba28d8ad28779eb1c5

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 04:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_bfc14d09cb65f777e10d4af16afe9fb7_amadey_elex_floxif_wannacry.exe
Size 2.3MB
Sample260809-fmphma1bld
SHA256 150f33fabc61c8386bdf48175ff46a48fbbf0513121c00ba28d8ad28779eb1c5
MD5 bfc14d09cb65f777e10d4af16afe9fb7
SHA1 e43ca4a3b3f822e431ac07cffa3332814dc104db
SHA512 32d570f7fb13327185897edf08d0ca53692adcd0051cee1e9f5ead235aed9b3f7665679fa5947a5b81fca5508c004ce20cbc8437fd7e810d014fc5dcc7dc5cc5
SSDEEP 24576:F/J12zsb10Y2nFq5zEuItv1q49A2ndccrHB+cgEGcarVlU6Kp+G+gEGcarVYLLIX:9im10Y2nFYzEq4fcuBSccghdccyt4ZVv
TLSH
T15CB5AD017391837AF9D366B29CD56E3687B47E450B12488F326C3F1ABF721B29E75218
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery execution floxif persistence privilege_escalation trojan upx

Malware Config

Signatures

Family: Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
backdoor trojan floxif

Detects Floxif payload 1 IoCs

backdoor

resource	yara_rule
behavioral2/files/0x000600000001b85f-1.dat	floxif

UPX dump on OEP (original entry point) 6 IoCs

resource	yara_rule
behavioral2/files/0x000600000001b85f-1.dat	UPX
behavioral2/memory/1096-3-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/1096-12-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/1096-16-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/1096-18-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/1096-19-0x0000000010000000-0x0000000010030000-memory.dmp	UPX

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000600000001b85f-1.dat	acprotect

Loads dropped DLL 1 IoCs

pid	Process
1096	2026-08-09_bfc14d09cb65f777e10d4af16afe9fb7_amadey_elex_floxif_wannacry.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\d:	2026-08-09_bfc14d09cb65f777e10d4af16afe9fb7_amadey_elex_floxif_wannacry.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 8 IoCs

execution

Visual Basic

T1059.005

pid	Process
240	cscript.exe
5156	cscript.exe
4588	cscript.exe
5796	cscript.exe
4756	cscript.exe
1084	cscript.exe
4172	cscript.exe
3384	cscript.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000600000001b85f-1.dat	upx
behavioral2/memory/1096-3-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/1096-12-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/1096-16-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/1096-18-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/1096-19-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\symsrv.dll	2026-08-09_bfc14d09cb65f777e10d4af16afe9fb7_amadey_elex_floxif_wannacry.exe
File created	\??\c:\program files\common files\system\symsrv.dll.000	2026-08-09_bfc14d09cb65f777e10d4af16afe9fb7_amadey_elex_floxif_wannacry.exe

Executes a command shell one-liner 1 TTPs 9 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2968	cmd.exe
5220	cmd.exe
6116	cmd.exe
4744	cmd.exe
1580	cmd.exe
1604	cmd.exe
1264	cmd.exe
5560	cmd.exe
4080	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_bfc14d09cb65f777e10d4af16afe9fb7_amadey_elex_floxif_wannacry.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1096	2026-08-09_bfc14d09cb65f777e10d4af16afe9fb7_amadey_elex_floxif_wannacry.exe
1096	2026-08-09_bfc14d09cb65f777e10d4af16afe9fb7_amadey_elex_floxif_wannacry.exe
1096	2026-08-09_bfc14d09cb65f777e10d4af16afe9fb7_amadey_elex_floxif_wannacry.exe
1096	2026-08-09_bfc14d09cb65f777e10d4af16afe9fb7_amadey_elex_floxif_wannacry.exe
1096	2026-08-09_bfc14d09cb65f777e10d4af16afe9fb7_amadey_elex_floxif_wannacry.exe
1096	2026-08-09_bfc14d09cb65f777e10d4af16afe9fb7_amadey_elex_floxif_wannacry.exe
1096	2026-08-09_bfc14d09cb65f777e10d4af16afe9fb7_amadey_elex_floxif_wannacry.exe
1096	2026-08-09_bfc14d09cb65f777e10d4af16afe9fb7_amadey_elex_floxif_wannacry.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1096	2026-08-09_bfc14d09cb65f777e10d4af16afe9fb7_amadey_elex_floxif_wannacry.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1096 wrote to memory of 2968	1096	2026-08-09_bfc14d09cb65f777e10d4af16afe9fb7_amadey_elex_floxif_wannacry.exe	89
PID 1096 wrote to memory of 1264	1096	2026-08-09_bfc14d09cb65f777e10d4af16afe9fb7_amadey_elex_floxif_wannacry.exe	91
PID 1264 wrote to memory of 240	1264	cmd.exe	93
PID 1096 wrote to memory of 5560	1096	2026-08-09_bfc14d09cb65f777e10d4af16afe9fb7_amadey_elex_floxif_wannacry.exe	95
PID 5560 wrote to memory of 5156	5560	cmd.exe	97
PID 1096 wrote to memory of 5220	1096	2026-08-09_bfc14d09cb65f777e10d4af16afe9fb7_amadey_elex_floxif_wannacry.exe	99
PID 5220 wrote to memory of 4588	5220	cmd.exe	101
PID 1096 wrote to memory of 4080	1096	2026-08-09_bfc14d09cb65f777e10d4af16afe9fb7_amadey_elex_floxif_wannacry.exe	102
PID 4080 wrote to memory of 5796	4080	cmd.exe	104
PID 1096 wrote to memory of 6116	1096	2026-08-09_bfc14d09cb65f777e10d4af16afe9fb7_amadey_elex_floxif_wannacry.exe	105
PID 6116 wrote to memory of 4756	6116	cmd.exe	107
PID 1096 wrote to memory of 4744	1096	2026-08-09_bfc14d09cb65f777e10d4af16afe9fb7_amadey_elex_floxif_wannacry.exe	108
PID 4744 wrote to memory of 1084	4744	cmd.exe	110
PID 1096 wrote to memory of 1580	1096	2026-08-09_bfc14d09cb65f777e10d4af16afe9fb7_amadey_elex_floxif_wannacry.exe	111
PID 1580 wrote to memory of 4172	1580	cmd.exe	113
PID 1096 wrote to memory of 1604	1096	2026-08-09_bfc14d09cb65f777e10d4af16afe9fb7_amadey_elex_floxif_wannacry.exe	114
PID 1604 wrote to memory of 3384	1604	cmd.exe	116

C:\Users\Admin\AppData\Local\Temp\2026-08-09_bfc14d09cb65f777e10d4af16afe9fb7_amadey_elex_floxif_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_bfc14d09cb65f777e10d4af16afe9fb7_amadey_elex_floxif_wannacry.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /c ver.exe
  2⤵
  - Executes a command shell one-liner
  PID:2968
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /c cscript.exe C:\Windows\System32\slmgr.vbs //NoLogo /dlv All
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1264
- - C:\Windows\System32\cscript.exe
    cscript.exe C:\Windows\System32\slmgr.vbs //NoLogo /dlv All
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:240
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /c cscript.exe C:\Windows\System32\slmgr.vbs //NoLogo /dlv All
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5560
- - C:\Windows\System32\cscript.exe
    cscript.exe C:\Windows\System32\slmgr.vbs //NoLogo /dlv All
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:5156
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /c cscript.exe C:\Windows\System32\slmgr.vbs //NoLogo /dlv All
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5220
- - C:\Windows\System32\cscript.exe
    cscript.exe C:\Windows\System32\slmgr.vbs //NoLogo /dlv All
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:4588
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /c cscript.exe C:\Windows\System32\slmgr.vbs //NoLogo /dlv All
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4080
- - C:\Windows\System32\cscript.exe
    cscript.exe C:\Windows\System32\slmgr.vbs //NoLogo /dlv All
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:5796
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /c cscript.exe C:\Windows\System32\slmgr.vbs //NoLogo /dlv All
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6116
- - C:\Windows\System32\cscript.exe
    cscript.exe C:\Windows\System32\slmgr.vbs //NoLogo /dlv All
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:4756
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /c cscript.exe C:\Windows\System32\slmgr.vbs //NoLogo /dlv All
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4744
- - C:\Windows\System32\cscript.exe
    cscript.exe C:\Windows\System32\slmgr.vbs //NoLogo /dlv All
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:1084
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /c cscript.exe C:\Windows\System32\slmgr.vbs //NoLogo /dlv All
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1580
- - C:\Windows\System32\cscript.exe
    cscript.exe C:\Windows\System32\slmgr.vbs //NoLogo /dlv All
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:4172
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /c cscript.exe C:\Windows\System32\slmgr.vbs //NoLogo /dlv All
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1604
- - C:\Windows\System32\cscript.exe
    cscript.exe C:\Windows\System32\slmgr.vbs //NoLogo /dlv All
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:3384

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

symsrv.dll

Path C:\Program Files\Common Files\System\symsrv.dll
Size 67KB
SHA256 de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
MD5 7574cf2c64f35161ab1292e2f532aabf
SHA1 14ba3fa927a06224dfe587014299e834def4644f
SHA512 4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
SSDEEP 1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZL:c8y93KQjy7G55riF1cMo03V
TLSH
T17863F1372AB5807DDD210D37949F835AB771E5A76C20643FC25907D988B8DD0E3239AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

symsrv.dll.000

Path C:\Program Files\Common Files\System\symsrv.dll.000
Size 114B
SHA256 aefc503b1ed462d7b6280228a7b5b710792273b78934426f88325341ac5b5a92
MD5 e609411db8aa6775d0344c75c23ae79b
SHA1 1d2ff6194bf159ce36cd0461cd3da29486d1e97d
SHA512 6884ff5c07bc687132c965a59cb8c5a898a25da74c6c846c1d6089ddca8007cb7e4d2f8520bdce9fbcf6e2f9c9e5c28d8c8d6d049d3522470bdc7d38bbfa0ad0
TLSH
T1FFB09262AA2791EAE1AA224505A0248C1ED0B62AB48638002EBA5A4E93256A85916147
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1096-3-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/1096-12-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/1096-16-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/1096-18-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/1096-19-0x0000000010000000-0x0000000010030000-memory.dmp

Download