Analysis
- max time kernel
149s - max time network
115s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
09/08/2026, 05:16
General
- Target 2026-08-09_84eb622ba16394445c9c4dfed1ad1aed_driverpack_elex_floxif_wannacry.exe
- Size 15.1MB
- Sample260809-fx9ljs1dla
- SHA256 292f0d557f320c5f36bf77a7f1db0ba6c753f1522f535055f7b451dff4e99d0d
Malware Config
Signatures
- Family: Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
- Detects Floxif payload 1 IoCs
- Detects binaries and memory artifacts referencing sandbox product IDs 21 IoCs
- UPX dump on OEP (original entry point) 3 IoCs
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 2 IoCs
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 7 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_84eb622ba16394445c9c4dfed1ad1aed_driverpack_elex_floxif_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_84eb622ba16394445c9c4dfed1ad1aed_driverpack_elex_floxif_wannacry.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ""C:\Users\Admin\AppData\Local\Temp\IcoFX\KillDuplicate.cmd" "C:\Users\Admin\AppData\Local\Temp\IcoFX" "2026-08-09_84eb622ba16394445c9c4dfed1ad1aed_driverpack_elex_floxif_wannacry.exe""2⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\IcoFX\icofx3.exe"C:\Users\Admin\AppData\Local\Temp\IcoFX\icofx3.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
symsrv.dll
English.lng
French.lng
German.lng
Italian.lng
Japanese.lng
PortuguesBrasil.lng
Spanish.lng
korean.lng
markunread.svg
access time.svg
add to photos.svg
edit.svg
photo.svg
local see.svg
place.svg
terrain.svg
cancel.1.mask.svg
cancel.2.mask.svg
cancel.3.mask.svg
cancel.4.mask.svg
mood.svg
poll.svg
Default.key
Default.wrk
Last.aco
Last.act
Last.brs
Last.grd
Last.pen
Last.stl
config.cfg
recent.cfg
FluentDark
icofx3.exe
libwebp.dll
memory/1536-5079-0x0000000005310000-0x0000000005311000-memory.dmp
memory/1536-5073-0x0000000005300000-0x0000000005301000-memory.dmp
memory/1536-5126-0x0000000000400000-0x00000000032C2000-memory.dmp
memory/1536-5123-0x0000000006F20000-0x0000000006F21000-memory.dmp
memory/1536-5117-0x00000000764F0000-0x00000000764F1000-memory.dmp
memory/1536-5105-0x0000000076C30000-0x0000000076C31000-memory.dmp
memory/1536-5100-0x0000000000400000-0x00000000032C2000-memory.dmp
memory/1536-5091-0x0000000006EE0000-0x0000000006EE1000-memory.dmp
memory/1536-5092-0x0000000006EE0000-0x0000000006EE1000-memory.dmp
memory/1536-5098-0x0000000006EF0000-0x0000000006EF1000-memory.dmp
memory/1536-5097-0x0000000006EF0000-0x0000000006EF1000-memory.dmp
memory/1536-5085-0x00000000764E0000-0x00000000764E1000-memory.dmp
memory/1536-5086-0x00000000764E0000-0x00000000764E1000-memory.dmp
memory/1536-5138-0x0000000000400000-0x00000000032C2000-memory.dmp
memory/1536-5071-0x0000000005300000-0x0000000005301000-memory.dmp
memory/1536-5069-0x0000000005300000-0x0000000005301000-memory.dmp
memory/1536-5072-0x0000000005300000-0x0000000005301000-memory.dmp
memory/1536-5078-0x0000000005310000-0x0000000005311000-memory.dmp
memory/1536-5081-0x000000000046C000-0x000000000046D000-memory.dmp
memory/1536-5111-0x00000000776B0000-0x00000000776B1000-memory.dmp
memory/1536-5189-0x0000000000400000-0x00000000032C2000-memory.dmp
memory/1536-5146-0x0000000000400000-0x00000000032C2000-memory.dmp
memory/1536-5148-0x0000000007610000-0x0000000007691000-memory.dmp
memory/1536-5147-0x0000000000400000-0x00000000032C2000-memory.dmp
memory/1536-5150-0x0000000000400000-0x00000000032C2000-memory.dmp
memory/1536-5186-0x0000000000400000-0x00000000032C2000-memory.dmp
memory/1536-5154-0x0000000000400000-0x00000000032C2000-memory.dmp
memory/1536-5155-0x0000000000400000-0x00000000032C2000-memory.dmp
memory/1536-5158-0x0000000000400000-0x00000000032C2000-memory.dmp
memory/1536-5159-0x0000000000400000-0x00000000032C2000-memory.dmp
memory/1536-5162-0x0000000000400000-0x00000000032C2000-memory.dmp
memory/1536-5165-0x0000000000400000-0x00000000032C2000-memory.dmp
memory/1536-5168-0x0000000000400000-0x00000000032C2000-memory.dmp
memory/1536-5171-0x0000000000400000-0x00000000032C2000-memory.dmp
memory/1536-5174-0x0000000000400000-0x00000000032C2000-memory.dmp
memory/1536-5177-0x0000000000400000-0x00000000032C2000-memory.dmp
memory/1536-5180-0x0000000000400000-0x00000000032C2000-memory.dmp
memory/1536-5183-0x0000000000400000-0x00000000032C2000-memory.dmp
memory/6052-4-0x0000000010000000-0x0000000010030000-memory.dmp
memory/6052-5068-0x0000000010000000-0x0000000010030000-memory.dmp