Analysis
- max time kernel
3s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
09/08/2026, 06:49
General
- Target 2026-08-09_5b639d32011eb25dcbb18a01656a5af3_amadey_elex_floxif_smoke-loader_wannacry.exe
- Size 4.2MB
- Sample260809-hltr3asfkh
- SHA256 9b07ec75669e97480a75c4f6126376732881ce7dc828d4b0d8682c345e73a217
Malware Config
Signatures
- Family: Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
- Detects Floxif payload 1 IoCs
- UPX dump on OEP (original entry point) 3 IoCs
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
- Loads dropped DLL 1 IoCs
- Enumerates connected drives 3 TTPs 3 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious use of AdjustPrivilegeToken 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_5b639d32011eb25dcbb18a01656a5af3_amadey_elex_floxif_smoke-loader_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_5b639d32011eb25dcbb18a01656a5af3_amadey_elex_floxif_smoke-loader_wannacry.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_5b639d32011eb25dcbb18a01656a5af3_amadey_elex_floxif_smoke-loader_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_5b639d32011eb25dcbb18a01656a5af3_amadey_elex_floxif_smoke-loader_wannacry.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\QemuBootTester\qemu-img.exe"C:\Users\Admin\AppData\Local\Temp\QemuBootTester\qemu-img.exe" create -q -f vmdk "C:\Users\Admin\AppData\Local\Temp\QemuBootTester\hd.vmdk" 1024M2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\QemuBootTester\myqemu.exe"C:\Users\Admin\AppData\Local\Temp\QemuBootTester\myqemu.exe" -L "C:\Users\Admin\AppData\Local\Temp\QemuBootTester" -m 759 -localtime -hda \\.\PhysicalDrive0 -boot c -hdb "C:\Users\Admin\AppData\Local\Temp\QemuBootTester\hd.vmdk" -vga std -snapshot2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_5b639d32011eb25dcbb18a01656a5af3_amadey_elex_floxif_smoke-loader_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_5b639d32011eb25dcbb18a01656a5af3_amadey_elex_floxif_smoke-loader_wannacry.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_5b639d32011eb25dcbb18a01656a5af3_amadey_elex_floxif_smoke-loader_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_5b639d32011eb25dcbb18a01656a5af3_amadey_elex_floxif_smoke-loader_wannacry.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
symsrv.dll
symsrv.dll.000
SDL.dll
SDL.dll.tmp
bios.bin
efi32.bin
efi64.bin
hd.vmdk
intl.dll
libgcc_s_sjlj-1.dll
libglib-2.0-0.dll
libgthread-2.0-0.dll
libpdcurses.dll
libssp-0.dll
libz-1.dll
linuxboot.bin
myqemu.exe
pxe-e1000.bin
qemu-img.exe
test.fba
vgabios-cirrus.bin
vgabios-stdvga.bin
zlib1.dll
memory/4280-297-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/4280-293-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/4280-280-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/4280-282-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/4280-269-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/4280-278-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/4280-281-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/4280-283-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/4280-285-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/4280-284-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/4280-287-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/4280-289-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/4280-290-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/4280-291-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/4280-288-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/4280-286-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/4280-304-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/4280-295-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/4280-296-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/4280-279-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/4280-298-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/4280-272-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/4280-299-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/4280-300-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/4280-301-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/4280-302-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/4280-305-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/4280-307-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/4280-308-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/4280-303-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/4280-294-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/4280-275-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/4280-292-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/4280-277-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/4280-273-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/4280-267-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/4280-266-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/4280-264-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/4280-261-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/4280-262-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/4280-260-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/4280-259-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/4280-258-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/4280-253-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/4280-256-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/4280-257-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/4280-255-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/4280-254-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/4280-252-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/4280-251-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/4280-250-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/4280-270-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/4280-265-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/4280-274-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/4280-263-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/4280-268-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/4352-234-0x00000000685C0000-0x00000000686C6000-memory.dmp
memory/4352-238-0x000000006CEC0000-0x000000006CF2F000-memory.dmp
memory/4352-237-0x000000006A300000-0x000000006A323000-memory.dmp
memory/4352-233-0x0000000000400000-0x00000000004A5000-memory.dmp
memory/4352-236-0x0000000062E80000-0x0000000062E9F000-memory.dmp
memory/4352-235-0x0000000065C40000-0x0000000065C4E000-memory.dmp
memory/4400-217-0x0000000000400000-0x000000000041B000-memory.dmp
memory/4588-119-0x0000000000400000-0x000000000081B000-memory.dmp
memory/4588-122-0x0000000000400000-0x000000000081B000-memory.dmp
memory/4588-161-0x0000000000400000-0x000000000081B000-memory.dmp
memory/4588-162-0x0000000000400000-0x000000000081B000-memory.dmp
memory/4588-164-0x0000000000400000-0x000000000081B000-memory.dmp
memory/4588-165-0x0000000000400000-0x000000000081B000-memory.dmp
memory/4588-163-0x0000000000400000-0x000000000081B000-memory.dmp
memory/4588-166-0x0000000000400000-0x000000000081B000-memory.dmp
memory/4588-167-0x0000000000400000-0x000000000081B000-memory.dmp
memory/4588-168-0x0000000000400000-0x000000000081B000-memory.dmp
memory/4588-169-0x0000000000400000-0x000000000081B000-memory.dmp
memory/4588-177-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4588-159-0x0000000000400000-0x000000000081B000-memory.dmp
memory/4588-158-0x0000000000400000-0x000000000081B000-memory.dmp
memory/4588-157-0x0000000000400000-0x000000000081B000-memory.dmp
memory/4588-156-0x0000000000400000-0x000000000081B000-memory.dmp
memory/4588-155-0x0000000000400000-0x000000000081B000-memory.dmp
memory/4588-154-0x0000000000400000-0x000000000081B000-memory.dmp
memory/4588-153-0x0000000000400000-0x000000000081B000-memory.dmp
memory/4588-152-0x0000000000400000-0x000000000081B000-memory.dmp
memory/4588-151-0x0000000000400000-0x000000000081B000-memory.dmp
memory/4588-150-0x0000000000400000-0x000000000081B000-memory.dmp
memory/4588-149-0x0000000000400000-0x000000000081B000-memory.dmp
memory/4588-148-0x0000000000400000-0x000000000081B000-memory.dmp
memory/4588-147-0x0000000000400000-0x000000000081B000-memory.dmp
memory/4588-146-0x0000000000400000-0x000000000081B000-memory.dmp
memory/4588-145-0x0000000000400000-0x000000000081B000-memory.dmp
memory/4588-144-0x0000000000400000-0x000000000081B000-memory.dmp
memory/4588-143-0x0000000000400000-0x000000000081B000-memory.dmp
memory/4588-142-0x0000000000400000-0x000000000081B000-memory.dmp
memory/4588-141-0x0000000000400000-0x000000000081B000-memory.dmp
memory/4588-140-0x0000000000400000-0x000000000081B000-memory.dmp
memory/4588-139-0x0000000000400000-0x000000000081B000-memory.dmp
memory/4588-138-0x0000000000400000-0x000000000081B000-memory.dmp
memory/4588-137-0x0000000000400000-0x000000000081B000-memory.dmp
memory/4588-136-0x0000000000400000-0x000000000081B000-memory.dmp
memory/4588-135-0x0000000000400000-0x000000000081B000-memory.dmp
memory/4588-134-0x0000000000400000-0x000000000081B000-memory.dmp
memory/4588-133-0x0000000000400000-0x000000000081B000-memory.dmp
memory/4588-132-0x0000000000400000-0x000000000081B000-memory.dmp
memory/4588-131-0x0000000000400000-0x000000000081B000-memory.dmp
memory/4588-130-0x0000000000400000-0x000000000081B000-memory.dmp
memory/4588-129-0x0000000000400000-0x000000000081B000-memory.dmp
memory/4588-128-0x0000000000400000-0x000000000081B000-memory.dmp
memory/4588-127-0x0000000000400000-0x000000000081B000-memory.dmp
memory/4588-126-0x0000000000400000-0x000000000081B000-memory.dmp
memory/4588-125-0x0000000000400000-0x000000000081B000-memory.dmp
memory/4588-124-0x0000000000400000-0x000000000081B000-memory.dmp
memory/4588-123-0x0000000000400000-0x000000000081B000-memory.dmp
memory/4588-160-0x0000000000400000-0x000000000081B000-memory.dmp
memory/4588-121-0x0000000000400000-0x000000000081B000-memory.dmp
memory/4588-120-0x0000000000400000-0x000000000081B000-memory.dmp
memory/4588-114-0x0000000000400000-0x000000000081B000-memory.dmp
memory/4588-117-0x0000000000400000-0x000000000081B000-memory.dmp
memory/4588-116-0x0000000000400000-0x000000000081B000-memory.dmp
memory/4588-115-0x0000000000400000-0x000000000081B000-memory.dmp
memory/4588-113-0x0000000000400000-0x000000000081B000-memory.dmp
memory/4588-112-0x0000000000400000-0x000000000081B000-memory.dmp
memory/4588-111-0x0000000000400000-0x000000000081B000-memory.dmp
memory/4588-108-0x0000000000400000-0x000000000081B000-memory.dmp
memory/4588-109-0x0000000000400000-0x000000000081B000-memory.dmp
memory/4588-110-0x0000000000400000-0x000000000081B000-memory.dmp
memory/4588-106-0x0000000000400000-0x000000000081B000-memory.dmp
memory/4588-107-0x0000000000400000-0x000000000081B000-memory.dmp
memory/4588-105-0x0000000000400000-0x000000000081B000-memory.dmp
memory/4588-99-0x0000000000400000-0x000000000081B000-memory.dmp
memory/4588-104-0x0000000000400000-0x000000000081B000-memory.dmp
memory/4588-101-0x0000000000400000-0x000000000081B000-memory.dmp
memory/4588-103-0x0000000000400000-0x000000000081B000-memory.dmp
memory/4588-102-0x0000000000400000-0x000000000081B000-memory.dmp
memory/4588-100-0x0000000000400000-0x000000000081B000-memory.dmp
memory/4588-98-0x0000000000400000-0x000000000081B000-memory.dmp
memory/4588-97-0x0000000000400000-0x000000000081B000-memory.dmp
memory/4588-96-0x0000000000400000-0x000000000081B000-memory.dmp
memory/4588-95-0x0000000000400000-0x000000000081B000-memory.dmp
memory/4588-94-0x0000000000400000-0x000000000081B000-memory.dmp
memory/4588-92-0x0000000000400000-0x000000000081B000-memory.dmp
memory/4588-90-0x0000000000400000-0x000000000081B000-memory.dmp
memory/4588-87-0x0000000000400000-0x000000000081B000-memory.dmp
memory/4588-89-0x0000000000400000-0x000000000081B000-memory.dmp
memory/4588-86-0x0000000000400000-0x000000000081B000-memory.dmp
memory/4588-84-0x0000000000400000-0x000000000081B000-memory.dmp
memory/4588-83-0x0000000000400000-0x000000000081B000-memory.dmp
memory/4588-82-0x0000000000400000-0x000000000081B000-memory.dmp
memory/4588-81-0x0000000000400000-0x000000000081B000-memory.dmp
memory/4588-80-0x0000000000400000-0x000000000081B000-memory.dmp
memory/4588-79-0x0000000000400000-0x000000000081B000-memory.dmp
memory/4588-78-0x0000000000400000-0x000000000081B000-memory.dmp
memory/4588-71-0x0000000000400000-0x000000000081B000-memory.dmp
memory/4588-57-0x0000000000400000-0x000000000081B000-memory.dmp
memory/4588-47-0x0000000000400000-0x000000000081B000-memory.dmp
memory/4588-36-0x0000000000400000-0x000000000081B000-memory.dmp
memory/4588-22-0x0000000000400000-0x000000000081B000-memory.dmp
memory/4588-10-0x0000000000400000-0x000000000081B000-memory.dmp
memory/4588-9-0x0000000000400000-0x000000000081B000-memory.dmp
memory/4588-8-0x0000000000480000-0x0000000000481000-memory.dmp
memory/4588-4-0x0000000010000000-0x0000000010030000-memory.dmp