Analysis
- max time kernel
10s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
09/08/2026, 06:49
General
- Target 2026-08-09_5b639d32011eb25dcbb18a01656a5af3_amadey_elex_floxif_smoke-loader_wannacry.exe
- Size 4.2MB
- Sample260809-hltr3asfkh
- SHA256 9b07ec75669e97480a75c4f6126376732881ce7dc828d4b0d8682c345e73a217
Malware Config
Signatures
- Family: Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
- Detects Floxif payload 1 IoCs
- UPX dump on OEP (original entry point) 5 IoCs
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
- Loads dropped DLL 1 IoCs
- Enumerates connected drives 3 TTPs 3 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 14 IoCs
- Suspicious use of AdjustPrivilegeToken 13 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_5b639d32011eb25dcbb18a01656a5af3_amadey_elex_floxif_smoke-loader_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_5b639d32011eb25dcbb18a01656a5af3_amadey_elex_floxif_smoke-loader_wannacry.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_5b639d32011eb25dcbb18a01656a5af3_amadey_elex_floxif_smoke-loader_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_5b639d32011eb25dcbb18a01656a5af3_amadey_elex_floxif_smoke-loader_wannacry.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\QemuBootTester\qemu-img.exe"C:\Users\Admin\AppData\Local\Temp\QemuBootTester\qemu-img.exe" create -q -f vmdk "C:\Users\Admin\AppData\Local\Temp\QemuBootTester\hd.vmdk" 1024M2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\QemuBootTester\myqemu.exe"C:\Users\Admin\AppData\Local\Temp\QemuBootTester\myqemu.exe" -L "C:\Users\Admin\AppData\Local\Temp\QemuBootTester" -m 690 -localtime -hda \\.\PhysicalDrive0 -boot c -hdb "C:\Users\Admin\AppData\Local\Temp\QemuBootTester\hd.vmdk" -vga std -snapshot2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_5b639d32011eb25dcbb18a01656a5af3_amadey_elex_floxif_smoke-loader_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_5b639d32011eb25dcbb18a01656a5af3_amadey_elex_floxif_smoke-loader_wannacry.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_5b639d32011eb25dcbb18a01656a5af3_amadey_elex_floxif_smoke-loader_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_5b639d32011eb25dcbb18a01656a5af3_amadey_elex_floxif_smoke-loader_wannacry.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
symsrv.dll
symsrv.dll.000
SDL.dll
bios.bin
efi32.bin
efi64.bin
hd.vmdk
intl.dll
libgcc_s_sjlj-1.dll
libglib-2.0-0.dll
libgthread-2.0-0.dll
libpdcurses.dll
libpdcurses.dll.tmp
libssp-0.dll
libz-1.dll
linuxboot.bin
myqemu.exe
pxe-e1000.bin
qemu-img.exe
test.fba
vgabios-cirrus.bin
vgabios-stdvga.bin
zlib1.dll
memory/816-182-0x000000006CEC0000-0x000000006CF2F000-memory.dmp
memory/816-179-0x00000000685C0000-0x00000000686C6000-memory.dmp
memory/816-178-0x0000000000400000-0x00000000004A5000-memory.dmp
memory/816-183-0x000000006A300000-0x000000006A323000-memory.dmp
memory/816-181-0x0000000065C40000-0x0000000065C4E000-memory.dmp
memory/816-180-0x0000000062E80000-0x0000000062E9F000-memory.dmp
memory/1980-93-0x0000000000400000-0x000000000081B000-memory.dmp
memory/1980-97-0x0000000000400000-0x000000000081B000-memory.dmp
memory/1980-103-0x0000000000400000-0x000000000081B000-memory.dmp
memory/1980-104-0x0000000000400000-0x000000000081B000-memory.dmp
memory/1980-105-0x0000000010000000-0x0000000010030000-memory.dmp
memory/1980-106-0x0000000000400000-0x000000000081B000-memory.dmp
memory/1980-107-0x0000000000400000-0x000000000081B000-memory.dmp
memory/1980-108-0x0000000000400000-0x000000000081B000-memory.dmp
memory/1980-109-0x0000000000400000-0x000000000081B000-memory.dmp
memory/1980-110-0x0000000000400000-0x000000000081B000-memory.dmp
memory/1980-111-0x0000000000400000-0x000000000081B000-memory.dmp
memory/1980-112-0x0000000000400000-0x000000000081B000-memory.dmp
memory/1980-113-0x0000000000400000-0x000000000081B000-memory.dmp
memory/1980-114-0x0000000000400000-0x000000000081B000-memory.dmp
memory/1980-115-0x0000000000400000-0x000000000081B000-memory.dmp
memory/1980-116-0x0000000000400000-0x000000000081B000-memory.dmp
memory/1980-117-0x0000000000400000-0x000000000081B000-memory.dmp
memory/1980-118-0x0000000000400000-0x000000000081B000-memory.dmp
memory/1980-119-0x0000000000400000-0x000000000081B000-memory.dmp
memory/1980-120-0x0000000000400000-0x000000000081B000-memory.dmp
memory/1980-123-0x0000000000400000-0x000000000081B000-memory.dmp
memory/1980-101-0x0000000000400000-0x000000000081B000-memory.dmp
memory/1980-4-0x0000000010000000-0x0000000010030000-memory.dmp
memory/1980-100-0x0000000000400000-0x000000000081B000-memory.dmp
memory/1980-99-0x0000000000400000-0x000000000081B000-memory.dmp
memory/1980-173-0x0000000000400000-0x000000000081B000-memory.dmp
memory/1980-98-0x0000000000400000-0x000000000081B000-memory.dmp
memory/1980-102-0x0000000000400000-0x000000000081B000-memory.dmp
memory/1980-96-0x0000000000400000-0x000000000081B000-memory.dmp
memory/1980-95-0x0000000000400000-0x000000000081B000-memory.dmp
memory/1980-94-0x0000000000400000-0x000000000081B000-memory.dmp
memory/1980-250-0x0000000010000000-0x0000000010030000-memory.dmp
memory/1980-92-0x0000000000400000-0x000000000081B000-memory.dmp
memory/1980-91-0x0000000000400000-0x000000000081B000-memory.dmp
memory/1980-90-0x0000000000400000-0x000000000081B000-memory.dmp
memory/1980-89-0x0000000000400000-0x000000000081B000-memory.dmp
memory/1980-758-0x0000000000480000-0x0000000000481000-memory.dmp
memory/1980-702-0x0000000000400000-0x000000000081B000-memory.dmp
memory/1980-681-0x0000000010000000-0x0000000010030000-memory.dmp
memory/1980-88-0x0000000000400000-0x000000000081B000-memory.dmp
memory/1980-87-0x0000000000400000-0x000000000081B000-memory.dmp
memory/1980-86-0x0000000000400000-0x000000000081B000-memory.dmp
memory/1980-82-0x0000000000400000-0x000000000081B000-memory.dmp
memory/1980-85-0x0000000000400000-0x000000000081B000-memory.dmp
memory/1980-83-0x0000000000400000-0x000000000081B000-memory.dmp
memory/1980-84-0x0000000000400000-0x000000000081B000-memory.dmp
memory/1980-78-0x0000000000400000-0x000000000081B000-memory.dmp
memory/1980-76-0x0000000000400000-0x000000000081B000-memory.dmp
memory/1980-75-0x0000000000400000-0x000000000081B000-memory.dmp
memory/1980-74-0x0000000000400000-0x000000000081B000-memory.dmp
memory/1980-73-0x0000000000400000-0x000000000081B000-memory.dmp
memory/1980-72-0x0000000000400000-0x000000000081B000-memory.dmp
memory/1980-9-0x0000000000400000-0x000000000081B000-memory.dmp
memory/1980-8-0x0000000000480000-0x0000000000481000-memory.dmp
memory/2708-162-0x0000000000400000-0x000000000041B000-memory.dmp
memory/3852-196-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/3852-238-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/3852-248-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/3852-252-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/3852-253-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/3852-251-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/3852-249-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/3852-247-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/3852-225-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/3852-242-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/3852-227-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/3852-209-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/3852-212-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/3852-194-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/3852-198-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/3852-199-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/3852-195-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/3852-240-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/3852-197-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/3852-241-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/3852-239-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/3852-237-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/3852-236-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/3852-235-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/3852-234-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/3852-233-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/3852-232-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/3852-231-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/3852-230-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/3852-229-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/3852-226-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/3852-200-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/3852-202-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/3852-224-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/3852-223-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/3852-221-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/3852-201-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/3852-205-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/3852-218-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/3852-228-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/3852-222-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/3852-219-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/3852-220-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/3852-217-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/3852-216-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/3852-214-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/3852-211-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/3852-210-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/3852-208-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/3852-207-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/3852-206-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/3852-215-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/3852-213-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/3852-204-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/3852-203-0x0000000000400000-0x0000000000CE9000-memory.dmp