Analysis
- max time kernel
10s - max time network
140s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
09/08/2026, 07:06
General
- Target 2026-08-09_0465295909272636a7f53e18dda1a79f_amadey_elex_floxif_smoke-loader_wannacry.exe
- Size 4.2MB
- Sample260809-hw4d9ashjg
- SHA256 b0cec193c245a416e95551d0290cda2a93bb593ce1b068d098400b59440b7043
Malware Config
Signatures
- Family: Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
- Detects Floxif payload 1 IoCs
- UPX dump on OEP (original entry point) 4 IoCs
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
- Loads dropped DLL 1 IoCs
- Enumerates connected drives 3 TTPs 3 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 18 IoCs
- Suspicious use of AdjustPrivilegeToken 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_0465295909272636a7f53e18dda1a79f_amadey_elex_floxif_smoke-loader_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_0465295909272636a7f53e18dda1a79f_amadey_elex_floxif_smoke-loader_wannacry.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_0465295909272636a7f53e18dda1a79f_amadey_elex_floxif_smoke-loader_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_0465295909272636a7f53e18dda1a79f_amadey_elex_floxif_smoke-loader_wannacry.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\QemuBootTester\qemu-img.exe"C:\Users\Admin\AppData\Local\Temp\QemuBootTester\qemu-img.exe" create -q -f vmdk "C:\Users\Admin\AppData\Local\Temp\QemuBootTester\hd.vmdk" 1024M2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\QemuBootTester\myqemu.exe"C:\Users\Admin\AppData\Local\Temp\QemuBootTester\myqemu.exe" -L "C:\Users\Admin\AppData\Local\Temp\QemuBootTester" -m 693 -localtime -hda \\.\PhysicalDrive0 -boot c -hdb "C:\Users\Admin\AppData\Local\Temp\QemuBootTester\hd.vmdk" -vga std -snapshot2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_0465295909272636a7f53e18dda1a79f_amadey_elex_floxif_smoke-loader_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_0465295909272636a7f53e18dda1a79f_amadey_elex_floxif_smoke-loader_wannacry.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_0465295909272636a7f53e18dda1a79f_amadey_elex_floxif_smoke-loader_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_0465295909272636a7f53e18dda1a79f_amadey_elex_floxif_smoke-loader_wannacry.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
symsrv.dll
symsrv.dll.000
SDL.dll
SDL.dll.tmp
bios.bin
efi32.bin
efi64.bin
hd.vmdk
intl.dll
libgcc_s_sjlj-1.dll
libglib-2.0-0.dll
libgthread-2.0-0.dll
libpdcurses.dll
libssp-0.dll
libz-1.dll
linuxboot.bin
myqemu.exe
pxe-e1000.bin
qemu-img.exe
test.fba
vgabios-cirrus.bin
vgabios-stdvga.bin
zlib1.dll
memory/1672-203-0x0000000000400000-0x000000000041B000-memory.dmp
memory/3656-222-0x000000006CEC0000-0x000000006CF2F000-memory.dmp
memory/3656-223-0x00000000685C0000-0x00000000686C6000-memory.dmp
memory/3656-219-0x0000000000400000-0x00000000004A5000-memory.dmp
memory/3656-224-0x000000006A300000-0x000000006A323000-memory.dmp
memory/3656-221-0x0000000062E80000-0x0000000062E9F000-memory.dmp
memory/3656-220-0x0000000065C40000-0x0000000065C4E000-memory.dmp
memory/5760-162-0x0000000000400000-0x000000000081B000-memory.dmp
memory/5760-87-0x0000000000400000-0x000000000081B000-memory.dmp
memory/5760-105-0x0000000000400000-0x000000000081B000-memory.dmp
memory/5760-107-0x0000000000400000-0x000000000081B000-memory.dmp
memory/5760-106-0x0000000000400000-0x000000000081B000-memory.dmp
memory/5760-108-0x0000000000400000-0x000000000081B000-memory.dmp
memory/5760-110-0x0000000000400000-0x000000000081B000-memory.dmp
memory/5760-111-0x0000000000400000-0x000000000081B000-memory.dmp
memory/5760-112-0x0000000000400000-0x000000000081B000-memory.dmp
memory/5760-109-0x0000000000400000-0x000000000081B000-memory.dmp
memory/5760-113-0x0000000000400000-0x000000000081B000-memory.dmp
memory/5760-114-0x0000000010000000-0x0000000010030000-memory.dmp
memory/5760-116-0x0000000000400000-0x000000000081B000-memory.dmp
memory/5760-117-0x0000000000400000-0x000000000081B000-memory.dmp
memory/5760-115-0x0000000000400000-0x000000000081B000-memory.dmp
memory/5760-118-0x0000000000400000-0x000000000081B000-memory.dmp
memory/5760-119-0x0000000000400000-0x000000000081B000-memory.dmp
memory/5760-120-0x0000000000400000-0x000000000081B000-memory.dmp
memory/5760-121-0x0000000000400000-0x000000000081B000-memory.dmp
memory/5760-122-0x0000000000400000-0x000000000081B000-memory.dmp
memory/5760-123-0x0000000000400000-0x000000000081B000-memory.dmp
memory/5760-124-0x0000000000400000-0x000000000081B000-memory.dmp
memory/5760-125-0x0000000000400000-0x000000000081B000-memory.dmp
memory/5760-127-0x0000000000400000-0x000000000081B000-memory.dmp
memory/5760-126-0x0000000000400000-0x000000000081B000-memory.dmp
memory/5760-128-0x0000000000400000-0x000000000081B000-memory.dmp
memory/5760-129-0x0000000000400000-0x000000000081B000-memory.dmp
memory/5760-130-0x0000000000400000-0x000000000081B000-memory.dmp
memory/5760-132-0x0000000000400000-0x000000000081B000-memory.dmp
memory/5760-131-0x0000000000400000-0x000000000081B000-memory.dmp
memory/5760-133-0x0000000000400000-0x000000000081B000-memory.dmp
memory/5760-135-0x0000000000400000-0x000000000081B000-memory.dmp
memory/5760-134-0x0000000000400000-0x000000000081B000-memory.dmp
memory/5760-136-0x0000000000400000-0x000000000081B000-memory.dmp
memory/5760-137-0x0000000000400000-0x000000000081B000-memory.dmp
memory/5760-138-0x0000000000400000-0x000000000081B000-memory.dmp
memory/5760-139-0x0000000000400000-0x000000000081B000-memory.dmp
memory/5760-140-0x0000000000400000-0x000000000081B000-memory.dmp
memory/5760-141-0x0000000000400000-0x000000000081B000-memory.dmp
memory/5760-142-0x0000000000400000-0x000000000081B000-memory.dmp
memory/5760-143-0x0000000000400000-0x000000000081B000-memory.dmp
memory/5760-144-0x0000000000400000-0x000000000081B000-memory.dmp
memory/5760-145-0x0000000000400000-0x000000000081B000-memory.dmp
memory/5760-146-0x0000000000400000-0x000000000081B000-memory.dmp
memory/5760-147-0x0000000000400000-0x000000000081B000-memory.dmp
memory/5760-149-0x0000000000400000-0x000000000081B000-memory.dmp
memory/5760-148-0x0000000000400000-0x000000000081B000-memory.dmp
memory/5760-151-0x0000000000400000-0x000000000081B000-memory.dmp
memory/5760-153-0x0000000000400000-0x000000000081B000-memory.dmp
memory/5760-150-0x0000000000400000-0x000000000081B000-memory.dmp
memory/5760-154-0x0000000000400000-0x000000000081B000-memory.dmp
memory/5760-156-0x0000000000400000-0x000000000081B000-memory.dmp
memory/5760-155-0x0000000000400000-0x000000000081B000-memory.dmp
memory/5760-158-0x0000000000400000-0x000000000081B000-memory.dmp
memory/5760-159-0x0000000000400000-0x000000000081B000-memory.dmp
memory/5760-160-0x0000000000400000-0x000000000081B000-memory.dmp
memory/5760-157-0x0000000000400000-0x000000000081B000-memory.dmp
memory/5760-104-0x0000000000400000-0x000000000081B000-memory.dmp
memory/5760-161-0x0000000000400000-0x000000000081B000-memory.dmp
memory/5760-103-0x0000000000400000-0x000000000081B000-memory.dmp
memory/5760-101-0x0000000000400000-0x000000000081B000-memory.dmp
memory/5760-100-0x0000000000400000-0x000000000081B000-memory.dmp
memory/5760-96-0x0000000000400000-0x000000000081B000-memory.dmp
memory/5760-99-0x0000000000400000-0x000000000081B000-memory.dmp
memory/5760-98-0x0000000000400000-0x000000000081B000-memory.dmp
memory/5760-97-0x0000000000400000-0x000000000081B000-memory.dmp
memory/5760-95-0x0000000000400000-0x000000000081B000-memory.dmp
memory/5760-93-0x0000000000400000-0x000000000081B000-memory.dmp
memory/5760-92-0x0000000000400000-0x000000000081B000-memory.dmp
memory/5760-91-0x0000000000400000-0x000000000081B000-memory.dmp
memory/5760-90-0x0000000000400000-0x000000000081B000-memory.dmp
memory/5760-89-0x0000000000400000-0x000000000081B000-memory.dmp
memory/5760-88-0x0000000000400000-0x000000000081B000-memory.dmp
memory/5760-102-0x0000000000400000-0x000000000081B000-memory.dmp
memory/5760-86-0x0000000000400000-0x000000000081B000-memory.dmp
memory/5760-85-0x0000000000400000-0x000000000081B000-memory.dmp
memory/5760-76-0x0000000000400000-0x000000000081B000-memory.dmp
memory/5760-4-0x0000000010000000-0x0000000010030000-memory.dmp
memory/5760-8-0x0000000000480000-0x0000000000481000-memory.dmp
memory/5760-793-0x0000000000480000-0x0000000000481000-memory.dmp
memory/5760-723-0x0000000000400000-0x000000000081B000-memory.dmp
memory/5760-720-0x0000000010000000-0x0000000010030000-memory.dmp
memory/5760-9-0x0000000000400000-0x000000000081B000-memory.dmp
memory/5760-72-0x0000000000400000-0x000000000081B000-memory.dmp
memory/5760-73-0x0000000000400000-0x000000000081B000-memory.dmp
memory/5760-75-0x0000000000400000-0x000000000081B000-memory.dmp
memory/5760-74-0x0000000000400000-0x000000000081B000-memory.dmp
memory/5760-77-0x0000000000400000-0x000000000081B000-memory.dmp
memory/5760-82-0x0000000000400000-0x000000000081B000-memory.dmp
memory/5760-84-0x0000000000400000-0x000000000081B000-memory.dmp
memory/5760-83-0x0000000000400000-0x000000000081B000-memory.dmp
memory/6116-278-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/6116-288-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/6116-266-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/6116-265-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/6116-264-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/6116-263-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/6116-259-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/6116-260-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/6116-261-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/6116-256-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/6116-255-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/6116-254-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/6116-252-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/6116-239-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/6116-243-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/6116-244-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/6116-246-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/6116-236-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/6116-235-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/6116-250-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/6116-247-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/6116-245-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/6116-242-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/6116-241-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/6116-279-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/6116-269-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/6116-237-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/6116-276-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/6116-253-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/6116-277-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/6116-275-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/6116-270-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/6116-281-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/6116-282-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/6116-283-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/6116-286-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/6116-285-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/6116-284-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/6116-294-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/6116-293-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/6116-292-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/6116-290-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/6116-289-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/6116-248-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/6116-249-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/6116-280-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/6116-287-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/6116-251-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/6116-240-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/6116-257-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/6116-291-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/6116-262-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/6116-258-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/6116-267-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/6116-268-0x0000000000400000-0x0000000000CE9000-memory.dmp
memory/6116-238-0x0000000000400000-0x0000000000CE9000-memory.dmp