Analysis
- max time kernel
149s - max time network
155s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
10/08/2026, 15:24
General
- Target 2026-08-10_5068c763556662e9821aeb838bbafd64_elex_floxif_wannacry.exe
- Size 9.8MB
- Sample260810-stbxbsha92
- SHA256 7327786fb4b7aa72eadd52a54118ac342492b00ec487fdd74c2589acd6741145
Malware Config
Signatures
- Family: Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
- Detects Floxif payload 1 IoCs
- UPX dump on OEP (original entry point) 5 IoCs
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 64 IoCs
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of FindShellTrayWindow 4 IoCs
- Suspicious use of SendNotifyMessage 3 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_5068c763556662e9821aeb838bbafd64_elex_floxif_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_5068c763556662e9821aeb838bbafd64_elex_floxif_wannacry.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AIMP\AIMP.exe"C:\Users\Admin\AppData\Local\Temp\AIMP\AIMP.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004BC 0x00000000000004B81⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
symsrv.dll
AIMP.Runtime.dll
AIMP.Shared.dll
AIMP.exe
AIMP.ini
AIMPac.exe
AIMPate.exe
English.lng
korean.lng
croatian.lng
dutch.lng
loading_order
bass_alac.dll
bass_ape.dll
bass_flac.dll
bass_hls.dll
bass_midi.dll
bass_mpc.dll
OptimFROG.dll
bass_ofr.dll
bass_wma.dll
bass_wv.dll
tak_deco_lib.dll
AIMP.ini
Catalogs-AlbumArt.ini
Encoders.xml
MACDll.dll
aimp_libvorbis.dll
lame_enc.dll
libFLAC.dll
wavpackdll.dll
aimp_mediakeys.dll
aimp_mousehook.dll
libsoxr.dll
bass.dll
memory/1860-503-0x0000000006A6E000-0x0000000006A6F000-memory.dmp
memory/1860-447-0x0000000002310000-0x000000000232B000-memory.dmp
memory/1860-529-0x0000000006AE0000-0x0000000006B01000-memory.dmp
memory/1860-533-0x0000000006E80000-0x0000000006EAB000-memory.dmp
memory/1860-534-0x0000000006EB0000-0x0000000006EC7000-memory.dmp
memory/1860-525-0x0000000006A60000-0x0000000006A6B000-memory.dmp
memory/1860-535-0x0000000006ED0000-0x0000000006EE4000-memory.dmp
memory/1860-522-0x0000000006A60000-0x0000000006A62000-memory.dmp
memory/1860-521-0x0000000006AA0000-0x0000000006AA7000-memory.dmp
memory/1860-520-0x00000000049D0000-0x00000000049D4000-memory.dmp
memory/1860-537-0x0000000007020000-0x000000000703E000-memory.dmp
memory/1860-516-0x0000000002390000-0x0000000002391000-memory.dmp
memory/1860-538-0x0000000007040000-0x0000000007056000-memory.dmp
memory/1860-513-0x0000000002310000-0x000000000232B000-memory.dmp
memory/1860-511-0x0000000006A80000-0x0000000006A93000-memory.dmp
memory/1860-508-0x0000000006A70000-0x0000000006A79000-memory.dmp
memory/1860-875-0x00000000016F0000-0x00000000022DD000-memory.dmp
memory/1860-539-0x0000000007060000-0x000000000719E000-memory.dmp
memory/1860-540-0x0000000006AA0000-0x0000000006AA7000-memory.dmp
memory/1860-502-0x0000000006A60000-0x0000000006A6F000-memory.dmp
memory/1860-541-0x00000000072E0000-0x0000000007345000-memory.dmp
memory/1860-542-0x0000000007350000-0x000000000738C000-memory.dmp
memory/1860-496-0x0000000006A60000-0x0000000006A62000-memory.dmp
memory/1860-543-0x0000000007390000-0x00000000073CD000-memory.dmp
memory/1860-536-0x0000000006EF0000-0x0000000006F1F000-memory.dmp
memory/1860-491-0x0000000006A40000-0x0000000006A58000-memory.dmp
memory/1860-531-0x0000000006C30000-0x0000000006C8D000-memory.dmp
memory/1860-530-0x0000000006C10000-0x0000000006C2F000-memory.dmp
memory/1860-528-0x0000000010700000-0x0000000010712000-memory.dmp
memory/1860-483-0x0000000005FA0000-0x0000000005FB8000-memory.dmp
memory/1860-468-0x00000000734C0000-0x00000000734CB000-memory.dmp
memory/1860-469-0x00000000049D0000-0x00000000049D4000-memory.dmp
memory/1860-448-0x0000000002390000-0x0000000002391000-memory.dmp
memory/1860-463-0x0000000004F10000-0x0000000004F4E000-memory.dmp
memory/1860-444-0x0000000073930000-0x0000000073988000-memory.dmp
memory/1860-456-0x0000000004EB0000-0x0000000004F0C000-memory.dmp
memory/1860-437-0x00000000010A0000-0x00000000016E1000-memory.dmp
memory/1860-851-0x00000000016F0000-0x00000000022DD000-memory.dmp
memory/1860-532-0x0000000006E00000-0x0000000006E74000-memory.dmp
memory/1860-439-0x00000000016F0000-0x00000000022DD000-memory.dmp
memory/1860-827-0x00000000016F0000-0x00000000022DD000-memory.dmp
memory/1860-554-0x0000000000400000-0x0000000000881000-memory.dmp
memory/1860-555-0x00000000010A0000-0x00000000016E1000-memory.dmp
memory/1860-575-0x0000000007350000-0x000000000738C000-memory.dmp
memory/1860-574-0x00000000072E0000-0x0000000007345000-memory.dmp
memory/1860-556-0x00000000016F0000-0x00000000022DD000-memory.dmp
memory/1860-572-0x0000000007040000-0x0000000007056000-memory.dmp
memory/1860-571-0x0000000007020000-0x000000000703E000-memory.dmp
memory/1860-569-0x0000000006ED0000-0x0000000006EE4000-memory.dmp
memory/1860-568-0x0000000006EB0000-0x0000000006EC7000-memory.dmp
memory/1860-567-0x0000000006E80000-0x0000000006EAB000-memory.dmp
memory/1860-566-0x0000000006E00000-0x0000000006E74000-memory.dmp
memory/1860-576-0x0000000007390000-0x00000000073CD000-memory.dmp
memory/1860-565-0x0000000006C30000-0x0000000006C8D000-memory.dmp
memory/1860-564-0x00000000726A0000-0x00000000726C6000-memory.dmp
memory/1860-563-0x0000000006C10000-0x0000000006C2F000-memory.dmp
memory/1860-562-0x0000000006AE0000-0x0000000006B01000-memory.dmp
memory/1860-558-0x0000000006A40000-0x0000000006A58000-memory.dmp
memory/1860-557-0x0000000005FA0000-0x0000000005FB8000-memory.dmp
memory/1860-570-0x0000000006EF0000-0x0000000006F1F000-memory.dmp
memory/1860-580-0x00000000016F0000-0x00000000022DD000-memory.dmp
memory/1860-603-0x0000000000400000-0x0000000000881000-memory.dmp
memory/1860-604-0x00000000010A0000-0x00000000016E1000-memory.dmp
memory/1860-605-0x00000000016F0000-0x00000000022DD000-memory.dmp
memory/1860-629-0x00000000016F0000-0x00000000022DD000-memory.dmp
memory/1860-653-0x00000000016F0000-0x00000000022DD000-memory.dmp
memory/1860-682-0x00000000016F0000-0x00000000022DD000-memory.dmp
memory/1860-707-0x00000000016F0000-0x00000000022DD000-memory.dmp
memory/1860-731-0x00000000016F0000-0x00000000022DD000-memory.dmp
memory/1860-755-0x00000000016F0000-0x00000000022DD000-memory.dmp
memory/1860-803-0x00000000016F0000-0x00000000022DD000-memory.dmp
memory/4512-548-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4512-4-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4512-507-0x0000000010000000-0x0000000010030000-memory.dmp