Analysis
- max time kernel
150s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
14/08/2026, 05:10
General
- Target 2026-08-14_15f28abe592c0bfca53dc0be54425c73_amadey_elex_floxif_smoke-loader_stop.exe
- Size 9.2MB
- Sample260814-ftx4cafd73
- SHA256 52f1d0de065e88a648d1ddcb0137700fec62924f3456b2e0e54e9efc429c6dcf
Malware Config
Signatures
- Family: Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
- Detects Floxif payload 1 IoCs
- Detects executables referencing virtualization MAC addresses 1 IoCs
- UPX dump on OEP (original entry point) 7 IoCs
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 18 IoCs
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file 7 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 14 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-14_15f28abe592c0bfca53dc0be54425c73_amadey_elex_floxif_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-14_15f28abe592c0bfca53dc0be54425c73_amadey_elex_floxif_smoke-loader_stop.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS4E02\FileExtractor.exe"C:\Users\Admin\AppData\Local\Temp\7zS4E02\FileExtractor.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS4E02\HPDiagnosticCoreUI.exe"C:\Users\Admin\AppData\Local\Temp\7zS4E02\HPDiagnosticCoreUI.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
symsrv.dll
symsrv.dll.000
Caliburn.Micro.Platform.dll
FileExtractor.exe
FileExtractor.exe.tmp
HPDiagnosticCore.dll
HPDiagnosticCoreUI.exe
HPDiagnosticCoreUI.exe.config
HPDiagnosticCoreUI.exe.nlog
Interop.HPDiagnosticCoreLib.dll
NLog.dll
PCLStorage.Abstractions.dll
PCLStorage.dll
PSdr.ico
Pdsmq.PCL.dll
PdsmqConfig.xml
PdsmqLib.Desktop.dll
1033.xaml
memory/1356-391-0x0000000007C70000-0x0000000007C78000-memory.dmp
memory/1356-396-0x0000000007CB0000-0x0000000007CC0000-memory.dmp
memory/1356-372-0x0000000007DA0000-0x00000000083B8000-memory.dmp
memory/1356-373-0x0000000007780000-0x0000000007ADB000-memory.dmp
memory/1356-426-0x000000000B520000-0x000000000B52E000-memory.dmp
memory/1356-378-0x0000000007B00000-0x0000000007B1A000-memory.dmp
memory/1356-384-0x0000000007B40000-0x0000000007B56000-memory.dmp
memory/1356-351-0x0000000072400000-0x0000000072BBC000-memory.dmp
memory/1356-350-0x0000000072412000-0x0000000072413000-memory.dmp
memory/1356-425-0x000000000B530000-0x000000000B56E000-memory.dmp
memory/1356-392-0x0000000007CD0000-0x0000000007CF2000-memory.dmp
memory/1356-424-0x000000000B4A0000-0x000000000B4A8000-memory.dmp
memory/1356-400-0x0000000008810000-0x000000000886A000-memory.dmp
memory/1356-404-0x0000000007D50000-0x0000000007D58000-memory.dmp
memory/1356-405-0x0000000007D60000-0x0000000007D68000-memory.dmp
memory/1356-403-0x0000000007D40000-0x0000000007D48000-memory.dmp
memory/1356-402-0x0000000007D30000-0x0000000007D38000-memory.dmp
memory/1356-401-0x0000000007D20000-0x0000000007D2A000-memory.dmp
memory/1356-344-0x0000000072400000-0x0000000072BBC000-memory.dmp
memory/1356-423-0x0000000008DB0000-0x0000000008DB8000-memory.dmp
memory/1356-343-0x00000000060E0000-0x0000000006168000-memory.dmp
memory/1356-410-0x0000000007D80000-0x0000000007D88000-memory.dmp
memory/1356-339-0x0000000000E70000-0x00000000015C6000-memory.dmp
memory/1356-416-0x0000000008890000-0x0000000008898000-memory.dmp
memory/1356-338-0x0000000072412000-0x0000000072413000-memory.dmp
memory/1356-421-0x0000000008930000-0x0000000008938000-memory.dmp
memory/1356-422-0x0000000008940000-0x0000000008948000-memory.dmp
memory/1356-419-0x0000000008920000-0x0000000008928000-memory.dmp
memory/1356-418-0x0000000008910000-0x0000000008918000-memory.dmp
memory/1356-417-0x0000000008900000-0x0000000008908000-memory.dmp
memory/1356-415-0x0000000008870000-0x000000000887C000-memory.dmp
memory/1356-411-0x0000000007D90000-0x0000000007D98000-memory.dmp
memory/1356-409-0x0000000007D70000-0x0000000007D78000-memory.dmp
memory/3036-364-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3036-347-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3036-348-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3036-353-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3036-4-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3036-431-0x0000000010000000-0x0000000010030000-memory.dmp
memory/5860-430-0x0000000000170000-0x000000000038F000-memory.dmp