Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
20/08/2026, 00:00
General
- Target 2026-08-19_a6014d85e0b16ee4e3230110315674a9_drokbk_elex_floxif_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 493KB
- Sample260820-aas3dswekb
- SHA256 bd1e3a00cad249c052d577924f6748f54a5ecc57010c5a821f51624446d71dea
Malware Config
Signatures
- Family: Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
- Detects Floxif payload 1 IoCs
- UPX dump on OEP (original entry point) 3 IoCs
- Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
- Loads dropped DLL 1 IoCs
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-19_a6014d85e0b16ee4e3230110315674a9_drokbk_elex_floxif_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-19_a6014d85e0b16ee4e3230110315674a9_drokbk_elex_floxif_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
symsrv.dll
symsrv.dll.000
memory/4608-4-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4608-6-0x0000000074FF2000-0x0000000074FF3000-memory.dmp
memory/4608-7-0x0000000004E70000-0x0000000004ECC000-memory.dmp
memory/4608-8-0x0000000074FE0000-0x000000007579C000-memory.dmp
memory/4608-10-0x0000000074FE0000-0x000000007579C000-memory.dmp
memory/4608-11-0x00000000055E0000-0x000000000563C000-memory.dmp
memory/4608-12-0x0000000005640000-0x00000000056DC000-memory.dmp
memory/4608-13-0x0000000074FE0000-0x000000007579C000-memory.dmp
memory/4608-9-0x0000000005020000-0x00000000055DA000-memory.dmp
memory/4608-139-0x00000000055E0000-0x0000000005635000-memory.dmp
memory/4608-137-0x00000000055E0000-0x0000000005635000-memory.dmp
memory/4608-334-0x0000000074FE0000-0x000000007579C000-memory.dmp
memory/4608-337-0x0000000005B50000-0x0000000005B5A000-memory.dmp
memory/4608-338-0x0000000005B60000-0x0000000005BB6000-memory.dmp
memory/4608-336-0x0000000074FE0000-0x000000007579C000-memory.dmp
memory/4608-331-0x0000000005800000-0x0000000005892000-memory.dmp
memory/4608-136-0x00000000055E0000-0x0000000005635000-memory.dmp
memory/4608-133-0x00000000055E0000-0x0000000005635000-memory.dmp
memory/4608-131-0x00000000055E0000-0x0000000005635000-memory.dmp
memory/4608-129-0x00000000055E0000-0x0000000005635000-memory.dmp
memory/4608-127-0x00000000055E0000-0x0000000005635000-memory.dmp
memory/4608-125-0x00000000055E0000-0x0000000005635000-memory.dmp
memory/4608-123-0x00000000055E0000-0x0000000005635000-memory.dmp
memory/4608-121-0x00000000055E0000-0x0000000005635000-memory.dmp
memory/4608-119-0x00000000055E0000-0x0000000005635000-memory.dmp
memory/4608-117-0x00000000055E0000-0x0000000005635000-memory.dmp
memory/4608-115-0x00000000055E0000-0x0000000005635000-memory.dmp
memory/4608-109-0x00000000055E0000-0x0000000005635000-memory.dmp
memory/4608-107-0x00000000055E0000-0x0000000005635000-memory.dmp
memory/4608-103-0x00000000055E0000-0x0000000005635000-memory.dmp
memory/4608-101-0x00000000055E0000-0x0000000005635000-memory.dmp
memory/4608-97-0x00000000055E0000-0x0000000005635000-memory.dmp
memory/4608-95-0x00000000055E0000-0x0000000005635000-memory.dmp
memory/4608-93-0x00000000055E0000-0x0000000005635000-memory.dmp
memory/4608-91-0x00000000055E0000-0x0000000005635000-memory.dmp
memory/4608-87-0x00000000055E0000-0x0000000005635000-memory.dmp
memory/4608-86-0x00000000055E0000-0x0000000005635000-memory.dmp
memory/4608-83-0x00000000055E0000-0x0000000005635000-memory.dmp
memory/4608-81-0x00000000055E0000-0x0000000005635000-memory.dmp
memory/4608-77-0x00000000055E0000-0x0000000005635000-memory.dmp
memory/4608-75-0x00000000055E0000-0x0000000005635000-memory.dmp
memory/4608-73-0x00000000055E0000-0x0000000005635000-memory.dmp
memory/4608-71-0x00000000055E0000-0x0000000005635000-memory.dmp
memory/4608-67-0x00000000055E0000-0x0000000005635000-memory.dmp
memory/4608-65-0x00000000055E0000-0x0000000005635000-memory.dmp
memory/4608-63-0x00000000055E0000-0x0000000005635000-memory.dmp
memory/4608-60-0x00000000055E0000-0x0000000005635000-memory.dmp
memory/4608-57-0x00000000055E0000-0x0000000005635000-memory.dmp
memory/4608-51-0x00000000055E0000-0x0000000005635000-memory.dmp
memory/4608-53-0x00000000055E0000-0x0000000005635000-memory.dmp
memory/4608-47-0x00000000055E0000-0x0000000005635000-memory.dmp
memory/4608-45-0x00000000055E0000-0x0000000005635000-memory.dmp
memory/4608-41-0x00000000055E0000-0x0000000005635000-memory.dmp
memory/4608-39-0x00000000055E0000-0x0000000005635000-memory.dmp
memory/4608-37-0x00000000055E0000-0x0000000005635000-memory.dmp
memory/4608-33-0x00000000055E0000-0x0000000005635000-memory.dmp
memory/4608-31-0x00000000055E0000-0x0000000005635000-memory.dmp
memory/4608-27-0x00000000055E0000-0x0000000005635000-memory.dmp
memory/4608-25-0x00000000055E0000-0x0000000005635000-memory.dmp
memory/4608-23-0x00000000055E0000-0x0000000005635000-memory.dmp
memory/4608-21-0x00000000055E0000-0x0000000005635000-memory.dmp
memory/4608-19-0x00000000055E0000-0x0000000005635000-memory.dmp
memory/4608-17-0x00000000055E0000-0x0000000005635000-memory.dmp
memory/4608-14-0x00000000055E0000-0x0000000005635000-memory.dmp
memory/4608-15-0x00000000055E0000-0x0000000005635000-memory.dmp
memory/4608-112-0x00000000055E0000-0x0000000005635000-memory.dmp
memory/4608-113-0x00000000055E0000-0x0000000005635000-memory.dmp
memory/4608-105-0x00000000055E0000-0x0000000005635000-memory.dmp
memory/4608-99-0x00000000055E0000-0x0000000005635000-memory.dmp
memory/4608-89-0x00000000055E0000-0x0000000005635000-memory.dmp
memory/4608-79-0x00000000055E0000-0x0000000005635000-memory.dmp
memory/4608-69-0x00000000055E0000-0x0000000005635000-memory.dmp
memory/4608-61-0x00000000055E0000-0x0000000005635000-memory.dmp
memory/4608-55-0x00000000055E0000-0x0000000005635000-memory.dmp
memory/4608-49-0x00000000055E0000-0x0000000005635000-memory.dmp
memory/4608-43-0x00000000055E0000-0x0000000005635000-memory.dmp
memory/4608-35-0x00000000055E0000-0x0000000005635000-memory.dmp
memory/4608-29-0x00000000055E0000-0x0000000005635000-memory.dmp
memory/4608-339-0x0000000009220000-0x0000000009248000-memory.dmp
memory/4608-340-0x0000000074FE0000-0x000000007579C000-memory.dmp
memory/4608-341-0x0000000074FE0000-0x000000007579C000-memory.dmp
memory/4608-343-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4608-344-0x0000000074FE0000-0x000000007579C000-memory.dmp
memory/4608-345-0x0000000074FF2000-0x0000000074FF3000-memory.dmp
memory/4608-346-0x0000000074FE0000-0x000000007579C000-memory.dmp
memory/4608-349-0x0000000074FE0000-0x000000007579C000-memory.dmp
memory/4608-351-0x0000000074FE0000-0x000000007579C000-memory.dmp