Analysis
- user interaction
yes - max time kernel
32s - max time network
35s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
01/09/2026, 23:38
General
- Target 99157E596322828D53D5673D58BD5343954FE00B97DFAECC61C679F9D8F14431.exe
- Size 12.9MB
- Sample260901-3msavafc86
- SHA256 99157e596322828d53d5673d58bd5343954fe00b97dfaecc61c679f9d8f14431
Malware Config
Signatures
- Family: Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
- Detects Floxif payload 1 IoCs
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
- Loads dropped DLL 5 IoCs
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 9 IoCs
- Suspicious use of UnmapMainImage 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\99157E596322828D53D5673D58BD5343954FE00B97DFAECC61C679F9D8F14431.exe"C:\Users\Admin\AppData\Local\Temp\99157E596322828D53D5673D58BD5343954FE00B97DFAECC61C679F9D8F14431.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
-
C:\Users\Admin\AppData\Local\Temp\Data\stub@\reg1aid64.exe"C:\Users\Admin\AppData\Local\Temp\Data\stub@\reg1aid64.exe" /864A627C-C6B2-464A-AA13-25D62F282BD82⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
symsrv.dll
rfagent32.exe_0x9963c63584b149093e3995d5b4f941df.1.manifest.__tmp__
3144_00400000_tls.dll
vmx.dll.tmp
vmx.dll.tmp
RFA_start.exe.tmp
memory/3144-9-0x0000000003E30000-0x0000000004387000-memory.dmp
memory/3144-27-0x0000000003050000-0x00000000030E9000-memory.dmp
memory/3144-15-0x0000000003E30000-0x0000000004387000-memory.dmp
memory/3144-13-0x0000000003E30000-0x0000000004387000-memory.dmp
memory/3144-12-0x0000000003E30000-0x0000000004387000-memory.dmp
memory/3144-29-0x0000000000400000-0x000000000047C000-memory.dmp
memory/3144-23-0x0000000003050000-0x00000000030E9000-memory.dmp
memory/3144-17-0x0000000003E30000-0x0000000004387000-memory.dmp
memory/3144-18-0x0000000003050000-0x00000000030E9000-memory.dmp
memory/3144-14-0x0000000003E30000-0x0000000004387000-memory.dmp
memory/3144-8-0x0000000003E30000-0x0000000004387000-memory.dmp
memory/3144-28-0x0000000003050000-0x00000000030E9000-memory.dmp
memory/3144-56-0x00000000744E0000-0x00000000744E2000-memory.dmp
memory/3144-59-0x0000000000400000-0x000000000047C000-memory.dmp
memory/3144-60-0x0000000000400000-0x000000000047C000-memory.dmp
memory/3144-58-0x0000000000400000-0x000000000047C000-memory.dmp
memory/3144-61-0x0000000000400000-0x000000000047C000-memory.dmp
memory/3144-10-0x0000000003E30000-0x0000000004387000-memory.dmp
memory/3144-11-0x0000000003E30000-0x0000000004387000-memory.dmp
memory/3144-3-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3144-111-0x0000000003050000-0x00000000030E9000-memory.dmp
memory/3144-115-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3144-112-0x0000000000400000-0x000000000047C000-memory.dmp