Analysis
- max time kernel
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
08/10/2026, 10:32
General
- Target 2026-10-07_79c21a66fb75d836d201672e259e53b6_darkgate_elex_floxif_rhadamanthys_smoke-loader.exe
- Size 8.0MB
- Sample261008-mk8baaez2z
- SHA256 c39ded062ad00ab2c1666fd8630c9dcbe6b9c28e3a0e9e955e5636aa499fc99d
Malware Config
Signatures
- Family: Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
- Detects Floxif payload 1 IoCs
- UPX dump on OEP (original entry point) 3 IoCs
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
- Loads dropped DLL 1 IoCs
- UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-07_79c21a66fb75d836d201672e259e53b6_darkgate_elex_floxif_rhadamanthys_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-07_79c21a66fb75d836d201672e259e53b6_darkgate_elex_floxif_rhadamanthys_smoke-loader.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
symsrv.dll
memory/6072-4-0x0000000010000000-0x0000000010030000-memory.dmp
memory/6072-15-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/6072-22-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/6072-73-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/6072-75-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/6072-78-0x0000000002B80000-0x0000000002B94000-memory.dmp
memory/6072-82-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/6072-96-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/6072-116-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/6072-132-0x0000000010000000-0x0000000010030000-memory.dmp
memory/6072-117-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/6072-115-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/6072-89-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/6072-83-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/6072-114-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/6072-113-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/6072-80-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/6072-77-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/6072-72-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/6072-71-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/6072-70-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/6072-69-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/6072-68-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/6072-67-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/6072-66-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/6072-65-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/6072-64-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/6072-63-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/6072-62-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/6072-61-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/6072-60-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/6072-57-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/6072-56-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/6072-55-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/6072-54-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/6072-53-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/6072-52-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/6072-51-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/6072-50-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/6072-49-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/6072-48-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/6072-47-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/6072-46-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/6072-45-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/6072-44-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/6072-59-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/6072-58-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/6072-41-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/6072-40-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/6072-38-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/6072-39-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/6072-37-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/6072-36-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/6072-35-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/6072-34-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/6072-33-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/6072-32-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/6072-31-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/6072-28-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/6072-27-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/6072-26-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/6072-25-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/6072-24-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/6072-23-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/6072-21-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/6072-20-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/6072-19-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/6072-18-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/6072-17-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/6072-16-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/6072-14-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/6072-12-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/6072-29-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/6072-30-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/6072-13-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/6072-43-0x000000007FCD0000-0x000000007FE96000-memory.dmp
memory/6072-6-0x000000007FCD0000-0x000000007FE96000-memory.dmp