floxif | 46454381b1df6ef37475dad5569ac5830ba8ddc98b61a8084b4f94723df5e625

General

Target
46454381b1df6ef37475dad5569ac5830ba8ddc98b61a8084b4f94723df5e625.dll
Size 218KB
Sample261027-e7adrsav8v
SHA256 46454381b1df6ef37475dad5569ac5830ba8ddc98b61a8084b4f94723df5e625
MD5 cefac98d98e746b6bbc830edeb2f208c
SHA1 a7355dd21a37465e9a49a385dbb67df29b6204a4
SHA512 9e66ce154f7e767f0bd9bc54c28c7f96e02c4bc49202b2e425ebdba16cace4cfe11419f43b8e6c1659e192d9960ec520d9b7df5759377d58b90b2179e2f6b4fa
SSDEEP 6144:aFMllOJTbaDhZJ7SWr3uGsQvMRlkM4RD/qzMfUQ:h7OJTbuBn3u8MRGM4h/qofV
TLSH
T16124CF01B150C3FAD47E18383074D7615BEAB83CCA9969CBE35446659E3C6C29E78E2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor defense_evasion discovery floxif trojan upx

Malware Config

Signatures

Family: Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
backdoor trojan floxif

Detects Floxif payload 1 IoCs

backdoor

resource	yara_rule
behavioral1/files/0x000a00000002434a-1.dat	floxif

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x000a00000002434a-1.dat	acprotect

Loads dropped DLL 2 IoCs

pid	Process
4832	rundll32.exe
4832	rundll32.exe

Network Service Discovery 1 TTPs 8 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
3536	arp.exe
3396	arp.exe
3868	arp.exe
3076	arp.exe
2344	arp.exe
3280	arp.exe
3288	arp.exe
1084	arp.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000a00000002434a-1.dat	upx
behavioral1/memory/4832-7-0x0000000000780000-0x00000000007B3000-memory.dmp	upx
behavioral1/memory/4832-6-0x0000000000780000-0x00000000007B3000-memory.dmp	upx
behavioral1/memory/4832-10-0x0000000000780000-0x00000000007B3000-memory.dmp	upx

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\symsrv.dll	rundll32.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1372	4832	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	arp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	arp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	arp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	arp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	arp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	arp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	arp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	arp.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4832	rundll32.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1344 wrote to memory of 4832	1344	rundll32.exe	83
PID 4832 wrote to memory of 3076	4832	rundll32.exe	84
PID 4832 wrote to memory of 3868	4832	rundll32.exe	88
PID 4832 wrote to memory of 3396	4832	rundll32.exe	89
PID 4832 wrote to memory of 3536	4832	rundll32.exe	90
PID 4832 wrote to memory of 1084	4832	rundll32.exe	91
PID 4832 wrote to memory of 3288	4832	rundll32.exe	92
PID 4832 wrote to memory of 3280	4832	rundll32.exe	93
PID 4832 wrote to memory of 2344	4832	rundll32.exe	94

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\46454381b1df6ef37475dad5569ac5830ba8ddc98b61a8084b4f94723df5e625.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1344
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\46454381b1df6ef37475dad5569ac5830ba8ddc98b61a8084b4f94723df5e625.dll,#1
  2⤵
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Direct Volume Access: Opens a physical disk for reading
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4832
- - C:\Windows\SysWOW64\arp.exe
    arp -a
    3⤵
    - Network Service Discovery
    - System Location Discovery: System Language Discovery
    PID:3076
- - C:\Windows\SysWOW64\arp.exe
    arp -s 10.127.0.1 ba-07-b1-b1-92-be
    3⤵
    - Network Service Discovery
    - System Location Discovery: System Language Discovery
    PID:3868
- - C:\Windows\SysWOW64\arp.exe
    arp -s 10.127.255.255 89-b0-c2-57-10-70
    3⤵
    - Network Service Discovery
    - System Location Discovery: System Language Discovery
    PID:3396
- - C:\Windows\SysWOW64\arp.exe
    arp -s 224.0.0.22 56-2b-2b-71-c4-80
    3⤵
    - Network Service Discovery
    - System Location Discovery: System Language Discovery
    PID:3536
- - C:\Windows\SysWOW64\arp.exe
    arp -s 224.0.0.251 6a-b8-b9-1c-4d-47
    3⤵
    - Network Service Discovery
    - System Location Discovery: System Language Discovery
    PID:1084
- - C:\Windows\SysWOW64\arp.exe
    arp -s 224.0.0.252 5f-c3-2f-e5-53-b7
    3⤵
    - Network Service Discovery
    - System Location Discovery: System Language Discovery
    PID:3288
- - C:\Windows\SysWOW64\arp.exe
    arp -s 239.255.255.250 a4-8e-e4-6f-d1-6d
    3⤵
    - Network Service Discovery
    - System Location Discovery: System Language Discovery
    PID:3280
- - C:\Windows\SysWOW64\arp.exe
    arp -s 255.255.255.255 d5-37-ea-8d-e3-92
    3⤵
    - Network Service Discovery
    - System Location Discovery: System Language Discovery
    PID:2344
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4832 -s 900
    3⤵
    - Program crash
    PID:1372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4832 -ip 4832
1⤵
PID:4680

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

1

T1006

Credential Access

Discovery

Network Service Discovery

1

T1046

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

symsrv.dll

Path C:\Program Files\Common Files\System\symsrv.dll
Size 71KB
SHA256 8ea3b17e4b783ffc0bc387b81b823bf87af0d57da74541d88ba85314bb232a5d
MD5 4fcd7574537cebec8e75b4e646996643
SHA1 efa59bb9050fb656b90d5d40c942fb2a304f2a8b
SHA512 7f1a7ef64d332a735db82506b47d84853af870785066d29ccaf4fdeab114079a9f0db400e01ba574776a0d652a248658fe1e8f9659cdced19ad6eea09644ea3e
SSDEEP 1536:5POOhfbOjovgdVydUgoNrwBZXGDaZ1QIxrfItMgR7ZaO+fGxHZPEP:5dbwovEVyqgoZmZXWfIdQdRaefPq
TLSH
T1D173E0B72DFC4865E1A12277865F4319EA31D4778110E86BC9080BC9CDBA9E0E7536BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4832-7-0x0000000000780000-0x00000000007B3000-memory.dmp

Download

memory/4832-6-0x0000000000780000-0x00000000007B3000-memory.dmp

Download

memory/4832-9-0x0000000010000000-0x0000000010025000-memory.dmp

Download

memory/4832-10-0x0000000000780000-0x00000000007B3000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads