floxif | e299172db95ce84fefdd56da39d939e5701fa7d9bf9f3b8d8683ffcf761dd099

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/11/2026, 14:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-09_fe57f82654d6cac6b045ba352c985560_elex_floxif_redline-stealer_rhadamanthys_stop_tofsee.exe
Size 2.6MB
Sample261109-rsm3jayv2k
SHA256 e299172db95ce84fefdd56da39d939e5701fa7d9bf9f3b8d8683ffcf761dd099
MD5 fe57f82654d6cac6b045ba352c985560
SHA1 770f1c0fd1131ee857566aaea12778ce1851da44
SHA512 95905af466b95123c39131a8e1cae4336227df3b6c0c8aa0329805b3807447f52da564bcd1c7e8836203693b4f5d5ed0c8c0b51aa91eb403e2d22b0ad92456aa
SSDEEP 49152:7mTRR0i90cyIw/wj3ka4NSV9dvLWqbURdk/qy3pvY2dPLUBIIOpyZP1Qph:7o0i90TIc4UJSpvLWdQZ3pvtdPw2IOpD
TLSH
T18CC5332336C4D7FAC425513068654926AAB4BC3F0B6486DFF329732E4F7D2969D3930A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery floxif persistence privilege_escalation trojan upx

Malware Config

Signatures

Family: Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
backdoor trojan floxif

Detects Floxif payload 1 IoCs

backdoor

resource	yara_rule
behavioral1/files/0x0008000000021709-1.dat	floxif

Custom signature

UPX dump on OEP (original entry point) 7 IoCs

resource	yara_rule
behavioral1/files/0x0008000000021709-1.dat	UPX
behavioral1/memory/4540-3-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral1/memory/4540-92-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral1/memory/4540-99-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral1/memory/4540-102-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral1/memory/4540-104-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral1/memory/4540-114-0x0000000010000000-0x0000000010030000-memory.dmp	UPX

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x0008000000021709-1.dat	acprotect

Executes dropped EXE 3 IoCs

pid	Process
4812	usb-redirector-customer-module-gui.exe
5660	usbredirectortechcsrv.exe
3932	ttechpnptls.sys

Loads dropped DLL 1 IoCs

pid	Process
4540	2026-11-09_fe57f82654d6cac6b045ba352c985560_elex_floxif_redline-stealer_rhadamanthys_stop_tofsee.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\e:	2026-11-09_fe57f82654d6cac6b045ba352c985560_elex_floxif_redline-stealer_rhadamanthys_stop_tofsee.exe

Drops file in System32 directory 16 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\Temp\{e89aa26f-92bc-8841-a802-52180fe3c956}\SET9D16.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{e89aa26f-92bc-8841-a802-52180fe3c956}\amd64\ttechusbd.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\ttechusbd.inf_amd64_883118eaf0a296fc\ttechusbd.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{e89aa26f-92bc-8841-a802-52180fe3c956}\amd64	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{e89aa26f-92bc-8841-a802-52180fe3c956}	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\ttechusbd.inf_amd64_883118eaf0a296fc\ttechusbd.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{e89aa26f-92bc-8841-a802-52180fe3c956}\SET9D16.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{e89aa26f-92bc-8841-a802-52180fe3c956}\SET9D26.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{e89aa26f-92bc-8841-a802-52180fe3c956}\amd64\SET9D27.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{e89aa26f-92bc-8841-a802-52180fe3c956}\amd64\SET9D27.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\ttechusbd.inf_amd64_883118eaf0a296fc\amd64\ttechusbd.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{e89aa26f-92bc-8841-a802-52180fe3c956}\ttechusbd.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{e89aa26f-92bc-8841-a802-52180fe3c956}\SET9D26.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{e89aa26f-92bc-8841-a802-52180fe3c956}\ttechusbd.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0008000000021709-1.dat	upx
behavioral1/memory/4540-3-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/4540-92-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/4540-99-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/4540-102-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/4540-104-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/4540-114-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	\??\c:\program files\common files\system\symsrv.dll.000	2026-11-09_fe57f82654d6cac6b045ba352c985560_elex_floxif_redline-stealer_rhadamanthys_stop_tofsee.exe
File created	C:\Program Files\Common Files\System\symsrv.dll	2026-11-09_fe57f82654d6cac6b045ba352c985560_elex_floxif_redline-stealer_rhadamanthys_stop_tofsee.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.dev.log	usb-redirector-customer-module-gui.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\inf\oem3.inf	DrvInst.exe
File created	C:\Windows\inf\oem3.inf	DrvInst.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-09_fe57f82654d6cac6b045ba352c985560_elex_floxif_redline-stealer_rhadamanthys_stop_tofsee.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-09_fe57f82654d6cac6b045ba352c985560_elex_floxif_redline-stealer_rhadamanthys_stop_tofsee.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-09_fe57f82654d6cac6b045ba352c985560_elex_floxif_redline-stealer_rhadamanthys_stop_tofsee.exe

Checks SCSI registry key(s) 3 TTPs 26 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4540	2026-11-09_fe57f82654d6cac6b045ba352c985560_elex_floxif_redline-stealer_rhadamanthys_stop_tofsee.exe
4540	2026-11-09_fe57f82654d6cac6b045ba352c985560_elex_floxif_redline-stealer_rhadamanthys_stop_tofsee.exe
4540	2026-11-09_fe57f82654d6cac6b045ba352c985560_elex_floxif_redline-stealer_rhadamanthys_stop_tofsee.exe
4540	2026-11-09_fe57f82654d6cac6b045ba352c985560_elex_floxif_redline-stealer_rhadamanthys_stop_tofsee.exe
4540	2026-11-09_fe57f82654d6cac6b045ba352c985560_elex_floxif_redline-stealer_rhadamanthys_stop_tofsee.exe
4540	2026-11-09_fe57f82654d6cac6b045ba352c985560_elex_floxif_redline-stealer_rhadamanthys_stop_tofsee.exe
4540	2026-11-09_fe57f82654d6cac6b045ba352c985560_elex_floxif_redline-stealer_rhadamanthys_stop_tofsee.exe
4540	2026-11-09_fe57f82654d6cac6b045ba352c985560_elex_floxif_redline-stealer_rhadamanthys_stop_tofsee.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
652	Process not Found

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4540	2026-11-09_fe57f82654d6cac6b045ba352c985560_elex_floxif_redline-stealer_rhadamanthys_stop_tofsee.exe
Token: SeAuditPrivilege	5760	svchost.exe
Token: SeSecurityPrivilege	5760	svchost.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4812	usb-redirector-customer-module-gui.exe
4812	usb-redirector-customer-module-gui.exe
4812	usb-redirector-customer-module-gui.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4540 wrote to memory of 4812	4540	2026-11-09_fe57f82654d6cac6b045ba352c985560_elex_floxif_redline-stealer_rhadamanthys_stop_tofsee.exe	85
PID 5760 wrote to memory of 712	5760	svchost.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-11-09_fe57f82654d6cac6b045ba352c985560_elex_floxif_redline-stealer_rhadamanthys_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-09_fe57f82654d6cac6b045ba352c985560_elex_floxif_redline-stealer_rhadamanthys_stop_tofsee.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4540
- C:\Users\Admin\AppData\Local\Temp\cf1424a72a8f6285ce68f31b31db1fd5\usb-redirector-customer-module-gui.exe
  "C:\Users\Admin\AppData\Local\Temp\cf1424a72a8f6285ce68f31b31db1fd5\usb-redirector-customer-module-gui.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  PID:4812

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5760
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{2792f9aa-cba3-ba4f-89ad-ee5b1f644ba9}\ttechusbd.inf" "9" "42387a80b" "0000000000000138" "WinSta0\Default" "0000000000000150" "208" "C:\Users\Admin\AppData\Local\Temp\cf1424a72a8f6285ce68f31b31db1fd5"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:712

C:\Users\Admin\AppData\Local\Temp\cf1424a72a8f6285ce68f31b31db1fd5\usbredirectortechcsrv.exe
C:\Users\Admin\AppData\Local\Temp\cf1424a72a8f6285ce68f31b31db1fd5\usbredirectortechcsrv.exe
1⤵
- Executes dropped EXE
PID:5660

C:\Users\Admin\AppData\Local\Temp\cf1424a72a8f6285ce68f31b31db1fd5\amd64\ttechpnptls.sys
C:\Users\Admin\AppData\Local\Temp\cf1424a72a8f6285ce68f31b31db1fd5\amd64\ttechpnptls.sys
1⤵
- Executes dropped EXE
PID:3932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

symsrv.dll

Path C:\Program Files\Common Files\System\symsrv.dll
Size 67KB
SHA256 de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
MD5 7574cf2c64f35161ab1292e2f532aabf
SHA1 14ba3fa927a06224dfe587014299e834def4644f
SHA512 4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
SSDEEP 1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZL:c8y93KQjy7G55riF1cMo03V
TLSH
T17863F1372AB5807DDD210D37949F835AB771E5A76C20643FC25907D988B8DD0E3239AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

symsrv.dll.000

Path C:\Program Files\Common Files\System\symsrv.dll.000
Size 114B
SHA256 aefc503b1ed462d7b6280228a7b5b710792273b78934426f88325341ac5b5a92
MD5 e609411db8aa6775d0344c75c23ae79b
SHA1 1d2ff6194bf159ce36cd0461cd3da29486d1e97d
SHA512 6884ff5c07bc687132c965a59cb8c5a898a25da74c6c846c1d6089ddca8007cb7e4d2f8520bdce9fbcf6e2f9c9e5c28d8c8d6d049d3522470bdc7d38bbfa0ad0
TLSH
T1FFB09262AA2791EAE1AA224505A0248C1ED0B62AB48638002EBA5A4E93256A85916147
MD5 SHA1 SHA512 TLSH

Submit Download

TTECHU~1.CAT

Path C:\Users\Admin\AppData\Local\Temp\CF1424~1\TTECHU~1.CAT
Size 11KB
SHA256 6e9ee89f3528fac6343e12dd172db8be6fc075f595e5f47cd208ecc8700683c8
MD5 54e55f7fa5338fcedcd4f7ad582a53b2
SHA1 e64aa6853d19b0b6f2117d1944f660a82dd387ae
SHA512 7377e956710378c43fbf4cb4e03b1e1dceb285c4968c3b6682c65168e14dd541319080c6e42877dcbe97ae7086697c4562056ea08d51161af0e675b5beae3c23
SSDEEP 192:ICMYCKyfJCYi39JnxrEwJqKkhYCcIhNMmuSdXqnajoy:SL4JxXxkh3c7gXlsy
TLSH
T1063208A288A80087EA637C7057E8F9577D3E73CB685001AD256FF7AA1C967C1F70422D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ttechusbd.sys

Path C:\Users\Admin\AppData\Local\Temp\CF1424~1\amd64\ttechusbd.sys
Size 48KB
SHA256 1373d3d69644d95c16cf2f1f17cb637a9bf9f6eb1b681e37913f69b15bb46680
MD5 5f0645bec453f758d2899142a7901826
SHA1 3fb96e79b57074ee9f518fdacf25debf359ee4d4
SHA512 dcb375faea6c41432ef055e8c15b82cb422125e6a54dae1c8011abb33d8200e87549ad7ef5f2c7604a7012560889474032c4fc90af2ea607ba4216d0c1fd596c
SSDEEP 768:E+yRcHOi5gcgnpXlt2MP7u83pso4CLk9yPnagjjTBP2DGloewnCQd8i7YzEX4ZXJ:E+xZgnHikqCT3BP6ewnCQV8QX0Ov61
TLSH
T147336B9653F8144AF5E3D479EAA5DA47EBB17482174147CF0260D3891F23BE1DA3A334
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ttechpnptls.sys

Path C:\Users\Admin\AppData\Local\Temp\cf1424a72a8f6285ce68f31b31db1fd5\amd64\ttechpnptls.sys
Size 56KB
SHA256 0f4e0f179692911469d2c390feb5e7e83da4d318689688f9d532b718ae952f0d
MD5 026b8f00614d208f2d3d4f6cffbc4631
SHA1 8aca4bd5d03de64624f5f5dfd89c5ab710282add
SHA512 4a1abe2292ca92ade2454d4380e40657c4ad1868dabef393a73795d0314e9472d78aa0d87e5e46ead942d678571ced6cb6ef21dee370ad91a9c512d914293465
SSDEEP 768:ZLY9miwoyUs7UWJNjm0zJ3fxzG1b3NF/XQwtInaGAzEy9ZbBKUBe3frd7dAsbyKo:ZLum5oyMyGB1qWKljdxX3v6kY
TLSH
T17B435BEA93B9108CE876D6B8C7F8DA17EEB2B8055B1416DF0364D6552F137E0A338364
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ttechusbd.inf

Path C:\Users\Admin\AppData\Local\Temp\cf1424a72a8f6285ce68f31b31db1fd5\ttechusbd.inf
Size 2KB
SHA256 793e8e83b4d363c6336f663733f80be980c7051b7c7c18a984afc12ce1f92903
MD5 34a0faa3da3bf4ee2e21632098cdfadf
SHA1 701814a1b91d941e5f5aeff15b87772d259198b2
SHA512 e93f9edd29dceb2ec6a232a83e4125bde5c351f1f7fc7bc80a348f96785361a69915c89b041fb8a957bd1143defae8723a7902a76106baea48832988422d4b0f
TLSH
T18F41DD217DC3FBB4CC57E1EB1AD64C92E92BD17000AC1908B0A1F8C259DEEA5532F06E
MD5 SHA1 SHA512 TLSH

Submit Download

usb-redirector-customer-module-gui.exe

Path C:\Users\Admin\AppData\Local\Temp\cf1424a72a8f6285ce68f31b31db1fd5\usb-redirector-customer-module-gui.exe
Size 1.6MB
SHA256 130db293d102235ce86d68c5d987be2e4d937ed0fecde928bf913f7fd570801d
MD5 16687b591dbd936314c1eb20d61b76c4
SHA1 80005e4b41733df5e580e1b34c3d20f9ee6e2f4c
SHA512 137902cbb22b0985ce9a300cc6edb5a0d4079b0fdf0c2794146b84d03ad4458442b01638212232c526414d031eefeec4b272ff0b680c0dd5fa70817e3c202dd6
SSDEEP 24576:IL6ekIsS9Nx9T6kok1ZZFr9Ha8q5GQQpfnmcUsRxPW:IL66XTP95QQnRw
TLSH
T136759D75F2958CA0E1B594348463DAC2D2207CB19B6487DF520ABEB62E7F7D11E3A703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usbredirectortechcsrv.exe

Path C:\Users\Admin\AppData\Local\Temp\cf1424a72a8f6285ce68f31b31db1fd5\usbredirectortechcsrv.exe
Size 848KB
SHA256 77d4f1f024e936401d9f48a2612bd1f2d8de6042c7399dec64405e1ea4b9f7e9
MD5 70498399217e10ca91819b1e4c409bc0
SHA1 314dc0eefeb6e356573c69f89d58fea111526e9f
SHA512 4276c7de8e338d056367f75910c3594ac4f45ae34370255798f60f968160c1e54780ecacad32e31a314b16e2c22cb5f58b88568818ffa0db63719f00a5da5c60
SSDEEP 24576:Mqn9hxqmfNWNCd047bG3fZzvMl330mzv4vTaer:Mqn9emfM0y3RzvMl330gHE
TLSH
T143058D1AFA6583F2D096C03D86A29617F5707849D734CADB0781AB772FA37D0963A730
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3932-90-0x0000000000010000-0x0000000000020000-memory.dmp

Download

memory/4540-6-0x00000000008D1000-0x00000000008D2000-memory.dmp

Download

memory/4540-92-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/4540-93-0x00000000008D0000-0x000000000091B000-memory.dmp

Download

memory/4540-3-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/4540-99-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/4540-102-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/4540-104-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/4540-114-0x0000000010000000-0x0000000010030000-memory.dmp

Download