File name:

2025-05-18_631481fece22761593b48b6e54cb1808_darkgate_elex_floxif_mafia

Full analysis: https://app.any.run/tasks/2978dad6-48a6-49f7-9a0c-e2983399b42f
Verdict: Malicious activity
Threats:

A backdoor is a type of cybersecurity threat that allows attackers to secretly compromise a system and conduct malicious activities, such as stealing data and modifying files. Backdoors can be difficult to detect, as they often use legitimate system applications to evade defense mechanisms. Threat actors often utilize special malware, such as PlugX, to establish backdoors on target devices.

Malware Trends Tracker     >>>
Analysis date: May 18, 2025, 13:04:34
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
floxif
backdoor
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

631481FECE22761593B48B6E54CB1808

SHA1:

A5B02344C72F20E8690960BBFC382083BE35EFCC

SHA256:

701625BDAA1719FF60E0FECE241650C5CED67C86EAE2A98A5C01F7482DFFE6E9

SSDEEP:

98304:sW+NK5y/12GGLdnHGEznxVV0+lKAJmyoumGAO6c9GYH5pqPme2Xdm/f2Q0AwoUl/:T2k

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • 2025-05-18_631481fece22761593b48b6e54cb1808_darkgate_elex_floxif_mafia.exe (PID: 2108)

    • FLOXIF mutex has been found

      • 2025-05-18_631481fece22761593b48b6e54cb1808_darkgate_elex_floxif_mafia.exe (PID: 2108)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • 2025-05-18_631481fece22761593b48b6e54cb1808_darkgate_elex_floxif_mafia.exe (PID: 2108)

    • Executable content was dropped or overwritten

      • 2025-05-18_631481fece22761593b48b6e54cb1808_darkgate_elex_floxif_mafia.exe (PID: 2108)

    • Executes application which crashes

      • 2025-05-18_631481fece22761593b48b6e54cb1808_darkgate_elex_floxif_mafia.exe (PID: 2108)

  • INFO

    • Create files in a temporary directory

      • 2025-05-18_631481fece22761593b48b6e54cb1808_darkgate_elex_floxif_mafia.exe (PID: 2108)

    • Failed to create an executable file in Windows directory

      • 2025-05-18_631481fece22761593b48b6e54cb1808_darkgate_elex_floxif_mafia.exe (PID: 2108)

    • The sample compiled with english language support

      • 2025-05-18_631481fece22761593b48b6e54cb1808_darkgate_elex_floxif_mafia.exe (PID: 2108)

    • Reads the computer name

      • 2025-05-18_631481fece22761593b48b6e54cb1808_darkgate_elex_floxif_mafia.exe (PID: 2108)

    • Checks supported languages

      • 2025-05-18_631481fece22761593b48b6e54cb1808_darkgate_elex_floxif_mafia.exe (PID: 2108)

    • Reads the software policy settings

      • slui.exe (PID: 5680)

    • Checks proxy server information

      • slui.exe (PID: 5680)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2012:10:10 13:25:06+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 10
CodeSize: 1852416
InitializedDataSize: 664064
UninitializedDataSize: -
EntryPoint: 0x1496c5
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 1.1.3.18
ProductVersionNumber: 1.1.3.18
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Driver
FileSubtype: 11
LanguageCode: Unknown (0009)
CharacterSet: Unicode
CompanyName: Google Inc.
FileDescription: Google Input Tools
FileVersion: 1.1.3.18
LegalCopyright: Copyright (C) 2012
ProductName: Google Input Tools
ProductVersion: 1.1.3.18
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
128
Monitored processes
5
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #FLOXIF 2025-05-18_631481fece22761593b48b6e54cb1808_darkgate_elex_floxif_mafia.exe werfault.exe no specs werfault.exe no specs werfault.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
1280C:\WINDOWS\SysWOW64\WerFault.exe -u -p 2108 -s 956C:\Windows\SysWOW64\WerFault.exe—2025-05-18_631481fece22761593b48b6e54cb1808_darkgate_elex_floxif_mafia.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
2108"C:\Users\admin\Desktop\2025-05-18_631481fece22761593b48b6e54cb1808_darkgate_elex_floxif_mafia.exe" C:\Users\admin\Desktop\2025-05-18_631481fece22761593b48b6e54cb1808_darkgate_elex_floxif_mafia.exe
explorer.exe
User:
admin
Company:
Google Inc.
Integrity Level:
MEDIUM
Description:
Google Input Tools
Exit code:
3221225477
Version:
1.1.3.18
Modules
Images
c:\users\admin\desktop\2025-05-18_631481fece22761593b48b6e54cb1808_darkgate_elex_floxif_mafia.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
4120C:\WINDOWS\SysWOW64\WerFault.exe -u -p 2108 -s 996C:\Windows\SysWOW64\WerFault.exe—2025-05-18_631481fece22761593b48b6e54cb1808_darkgate_elex_floxif_mafia.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
4812C:\WINDOWS\SysWOW64\WerFault.exe -u -p 2108 -s 868C:\Windows\SysWOW64\WerFault.exe—2025-05-18_631481fece22761593b48b6e54cb1808_darkgate_elex_floxif_mafia.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
5680C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
4 362
Read events
4 362
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
21082025-05-18_631481fece22761593b48b6e54cb1808_darkgate_elex_floxif_mafia.exeC:\Users\admin\AppData\Local\Temp\conres.dllexecutable
MD5:7574CF2C64F35161AB1292E2F532AABF
SHA256:DE055A89DE246E629A8694BDE18AF2B1605E4B9B493C7E4AEF669DD67ACF5085
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
20
DNS requests
6
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2136
slui.exe
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5680
slui.exe
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
google.com
  • 172.217.18.14
whitelisted
com.google.input_tools.skinui
  • —
unknown
com.google.input_tools.keyboard_input
  • —
unknown
com.google.input_tools.input_method_switch
  • —
unknown
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
2025-05-18_631481fece22761593b48b6e54cb1808_darkgate_elex_floxif_mafia