File name:	2025-05-16_341727f24e1c7c50aaf4ac68fded6c2e_bkransomware_darkgate_elex_floxif
Full analysis:	https://app.any.run/tasks/85ae902d-607f-455f-82db-5a8298c52a36
Verdict:	Malicious activity
Threats:	A backdoor is a type of cybersecurity threat that allows attackers to secretly compromise a system and conduct malicious activities, such as stealing data and modifying files. Backdoors can be difficult to detect, as they often use legitimate system applications to evade defense mechanisms. Threat actors often utilize special malware, such as PlugX, to establish backdoors on target devices. Malware Trends Tracker >>>
Analysis date:	May 16, 2025, 13:26:46
OS:	Windows 10 Professional (build: 19044, 64 bit)
Tags:	floxif backdoor
Indicators:
MIME:	application/vnd.microsoft.portable-executable
File info:	PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:	341727F24E1C7C50AAF4AC68FDED6C2E
SHA1:	373261721B9FCA4E42278F9C6A05DC39D2FD0AB2
SHA256:	CB19A94B500BA64AF88A15D42B62EFC80903DD530B720318D3D830C209B49CBF
SSDEEP:	98304:iJMuOYGsg9aFGF2Nv5SQ6i0A5vxlCX2aiE5o:CR

.exe	\|	Win64 Executable (generic) (64.6)
.dll	\|	Win32 Dynamic Link Library (generic) (15.4)
.exe	\|	Win32 Executable (generic) (10.5)
.exe	\|	Generic Win/DOS Executable (4.6)
.exe	\|	DOS Executable Generic (4.6)

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	2015:04:09 07:25:45+00:00
ImageFileCharacteristics:	Executable, 32-bit
PEType:	PE32
LinkerVersion:	12
CodeSize:	1402368
InitializedDataSize:	563712
UninitializedDataSize:	-
EntryPoint:	0x1263ac
OSVersion:	5.1
ImageVersion:	-
SubsystemVersion:	5.1
Subsystem:	Windows GUI
FileVersionNumber:	35.0.61.54677
ProductVersionNumber:	35.0.61.54677
FileFlagsMask:	0x003f
FileFlags:	(none)
FileOS:	Windows 32-bit
ObjectFileType:	Executable application
FileSubtype:	-
LanguageCode:	English (U.S.)
CharacterSet:	Windows, Latin1
Comments:	USBSetupLauncher.exe
OriginalFileName:	USBSetupLauncher.exe
InternalName:	USBSetupLauncher
CompanyName:	Hewlett-Packard Development Company, LP
LegalCopyright:	Copyright (C) Hewlett-Packard Co. 2014
LegalTrademarks:	-
FileDescription:	USBSetupLauncher.exe
FileVersion:	35.0.61.54677
ProductName:	HP Digital Imaging
ProductVersion:	035.000.061.54677
ProductFamily:	HP Digital Imaging
ProductFileFlags:	1


(PID) Process:	(7652) 2025-05-16_341727f24e1c7c50aaf4ac68fded6c2e_bkransomware_darkgate_elex_floxif.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:	write	Name:	CachePrefix
Value:
(PID) Process:	(7652) 2025-05-16_341727f24e1c7c50aaf4ac68fded6c2e_bkransomware_darkgate_elex_floxif.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:	write	Name:	CachePrefix
Value: Cookie:
(PID) Process:	(7652) 2025-05-16_341727f24e1c7c50aaf4ac68fded6c2e_bkransomware_darkgate_elex_floxif.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:	write	Name:	CachePrefix
Value: Visited:

PID	Process	Filename		Type
7652	2025-05-16_341727f24e1c7c50aaf4ac68fded6c2e_bkransomware_darkgate_elex_floxif.exe	C:\Users\admin\AppData\Local\Temp\conres.dll		executable
		MD5:7574CF2C64F35161AB1292E2F532AABF	SHA256:DE055A89DE246E629A8694BDE18AF2B1605E4B9B493C7E4AEF669DD67ACF5085
7652	2025-05-16_341727f24e1c7c50aaf4ac68fded6c2e_bkransomware_darkgate_elex_floxif.exe	C:\Users\admin\AppData\Local\Temp\conres.dll.000		text
		MD5:1130C911BF5DB4B8F7CF9B6F4B457623	SHA256:EBA08CC8182F379392A97F542B350EA0DBBE5E4009472F35AF20E3D857EAFDF1

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
2104	svchost.exe	GET	200	2.16.164.120:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
2104	svchost.exe	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
7652	2025-05-16_341727f24e1c7c50aaf4ac68fded6c2e_bkransomware_darkgate_elex_floxif.exe	GET	403	45.56.79.23:80	http://www.aieov.com/logo.gif	unknown	—	—	malicious
5376	SIHClient.exe	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl	unknown	—	—	whitelisted
5376	SIHClient.exe	GET	200	2.16.164.120:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl	unknown	—	—	whitelisted
5376	SIHClient.exe	GET	200	2.16.164.120:80	http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl	unknown	—	—	whitelisted
5376	SIHClient.exe	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl	unknown	—	—	whitelisted
5376	SIHClient.exe	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.1.crl	unknown	—	—	whitelisted
5376	SIHClient.exe	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.2.crl	unknown	—	—	whitelisted
5376	SIHClient.exe	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.2.crl	unknown	—	—	whitelisted

PID	Process	IP	Domain	ASN	CN	Reputation
—	—	51.104.136.2:443	—	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4	System	192.168.100.255:137	—	—	—	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
2104	svchost.exe	2.16.164.120:80	crl.microsoft.com	Akamai International B.V.	NL	whitelisted
2104	svchost.exe	95.101.149.131:80	www.microsoft.com	Akamai International B.V.	NL	whitelisted
—	—	172.211.123.249:443	client.wns.windows.com	MICROSOFT-CORP-MSN-AS-BLOCK	FR	whitelisted
—	—	20.190.160.128:443	login.live.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
6544	svchost.exe	20.190.160.128:443	login.live.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
7652	2025-05-16_341727f24e1c7c50aaf4ac68fded6c2e_bkransomware_darkgate_elex_floxif.exe	45.56.79.23:80	www.aieov.com	Linode, LLC	US	malicious
2104	svchost.exe	4.231.128.59:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted

Domain	IP	Reputation
google.com	142.250.186.78	whitelisted
crl.microsoft.com	2.16.164.120 2.16.164.49	whitelisted
www.microsoft.com	95.101.149.131	whitelisted
client.wns.windows.com	172.211.123.249 172.211.123.248	whitelisted
login.live.com	20.190.160.128 40.126.32.76 20.190.160.65 20.190.160.4 40.126.32.134 40.126.32.140 40.126.32.138 20.190.160.64	whitelisted
5isohu.com	—	whitelisted
www.aieov.com	45.56.79.23 45.33.20.235 45.33.23.183 96.126.123.244 45.79.19.196 45.33.2.79 72.14.178.174 72.14.185.43 45.33.18.44 45.33.30.197 173.255.194.134 198.58.118.167	malicious
settings-win.data.microsoft.com	4.231.128.59 20.73.194.208	whitelisted
slscr.update.microsoft.com	52.149.20.212	whitelisted
fe3cr.delivery.mp.microsoft.com	13.85.23.206	whitelisted

General Info

2025-05-16_341727f24e1c7c50aaf4ac68fded6c2e_bkransomware_darkgate_elex_floxif

341727F24E1C7C50AAF4AC68FDED6C2E

373261721B9FCA4E42278F9C6A05DC39D2FD0AB2

CB19A94B500BA64AF88A15D42B62EFC80903DD530B720318D3D830C209B49CBF

98304:iJMuOYGsg9aFGF2Nv5SQ6i0A5vxlCX2aiE5o:CR

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

Executing a file with an untrusted certificate

FLOXIF mutex has been found

Connects to the CnC server

SUSPICIOUS

Process drops legitimate windows executable

Executable content was dropped or overwritten

Reads security settings of Internet Explorer

Contacting a server suspected of hosting an CnC

INFO

The sample compiled with english language support

Failed to create an executable file in Windows directory

Reads the computer name

Checks supported languages

Checks proxy server information

Create files in a temporary directory

Reads the software policy settings

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings