Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20250502-en -
resource tags
arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system -
submitted
02/07/2025, 18:51
Static task
static1
Behavioral task
behavioral1
Sample
2025-07-02_b0e7146be2b1ec74bde1e0a887f1c6f6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Resource
win10v2004-20250502-en
General
-
Target
2025-07-02_b0e7146be2b1ec74bde1e0a887f1c6f6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
-
Size
361KB
-
MD5
b0e7146be2b1ec74bde1e0a887f1c6f6
-
SHA1
3b8faf0fd6e06e5ad6f0946f4a0545642a9fd9a8
-
SHA256
d1a4559eec6b6424ac638a9756c15b4fbfd436ee9f64b757f4ecc20417138611
-
SHA512
9f6fd60ad43b0cdfc736925b3c740064cb7551ea8cd8527f2771a8ed1651f50a15bc6e691f00d87daa204f80b5d2c5430f72fb1e2eac6e275090acb3c3a0ffe3
-
SSDEEP
6144:DflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:DflfAsiVGjSGecvX
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4200 wrojhbztrmgeywro.exe 956 CreateProcess.exe 2964 eywrojhbzt.exe 412 CreateProcess.exe 2196 CreateProcess.exe 4456 i_eywrojhbzt.exe 4692 CreateProcess.exe 4612 igbytrljdb.exe 4800 CreateProcess.exe 4640 CreateProcess.exe 4904 i_igbytrljdb.exe 4816 CreateProcess.exe 4836 lgdyvqoiga.exe 1220 CreateProcess.exe 3352 CreateProcess.exe 920 i_lgdyvqoiga.exe 4740 CreateProcess.exe 5084 aysqlidbvt.exe 5544 CreateProcess.exe 5900 CreateProcess.exe 1964 i_aysqlidbvt.exe 3936 CreateProcess.exe 1188 vpnhfaxsqk.exe 5052 CreateProcess.exe 4416 CreateProcess.exe 2120 i_vpnhfaxsqk.exe 5424 CreateProcess.exe 3612 pkicausmkf.exe 2292 CreateProcess.exe 2344 CreateProcess.exe 4288 i_pkicausmkf.exe 5752 CreateProcess.exe 5008 pmhfzxrpkh.exe 2804 CreateProcess.exe 5612 CreateProcess.exe 2240 i_pmhfzxrpkh.exe 5488 CreateProcess.exe 6080 mhezxrpjhb.exe 3968 CreateProcess.exe 5860 CreateProcess.exe 1680 i_mhezxrpjhb.exe 1464 CreateProcess.exe 2032 gbztrljecw.exe 5476 CreateProcess.exe 5724 CreateProcess.exe 2756 i_gbztrljecw.exe 3880 CreateProcess.exe 5408 bztrljdbwt.exe 5760 CreateProcess.exe 3716 CreateProcess.exe 2200 i_bztrljdbwt.exe 5692 CreateProcess.exe 4088 gaytqljdbv.exe 4312 CreateProcess.exe 5960 CreateProcess.exe 396 i_gaytqljdbv.exe 5904 CreateProcess.exe 3100 aysqkidavt.exe 5264 CreateProcess.exe 2348 CreateProcess.exe 3876 i_aysqkidavt.exe 3092 CreateProcess.exe 1644 avsnlfdxvp.exe 4048 CreateProcess.exe -
System Location Discovery: System Language Discovery 1 TTPs 44 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aysqkidavt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wrojhbztrmgeywro.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language eywrojhbzt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language i_lgdyvqoiga.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language i_bztrljdbwt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lgdyvqoiga.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mhezxrpjhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language i_gbztrljecw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ztrmjecwuo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gbztrljecw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bztrljdbwt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language i_aysqkidavt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cxrpjhbzur.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ywqoigbytr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language i_igbytrljdb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language i_pkicausmkf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gaytqljdbv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bztrmjebwu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language i_vpnhfaxsqk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language i_eywrojhbzt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language i_aysqlidbvt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pmhfzxrpkh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ytqljdbvtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language i_ytqljdbvtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpnhfaxsqk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language i_mhezxrpjhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language i_gaytqljdbv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avsnlfdxvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language faxsqkausm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language i_faxsqkausm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language i_fzxspkicau.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-07-02_b0e7146be2b1ec74bde1e0a887f1c6f6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CreateProcess.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igbytrljdb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language i_avsnlfdxvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language i_cxrpjhbzur.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language i_ztrmjecwuo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language i_bztrmjebwu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language i_ywqoigbytr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aysqlidbvt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pkicausmkf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language i_pmhfzxrpkh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fzxspkicau.exe -
Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
pid Process 4820 ipconfig.exe 6100 ipconfig.exe 1996 ipconfig.exe 4860 ipconfig.exe 4240 ipconfig.exe 5140 ipconfig.exe 5996 ipconfig.exe 4736 ipconfig.exe 5700 ipconfig.exe 1608 ipconfig.exe 1440 ipconfig.exe 5812 ipconfig.exe 1880 ipconfig.exe 1312 ipconfig.exe 5064 ipconfig.exe 3044 ipconfig.exe 2536 ipconfig.exe 4912 ipconfig.exe 1564 ipconfig.exe 5840 ipconfig.exe -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1612392875" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31189890" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008b4d6c6a63510c4b93a77972e799f59b000000000200000000001066000000010000200000003f32c3ac7ec9757c9af7edb40d9ae84623e96f9f12a05ca2668c327c9d11816c000000000e800000000200002000000045d1a052ca5fe9f6fa8e9527a463714c33f010dd7bd7a7a0571b189b9eb1b2cf200000008712b8947bbe750ba8fd651d783f88551bbdb73d571a2c566aef4b68b75dca33400000008866fca3996a101edc4f09e8833061cf7e6db7decd1d7fce6eb5c9dc807f00fc28c666d8273e22731c2127e8476bb0114c73b3f92234284987c6074ae9a340b2 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1615518177" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "458247256" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008b4d6c6a63510c4b93a77972e799f59b000000000200000000001066000000010000200000005da6d9f063eab4ee3200d336ee827635f9f03a91517035cc3f93498d2cd4fe73000000000e800000000200002000000003e76347ca5c638ab9e5c09610b3119ea5e28ff0a548969d57efb1e7e7917cff20000000d76619e6e6fcd870cf91a7fe5cb8d109e22297be4a696d087859b23072df927240000000698c5d338305eb4cf45729c737a93a7ffe4dee538eb272ae03588389a6748332b6c4602426c7483f49c84262446fbeb8dca923f7efebd163063fd050a131fc0e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50288b6082ebdb01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{8B9E8A9B-5775-11F0-AF61-F2717F61EF81} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31189890" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 4054926082ebdb01 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3160 2025-07-02_b0e7146be2b1ec74bde1e0a887f1c6f6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 3160 2025-07-02_b0e7146be2b1ec74bde1e0a887f1c6f6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 3160 2025-07-02_b0e7146be2b1ec74bde1e0a887f1c6f6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 3160 2025-07-02_b0e7146be2b1ec74bde1e0a887f1c6f6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 3160 2025-07-02_b0e7146be2b1ec74bde1e0a887f1c6f6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 3160 2025-07-02_b0e7146be2b1ec74bde1e0a887f1c6f6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 3160 2025-07-02_b0e7146be2b1ec74bde1e0a887f1c6f6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 3160 2025-07-02_b0e7146be2b1ec74bde1e0a887f1c6f6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 3160 2025-07-02_b0e7146be2b1ec74bde1e0a887f1c6f6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 3160 2025-07-02_b0e7146be2b1ec74bde1e0a887f1c6f6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 3160 2025-07-02_b0e7146be2b1ec74bde1e0a887f1c6f6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 3160 2025-07-02_b0e7146be2b1ec74bde1e0a887f1c6f6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 3160 2025-07-02_b0e7146be2b1ec74bde1e0a887f1c6f6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 3160 2025-07-02_b0e7146be2b1ec74bde1e0a887f1c6f6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 3160 2025-07-02_b0e7146be2b1ec74bde1e0a887f1c6f6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 3160 2025-07-02_b0e7146be2b1ec74bde1e0a887f1c6f6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 3160 2025-07-02_b0e7146be2b1ec74bde1e0a887f1c6f6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 3160 2025-07-02_b0e7146be2b1ec74bde1e0a887f1c6f6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 3160 2025-07-02_b0e7146be2b1ec74bde1e0a887f1c6f6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 3160 2025-07-02_b0e7146be2b1ec74bde1e0a887f1c6f6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 3160 2025-07-02_b0e7146be2b1ec74bde1e0a887f1c6f6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 3160 2025-07-02_b0e7146be2b1ec74bde1e0a887f1c6f6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 3160 2025-07-02_b0e7146be2b1ec74bde1e0a887f1c6f6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 3160 2025-07-02_b0e7146be2b1ec74bde1e0a887f1c6f6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 3160 2025-07-02_b0e7146be2b1ec74bde1e0a887f1c6f6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 3160 2025-07-02_b0e7146be2b1ec74bde1e0a887f1c6f6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 3160 2025-07-02_b0e7146be2b1ec74bde1e0a887f1c6f6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 3160 2025-07-02_b0e7146be2b1ec74bde1e0a887f1c6f6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 3160 2025-07-02_b0e7146be2b1ec74bde1e0a887f1c6f6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 3160 2025-07-02_b0e7146be2b1ec74bde1e0a887f1c6f6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 4200 wrojhbztrmgeywro.exe 3160 2025-07-02_b0e7146be2b1ec74bde1e0a887f1c6f6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 3160 2025-07-02_b0e7146be2b1ec74bde1e0a887f1c6f6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 4200 wrojhbztrmgeywro.exe 3160 2025-07-02_b0e7146be2b1ec74bde1e0a887f1c6f6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 4200 wrojhbztrmgeywro.exe 4200 wrojhbztrmgeywro.exe 3160 2025-07-02_b0e7146be2b1ec74bde1e0a887f1c6f6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 4200 wrojhbztrmgeywro.exe 3160 2025-07-02_b0e7146be2b1ec74bde1e0a887f1c6f6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 4200 wrojhbztrmgeywro.exe 3160 2025-07-02_b0e7146be2b1ec74bde1e0a887f1c6f6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 4200 wrojhbztrmgeywro.exe 3160 2025-07-02_b0e7146be2b1ec74bde1e0a887f1c6f6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 4200 wrojhbztrmgeywro.exe 3160 2025-07-02_b0e7146be2b1ec74bde1e0a887f1c6f6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 3160 2025-07-02_b0e7146be2b1ec74bde1e0a887f1c6f6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 4200 wrojhbztrmgeywro.exe 4200 wrojhbztrmgeywro.exe 3160 2025-07-02_b0e7146be2b1ec74bde1e0a887f1c6f6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 4200 wrojhbztrmgeywro.exe 3160 2025-07-02_b0e7146be2b1ec74bde1e0a887f1c6f6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 3160 2025-07-02_b0e7146be2b1ec74bde1e0a887f1c6f6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 4200 wrojhbztrmgeywro.exe 4200 wrojhbztrmgeywro.exe 3160 2025-07-02_b0e7146be2b1ec74bde1e0a887f1c6f6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 4200 wrojhbztrmgeywro.exe 3160 2025-07-02_b0e7146be2b1ec74bde1e0a887f1c6f6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 3160 2025-07-02_b0e7146be2b1ec74bde1e0a887f1c6f6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 3160 2025-07-02_b0e7146be2b1ec74bde1e0a887f1c6f6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 3160 2025-07-02_b0e7146be2b1ec74bde1e0a887f1c6f6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 3160 2025-07-02_b0e7146be2b1ec74bde1e0a887f1c6f6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 3160 2025-07-02_b0e7146be2b1ec74bde1e0a887f1c6f6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 3160 2025-07-02_b0e7146be2b1ec74bde1e0a887f1c6f6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe -
Suspicious behavior: LoadsDriver 20 IoCs
pid Process 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found -
Suspicious use of AdjustPrivilegeToken 20 IoCs
description pid Process Token: SeDebugPrivilege 4456 i_eywrojhbzt.exe Token: SeDebugPrivilege 4904 i_igbytrljdb.exe Token: SeDebugPrivilege 920 i_lgdyvqoiga.exe Token: SeDebugPrivilege 1964 i_aysqlidbvt.exe Token: SeDebugPrivilege 2120 i_vpnhfaxsqk.exe Token: SeDebugPrivilege 4288 i_pkicausmkf.exe Token: SeDebugPrivilege 2240 i_pmhfzxrpkh.exe Token: SeDebugPrivilege 1680 i_mhezxrpjhb.exe Token: SeDebugPrivilege 2756 i_gbztrljecw.exe Token: SeDebugPrivilege 2200 i_bztrljdbwt.exe Token: SeDebugPrivilege 396 i_gaytqljdbv.exe Token: SeDebugPrivilege 3876 i_aysqkidavt.exe Token: SeDebugPrivilege 1660 i_avsnlfdxvp.exe Token: SeDebugPrivilege 2028 i_faxsqkausm.exe Token: SeDebugPrivilege 5452 i_fzxspkicau.exe Token: SeDebugPrivilege 4748 i_cxrpjhbzur.exe Token: SeDebugPrivilege 5084 i_ztrmjecwuo.exe Token: SeDebugPrivilege 1964 i_bztrmjebwu.exe Token: SeDebugPrivilege 4400 i_ywqoigbytr.exe Token: SeDebugPrivilege 5652 i_ytqljdbvtn.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 372 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 372 iexplore.exe 372 iexplore.exe 5248 IEXPLORE.EXE 5248 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3160 wrote to memory of 4200 3160 2025-07-02_b0e7146be2b1ec74bde1e0a887f1c6f6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 84 PID 3160 wrote to memory of 4200 3160 2025-07-02_b0e7146be2b1ec74bde1e0a887f1c6f6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 84 PID 3160 wrote to memory of 4200 3160 2025-07-02_b0e7146be2b1ec74bde1e0a887f1c6f6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 84 PID 3160 wrote to memory of 372 3160 2025-07-02_b0e7146be2b1ec74bde1e0a887f1c6f6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 85 PID 3160 wrote to memory of 372 3160 2025-07-02_b0e7146be2b1ec74bde1e0a887f1c6f6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 85 PID 372 wrote to memory of 5248 372 iexplore.exe 86 PID 372 wrote to memory of 5248 372 iexplore.exe 86 PID 372 wrote to memory of 5248 372 iexplore.exe 86 PID 4200 wrote to memory of 956 4200 wrojhbztrmgeywro.exe 87 PID 4200 wrote to memory of 956 4200 wrojhbztrmgeywro.exe 87 PID 4200 wrote to memory of 956 4200 wrojhbztrmgeywro.exe 87 PID 2964 wrote to memory of 412 2964 eywrojhbzt.exe 90 PID 2964 wrote to memory of 412 2964 eywrojhbzt.exe 90 PID 2964 wrote to memory of 412 2964 eywrojhbzt.exe 90 PID 4200 wrote to memory of 2196 4200 wrojhbztrmgeywro.exe 93 PID 4200 wrote to memory of 2196 4200 wrojhbztrmgeywro.exe 93 PID 4200 wrote to memory of 2196 4200 wrojhbztrmgeywro.exe 93 PID 4200 wrote to memory of 4692 4200 wrojhbztrmgeywro.exe 99 PID 4200 wrote to memory of 4692 4200 wrojhbztrmgeywro.exe 99 PID 4200 wrote to memory of 4692 4200 wrojhbztrmgeywro.exe 99 PID 4612 wrote to memory of 4800 4612 igbytrljdb.exe 101 PID 4612 wrote to memory of 4800 4612 igbytrljdb.exe 101 PID 4612 wrote to memory of 4800 4612 igbytrljdb.exe 101 PID 4200 wrote to memory of 4640 4200 wrojhbztrmgeywro.exe 104 PID 4200 wrote to memory of 4640 4200 wrojhbztrmgeywro.exe 104 PID 4200 wrote to memory of 4640 4200 wrojhbztrmgeywro.exe 104 PID 4200 wrote to memory of 4816 4200 wrojhbztrmgeywro.exe 109 PID 4200 wrote to memory of 4816 4200 wrojhbztrmgeywro.exe 109 PID 4200 wrote to memory of 4816 4200 wrojhbztrmgeywro.exe 109 PID 4836 wrote to memory of 1220 4836 lgdyvqoiga.exe 111 PID 4836 wrote to memory of 1220 4836 lgdyvqoiga.exe 111 PID 4836 wrote to memory of 1220 4836 lgdyvqoiga.exe 111 PID 4200 wrote to memory of 3352 4200 wrojhbztrmgeywro.exe 114 PID 4200 wrote to memory of 3352 4200 wrojhbztrmgeywro.exe 114 PID 4200 wrote to memory of 3352 4200 wrojhbztrmgeywro.exe 114 PID 4200 wrote to memory of 4740 4200 wrojhbztrmgeywro.exe 116 PID 4200 wrote to memory of 4740 4200 wrojhbztrmgeywro.exe 116 PID 4200 wrote to memory of 4740 4200 wrojhbztrmgeywro.exe 116 PID 5084 wrote to memory of 5544 5084 aysqlidbvt.exe 118 PID 5084 wrote to memory of 5544 5084 aysqlidbvt.exe 118 PID 5084 wrote to memory of 5544 5084 aysqlidbvt.exe 118 PID 4200 wrote to memory of 5900 4200 wrojhbztrmgeywro.exe 122 PID 4200 wrote to memory of 5900 4200 wrojhbztrmgeywro.exe 122 PID 4200 wrote to memory of 5900 4200 wrojhbztrmgeywro.exe 122 PID 4200 wrote to memory of 3936 4200 wrojhbztrmgeywro.exe 125 PID 4200 wrote to memory of 3936 4200 wrojhbztrmgeywro.exe 125 PID 4200 wrote to memory of 3936 4200 wrojhbztrmgeywro.exe 125 PID 1188 wrote to memory of 5052 1188 vpnhfaxsqk.exe 127 PID 1188 wrote to memory of 5052 1188 vpnhfaxsqk.exe 127 PID 1188 wrote to memory of 5052 1188 vpnhfaxsqk.exe 127 PID 4200 wrote to memory of 4416 4200 wrojhbztrmgeywro.exe 130 PID 4200 wrote to memory of 4416 4200 wrojhbztrmgeywro.exe 130 PID 4200 wrote to memory of 4416 4200 wrojhbztrmgeywro.exe 130 PID 4200 wrote to memory of 5424 4200 wrojhbztrmgeywro.exe 132 PID 4200 wrote to memory of 5424 4200 wrojhbztrmgeywro.exe 132 PID 4200 wrote to memory of 5424 4200 wrojhbztrmgeywro.exe 132 PID 3612 wrote to memory of 2292 3612 pkicausmkf.exe 134 PID 3612 wrote to memory of 2292 3612 pkicausmkf.exe 134 PID 3612 wrote to memory of 2292 3612 pkicausmkf.exe 134 PID 4200 wrote to memory of 2344 4200 wrojhbztrmgeywro.exe 137 PID 4200 wrote to memory of 2344 4200 wrojhbztrmgeywro.exe 137 PID 4200 wrote to memory of 2344 4200 wrojhbztrmgeywro.exe 137 PID 4200 wrote to memory of 5752 4200 wrojhbztrmgeywro.exe 139 PID 4200 wrote to memory of 5752 4200 wrojhbztrmgeywro.exe 139
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-07-02_b0e7146be2b1ec74bde1e0a887f1c6f6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2025-07-02_b0e7146be2b1ec74bde1e0a887f1c6f6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Temp\wrojhbztrmgeywro.exeC:\Temp\wrojhbztrmgeywro.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\eywrojhbzt.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:956 -
C:\Temp\eywrojhbzt.exeC:\Temp\eywrojhbzt.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
PID:412 -
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
PID:3044
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_eywrojhbzt.exe ups_ins3⤵
- Executes dropped EXE
PID:2196 -
C:\Temp\i_eywrojhbzt.exeC:\Temp\i_eywrojhbzt.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4456
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\igbytrljdb.exe ups_run3⤵
- Executes dropped EXE
PID:4692 -
C:\Temp\igbytrljdb.exeC:\Temp\igbytrljdb.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
PID:4800 -
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
PID:4820
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_igbytrljdb.exe ups_ins3⤵
- Executes dropped EXE
PID:4640 -
C:\Temp\i_igbytrljdb.exeC:\Temp\i_igbytrljdb.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4904
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lgdyvqoiga.exe ups_run3⤵
- Executes dropped EXE
PID:4816 -
C:\Temp\lgdyvqoiga.exeC:\Temp\lgdyvqoiga.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
PID:1220 -
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
PID:6100
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_lgdyvqoiga.exe ups_ins3⤵
- Executes dropped EXE
PID:3352 -
C:\Temp\i_lgdyvqoiga.exeC:\Temp\i_lgdyvqoiga.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:920
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\aysqlidbvt.exe ups_run3⤵
- Executes dropped EXE
PID:4740 -
C:\Temp\aysqlidbvt.exeC:\Temp\aysqlidbvt.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
PID:5544 -
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
PID:1440
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_aysqlidbvt.exe ups_ins3⤵
- Executes dropped EXE
PID:5900 -
C:\Temp\i_aysqlidbvt.exeC:\Temp\i_aysqlidbvt.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1964
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vpnhfaxsqk.exe ups_run3⤵
- Executes dropped EXE
PID:3936 -
C:\Temp\vpnhfaxsqk.exeC:\Temp\vpnhfaxsqk.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
PID:5052 -
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
PID:5140
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vpnhfaxsqk.exe ups_ins3⤵
- Executes dropped EXE
PID:4416 -
C:\Temp\i_vpnhfaxsqk.exeC:\Temp\i_vpnhfaxsqk.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2120
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pkicausmkf.exe ups_run3⤵
- Executes dropped EXE
PID:5424 -
C:\Temp\pkicausmkf.exeC:\Temp\pkicausmkf.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
PID:2292 -
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
PID:5812
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pkicausmkf.exe ups_ins3⤵
- Executes dropped EXE
PID:2344 -
C:\Temp\i_pkicausmkf.exeC:\Temp\i_pkicausmkf.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4288
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pmhfzxrpkh.exe ups_run3⤵
- Executes dropped EXE
PID:5752 -
C:\Temp\pmhfzxrpkh.exeC:\Temp\pmhfzxrpkh.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5008 -
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
PID:2804 -
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
PID:2536
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pmhfzxrpkh.exe ups_ins3⤵
- Executes dropped EXE
PID:5612 -
C:\Temp\i_pmhfzxrpkh.exeC:\Temp\i_pmhfzxrpkh.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2240
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mhezxrpjhb.exe ups_run3⤵
- Executes dropped EXE
PID:5488 -
C:\Temp\mhezxrpjhb.exeC:\Temp\mhezxrpjhb.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6080 -
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
PID:3968 -
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
PID:5996
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mhezxrpjhb.exe ups_ins3⤵
- Executes dropped EXE
PID:5860 -
C:\Temp\i_mhezxrpjhb.exeC:\Temp\i_mhezxrpjhb.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1680
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gbztrljecw.exe ups_run3⤵
- Executes dropped EXE
PID:1464 -
C:\Temp\gbztrljecw.exeC:\Temp\gbztrljecw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2032 -
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
PID:5476 -
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
PID:1880
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gbztrljecw.exe ups_ins3⤵
- Executes dropped EXE
PID:5724 -
C:\Temp\i_gbztrljecw.exeC:\Temp\i_gbztrljecw.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2756
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bztrljdbwt.exe ups_run3⤵
- Executes dropped EXE
PID:3880 -
C:\Temp\bztrljdbwt.exeC:\Temp\bztrljdbwt.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5408 -
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
PID:5760 -
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
PID:1996
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bztrljdbwt.exe ups_ins3⤵
- Executes dropped EXE
PID:3716 -
C:\Temp\i_bztrljdbwt.exeC:\Temp\i_bztrljdbwt.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2200
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gaytqljdbv.exe ups_run3⤵
- Executes dropped EXE
PID:5692 -
C:\Temp\gaytqljdbv.exeC:\Temp\gaytqljdbv.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4088 -
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
PID:4312 -
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
PID:4736
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gaytqljdbv.exe ups_ins3⤵
- Executes dropped EXE
PID:5960 -
C:\Temp\i_gaytqljdbv.exeC:\Temp\i_gaytqljdbv.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:396
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\aysqkidavt.exe ups_run3⤵
- Executes dropped EXE
PID:5904 -
C:\Temp\aysqkidavt.exeC:\Temp\aysqkidavt.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3100 -
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
PID:5264 -
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
PID:1312
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_aysqkidavt.exe ups_ins3⤵
- Executes dropped EXE
PID:2348 -
C:\Temp\i_aysqkidavt.exeC:\Temp\i_aysqkidavt.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3876
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\avsnlfdxvp.exe ups_run3⤵
- Executes dropped EXE
PID:3092 -
C:\Temp\avsnlfdxvp.exeC:\Temp\avsnlfdxvp.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1644 -
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
PID:4048 -
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
PID:5700
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_avsnlfdxvp.exe ups_ins3⤵PID:5232
-
C:\Temp\i_avsnlfdxvp.exeC:\Temp\i_avsnlfdxvp.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1660
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\faxsqkausm.exe ups_run3⤵PID:4784
-
C:\Temp\faxsqkausm.exeC:\Temp\faxsqkausm.exe ups_run4⤵
- System Location Discovery: System Language Discovery
PID:4908 -
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵PID:4732
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
PID:5064
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_faxsqkausm.exe ups_ins3⤵PID:2920
-
C:\Temp\i_faxsqkausm.exeC:\Temp\i_faxsqkausm.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2028
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fzxspkicau.exe ups_run3⤵PID:5764
-
C:\Temp\fzxspkicau.exeC:\Temp\fzxspkicau.exe ups_run4⤵
- System Location Discovery: System Language Discovery
PID:316 -
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵PID:3548
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
PID:4860
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fzxspkicau.exe ups_ins3⤵PID:3944
-
C:\Temp\i_fzxspkicau.exeC:\Temp\i_fzxspkicau.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5452
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\cxrpjhbzur.exe ups_run3⤵PID:5304
-
C:\Temp\cxrpjhbzur.exeC:\Temp\cxrpjhbzur.exe ups_run4⤵
- System Location Discovery: System Language Discovery
PID:944 -
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵PID:4968
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
PID:4912
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_cxrpjhbzur.exe ups_ins3⤵PID:3964
-
C:\Temp\i_cxrpjhbzur.exeC:\Temp\i_cxrpjhbzur.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4748
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ztrmjecwuo.exe ups_run3⤵PID:5324
-
C:\Temp\ztrmjecwuo.exeC:\Temp\ztrmjecwuo.exe ups_run4⤵
- System Location Discovery: System Language Discovery
PID:1480 -
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵PID:3928
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
PID:1608
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ztrmjecwuo.exe ups_ins3⤵PID:5544
-
C:\Temp\i_ztrmjecwuo.exeC:\Temp\i_ztrmjecwuo.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5084
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bztrmjebwu.exe ups_run3⤵PID:5592
-
C:\Temp\bztrmjebwu.exeC:\Temp\bztrmjebwu.exe ups_run4⤵
- System Location Discovery: System Language Discovery
PID:5200 -
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵PID:4460
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
PID:1564
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bztrmjebwu.exe ups_ins3⤵PID:1512
-
C:\Temp\i_bztrmjebwu.exeC:\Temp\i_bztrmjebwu.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1964
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ywqoigbytr.exe ups_run3⤵PID:1804
-
C:\Temp\ywqoigbytr.exeC:\Temp\ywqoigbytr.exe ups_run4⤵
- System Location Discovery: System Language Discovery
PID:3744 -
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵PID:744
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
PID:4240
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ywqoigbytr.exe ups_ins3⤵PID:876
-
C:\Temp\i_ywqoigbytr.exeC:\Temp\i_ywqoigbytr.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4400
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ytqljdbvtn.exe ups_run3⤵PID:2292
-
C:\Temp\ytqljdbvtn.exeC:\Temp\ytqljdbvtn.exe ups_run4⤵
- System Location Discovery: System Language Discovery
PID:3612 -
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵PID:5424
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
PID:5840
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ytqljdbvtn.exe ups_ins3⤵PID:4468
-
C:\Temp\i_ytqljdbvtn.exeC:\Temp\i_ytqljdbvtn.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5652
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:372 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:372 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:5248
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5b9c28e970fee764c12d78c39f5b77866
SHA1acdc2001b5e5cf7683ed449e68b0d6d5f9473b0c
SHA25659676b6b0ecba89ac6810fc513621bd6976b806a32c6397e080042f57b985df4
SHA5120c49c81f093acd62c01e9aa0074e5b4de29775a150fd6bd08c32c2a6b22d46e54eccff7f23e5b789847b85fe410897f68a8e0e2f8b1375db302f476a3cc601bf
-
Filesize
361KB
MD5183047f7977762e7a63898593af4312a
SHA178f0e158e522b7acd1500df2c5d9bcdcc9251317
SHA256c482737e0e0a5bd0b0c0e43ba7afde40c96915b880a0f4d20d996a0a45f5dd79
SHA512d0d4390a2b876d19cf1ff9efeae66c7d6eaefd534a8a471594f6af169a6d7f2c3b3ab171b2bef5dca490b9d617d52c019d6354e50c7eb609d876ba852a180bc1
-
Filesize
361KB
MD5ce35793d291eb266d8f1cc25a193f22d
SHA111dd21f8985e5d6b6fc9374c2375a36077e8149f
SHA2568abccb4ac6bc537c520803afa5cfbd50be54b50b738da727fe4b033616a2eb2e
SHA51262aa03168bc10f66228fb31cc803fd70288904277f285ba72212096376d09827eabe91360cf0a4920b8a4e71e1ff4e496f92f2b26cd28b8fa98ce7b765f742e7
-
Filesize
361KB
MD5867e4bdcaa68912bc8e45819722464f3
SHA18d3886ce8f2e51b19019ddaf94f138d38eb1bb3b
SHA256c4fe4cdba89ede66889b63c0fba00b8e1b35f1da39ed9eec126d278d48bd4219
SHA512d89b11d9dd4d5c2f64d85281531859c82a7e5e6c26d7253cc56420eedfe3b7fbc7dd3aa1c1f851c10b0ee83c1f6b310eeb58b022ab5762f2448191068b60a9f7
-
Filesize
361KB
MD55504c2bfd9683bae93048be37cd7d48b
SHA1df359deda6316ed49e152f7269451351b2235749
SHA25671b7a000c6130735d624ae39f6957543bc64299126e928b8cdf03ceebb1f1d62
SHA512e939c81684370feba8d0212aa60af492c3b1f85fb80e2d3fd843965db7fb430dca5625dae970b93ec3f5d27f4f09fd449576b2661fafe8c33837c7d336ee176e
-
Filesize
361KB
MD52aee25658f0a0ccf5e21fe5016700f54
SHA12f591b70eeffb6ecd27bbbfe7386cd62930564d4
SHA256c6d982bf1f21f86c6348a2eeb9d2fc9d0393d7db22c76a6dad1ff72a1baa22bc
SHA51260545e81ba587ce157841dca60511a9eb87f4406605ec45bcbe37339f9f3488adf18fcc833482387a698ed340a201acdde860fc2c9020ecc3c05ba51f49840f4
-
Filesize
361KB
MD50cda26f46226e5e10c0bd5876a4ac77a
SHA1ac9887392dde3d9178ad712d5bdd97f5ee35f388
SHA256a23335c71afa48085a57909ec69db5aeab596b6a24ab3289de26ae75f9eff234
SHA5127c186199b0b77b7fe0647629209d140076fe20389061ecee7e8a0677ebf56254eebfcd9128366811e1947cd19e3b040e353f37210d458bb0f46f66fdeceaf1bd
-
Filesize
361KB
MD5bfcb0890a6c13d6ada5bd63db12c9e06
SHA16a7db7c0405ec30b966a3dab56e360e475327f44
SHA2568d5706231afaf0a190c7eed139b94e00325d36879808bbda2e885dd4100f227a
SHA5122a7c141d91a14260f0bf6fec2facfc4aad0d0e39c5856df156d9bc1a714725d12d9aa7610b254b5bea4133912723f5765b4f50b9e9a7196d92648c3a19406a6e
-
Filesize
361KB
MD58c9101a8fb76fcd05538db747ff63d9b
SHA1332a85a252453bbcf84388fd06442be65a9cc467
SHA256ca850a78cd5a4861102661b0ff02bb04c8afddd94bc3c30ffdc363a52eb8fae3
SHA5123852bff9e07f659f25965ca16667bcee2fcc9600edfd49691676e788308def32220b578b0ed7c59e46da557596c405597565939d3c05711006cabe9fb966b55a
-
Filesize
361KB
MD5b641c698958e9f331ff0528338dfcea8
SHA1d0f6789da8bcefd009b7d4fa21b2026eaf9f1c02
SHA256a7a8d409c46df04e3b755324dcbb51edd495c494146936a723336a88b993f5f8
SHA512123d3c851d09b71b73e08944678a4cf88336fb194945d8390fef536ba45e67eac4b0444ff28a7b630663818b907b4bb04c2ae206251ef6dff8719eda3405b570
-
Filesize
361KB
MD56ecf9786cb3a59ab58eba6264e242b2f
SHA1138ad592ead9067cb0b66c71810b008e15b6af13
SHA2562b0458e86f0e7344ff13dd9a04c92fcd972535118532e0e21b62eb5481b92539
SHA512741bfb91a5a136e464c389105b83b90cc5ed615c45dbe5a7b17b3ff0cc0dbeccd2606e0f541dd45fef1c1d468cfd71f7e283710d33b801d372cbc369a3eff57d
-
Filesize
361KB
MD51de5c4b77c53667b8a19a48cbaf4fd8d
SHA13feab0ea6fe4f559c522ae410a80e53cfd6f59b2
SHA25637a609b0c9e9567bd599e3e26f16a9388c1a2e9c02ef0b11a3fb6cd20190fe97
SHA512d2d11ac777c3d48bc74b6da74dfac1e6f91d51eb9e349fe28d5dd230a25ab8562eb81e0ea13b02cd76bb746eb676971ded36e549987e756757c37a5b21ad69f3
-
Filesize
361KB
MD5857f72821023358a520c815ab1867a26
SHA1475cee414ea29e1220e5b19e2ba657a5b3cebed9
SHA256655f600a3b9de693dd0d5a6cc528fe69a1fe0bfd44f838b207c33c392b879a3a
SHA512c8a1bc2e099e38f66238bc404ba02e441ce95faeb2ae265a25db6a31e487a22782fa26fa5722362df64fee20b6a7f83c37ebdb23363e08ce03e15e8de2a89c23
-
Filesize
361KB
MD57d7c0e672369f57b2f8a8d2e1166995f
SHA133acc6fc746ef7f8912d29f79f47a28496f7d04e
SHA2567abea7de5b13eaf49c0703b38c452af4a5b85279536dabf49a6d2aed2017cab9
SHA512f1155328dd509d281f580d56c6ecf4f464d76e5b29c022151a58c0cd41ce11e0adc47922e02fa5c440f57ddf397cd7391aa1031a7821dcc0be5995b58b4b8012
-
Filesize
361KB
MD5fc9c5f24281554755f1587d072317c9d
SHA1e62e7d1a404a5a696685959e10755a6141ad08cf
SHA2562dc6ac01bd8a882134525ab736232fcf49c218eacb285102ad4b015bef717973
SHA51208efbc3ba6eb4ef2afef564e6d4241068e090b322ce92bc7a9942a19b2a93eae94fbb717a87599a91e52a2e3a5e2e14dfb9978679d0e265123136607bedc8a05
-
Filesize
361KB
MD5b689936fd1fa150f7beab4e6ef0b7ca2
SHA1f7d14d986b501a5eaed490a0842e184eae4c42ba
SHA256195895b156a06bd83c04181247aacb9a4fc0eeea3cce2f6cdef4398a9732b0d7
SHA512f78a3216626f01f710e5736beee0fc5042a2716bbe08b22dd5fec158427efc738ec862ade46edbceab7802ab0ae8b02789c74b50cb34c7b08991c50b0011a05b
-
Filesize
361KB
MD555ee0d73ff218c49d715dff586c256bc
SHA164749c339943f1460582efc27930c15919f287c5
SHA2562c043e56b7fe97919486fdbf51290cf9ac0daf31fbb4b372201b4f381940d293
SHA51295b89d87b95736d7ce366d7659dfb506d615adb74e6aa9656b077d54de9c8c24a4ed555626efa5d8b08f67a3de8c0759196a0d7448ff6ee014119ce055ef1dc5
-
Filesize
361KB
MD501dbb726b27d84bcc623a219f3e8270a
SHA17233ea637fb046ae928afd628a536864fe0d602c
SHA256330e3562f2e690da6c0796a8ced06a52d7eaadc9528a23753adead78e215f713
SHA51218aecafeffff6caded5f0320594e01b93306409813f7ca363dd1fe5cf5eba2743869b4b59d426f079e1e8a04fa011122b0a448c0bc18c039ec528c26c4d00c66
-
Filesize
361KB
MD54d64ae23460f70aeb72336b63b01dd65
SHA1ebea4ce55fe184536958979b7e6a15a18a39c545
SHA2561a70a0db74f9bc334a90aca872544ae9eb488cc2ea247737ad7d2eca4320b27b
SHA512a0d9973a31b4940b7b59c23a24c50e6ee2477aa2bce3437359da603bc0c2a35ba606cef05487f44dada2efba3829afe5a34f09a25ad4f2f79c5e476fec36a589
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_9F6005AF34C7906F717D420F892FD6D0
Filesize471B
MD56fa63488caea8b3594fea115df3be326
SHA1c3e7561107396a1178e0d032e55da05ecc81ecd4
SHA2563b67d81ecd4a7d8e6cf9c0aac3216b42673664287e2b126f46f33c11404ff975
SHA512f1d1f0c27ec78458c1cfe994bd51fd2da4dc4a69196dba788cd7987041a7c6c3b8a51f94d84cfb498700c543f54eeae74ccef3c9c839d3a1b648e00e54e0cb62
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_9F6005AF34C7906F717D420F892FD6D0
Filesize400B
MD5c6a2875bdd658411aeccde29fc2f6def
SHA1aab39bb49982acc74fc803f3fe9c4084535430d9
SHA25611e674e3bd7407d36f333ddc16b1ff86a89d0128f4bbe658ac803cfaed6c05f9
SHA512b8889a25a1f78f4c4f4429832024d0be489491144f87407e745031922d86f5f68e670f94f2f9c9cc57c8afb0a09bb0e91b3a33971162d0c0987139b4998033c6
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee