Analysis
- max time kernel
149s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
15/04/2026, 22:29
General
- Target 2026-04-15_ad938d013a1c9ee7ab758858e5bd6689_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
- Size 291KB
- Sample260415-2d8e2abs4k
- SHA256 c9220ffbf4a4e6c1b78466e9377f4811e67fa6e8e47854374f51f3ae08b22bfe
Malware Config
Extracted
-
systex
-
http://xytets.com:2345/t.asp?os=wangba8102
-
http://xytets.com:2345/ll/out.txt
-
http://xytets.com:2345/t.asp?os=home8102
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- UPX dump on OEP (original entry point) 64 IoCs
- Executes dropped EXE 64 IoCs
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- System Location Discovery: System Language Discovery 1 TTPs 44 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 54 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious use of AdjustPrivilegeToken 20 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SetWindowsHookEx 10 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_ad938d013a1c9ee7ab758858e5bd6689_coinminer_elex_redline-stealer_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-15_ad938d013a1c9ee7ab758858e5bd6689_coinminer_elex_redline-stealer_rhadamanthys_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home81022⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3684 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1748 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\rpkhcausnh.exe ups_run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\rpkhcausnh.exeC:\Temp\rpkhcausnh.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_rpkhcausnh.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_rpkhcausnh.exeC:\Temp\i_rpkhcausnh.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ztrmjecwuo.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\ztrmjecwuo.exeC:\Temp\ztrmjecwuo.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ztrmjecwuo.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_ztrmjecwuo.exeC:\Temp\i_ztrmjecwuo.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ywrojhbztr.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\ywrojhbztr.exeC:\Temp\ywrojhbztr.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ywrojhbztr.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_ywrojhbztr.exeC:\Temp\i_ywrojhbztr.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ytrljdbvto.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\ytrljdbvto.exeC:\Temp\ytrljdbvto.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ytrljdbvto.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_ytrljdbvto.exeC:\Temp\i_ytrljdbvto.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\dbvtolgeyw.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\dbvtolgeyw.exeC:\Temp\dbvtolgeyw.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_dbvtolgeyw.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_dbvtolgeyw.exeC:\Temp\i_dbvtolgeyw.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\vtnlfdxvqn.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\vtnlfdxvqn.exeC:\Temp\vtnlfdxvqn.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_vtnlfdxvqn.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_vtnlfdxvqn.exeC:\Temp\i_vtnlfdxvqn.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\pnifaysqki.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\pnifaysqki.exeC:\Temp\pnifaysqki.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_pnifaysqki.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_pnifaysqki.exeC:\Temp\i_pnifaysqki.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\nhcausmkfc.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\nhcausmkfc.exeC:\Temp\nhcausmkfc.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_nhcausmkfc.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_nhcausmkfc.exeC:\Temp\i_nhcausmkfc.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\smkfcxvpnh.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\smkfcxvpnh.exeC:\Temp\smkfcxvpnh.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_smkfcxvpnh.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_smkfcxvpnh.exeC:\Temp\i_smkfcxvpnh.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\jhczurmkec.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\jhczurmkec.exeC:\Temp\jhczurmkec.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_jhczurmkec.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_jhczurmkec.exeC:\Temp\i_jhczurmkec.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ebwuomhezw.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\ebwuomhezw.exeC:\Temp\ebwuomhezw.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ebwuomhezw.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_ebwuomhezw.exeC:\Temp\i_ebwuomhezw.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\bwtolgeywq.exe ups_run2⤵
-
C:\Temp\bwtolgeywq.exeC:\Temp\bwtolgeywq.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_bwtolgeywq.exe ups_ins2⤵
-
C:\Temp\i_bwtolgeywq.exeC:\Temp\i_bwtolgeywq.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\eytrljdbvt.exe ups_run2⤵
-
C:\Temp\eytrljdbvt.exeC:\Temp\eytrljdbvt.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_eytrljdbvt.exe ups_ins2⤵
-
C:\Temp\i_eytrljdbvt.exeC:\Temp\i_eytrljdbvt.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\vtnlgdywqo.exe ups_run2⤵
-
C:\Temp\vtnlgdywqo.exeC:\Temp\vtnlgdywqo.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_vtnlgdywqo.exe ups_ins2⤵
-
C:\Temp\i_vtnlgdywqo.exeC:\Temp\i_vtnlgdywqo.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\qkidavsnlf.exe ups_run2⤵
-
C:\Temp\qkidavsnlf.exeC:\Temp\qkidavsnlf.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_qkidavsnlf.exe ups_ins2⤵
-
C:\Temp\i_qkidavsnlf.exeC:\Temp\i_qkidavsnlf.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\kicausnkfd.exe ups_run2⤵
-
C:\Temp\kicausnkfd.exeC:\Temp\kicausnkfd.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_kicausnkfd.exe ups_ins2⤵
-
C:\Temp\i_kicausnkfd.exeC:\Temp\i_kicausnkfd.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\pkicausmkf.exe ups_run2⤵
-
C:\Temp\pkicausmkf.exeC:\Temp\pkicausmkf.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_pkicausmkf.exe ups_ins2⤵
-
C:\Temp\i_pkicausmkf.exeC:\Temp\i_pkicausmkf.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\mhfzxrpkhc.exe ups_run2⤵
-
C:\Temp\mhfzxrpkhc.exeC:\Temp\mhfzxrpkhc.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_mhfzxrpkhc.exe ups_ins2⤵
-
C:\Temp\i_mhfzxrpkhc.exeC:\Temp\i_mhfzxrpkhc.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\kecwuomhez.exe ups_run2⤵
-
C:\Temp\kecwuomhez.exeC:\Temp\kecwuomhez.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_kecwuomhez.exe ups_ins2⤵
-
C:\Temp\i_kecwuomhez.exeC:\Temp\i_kecwuomhez.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\dbwtomgeyw.exe ups_run2⤵
-
C:\Temp\dbwtomgeyw.exeC:\Temp\dbwtomgeyw.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_dbwtomgeyw.exe ups_ins2⤵
-
C:\Temp\i_dbwtomgeyw.exeC:\Temp\i_dbwtomgeyw.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Temp\kecwuomhez.sysC:\Temp\kecwuomhez.sys1⤵
- Executes dropped EXE
-
C:\Temp\jebwuomgez.sysC:\Temp\jebwuomgez.sys1⤵
- Executes dropped EXE
-
C:\Temp\omgeywrojg.sysC:\Temp\omgeywrojg.sys1⤵
- Executes dropped EXE
-
C:\Temp\oigbytqljd.sysC:\Temp\oigbytqljd.sys1⤵
- Executes dropped EXE
-
C:\Temp\faysqlidbv.sysC:\Temp\faysqlidbv.sys1⤵
- Executes dropped EXE
-
C:\Temp\avtnlfdxvq.sysC:\Temp\avtnlfdxvq.sys1⤵
- Executes dropped EXE
-
C:\Temp\cavsnlfdxv.sysC:\Temp\cavsnlfdxv.sys1⤵
- Executes dropped EXE
-
C:\Temp\ausmkecxup.sysC:\Temp\ausmkecxup.sys1⤵
- Executes dropped EXE
-
C:\Temp\usmkecxupm.sysC:\Temp\usmkecxupm.sys1⤵
- Executes dropped EXE
-
C:\Temp\rmhezwrpjh.sysC:\Temp\rmhezwrpjh.sys1⤵
- Executes dropped EXE
-
C:\Temp\uojhbztrlj.sysC:\Temp\uojhbztrlj.sys1⤵
-
C:\Temp\ljdbwtomge.sysC:\Temp\ljdbwtomge.sys1⤵
-
C:\Temp\gdywqoigay.sysC:\Temp\gdywqoigay.sys1⤵
-
C:\Temp\avtnlfdyvq.sysC:\Temp\avtnlfdyvq.sys1⤵
-
C:\Temp\davtnlfdxv.sysC:\Temp\davtnlfdxv.sys1⤵
-
C:\Temp\ausnkfdxvp.sysC:\Temp\ausnkfdxvp.sys1⤵
-
C:\Temp\usmkecxupn.sysC:\Temp\usmkecxupn.sys1⤵
-
C:\Temp\rmjecwuomg.sysC:\Temp\rmjecwuomg.sys1⤵
-
C:\Temp\wrpjhbztrm.sysC:\Temp\wrpjhbztrm.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
avtnlfdxvq.sys
cavsnlfdxv.sys
dbvtolgeyw.exe
faysqlidbv.sys
i_dbvtolgeyw.exe
i_pnifaysqki.exe
i_rpkhcausnh.exe
i_vtnlfdxvqn.exe
i_ytrljdbvto.exe
i_ywrojhbztr.exe
i_ztrmjecwuo.exe
jebwuomgez.sys
kecwuomhez.sys
nhcausmkfc.exe
oigbytqljd.sys
omgeywrojg.sys
pnifaysqki.exe
rpkhcausnh.exe
vtnlfdxvqn.exe
ytrljdbvto.exe
ywrojhbztr.exe
ztrmjecwuo.exe
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
RecoveryStore.{85EBC8FE-391A-11F1-9D89-FE9584C87747}.dat
RecoveryStore.{85EE2B42-391A-11F1-9D89-FE9584C87747}.dat
suggestions[1].en-US
CP.exe
memory/220-93-0x0000000000F80000-0x0000000000FCB000-memory.dmp
memory/220-96-0x0000000000F80000-0x0000000000FCB000-memory.dmp
memory/512-21-0x0000000000F00000-0x0000000000F4B000-memory.dmp
memory/512-218-0x0000000000E40000-0x0000000000E8B000-memory.dmp
memory/512-216-0x0000000000E40000-0x0000000000E8B000-memory.dmp
memory/512-24-0x0000000000F00000-0x0000000000F4B000-memory.dmp
memory/748-214-0x0000000000110000-0x000000000015B000-memory.dmp
memory/748-213-0x0000000000110000-0x000000000015B000-memory.dmp
memory/1020-14-0x0000000000560000-0x00000000005AB000-memory.dmp
memory/1020-17-0x0000000000560000-0x00000000005AB000-memory.dmp
memory/1152-202-0x00000000004E0000-0x000000000052B000-memory.dmp
memory/1152-200-0x00000000004E0000-0x000000000052B000-memory.dmp
memory/1192-227-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1272-162-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1504-38-0x0000000000270000-0x00000000002BB000-memory.dmp
memory/1504-41-0x0000000000270000-0x00000000002BB000-memory.dmp
memory/1904-27-0x0000000000C10000-0x0000000000C5B000-memory.dmp
memory/1904-0-0x0000000000C10000-0x0000000000C5B000-memory.dmp
memory/1944-237-0x00000000005F0000-0x000000000063B000-memory.dmp
memory/1944-238-0x00000000005F0000-0x000000000063B000-memory.dmp
memory/1976-240-0x0000000000C80000-0x0000000000CCB000-memory.dmp
memory/1980-110-0x0000000000800000-0x000000000084B000-memory.dmp
memory/1980-112-0x0000000000800000-0x000000000084B000-memory.dmp
memory/2216-119-0x0000000000F80000-0x0000000000FCB000-memory.dmp
memory/2216-121-0x0000000000F80000-0x0000000000FCB000-memory.dmp
memory/2284-174-0x00000000004C0000-0x000000000050B000-memory.dmp
memory/2284-173-0x00000000004C0000-0x000000000050B000-memory.dmp
memory/2424-198-0x0000000000AF0000-0x0000000000B3B000-memory.dmp
memory/2424-197-0x0000000000AF0000-0x0000000000B3B000-memory.dmp
memory/2492-114-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2572-34-0x0000000000210000-0x000000000025B000-memory.dmp
memory/2572-31-0x0000000000210000-0x000000000025B000-memory.dmp
memory/2836-146-0x00000000000A0000-0x00000000000EB000-memory.dmp
memory/2836-161-0x00000000000A0000-0x00000000000EB000-memory.dmp
memory/2896-26-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2992-235-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3004-195-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3044-205-0x0000000000070000-0x00000000000BB000-memory.dmp
memory/3044-206-0x0000000000070000-0x00000000000BB000-memory.dmp
memory/3048-128-0x0000000000710000-0x000000000075B000-memory.dmp
memory/3048-126-0x0000000000710000-0x000000000075B000-memory.dmp
memory/3076-50-0x0000000000B80000-0x0000000000BCB000-memory.dmp
memory/3076-47-0x0000000000B80000-0x0000000000BCB000-memory.dmp
memory/3416-143-0x0000000000340000-0x000000000038B000-memory.dmp
memory/3416-144-0x0000000000340000-0x000000000038B000-memory.dmp
memory/3548-130-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3556-98-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3676-179-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3696-178-0x0000000000250000-0x000000000029B000-memory.dmp
memory/3696-176-0x0000000000250000-0x000000000029B000-memory.dmp
memory/3748-234-0x0000000000070000-0x00000000000BB000-memory.dmp
memory/3748-232-0x0000000000070000-0x00000000000BB000-memory.dmp
memory/3764-64-0x0000000000160000-0x00000000001AB000-memory.dmp
memory/3764-66-0x0000000000160000-0x00000000001AB000-memory.dmp
memory/3788-54-0x00000000008B0000-0x00000000008FB000-memory.dmp
memory/3788-57-0x00000000008B0000-0x00000000008FB000-memory.dmp
memory/3832-138-0x0000000000E60000-0x0000000000EAB000-memory.dmp
memory/3832-140-0x0000000000E60000-0x0000000000EAB000-memory.dmp
memory/3880-226-0x0000000000940000-0x000000000098B000-memory.dmp
memory/3880-224-0x0000000000940000-0x000000000098B000-memory.dmp
memory/4116-203-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4140-189-0x0000000000020000-0x000000000006B000-memory.dmp
memory/4140-190-0x0000000000020000-0x000000000006B000-memory.dmp
memory/4236-229-0x0000000000D80000-0x0000000000DCB000-memory.dmp
memory/4236-230-0x0000000000D80000-0x0000000000DCB000-memory.dmp
memory/4276-163-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4276-141-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4724-182-0x00000000006F0000-0x000000000073B000-memory.dmp
memory/4724-181-0x00000000006F0000-0x000000000073B000-memory.dmp
memory/4948-221-0x00000000000E0000-0x000000000012B000-memory.dmp
memory/4948-222-0x00000000000E0000-0x000000000012B000-memory.dmp
memory/5232-136-0x0000000000370000-0x00000000003BB000-memory.dmp
memory/5232-134-0x0000000000370000-0x00000000003BB000-memory.dmp
memory/5320-170-0x0000000000540000-0x000000000058B000-memory.dmp
memory/5320-168-0x0000000000540000-0x000000000058B000-memory.dmp
memory/5436-89-0x0000000000040000-0x000000000008B000-memory.dmp
memory/5436-86-0x0000000000040000-0x000000000008B000-memory.dmp
memory/5464-165-0x00000000006A0000-0x00000000006EB000-memory.dmp
memory/5464-166-0x00000000006A0000-0x00000000006EB000-memory.dmp
memory/5472-192-0x0000000000490000-0x00000000004DB000-memory.dmp
memory/5472-194-0x0000000000490000-0x00000000004DB000-memory.dmp
memory/5604-70-0x0000000000620000-0x000000000066B000-memory.dmp
memory/5604-73-0x0000000000620000-0x000000000066B000-memory.dmp
memory/5620-186-0x0000000000C80000-0x0000000000CCB000-memory.dmp
memory/5620-184-0x0000000000C80000-0x0000000000CCB000-memory.dmp
memory/5624-43-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5716-219-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5904-78-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5924-103-0x0000000000FE0000-0x000000000102B000-memory.dmp
memory/5924-105-0x0000000000FE0000-0x000000000102B000-memory.dmp
memory/5936-171-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5956-187-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5996-59-0x0000000000010000-0x0000000000083000-memory.dmp
memory/6076-210-0x00000000003F0000-0x000000000043B000-memory.dmp
memory/6076-208-0x00000000003F0000-0x000000000043B000-memory.dmp
memory/6140-211-0x0000000000010000-0x0000000000083000-memory.dmp