Analysis
- max time kernel
149s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
15/04/2026, 12:43
General
- Target 2026-04-15_04e962909035b4aa7b9ac04dfa2a380d_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
- Size 291KB
- Sample260415-px3yfaev8r
- SHA256 0ee3d2e3692ea350690880bc52b36682af6f8b4b3400c4ad20fb01ea90f1e033
Malware Config
Extracted
-
systex
-
http://xytets.com:2345/t.asp?os=wangba8102
-
http://xytets.com:2345/ll/out.txt
-
http://xytets.com:2345/t.asp?os=home8102
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Custom signatureUPX dump on OEP (original entry point) 64 IoCs
- Executes dropped EXE 64 IoCs
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- System Location Discovery: System Language Discovery 1 TTPs 43 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 55 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 19 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SetWindowsHookEx 10 IoCs
- Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_04e962909035b4aa7b9ac04dfa2a380d_coinminer_elex_redline-stealer_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-15_04e962909035b4aa7b9ac04dfa2a380d_coinminer_elex_redline-stealer_rhadamanthys_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home81022⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1252 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5248 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\pnhcxspkic.exe ups_run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\pnhcxspkic.exeC:\Temp\pnhcxspkic.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_pnhcxspkic.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_pnhcxspkic.exeC:\Temp\i_pnhcxspkic.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\omhezxrpke.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\omhezxrpke.exeC:\Temp\omhezxrpke.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_omhezxrpke.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_omhezxrpke.exeC:\Temp\i_omhezxrpke.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\hbztrmjecw.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\hbztrmjecw.exeC:\Temp\hbztrmjecw.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_hbztrmjecw.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_hbztrmjecw.exeC:\Temp\i_hbztrmjecw.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ljdbwtomge.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\ljdbwtomge.exeC:\Temp\ljdbwtomge.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ljdbwtomge.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_ljdbwtomge.exeC:\Temp\i_ljdbwtomge.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\lgeywrljdb.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\lgeywrljdb.exeC:\Temp\lgeywrljdb.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_lgeywrljdb.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_lgeywrljdb.exeC:\Temp\i_lgeywrljdb.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\qoigaytqli.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\qoigaytqli.exeC:\Temp\qoigaytqli.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_qoigaytqli.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_qoigaytqli.exeC:\Temp\i_qoigaytqli.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ysqkidavtn.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\ysqkidavtn.exeC:\Temp\ysqkidavtn.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ysqkidavtn.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_ysqkidavtn.exeC:\Temp\i_ysqkidavtn.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\nhfaxsqkic.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\nhfaxsqkic.exeC:\Temp\nhfaxsqkic.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_nhfaxsqkic.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_nhfaxsqkic.exeC:\Temp\i_nhfaxsqkic.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\snhfzxspki.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\snhfzxspki.exeC:\Temp\snhfzxspki.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_snhfzxspki.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_snhfzxspki.exeC:\Temp\i_snhfzxspki.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\cxupmhfzxs.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\cxupmhfzxs.exeC:\Temp\cxupmhfzxs.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_cxupmhfzxs.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_cxupmhfzxs.exeC:\Temp\i_cxupmhfzxs.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\mjecwuomge.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\mjecwuomge.exeC:\Temp\mjecwuomge.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_mjecwuomge.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_mjecwuomge.exeC:\Temp\i_mjecwuomge.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\jebwuomgbz.exe ups_run2⤵
-
C:\Temp\jebwuomgbz.exeC:\Temp\jebwuomgbz.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_jebwuomgbz.exe ups_ins2⤵
-
C:\Temp\i_jebwuomgbz.exeC:\Temp\i_jebwuomgbz.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\wqoigbytrl.exe ups_run2⤵
-
C:\Temp\wqoigbytrl.exeC:\Temp\wqoigbytrl.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_wqoigbytrl.exe ups_ins2⤵
-
C:\Temp\i_wqoigbytrl.exeC:\Temp\i_wqoigbytrl.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\dyvqoigavt.exe ups_run2⤵
-
C:\Temp\dyvqoigavt.exeC:\Temp\dyvqoigavt.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_dyvqoigavt.exe ups_ins2⤵
-
C:\Temp\i_dyvqoigavt.exeC:\Temp\i_dyvqoigavt.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\nigaysqkid.exe ups_run2⤵
-
C:\Temp\nigaysqkid.exeC:\Temp\nigaysqkid.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_nigaysqkid.exe ups_ins2⤵
-
C:\Temp\i_nigaysqkid.exeC:\Temp\i_nigaysqkid.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\faysqkican.exe ups_run2⤵
-
C:\Temp\faysqkican.exeC:\Temp\faysqkican.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_faysqkican.exe ups_ins2⤵
-
C:\Temp\i_faysqkican.exeC:\Temp\i_faysqkican.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\nkfdxvpnhf.exe ups_run2⤵
-
C:\Temp\nkfdxvpnhf.exeC:\Temp\nkfdxvpnhf.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_nkfdxvpnhf.exe ups_ins2⤵
-
C:\Temp\i_nkfdxvpnhf.exeC:\Temp\i_nkfdxvpnhf.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\upmhfzxrpk.exe ups_run2⤵
-
C:\Temp\upmhfzxrpk.exeC:\Temp\upmhfzxrpk.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_upmhfzxrpk.exe ups_ins2⤵
-
C:\Temp\i_upmhfzxrpk.exeC:\Temp\i_upmhfzxrpk.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\hcwuomhezw.exe ups_run2⤵
-
C:\Temp\hcwuomhezw.exeC:\Temp\hcwuomhezw.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_hcwuomhezw.exe ups_ins2⤵
-
C:\Temp\i_hcwuomhezw.exeC:\Temp\i_hcwuomhezw.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\zugeywrojh.exe ups_run2⤵
-
C:\Temp\zugeywrojh.exeC:\Temp\zugeywrojh.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\Temp\kecwupmhxr.sysC:\Temp\kecwupmhxr.sys1⤵
- Executes dropped EXE
-
C:\Temp\zurmkecwuo.sysC:\Temp\zurmkecwuo.sys1⤵
- Executes dropped EXE
-
C:\Temp\ztrmjebwuo.sysC:\Temp\ztrmjebwuo.sys1⤵
- Executes dropped EXE
-
C:\Temp\bwqojgbytr.sysC:\Temp\bwqojgbytr.sys1⤵
- Executes dropped EXE
-
C:\Temp\aytqlidbvt.sysC:\Temp\aytqlidbvt.sys1⤵
- Executes dropped EXE
-
C:\Temp\qlidbvtnlf.sysC:\Temp\qlidbvtnlf.sys1⤵
- Executes dropped EXE
-
C:\Temp\xsqkidavsn.sysC:\Temp\xsqkidavsn.sys1⤵
- Executes dropped EXE
-
C:\Temp\zxspkicaus.sysC:\Temp\zxspkicaus.sys1⤵
- Executes dropped EXE
-
C:\Temp\jhczusmkec.sysC:\Temp\jhczusmkec.sys1⤵
- Executes dropped EXE
-
C:\Temp\ecwuomhezx.sysC:\Temp\ecwuomhezx.sys1⤵
- Executes dropped EXE
-
C:\Temp\uomgezwrpj.sysC:\Temp\uomgezwrpj.sys1⤵
-
C:\Temp\gbztrljdbw.sysC:\Temp\gbztrljdbw.sys1⤵
-
C:\Temp\nlgdywqoig.sysC:\Temp\nlgdywqoig.sys1⤵
-
C:\Temp\gaysqlidav.sysC:\Temp\gaysqlidav.sys1⤵
-
C:\Temp\qkicavsnlf.sysC:\Temp\qkicavsnlf.sys1⤵
-
C:\Temp\xvpnhfaxsq.sysC:\Temp\xvpnhfaxsq.sys1⤵
-
C:\Temp\fzxrpkhcau.sysC:\Temp\fzxrpkhcau.sys1⤵
-
C:\Temp\zupmherpjh.sysC:\Temp\zupmherpjh.sys1⤵
-
C:\Temp\gezwrojhbz.sysC:\Temp\gezwrojhbz.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CP.exe
aytqlidbvt.sys
bwqojgbytr.sys
hbztrmjecw.exe
i_hbztrmjecw.exe
i_lgeywrljdb.exe
i_ljdbwtomge.exe
i_omhezxrpke.exe
i_pnhcxspkic.exe
i_qoigaytqli.exe
i_ysqkidavtn.exe
kecwupmhxr.sys
lgeywrljdb.exe
ljdbwtomge.exe
nhfaxsqkic.exe
omhezxrpke.exe
pnhcxspkic.exe
qlidbvtnlf.sys
qoigaytqli.exe
xsqkidavsn.sys
ysqkidavtn.exe
ztrmjebwuo.sys
zurmkecwuo.sys
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
RecoveryStore.{F46956C3-38CB-11F1-A84F-5ECAEA90A88A}.dat
RecoveryStore.{F4697DD3-38CB-11F1-A84F-5ECAEA90A88A}.dat
suggestions[1].en-US
memory/212-93-0x0000000000010000-0x0000000000083000-memory.dmp
memory/540-133-0x0000000000200000-0x000000000024B000-memory.dmp
memory/540-135-0x0000000000200000-0x000000000024B000-memory.dmp
memory/644-204-0x0000000000420000-0x000000000046B000-memory.dmp
memory/644-202-0x0000000000420000-0x000000000046B000-memory.dmp
memory/696-28-0x0000000000070000-0x00000000000BB000-memory.dmp
memory/696-29-0x0000000000070000-0x00000000000BB000-memory.dmp
memory/1092-228-0x0000000000F20000-0x0000000000F6B000-memory.dmp
memory/1092-226-0x0000000000F20000-0x0000000000F6B000-memory.dmp
memory/1196-123-0x0000000000870000-0x00000000008BB000-memory.dmp
memory/1196-120-0x0000000000870000-0x00000000008BB000-memory.dmp
memory/1620-10-0x0000000000420000-0x000000000046B000-memory.dmp
memory/1620-12-0x0000000000420000-0x000000000046B000-memory.dmp
memory/1648-107-0x0000000000210000-0x000000000025B000-memory.dmp
memory/1648-104-0x0000000000210000-0x000000000025B000-memory.dmp
memory/1776-184-0x00000000000C0000-0x000000000010B000-memory.dmp
memory/1776-183-0x00000000000C0000-0x000000000010B000-memory.dmp
memory/1788-0-0x0000000000320000-0x000000000036B000-memory.dmp
memory/1788-20-0x0000000000320000-0x000000000036B000-memory.dmp
memory/1904-125-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2116-22-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2188-88-0x0000000000A90000-0x0000000000ADB000-memory.dmp
memory/2188-91-0x0000000000A90000-0x0000000000ADB000-memory.dmp
memory/2316-199-0x0000000000310000-0x000000000035B000-memory.dmp
memory/2316-200-0x0000000000310000-0x000000000035B000-memory.dmp
memory/2352-221-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2392-97-0x0000000000A70000-0x0000000000ABB000-memory.dmp
memory/2392-100-0x0000000000A70000-0x0000000000ABB000-memory.dmp
memory/2660-146-0x0000000000190000-0x00000000001DB000-memory.dmp
memory/2660-147-0x0000000000190000-0x00000000001DB000-memory.dmp
memory/2680-38-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2768-213-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2860-163-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2952-139-0x0000000000BF0000-0x0000000000C3B000-memory.dmp
memory/2952-138-0x0000000000BF0000-0x0000000000C3B000-memory.dmp
memory/3080-136-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3212-155-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3272-236-0x0000000000100000-0x000000000014B000-memory.dmp
memory/3272-234-0x0000000000100000-0x000000000014B000-memory.dmp
memory/3332-220-0x0000000000640000-0x000000000068B000-memory.dmp
memory/3332-218-0x0000000000640000-0x000000000068B000-memory.dmp
memory/3432-143-0x00000000004E0000-0x000000000052B000-memory.dmp
memory/3432-141-0x00000000004E0000-0x000000000052B000-memory.dmp
memory/3436-144-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3524-223-0x0000000000140000-0x000000000018B000-memory.dmp
memory/3524-224-0x0000000000140000-0x000000000018B000-memory.dmp
memory/3548-205-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3560-81-0x0000000000A20000-0x0000000000A6B000-memory.dmp
memory/3560-84-0x0000000000A20000-0x0000000000A6B000-memory.dmp
memory/3596-162-0x00000000009E0000-0x0000000000A2B000-memory.dmp
memory/3596-160-0x00000000009E0000-0x0000000000A2B000-memory.dmp
memory/3740-216-0x0000000000230000-0x000000000027B000-memory.dmp
memory/3740-215-0x0000000000230000-0x000000000027B000-memory.dmp
memory/3792-75-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3900-231-0x0000000000150000-0x000000000019B000-memory.dmp
memory/3900-232-0x0000000000150000-0x000000000019B000-memory.dmp
memory/3928-36-0x0000000000BB0000-0x0000000000BFB000-memory.dmp
memory/3928-34-0x0000000000BB0000-0x0000000000BFB000-memory.dmp
memory/3932-131-0x0000000000560000-0x00000000005AB000-memory.dmp
memory/3932-130-0x0000000000560000-0x00000000005AB000-memory.dmp
memory/3988-194-0x0000000000420000-0x000000000046B000-memory.dmp
memory/3988-196-0x0000000000420000-0x000000000046B000-memory.dmp
memory/4008-154-0x0000000000910000-0x000000000095B000-memory.dmp
memory/4008-152-0x0000000000910000-0x000000000095B000-memory.dmp
memory/4164-58-0x0000000000760000-0x00000000007AB000-memory.dmp
memory/4164-61-0x0000000000760000-0x00000000007AB000-memory.dmp
memory/4228-54-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4444-191-0x00000000007C0000-0x000000000080B000-memory.dmp
memory/4444-192-0x00000000007C0000-0x000000000080B000-memory.dmp
memory/4472-45-0x0000000000FC0000-0x000000000100B000-memory.dmp
memory/4472-42-0x0000000000FC0000-0x000000000100B000-memory.dmp
memory/4520-166-0x0000000000E30000-0x0000000000E7B000-memory.dmp
memory/4520-165-0x0000000000E30000-0x0000000000E7B000-memory.dmp
memory/4604-157-0x00000000004C0000-0x000000000050B000-memory.dmp
memory/4604-158-0x00000000004C0000-0x000000000050B000-memory.dmp
memory/4612-197-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4896-189-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4940-207-0x0000000000F90000-0x0000000000FDB000-memory.dmp
memory/4940-208-0x0000000000F90000-0x0000000000FDB000-memory.dmp
memory/5068-109-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5132-181-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5316-210-0x0000000000AA0000-0x0000000000AEB000-memory.dmp
memory/5316-212-0x0000000000AA0000-0x0000000000AEB000-memory.dmp
memory/5360-19-0x0000000000BF0000-0x0000000000C3B000-memory.dmp
memory/5360-17-0x0000000000BF0000-0x0000000000C3B000-memory.dmp
memory/5492-188-0x0000000000BB0000-0x0000000000BFB000-memory.dmp
memory/5492-186-0x0000000000BB0000-0x0000000000BFB000-memory.dmp
memory/5500-116-0x0000000000DF0000-0x0000000000E3B000-memory.dmp
memory/5500-113-0x0000000000DF0000-0x0000000000E3B000-memory.dmp
memory/5528-229-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5568-65-0x0000000000710000-0x000000000075B000-memory.dmp
memory/5568-73-0x0000000000710000-0x000000000075B000-memory.dmp
memory/5584-178-0x0000000000EC0000-0x0000000000F0B000-memory.dmp
memory/5584-180-0x0000000000EC0000-0x0000000000F0B000-memory.dmp
memory/6092-50-0x0000000000730000-0x000000000077B000-memory.dmp
memory/6092-52-0x0000000000730000-0x000000000077B000-memory.dmp