Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
15/04/2026, 14:55
General
- Target 2026-04-15_4f399e82a6ed6980ff37609f374d8f9f_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
- Size 291KB
- Sample260415-sawsdsav9m
- SHA256 b2f266c7a961e2da7a52d434ac4602222f1e66ae7a95bf8d2365673f3b0b67d8
Malware Config
Extracted
-
systex
-
http://xytets.com:2345/t.asp?os=wangba8102
-
http://xytets.com:2345/ll/out.txt
-
http://xytets.com:2345/t.asp?os=home8102
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Custom signatureUPX dump on OEP (original entry point) 64 IoCs
- Executes dropped EXE 64 IoCs
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- System Location Discovery: System Language Discovery 1 TTPs 44 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 55 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 19 IoCs
- Suspicious use of AdjustPrivilegeToken 20 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SetWindowsHookEx 10 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_4f399e82a6ed6980ff37609f374d8f9f_coinminer_elex_redline-stealer_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-15_4f399e82a6ed6980ff37609f374d8f9f_coinminer_elex_redline-stealer_rhadamanthys_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home81022⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4760 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4764 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\hfzxspkica.exe ups_run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\hfzxspkica.exeC:\Temp\hfzxspkica.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_hfzxspkica.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_hfzxspkica.exeC:\Temp\i_hfzxspkica.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\khczusmkwu.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\khczusmkwu.exeC:\Temp\khczusmkwu.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_khczusmkwu.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_khczusmkwu.exeC:\Temp\i_khczusmkwu.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\wupmhezxrp.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\wupmhezxrp.exeC:\Temp\wupmhezxrp.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_wupmhezxrp.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_wupmhezxrp.exeC:\Temp\i_wupmhezxrp.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ljebwuomge.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\ljebwuomge.exeC:\Temp\ljebwuomge.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ljebwuomge.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_ljebwuomge.exeC:\Temp\i_ljebwuomge.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\dywqoigbyt.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\dywqoigbyt.exeC:\Temp\dywqoigbyt.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_dywqoigbyt.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_dywqoigbyt.exeC:\Temp\i_dywqoigbyt.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\eywqoigtql.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\eywqoigtql.exeC:\Temp\eywqoigtql.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_eywqoigtql.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_eywqoigtql.exeC:\Temp\i_eywqoigtql.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\qlidbvtnlf.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\qlidbvtnlf.exeC:\Temp\qlidbvtnlf.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_qlidbvtnlf.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_qlidbvtnlf.exeC:\Temp\i_qlidbvtnlf.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\avpnifaxsq.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\avpnifaxsq.exeC:\Temp\avpnifaxsq.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_avpnifaxsq.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_avpnifaxsq.exeC:\Temp\i_avpnifaxsq.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\mkfcxvpnhf.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\mkfcxvpnhf.exeC:\Temp\mkfcxvpnhf.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_mkfcxvpnhf.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_mkfcxvpnhf.exeC:\Temp\i_mkfcxvpnhf.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\fzpjhczusm.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\fzpjhczusm.exeC:\Temp\fzpjhczusm.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_fzpjhczusm.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_fzpjhczusm.exeC:\Temp\i_fzpjhczusm.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\upjhbzurmk.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\upjhbzurmk.exeC:\Temp\upjhbzurmk.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_upjhbzurmk.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_upjhbzurmk.exeC:\Temp\i_upjhbzurmk.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\bztrmjebwu.exe ups_run2⤵
-
C:\Temp\bztrmjebwu.exeC:\Temp\bztrmjebwu.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_bztrmjebwu.exe ups_ins2⤵
-
C:\Temp\i_bztrmjebwu.exeC:\Temp\i_bztrmjebwu.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\tomgeywroj.exe ups_run2⤵
-
C:\Temp\tomgeywroj.exeC:\Temp\tomgeywroj.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_tomgeywroj.exe ups_ins2⤵
-
C:\Temp\i_tomgeywroj.exeC:\Temp\i_tomgeywroj.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\gbvtoigayt.exe ups_run2⤵
-
C:\Temp\gbvtoigayt.exeC:\Temp\gbvtoigayt.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_gbvtoigayt.exe ups_ins2⤵
-
C:\Temp\i_gbvtoigayt.exeC:\Temp\i_gbvtoigayt.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\dyvqoigays.exe ups_run2⤵
-
C:\Temp\dyvqoigays.exeC:\Temp\dyvqoigays.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_dyvqoigays.exe ups_ins2⤵
-
C:\Temp\i_dyvqoigays.exeC:\Temp\i_dyvqoigays.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\qkidavtnlf.exe ups_run2⤵
-
C:\Temp\qkidavtnlf.exeC:\Temp\qkidavtnlf.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_qkidavtnlf.exe ups_ins2⤵
-
C:\Temp\i_qkidavtnlf.exeC:\Temp\i_qkidavtnlf.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\faxsqkicav.exe ups_run2⤵
-
C:\Temp\faxsqkicav.exeC:\Temp\faxsqkicav.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_faxsqkicav.exe ups_ins2⤵
-
C:\Temp\i_faxsqkicav.exeC:\Temp\i_faxsqkicav.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\hczusmkecw.exe ups_run2⤵
-
C:\Temp\hczusmkecw.exeC:\Temp\hczusmkecw.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_hczusmkecw.exe ups_ins2⤵
-
C:\Temp\i_hczusmkecw.exeC:\Temp\i_hczusmkecw.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\hfzxrpjhcz.exe ups_run2⤵
-
C:\Temp\hfzxrpjhcz.exeC:\Temp\hfzxrpjhcz.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_hfzxrpjhcz.exe ups_ins2⤵
-
C:\Temp\i_hfzxrpjhcz.exeC:\Temp\i_hfzxrpjhcz.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\uomhezwrpj.exe ups_run2⤵
-
C:\Temp\uomhezwrpj.exeC:\Temp\uomhezwrpj.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_uomhezwrpj.exe ups_ins2⤵
-
C:\Temp\i_uomhezwrpj.exeC:\Temp\i_uomhezwrpj.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Temp\usmkecwupm.sysC:\Temp\usmkecwupm.sys1⤵
- Executes dropped EXE
-
C:\Temp\hbzurmkecw.sysC:\Temp\hbzurmkecw.sys1⤵
- Executes dropped EXE
-
C:\Temp\wuomgezwrp.sysC:\Temp\wuomgezwrp.sys1⤵
- Executes dropped EXE
-
C:\Temp\wrojhbztrd.sysC:\Temp\wrojhbztrd.sys1⤵
- Executes dropped EXE
-
C:\Temp\ljdbvtolgd.sysC:\Temp\ljdbvtolgd.sys1⤵
- Executes dropped EXE
-
C:\Temp\bvtnlgaysq.sysC:\Temp\bvtnlgaysq.sys1⤵
- Executes dropped EXE
-
C:\Temp\ifaxsqkica.sysC:\Temp\ifaxsqkica.sys1⤵
- Executes dropped EXE
-
C:\Temp\faxsqkausm.sysC:\Temp\faxsqkausm.sys1⤵
- Executes dropped EXE
-
C:\Temp\pkhcausmke.sysC:\Temp\pkhcausmke.sys1⤵
- Executes dropped EXE
-
C:\Temp\bzurmkecwu.sysC:\Temp\bzurmkecwu.sys1⤵
- Executes dropped EXE
-
C:\Temp\mjebwuomge.sysC:\Temp\mjebwuomge.sys1⤵
-
C:\Temp\mgerojgbzt.sysC:\Temp\mgerojgbzt.sys1⤵
-
C:\Temp\ytrljdbvto.sysC:\Temp\ytrljdbvto.sys1⤵
-
C:\Temp\oigaytqljd.sysC:\Temp\oigaytqljd.sys1⤵
-
C:\Temp\aysqkidavt.sysC:\Temp\aysqkidavt.sys1⤵
-
C:\Temp\anhfaxspki.sysC:\Temp\anhfaxspki.sys1⤵
-
C:\Temp\ausnkfcxvp.sysC:\Temp\ausnkfcxvp.sys1⤵
-
C:\Temp\rpkhcausmk.sysC:\Temp\rpkhcausmk.sys1⤵
-
C:\Temp\eztrmjecwu.sysC:\Temp\eztrmjecwu.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CP.exe
avpnifaxsq.exe
bvtnlgaysq.sys
dywqoigbyt.exe
eywqoigtql.exe
hbzurmkecw.sys
hfzxspkica.exe
i_dywqoigbyt.exe
i_eywqoigtql.exe
i_hfzxspkica.exe
i_khczusmkwu.exe
i_ljebwuomge.exe
i_qlidbvtnlf.exe
i_wupmhezxrp.exe
ifaxsqkica.sys
khczusmkwu.exe
ljdbvtolgd.sys
ljebwuomge.exe
qlidbvtnlf.exe
usmkecwupm.sys
wrojhbztrd.sys
wuomgezwrp.sys
wupmhezxrp.exe
8A7891822FCFF127E4EADADE9757112B
8A7891822FCFF127E4EADADE9757112B
8A7891822FCFF127E4EADADE9757112B
RecoveryStore.{FAE4BE2B-38DB-11F1-A918-4E4F3739AA41}.dat
RecoveryStore.{FAE71F76-38DB-11F1-A918-4E4F3739AA41}.dat
suggestions[1].en-US
memory/564-29-0x00000000006A0000-0x00000000006EB000-memory.dmp
memory/564-26-0x00000000006A0000-0x00000000006EB000-memory.dmp
memory/696-201-0x0000000000B60000-0x0000000000BAB000-memory.dmp
memory/696-199-0x0000000000B60000-0x0000000000BAB000-memory.dmp
memory/756-191-0x0000000000590000-0x00000000005DB000-memory.dmp
memory/756-193-0x0000000000590000-0x00000000005DB000-memory.dmp
memory/964-186-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1036-230-0x0000000000E10000-0x0000000000E5B000-memory.dmp
memory/1036-229-0x0000000000E10000-0x0000000000E5B000-memory.dmp
memory/1276-163-0x00000000004C0000-0x000000000050B000-memory.dmp
memory/1276-164-0x00000000004C0000-0x000000000050B000-memory.dmp
memory/1296-196-0x0000000000630000-0x000000000067B000-memory.dmp
memory/1296-197-0x0000000000630000-0x000000000067B000-memory.dmp
memory/1300-160-0x0000000000B30000-0x0000000000B7B000-memory.dmp
memory/1300-148-0x0000000000B30000-0x0000000000B7B000-memory.dmp
memory/1408-189-0x0000000000260000-0x00000000002AB000-memory.dmp
memory/1408-188-0x0000000000260000-0x00000000002AB000-memory.dmp
memory/1504-93-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1584-218-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1844-17-0x0000000000C90000-0x0000000000CDB000-memory.dmp
memory/1844-19-0x0000000000C90000-0x0000000000CDB000-memory.dmp
memory/2036-12-0x0000000000580000-0x00000000005CB000-memory.dmp
memory/2036-9-0x0000000000580000-0x00000000005CB000-memory.dmp
memory/2052-138-0x0000000000CC0000-0x0000000000D0B000-memory.dmp
memory/2052-137-0x0000000000CC0000-0x0000000000D0B000-memory.dmp
memory/2056-166-0x0000000000F80000-0x0000000000FCB000-memory.dmp
memory/2056-227-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2056-168-0x0000000000F80000-0x0000000000FCB000-memory.dmp
memory/2256-38-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2468-66-0x0000000000AF0000-0x0000000000B3B000-memory.dmp
memory/2468-70-0x0000000000AF0000-0x0000000000B3B000-memory.dmp
memory/2516-161-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2640-224-0x0000000000840000-0x000000000088B000-memory.dmp
memory/2640-226-0x0000000000840000-0x000000000088B000-memory.dmp
memory/2724-178-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2724-169-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2736-121-0x0000000000090000-0x00000000000DB000-memory.dmp
memory/2736-124-0x0000000000090000-0x00000000000DB000-memory.dmp
memory/3212-54-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3276-52-0x00000000005F0000-0x000000000063B000-memory.dmp
memory/3276-49-0x00000000005F0000-0x000000000063B000-memory.dmp
memory/3420-22-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3516-181-0x0000000000290000-0x00000000002DB000-memory.dmp
memory/3516-180-0x0000000000290000-0x00000000002DB000-memory.dmp
memory/3744-215-0x0000000000460000-0x00000000004AB000-memory.dmp
memory/3744-217-0x0000000000460000-0x00000000004AB000-memory.dmp
memory/4240-84-0x0000000000E80000-0x0000000000ECB000-memory.dmp
memory/4240-81-0x0000000000E80000-0x0000000000ECB000-memory.dmp
memory/4292-72-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4376-58-0x00000000008F0000-0x000000000093B000-memory.dmp
memory/4376-61-0x00000000008F0000-0x000000000093B000-memory.dmp
memory/4608-171-0x0000000000440000-0x000000000048B000-memory.dmp
memory/4608-172-0x0000000000440000-0x000000000048B000-memory.dmp
memory/4632-205-0x0000000000080000-0x00000000000CB000-memory.dmp
memory/4632-204-0x0000000000080000-0x00000000000CB000-memory.dmp
memory/4664-222-0x0000000000230000-0x000000000027B000-memory.dmp
memory/4664-221-0x0000000000230000-0x000000000027B000-memory.dmp
memory/4696-117-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4716-0-0x0000000000D20000-0x0000000000D6B000-memory.dmp
memory/4716-20-0x0000000000D20000-0x0000000000D6B000-memory.dmp
memory/4768-145-0x0000000000F50000-0x0000000000F9B000-memory.dmp
memory/4768-146-0x0000000000F50000-0x0000000000F9B000-memory.dmp
memory/4908-207-0x0000000000CC0000-0x0000000000D0B000-memory.dmp
memory/4908-209-0x0000000000CC0000-0x0000000000D0B000-memory.dmp
memory/4924-212-0x0000000000390000-0x00000000003DB000-memory.dmp
memory/4924-213-0x0000000000390000-0x00000000003DB000-memory.dmp
memory/5076-234-0x0000000000290000-0x00000000002DB000-memory.dmp
memory/5076-232-0x0000000000290000-0x00000000002DB000-memory.dmp
memory/5132-140-0x0000000000480000-0x00000000004CB000-memory.dmp
memory/5132-142-0x0000000000480000-0x00000000004CB000-memory.dmp
memory/5180-104-0x0000000000B20000-0x0000000000B6B000-memory.dmp
memory/5180-115-0x0000000000B20000-0x0000000000B6B000-memory.dmp
memory/5204-185-0x0000000000E90000-0x0000000000EDB000-memory.dmp
memory/5204-183-0x0000000000E90000-0x0000000000EDB000-memory.dmp
memory/5216-45-0x00000000008B0000-0x00000000008FB000-memory.dmp
memory/5216-42-0x00000000008B0000-0x00000000008FB000-memory.dmp
memory/5244-133-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5264-34-0x00000000000B0000-0x00000000000FB000-memory.dmp
memory/5264-235-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5264-36-0x00000000000B0000-0x00000000000FB000-memory.dmp
memory/5480-128-0x0000000000200000-0x000000000024B000-memory.dmp
memory/5480-131-0x0000000000200000-0x000000000024B000-memory.dmp
memory/5504-238-0x0000000000340000-0x000000000038B000-memory.dmp
memory/5504-176-0x0000000000D60000-0x0000000000DAB000-memory.dmp
memory/5504-174-0x0000000000D60000-0x0000000000DAB000-memory.dmp
memory/5504-237-0x0000000000340000-0x000000000038B000-memory.dmp
memory/5680-143-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5712-202-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5792-89-0x00000000008A0000-0x00000000008EB000-memory.dmp
memory/5792-91-0x00000000008A0000-0x00000000008EB000-memory.dmp
memory/5816-97-0x0000000000210000-0x000000000025B000-memory.dmp
memory/5816-100-0x0000000000210000-0x000000000025B000-memory.dmp
memory/5888-194-0x0000000000010000-0x0000000000083000-memory.dmp
memory/6004-219-0x0000000000010000-0x0000000000083000-memory.dmp
memory/6004-210-0x0000000000010000-0x0000000000083000-memory.dmp
memory/6036-177-0x0000000000010000-0x0000000000083000-memory.dmp