Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
15/04/2026, 16:13
General
- Target 2026-04-15_a34ff56e4d972ff099f6e12d90a87f07_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 376KB
- Sample260415-tpfv6afx41
- SHA256 7462f296013580c0fec49664ec5e0474235dd0dbf8b1d22d72af75ec81736c1f
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 43 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 32 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 62 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_a34ff56e4d972ff099f6e12d90a87f07_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-15_a34ff56e4d972ff099f6e12d90a87f07_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\xrpjhbzurmkecwuo.exeC:\Temp\xrpjhbzurmkecwuo.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\cojhbztrjh.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\cojhbztrjh.exeC:\Temp\cojhbztrjh.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_cojhbztrjh.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_cojhbztrjh.exeC:\Temp\i_cojhbztrjh.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rljdbwtomg.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\rljdbwtomg.exeC:\Temp\rljdbwtomg.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rljdbwtomg.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_rljdbwtomg.exeC:\Temp\i_rljdbwtomg.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dbwtolgeyw.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\dbwtolgeyw.exeC:\Temp\dbwtolgeyw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dbwtolgeyw.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_dbwtolgeyw.exeC:\Temp\i_dbwtolgeyw.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nigaysqlid.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\nigaysqlid.exeC:\Temp\nigaysqlid.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nigaysqlid.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_nigaysqlid.exeC:\Temp\i_nigaysqlid.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kidxvqnifa.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\kidxvqnifa.exeC:\Temp\kidxvqnifa.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kidxvqnifa.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_kidxvqnifa.exeC:\Temp\i_kidxvqnifa.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nhfaxspnif.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\nhfaxspnif.exeC:\Temp\nhfaxspnif.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nhfaxspnif.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_nhfaxspnif.exeC:\Temp\i_nhfaxspnif.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fzxspkhcau.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\fzxspkhcau.exeC:\Temp\fzxspkhcau.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fzxspkhcau.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_fzxspkhcau.exeC:\Temp\i_fzxspkhcau.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\smkecxupmh.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\smkecxupmh.exeC:\Temp\smkecxupmh.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_smkecxupmh.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_smkecxupmh.exeC:\Temp\i_smkecxupmh.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hbztrmgezw.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\hbztrmgezw.exeC:\Temp\hbztrmgezw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hbztrmgezw.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_hbztrmgezw.exeC:\Temp\i_hbztrmgezw.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gezwrojhbz.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\gezwrojhbz.exeC:\Temp\gezwrojhbz.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gezwrojhbz.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_gezwrojhbz.exeC:\Temp\i_gezwrojhbz.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bwtomgeywq.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\bwtomgeywq.exeC:\Temp\bwtomgeywq.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bwtomgeywq.exe ups_ins3⤵
-
C:\Temp\i_bwtomgeywq.exeC:\Temp\i_bwtomgeywq.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\tnlfdyvqoi.exe ups_run3⤵
-
C:\Temp\tnlfdyvqoi.exeC:\Temp\tnlfdyvqoi.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_tnlfdyvqoi.exe ups_ins3⤵
-
C:\Temp\i_tnlfdyvqoi.exeC:\Temp\i_tnlfdyvqoi.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nlfdyvqnig.exe ups_run3⤵
-
C:\Temp\nlfdyvqnig.exeC:\Temp\nlfdyvqnig.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nlfdyvqnig.exe ups_ins3⤵
-
C:\Temp\i_nlfdyvqnig.exeC:\Temp\i_nlfdyvqnig.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nifaysqkid.exe ups_run3⤵
-
C:\Temp\nifaysqkid.exeC:\Temp\nifaysqkid.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nifaysqkid.exe ups_ins3⤵
-
C:\Temp\i_nifaysqkid.exeC:\Temp\i_nifaysqkid.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\icausmkfcx.exe ups_run3⤵
-
C:\Temp\icausmkfcx.exeC:\Temp\icausmkfcx.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_icausmkfcx.exe ups_ins3⤵
-
C:\Temp\i_icausmkfcx.exeC:\Temp\i_icausmkfcx.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\cwupmhfzxr.exe ups_run3⤵
-
C:\Temp\cwupmhfzxr.exeC:\Temp\cwupmhfzxr.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_cwupmhfzxr.exe ups_ins3⤵
-
C:\Temp\i_cwupmhfzxr.exeC:\Temp\i_cwupmhfzxr.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\cxrpjhbzur.exe ups_run3⤵
-
C:\Temp\cxrpjhbzur.exeC:\Temp\cxrpjhbzur.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_cxrpjhbzur.exe ups_ins3⤵
-
C:\Temp\i_cxrpjhbzur.exeC:\Temp\i_cxrpjhbzur.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ezwrpjhbzt.exe ups_run3⤵
-
C:\Temp\ezwrpjhbzt.exeC:\Temp\ezwrpjhbzt.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ezwrpjhbzt.exe ups_ins3⤵
-
C:\Temp\i_ezwrpjhbzt.exeC:\Temp\i_ezwrpjhbzt.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ztrljdbwto.exe ups_run3⤵
-
C:\Temp\ztrljdbwto.exeC:\Temp\ztrljdbwto.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ztrljdbwto.exe ups_ins3⤵
-
C:\Temp\i_ztrljdbwto.exeC:\Temp\i_ztrljdbwto.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nlgdywqoig.exe ups_run3⤵
-
C:\Temp\nlgdywqoig.exeC:\Temp\nlgdywqoig.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1120 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Temp\xrpjhbzurmkecwuo.sysC:\Temp\xrpjhbzurmkecwuo.sys1⤵
- Executes dropped EXE
-
C:\Temp\bwuomgeywr.sysC:\Temp\bwuomgeywr.sys1⤵
- Executes dropped EXE
-
C:\Temp\oigbytrljd.sysC:\Temp\oigbytrljd.sys1⤵
- Executes dropped EXE
-
C:\Temp\vtnlfdyvqo.sysC:\Temp\vtnlfdyvqo.sys1⤵
- Executes dropped EXE
-
C:\Temp\sqlidbvtnl.sysC:\Temp\sqlidbvtnl.sys1⤵
- Executes dropped EXE
-
C:\Temp\ysqkidavsn.sysC:\Temp\ysqkidavsn.sys1⤵
- Executes dropped EXE
-
C:\Temp\pkicausnkf.sysC:\Temp\pkicausnkf.sys1⤵
- Executes dropped EXE
-
C:\Temp\zxrpjecwup.sysC:\Temp\zxrpjecwup.sys1⤵
- Executes dropped EXE
-
C:\Temp\zusmkecwup.sysC:\Temp\zusmkecwup.sys1⤵
- Executes dropped EXE
-
C:\Temp\rljebwuomg.sysC:\Temp\rljebwuomg.sys1⤵
- Executes dropped EXE
-
C:\Temp\jdbvtolgey.sysC:\Temp\jdbvtolgey.sys1⤵
- Executes dropped EXE
-
C:\Temp\dywqoigayt.sysC:\Temp\dywqoigayt.sys1⤵
-
C:\Temp\gaysqlidbv.sysC:\Temp\gaysqlidbv.sys1⤵
-
C:\Temp\vtnlfdxvqn.sysC:\Temp\vtnlfdxvqn.sys1⤵
-
C:\Temp\pnhfaxsqki.sysC:\Temp\pnhfaxsqki.sys1⤵
-
C:\Temp\khcausmkec.sysC:\Temp\khcausmkec.sys1⤵
-
C:\Temp\rmkecwupmh.sysC:\Temp\rmkecwupmh.sys1⤵
-
C:\Temp\mkecwuomhe.sysC:\Temp\mkecwuomhe.sys1⤵
-
C:\Temp\geywrojhbz.sysC:\Temp\geywrojhbz.sys1⤵
-
C:\Temp\ytqljdbvto.sysC:\Temp\ytqljdbvto.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CreateProcess.exe
bwuomgeywr.sys
cojhbztrjh.exe
dbwtolgeyw.exe
fzxspkhcau.exe
i_cojhbztrjh.exe
i_dbwtolgeyw.exe
i_fzxspkhcau.exe
i_kidxvqnifa.exe
i_nhfaxspnif.exe
i_nigaysqlid.exe
i_rljdbwtomg.exe
kidxvqnifa.exe
nhfaxspnif.exe
nigaysqlid.exe
oigbytrljd.sys
pkicausnkf.sys
rljdbwtomg.exe
smkecxupmh.exe
sqlidbvtnl.sys
vtnlfdyvqo.sys
xrpjhbzurmkecwuo.exe
xrpjhbzurmkecwuo.sys
ysqkidavsn.sys
zxrpjecwup.sys
suggestions[1].en-US
memory/540-155-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/728-123-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1064-14-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1252-57-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1412-143-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1476-135-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1944-139-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2112-86-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2268-106-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2404-147-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2608-74-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2764-164-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2864-33-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3812-45-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4264-165-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4264-160-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4416-127-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4436-131-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4788-98-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4792-21-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4968-156-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4968-151-0x0000000000010000-0x00000000000AB000-memory.dmp