Analysis
- max time kernel
149s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
15/04/2026, 18:45
General
- Target 2026-04-15_18b6e8fa87cfc1a0973e5d8d77ae296f_elex_redline-stealer_rhadamanthys_stop.exe
- Size 248KB
- Sample260415-xd65ragw4p
- SHA256 52b775e52c94c7b76db2d61580d9fbbbd8ae0a56300ed8a63f80d51d26aeb663
Malware Config
Extracted
-
systex
-
http://xytets.com:2345/t.asp?os=wangba8102
-
http://xytets.com:2345/ll/out.txt
-
http://xytets.com:2345/t.asp?os=home8102
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 44 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 55 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 19 IoCs
- Suspicious use of AdjustPrivilegeToken 20 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SetWindowsHookEx 10 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_18b6e8fa87cfc1a0973e5d8d77ae296f_elex_redline-stealer_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-15_18b6e8fa87cfc1a0973e5d8d77ae296f_elex_redline-stealer_rhadamanthys_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home81022⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3464 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2844 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\cwupmhezxr.exe ups_run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\cwupmhezxr.exeC:\Temp\cwupmhezxr.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_cwupmhezxr.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_cwupmhezxr.exeC:\Temp\i_cwupmhezxr.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ztrmjecwuo.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\ztrmjecwuo.exeC:\Temp\ztrmjecwuo.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ztrmjecwuo.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_ztrmjecwuo.exeC:\Temp\i_ztrmjecwuo.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\olgeywqojg.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\olgeywqojg.exeC:\Temp\olgeywqojg.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_olgeywqojg.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_olgeywqojg.exeC:\Temp\i_olgeywqojg.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\oigaytqljd.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\oigaytqljd.exeC:\Temp\oigaytqljd.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_oigaytqljd.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_oigaytqljd.exeC:\Temp\i_oigaytqljd.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\gavtnlfdxt.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\gavtnlfdxt.exeC:\Temp\gavtnlfdxt.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_gavtnlfdxt.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_gavtnlfdxt.exeC:\Temp\i_gavtnlfdxt.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\snlfaysqki.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\snlfaysqki.exeC:\Temp\snlfaysqki.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_snlfaysqki.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_snlfaysqki.exeC:\Temp\i_snlfaysqki.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\kfcxupnhfz.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\kfcxupnhfz.exeC:\Temp\kfcxupnhfz.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_kfcxupnhfz.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_kfcxupnhfz.exeC:\Temp\i_kfcxupnhfz.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\nhfzxspkhc.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\nhfzxspkhc.exeC:\Temp\nhfzxspkhc.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_nhfzxspkhc.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_nhfzxspkhc.exeC:\Temp\i_nhfzxspkhc.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\hczurmkecw.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\hczurmkecw.exeC:\Temp\hczurmkecw.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_hczurmkecw.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_hczurmkecw.exeC:\Temp\i_hczurmkecw.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\zuomgeywro.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\zuomgeywro.exeC:\Temp\zuomgeywro.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_zuomgeywro.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_zuomgeywro.exeC:\Temp\i_zuomgeywro.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\rljdywqojg.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\rljdywqojg.exeC:\Temp\rljdywqojg.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_rljdywqojg.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_rljdywqojg.exeC:\Temp\i_rljdywqojg.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\rljdbvtolg.exe ups_run2⤵
-
C:\Temp\rljdbvtolg.exeC:\Temp\rljdbvtolg.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_rljdbvtolg.exe ups_ins2⤵
-
C:\Temp\i_rljdbvtolg.exeC:\Temp\i_rljdbvtolg.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\lgdywqoiga.exe ups_run2⤵
-
C:\Temp\lgdywqoiga.exeC:\Temp\lgdywqoiga.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_lgdywqoiga.exe ups_ins2⤵
-
C:\Temp\i_lgdywqoiga.exeC:\Temp\i_lgdywqoiga.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\fdyvqkidav.exe ups_run2⤵
-
C:\Temp\fdyvqkidav.exeC:\Temp\fdyvqkidav.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_fdyvqkidav.exe ups_ins2⤵
-
C:\Temp\i_fdyvqkidav.exeC:\Temp\i_fdyvqkidav.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\axsqkicaus.exe ups_run2⤵
-
C:\Temp\axsqkicaus.exeC:\Temp\axsqkicaus.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_axsqkicaus.exe ups_ins2⤵
-
C:\Temp\i_axsqkicaus.exeC:\Temp\i_axsqkicaus.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\cxupnhfzxs.exe ups_run2⤵
-
C:\Temp\cxupnhfzxs.exeC:\Temp\cxupnhfzxs.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_cxupnhfzxs.exe ups_ins2⤵
-
C:\Temp\i_cxupnhfzxs.exeC:\Temp\i_cxupnhfzxs.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\zusmkecwup.exe ups_run2⤵
-
C:\Temp\zusmkecwup.exeC:\Temp\zusmkecwup.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_zusmkecwup.exe ups_ins2⤵
-
C:\Temp\i_zusmkecwup.exeC:\Temp\i_zusmkecwup.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\uomgezwrpj.exe ups_run2⤵
-
C:\Temp\uomgezwrpj.exeC:\Temp\uomgezwrpj.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_uomgezwrpj.exe ups_ins2⤵
-
C:\Temp\i_uomgezwrpj.exeC:\Temp\i_uomgezwrpj.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ojhbztrlje.exe ups_run2⤵
-
C:\Temp\ojhbztrlje.exeC:\Temp\ojhbztrlje.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ojhbztrlje.exe ups_ins2⤵
-
C:\Temp\i_ojhbztrlje.exeC:\Temp\i_ojhbztrlje.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\qojgbztrlj.exe ups_run2⤵
-
C:\Temp\qojgbztrlj.exeC:\Temp\qojgbztrlj.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_qojgbztrlj.exe ups_ins2⤵
-
C:\Temp\i_qojgbztrlj.exeC:\Temp\i_qojgbztrlj.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Temp\jebwuomgez.sysC:\Temp\jebwuomgez.sys1⤵
- Executes dropped EXE
-
C:\Temp\gbztrljdbw.sysC:\Temp\gbztrljdbw.sys1⤵
- Executes dropped EXE
-
C:\Temp\ytqljdbvtn.sysC:\Temp\ytqljdbvtn.sys1⤵
- Executes dropped EXE
-
C:\Temp\qlidbvtnlg.sysC:\Temp\qlidbvtnlg.sys1⤵
- Executes dropped EXE
-
C:\Temp\aysqkicavs.sysC:\Temp\aysqkicavs.sys1⤵
- Executes dropped EXE
-
C:\Temp\dxvpnifaxs.sysC:\Temp\dxvpnifaxs.sys1⤵
- Executes dropped EXE
-
C:\Temp\usmkecxupn.sysC:\Temp\usmkecxupn.sys1⤵
- Executes dropped EXE
-
C:\Temp\rmkecxupmh.sysC:\Temp\rmkecxupmh.sys1⤵
- Executes dropped EXE
-
C:\Temp\kecwuomhez.sysC:\Temp\kecwuomhez.sys1⤵
- Executes dropped EXE
-
C:\Temp\jebwuomgey.sysC:\Temp\jebwuomgey.sys1⤵
- Executes dropped EXE
-
C:\Temp\bwtomgeywq.sysC:\Temp\bwtomgeywq.sys1⤵
-
C:\Temp\tnlfdyvqoi.sysC:\Temp\tnlfdyvqoi.sys1⤵
-
C:\Temp\qkidavtnlf.sysC:\Temp\qkidavtnlf.sys1⤵
-
C:\Temp\snkfdxvpni.sysC:\Temp\snkfdxvpni.sys1⤵
-
C:\Temp\nhfaxspkic.sysC:\Temp\nhfaxspkic.sys1⤵
-
C:\Temp\kecxupnhfz.sysC:\Temp\kecxupnhfz.sys1⤵
-
C:\Temp\ezxrpjhbzu.sysC:\Temp\ezxrpjhbzu.sys1⤵
-
C:\Temp\ebwuomgezw.sysC:\Temp\ebwuomgezw.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CP.exe
aysqkicavs.sys
cwupmhezxr.exe
dxvpnifaxs.sys
gavtnlfdxt.exe
gbztrljdbw.sys
i_cwupmhezxr.exe
i_gavtnlfdxt.exe
i_kfcxupnhfz.exe
i_oigaytqljd.exe
i_olgeywqojg.exe
i_snlfaysqki.exe
i_ztrmjecwuo.exe
jebwuomgez.sys
kfcxupnhfz.exe
nhfzxspkhc.exe
oigaytqljd.exe
olgeywqojg.exe
qlidbvtnlg.sys
snlfaysqki.exe
usmkecxupn.sys
ytqljdbvtn.sys
ztrmjecwuo.exe
RecoveryStore.{9D1572E8-3900-11F1-87B0-E28DCF3091F7}.dat
RecoveryStore.{9D1599F8-3900-11F1-87B0-E28DCF3091F7}.dat
suggestions[1].en-US
memory/212-90-0x0000000000840000-0x00000000008BA000-memory.dmp
memory/416-169-0x0000000000010000-0x0000000000083000-memory.dmp
memory/436-179-0x0000000000830000-0x00000000008AA000-memory.dmp
memory/536-182-0x0000000000450000-0x00000000004CA000-memory.dmp
memory/564-75-0x00000000008F0000-0x000000000096A000-memory.dmp
memory/688-186-0x0000000000870000-0x00000000008EA000-memory.dmp
memory/740-154-0x0000000000010000-0x0000000000083000-memory.dmp
memory/816-196-0x0000000000660000-0x00000000006DA000-memory.dmp
memory/824-55-0x00000000005F0000-0x000000000066A000-memory.dmp
memory/888-108-0x0000000000670000-0x00000000006EA000-memory.dmp
memory/1060-56-0x0000000000870000-0x00000000008EA000-memory.dmp
memory/1092-146-0x0000000000470000-0x00000000004EA000-memory.dmp
memory/1340-32-0x00000000005A0000-0x000000000061A000-memory.dmp
memory/1396-34-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1396-91-0x0000000000850000-0x00000000008CA000-memory.dmp
memory/1468-11-0x0000000000560000-0x00000000005DA000-memory.dmp
memory/1524-133-0x0000000000600000-0x000000000067A000-memory.dmp
memory/1556-185-0x00000000004E0000-0x000000000055A000-memory.dmp
memory/1644-161-0x0000000000870000-0x00000000008EA000-memory.dmp
memory/1752-176-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1848-109-0x00000000004D0000-0x000000000054A000-memory.dmp
memory/1852-157-0x0000000000860000-0x00000000008DA000-memory.dmp
memory/1916-165-0x0000000000770000-0x00000000007EA000-memory.dmp
memory/1964-25-0x0000000000410000-0x000000000048A000-memory.dmp
memory/1980-84-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2052-171-0x0000000000700000-0x000000000077A000-memory.dmp
memory/2056-62-0x0000000000490000-0x000000000050A000-memory.dmp
memory/2136-10-0x0000000000760000-0x00000000007DA000-memory.dmp
memory/2148-158-0x0000000000890000-0x000000000090A000-memory.dmp
memory/2192-190-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2224-124-0x0000000000740000-0x00000000007BA000-memory.dmp
memory/2236-149-0x00000000005A0000-0x000000000061A000-memory.dmp
memory/2264-47-0x0000000000870000-0x00000000008EA000-memory.dmp
memory/2312-132-0x0000000000880000-0x00000000008FA000-memory.dmp
memory/2332-118-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2384-220-0x00000000008C0000-0x000000000093A000-memory.dmp
memory/2624-41-0x00000000008B0000-0x000000000092A000-memory.dmp
memory/3024-150-0x0000000000830000-0x00000000008AA000-memory.dmp
memory/3076-153-0x00000000004C0000-0x000000000053A000-memory.dmp
memory/3108-97-0x0000000000840000-0x00000000008BA000-memory.dmp
memory/3200-206-0x0000000000660000-0x00000000006DA000-memory.dmp
memory/3308-210-0x0000000000650000-0x00000000006CA000-memory.dmp
memory/3332-172-0x0000000000660000-0x00000000006DA000-memory.dmp
memory/3336-82-0x0000000000880000-0x00000000008FA000-memory.dmp
memory/3548-17-0x0000000000880000-0x00000000008FA000-memory.dmp
memory/3612-197-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3620-67-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3624-199-0x0000000000590000-0x000000000060A000-memory.dmp
memory/3624-130-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3712-217-0x0000000000520000-0x000000000059A000-memory.dmp
memory/3800-219-0x0000000000870000-0x00000000008EA000-memory.dmp
memory/3840-125-0x0000000000870000-0x00000000008EA000-memory.dmp
memory/3944-129-0x0000000000630000-0x00000000006AA000-memory.dmp
memory/3984-193-0x0000000000580000-0x00000000005FA000-memory.dmp
memory/4000-175-0x00000000008A0000-0x000000000091A000-memory.dmp
memory/4036-203-0x00000000008B0000-0x000000000092A000-memory.dmp
memory/4144-189-0x00000000005F0000-0x000000000066A000-memory.dmp
memory/4188-102-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4196-178-0x0000000000860000-0x00000000008DA000-memory.dmp
memory/4260-211-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4304-49-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4308-110-0x0000000000FA0000-0x0000000000FDE000-memory.dmp
memory/4344-162-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4352-204-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4484-155-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4484-147-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4596-192-0x00000000008A0000-0x000000000091A000-memory.dmp
memory/4656-183-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4716-19-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4736-40-0x0000000000500000-0x000000000057A000-memory.dmp
memory/4824-207-0x0000000000530000-0x00000000005AA000-memory.dmp
memory/4912-168-0x0000000000580000-0x00000000005FA000-memory.dmp
memory/4932-26-0x0000000000520000-0x000000000059A000-memory.dmp
memory/4960-214-0x00000000008D0000-0x000000000094A000-memory.dmp
memory/4988-213-0x0000000000770000-0x00000000007EA000-memory.dmp
memory/5000-200-0x0000000000880000-0x00000000008FA000-memory.dmp
memory/5012-164-0x0000000000790000-0x000000000080A000-memory.dmp
memory/5024-116-0x0000000000410000-0x000000000048A000-memory.dmp
memory/5116-76-0x0000000000450000-0x00000000004CA000-memory.dmp