Analysis
- max time kernel
149s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
15/04/2026, 19:41
General
- Target 2026-04-15_f61bdc1a65f7483e68ac88e22313d162_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 376KB
- Sample260415-yeemkahs7k
- SHA256 cf147cace28eb94721b3ff450fee4f38f5a98ba3c22c0eb311769268e4a5548a
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 43 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 35 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 61 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_f61bdc1a65f7483e68ac88e22313d162_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-15_f61bdc1a65f7483e68ac88e22313d162_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\bztrmjebwuomgezw.exeC:\Temp\bztrmjebwuomgezw.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ljebwuomge.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\ljebwuomge.exeC:\Temp\ljebwuomge.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ljebwuomge.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ljebwuomge.exeC:\Temp\i_ljebwuomge.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ywrlgeywqo.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ywrlgeywqo.exeC:\Temp\ywrlgeywqo.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ywrlgeywqo.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ywrlgeywqo.exeC:\Temp\i_ywrlgeywqo.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\oigaysqlid.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\oigaysqlid.exeC:\Temp\oigaysqlid.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_oigaysqlid.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_oigaysqlid.exeC:\Temp\i_oigaysqlid.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vsnidavsnl.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\vsnidavsnl.exeC:\Temp\vsnidavsnl.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vsnidavsnl.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_vsnidavsnl.exeC:\Temp\i_vsnidavsnl.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pnifaysqki.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\pnifaysqki.exeC:\Temp\pnifaysqki.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pnifaysqki.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_pnifaysqki.exeC:\Temp\i_pnifaysqki.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zxspkicaus.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\zxspkicaus.exeC:\Temp\zxspkicaus.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zxspkicaus.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_zxspkicaus.exeC:\Temp\i_zxspkicaus.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pjhbzurmke.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\pjhbzurmke.exeC:\Temp\pjhbzurmke.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pjhbzurmke.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_pjhbzurmke.exeC:\Temp\i_pjhbzurmke.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wuomhbztrm.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\wuomhbztrm.exeC:\Temp\wuomhbztrm.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wuomhbztrm.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_wuomhbztrm.exeC:\Temp\i_wuomhbztrm.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ztrmjecwuo.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ztrmjecwuo.exeC:\Temp\ztrmjecwuo.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ztrmjecwuo.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ztrmjecwuo.exeC:\Temp\i_ztrmjecwuo.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ojgbytrljd.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ojgbytrljd.exeC:\Temp\ojgbytrljd.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ojgbytrljd.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ojgbytrljd.exeC:\Temp\i_ojgbytrljd.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\idbvtnlfdy.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\idbvtnlfdy.exeC:\Temp\idbvtnlfdy.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_idbvtnlfdy.exe ups_ins3⤵
-
C:\Temp\i_idbvtnlfdy.exeC:\Temp\i_idbvtnlfdy.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\aysqkidavt.exe ups_run3⤵
-
C:\Temp\aysqkidavt.exeC:\Temp\aysqkidavt.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_aysqkidavt.exe ups_ins3⤵
-
C:\Temp\i_aysqkidavt.exeC:\Temp\i_aysqkidavt.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xvqnicavsn.exe ups_run3⤵
-
C:\Temp\xvqnicavsn.exeC:\Temp\xvqnicavsn.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xvqnicavsn.exe ups_ins3⤵
-
C:\Temp\i_xvqnicavsn.exeC:\Temp\i_xvqnicavsn.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\snkfdxvpnh.exe ups_run3⤵
-
C:\Temp\snkfdxvpnh.exeC:\Temp\snkfdxvpnh.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_snkfdxvpnh.exe ups_ins3⤵
-
C:\Temp\i_snkfdxvpnh.exeC:\Temp\i_snkfdxvpnh.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\khczusmkec.exe ups_run3⤵
-
C:\Temp\khczusmkec.exeC:\Temp\khczusmkec.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_khczusmkec.exe ups_ins3⤵
-
C:\Temp\i_khczusmkec.exeC:\Temp\i_khczusmkec.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ecwupmhezx.exe ups_run3⤵
-
C:\Temp\ecwupmhezx.exeC:\Temp\ecwupmhezx.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ecwupmhezx.exe ups_ins3⤵
-
C:\Temp\i_ecwupmhezx.exeC:\Temp\i_ecwupmhezx.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hezwrpjhbz.exe ups_run3⤵
-
C:\Temp\hezwrpjhbz.exeC:\Temp\hezwrpjhbz.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hezwrpjhbz.exe ups_ins3⤵
-
C:\Temp\i_hezwrpjhbz.exeC:\Temp\i_hezwrpjhbz.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ywrojgbwto.exe ups_run3⤵
-
C:\Temp\ywrojgbwto.exeC:\Temp\ywrojgbwto.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ywrojgbwto.exe ups_ins3⤵
-
C:\Temp\i_ywrojgbwto.exeC:\Temp\i_ywrojgbwto.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\tnlgdywqoi.exe ups_run3⤵
-
C:\Temp\tnlgdywqoi.exeC:\Temp\tnlgdywqoi.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_tnlgdywqoi.exe ups_ins3⤵
-
C:\Temp\i_tnlgdywqoi.exeC:\Temp\i_tnlgdywqoi.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lfdxvqniga.exe ups_run3⤵
-
C:\Temp\lfdxvqniga.exeC:\Temp\lfdxvqniga.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3212 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Temp\bztrmjebwuomgezw.sysC:\Temp\bztrmjebwuomgezw.sys1⤵
- Executes dropped EXE
-
C:\Temp\jdbvtolgdy.sysC:\Temp\jdbvtolgdy.sys1⤵
- Executes dropped EXE
-
C:\Temp\vtnlgdywqo.sysC:\Temp\vtnlgdywqo.sys1⤵
- Executes dropped EXE
-
C:\Temp\nigaysqlid.sysC:\Temp\nigaysqlid.sys1⤵
- Executes dropped EXE
-
C:\Temp\avsnkfdxvp.sysC:\Temp\avsnkfdxvp.sys1⤵
- Executes dropped EXE
-
C:\Temp\kfcxvpnhfz.sysC:\Temp\kfcxvpnhfz.sys1⤵
- Executes dropped EXE
-
C:\Temp\wupmhfzxrp.sysC:\Temp\wupmhfzxrp.sys1⤵
- Executes dropped EXE
-
C:\Temp\pjhczusmke.sysC:\Temp\pjhczusmke.sys1⤵
- Executes dropped EXE
-
C:\Temp\hbztrljebw.sysC:\Temp\hbztrljebw.sys1⤵
- Executes dropped EXE
-
C:\Temp\wtomgeywqo.sysC:\Temp\wtomgeywqo.sys1⤵
- Executes dropped EXE
-
C:\Temp\qoigaytqlj.sysC:\Temp\qoigaytqlj.sys1⤵
- Executes dropped EXE
-
C:\Temp\tnlgdyvqoi.sysC:\Temp\tnlgdyvqoi.sys1⤵
-
C:\Temp\idavtnlfdx.sysC:\Temp\idavtnlfdx.sys1⤵
-
C:\Temp\ausmkfcxvp.sysC:\Temp\ausmkfcxvp.sys1⤵
-
C:\Temp\upnhfzxrpk.sysC:\Temp\upnhfzxrpk.sys1⤵
-
C:\Temp\xrmkecwupm.sysC:\Temp\xrmkecwupm.sys1⤵
-
C:\Temp\rmkecwuomh.sysC:\Temp\rmkecwuomh.sys1⤵
-
C:\Temp\jebwuomgey.sysC:\Temp\jebwuomgey.sys1⤵
-
C:\Temp\eywqoigbyt.sysC:\Temp\eywqoigbyt.sys1⤵
-
C:\Temp\aytqljdbvt.sysC:\Temp\aytqljdbvt.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CreateProcess.exe
avsnkfdxvp.sys
bztrmjebwuomgezw.exe
bztrmjebwuomgezw.sys
i_ljebwuomge.exe
i_oigaysqlid.exe
i_pjhbzurmke.exe
i_pnifaysqki.exe
i_vsnidavsnl.exe
i_ywrlgeywqo.exe
i_zxspkicaus.exe
jdbvtolgdy.sys
kfcxvpnhfz.sys
ljebwuomge.exe
nigaysqlid.sys
oigaysqlid.exe
pjhbzurmke.exe
pjhczusmke.sys
pnifaysqki.exe
vsnidavsnl.exe
vtnlgdywqo.sys
wuomhbztrm.exe
wupmhfzxrp.sys
ywrlgeywqo.exe
zxspkicaus.exe
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
suggestions[1].en-US
memory/204-76-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/212-123-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1708-33-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2180-152-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2392-133-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2392-127-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3276-88-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3380-164-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3496-144-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3952-148-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3964-45-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3988-100-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4080-21-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4332-62-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4340-106-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4392-160-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4472-7-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4564-140-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4576-131-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4768-136-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4768-156-0x0000000000010000-0x00000000000AB000-memory.dmp