Analysis
- max time kernel
149s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
16/04/2026, 03:52
General
- Target 2026-04-16_364391356d5c3a6f5536be69ebe135a9_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
- Size 291KB
- Sample260416-ee82mae17k
- SHA256 772485700f1e2b1b014c44cd7bbbaa36881338bf6b1e9f6bc108ee7eb5c6d5ab
Malware Config
Extracted
-
systex
-
http://xytets.com:2345/t.asp?os=wangba8102
-
http://xytets.com:2345/ll/out.txt
-
http://xytets.com:2345/t.asp?os=home8102
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Custom signatureUPX dump on OEP (original entry point) 64 IoCs
- Executes dropped EXE 64 IoCs
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- System Location Discovery: System Language Discovery 1 TTPs 43 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 51 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 19 IoCs
- Suspicious use of AdjustPrivilegeToken 20 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SetWindowsHookEx 10 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-16_364391356d5c3a6f5536be69ebe135a9_coinminer_elex_redline-stealer_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-16_364391356d5c3a6f5536be69ebe135a9_coinminer_elex_redline-stealer_rhadamanthys_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home81022⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1044 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5116 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\upkhcauskh.exe ups_run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\upkhcauskh.exeC:\Temp\upkhcauskh.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_upkhcauskh.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_upkhcauskh.exeC:\Temp\i_upkhcauskh.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\wupmhezxrp.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\wupmhezxrp.exeC:\Temp\wupmhezxrp.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_wupmhezxrp.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_wupmhezxrp.exeC:\Temp\i_wupmhezxrp.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\hbztrlgbzt.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\hbztrlgbzt.exeC:\Temp\hbztrlgbzt.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_hbztrlgbzt.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_hbztrlgbzt.exeC:\Temp\i_hbztrlgbzt.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\wqoigbytrl.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\wqoigbytrl.exeC:\Temp\wqoigbytrl.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_wqoigbytrl.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_wqoigbytrl.exeC:\Temp\i_wqoigbytrl.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\wqoigaytql.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\wqoigaytql.exeC:\Temp\wqoigaytql.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_wqoigaytql.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_wqoigaytql.exeC:\Temp\i_wqoigaytql.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\igbvtnlfdy.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\igbvtnlfdy.exeC:\Temp\igbvtnlfdy.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_igbvtnlfdy.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_igbvtnlfdy.exeC:\Temp\i_igbvtnlfdy.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\aysqkidavs.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\aysqkidavs.exeC:\Temp\aysqkidavs.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_aysqkidavs.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_aysqkidavs.exeC:\Temp\i_aysqkidavs.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\qkicausnkf.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\qkicausnkf.exeC:\Temp\qkicausnkf.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_qkicausnkf.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_qkicausnkf.exeC:\Temp\i_qkicausnkf.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\nhfzxrpkhc.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\nhfzxrpkhc.exeC:\Temp\nhfzxrpkhc.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_nhfzxrpkhc.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_nhfzxrpkhc.exeC:\Temp\i_nhfzxrpkhc.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ecwupmhfzx.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\ecwupmhfzx.exeC:\Temp\ecwupmhfzx.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ecwupmhfzx.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_ecwupmhfzx.exeC:\Temp\i_ecwupmhfzx.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ztrljebwuo.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\ztrljebwuo.exeC:\Temp\ztrljebwuo.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ztrljebwuo.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_ztrljebwuo.exeC:\Temp\i_ztrljebwuo.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\trljdbwtol.exe ups_run2⤵
-
C:\Temp\trljdbwtol.exeC:\Temp\trljdbwtol.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_trljdbwtol.exe ups_ins2⤵
-
C:\Temp\i_trljdbwtol.exeC:\Temp\i_trljdbwtol.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\wtolgeywqo.exe ups_run2⤵
-
C:\Temp\wtolgeywqo.exeC:\Temp\wtolgeywqo.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_wtolgeywqo.exe ups_ins2⤵
-
C:\Temp\i_wtolgeywqo.exeC:\Temp\i_wtolgeywqo.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\tnlgdywqoi.exe ups_run2⤵
-
C:\Temp\tnlgdywqoi.exeC:\Temp\tnlgdywqoi.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_tnlgdywqoi.exe ups_ins2⤵
-
C:\Temp\i_tnlgdywqoi.exeC:\Temp\i_tnlgdywqoi.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\qlidavtnlf.exe ups_run2⤵
-
C:\Temp\qlidavtnlf.exeC:\Temp\qlidavtnlf.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_qlidavtnlf.exe ups_ins2⤵
-
C:\Temp\i_qlidavtnlf.exeC:\Temp\i_qlidavtnlf.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\kfdxvpnhfa.exe ups_run2⤵
-
C:\Temp\kfdxvpnhfa.exeC:\Temp\kfdxvpnhfa.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_kfdxvpnhfa.exe ups_ins2⤵
-
C:\Temp\i_kfdxvpnhfa.exeC:\Temp\i_kfdxvpnhfa.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\qkicausnkf.exe ups_run2⤵
-
C:\Temp\qkicausnkf.exeC:\Temp\qkicausnkf.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_qkicausnkf.exe ups_ins2⤵
-
C:\Temp\i_qkicausnkf.exeC:\Temp\i_qkicausnkf.exe ups_ins3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\kecxupmhfz.exe ups_run2⤵
-
C:\Temp\kecxupmhfz.exeC:\Temp\kecxupmhfz.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_kecxupmhfz.exe ups_ins2⤵
-
C:\Temp\i_kecxupmhfz.exeC:\Temp\i_kecxupmhfz.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ezwrpjhbzu.exe ups_run2⤵
-
C:\Temp\ezwrpjhbzu.exeC:\Temp\ezwrpjhbzu.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ezwrpjhbzu.exe ups_ins2⤵
-
C:\Temp\i_ezwrpjhbzu.exeC:\Temp\i_ezwrpjhbzu.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\bwuomgeywr.exe ups_run2⤵
-
C:\Temp\bwuomgeywr.exeC:\Temp\bwuomgeywr.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_bwuomgeywr.exe ups_ins2⤵
-
C:\Temp\i_bwuomgeywr.exeC:\Temp\i_bwuomgeywr.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Temp\hbzurmkecw.sysC:\Temp\hbzurmkecw.sys1⤵
- Executes dropped EXE
-
C:\Temp\omgeywrojh.sysC:\Temp\omgeywrojh.sys1⤵
- Executes dropped EXE
-
C:\Temp\ojhbztrlje.sysC:\Temp\ojhbztrlje.sys1⤵
- Executes dropped EXE
-
C:\Temp\gbytrljdbv.sysC:\Temp\gbytrljdbv.sys1⤵
- Executes dropped EXE
-
C:\Temp\tnlfdyvqoi.sysC:\Temp\tnlfdyvqoi.sys1⤵
- Executes dropped EXE
-
C:\Temp\ifaxsqkica.sysC:\Temp\ifaxsqkica.sys1⤵
- Executes dropped EXE
-
C:\Temp\fdxvpnhfax.sysC:\Temp\fdxvpnhfax.sys1⤵
- Executes dropped EXE
-
C:\Temp\xspkicausm.sysC:\Temp\xspkicausm.sys1⤵
- Executes dropped EXE
-
C:\Temp\pjhbzurmke.sysC:\Temp\pjhbzurmke.sys1⤵
- Executes dropped EXE
-
C:\Temp\gezwrpjhbz.sysC:\Temp\gezwrpjhbz.sys1⤵
- Executes dropped EXE
-
C:\Temp\mgeywrojhb.sysC:\Temp\mgeywrojhb.sys1⤵
-
C:\Temp\dysqlidbvt.sysC:\Temp\dysqlidbvt.sys1⤵
-
C:\Temp\xvqnigaysq.sysC:\Temp\xvqnigaysq.sys1⤵
-
C:\Temp\dysqkicavs.sysC:\Temp\dysqkicavs.sys1⤵
-
C:\Temp\avpnhfzxsp.sysC:\Temp\avpnhfzxsp.sys1⤵
-
C:\Temp\upmhfzxrpk.sysC:\Temp\upmhfzxrpk.sys1⤵
-
C:\Temp\mkecwuomhe.sysC:\Temp\mkecwuomhe.sys1⤵
-
C:\Temp\rpjhbzurmk.sysC:\Temp\rpjhbzurmk.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
aysqkidavs.exe
fdxvpnhfax.sys
gbytrljdbv.sys
hbztrlgbzt.exe
hbzurmkecw.sys
i_aysqkidavs.exe
i_hbztrlgbzt.exe
i_igbvtnlfdy.exe
i_upkhcauskh.exe
i_wqoigaytql.exe
i_wqoigbytrl.exe
i_wupmhezxrp.exe
ifaxsqkica.sys
igbvtnlfdy.exe
ojhbztrlje.sys
omgeywrojh.sys
tnlfdyvqoi.sys
upkhcauskh.exe
wqoigaytql.exe
wqoigbytrl.exe
wupmhezxrp.exe
8A7891822FCFF127E4EADADE9757112B
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
8A7891822FCFF127E4EADADE9757112B
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
RecoveryStore.{AD9B3A17-3947-11F1-A918-7AB34D7E7C3E}.dat
RecoveryStore.{AD9D9BC6-3947-11F1-A918-7AB34D7E7C3E}.dat
suggestions[1].en-US
CP.exe
memory/216-247-0x00000000002E0000-0x000000000032B000-memory.dmp
memory/216-245-0x00000000002E0000-0x000000000032B000-memory.dmp
memory/628-41-0x0000000000CA0000-0x0000000000CEB000-memory.dmp
memory/628-38-0x0000000000CA0000-0x0000000000CEB000-memory.dmp
memory/652-105-0x0000000000F30000-0x0000000000F7B000-memory.dmp
memory/652-108-0x0000000000F30000-0x0000000000F7B000-memory.dmp
memory/828-54-0x0000000000950000-0x000000000099B000-memory.dmp
memory/828-57-0x0000000000950000-0x000000000099B000-memory.dmp
memory/1360-216-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1460-125-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1560-213-0x0000000000F00000-0x0000000000F4B000-memory.dmp
memory/1560-215-0x0000000000F00000-0x0000000000F4B000-memory.dmp
memory/1580-149-0x0000000000A30000-0x0000000000A7B000-memory.dmp
memory/1580-147-0x0000000000A30000-0x0000000000A7B000-memory.dmp
memory/2032-224-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2032-59-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2036-66-0x0000000000320000-0x000000000036B000-memory.dmp
memory/2036-64-0x0000000000320000-0x000000000036B000-memory.dmp
memory/2188-180-0x0000000000DB0000-0x0000000000DFB000-memory.dmp
memory/2188-179-0x0000000000DB0000-0x0000000000DFB000-memory.dmp
memory/2252-199-0x00000000001C0000-0x000000000020B000-memory.dmp
memory/2252-197-0x00000000001C0000-0x000000000020B000-memory.dmp
memory/2496-235-0x0000000000060000-0x00000000000AB000-memory.dmp
memory/2496-234-0x0000000000060000-0x00000000000AB000-memory.dmp
memory/2728-208-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2824-22-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3004-218-0x0000000000FE0000-0x000000000102B000-memory.dmp
memory/3004-219-0x0000000000FE0000-0x000000000102B000-memory.dmp
memory/3252-153-0x0000000000EC0000-0x0000000000F0B000-memory.dmp
memory/3252-152-0x0000000000EC0000-0x0000000000F0B000-memory.dmp
memory/3320-169-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3320-150-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3344-203-0x00000000003F0000-0x000000000043B000-memory.dmp
memory/3344-202-0x00000000003F0000-0x000000000043B000-memory.dmp
memory/3356-144-0x0000000000E60000-0x0000000000EAB000-memory.dmp
memory/3356-145-0x0000000000E60000-0x0000000000EAB000-memory.dmp
memory/3864-177-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3920-129-0x00000000002A0000-0x00000000002EB000-memory.dmp
memory/3920-132-0x00000000002A0000-0x00000000002EB000-memory.dmp
memory/3996-141-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4012-211-0x0000000000BE0000-0x0000000000C2B000-memory.dmp
memory/4012-210-0x0000000000BE0000-0x0000000000C2B000-memory.dmp
memory/4180-190-0x00000000009A0000-0x00000000009EB000-memory.dmp
memory/4180-192-0x00000000009A0000-0x00000000009EB000-memory.dmp
memory/4196-200-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4220-231-0x0000000000BB0000-0x0000000000BFB000-memory.dmp
memory/4220-229-0x0000000000BB0000-0x0000000000BFB000-memory.dmp
memory/4256-242-0x0000000000D70000-0x0000000000DBB000-memory.dmp
memory/4256-243-0x0000000000D70000-0x0000000000DBB000-memory.dmp
memory/4268-43-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4276-16-0x0000000000160000-0x00000000001AB000-memory.dmp
memory/4276-19-0x0000000000160000-0x00000000001AB000-memory.dmp
memory/4380-240-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4380-185-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4384-89-0x0000000000B60000-0x0000000000BAB000-memory.dmp
memory/4384-92-0x0000000000B60000-0x0000000000BAB000-memory.dmp
memory/4516-101-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4528-232-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4704-29-0x0000000000DF0000-0x0000000000E3B000-memory.dmp
memory/4704-27-0x0000000000DF0000-0x0000000000E3B000-memory.dmp
memory/4824-168-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4824-226-0x0000000000300000-0x000000000034B000-memory.dmp
memory/4824-227-0x0000000000300000-0x000000000034B000-memory.dmp
memory/4836-237-0x0000000000C60000-0x0000000000CAB000-memory.dmp
memory/4836-239-0x0000000000C60000-0x0000000000CAB000-memory.dmp
memory/4852-10-0x0000000000CE0000-0x0000000000D2B000-memory.dmp
memory/4852-12-0x0000000000CE0000-0x0000000000D2B000-memory.dmp
memory/4972-221-0x0000000000E80000-0x0000000000ECB000-memory.dmp
memory/4972-223-0x0000000000E80000-0x0000000000ECB000-memory.dmp
memory/5080-171-0x0000000000BF0000-0x0000000000C3B000-memory.dmp
memory/5080-172-0x0000000000BF0000-0x0000000000C3B000-memory.dmp
memory/5176-139-0x0000000000540000-0x000000000058B000-memory.dmp
memory/5176-136-0x0000000000540000-0x000000000058B000-memory.dmp
memory/5220-205-0x0000000000520000-0x000000000056B000-memory.dmp
memory/5220-207-0x0000000000520000-0x000000000056B000-memory.dmp
memory/5256-71-0x0000000000760000-0x00000000007AB000-memory.dmp
memory/5256-73-0x0000000000760000-0x00000000007AB000-memory.dmp
memory/5432-195-0x0000000000F40000-0x0000000000F8B000-memory.dmp
memory/5432-194-0x0000000000F40000-0x0000000000F8B000-memory.dmp
memory/5476-83-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5556-112-0x0000000000180000-0x00000000001CB000-memory.dmp
memory/5556-123-0x0000000000180000-0x00000000001CB000-memory.dmp
memory/5572-20-0x0000000000330000-0x000000000037B000-memory.dmp
memory/5572-0-0x0000000000330000-0x000000000037B000-memory.dmp
memory/5612-187-0x0000000000950000-0x000000000099B000-memory.dmp
memory/5612-188-0x0000000000950000-0x000000000099B000-memory.dmp
memory/5736-176-0x0000000000B30000-0x0000000000B7B000-memory.dmp
memory/5736-174-0x0000000000B30000-0x0000000000B7B000-memory.dmp
memory/5788-48-0x0000000000AF0000-0x0000000000B3B000-memory.dmp
memory/5788-50-0x0000000000AF0000-0x0000000000B3B000-memory.dmp
memory/6076-167-0x00000000004A0000-0x00000000004EB000-memory.dmp
memory/6076-155-0x00000000004A0000-0x00000000004EB000-memory.dmp
memory/6120-96-0x00000000008E0000-0x000000000092B000-memory.dmp
memory/6120-99-0x00000000008E0000-0x000000000092B000-memory.dmp
memory/6136-184-0x0000000000BF0000-0x0000000000C3B000-memory.dmp
memory/6136-182-0x0000000000BF0000-0x0000000000C3B000-memory.dmp