Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
16/04/2026, 04:10
General
- Target 2026-04-16_d9dcacfbc90a6927b0144949c000d977_amadey_darkgate_elex_smoke-loader_stop.exe
- Size 384KB
- Sample260416-erk6bsft2k
- SHA256 136f392164caa657d55d43d4d9a9eed163fd0d49e19059725cb12f1cf50f0c6a
Score
10/10
Malware Config
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 43 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 31 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 62 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-16_d9dcacfbc90a6927b0144949c000d977_amadey_darkgate_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-16_d9dcacfbc90a6927b0144949c000d977_amadey_darkgate_elex_smoke-loader_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\xrpkhcausmkecxup.exeC:\Temp\xrpkhcausmkecxup.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fzxrpkhcau.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\fzxrpkhcau.exeC:\Temp\fzxrpkhcau.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fzxrpkhcau.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_fzxrpkhcau.exeC:\Temp\i_fzxrpkhcau.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zuomecwuom.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\zuomecwuom.exeC:\Temp\zuomecwuom.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zuomecwuom.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_zuomecwuom.exeC:\Temp\i_zuomecwuom.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gbztrljebw.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\gbztrljebw.exeC:\Temp\gbztrljebw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gbztrljebw.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_gbztrljebw.exeC:\Temp\i_gbztrljebw.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\tolgbvtolg.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\tolgbvtolg.exeC:\Temp\tolgbvtolg.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_tolgbvtolg.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_tolgbvtolg.exeC:\Temp\i_tolgbvtolg.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\oigbytqljd.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\oigbytqljd.exeC:\Temp\oigbytqljd.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_oigbytqljd.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_oigbytqljd.exeC:\Temp\i_oigbytqljd.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dyvqofdyvq.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\dyvqofdyvq.exeC:\Temp\dyvqofdyvq.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dyvqofdyvq.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_dyvqofdyvq.exeC:\Temp\i_dyvqofdyvq.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nkfdxvpnif.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\nkfdxvpnif.exeC:\Temp\nkfdxvpnif.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nkfdxvpnif.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_nkfdxvpnif.exeC:\Temp\i_nkfdxvpnif.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dxspkicxvp.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\dxspkicxvp.exeC:\Temp\dxspkicxvp.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dxspkicxvp.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_dxspkicxvp.exeC:\Temp\i_dxspkicxvp.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\cxupnhfzxr.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\cxupnhfzxr.exeC:\Temp\cxupnhfzxr.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_cxupnhfzxr.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_cxupnhfzxr.exeC:\Temp\i_cxupnhfzxr.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\upmhfzxrpj.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\upmhfzxrpj.exeC:\Temp\upmhfzxrpj.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_upmhfzxrpj.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_upmhfzxrpj.exeC:\Temp\i_upmhfzxrpj.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\geywrojhbz.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\geywrojhbz.exeC:\Temp\geywrojhbz.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_geywrojhbz.exe ups_ins3⤵
-
C:\Temp\i_geywrojhbz.exeC:\Temp\i_geywrojhbz.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\eywqojgbyt.exe ups_run3⤵
-
C:\Temp\eywqojgbyt.exeC:\Temp\eywqojgbyt.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_eywqojgbyt.exe ups_ins3⤵
-
C:\Temp\i_eywqojgbyt.exeC:\Temp\i_eywqojgbyt.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\eywqojgbwt.exe ups_run3⤵
-
C:\Temp\eywqojgbwt.exeC:\Temp\eywqojgbwt.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_eywqojgbwt.exe ups_ins3⤵
-
C:\Temp\i_eywqojgbwt.exeC:\Temp\i_eywqojgbwt.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vqoigaysql.exe ups_run3⤵
-
C:\Temp\vqoigaysql.exeC:\Temp\vqoigaysql.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vqoigaysql.exe ups_ins3⤵
-
C:\Temp\i_vqoigaysql.exeC:\Temp\i_vqoigaysql.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qkidavtnlf.exe ups_run3⤵
-
C:\Temp\qkidavtnlf.exeC:\Temp\qkidavtnlf.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qkidavtnlf.exe ups_ins3⤵
-
C:\Temp\i_qkidavtnlf.exeC:\Temp\i_qkidavtnlf.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\faxspkicau.exe ups_run3⤵
-
C:\Temp\faxspkicau.exeC:\Temp\faxspkicau.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_faxspkicau.exe ups_ins3⤵
-
C:\Temp\i_faxspkicau.exeC:\Temp\i_faxspkicau.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\icausnkfcx.exe ups_run3⤵
-
C:\Temp\icausnkfcx.exeC:\Temp\icausnkfcx.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_icausnkfcx.exe ups_ins3⤵
-
C:\Temp\i_icausnkfcx.exeC:\Temp\i_icausnkfcx.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zxrpjhczup.exe ups_run3⤵
-
C:\Temp\zxrpjhczup.exeC:\Temp\zxrpjhczup.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zxrpjhczup.exe ups_ins3⤵
-
C:\Temp\i_zxrpjhczup.exeC:\Temp\i_zxrpjhczup.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rmhbztrmje.exe ups_run3⤵
-
C:\Temp\rmhbztrmje.exeC:\Temp\rmhbztrmje.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rmhbztrmje.exe ups_ins3⤵
-
C:\Temp\i_rmhbztrmje.exeC:\Temp\i_rmhbztrmje.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gbztrljdbw.exe ups_run3⤵
-
C:\Temp\gbztrljdbw.exeC:\Temp\gbztrljdbw.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3948 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Temp\xrpkhcausmkecxup.sysC:\Temp\xrpkhcausmkecxup.sys1⤵
- Executes dropped EXE
-
C:\Temp\hezxrpjhbz.sysC:\Temp\hezxrpjhbz.sys1⤵
- Executes dropped EXE
-
C:\Temp\wmgeywrojh.sysC:\Temp\wmgeywrojh.sys1⤵
- Executes dropped EXE
-
C:\Temp\jhbztrljeb.sysC:\Temp\jhbztrljeb.sys1⤵
- Executes dropped EXE
-
C:\Temp\vtolgeywqo.sysC:\Temp\vtolgeywqo.sys1⤵
- Executes dropped EXE
-
C:\Temp\ljdbvtnlgd.sysC:\Temp\ljdbvtnlgd.sys1⤵
- Executes dropped EXE
-
C:\Temp\ysqkicavsn.sysC:\Temp\ysqkicavsn.sys1⤵
- Executes dropped EXE
-
C:\Temp\snkfdxvpnh.sysC:\Temp\snkfdxvpnh.sys1⤵
- Executes dropped EXE
-
C:\Temp\khcausmkfc.sysC:\Temp\khcausmkfc.sys1⤵
- Executes dropped EXE
-
C:\Temp\cwupmhezxr.sysC:\Temp\cwupmhezxr.sys1⤵
- Executes dropped EXE
-
C:\Temp\rpjhbzurmj.sysC:\Temp\rpjhbzurmj.sys1⤵
- Executes dropped EXE
-
C:\Temp\trljebwuom.sysC:\Temp\trljebwuom.sys1⤵
-
C:\Temp\lgeywqoigb.sysC:\Temp\lgeywqoigb.sys1⤵
-
C:\Temp\dbvtnlgdyv.sysC:\Temp\dbvtnlgdyv.sys1⤵
-
C:\Temp\yvqoigaysq.sysC:\Temp\yvqoigaysq.sys1⤵
-
C:\Temp\vsnlfdxvpn.sysC:\Temp\vsnlfdxvpn.sys1⤵
-
C:\Temp\pnhfaxsqki.sysC:\Temp\pnhfaxsqki.sys1⤵
-
C:\Temp\kecxupmhfz.sysC:\Temp\kecxupmhfz.sys1⤵
-
C:\Temp\hfrpjhczur.sysC:\Temp\hfrpjhczur.sys1⤵
-
C:\Temp\zuomgezwrp.sysC:\Temp\zuomgezwrp.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CreateProcess.exe
dxspkicxvp.exe
dyvqofdyvq.exe
fzxrpkhcau.exe
gbztrljebw.exe
hezxrpjhbz.sys
i_dyvqofdyvq.exe
i_fzxrpkhcau.exe
i_gbztrljebw.exe
i_nkfdxvpnif.exe
i_oigbytqljd.exe
i_tolgbvtolg.exe
i_zuomecwuom.exe
jhbztrljeb.sys
ljdbvtnlgd.sys
nkfdxvpnif.exe
oigbytqljd.exe
snkfdxvpnh.sys
tolgbvtolg.exe
vtolgeywqo.sys
wmgeywrojh.sys
xrpkhcausmkecxup.exe
xrpkhcausmkecxup.sys
ysqkicavsn.sys
zuomecwuom.exe
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
suggestions[1].en-US
memory/712-77-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/864-110-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1624-166-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1628-62-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2052-94-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2700-158-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2780-138-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3068-150-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3408-130-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3660-142-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4344-154-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4456-171-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4484-146-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4524-38-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4676-50-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4732-134-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4736-14-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4796-162-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4796-167-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5044-21-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5092-116-0x0000000000010000-0x00000000000AB000-memory.dmp