Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
16/04/2026, 21:21
General
- Target 2026-04-16_86a70cf10a255165c3858047a4f8d5b2_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
- Size 291KB
- Sample260416-z7adzsbs8r
- SHA256 369f55e754d50f520e8ba3f20400bb70a987ea8dd2f89a9a883c72b121784eff
Malware Config
Extracted
-
systex
-
http://xytets.com:2345/t.asp?os=wangba8102
-
http://xytets.com:2345/ll/out.txt
-
http://xytets.com:2345/t.asp?os=home8102
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- UPX dump on OEP (original entry point) 64 IoCs
- Executes dropped EXE 64 IoCs
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- System Location Discovery: System Language Discovery 1 TTPs 43 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 54 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 19 IoCs
- Suspicious use of AdjustPrivilegeToken 20 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SetWindowsHookEx 10 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-16_86a70cf10a255165c3858047a4f8d5b2_coinminer_elex_redline-stealer_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-16_86a70cf10a255165c3858047a4f8d5b2_coinminer_elex_redline-stealer_rhadamanthys_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home81022⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4512 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1040 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\mkezxrpjhb.exe ups_run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\mkezxrpjhb.exeC:\Temp\mkezxrpjhb.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_mkezxrpjhb.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_mkezxrpjhb.exeC:\Temp\i_mkezxrpjhb.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\mgeywrojgb.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\mgeywrojgb.exeC:\Temp\mgeywrojgb.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_mgeywrojgb.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_mgeywrojgb.exeC:\Temp\i_mgeywrojgb.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\qljdbvtnlg.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\qljdbvtnlg.exeC:\Temp\qljdbvtnlg.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_qljdbvtnlg.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_qljdbvtnlg.exeC:\Temp\i_qljdbvtnlg.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\gaysqlidbv.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\gaysqlidbv.exeC:\Temp\gaysqlidbv.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_gaysqlidbv.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_gaysqlidbv.exeC:\Temp\i_gaysqlidbv.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\avqnifavpn.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\avqnifavpn.exeC:\Temp\avqnifavpn.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_avqnifavpn.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_avqnifavpn.exeC:\Temp\i_avqnifavpn.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\vsnlfdxvpn.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\vsnlfdxvpn.exeC:\Temp\vsnlfdxvpn.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_vsnlfdxvpn.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_vsnlfdxvpn.exeC:\Temp\i_vsnlfdxvpn.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\kfcxvpnhfx.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\kfcxvpnhfx.exeC:\Temp\kfcxvpnhfx.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_kfcxvpnhfx.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_kfcxvpnhfx.exeC:\Temp\i_kfcxvpnhfx.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\xrpjhczusm.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\xrpjhczusm.exeC:\Temp\xrpjhczusm.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_xrpjhczusm.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_xrpjhczusm.exeC:\Temp\i_xrpjhczusm.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ecwuomgezw.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\ecwuomgezw.exeC:\Temp\ecwuomgezw.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ecwuomgezw.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_ecwuomgezw.exeC:\Temp\i_ecwuomgezw.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\eywrojhbzt.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\eywrojhbzt.exeC:\Temp\eywrojhbzt.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_eywrojhbzt.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_eywrojhbzt.exeC:\Temp\i_eywrojhbzt.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\bwtolgeywq.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\bwtolgeywq.exeC:\Temp\bwtolgeywq.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_bwtolgeywq.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_bwtolgeywq.exeC:\Temp\i_bwtolgeywq.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\vtnlgdyvqo.exe ups_run2⤵
-
C:\Temp\vtnlgdyvqo.exeC:\Temp\vtnlgdyvqo.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_vtnlgdyvqo.exe ups_ins2⤵
-
C:\Temp\i_vtnlgdyvqo.exeC:\Temp\i_vtnlgdyvqo.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\qnifaysqki.exe ups_run2⤵
-
C:\Temp\qnifaysqki.exeC:\Temp\qnifaysqki.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_qnifaysqki.exe ups_ins2⤵
-
C:\Temp\i_qnifaysqki.exeC:\Temp\i_qnifaysqki.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\vqnigaysqk.exe ups_run2⤵
-
C:\Temp\vqnigaysqk.exeC:\Temp\vqnigaysqk.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_vqnigaysqk.exe ups_ins2⤵
-
C:\Temp\i_vqnigaysqk.exeC:\Temp\i_vqnigaysqk.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\pnhfaxsqki.exe ups_run2⤵
-
C:\Temp\pnhfaxsqki.exeC:\Temp\pnhfaxsqki.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_pnhfaxsqki.exe ups_ins2⤵
-
C:\Temp\i_pnhfaxsqki.exeC:\Temp\i_pnhfaxsqki.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\khcausmkec.exe ups_run2⤵
-
C:\Temp\khcausmkec.exeC:\Temp\khcausmkec.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_khcausmkec.exe ups_ins2⤵
-
C:\Temp\i_khcausmkec.exeC:\Temp\i_khcausmkec.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\mherpjhbzu.exe ups_run2⤵
-
C:\Temp\mherpjhbzu.exeC:\Temp\mherpjhbzu.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_mherpjhbzu.exe ups_ins2⤵
-
C:\Temp\i_mherpjhbzu.exeC:\Temp\i_mherpjhbzu.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ecwuomgezw.exe ups_run2⤵
-
C:\Temp\ecwuomgezw.exeC:\Temp\ecwuomgezw.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ecwuomgezw.exe ups_ins2⤵
-
C:\Temp\i_ecwuomgezw.exeC:\Temp\i_ecwuomgezw.exe ups_ins3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\bztrljebwt.exe ups_run2⤵
-
C:\Temp\bztrljebwt.exeC:\Temp\bztrljebwt.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_bztrljebwt.exe ups_ins2⤵
-
C:\Temp\i_bztrljebwt.exeC:\Temp\i_bztrljebwt.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ywqoigbytr.exe ups_run2⤵
-
C:\Temp\ywqoigbytr.exeC:\Temp\ywqoigbytr.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ywqoigbytr.exe ups_ins2⤵
-
C:\Temp\i_ywqoigbytr.exeC:\Temp\i_ywqoigbytr.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Temp\wrojgbztrl.sysC:\Temp\wrojgbztrl.sys1⤵
- Executes dropped EXE
-
C:\Temp\jgbztrljdb.sysC:\Temp\jgbztrljdb.sys1⤵
- Executes dropped EXE
-
C:\Temp\qljdbvtnlg.sysC:\Temp\qljdbvtnlg.sys1⤵
- Executes dropped EXE
-
C:\Temp\qkidavtnlf.sysC:\Temp\qkidavtnlf.sys1⤵
- Executes dropped EXE
-
C:\Temp\faxsqkicav.sysC:\Temp\faxsqkicav.sys1⤵
- Executes dropped EXE
-
C:\Temp\spkicausmk.sysC:\Temp\spkicausmk.sys1⤵
- Executes dropped EXE
-
C:\Temp\hczusmkecw.sysC:\Temp\hczusmkecw.sys1⤵
- Executes dropped EXE
-
C:\Temp\wupmhfzxrp.sysC:\Temp\wupmhfzxrp.sys1⤵
- Executes dropped EXE
-
C:\Temp\ojhbztrmje.sysC:\Temp\ojhbztrmje.sys1⤵
- Executes dropped EXE
-
C:\Temp\geywqoigby.sysC:\Temp\geywqoigby.sys1⤵
-
C:\Temp\idbvtnlfdy.sysC:\Temp\idbvtnlfdy.sys1⤵
-
C:\Temp\gavsnlfdxv.sysC:\Temp\gavsnlfdxv.sys1⤵
-
C:\Temp\ausnkfcxvp.sysC:\Temp\ausnkfcxvp.sys1⤵
-
C:\Temp\cxupfzxrpk.sysC:\Temp\cxupfzxrpk.sys1⤵
-
C:\Temp\xrpkhczusm.sysC:\Temp\xrpkhczusm.sys1⤵
-
C:\Temp\rmjecwuomg.sysC:\Temp\rmjecwuomg.sys1⤵
-
C:\Temp\mgezwrojhb.sysC:\Temp\mgezwrojhb.sys1⤵
-
C:\Temp\olgeywqoiy.sysC:\Temp\olgeywqoiy.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CP.exe
avqnifavpn.exe
faxsqkicav.sys
gaysqlidbv.exe
hczusmkecw.sys
i_avqnifavpn.exe
i_gaysqlidbv.exe
i_kfcxvpnhfx.exe
i_mgeywrojgb.exe
i_mkezxrpjhb.exe
i_qljdbvtnlg.exe
i_vsnlfdxvpn.exe
jgbztrljdb.sys
kfcxvpnhfx.exe
mgeywrojgb.exe
mkezxrpjhb.exe
qkidavtnlf.sys
qljdbvtnlg.exe
qljdbvtnlg.sys
spkicausmk.sys
vsnlfdxvpn.exe
wrojgbztrl.sys
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
RecoveryStore.{2E1269FC-39DA-11F1-8285-F634701597AD}.dat
RecoveryStore.{2E14CE65-39DA-11F1-8285-F634701597AD}.dat
suggestions[1].en-US
memory/640-21-0x0000000000760000-0x00000000007AB000-memory.dmp
memory/640-24-0x0000000000760000-0x00000000007AB000-memory.dmp
memory/856-25-0x0000000000E40000-0x0000000000E8B000-memory.dmp
memory/856-0-0x0000000000E40000-0x0000000000E8B000-memory.dmp
memory/1032-140-0x0000000000170000-0x00000000001BB000-memory.dmp
memory/1032-142-0x0000000000170000-0x00000000001BB000-memory.dmp
memory/1132-143-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1440-157-0x0000000000E60000-0x0000000000EAB000-memory.dmp
memory/1440-156-0x0000000000E60000-0x0000000000EAB000-memory.dmp
memory/1460-206-0x0000000000E50000-0x0000000000E9B000-memory.dmp
memory/1460-205-0x0000000000E50000-0x0000000000E9B000-memory.dmp
memory/1552-187-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1556-194-0x0000000000B50000-0x0000000000B9B000-memory.dmp
memory/1556-192-0x0000000000B50000-0x0000000000B9B000-memory.dmp
memory/1648-41-0x0000000000320000-0x000000000036B000-memory.dmp
memory/1648-39-0x0000000000320000-0x000000000036B000-memory.dmp
memory/1820-148-0x0000000000090000-0x00000000000DB000-memory.dmp
memory/1820-153-0x0000000000090000-0x00000000000DB000-memory.dmp
memory/1996-235-0x00000000008E0000-0x000000000092B000-memory.dmp
memory/1996-233-0x00000000008E0000-0x000000000092B000-memory.dmp
memory/2056-178-0x00000000008E0000-0x000000000092B000-memory.dmp
memory/2056-166-0x00000000008E0000-0x000000000092B000-memory.dmp
memory/2080-103-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2092-243-0x0000000000A30000-0x0000000000A7B000-memory.dmp
memory/2092-241-0x0000000000A30000-0x0000000000A7B000-memory.dmp
memory/2172-203-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2280-211-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2280-220-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2292-198-0x0000000000BB0000-0x0000000000BFB000-memory.dmp
memory/2292-197-0x0000000000BB0000-0x0000000000BFB000-memory.dmp
memory/2312-55-0x00000000004A0000-0x00000000004EB000-memory.dmp
memory/2312-57-0x00000000004A0000-0x00000000004EB000-memory.dmp
memory/2468-123-0x0000000000550000-0x000000000059B000-memory.dmp
memory/2468-126-0x0000000000550000-0x000000000059B000-memory.dmp
memory/2516-17-0x0000000000B60000-0x0000000000BAB000-memory.dmp
memory/2516-15-0x0000000000B60000-0x0000000000BAB000-memory.dmp
memory/2600-63-0x00000000006B0000-0x00000000006FB000-memory.dmp
memory/2600-66-0x00000000006B0000-0x00000000006FB000-memory.dmp
memory/2732-43-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2984-59-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3188-219-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3196-213-0x00000000003A0000-0x00000000003EB000-memory.dmp
memory/3196-214-0x00000000003A0000-0x00000000003EB000-memory.dmp
memory/3296-146-0x0000000000FE0000-0x000000000102B000-memory.dmp
memory/3296-145-0x0000000000FE0000-0x000000000102B000-memory.dmp
memory/3340-107-0x00000000009A0000-0x00000000009EB000-memory.dmp
memory/3340-110-0x00000000009A0000-0x00000000009EB000-memory.dmp
memory/3356-179-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3404-135-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3456-130-0x0000000000C90000-0x0000000000CDB000-memory.dmp
memory/3456-133-0x0000000000C90000-0x0000000000CDB000-memory.dmp
memory/3476-218-0x0000000000900000-0x000000000094B000-memory.dmp
memory/3476-216-0x0000000000900000-0x000000000094B000-memory.dmp
memory/3528-159-0x00000000007E0000-0x000000000082B000-memory.dmp
memory/3528-161-0x00000000007E0000-0x000000000082B000-memory.dmp
memory/3540-184-0x0000000000660000-0x00000000006AB000-memory.dmp
memory/3540-186-0x0000000000660000-0x00000000006AB000-memory.dmp
memory/3568-189-0x00000000000C0000-0x000000000010B000-memory.dmp
memory/3568-190-0x00000000000C0000-0x000000000010B000-memory.dmp
memory/3732-195-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3832-91-0x0000000000D30000-0x0000000000D7B000-memory.dmp
memory/3832-94-0x0000000000D30000-0x0000000000D7B000-memory.dmp
memory/3932-225-0x0000000000550000-0x000000000059B000-memory.dmp
memory/3932-227-0x0000000000550000-0x000000000059B000-memory.dmp
memory/4044-114-0x0000000000D30000-0x0000000000D7B000-memory.dmp
memory/4044-117-0x0000000000D30000-0x0000000000D7B000-memory.dmp
memory/4044-228-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4184-85-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4324-119-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4356-50-0x0000000000D50000-0x0000000000D9B000-memory.dmp
memory/4356-47-0x0000000000D50000-0x0000000000D9B000-memory.dmp
memory/4364-32-0x0000000000BD0000-0x0000000000C1B000-memory.dmp
memory/4364-34-0x0000000000BD0000-0x0000000000C1B000-memory.dmp
memory/4388-137-0x0000000000CA0000-0x0000000000CEB000-memory.dmp
memory/4388-138-0x0000000000CA0000-0x0000000000CEB000-memory.dmp
memory/4532-236-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4548-101-0x0000000000110000-0x000000000015B000-memory.dmp
memory/4548-99-0x0000000000110000-0x000000000015B000-memory.dmp
memory/4548-223-0x0000000000500000-0x000000000054B000-memory.dmp
memory/4548-222-0x0000000000500000-0x000000000054B000-memory.dmp
memory/4584-182-0x00000000007E0000-0x000000000082B000-memory.dmp
memory/4584-181-0x00000000007E0000-0x000000000082B000-memory.dmp
memory/4628-164-0x0000000000240000-0x000000000028B000-memory.dmp
memory/4628-163-0x0000000000240000-0x000000000028B000-memory.dmp
memory/4696-210-0x00000000004B0000-0x00000000004FB000-memory.dmp
memory/4696-208-0x00000000004B0000-0x00000000004FB000-memory.dmp
memory/4700-83-0x0000000000750000-0x000000000079B000-memory.dmp
memory/4700-71-0x0000000000750000-0x000000000079B000-memory.dmp
memory/4804-200-0x0000000000CA0000-0x0000000000CEB000-memory.dmp
memory/4804-202-0x0000000000CA0000-0x0000000000CEB000-memory.dmp
memory/4804-239-0x0000000000820000-0x000000000086B000-memory.dmp
memory/4804-238-0x0000000000820000-0x000000000086B000-memory.dmp
memory/4812-230-0x00000000009A0000-0x00000000009EB000-memory.dmp
memory/4812-231-0x00000000009A0000-0x00000000009EB000-memory.dmp
memory/4972-154-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5044-27-0x0000000000010000-0x0000000000083000-memory.dmp