Analysis
- max time kernel
149s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
17/04/2026, 11:48
General
- Target 2026-04-17_9c294f0ed21e140118f5943574dc5981_elex_redline-stealer_rhadamanthys_stop.exe
- Size 230KB
- Sample260417-nywebafw2x
- SHA256 d61449b7fb1702699a2fda555e7c677755a728b47197d1180fbe369e54dd9656
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba8102
-
http://xytets.com:2345/ll/out.txt
-
http://xytets.com:2345/t.asp?os=home8102
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 44 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 55 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious use of AdjustPrivilegeToken 20 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SetWindowsHookEx 10 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-17_9c294f0ed21e140118f5943574dc5981_elex_redline-stealer_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-17_9c294f0ed21e140118f5943574dc5981_elex_redline-stealer_rhadamanthys_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home81022⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4540 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4604 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\mhfzxrpjhc.exe ups_run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\mhfzxrpjhc.exeC:\Temp\mhfzxrpjhc.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_mhfzxrpjhc.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_mhfzxrpjhc.exeC:\Temp\i_mhfzxrpjhc.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\heztrmjecw.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\heztrmjecw.exeC:\Temp\heztrmjecw.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_heztrmjecw.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_heztrmjecw.exeC:\Temp\i_heztrmjecw.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\bwuomgeywr.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\bwuomgeywr.exeC:\Temp\bwuomgeywr.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_bwuomgeywr.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_bwuomgeywr.exeC:\Temp\i_bwuomgeywr.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\wqoigbytrl.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\wqoigbytrl.exeC:\Temp\wqoigbytrl.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_wqoigbytrl.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_wqoigbytrl.exeC:\Temp\i_wqoigbytrl.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\qoigaysqli.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\qoigaysqli.exeC:\Temp\qoigaysqli.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_qoigaysqli.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_qoigaysqli.exeC:\Temp\i_qoigaysqli.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\tnlfdyvqoi.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\tnlfdyvqoi.exeC:\Temp\tnlfdyvqoi.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_tnlfdyvqoi.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_tnlfdyvqoi.exeC:\Temp\i_tnlfdyvqoi.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\nifaxsqkic.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\nifaxsqkic.exeC:\Temp\nifaxsqkic.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_nifaxsqkic.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_nifaxsqkic.exeC:\Temp\i_nifaxsqkic.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\icausnkfcx.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\icausnkfcx.exeC:\Temp\icausnkfcx.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_icausnkfcx.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_icausnkfcx.exeC:\Temp\i_icausnkfcx.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\upmhfzxrpj.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\upmhfzxrpj.exeC:\Temp\upmhfzxrpj.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_upmhfzxrpj.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_upmhfzxrpj.exeC:\Temp\i_upmhfzxrpj.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\zurmkecwuo.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\zurmkecwuo.exeC:\Temp\zurmkecwuo.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_zurmkecwuo.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_zurmkecwuo.exeC:\Temp\i_zurmkecwuo.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\wrojhbztrm.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\wrojhbztrm.exeC:\Temp\wrojhbztrm.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_wrojhbztrm.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_wrojhbztrm.exeC:\Temp\i_wrojhbztrm.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\tojgbytrlj.exe ups_run2⤵
-
C:\Temp\tojgbytrlj.exeC:\Temp\tojgbytrlj.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_tojgbytrlj.exe ups_ins2⤵
-
C:\Temp\i_tojgbytrlj.exeC:\Temp\i_tojgbytrlj.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\rljdbvtolg.exe ups_run2⤵
-
C:\Temp\rljdbvtolg.exeC:\Temp\rljdbvtolg.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_rljdbvtolg.exe ups_ins2⤵
-
C:\Temp\i_rljdbvtolg.exeC:\Temp\i_rljdbvtolg.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\vtnlgdyvqo.exe ups_run2⤵
-
C:\Temp\vtnlgdyvqo.exeC:\Temp\vtnlgdyvqo.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_vtnlgdyvqo.exe ups_ins2⤵
-
C:\Temp\i_vtnlgdyvqo.exeC:\Temp\i_vtnlgdyvqo.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\qnifaysqki.exe ups_run2⤵
-
C:\Temp\qnifaysqki.exeC:\Temp\qnifaysqki.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_qnifaysqki.exe ups_ins2⤵
-
C:\Temp\i_qnifaysqki.exeC:\Temp\i_qnifaysqki.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\nkfdxvpnhf.exe ups_run2⤵
-
C:\Temp\nkfdxvpnhf.exeC:\Temp\nkfdxvpnhf.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_nkfdxvpnhf.exe ups_ins2⤵
-
C:\Temp\i_nkfdxvpnhf.exeC:\Temp\i_nkfdxvpnhf.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\khczusmkec.exe ups_run2⤵
-
C:\Temp\khczusmkec.exeC:\Temp\khczusmkec.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_khczusmkec.exe ups_ins2⤵
-
C:\Temp\i_khczusmkec.exeC:\Temp\i_khczusmkec.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\pjhczurmke.exe ups_run2⤵
-
C:\Temp\pjhczurmke.exeC:\Temp\pjhczurmke.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_pjhczurmke.exe ups_ins2⤵
-
C:\Temp\i_pjhczurmke.exeC:\Temp\i_pjhczurmke.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\pjhbzurmke.exe ups_run2⤵
-
C:\Temp\pjhbzurmke.exeC:\Temp\pjhbzurmke.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_pjhbzurmke.exe ups_ins2⤵
-
C:\Temp\i_pjhbzurmke.exeC:\Temp\i_pjhbzurmke.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ljebwuomge.exe ups_run2⤵
-
C:\Temp\ljebwuomge.exeC:\Temp\ljebwuomge.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ljebwuomge.exe ups_ins2⤵
-
C:\Temp\i_ljebwuomge.exeC:\Temp\i_ljebwuomge.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Temp\rpjhczurmk.sysC:\Temp\rpjhczurmk.sys1⤵
- Executes dropped EXE
-
C:\Temp\jgbztrljeb.sysC:\Temp\jgbztrljeb.sys1⤵
- Executes dropped EXE
-
C:\Temp\dbwtolgeyw.sysC:\Temp\dbwtolgeyw.sys1⤵
- Executes dropped EXE
-
C:\Temp\idbvtolgey.sysC:\Temp\idbvtolgey.sys1⤵
- Executes dropped EXE
-
C:\Temp\aytqlidbvt.sysC:\Temp\aytqlidbvt.sys1⤵
- Executes dropped EXE
-
C:\Temp\ysqkidavsn.sysC:\Temp\ysqkidavsn.sys1⤵
- Executes dropped EXE
-
C:\Temp\pkhcausmkf.sysC:\Temp\pkhcausmkf.sys1⤵
- Executes dropped EXE
-
C:\Temp\kicausmkfc.sysC:\Temp\kicausmkfc.sys1⤵
- Executes dropped EXE
-
C:\Temp\hezxrpjhcz.sysC:\Temp\hezxrpjhcz.sys1⤵
- Executes dropped EXE
-
C:\Temp\ecwuomgezw.sysC:\Temp\ecwuomgezw.sys1⤵
- Executes dropped EXE
-
C:\Temp\bztrljebwu.sysC:\Temp\bztrljebwu.sys1⤵
-
C:\Temp\gbytrljdbv.sysC:\Temp\gbytrljdbv.sys1⤵
-
C:\Temp\gaytqljdbv.sysC:\Temp\gaytqljdbv.sys1⤵
-
C:\Temp\avtnlfdxvq.sysC:\Temp\avtnlfdxvq.sys1⤵
-
C:\Temp\xsqkicavsn.sysC:\Temp\xsqkicavsn.sys1⤵
-
C:\Temp\cxvpnhfzxs.sysC:\Temp\cxvpnhfzxs.sys1⤵
-
C:\Temp\aupmhfzxrp.sysC:\Temp\aupmhfzxrp.sys1⤵
-
C:\Temp\xrpjhczurm.sysC:\Temp\xrpjhczurm.sys1⤵
-
C:\Temp\ezwjhbztrm.sysC:\Temp\ezwjhbztrm.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CP.exe
aytqlidbvt.sys
bwuomgeywr.exe
dbwtolgeyw.sys
heztrmjecw.exe
i_bwuomgeywr.exe
i_heztrmjecw.exe
i_mhfzxrpjhc.exe
i_nifaxsqkic.exe
i_qoigaysqli.exe
i_tnlfdyvqoi.exe
i_wqoigbytrl.exe
idbvtolgey.sys
jgbztrljeb.sys
mhfzxrpjhc.exe
nifaxsqkic.exe
pkhcausmkf.sys
qoigaysqli.exe
rpjhczurmk.sys
tnlfdyvqoi.exe
wqoigbytrl.exe
ysqkidavsn.sys
57C8EDB95DF3F0AD4EE2DC2B8CFD4157
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
57C8EDB95DF3F0AD4EE2DC2B8CFD4157
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
RecoveryStore.{67CE4CEC-3A53-11F1-80F6-66C00C35F2B8}.dat
RecoveryStore.{67CE73FC-3A53-11F1-80F6-66C00C35F2B8}.dat
suggestions[1].en-US
memory/512-75-0x0000000000010000-0x0000000000083000-memory.dmp
memory/544-16-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1100-131-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2520-123-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2772-159-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2868-127-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3056-104-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3848-28-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4256-155-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4388-87-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4512-61-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4616-147-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5144-143-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5240-109-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5324-163-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5604-135-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5628-151-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5696-139-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5772-40-0x0000000000010000-0x0000000000083000-memory.dmp