Analysis
- max time kernel
150s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
18/04/2026, 03:49
General
- Target 2026-04-18_8a6f975f4a88dda4ce42e7d02e656b36_elex_redline-stealer_rhadamanthys_stop.exe
- Size 230KB
- Sample260418-edtkjsav3k
- SHA256 aac8cff93a9b794cdc0f9bbc08183acb644f5071871bc77d67ec1b51e2bd70a3
Malware Config
Extracted
-
systex
-
http://xytets.com:2345/t.asp?os=wangba8102
-
http://xytets.com:2345/ll/out.txt
-
http://xytets.com:2345/t.asp?os=home8102
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 43 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 55 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SetWindowsHookEx 10 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-18_8a6f975f4a88dda4ce42e7d02e656b36_elex_redline-stealer_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-18_8a6f975f4a88dda4ce42e7d02e656b36_elex_redline-stealer_rhadamanthys_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home81022⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4864 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4852 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\upnhfzxrpk.exe ups_run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\upnhfzxrpk.exeC:\Temp\upnhfzxrpk.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_upnhfzxrpk.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_upnhfzxrpk.exeC:\Temp\i_upnhfzxrpk.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\fzxrpjhczu.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\fzxrpjhczu.exeC:\Temp\fzxrpjhczu.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_fzxrpjhczu.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_fzxrpjhczu.exeC:\Temp\i_fzxrpjhczu.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ecwuomhezx.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\ecwuomhezx.exeC:\Temp\ecwuomhezx.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ecwuomhezx.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_ecwuomhezx.exeC:\Temp\i_ecwuomhezx.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ztrljebwto.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\ztrljebwto.exeC:\Temp\ztrljebwto.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ztrljebwto.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_ztrljebwto.exeC:\Temp\i_ztrljebwto.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\tomgeywqoj.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\tomgeywqoj.exeC:\Temp\tomgeywqoj.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_tomgeywqoj.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_tomgeywqoj.exeC:\Temp\i_tomgeywqoj.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\lgaytqlidb.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\lgaytqlidb.exeC:\Temp\lgaytqlidb.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_lgaytqlidb.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_lgaytqlidb.exeC:\Temp\i_lgaytqlidb.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\lgaysqlidb.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\lgaysqlidb.exeC:\Temp\lgaysqlidb.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_lgaysqlidb.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_lgaysqlidb.exeC:\Temp\i_lgaysqlidb.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\favsnkfdxv.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\favsnkfdxv.exeC:\Temp\favsnkfdxv.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_favsnkfdxv.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_favsnkfdxv.exeC:\Temp\i_favsnkfdxv.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\xvpnhfaxsp.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\xvpnhfaxsp.exeC:\Temp\xvpnhfaxsp.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_xvpnhfaxsp.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_xvpnhfaxsp.exeC:\Temp\i_xvpnhfaxsp.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\upnhfzxrpk.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\upnhfzxrpk.exeC:\Temp\upnhfzxrpk.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_upnhfzxrpk.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_upnhfzxrpk.exeC:\Temp\i_upnhfzxrpk.exe ups_ins3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\uomhezxrpj.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\uomhezxrpj.exeC:\Temp\uomhezxrpj.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_uomhezxrpj.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_uomhezxrpj.exeC:\Temp\i_uomhezxrpj.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\omgezwrpjh.exe ups_run2⤵
-
C:\Temp\omgezwrpjh.exeC:\Temp\omgezwrpjh.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_omgezwrpjh.exe ups_ins2⤵
-
C:\Temp\i_omgezwrpjh.exeC:\Temp\i_omgezwrpjh.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\mgbztrljdb.exe ups_run2⤵
-
C:\Temp\mgbztrljdb.exeC:\Temp\mgbztrljdb.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_mgbztrljdb.exe ups_ins2⤵
-
C:\Temp\i_mgbztrljdb.exeC:\Temp\i_mgbztrljdb.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\dyvqoigayt.exe ups_run2⤵
-
C:\Temp\dyvqoigayt.exeC:\Temp\dyvqoigayt.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_dyvqoigayt.exe ups_ins2⤵
-
C:\Temp\i_dyvqoigayt.exeC:\Temp\i_dyvqoigayt.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\fdyvqoigay.exe ups_run2⤵
-
C:\Temp\fdyvqoigay.exeC:\Temp\fdyvqoigay.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_fdyvqoigay.exe ups_ins2⤵
-
C:\Temp\i_fdyvqoigay.exeC:\Temp\i_fdyvqoigay.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\dxvpnifays.exe ups_run2⤵
-
C:\Temp\dxvpnifays.exeC:\Temp\dxvpnifays.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_dxvpnifays.exe ups_ins2⤵
-
C:\Temp\i_dxvpnifays.exeC:\Temp\i_dxvpnifays.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\xsnkfcxvpn.exe ups_run2⤵
-
C:\Temp\xsnkfcxvpn.exeC:\Temp\xsnkfcxvpn.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_xsnkfcxvpn.exe ups_ins2⤵
-
C:\Temp\i_xsnkfcxvpn.exeC:\Temp\i_xsnkfcxvpn.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ausmcxupnh.exe ups_run2⤵
-
C:\Temp\ausmcxupnh.exeC:\Temp\ausmcxupnh.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ausmcxupnh.exe ups_ins2⤵
-
C:\Temp\i_ausmcxupnh.exeC:\Temp\i_ausmcxupnh.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\xsmkecwupm.exe ups_run2⤵
-
C:\Temp\xsmkecwupm.exeC:\Temp\xsmkecwupm.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_xsmkecwupm.exe ups_ins2⤵
-
C:\Temp\i_xsmkecwupm.exeC:\Temp\i_xsmkecwupm.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\omhezxrpjh.exe ups_run2⤵
-
C:\Temp\omhezxrpjh.exeC:\Temp\omhezxrpjh.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_omhezxrpjh.exe ups_ins2⤵
-
C:\Temp\i_omhezxrpjh.exeC:\Temp\i_omhezxrpjh.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Temp\usmkecwupm.sysC:\Temp\usmkecwupm.sys1⤵
- Executes dropped EXE
-
C:\Temp\omhezxrpjh.sysC:\Temp\omhezxrpjh.sys1⤵
- Executes dropped EXE
-
C:\Temp\jebwtomgey.sysC:\Temp\jebwtomgey.sys1⤵
- Executes dropped EXE
-
C:\Temp\dywqojgbyt.sysC:\Temp\dywqojgbyt.sys1⤵
- Executes dropped EXE
-
C:\Temp\eytqljdbvt.sysC:\Temp\eytqljdbvt.sys1⤵
- Executes dropped EXE
-
C:\Temp\sqlidavtnl.sysC:\Temp\sqlidavtnl.sys1⤵
- Executes dropped EXE
-
C:\Temp\kfaxspkica.sysC:\Temp\kfaxspkica.sys1⤵
- Executes dropped EXE
-
C:\Temp\nhfzxspkic.sysC:\Temp\nhfzxspkic.sys1⤵
- Executes dropped EXE
-
C:\Temp\hcwuomhezx.sysC:\Temp\hcwuomhezx.sys1⤵
- Executes dropped EXE
-
C:\Temp\cwrpjhbztr.sysC:\Temp\cwrpjhbztr.sys1⤵
-
C:\Temp\trljdbwtom.sysC:\Temp\trljdbwtom.sys1⤵
-
C:\Temp\wtomgeywqo.sysC:\Temp\wtomgeywqo.sys1⤵
-
C:\Temp\qoigaytqlj.sysC:\Temp\qoigaytqlj.sys1⤵
-
C:\Temp\nlfdyvqnig.sysC:\Temp\nlfdyvqnig.sys1⤵
-
C:\Temp\nkfdxnhfax.sysC:\Temp\nkfdxnhfax.sys1⤵
-
C:\Temp\kfcxvpnhfz.sysC:\Temp\kfcxvpnhfz.sys1⤵
-
C:\Temp\ecwupmhfzx.sysC:\Temp\ecwupmhfzx.sys1⤵
-
C:\Temp\zurmjecwuo.sysC:\Temp\zurmjecwuo.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CP.exe
dywqojgbyt.sys
ecwuomhezx.exe
eytqljdbvt.sys
favsnkfdxv.exe
fzxrpjhczu.exe
i_ecwuomhezx.exe
i_fzxrpjhczu.exe
i_lgaysqlidb.exe
i_lgaytqlidb.exe
i_tomgeywqoj.exe
i_upnhfzxrpk.exe
i_ztrljebwto.exe
jebwtomgey.sys
lgaysqlidb.exe
lgaytqlidb.exe
omhezxrpjh.sys
sqlidavtnl.sys
tomgeywqoj.exe
upnhfzxrpk.exe
usmkecwupm.sys
ztrljebwto.exe
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
RecoveryStore.{A9A6F20C-3AD9-11F1-9D89-72B93FB45490}.dat
RecoveryStore.{A9ABB958-3AD9-11F1-9D89-72B93FB45490}.dat
suggestions[1].en-US
memory/396-93-0x0000000000940000-0x00000000009FF000-memory.dmp
memory/624-10-0x00000000007A0000-0x000000000085F000-memory.dmp
memory/760-69-0x0000000000010000-0x0000000000083000-memory.dmp
memory/984-185-0x0000000000540000-0x00000000005FF000-memory.dmp
memory/1000-209-0x00000000008E0000-0x000000000099F000-memory.dmp
memory/1028-99-0x0000000000800000-0x00000000008BF000-memory.dmp
memory/1240-210-0x0000000000960000-0x0000000000A1F000-memory.dmp
memory/1244-160-0x00000000008F0000-0x00000000009AF000-memory.dmp
memory/1424-77-0x0000000000760000-0x000000000081F000-memory.dmp
memory/1580-19-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1656-84-0x00000000004E0000-0x000000000059F000-memory.dmp
memory/1724-174-0x0000000000890000-0x000000000094F000-memory.dmp
memory/1764-168-0x0000000000950000-0x0000000000A0F000-memory.dmp
memory/1812-47-0x00000000008E0000-0x000000000099F000-memory.dmp
memory/1844-92-0x0000000000860000-0x000000000091F000-memory.dmp
memory/1908-207-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1996-107-0x00000000007A0000-0x000000000085F000-memory.dmp
memory/2064-11-0x00000000006C0000-0x000000000077F000-memory.dmp
memory/2080-167-0x0000000000870000-0x000000000092F000-memory.dmp
memory/2196-55-0x00000000007E0000-0x000000000089F000-memory.dmp
memory/2232-49-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2252-206-0x0000000000860000-0x000000000091F000-memory.dmp
memory/2320-188-0x0000000000870000-0x000000000092F000-memory.dmp
memory/2336-34-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2376-78-0x0000000000490000-0x000000000054F000-memory.dmp
memory/2588-151-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2776-158-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2860-178-0x0000000000880000-0x000000000093F000-memory.dmp
memory/2960-56-0x0000000000860000-0x000000000091F000-memory.dmp
memory/3040-154-0x0000000000850000-0x000000000090F000-memory.dmp
memory/3112-157-0x00000000008A0000-0x000000000095F000-memory.dmp
memory/3132-119-0x00000000005B0000-0x000000000066F000-memory.dmp
memory/3288-214-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3416-146-0x00000000008F0000-0x00000000009AF000-memory.dmp
memory/3488-217-0x00000000008B0000-0x000000000096F000-memory.dmp
memory/3584-41-0x00000000008E0000-0x000000000099F000-memory.dmp
memory/3700-40-0x00000000007D0000-0x000000000088F000-memory.dmp
memory/3748-202-0x0000000000560000-0x000000000061F000-memory.dmp
memory/3788-147-0x0000000000720000-0x00000000007DF000-memory.dmp
memory/3804-65-0x0000000000870000-0x000000000092F000-memory.dmp
memory/3820-124-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3884-175-0x00000000008C0000-0x000000000097F000-memory.dmp
memory/3904-101-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3952-200-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4076-199-0x0000000000930000-0x00000000009EF000-memory.dmp
memory/4088-143-0x00000000008A0000-0x000000000095F000-memory.dmp
memory/4288-181-0x00000000008E0000-0x000000000099F000-memory.dmp
memory/4312-179-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4420-32-0x0000000000920000-0x00000000009DF000-memory.dmp
memory/4460-196-0x00000000008C0000-0x000000000097F000-memory.dmp
memory/4476-192-0x00000000008D0000-0x000000000098F000-memory.dmp
memory/4540-182-0x0000000000840000-0x00000000008FF000-memory.dmp
memory/4612-86-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4724-186-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4780-216-0x0000000000870000-0x000000000092F000-memory.dmp
memory/4912-164-0x0000000000900000-0x00000000009BF000-memory.dmp
memory/4956-171-0x0000000000590000-0x000000000064F000-memory.dmp
memory/5108-126-0x0000000000750000-0x000000000080F000-memory.dmp
memory/5148-161-0x0000000000860000-0x000000000091F000-memory.dmp
memory/5180-17-0x0000000000870000-0x000000000092F000-memory.dmp
memory/5252-203-0x0000000000540000-0x00000000005FF000-memory.dmp
memory/5268-127-0x0000000000890000-0x000000000094F000-memory.dmp
memory/5276-150-0x00000000008C0000-0x000000000097F000-memory.dmp
memory/5320-153-0x0000000000920000-0x00000000009DF000-memory.dmp
memory/5336-220-0x0000000000540000-0x00000000005FF000-memory.dmp
memory/5372-108-0x0000000000890000-0x000000000094F000-memory.dmp
memory/5412-193-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5416-25-0x00000000007C0000-0x000000000087F000-memory.dmp
memory/5452-123-0x0000000000960000-0x0000000000A1F000-memory.dmp
memory/5492-189-0x0000000000930000-0x00000000009EF000-memory.dmp
memory/5516-195-0x00000000008E0000-0x000000000099F000-memory.dmp
memory/5752-165-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5812-26-0x00000000008F0000-0x00000000009AF000-memory.dmp
memory/5884-144-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5964-172-0x0000000000010000-0x0000000000083000-memory.dmp
memory/6056-112-0x0000000000880000-0x000000000093F000-memory.dmp
memory/6068-213-0x0000000000850000-0x000000000090F000-memory.dmp
memory/6080-118-0x00000000008D0000-0x000000000098F000-memory.dmp