Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
21/04/2026, 23:27
General
- Target 2026-04-21_bdf0236f2d6a407edaa4a6bf3593cd39_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 361KB
- Sample260421-3fpldady7j
- SHA256 6bb6ae04101c6990f37356b2ae872ea44aa3a55d08db4ea6db27679563ca7515
Malware Config
Extracted
-
systex
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 43 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 31 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 62 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-21_bdf0236f2d6a407edaa4a6bf3593cd39_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-21_bdf0236f2d6a407edaa4a6bf3593cd39_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\icausnkfdxvpnhfa.exeC:\Temp\icausnkfdxvpnhfa.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nifaxsqkic.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\nifaxsqkic.exeC:\Temp\nifaxsqkic.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nifaxsqkic.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_nifaxsqkic.exeC:\Temp\i_nifaxsqkic.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xrpkhcausm.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\xrpkhcausm.exeC:\Temp\xrpkhcausm.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xrpkhcausm.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_xrpkhcausm.exeC:\Temp\i_xrpkhcausm.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ecwupmhfzx.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ecwupmhfzx.exeC:\Temp\ecwupmhfzx.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ecwupmhfzx.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ecwupmhfzx.exeC:\Temp\i_ecwupmhfzx.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rojhbztrmj.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\rojhbztrmj.exeC:\Temp\rojhbztrmj.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rojhbztrmj.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_rojhbztrmj.exeC:\Temp\i_rojhbztrmj.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rojhbztrlj.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\rojhbztrlj.exeC:\Temp\rojhbztrlj.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rojhbztrlj.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_rojhbztrlj.exeC:\Temp\i_rojhbztrlj.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bytrljdbvt.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\bytrljdbvt.exeC:\Temp\bytrljdbvt.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bytrljdbvt.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_bytrljdbvt.exeC:\Temp\i_bytrljdbvt.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\sqlidbvtnl.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\sqlidbvtnl.exeC:\Temp\sqlidbvtnl.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_sqlidbvtnl.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_sqlidbvtnl.exeC:\Temp\i_sqlidbvtnl.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fdxvpnifay.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\fdxvpnifay.exeC:\Temp\fdxvpnifay.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fdxvpnifay.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_fdxvpnifay.exeC:\Temp\i_fdxvpnifay.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\icavsnlfdx.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\icavsnlfdx.exeC:\Temp\icavsnlfdx.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_icavsnlfdx.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_icavsnlfdx.exeC:\Temp\i_icavsnlfdx.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\upnhfzxspk.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\upnhfzxspk.exeC:\Temp\upnhfzxspk.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_upnhfzxspk.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_upnhfzxspk.exeC:\Temp\i_upnhfzxspk.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mhfzxrpjhc.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\mhfzxrpjhc.exeC:\Temp\mhfzxrpjhc.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mhfzxrpjhc.exe ups_ins3⤵
-
C:\Temp\i_mhfzxrpjhc.exeC:\Temp\i_mhfzxrpjhc.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bzurmkecwu.exe ups_run3⤵
-
C:\Temp\bzurmkecwu.exeC:\Temp\bzurmkecwu.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bzurmkecwu.exe ups_ins3⤵
-
C:\Temp\i_bzurmkecwu.exeC:\Temp\i_bzurmkecwu.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bztrmjecwu.exe ups_run3⤵
-
C:\Temp\bztrmjecwu.exeC:\Temp\bztrmjecwu.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bztrmjecwu.exe ups_ins3⤵
-
C:\Temp\i_bztrmjecwu.exeC:\Temp\i_bztrmjecwu.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wqojgbytrl.exe ups_run3⤵
-
C:\Temp\wqojgbytrl.exeC:\Temp\wqojgbytrl.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wqojgbytrl.exe ups_ins3⤵
-
C:\Temp\i_wqojgbytrl.exeC:\Temp\i_wqojgbytrl.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lgdywqoiga.exe ups_run3⤵
-
C:\Temp\lgdywqoiga.exeC:\Temp\lgdywqoiga.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_lgdywqoiga.exe ups_ins3⤵
-
C:\Temp\i_lgdywqoiga.exeC:\Temp\i_lgdywqoiga.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dbvtnlfdyv.exe ups_run3⤵
-
C:\Temp\dbvtnlfdyv.exeC:\Temp\dbvtnlfdyv.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dbvtnlfdyv.exe ups_ins3⤵
-
C:\Temp\i_dbvtnlfdyv.exeC:\Temp\i_dbvtnlfdyv.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\cavsnkfdxv.exe ups_run3⤵
-
C:\Temp\cavsnkfdxv.exeC:\Temp\cavsnkfdxv.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_cavsnkfdxv.exe ups_ins3⤵
-
C:\Temp\i_cavsnkfdxv.exeC:\Temp\i_cavsnkfdxv.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xsmkfcxvpn.exe ups_run3⤵
-
C:\Temp\xsmkfcxvpn.exeC:\Temp\xsmkfcxvpn.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xsmkfcxvpn.exe ups_ins3⤵
-
C:\Temp\i_xsmkfcxvpn.exeC:\Temp\i_xsmkfcxvpn.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rmkecwupmh.exe ups_run3⤵
-
C:\Temp\rmkecwupmh.exeC:\Temp\rmkecwupmh.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rmkecwupmh.exe ups_ins3⤵
-
C:\Temp\i_rmkecwupmh.exeC:\Temp\i_rmkecwupmh.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jhbzurmkec.exe ups_run3⤵
-
C:\Temp\jhbzurmkec.exeC:\Temp\jhbzurmkec.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2836 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Temp\icausnkfdxvpnhfa.sysC:\Temp\icausnkfdxvpnhfa.sys1⤵
- Executes dropped EXE
-
C:\Temp\kfzxrpkhca.sysC:\Temp\kfzxrpkhca.sys1⤵
- Executes dropped EXE
-
C:\Temp\smkecwupmh.sysC:\Temp\smkecwupmh.sys1⤵
- Executes dropped EXE
-
C:\Temp\mhbzurmjec.sysC:\Temp\mhbzurmjec.sys1⤵
- Executes dropped EXE
-
C:\Temp\bwuomgezwr.sysC:\Temp\bwuomgezwr.sys1⤵
- Executes dropped EXE
-
C:\Temp\ojdbvtolge.sysC:\Temp\ojdbvtolge.sys1⤵
- Executes dropped EXE
-
C:\Temp\dyvqoigays.sysC:\Temp\dyvqoigays.sys1⤵
- Executes dropped EXE
-
C:\Temp\xvqnigaysq.sysC:\Temp\xvqnigaysq.sys1⤵
- Executes dropped EXE
-
C:\Temp\pnhfaxsqki.sysC:\Temp\pnhfaxsqki.sys1⤵
- Executes dropped EXE
-
C:\Temp\fcxvpnhfzx.sysC:\Temp\fcxvpnhfzx.sys1⤵
- Executes dropped EXE
-
C:\Temp\wrpjhczurm.sysC:\Temp\wrpjhczurm.sys1⤵
- Executes dropped EXE
-
C:\Temp\urmkecwupm.sysC:\Temp\urmkecwupm.sys1⤵
-
C:\Temp\pjecwuomge.sysC:\Temp\pjecwuomge.sys1⤵
-
C:\Temp\gbytrljdbv.sysC:\Temp\gbytrljdbv.sys1⤵
-
C:\Temp\wqoigaytql.sysC:\Temp\wqoigaytql.sys1⤵
-
C:\Temp\vtnlgdyvqo.sysC:\Temp\vtnlgdyvqo.sys1⤵
-
C:\Temp\qkidavtnlf.sysC:\Temp\qkidavtnlf.sys1⤵
-
C:\Temp\icausmkfcx.sysC:\Temp\icausmkfcx.sys1⤵
-
C:\Temp\causmkfcxu.sysC:\Temp\causmkfcxu.sys1⤵
-
C:\Temp\czurmkecwu.sysC:\Temp\czurmkecwu.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CreateProcess.exe
bwuomgezwr.sys
bytrljdbvt.exe
dyvqoigays.sys
ecwupmhfzx.exe
fdxvpnifay.exe
i_bytrljdbvt.exe
i_ecwupmhfzx.exe
i_nifaxsqkic.exe
i_rojhbztrlj.exe
i_rojhbztrmj.exe
i_sqlidbvtnl.exe
i_xrpkhcausm.exe
icausnkfdxvpnhfa.exe
icausnkfdxvpnhfa.sys
kfzxrpkhca.sys
mhbzurmjec.sys
nifaxsqkic.exe
ojdbvtolge.sys
rojhbztrlj.exe
rojhbztrmj.exe
smkecwupmh.sys
sqlidbvtnl.exe
xrpkhcausm.exe
xvqnigaysq.sys
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
suggestions[1].en-US
memory/412-142-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/536-228-0x00000000008A0000-0x00000000009C0000-memory.dmp
memory/636-221-0x00000000008F0000-0x0000000000A10000-memory.dmp
memory/776-192-0x0000000000940000-0x0000000000A60000-memory.dmp
memory/812-220-0x0000000000880000-0x00000000009A0000-memory.dmp
memory/1044-103-0x00000000007D0000-0x00000000008F0000-memory.dmp
memory/1144-197-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1208-135-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1416-214-0x00000000008B0000-0x00000000009D0000-memory.dmp
memory/1520-225-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1832-21-0x00000000009C0000-0x0000000000AE0000-memory.dmp
memory/1892-87-0x0000000000900000-0x0000000000A20000-memory.dmp
memory/2028-165-0x0000000000990000-0x0000000000AB0000-memory.dmp
memory/2040-77-0x0000000000910000-0x0000000000A30000-memory.dmp
memory/2056-134-0x00000000008F0000-0x0000000000A10000-memory.dmp
memory/2120-126-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2264-176-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2304-171-0x00000000008B0000-0x00000000009D0000-memory.dmp
memory/2340-172-0x0000000000930000-0x0000000000A50000-memory.dmp
memory/2356-29-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2360-111-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2388-20-0x0000000000830000-0x0000000000950000-memory.dmp
memory/2392-19-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2484-131-0x00000000008C0000-0x00000000009E0000-memory.dmp
memory/2540-218-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2740-117-0x0000000000880000-0x00000000009A0000-memory.dmp
memory/2888-137-0x0000000000900000-0x0000000000A20000-memory.dmp
memory/2972-183-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3044-185-0x00000000008D0000-0x00000000009F0000-memory.dmp
memory/3136-213-0x00000000008F0000-0x0000000000A10000-memory.dmp
memory/3144-217-0x0000000000860000-0x0000000000980000-memory.dmp
memory/3196-118-0x0000000000950000-0x0000000000A70000-memory.dmp
memory/3208-94-0x0000000000960000-0x0000000000A80000-memory.dmp
memory/3304-42-0x0000000000930000-0x0000000000A50000-memory.dmp
memory/3316-169-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3352-59-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3392-193-0x0000000000940000-0x0000000000A60000-memory.dmp
memory/3408-141-0x00000000008C0000-0x00000000009E0000-memory.dmp
memory/3552-203-0x0000000000890000-0x00000000009B0000-memory.dmp
memory/3576-179-0x00000000008A0000-0x00000000009C0000-memory.dmp
memory/3580-182-0x0000000000980000-0x0000000000AA0000-memory.dmp
memory/3752-57-0x00000000008C0000-0x00000000009E0000-memory.dmp
memory/3788-190-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3808-138-0x0000000000960000-0x0000000000A80000-memory.dmp
memory/3840-66-0x00000000008F0000-0x0000000000A10000-memory.dmp
memory/3852-130-0x0000000000760000-0x0000000000880000-memory.dmp
memory/3888-178-0x00000000008E0000-0x0000000000A00000-memory.dmp
memory/3896-65-0x0000000000750000-0x0000000000870000-memory.dmp
memory/3948-227-0x0000000000970000-0x0000000000A90000-memory.dmp
memory/4008-109-0x0000000000860000-0x0000000000980000-memory.dmp
memory/4248-200-0x00000000008F0000-0x0000000000A10000-memory.dmp
memory/4268-207-0x00000000008D0000-0x00000000009F0000-memory.dmp
memory/4288-211-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4300-204-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4324-224-0x00000000008A0000-0x00000000009C0000-memory.dmp
memory/4372-164-0x00000000008C0000-0x00000000009E0000-memory.dmp
memory/4528-88-0x00000000008F0000-0x0000000000A10000-memory.dmp
memory/4708-96-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4844-196-0x0000000000910000-0x0000000000A30000-memory.dmp
memory/4992-210-0x0000000000910000-0x0000000000A30000-memory.dmp
memory/5032-44-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5052-186-0x00000000008E0000-0x0000000000A00000-memory.dmp
memory/5116-51-0x00000000009B0000-0x0000000000AD0000-memory.dmp
memory/5280-36-0x0000000000980000-0x0000000000AA0000-memory.dmp
memory/5356-199-0x00000000008C0000-0x00000000009E0000-memory.dmp
memory/5384-175-0x0000000000880000-0x00000000009A0000-memory.dmp
memory/5384-79-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5404-189-0x0000000000860000-0x0000000000980000-memory.dmp
memory/5456-124-0x00000000008C0000-0x00000000009E0000-memory.dmp
memory/5588-27-0x0000000000900000-0x0000000000A20000-memory.dmp
memory/5620-162-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5624-168-0x0000000000A90000-0x0000000000BB0000-memory.dmp
memory/5676-145-0x00000000009C0000-0x0000000000AE0000-memory.dmp
memory/5832-102-0x0000000000890000-0x00000000009B0000-memory.dmp
memory/5908-206-0x00000000007F0000-0x0000000000910000-memory.dmp
memory/5944-161-0x0000000000960000-0x0000000000A80000-memory.dmp
memory/6012-144-0x0000000000890000-0x00000000009B0000-memory.dmp
memory/6020-35-0x0000000000990000-0x0000000000AB0000-memory.dmp
memory/6056-50-0x0000000000910000-0x0000000000A30000-memory.dmp