Analysis
- max time kernel
149s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
22/04/2026, 08:47
General
- Target 2026-04-22_62c25f033449db8426f5943935f9ab9b_elex_redline-stealer_rhadamanthys_stop.exe
- Size 230KB
- Sample260422-kqaabsfx4x
- SHA256 5552f266e761d57fbc03db12f0fd2d0277fe7b84351cb5586e5a46a71d9d3e97
Malware Config
Extracted
-
systex
-
http://xytets.com:2345/t.asp?os=wangba8102
-
http://xytets.com:2345/ll/out.txt
-
http://xytets.com:2345/t.asp?os=home8102
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 44 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 54 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 19 IoCs
- Suspicious use of AdjustPrivilegeToken 20 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SetWindowsHookEx 10 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-22_62c25f033449db8426f5943935f9ab9b_elex_redline-stealer_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-22_62c25f033449db8426f5943935f9ab9b_elex_redline-stealer_rhadamanthys_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home81022⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4824 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4524 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\fausnkfaxs.exe ups_run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\fausnkfaxs.exeC:\Temp\fausnkfaxs.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_fausnkfaxs.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_fausnkfaxs.exeC:\Temp\i_fausnkfaxs.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\cwupmhfzxr.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\cwupmhfzxr.exeC:\Temp\cwupmhfzxr.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_cwupmhfzxr.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_cwupmhfzxr.exeC:\Temp\i_cwupmhfzxr.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\upmhfzxrpj.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\upmhfzxrpj.exeC:\Temp\upmhfzxrpj.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_upmhfzxrpj.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_upmhfzxrpj.exeC:\Temp\i_upmhfzxrpj.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\mgeywrojgb.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\mgeywrojgb.exeC:\Temp\mgeywrojgb.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_mgeywrojgb.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_mgeywrojgb.exeC:\Temp\i_mgeywrojgb.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\jdbwtoeywq.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\jdbwtoeywq.exeC:\Temp\jdbwtoeywq.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_jdbwtoeywq.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_jdbwtoeywq.exeC:\Temp\i_jdbwtoeywq.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\vtolgdywqo.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\vtolgdywqo.exeC:\Temp\vtolgdywqo.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_vtolgdywqo.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_vtolgdywqo.exeC:\Temp\i_vtolgdywqo.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\qlidbvtnlf.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\qlidbvtnlf.exeC:\Temp\qlidbvtnlf.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_qlidbvtnlf.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_qlidbvtnlf.exeC:\Temp\i_qlidbvtnlf.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\idavsnifay.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\idavsnifay.exeC:\Temp\idavsnifay.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_idavsnifay.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_idavsnifay.exeC:\Temp\i_idavsnifay.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ifaysqkaus.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\ifaysqkaus.exeC:\Temp\ifaysqkaus.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ifaysqkaus.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_ifaysqkaus.exeC:\Temp\i_ifaysqkaus.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\zxspkicaus.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\zxspkicaus.exeC:\Temp\zxspkicaus.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_zxspkicaus.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_zxspkicaus.exeC:\Temp\i_zxspkicaus.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\rpkhczusmk.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\rpkhczusmk.exeC:\Temp\rpkhczusmk.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_rpkhczusmk.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_rpkhczusmk.exeC:\Temp\i_rpkhczusmk.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\pjhbzurmje.exe ups_run2⤵
-
C:\Temp\pjhbzurmje.exeC:\Temp\pjhbzurmje.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_pjhbzurmje.exe ups_ins2⤵
-
C:\Temp\i_pjhbzurmje.exeC:\Temp\i_pjhbzurmje.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\omgeywrojh.exe ups_run2⤵
-
C:\Temp\omgeywrojh.exeC:\Temp\omgeywrojh.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_omgeywrojh.exe ups_ins2⤵
-
C:\Temp\i_omgeywrojh.exeC:\Temp\i_omgeywrojh.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\jdbwqoigby.exe ups_run2⤵
-
C:\Temp\jdbwqoigby.exeC:\Temp\jdbwqoigby.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_jdbwqoigby.exe ups_ins2⤵
-
C:\Temp\i_jdbwqoigby.exeC:\Temp\i_jdbwqoigby.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\dyvqoigayt.exe ups_run2⤵
-
C:\Temp\dyvqoigayt.exeC:\Temp\dyvqoigayt.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_dyvqoigayt.exe ups_ins2⤵
-
C:\Temp\i_dyvqoigayt.exeC:\Temp\i_dyvqoigayt.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ysqlidavtn.exe ups_run2⤵
-
C:\Temp\ysqlidavtn.exeC:\Temp\ysqlidavtn.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ysqlidavtn.exe ups_ins2⤵
-
C:\Temp\i_ysqlidavtn.exeC:\Temp\i_ysqlidavtn.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\axsqkicavs.exe ups_run2⤵
-
C:\Temp\axsqkicavs.exeC:\Temp\axsqkicavs.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_axsqkicavs.exe ups_ins2⤵
-
C:\Temp\i_axsqkicavs.exeC:\Temp\i_axsqkicavs.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\xspkicausm.exe ups_run2⤵
-
C:\Temp\xspkicausm.exeC:\Temp\xspkicausm.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_xspkicausm.exe ups_ins2⤵
-
C:\Temp\i_xspkicausm.exeC:\Temp\i_xspkicausm.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\rpkhcausmk.exe ups_run2⤵
-
C:\Temp\rpkhcausmk.exeC:\Temp\rpkhcausmk.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_rpkhcausmk.exe ups_ins2⤵
-
C:\Temp\i_rpkhcausmk.exeC:\Temp\i_rpkhcausmk.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\pjhbztrmje.exe ups_run2⤵
-
C:\Temp\pjhbztrmje.exeC:\Temp\pjhbztrmje.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_pjhbztrmje.exe ups_ins2⤵
-
C:\Temp\i_pjhbztrmje.exeC:\Temp\i_pjhbztrmje.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Temp\mkecxupmhf.sysC:\Temp\mkecxupmhf.sys1⤵
- Executes dropped EXE
-
C:\Temp\bzurmkecwu.sysC:\Temp\bzurmkecwu.sys1⤵
- Executes dropped EXE
-
C:\Temp\ezxrpjhbzm.sysC:\Temp\ezxrpjhbzm.sys1⤵
- Executes dropped EXE
-
C:\Temp\tomgezwroj.sysC:\Temp\tomgezwroj.sys1⤵
- Executes dropped EXE
-
C:\Temp\jdywqoigay.sysC:\Temp\jdywqoigay.sys1⤵
- Executes dropped EXE
-
C:\Temp\yvqnigaysq.sysC:\Temp\yvqnigaysq.sys1⤵
- Executes dropped EXE
-
C:\Temp\xvqnigaysi.sysC:\Temp\xvqnigaysi.sys1⤵
- Executes dropped EXE
-
C:\Temp\sqkicavsnl.sysC:\Temp\sqkicavsnl.sys1⤵
- Executes dropped EXE
-
C:\Temp\kfcxupnhfz.sysC:\Temp\kfcxupnhfz.sys1⤵
- Executes dropped EXE
-
C:\Temp\cwupmhfzxr.sysC:\Temp\cwupmhfzxr.sys1⤵
- Executes dropped EXE
-
C:\Temp\ecwuomhezx.sysC:\Temp\ecwuomhezx.sys1⤵
-
C:\Temp\ywrojhbztr.sysC:\Temp\ywrojhbztr.sys1⤵
-
C:\Temp\tolgeywqoj.sysC:\Temp\tolgeywqoj.sys1⤵
-
C:\Temp\oigbytqljd.sysC:\Temp\oigbytqljd.sys1⤵
-
C:\Temp\qlidbvtnlg.sysC:\Temp\qlidbvtnlg.sys1⤵
-
C:\Temp\kidavsnlfd.sysC:\Temp\kidavsnlfd.sys1⤵
-
C:\Temp\icausnkfdx.sysC:\Temp\icausnkfdx.sys1⤵
-
C:\Temp\cxupnhfzxr.sysC:\Temp\cxupnhfzxr.sys1⤵
-
C:\Temp\hczusmkecw.sysC:\Temp\hczusmkecw.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CP.exe
bzurmkecwu.sys
cwupmhfzxr.exe
ezxrpjhbzm.sys
fausnkfaxs.exe
i_cwupmhfzxr.exe
i_fausnkfaxs.exe
i_jdbwtoeywq.exe
i_mgeywrojgb.exe
i_qlidbvtnlf.exe
i_upmhfzxrpj.exe
i_vtolgdywqo.exe
jdbwtoeywq.exe
jdywqoigay.sys
mgeywrojgb.exe
mkecxupmhf.sys
qlidbvtnlf.exe
tomgezwroj.sys
upmhfzxrpj.exe
vtolgdywqo.exe
xvqnigaysi.sys
yvqnigaysq.sys
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
RecoveryStore.{F2EFE72F-3E27-11F1-9D89-CEEB04D51BF9}.dat
RecoveryStore.{F2F24AD6-3E27-11F1-9D89-CEEB04D51BF9}.dat
suggestions[1].en-US
memory/64-45-0x0000000000410000-0x000000000048B000-memory.dmp
memory/312-174-0x0000000000890000-0x000000000090B000-memory.dmp
memory/544-154-0x0000000000010000-0x0000000000083000-memory.dmp
memory/764-126-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1064-206-0x00000000008B0000-0x000000000092B000-memory.dmp
memory/1092-163-0x0000000000530000-0x00000000005AB000-memory.dmp
memory/1148-198-0x00000000005A0000-0x000000000061B000-memory.dmp
memory/1332-217-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1468-94-0x00000000008A0000-0x000000000091B000-memory.dmp
memory/1480-61-0x0000000000450000-0x00000000004CB000-memory.dmp
memory/1824-31-0x0000000000590000-0x000000000060B000-memory.dmp
memory/1828-46-0x00000000006A0000-0x000000000071B000-memory.dmp
memory/1980-189-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2060-157-0x0000000000520000-0x000000000059B000-memory.dmp
memory/2352-223-0x00000000008B0000-0x000000000092B000-memory.dmp
memory/2476-109-0x0000000000870000-0x00000000008EB000-memory.dmp
memory/2480-133-0x0000000000890000-0x000000000090B000-memory.dmp
memory/2492-161-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2532-153-0x0000000000870000-0x00000000008EB000-memory.dmp
memory/2536-87-0x0000000000890000-0x000000000090B000-memory.dmp
memory/2560-203-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2628-164-0x0000000000890000-0x000000000090B000-memory.dmp
memory/2808-196-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2896-191-0x0000000000550000-0x00000000005CB000-memory.dmp
memory/2932-220-0x00000000004A0000-0x000000000051B000-memory.dmp
memory/2992-96-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3028-129-0x0000000000870000-0x00000000008EB000-memory.dmp
memory/3112-134-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3496-79-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3644-30-0x0000000000770000-0x00000000007EB000-memory.dmp
memory/3780-226-0x0000000000550000-0x00000000005CB000-memory.dmp
memory/3868-22-0x00000000008D0000-0x000000000094B000-memory.dmp
memory/3884-16-0x0000000000850000-0x00000000008CB000-memory.dmp
memory/4168-24-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4248-182-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4392-111-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4452-188-0x0000000000450000-0x00000000004CB000-memory.dmp
memory/4672-213-0x0000000000660000-0x00000000006DB000-memory.dmp
memory/4688-117-0x00000000008A0000-0x000000000091B000-memory.dmp
memory/4784-224-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4804-124-0x0000000000590000-0x000000000060B000-memory.dmp
memory/4828-102-0x00000000008B0000-0x000000000092B000-memory.dmp
memory/4864-160-0x00000000005A0000-0x000000000061B000-memory.dmp
memory/4964-181-0x00000000008C0000-0x000000000093B000-memory.dmp
memory/5040-184-0x0000000000840000-0x00000000008BB000-memory.dmp
memory/5128-54-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5140-170-0x0000000000580000-0x00000000005FB000-memory.dmp
memory/5180-136-0x0000000000520000-0x000000000059B000-memory.dmp
memory/5208-60-0x0000000000830000-0x00000000008AB000-memory.dmp
memory/5220-168-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5276-88-0x0000000000830000-0x00000000008AB000-memory.dmp
memory/5280-177-0x0000000000650000-0x00000000006CB000-memory.dmp
memory/5372-118-0x0000000000450000-0x00000000004CB000-memory.dmp
memory/5404-75-0x0000000000850000-0x00000000008CB000-memory.dmp
memory/5428-171-0x00000000008B0000-0x000000000092B000-memory.dmp
memory/5500-219-0x0000000000870000-0x00000000008EB000-memory.dmp
memory/5508-130-0x0000000000890000-0x000000000090B000-memory.dmp
memory/5532-103-0x00000000008B0000-0x000000000092B000-memory.dmp
memory/5548-195-0x0000000000640000-0x00000000006BB000-memory.dmp
memory/5556-185-0x0000000000550000-0x00000000005CB000-memory.dmp
memory/5560-192-0x0000000000880000-0x00000000008FB000-memory.dmp
memory/5584-210-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5656-37-0x0000000000880000-0x00000000008FB000-memory.dmp
memory/5660-212-0x0000000000480000-0x00000000004FB000-memory.dmp
memory/5732-52-0x0000000000870000-0x00000000008EB000-memory.dmp
memory/5760-216-0x0000000000860000-0x00000000008DB000-memory.dmp
memory/5768-209-0x0000000000690000-0x000000000070B000-memory.dmp
memory/5784-167-0x0000000000540000-0x00000000005BB000-memory.dmp
memory/5800-205-0x0000000000520000-0x000000000059B000-memory.dmp
memory/5860-178-0x0000000000850000-0x00000000008CB000-memory.dmp
memory/5884-39-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5964-156-0x0000000000840000-0x00000000008BB000-memory.dmp
memory/5984-15-0x00000000004E0000-0x000000000055B000-memory.dmp
memory/5988-199-0x0000000000520000-0x000000000059B000-memory.dmp
memory/6012-227-0x0000000000580000-0x00000000005FB000-memory.dmp
memory/6112-175-0x0000000000010000-0x0000000000083000-memory.dmp
memory/6120-202-0x0000000000850000-0x00000000008CB000-memory.dmp
memory/6128-137-0x00000000008A0000-0x000000000091B000-memory.dmp