Analysis
- max time kernel
150s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
22/04/2026, 16:07
General
- Target 2026-04-22_be8cb82bf9dedd6a4e9a78fbeac0bedb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
- Size 365KB
- Sample260422-tkmsxaaz6p
- SHA256 19d46654ad8427c226361da1260bc78ef91472dfa6de4144baff3a53769af780
Malware Config
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 35 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 60 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-22_be8cb82bf9dedd6a4e9a78fbeac0bedb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-22_be8cb82bf9dedd6a4e9a78fbeac0bedb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\ojgbztrljdbwtoey.exeC:\Temp\ojgbztrljdbwtoey.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rljdbwtomd.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\rljdbwtomd.exeC:\Temp\rljdbwtomd.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rljdbwtomd.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_rljdbwtomd.exeC:\Temp\i_rljdbwtomd.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ywqoigaytq.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ywqoigaytq.exeC:\Temp\ywqoigaytq.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ywqoigaytq.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ywqoigaytq.exeC:\Temp\i_ywqoigaytq.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\igaysqkida.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\igaysqkida.exeC:\Temp\igaysqkida.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_igaysqkida.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_igaysqkida.exeC:\Temp\i_igaysqkida.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vpnifaysqk.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\vpnifaysqk.exeC:\Temp\vpnifaysqk.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vpnifaysqk.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_vpnifaysqk.exeC:\Temp\i_vpnifaysqk.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ausmkfcxvp.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ausmkfcxvp.exeC:\Temp\ausmkfcxvp.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ausmkfcxvp.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ausmkfcxvp.exeC:\Temp\i_ausmkfcxvp.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pkhcausmke.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\pkhcausmke.exeC:\Temp\pkhcausmke.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pkhcausmke.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_pkhcausmke.exeC:\Temp\i_pkhcausmke.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xrpkecwupm.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\xrpkecwupm.exeC:\Temp\xrpkecwupm.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xrpkecwupm.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_xrpkecwupm.exeC:\Temp\i_xrpkecwupm.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ezwrpjhbzu.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ezwrpjhbzu.exeC:\Temp\ezwrpjhbzu.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ezwrpjhbzu.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ezwrpjhbzu.exeC:\Temp\i_ezwrpjhbzu.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ojgbytrljd.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ojgbytrljd.exeC:\Temp\ojgbytrljd.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ojgbytrljd.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ojgbytrljd.exeC:\Temp\i_ojgbytrljd.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jdbwtolgey.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jdbwtolgey.exeC:\Temp\jdbwtolgey.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jdbwtolgey.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jdbwtolgey.exeC:\Temp\i_jdbwtolgey.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vtoigaysql.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\vtoigaysql.exeC:\Temp\vtoigaysql.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vtoigaysql.exe ups_ins3⤵
-
C:\Temp\i_vtoigaysql.exeC:\Temp\i_vtoigaysql.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kidavtnlfd.exe ups_run3⤵
-
C:\Temp\kidavtnlfd.exeC:\Temp\kidavtnlfd.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kidavtnlfd.exe ups_ins3⤵
-
C:\Temp\i_kidavtnlfd.exeC:\Temp\i_kidavtnlfd.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xvpnhfaxsq.exe ups_run3⤵
-
C:\Temp\xvpnhfaxsq.exeC:\Temp\xvpnhfaxsq.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xvpnhfaxsq.exe ups_ins3⤵
-
C:\Temp\i_xvpnhfaxsq.exeC:\Temp\i_xvpnhfaxsq.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vpnhfzxspc.exe ups_run3⤵
-
C:\Temp\vpnhfzxspc.exeC:\Temp\vpnhfzxspc.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vpnhfzxspc.exe ups_ins3⤵
-
C:\Temp\i_vpnhfzxspc.exeC:\Temp\i_vpnhfzxspc.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ecwupmhezx.exe ups_run3⤵
-
C:\Temp\ecwupmhezx.exeC:\Temp\ecwupmhezx.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ecwupmhezx.exe ups_ins3⤵
-
C:\Temp\i_ecwupmhezx.exeC:\Temp\i_ecwupmhezx.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\uomgezwrpj.exe ups_run3⤵
-
C:\Temp\uomgezwrpj.exeC:\Temp\uomgezwrpj.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_uomgezwrpj.exe ups_ins3⤵
-
C:\Temp\i_uomgezwrpj.exeC:\Temp\i_uomgezwrpj.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ezwrojhbzt.exe ups_run3⤵
-
C:\Temp\ezwrojhbzt.exeC:\Temp\ezwrojhbzt.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ezwrojhbzt.exe ups_ins3⤵
-
C:\Temp\i_ezwrojhbzt.exeC:\Temp\i_ezwrojhbzt.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ztrlbvtolg.exe ups_run3⤵
-
C:\Temp\ztrlbvtolg.exeC:\Temp\ztrlbvtolg.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ztrlbvtolg.exe ups_ins3⤵
-
C:\Temp\i_ztrlbvtolg.exeC:\Temp\i_ztrlbvtolg.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lgdywqoiga.exe ups_run3⤵
-
C:\Temp\lgdywqoiga.exeC:\Temp\lgdywqoiga.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_lgdywqoiga.exe ups_ins3⤵
-
C:\Temp\i_lgdywqoiga.exeC:\Temp\i_lgdywqoiga.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4220 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Temp\ojgbztrljdbwtoey.sysC:\Temp\ojgbztrljdbwtoey.sys1⤵
- Executes dropped EXE
-
C:\Temp\lgeywqojgb.sysC:\Temp\lgeywqojgb.sys1⤵
- Executes dropped EXE
-
C:\Temp\vqnigaysql.sysC:\Temp\vqnigaysql.sys1⤵
- Executes dropped EXE
-
C:\Temp\fdxvpnifay.sysC:\Temp\fdxvpnifay.sys1⤵
- Executes dropped EXE
-
C:\Temp\vpnhfaxsqk.sysC:\Temp\vpnhfaxsqk.sys1⤵
- Executes dropped EXE
-
C:\Temp\causmkfcxv.sysC:\Temp\causmkfcxv.sys1⤵
- Executes dropped EXE
-
C:\Temp\hfzxrpjhcz.sysC:\Temp\hfzxrpjhcz.sys1⤵
- Executes dropped EXE
-
C:\Temp\omhezxrpjh.sysC:\Temp\omhezxrpjh.sys1⤵
- Executes dropped EXE
-
C:\Temp\gezwrojgbz.sysC:\Temp\gezwrojgbz.sys1⤵
- Executes dropped EXE
-
C:\Temp\tolgeywqoi.sysC:\Temp\tolgeywqoi.sys1⤵
- Executes dropped EXE
-
C:\Temp\gdyvqoigay.sysC:\Temp\gdyvqoigay.sys1⤵
- Executes dropped EXE
-
C:\Temp\ysqkicavsn.sysC:\Temp\ysqkicavsn.sys1⤵
-
C:\Temp\snlfdxvpni.sysC:\Temp\snlfdxvpni.sys1⤵
-
C:\Temp\fzxspkicau.sysC:\Temp\fzxspkicau.sys1⤵
-
C:\Temp\smkecxupnh.sysC:\Temp\smkecxupnh.sys1⤵
-
C:\Temp\ecwupmhezx.sysC:\Temp\ecwupmhezx.sys1⤵
-
C:\Temp\wrpjhbztje.sysC:\Temp\wrpjhbztje.sys1⤵
-
C:\Temp\mgbztrljeb.sysC:\Temp\mgbztrljeb.sys1⤵
-
C:\Temp\wqoigaytql.sysC:\Temp\wqoigaytql.sys1⤵
-
C:\Temp\nigaysqlid.sysC:\Temp\nigaysqlid.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CreateProcess.exe
ausmkfcxvp.exe
causmkfcxv.sys
ezwrpjhbzu.exe
fdxvpnifay.sys
hfzxrpjhcz.sys
i_ausmkfcxvp.exe
i_igaysqkida.exe
i_pkhcausmke.exe
i_rljdbwtomd.exe
i_vpnifaysqk.exe
i_xrpkecwupm.exe
i_ywqoigaytq.exe
igaysqkida.exe
lgeywqojgb.sys
ojgbztrljdbwtoey.exe
ojgbztrljdbwtoey.sys
omhezxrpjh.sys
pkhcausmke.exe
rljdbwtomd.exe
vpnhfaxsqk.sys
vpnifaysqk.exe
vqnigaysql.sys
xrpkecwupm.exe
ywqoigaytq.exe
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
suggestions[1].en-US
memory/440-113-0x0000000000930000-0x0000000000A0C000-memory.dmp
memory/468-181-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/600-183-0x0000000000A00000-0x0000000000ADC000-memory.dmp
memory/632-39-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/640-219-0x00000000008A0000-0x000000000097C000-memory.dmp
memory/676-180-0x0000000000900000-0x00000000009DC000-memory.dmp
memory/988-191-0x0000000000910000-0x00000000009EC000-memory.dmp
memory/1000-46-0x0000000000870000-0x000000000094C000-memory.dmp
memory/1092-173-0x0000000000890000-0x000000000096C000-memory.dmp
memory/1124-152-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1124-131-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1172-223-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1188-16-0x00000000007F0000-0x00000000008CC000-memory.dmp
memory/1280-24-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1376-169-0x00000000008F0000-0x00000000009CC000-memory.dmp
memory/1396-218-0x00000000008D0000-0x00000000009AC000-memory.dmp
memory/1404-126-0x0000000000800000-0x00000000008DC000-memory.dmp
memory/1456-77-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1456-54-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1460-212-0x0000000000860000-0x000000000093C000-memory.dmp
memory/1468-11-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1588-216-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1628-155-0x0000000000930000-0x0000000000A0C000-memory.dmp
memory/1652-188-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1740-52-0x0000000000920000-0x00000000009FC000-memory.dmp
memory/1748-72-0x00000000008D0000-0x00000000009AC000-memory.dmp
memory/1772-158-0x00000000008A0000-0x000000000097C000-memory.dmp
memory/1844-190-0x00000000008F0000-0x00000000009CC000-memory.dmp
memory/1848-184-0x0000000000870000-0x000000000094C000-memory.dmp
memory/1872-74-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1916-45-0x0000000000780000-0x000000000085C000-memory.dmp
memory/2064-90-0x00000000008F0000-0x00000000009CC000-memory.dmp
memory/2084-122-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2120-215-0x00000000009E0000-0x0000000000ABC000-memory.dmp
memory/2124-130-0x0000000000920000-0x00000000009FC000-memory.dmp
memory/2164-209-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2252-154-0x0000000000870000-0x000000000094C000-memory.dmp
memory/2260-167-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2260-159-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2264-120-0x0000000000930000-0x0000000000A0C000-memory.dmp
memory/2320-31-0x0000000000870000-0x000000000094C000-memory.dmp
memory/2392-222-0x0000000000930000-0x0000000000A0C000-memory.dmp
memory/2460-205-0x0000000000890000-0x000000000096C000-memory.dmp
memory/2520-162-0x00000000008F0000-0x00000000009CC000-memory.dmp
memory/2556-201-0x0000000000760000-0x000000000083C000-memory.dmp
memory/2600-208-0x00000000008A0000-0x000000000097C000-memory.dmp
memory/2632-30-0x00000000008D0000-0x00000000009AC000-memory.dmp
memory/2748-127-0x00000000008A0000-0x000000000097C000-memory.dmp
memory/2780-83-0x0000000000930000-0x0000000000A0C000-memory.dmp
memory/2820-134-0x00000000008A0000-0x000000000097C000-memory.dmp
memory/2836-197-0x00000000008D0000-0x00000000009AC000-memory.dmp
memory/2880-198-0x0000000000850000-0x000000000092C000-memory.dmp
memory/2988-176-0x0000000000890000-0x000000000096C000-memory.dmp
memory/3020-174-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3100-99-0x0000000000940000-0x0000000000A1C000-memory.dmp
memory/3128-161-0x00000000008D0000-0x00000000009AC000-memory.dmp
memory/3256-187-0x00000000008E0000-0x00000000009BC000-memory.dmp
memory/3264-195-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3276-92-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3280-170-0x0000000000860000-0x000000000093C000-memory.dmp
memory/3624-60-0x0000000000610000-0x00000000006EC000-memory.dmp
memory/3732-165-0x0000000000850000-0x000000000092C000-memory.dmp
memory/3796-177-0x00000000009E0000-0x0000000000ABC000-memory.dmp
memory/3800-194-0x00000000008A0000-0x000000000097C000-memory.dmp
memory/3804-114-0x0000000000930000-0x0000000000A0C000-memory.dmp
memory/3824-37-0x00000000008A0000-0x000000000097C000-memory.dmp
memory/3996-84-0x00000000008C0000-0x000000000099C000-memory.dmp
memory/4108-151-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4152-211-0x0000000000880000-0x000000000095C000-memory.dmp
memory/4188-105-0x00000000008B0000-0x000000000098C000-memory.dmp
memory/4480-166-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4484-202-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4504-15-0x0000000000820000-0x00000000008FC000-memory.dmp
memory/4536-150-0x0000000000940000-0x0000000000A1C000-memory.dmp
memory/4628-98-0x00000000005B0000-0x000000000068C000-memory.dmp
memory/4796-133-0x0000000000910000-0x00000000009EC000-memory.dmp
memory/4820-107-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4876-204-0x00000000008A0000-0x000000000097C000-memory.dmp
memory/5076-61-0x0000000000950000-0x0000000000A2C000-memory.dmp
memory/5088-22-0x0000000000880000-0x000000000095C000-memory.dmp