Analysis
- max time kernel
150s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
03/05/2026, 15:31
General
- Target 2026-05-03_8cccb9e91904ad8461cdb119bd947dba_amadey_darkgate_elex_smoke-loader_stop.exe
- Size 384KB
- Sample260503-syf2vact8v
- SHA256 0eb336302ee59c746240570214d2c19623e316ab1953f7fef23545198bda4183
Score
10/10
Malware Config
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 35 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 61 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-03_8cccb9e91904ad8461cdb119bd947dba_amadey_darkgate_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-03_8cccb9e91904ad8461cdb119bd947dba_amadey_darkgate_elex_smoke-loader_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\ztrljdbwtomgeywq.exeC:\Temp\ztrljdbwtomgeywq.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\geywrljdbw.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\geywrljdbw.exeC:\Temp\geywrljdbw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_geywrljdbw.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_geywrljdbw.exeC:\Temp\i_geywrljdbw.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wqogdywqoi.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\wqogdywqoi.exeC:\Temp\wqogdywqoi.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wqogdywqoi.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_wqogdywqoi.exeC:\Temp\i_wqogdywqoi.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gdywqoigay.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\gdywqoigay.exeC:\Temp\gdywqoigay.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gdywqoigay.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_gdywqoigay.exeC:\Temp\i_gdywqoigay.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nlfdxvpnif.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\nlfdxvpnif.exeC:\Temp\nlfdxvpnif.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nlfdxvpnif.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_nlfdxvpnif.exeC:\Temp\i_nlfdxvpnif.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dxsqkicavp.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\dxsqkicavp.exeC:\Temp\dxsqkicavp.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dxsqkicavp.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_dxsqkicavp.exeC:\Temp\i_dxsqkicavp.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hcausmkecx.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\hcausmkecx.exeC:\Temp\hcausmkecx.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hcausmkecx.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_hcausmkecx.exeC:\Temp\i_hcausmkecx.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\smhfzxrpje.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\smhfzxrpje.exeC:\Temp\smhfzxrpje.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_smhfzxrpje.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_smhfzxrpje.exeC:\Temp\i_smhfzxrpje.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bztrmjecwu.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\bztrmjecwu.exeC:\Temp\bztrmjecwu.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bztrmjecwu.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_bztrmjecwu.exeC:\Temp\i_bztrmjecwu.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wrojhbzuom.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\wrojhbzuom.exeC:\Temp\wrojhbzuom.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wrojhbzuom.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_wrojhbzuom.exeC:\Temp\i_wrojhbzuom.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jdbvtolgey.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jdbvtolgey.exeC:\Temp\jdbvtolgey.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jdbvtolgey.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jdbvtolgey.exeC:\Temp\i_jdbvtolgey.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ytqljdbvtl.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ytqljdbvtl.exeC:\Temp\ytqljdbvtl.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ytqljdbvtl.exe ups_ins3⤵
-
C:\Temp\i_ytqljdbvtl.exeC:\Temp\i_ytqljdbvtl.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nlfaysqkic.exe ups_run3⤵
-
C:\Temp\nlfaysqkic.exeC:\Temp\nlfaysqkic.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nlfaysqkic.exe ups_ins3⤵
-
C:\Temp\i_nlfaysqkic.exeC:\Temp\i_nlfaysqkic.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\snlfdxvpni.exe ups_run3⤵
-
C:\Temp\snlfdxvpni.exeC:\Temp\snlfdxvpni.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_snlfdxvpni.exe ups_ins3⤵
-
C:\Temp\i_snlfdxvpni.exeC:\Temp\i_snlfdxvpni.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\faxsqkicau.exe ups_run3⤵
-
C:\Temp\faxsqkicau.exeC:\Temp\faxsqkicau.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_faxsqkicau.exe ups_ins3⤵
-
C:\Temp\i_faxsqkicau.exeC:\Temp\i_faxsqkicau.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xrpjhczusm.exe ups_run3⤵
-
C:\Temp\xrpjhczusm.exeC:\Temp\xrpjhczusm.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xrpjhczusm.exe ups_ins3⤵
-
C:\Temp\i_xrpjhczusm.exeC:\Temp\i_xrpjhczusm.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mhezwrpjhb.exe ups_run3⤵
-
C:\Temp\mhezwrpjhb.exeC:\Temp\mhezwrpjhb.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mhezwrpjhb.exe ups_ins3⤵
-
C:\Temp\i_mhezwrpjhb.exeC:\Temp\i_mhezwrpjhb.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mjezwrpjhb.exe ups_run3⤵
-
C:\Temp\mjezwrpjhb.exeC:\Temp\mjezwrpjhb.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mjezwrpjhb.exe ups_ins3⤵
-
C:\Temp\i_mjezwrpjhb.exeC:\Temp\i_mjezwrpjhb.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\eywqojgbzt.exe ups_run3⤵
-
C:\Temp\eywqojgbzt.exeC:\Temp\eywqojgbzt.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_eywqojgbzt.exe ups_ins3⤵
-
C:\Temp\i_eywqojgbzt.exeC:\Temp\i_eywqojgbzt.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\trljdbvtol.exe ups_run3⤵
-
C:\Temp\trljdbvtol.exeC:\Temp\trljdbvtol.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_trljdbvtol.exe ups_ins3⤵
-
C:\Temp\i_trljdbvtol.exeC:\Temp\i_trljdbvtol.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nlfdyvqoig.exe ups_run3⤵
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3796 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Temp\ztrljdbwtomgeywq.sysC:\Temp\ztrljdbwtomgeywq.sys1⤵
- Executes dropped EXE
-
C:\Temp\dbvtolgdyw.sysC:\Temp\dbvtolgdyw.sys1⤵
- Executes dropped EXE
-
C:\Temp\qlfdyvqoig.sysC:\Temp\qlfdyvqoig.sys1⤵
- Executes dropped EXE
-
C:\Temp\gaysqlidbv.sysC:\Temp\gaysqlidbv.sys1⤵
- Executes dropped EXE
-
C:\Temp\nifaysqkid.sysC:\Temp\nifaysqkid.sys1⤵
- Executes dropped EXE
-
C:\Temp\pnhfzxspki.sysC:\Temp\pnhfzxspki.sys1⤵
- Executes dropped EXE
-
C:\Temp\zxrpjhczus.sysC:\Temp\zxrpjhczus.sys1⤵
- Executes dropped EXE
-
C:\Temp\upmhezxrpj.sysC:\Temp\upmhezxrpj.sys1⤵
- Executes dropped EXE
-
C:\Temp\ecwuomgezw.sysC:\Temp\ecwuomgezw.sys1⤵
- Executes dropped EXE
-
C:\Temp\tomgeywroj.sysC:\Temp\tomgeywroj.sys1⤵
- Executes dropped EXE
-
C:\Temp\gdyvqoigay.sysC:\Temp\gdyvqoigay.sys1⤵
- Executes dropped EXE
-
C:\Temp\gaytqlidbv.sysC:\Temp\gaytqlidbv.sys1⤵
-
C:\Temp\avsqkidavs.sysC:\Temp\avsqkidavs.sys1⤵
-
C:\Temp\nkfcxvpnhf.sysC:\Temp\nkfcxvpnhf.sys1⤵
-
C:\Temp\hcxupnhfzx.sysC:\Temp\hcxupnhfzx.sys1⤵
-
C:\Temp\czusmkecwu.sysC:\Temp\czusmkecwu.sys1⤵
-
C:\Temp\wrpjhbzurm.sysC:\Temp\wrpjhbzurm.sys1⤵
-
C:\Temp\omgeywrojg.sysC:\Temp\omgeywrojg.sys1⤵
-
C:\Temp\dytqljdbvt.sysC:\Temp\dytqljdbvt.sys1⤵
-
C:\Temp\gbytqljdbv.sysC:\Temp\gbytqljdbv.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CreateProcess.exe
bztrmjecwu.exe
dbvtolgdyw.sys
dxsqkicavp.exe
gaysqlidbv.sys
gdywqoigay.exe
geywrljdbw.exe
hcausmkecx.exe
i_dxsqkicavp.exe
i_gdywqoigay.exe
i_geywrljdbw.exe
i_hcausmkecx.exe
i_nlfdxvpnif.exe
i_smhfzxrpje.exe
i_wqogdywqoi.exe
nifaysqkid.sys
nlfdxvpnif.exe
pnhfzxspki.sys
qlfdyvqoig.sys
smhfzxrpje.exe
upmhezxrpj.sys
wqogdywqoi.exe
ztrljdbwtomgeywq.exe
ztrljdbwtomgeywq.sys
zxrpjhczus.sys
8A7891822FCFF127E4EADADE9757112B
suggestions[1].en-US
memory/60-158-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/536-33-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/640-21-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/792-153-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/972-106-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1072-124-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1376-162-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1392-87-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1832-145-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2268-14-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2692-57-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2832-45-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3084-99-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3368-132-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3384-141-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3952-120-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4020-137-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4132-128-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4132-134-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4764-71-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5044-149-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5044-154-0x0000000000010000-0x00000000000AB000-memory.dmp