Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
04/05/2026, 12:17
General
- Target 2026-05-04_3bc5ffd8ce0b48a322865aaad48ffcaa_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 361KB
- Sample260504-pgfszaay5x
- SHA256 cfe5cf16830442000b04f795dbe257df4386d7facbde061b65cce7e7edcb78e7
Malware Config
Extracted
-
systex
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 43 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 35 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious use of AdjustPrivilegeToken 18 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 62 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-04_3bc5ffd8ce0b48a322865aaad48ffcaa_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-04_3bc5ffd8ce0b48a322865aaad48ffcaa_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\wuomgeywrojhbztr.exeC:\Temp\wuomgeywrojhbztr.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jebwuomgey.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\jebwuomgey.exeC:\Temp\jebwuomgey.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jebwuomgey.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jebwuomgey.exeC:\Temp\i_jebwuomgey.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vtolgdywqo.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\vtolgdywqo.exeC:\Temp\vtolgdywqo.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vtolgdywqo.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_vtolgdywqo.exeC:\Temp\i_vtolgdywqo.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lidbvtnlfd.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\lidbvtnlfd.exeC:\Temp\lidbvtnlfd.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_lidbvtnlfd.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_lidbvtnlfd.exeC:\Temp\i_lidbvtnlfd.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xsqkidavtn.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\xsqkidavtn.exeC:\Temp\xsqkidavtn.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xsqkidavtn.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_xsqkidavtn.exeC:\Temp\i_xsqkidavtn.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\snkxvpnhfa.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\snkxvpnhfa.exeC:\Temp\snkxvpnhfa.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_snkxvpnhfa.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_snkxvpnhfa.exeC:\Temp\i_snkxvpnhfa.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zxspkhcaus.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\zxspkhcaus.exeC:\Temp\zxspkhcaus.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zxspkhcaus.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_zxspkhcaus.exeC:\Temp\i_zxspkhcaus.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pmhfzxrpjh.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\pmhfzxrpjh.exeC:\Temp\pmhfzxrpjh.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pmhfzxrpjh.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_pmhfzxrpjh.exeC:\Temp\i_pmhfzxrpjh.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\cwuomhezwr.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\cwuomhezwr.exeC:\Temp\cwuomhezwr.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_cwuomhezwr.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_cwuomhezwr.exeC:\Temp\i_cwuomhezwr.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lgeywqojgb.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\lgeywqojgb.exeC:\Temp\lgeywqojgb.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_lgeywqojgb.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_lgeywqojgb.exeC:\Temp\i_lgeywqojgb.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dbvtolgeyw.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\dbvtolgeyw.exeC:\Temp\dbvtolgeyw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dbvtolgeyw.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_dbvtolgeyw.exeC:\Temp\i_dbvtolgeyw.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ytqljdbvtn.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ytqljdbvtn.exeC:\Temp\ytqljdbvtn.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ytqljdbvtn.exe ups_ins3⤵
-
C:\Temp\i_ytqljdbvtn.exeC:\Temp\i_ytqljdbvtn.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nigaysqlid.exe ups_run3⤵
-
C:\Temp\nigaysqlid.exeC:\Temp\nigaysqlid.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nigaysqlid.exe ups_ins3⤵
-
C:\Temp\i_nigaysqlid.exeC:\Temp\i_nigaysqlid.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\causnhfaxs.exe ups_run3⤵
-
C:\Temp\causnhfaxs.exeC:\Temp\causnhfaxs.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_causnhfaxs.exe ups_ins3⤵
-
C:\Temp\i_causnhfaxs.exeC:\Temp\i_causnhfaxs.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\cxvpnhfzxs.exe ups_run3⤵
-
C:\Temp\cxvpnhfzxs.exeC:\Temp\cxvpnhfzxs.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_cxvpnhfzxs.exe ups_ins3⤵
-
C:\Temp\i_cxvpnhfzxs.exeC:\Temp\i_cxvpnhfzxs.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rpkhcausmk.exe ups_run3⤵
-
C:\Temp\rpkhcausmk.exeC:\Temp\rpkhcausmk.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rpkhcausmk.exe ups_ins3⤵
-
C:\Temp\i_rpkhcausmk.exeC:\Temp\i_rpkhcausmk.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jhczurmkec.exe ups_run3⤵
-
C:\Temp\jhczurmkec.exeC:\Temp\jhczurmkec.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jhczurmkec.exe ups_ins3⤵
-
C:\Temp\i_jhczurmkec.exeC:\Temp\i_jhczurmkec.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bwuomgeywr.exe ups_run3⤵
-
C:\Temp\bwuomgeywr.exeC:\Temp\bwuomgeywr.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bwuomgeywr.exe ups_ins3⤵
-
C:\Temp\i_bwuomgeywr.exeC:\Temp\i_bwuomgeywr.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ywqojgbztr.exe ups_run3⤵
-
C:\Temp\ywqojgbztr.exeC:\Temp\ywqojgbztr.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ywqojgbztr.exe ups_ins3⤵
-
C:\Temp\i_ywqojgbztr.exeC:\Temp\i_ywqojgbztr.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rlgdywqoig.exe ups_run3⤵
-
C:\Temp\rlgdywqoig.exeC:\Temp\rlgdywqoig.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rlgdywqoig.exe ups_ins3⤵
-
C:\Temp\i_rlgdywqoig.exeC:\Temp\i_rlgdywqoig.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vtnlfdyvqo.exe ups_run3⤵
-
C:\Temp\vtnlfdyvqo.exeC:\Temp\vtnlfdyvqo.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1792 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Temp\wuomgeywrojhbztr.sysC:\Temp\wuomgeywrojhbztr.sys1⤵
- Executes dropped EXE
-
C:\Temp\gdywqoigay.sysC:\Temp\gdywqoigay.sys1⤵
- Executes dropped EXE
-
C:\Temp\vtnlfdyvqo.sysC:\Temp\vtnlfdyvqo.sys1⤵
- Executes dropped EXE
-
C:\Temp\qnigaysica.sysC:\Temp\qnigaysica.sys1⤵
- Executes dropped EXE
-
C:\Temp\cavsnlfdxv.sysC:\Temp\cavsnlfdxv.sys1⤵
- Executes dropped EXE
-
C:\Temp\khcausmkec.sysC:\Temp\khcausmkec.sys1⤵
- Executes dropped EXE
-
C:\Temp\zxrpjhczus.sysC:\Temp\zxrpjhczus.sys1⤵
- Executes dropped EXE
-
C:\Temp\upezwrpjhb.sysC:\Temp\upezwrpjhb.sys1⤵
- Executes dropped EXE
-
C:\Temp\ebwuomgeyw.sysC:\Temp\ebwuomgeyw.sys1⤵
- Executes dropped EXE
-
C:\Temp\olgeywqoig.sysC:\Temp\olgeywqoig.sys1⤵
- Executes dropped EXE
-
C:\Temp\fdyvqoigay.sysC:\Temp\fdyvqoigay.sys1⤵
- Executes dropped EXE
-
C:\Temp\avtnlfdxvq.sysC:\Temp\avtnlfdxvq.sys1⤵
-
C:\Temp\vpnifaysqk.sysC:\Temp\vpnifaysqk.sys1⤵
-
C:\Temp\nhfzxspkic.sysC:\Temp\nhfzxspkic.sys1⤵
-
C:\Temp\fzxspkhcau.sysC:\Temp\fzxspkhcau.sys1⤵
-
C:\Temp\urmkecwuom.sysC:\Temp\urmkecwuom.sys1⤵
-
C:\Temp\uomgezwrpj.sysC:\Temp\uomgezwrpj.sys1⤵
-
C:\Temp\bvtolgeywq.sysC:\Temp\bvtolgeywq.sys1⤵
-
C:\Temp\lgaysqlida.sysC:\Temp\lgaysqlida.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CreateProcess.exe
cavsnlfdxv.sys
cwuomhezwr.exe
gdywqoigay.sys
i_jebwuomgey.exe
i_lidbvtnlfd.exe
i_pmhfzxrpjh.exe
i_snkxvpnhfa.exe
i_vtolgdywqo.exe
i_xsqkidavtn.exe
i_zxspkhcaus.exe
jebwuomgey.exe
khcausmkec.sys
lidbvtnlfd.exe
pmhfzxrpjh.exe
qnigaysica.sys
snkxvpnhfa.exe
upezwrpjhb.sys
vtnlfdyvqo.sys
vtolgdywqo.exe
wuomgeywrojhbztr.exe
wuomgeywrojhbztr.sys
xsqkidavtn.exe
zxrpjhczus.sys
zxspkhcaus.exe
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
suggestions[1].en-US
memory/208-89-0x0000000000900000-0x0000000000A20000-memory.dmp
memory/456-181-0x0000000000860000-0x0000000000980000-memory.dmp
memory/644-206-0x0000000000890000-0x00000000009B0000-memory.dmp
memory/752-185-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/764-170-0x0000000000880000-0x00000000009A0000-memory.dmp
memory/920-211-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/932-195-0x0000000000980000-0x0000000000AA0000-memory.dmp
memory/980-188-0x00000000008D0000-0x00000000009F0000-memory.dmp
memory/1084-204-0x0000000000A30000-0x0000000000B50000-memory.dmp
memory/1152-52-0x0000000000900000-0x0000000000A20000-memory.dmp
memory/1164-180-0x0000000000990000-0x0000000000AB0000-memory.dmp
memory/1216-156-0x0000000000910000-0x0000000000A30000-memory.dmp
memory/1368-82-0x00000000008B0000-0x00000000009D0000-memory.dmp
memory/1436-74-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1464-16-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1512-98-0x0000000000880000-0x00000000009A0000-memory.dmp
memory/1528-218-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1624-22-0x00000000009C0000-0x0000000000AE0000-memory.dmp
memory/1668-160-0x00000000009E0000-0x0000000000B00000-memory.dmp
memory/1748-166-0x0000000000860000-0x0000000000980000-memory.dmp
memory/1784-72-0x0000000000920000-0x0000000000A40000-memory.dmp
memory/1828-220-0x0000000000920000-0x0000000000A40000-memory.dmp
memory/1880-191-0x00000000008F0000-0x0000000000A10000-memory.dmp
memory/1892-91-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1896-149-0x0000000000910000-0x0000000000A30000-memory.dmp
memory/1952-207-0x0000000000860000-0x0000000000980000-memory.dmp
memory/2004-129-0x0000000000940000-0x0000000000A60000-memory.dmp
memory/2036-30-0x0000000000780000-0x00000000008A0000-memory.dmp
memory/2292-24-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2476-46-0x0000000000910000-0x0000000000A30000-memory.dmp
memory/2516-210-0x0000000000880000-0x00000000009A0000-memory.dmp
memory/2532-119-0x00000000008A0000-0x00000000009C0000-memory.dmp
memory/2632-163-0x00000000008C0000-0x00000000009E0000-memory.dmp
memory/2960-113-0x0000000000990000-0x0000000000AB0000-memory.dmp
memory/2964-214-0x00000000008F0000-0x0000000000A10000-memory.dmp
memory/3024-187-0x00000000009F0000-0x0000000000B10000-memory.dmp
memory/3028-39-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3048-167-0x00000000008D0000-0x00000000009F0000-memory.dmp
memory/3156-132-0x0000000000950000-0x0000000000A70000-memory.dmp
memory/3256-106-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3320-159-0x0000000000870000-0x0000000000990000-memory.dmp
memory/3360-150-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3380-112-0x00000000007F0000-0x0000000000910000-memory.dmp
memory/3456-104-0x00000000008E0000-0x0000000000A00000-memory.dmp
memory/3500-31-0x00000000008C0000-0x00000000009E0000-memory.dmp
memory/3540-121-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3588-54-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3604-217-0x0000000000970000-0x0000000000A90000-memory.dmp
memory/3628-61-0x00000000008E0000-0x0000000000A00000-memory.dmp
memory/3788-171-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3796-213-0x0000000000980000-0x0000000000AA0000-memory.dmp
memory/3888-45-0x0000000000960000-0x0000000000A80000-memory.dmp
memory/3900-37-0x0000000000980000-0x0000000000AA0000-memory.dmp
memory/3952-198-0x0000000000940000-0x0000000000A60000-memory.dmp
memory/4092-221-0x0000000000970000-0x0000000000A90000-memory.dmp
memory/4104-202-0x00000000008B0000-0x00000000009D0000-memory.dmp
memory/4156-83-0x0000000000940000-0x0000000000A60000-memory.dmp
memory/4176-192-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4192-60-0x0000000000810000-0x0000000000930000-memory.dmp
memory/4232-177-0x0000000000870000-0x0000000000990000-memory.dmp
memory/4248-184-0x0000000000890000-0x00000000009B0000-memory.dmp
memory/4280-157-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4388-97-0x0000000000810000-0x0000000000930000-memory.dmp
memory/4460-13-0x0000000000870000-0x0000000000990000-memory.dmp
memory/4464-133-0x00000000008E0000-0x0000000000A00000-memory.dmp
memory/4516-178-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4532-199-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4640-164-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4764-173-0x0000000000990000-0x0000000000AB0000-memory.dmp
memory/4784-194-0x0000000000920000-0x0000000000A40000-memory.dmp
memory/4840-152-0x00000000008D0000-0x00000000009F0000-memory.dmp
memory/4860-125-0x00000000008E0000-0x0000000000A00000-memory.dmp
memory/4908-14-0x0000000000880000-0x00000000009A0000-memory.dmp
memory/5012-201-0x0000000000920000-0x0000000000A40000-memory.dmp
memory/5016-130-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5032-153-0x0000000000890000-0x00000000009B0000-memory.dmp
memory/5056-174-0x0000000000850000-0x0000000000970000-memory.dmp
memory/5100-126-0x0000000000970000-0x0000000000A90000-memory.dmp