Analysis
- max time kernel
149s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
04/05/2026, 14:29
General
- Target 2026-05-04_ae8cdeec685edc277b40db3b4dce0b72_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
- Size 291KB
- Sample260504-rt2mbadx3s
- SHA256 35a8033fa1783e2a98994af4cd769f7c82773c49c01129f50466a922bde46240
Malware Config
Extracted
-
systex
-
http://xytets.com:2345/t.asp?os=wangba8102
-
http://xytets.com:2345/ll/out.txt
-
http://xytets.com:2345/t.asp?os=home8102
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Custom signatureUPX dump on OEP (original entry point) 64 IoCs
- Executes dropped EXE 64 IoCs
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 55 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 19 IoCs
- Suspicious use of AdjustPrivilegeToken 18 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SetWindowsHookEx 10 IoCs
- Suspicious use of WriteProcessMemory 60 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-04_ae8cdeec685edc277b40db3b4dce0b72_coinminer_elex_redline-stealer_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-04_ae8cdeec685edc277b40db3b4dce0b72_coinminer_elex_redline-stealer_rhadamanthys_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home81022⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3420 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1936 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\urmhbzupje.exe ups_run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\urmhbzupje.exeC:\Temp\urmhbzupje.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_urmhbzupje.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_urmhbzupje.exeC:\Temp\i_urmhbzupje.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\wuomgeztrl.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\wuomgeztrl.exeC:\Temp\wuomgeztrl.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_wuomgeztrl.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_wuomgeztrl.exeC:\Temp\i_wuomgeztrl.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ywrojhbwto.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\ywrojhbwto.exeC:\Temp\ywrojhbwto.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ywrojhbwto.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_ywrojhbwto.exeC:\Temp\i_ywrojhbwto.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\dbvtolgdyw.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\dbvtolgdyw.exeC:\Temp\dbvtolgdyw.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_dbvtolgdyw.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_dbvtolgdyw.exeC:\Temp\i_dbvtolgdyw.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\fdyvqoigay.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\fdyvqoigay.exeC:\Temp\fdyvqoigay.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_fdyvqoigay.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_fdyvqoigay.exeC:\Temp\i_fdyvqoigay.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\avtnlfxvpn.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\avtnlfxvpn.exeC:\Temp\avtnlfxvpn.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_avtnlfxvpn.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_avtnlfxvpn.exeC:\Temp\i_avtnlfxvpn.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\nifaxsqkid.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\nifaxsqkid.exeC:\Temp\nifaxsqkid.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_nifaxsqkid.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_nifaxsqkid.exeC:\Temp\i_nifaxsqkid.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\hfzxrpkhca.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\hfzxrpkhca.exeC:\Temp\hfzxrpkhca.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_hfzxrpkhca.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_hfzxrpkhca.exeC:\Temp\i_hfzxrpkhca.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\upmhezxrmk.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\upmhezxrmk.exeC:\Temp\upmhezxrmk.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_upmhezxrmk.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_upmhezxrmk.exeC:\Temp\i_upmhezxrmk.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\urmjecwuom.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\urmjecwuom.exeC:\Temp\urmjecwuom.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_urmjecwuom.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_urmjecwuom.exeC:\Temp\i_urmjecwuom.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\erlgeywqoj.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\erlgeywqoj.exeC:\Temp\erlgeywqoj.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_erlgeywqoj.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_erlgeywqoj.exeC:\Temp\i_erlgeywqoj.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\geywqojgyt.exe ups_run2⤵
-
C:\Temp\geywqojgyt.exeC:\Temp\geywqojgyt.exe ups_run3⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_geywqojgyt.exe ups_ins2⤵
-
C:\Temp\i_geywqojgyt.exeC:\Temp\i_geywqojgyt.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\igaytqljdb.exe ups_run2⤵
-
C:\Temp\igaytqljdb.exeC:\Temp\igaytqljdb.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_igaytqljdb.exe ups_ins2⤵
-
C:\Temp\i_igaytqljdb.exeC:\Temp\i_igaytqljdb.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\tnlfdxvqni.exe ups_run2⤵
-
C:\Temp\tnlfdxvqni.exeC:\Temp\tnlfdxvqni.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_tnlfdxvqni.exe ups_ins2⤵
-
C:\Temp\i_tnlfdxvqni.exeC:\Temp\i_tnlfdxvqni.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\fausnkfcxv.exe ups_run2⤵
-
C:\Temp\fausnkfcxv.exeC:\Temp\fausnkfcxv.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_fausnkfcxv.exe ups_ins2⤵
-
C:\Temp\i_fausnkfcxv.exeC:\Temp\i_fausnkfcxv.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\usnkfaxspk.exe ups_run2⤵
-
C:\Temp\usnkfaxspk.exeC:\Temp\usnkfaxspk.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_usnkfaxspk.exe ups_ins2⤵
-
C:\Temp\i_usnkfaxspk.exeC:\Temp\i_usnkfaxspk.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ecxupnhfzx.exe ups_run2⤵
-
C:\Temp\ecxupnhfzx.exeC:\Temp\ecxupnhfzx.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ecxupnhfzx.exe ups_ins2⤵
-
C:\Temp\i_ecxupnhfzx.exeC:\Temp\i_ecxupnhfzx.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\omgezwrpjh.exe ups_run2⤵
-
C:\Temp\omgezwrpjh.exeC:\Temp\omgezwrpjh.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_omgezwrpjh.exe ups_ins2⤵
-
C:\Temp\i_omgezwrpjh.exeC:\Temp\i_omgezwrpjh.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ebwtomgeyw.exe ups_run2⤵
-
C:\Temp\ebwtomgeyw.exeC:\Temp\ebwtomgeyw.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ebwtomgeyw.exe ups_ins2⤵
-
C:\Temp\i_ebwtomgeyw.exeC:\Temp\i_ebwtomgeyw.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Temp\upjhbztrmj.sysC:\Temp\upjhbztrmj.sys1⤵
- Executes dropped EXE
-
C:\Temp\jhbztrljeb.sysC:\Temp\jhbztrljeb.sys1⤵
- Executes dropped EXE
-
C:\Temp\omgeywqojg.sysC:\Temp\omgeywqojg.sys1⤵
- Executes dropped EXE
-
C:\Temp\toigaysqli.sysC:\Temp\toigaysqli.sys1⤵
- Executes dropped EXE
-
C:\Temp\sqkidavtnl.sysC:\Temp\sqkidavtnl.sys1⤵
- Executes dropped EXE
-
C:\Temp\avsnlfaysq.sysC:\Temp\avsnlfaysq.sys1⤵
- Executes dropped EXE
-
C:\Temp\ecwupmhfzx.sysC:\Temp\ecwupmhfzx.sys1⤵
- Executes dropped EXE
-
C:\Temp\mhezxrpbzt.sysC:\Temp\mhezxrpbzt.sys1⤵
- Executes dropped EXE
-
C:\Temp\ojhbztrlje.sysC:\Temp\ojhbztrlje.sys1⤵
- Executes dropped EXE
-
C:\Temp\tolgeytrlj.sysC:\Temp\tolgeytrlj.sys1⤵
-
C:\Temp\tnlgdyvqoi.sysC:\Temp\tnlgdyvqoi.sys1⤵
-
C:\Temp\dxvqnigays.sysC:\Temp\dxvqnigays.sys1⤵
-
C:\Temp\ysqkidavtn.sysC:\Temp\ysqkidavtn.sys1⤵
-
C:\Temp\idxvpnhfax.sysC:\Temp\idxvpnhfax.sys1⤵
-
C:\Temp\pnhfzxrpkh.sysC:\Temp\pnhfzxrpkh.sys1⤵
-
C:\Temp\zxrpjhbzur.sysC:\Temp\zxrpjhbzur.sys1⤵
-
C:\Temp\wuomhezxrp.sysC:\Temp\wuomhezxrp.sys1⤵
-
C:\Temp\jeywqojgbz.sysC:\Temp\jeywqojgbz.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CP.exe
avsnlfaysq.sys
avtnlfxvpn.exe
dbvtolgdyw.exe
fdyvqoigay.exe
hfzxrpkhca.exe
i_avtnlfxvpn.exe
i_dbvtolgdyw.exe
i_fdyvqoigay.exe
i_nifaxsqkid.exe
i_urmhbzupje.exe
i_wuomgeztrl.exe
i_ywrojhbwto.exe
jhbztrljeb.sys
nifaxsqkid.exe
omgeywqojg.sys
sqkidavtnl.sys
toigaysqli.sys
upjhbztrmj.sys
urmhbzupje.exe
wuomgeztrl.exe
ywrojhbwto.exe
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
RecoveryStore.{B9240916-47C5-11F1-A84F-7632E4651F66}.dat
RecoveryStore.{B9266624-47C5-11F1-A84F-7632E4651F66}.dat
suggestions[1].en-US
memory/60-133-0x0000000000100000-0x000000000014B000-memory.dmp
memory/60-135-0x0000000000100000-0x000000000014B000-memory.dmp
memory/216-89-0x0000000000D40000-0x0000000000D8B000-memory.dmp
memory/216-87-0x0000000000D40000-0x0000000000D8B000-memory.dmp
memory/368-10-0x0000000000F00000-0x0000000000F4B000-memory.dmp
memory/368-12-0x0000000000F00000-0x0000000000F4B000-memory.dmp
memory/416-224-0x00000000004E0000-0x000000000052B000-memory.dmp
memory/416-223-0x00000000004E0000-0x000000000052B000-memory.dmp
memory/468-228-0x00000000007C0000-0x000000000080B000-memory.dmp
memory/468-226-0x00000000007C0000-0x000000000080B000-memory.dmp
memory/736-26-0x00000000005C0000-0x000000000060B000-memory.dmp
memory/736-29-0x00000000005C0000-0x000000000060B000-memory.dmp
memory/744-33-0x0000000000700000-0x000000000074B000-memory.dmp
memory/744-36-0x0000000000700000-0x000000000074B000-memory.dmp
memory/972-138-0x0000000000390000-0x00000000003DB000-memory.dmp
memory/972-139-0x0000000000390000-0x00000000003DB000-memory.dmp
memory/1072-98-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1192-213-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1248-237-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1708-197-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1768-218-0x0000000000090000-0x00000000000DB000-memory.dmp
memory/1768-220-0x0000000000090000-0x00000000000DB000-memory.dmp
memory/1812-183-0x0000000000630000-0x000000000067B000-memory.dmp
memory/1812-184-0x0000000000630000-0x000000000067B000-memory.dmp
memory/1852-234-0x0000000000290000-0x00000000002DB000-memory.dmp
memory/1852-236-0x0000000000290000-0x00000000002DB000-memory.dmp
memory/1860-216-0x00000000003E0000-0x000000000042B000-memory.dmp
memory/1860-215-0x00000000003E0000-0x000000000042B000-memory.dmp
memory/1956-61-0x0000000000D80000-0x0000000000DCB000-memory.dmp
memory/1956-58-0x0000000000D80000-0x0000000000DCB000-memory.dmp
memory/1960-229-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2080-110-0x0000000000CB0000-0x0000000000CFB000-memory.dmp
memory/2080-112-0x0000000000CB0000-0x0000000000CFB000-memory.dmp
memory/2204-22-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2316-181-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2436-126-0x0000000000C20000-0x0000000000C6B000-memory.dmp
memory/2436-125-0x0000000000C20000-0x0000000000C6B000-memory.dmp
memory/2436-176-0x0000000000C80000-0x0000000000CCB000-memory.dmp
memory/2436-175-0x0000000000C80000-0x0000000000CCB000-memory.dmp
memory/2508-232-0x0000000000F20000-0x0000000000F6B000-memory.dmp
memory/2508-231-0x0000000000F20000-0x0000000000F6B000-memory.dmp
memory/2572-199-0x00000000004D0000-0x000000000051B000-memory.dmp
memory/2572-200-0x00000000004D0000-0x000000000051B000-memory.dmp
memory/2680-157-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2728-207-0x0000000000060000-0x00000000000AB000-memory.dmp
memory/2728-208-0x0000000000060000-0x00000000000AB000-memory.dmp
memory/2840-162-0x0000000000420000-0x000000000046B000-memory.dmp
memory/2840-164-0x0000000000420000-0x000000000046B000-memory.dmp
memory/2872-165-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2928-136-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3280-45-0x00000000000B0000-0x00000000000FB000-memory.dmp
memory/3280-43-0x00000000000B0000-0x00000000000FB000-memory.dmp
memory/3384-173-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3508-191-0x0000000000740000-0x000000000078B000-memory.dmp
memory/3508-192-0x0000000000740000-0x000000000078B000-memory.dmp
memory/3520-118-0x0000000000FA0000-0x0000000000FEB000-memory.dmp
memory/3520-49-0x0000000000FB0000-0x0000000000FFB000-memory.dmp
memory/3520-121-0x0000000000FA0000-0x0000000000FEB000-memory.dmp
memory/3520-52-0x0000000000FB0000-0x0000000000FFB000-memory.dmp
memory/3652-105-0x0000000000E10000-0x0000000000E5B000-memory.dmp
memory/3652-103-0x0000000000E10000-0x0000000000E5B000-memory.dmp
memory/3756-205-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3852-204-0x00000000006B0000-0x00000000006FB000-memory.dmp
memory/3852-202-0x00000000006B0000-0x00000000006FB000-memory.dmp
memory/3940-221-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4184-38-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4212-167-0x0000000000E90000-0x0000000000EDB000-memory.dmp
memory/4212-168-0x0000000000E90000-0x0000000000EDB000-memory.dmp
memory/4228-210-0x0000000000F80000-0x0000000000FCB000-memory.dmp
memory/4228-212-0x0000000000F80000-0x0000000000FCB000-memory.dmp
memory/4280-0-0x00000000009D0000-0x0000000000A1B000-memory.dmp
memory/4280-21-0x00000000009D0000-0x0000000000A1B000-memory.dmp
memory/4360-130-0x0000000000AE0000-0x0000000000B2B000-memory.dmp
memory/4360-131-0x0000000000AE0000-0x0000000000B2B000-memory.dmp
memory/4412-114-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4472-186-0x0000000000AB0000-0x0000000000AFB000-memory.dmp
memory/4472-188-0x0000000000AB0000-0x0000000000AFB000-memory.dmp
memory/4520-159-0x0000000000E30000-0x0000000000E7B000-memory.dmp
memory/4520-160-0x0000000000E30000-0x0000000000E7B000-memory.dmp
memory/4608-178-0x0000000000810000-0x000000000085B000-memory.dmp
memory/4608-180-0x0000000000810000-0x000000000085B000-memory.dmp
memory/4652-189-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4708-78-0x0000000000F90000-0x0000000000FDB000-memory.dmp
memory/4708-66-0x0000000000F90000-0x0000000000FDB000-memory.dmp
memory/4724-172-0x0000000000980000-0x00000000009CB000-memory.dmp
memory/4724-54-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4724-170-0x0000000000980000-0x00000000009CB000-memory.dmp
memory/4748-154-0x00000000006E0000-0x000000000072B000-memory.dmp
memory/4748-156-0x00000000006E0000-0x000000000072B000-memory.dmp
memory/4816-196-0x00000000008A0000-0x00000000008EB000-memory.dmp
memory/4816-194-0x00000000008A0000-0x00000000008EB000-memory.dmp
memory/4928-96-0x0000000000C20000-0x0000000000C6B000-memory.dmp
memory/4928-94-0x0000000000C20000-0x0000000000C6B000-memory.dmp
memory/4948-82-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5076-19-0x0000000000A80000-0x0000000000ACB000-memory.dmp
memory/5076-17-0x0000000000A80000-0x0000000000ACB000-memory.dmp