Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
04/05/2026, 17:47
General
- Target 2026-05-04_dbeb9bd57b270f01c7cef6813da77eb5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 376KB
- Sample260504-wc3khagy61
- SHA256 57e6dc1477fc286f3762198b96f07c117617b4128f73156c44c3921d553c95d2
Malware Config
Extracted
-
systex
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 43 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 32 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 62 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-04_dbeb9bd57b270f01c7cef6813da77eb5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-04_dbeb9bd57b270f01c7cef6813da77eb5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\kecxupmhfzxrpkhc.exeC:\Temp\kecxupmhfzxrpkhc.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\smkfcxvpnh.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\smkfcxvpnh.exeC:\Temp\smkfcxvpnh.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_smkfcxvpnh.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_smkfcxvpnh.exeC:\Temp\i_smkfcxvpnh.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hcwuomhezx.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\hcwuomhezx.exeC:\Temp\hcwuomhezx.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hcwuomhezx.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_hcwuomhezx.exeC:\Temp\i_hcwuomhezx.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zojhbztrlj.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\zojhbztrlj.exeC:\Temp\zojhbztrlj.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zojhbztrlj.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_zojhbztrlj.exeC:\Temp\i_zojhbztrlj.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ljebwuomge.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ljebwuomge.exeC:\Temp\ljebwuomge.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ljebwuomge.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ljebwuomge.exeC:\Temp\i_ljebwuomge.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bvtolgeywq.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\bvtolgeywq.exeC:\Temp\bvtolgeywq.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bvtolgeywq.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_bvtolgeywq.exeC:\Temp\i_bvtolgeywq.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ljdbvtnlgd.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ljdbvtnlgd.exeC:\Temp\ljdbvtnlgd.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ljdbvtnlgd.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ljdbvtnlgd.exeC:\Temp\i_ljdbvtnlgd.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\avtnlfdxvq.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\avtnlfdxvq.exeC:\Temp\avtnlfdxvq.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_avtnlfdxvq.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_avtnlfdxvq.exeC:\Temp\i_avtnlfdxvq.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\snlfdxvpni.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\snlfdxvpni.exeC:\Temp\snlfdxvpni.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_snlfdxvpni.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_snlfdxvpni.exeC:\Temp\i_snlfdxvpni.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fcxvpnhfax.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\fcxvpnhfax.exeC:\Temp\fcxvpnhfax.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fcxvpnhfax.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_fcxvpnhfax.exeC:\Temp\i_fcxvpnhfax.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\upmhfzxrpk.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\upmhfzxrpk.exeC:\Temp\upmhfzxrpk.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_upmhfzxrpk.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_upmhfzxrpk.exeC:\Temp\i_upmhfzxrpk.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ezwrojhbzt.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ezwrojhbzt.exeC:\Temp\ezwrojhbzt.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ezwrojhbzt.exe ups_ins3⤵
-
C:\Temp\i_ezwrojhbzt.exeC:\Temp\i_ezwrojhbzt.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wrmjebwuom.exe ups_run3⤵
-
C:\Temp\wrmjebwuom.exeC:\Temp\wrmjebwuom.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wrmjebwuom.exe ups_ins3⤵
-
C:\Temp\i_wrmjebwuom.exeC:\Temp\i_wrmjebwuom.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\geywqojgby.exe ups_run3⤵
-
C:\Temp\geywqojgby.exeC:\Temp\geywqojgby.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_geywqojgby.exe ups_ins3⤵
-
C:\Temp\i_geywqojgby.exeC:\Temp\i_geywqojgby.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vqlidbvtnl.exe ups_run3⤵
-
C:\Temp\vqlidbvtnl.exeC:\Temp\vqlidbvtnl.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vqlidbvtnl.exe ups_ins3⤵
-
C:\Temp\i_vqlidbvtnl.exeC:\Temp\i_vqlidbvtnl.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lidbvtnlfd.exe ups_run3⤵
-
C:\Temp\lidbvtnlfd.exeC:\Temp\lidbvtnlfd.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_lidbvtnlfd.exe ups_ins3⤵
-
C:\Temp\i_lidbvtnlfd.exeC:\Temp\i_lidbvtnlfd.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kidavtnlfd.exe ups_run3⤵
-
C:\Temp\kidavtnlfd.exeC:\Temp\kidavtnlfd.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kidavtnlfd.exe ups_ins3⤵
-
C:\Temp\i_kidavtnlfd.exeC:\Temp\i_kidavtnlfd.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\causmkfcxv.exe ups_run3⤵
-
C:\Temp\causmkfcxv.exeC:\Temp\causmkfcxv.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_causmkfcxv.exe ups_ins3⤵
-
C:\Temp\i_causmkfcxv.exeC:\Temp\i_causmkfcxv.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\usmkecxupn.exe ups_run3⤵
-
C:\Temp\usmkecxupn.exeC:\Temp\usmkecxupn.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_usmkecxupn.exe ups_ins3⤵
-
C:\Temp\i_usmkecxupn.exeC:\Temp\i_usmkecxupn.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jhbzurmkec.exe ups_run3⤵
-
C:\Temp\jhbzurmkec.exeC:\Temp\jhbzurmkec.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jhbzurmkec.exe ups_ins3⤵
-
C:\Temp\i_jhbzurmkec.exeC:\Temp\i_jhbzurmkec.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pjhbztrmje.exe ups_run3⤵
-
C:\Temp\pjhbztrmje.exeC:\Temp\pjhbztrmje.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3680 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Temp\kecxupmhfzxrpkhc.sysC:\Temp\kecxupmhfzxrpkhc.sys1⤵
- Executes dropped EXE
-
C:\Temp\zusmkwupmh.sysC:\Temp\zusmkwupmh.sys1⤵
- Executes dropped EXE
-
C:\Temp\jhbzurmkec.sysC:\Temp\jhbzurmkec.sys1⤵
- Executes dropped EXE
-
C:\Temp\ztrljebwuo.sysC:\Temp\ztrljebwuo.sys1⤵
- Executes dropped EXE
-
C:\Temp\lgeywqoigb.sysC:\Temp\lgeywqoigb.sys1⤵
- Executes dropped EXE
-
C:\Temp\gtqljdbvtn.sysC:\Temp\gtqljdbvtn.sys1⤵
- Executes dropped EXE
-
C:\Temp\sqlidbvtnl.sysC:\Temp\sqlidbvtnl.sys1⤵
- Executes dropped EXE
-
C:\Temp\dxvpnifays.sysC:\Temp\dxvpnifays.sys1⤵
- Executes dropped EXE
-
C:\Temp\snhfzxspki.sysC:\Temp\snhfzxspki.sys1⤵
- Executes dropped EXE
-
C:\Temp\ecxupnhfzx.sysC:\Temp\ecxupnhfzx.sys1⤵
- Executes dropped EXE
-
C:\Temp\wupmhfzxrp.sysC:\Temp\wupmhfzxrp.sys1⤵
- Executes dropped EXE
-
C:\Temp\gezwrpjhbz.sysC:\Temp\gezwrpjhbz.sys1⤵
-
C:\Temp\wqoigbytrl.sysC:\Temp\wqoigbytrl.sys1⤵
-
C:\Temp\gdywqoigay.sysC:\Temp\gdywqoigay.sys1⤵
-
C:\Temp\gaytqljdbv.sysC:\Temp\gaytqljdbv.sys1⤵
-
C:\Temp\vtnlfdxvqn.sysC:\Temp\vtnlfdxvqn.sys1⤵
-
C:\Temp\qkicavsnkf.sysC:\Temp\qkicavsnkf.sys1⤵
-
C:\Temp\hcausmkfcx.sysC:\Temp\hcausmkfcx.sys1⤵
-
C:\Temp\causmkecxu.sysC:\Temp\causmkecxu.sys1⤵
-
C:\Temp\ztrmjecwuo.sysC:\Temp\ztrmjecwuo.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CreateProcess.exe
avtnlfdxvq.exe
bvtolgeywq.exe
dxvpnifays.sys
gtqljdbvtn.sys
hcwuomhezx.exe
i_avtnlfdxvq.exe
i_bvtolgeywq.exe
i_hcwuomhezx.exe
i_ljdbvtnlgd.exe
i_ljebwuomge.exe
i_smkfcxvpnh.exe
i_zojhbztrlj.exe
jhbzurmkec.sys
kecxupmhfzxrpkhc.exe
kecxupmhfzxrpkhc.sys
lgeywqoigb.sys
ljdbvtnlgd.exe
ljebwuomge.exe
smkfcxvpnh.exe
snlfdxvpni.exe
sqlidbvtnl.sys
zojhbztrlj.exe
ztrljebwuo.sys
zusmkwupmh.sys
suggestions[1].en-US
memory/8-153-0x0000000000890000-0x00000000009B0000-memory.dmp
memory/64-181-0x0000000000940000-0x0000000000A60000-memory.dmp
memory/208-93-0x0000000000740000-0x0000000000860000-memory.dmp
memory/312-130-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/688-164-0x00000000008B0000-0x00000000009D0000-memory.dmp
memory/740-195-0x0000000000960000-0x0000000000A80000-memory.dmp
memory/816-165-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1108-216-0x0000000000910000-0x0000000000A30000-memory.dmp
memory/1292-215-0x0000000000A60000-0x0000000000B80000-memory.dmp
memory/1596-152-0x00000000008E0000-0x0000000000A00000-memory.dmp
memory/1708-129-0x0000000000A70000-0x0000000000B90000-memory.dmp
memory/1716-92-0x0000000000900000-0x0000000000A20000-memory.dmp
memory/1752-175-0x0000000000890000-0x00000000009B0000-memory.dmp
memory/2056-39-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2124-171-0x0000000000810000-0x0000000000930000-memory.dmp
memory/2244-199-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2256-179-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2312-61-0x0000000000910000-0x0000000000A30000-memory.dmp
memory/2348-84-0x0000000000910000-0x0000000000A30000-memory.dmp
memory/2656-212-0x0000000000970000-0x0000000000A90000-memory.dmp
memory/2728-182-0x00000000008F0000-0x0000000000A10000-memory.dmp
memory/2788-86-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2800-99-0x0000000000900000-0x0000000000A20000-memory.dmp
memory/2844-185-0x0000000000930000-0x0000000000A50000-memory.dmp
memory/3004-188-0x0000000000930000-0x0000000000A50000-memory.dmp
memory/3012-168-0x00000000008E0000-0x0000000000A00000-memory.dmp
memory/3024-45-0x00000000008B0000-0x00000000009D0000-memory.dmp
memory/3076-161-0x0000000000940000-0x0000000000A60000-memory.dmp
memory/3208-222-0x00000000009F0000-0x0000000000B10000-memory.dmp
memory/3216-108-0x00000000009F0000-0x0000000000B10000-memory.dmp
memory/3220-114-0x00000000008B0000-0x00000000009D0000-memory.dmp
memory/3240-60-0x00000000007D0000-0x00000000008F0000-memory.dmp
memory/3396-198-0x0000000000930000-0x0000000000A50000-memory.dmp
memory/3472-156-0x0000000000670000-0x0000000000790000-memory.dmp
memory/3700-201-0x00000000008C0000-0x00000000009E0000-memory.dmp
memory/3752-220-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3988-208-0x0000000000860000-0x0000000000980000-memory.dmp
memory/4128-167-0x0000000000920000-0x0000000000A40000-memory.dmp
memory/4180-116-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4332-205-0x00000000008D0000-0x00000000009F0000-memory.dmp
memory/4368-174-0x0000000000870000-0x0000000000990000-memory.dmp
memory/4392-30-0x0000000000740000-0x0000000000860000-memory.dmp
memory/4464-132-0x00000000008D0000-0x00000000009F0000-memory.dmp
memory/4504-149-0x0000000000910000-0x0000000000A30000-memory.dmp
memory/4616-133-0x00000000008C0000-0x00000000009E0000-memory.dmp
memory/4692-160-0x00000000008A0000-0x00000000009C0000-memory.dmp
memory/4716-67-0x0000000000990000-0x0000000000AB0000-memory.dmp
memory/4752-122-0x0000000000950000-0x0000000000A70000-memory.dmp
memory/4788-192-0x0000000000790000-0x00000000008B0000-memory.dmp
memory/4844-46-0x0000000000A80000-0x0000000000BA0000-memory.dmp
memory/4984-16-0x00000000008E0000-0x0000000000A00000-memory.dmp
memory/5020-15-0x0000000000880000-0x00000000009A0000-memory.dmp
memory/5040-193-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5052-202-0x0000000000940000-0x0000000000A60000-memory.dmp
memory/5080-14-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5140-71-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5156-54-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5216-158-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5216-150-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5240-223-0x0000000000850000-0x0000000000970000-memory.dmp
memory/5248-37-0x00000000008B0000-0x00000000009D0000-memory.dmp
memory/5276-209-0x00000000008E0000-0x0000000000A00000-memory.dmp
memory/5292-186-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5388-77-0x0000000000750000-0x0000000000870000-memory.dmp
memory/5452-78-0x00000000009A0000-0x0000000000AC0000-memory.dmp
memory/5544-101-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5552-178-0x0000000000900000-0x0000000000A20000-memory.dmp
memory/5572-219-0x0000000000900000-0x0000000000A20000-memory.dmp
memory/5576-123-0x0000000000960000-0x0000000000A80000-memory.dmp
memory/5588-107-0x0000000000740000-0x0000000000860000-memory.dmp
memory/5592-157-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5684-189-0x0000000000930000-0x0000000000A50000-memory.dmp
memory/5704-22-0x0000000000870000-0x0000000000990000-memory.dmp
memory/5784-206-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5852-213-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5872-31-0x0000000000950000-0x0000000000A70000-memory.dmp
memory/5900-52-0x0000000000850000-0x0000000000970000-memory.dmp
memory/6060-172-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6128-24-0x0000000000010000-0x00000000000AB000-memory.dmp