Analysis
- max time kernel
149s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
07/05/2026, 02:32
General
- Target 2026-05-07_ec291dd55e45043bad43569284ce0c39_elex_redline-stealer_rhadamanthys_stop.exe
- Size 230KB
- Sample260507-c1fabsas2k
- SHA256 092fa1de380506afd5b6503a4b3c94a6db5c3c251b111513da8955f056f24927
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba8102
-
http://xytets.com:2345/ll/out.txt
-
http://xytets.com:2345/t.asp?os=home8102
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 44 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 54 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 19 IoCs
- Suspicious use of AdjustPrivilegeToken 20 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SetWindowsHookEx 10 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-07_ec291dd55e45043bad43569284ce0c39_elex_redline-stealer_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-07_ec291dd55e45043bad43569284ce0c39_elex_redline-stealer_rhadamanthys_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home81022⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4584 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5236 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\usmkfzxrpj.exe ups_run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\usmkfzxrpj.exeC:\Temp\usmkfzxrpj.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_usmkfzxrpj.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_usmkfzxrpj.exeC:\Temp\i_usmkfzxrpj.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\wrpjhbztrm.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\wrpjhbztrm.exeC:\Temp\wrpjhbztrm.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_wrpjhbztrm.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_wrpjhbztrm.exeC:\Temp\i_wrpjhbztrm.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\jeywrojgbz.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\jeywrojgbz.exeC:\Temp\jeywrojgbz.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_jeywrojgbz.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_jeywrojgbz.exeC:\Temp\i_jeywrojgbz.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ztrljdbwto.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\ztrljdbwto.exeC:\Temp\ztrljdbwto.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ztrljdbwto.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_ztrljdbwto.exeC:\Temp\i_ztrljdbwto.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\oigaysqlid.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\oigaysqlid.exeC:\Temp\oigaysqlid.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_oigaysqlid.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_oigaysqlid.exeC:\Temp\i_oigaysqlid.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\lidbvtnlfd.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\lidbvtnlfd.exeC:\Temp\lidbvtnlfd.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_lidbvtnlfd.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_lidbvtnlfd.exeC:\Temp\i_lidbvtnlfd.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ausnkfdxvp.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\ausnkfdxvp.exeC:\Temp\ausnkfdxvp.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ausnkfdxvp.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_ausnkfdxvp.exeC:\Temp\i_ausnkfdxvp.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\pnhfzxspki.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\pnhfzxspki.exeC:\Temp\pnhfzxspki.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_pnhfzxspki.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_pnhfzxspki.exeC:\Temp\i_pnhfzxspki.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\mkecxupnhf.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\mkecxupnhf.exeC:\Temp\mkecxupnhf.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_mkecxupnhf.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_mkecxupnhf.exeC:\Temp\i_mkecxupnhf.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\pjhbzurmke.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\pjhbzurmke.exeC:\Temp\pjhbzurmke.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_pjhbzurmke.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_pjhbzurmke.exeC:\Temp\i_pjhbzurmke.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\jecwuomgez.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\jecwuomgez.exeC:\Temp\jecwuomgez.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_jecwuomgez.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_jecwuomgez.exeC:\Temp\i_jecwuomgez.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ebwtomgeyw.exe ups_run2⤵
-
C:\Temp\ebwtomgeyw.exeC:\Temp\ebwtomgeyw.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ebwtomgeyw.exe ups_ins2⤵
-
C:\Temp\i_ebwtomgeyw.exeC:\Temp\i_ebwtomgeyw.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\tolgdytqlj.exe ups_run2⤵
-
C:\Temp\tolgdytqlj.exeC:\Temp\tolgdytqlj.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_tolgdytqlj.exe ups_ins2⤵
-
C:\Temp\i_tolgdytqlj.exeC:\Temp\i_tolgdytqlj.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\vqoigaytql.exe ups_run2⤵
-
C:\Temp\vqoigaytql.exeC:\Temp\vqoigaytql.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_vqoigaytql.exe ups_ins2⤵
-
C:\Temp\i_vqoigaytql.exeC:\Temp\i_vqoigaytql.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\nlfdxvpnif.exe ups_run2⤵
-
C:\Temp\nlfdxvpnif.exeC:\Temp\nlfdxvpnif.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_nlfdxvpnif.exe ups_ins2⤵
-
C:\Temp\i_nlfdxvpnif.exeC:\Temp\i_nlfdxvpnif.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\kfdxvpnhfa.exe ups_run2⤵
-
C:\Temp\kfdxvpnhfa.exeC:\Temp\kfdxvpnhfa.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_kfdxvpnhfa.exe ups_ins2⤵
-
C:\Temp\i_kfdxvpnhfa.exeC:\Temp\i_kfdxvpnhfa.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\fcxupnhfzx.exe ups_run2⤵
-
C:\Temp\fcxupnhfzx.exeC:\Temp\fcxupnhfzx.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_fcxupnhfzx.exe ups_ins2⤵
-
C:\Temp\i_fcxupnhfzx.exeC:\Temp\i_fcxupnhfzx.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\kecxupnhfz.exe ups_run2⤵
-
C:\Temp\kecxupnhfz.exeC:\Temp\kecxupnhfz.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_kecxupnhfz.exe ups_ins2⤵
-
C:\Temp\i_kecxupnhfz.exeC:\Temp\i_kecxupnhfz.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\zwrpjhbzur.exe ups_run2⤵
-
C:\Temp\zwrpjhbzur.exeC:\Temp\zwrpjhbzur.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_zwrpjhbzur.exe ups_ins2⤵
-
C:\Temp\i_zwrpjhbzur.exeC:\Temp\i_zwrpjhbzur.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\trljebwtom.exe ups_run2⤵
-
C:\Temp\trljebwtom.exeC:\Temp\trljebwtom.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_trljebwtom.exe ups_ins2⤵
-
C:\Temp\i_trljebwtom.exeC:\Temp\i_trljebwtom.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Temp\hbzurmkecw.sysC:\Temp\hbzurmkecw.sys1⤵
- Executes dropped EXE
-
C:\Temp\rpjhbztrmj.sysC:\Temp\rpjhbztrmj.sys1⤵
- Executes dropped EXE
-
C:\Temp\gbytrljdbv.sysC:\Temp\gbytrljdbv.sys1⤵
- Executes dropped EXE
-
C:\Temp\dbvtolgeyw.sysC:\Temp\dbvtolgeyw.sys1⤵
- Executes dropped EXE
-
C:\Temp\sqkidavtnl.sysC:\Temp\sqkidavtnl.sys1⤵
- Executes dropped EXE
-
C:\Temp\lfaysqkica.sysC:\Temp\lfaysqkica.sys1⤵
- Executes dropped EXE
-
C:\Temp\ausmkfcxup.sysC:\Temp\ausmkfcxup.sys1⤵
- Executes dropped EXE
-
C:\Temp\causmkecxu.sysC:\Temp\causmkecxu.sys1⤵
- Executes dropped EXE
-
C:\Temp\wupmhfzxrp.sysC:\Temp\wupmhfzxrp.sys1⤵
- Executes dropped EXE
-
C:\Temp\rljebwuomg.sysC:\Temp\rljebwuomg.sys1⤵
- Executes dropped EXE
-
C:\Temp\ljdbwtolge.sysC:\Temp\ljdbwtolge.sys1⤵
-
C:\Temp\lgeywqojgb.sysC:\Temp\lgeywqojgb.sys1⤵
-
C:\Temp\dbvtnlgdyw.sysC:\Temp\dbvtnlgdyw.sys1⤵
-
C:\Temp\ysqkidavsn.sysC:\Temp\ysqkidavsn.sys1⤵
-
C:\Temp\snkfcxvpnh.sysC:\Temp\snkfcxvpnh.sys1⤵
-
C:\Temp\usmkfcxupn.sysC:\Temp\usmkfcxupn.sys1⤵
-
C:\Temp\smkecwupmh.sysC:\Temp\smkecwupmh.sys1⤵
-
C:\Temp\kecwuomhez.sysC:\Temp\kecwuomhez.sys1⤵
-
C:\Temp\eywrojhbzt.sysC:\Temp\eywrojhbzt.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CP.exe
ausmkfcxup.sys
ausnkfdxvp.exe
dbvtolgeyw.sys
gbytrljdbv.sys
hbzurmkecw.sys
i_ausnkfdxvp.exe
i_jeywrojgbz.exe
i_lidbvtnlfd.exe
i_oigaysqlid.exe
i_usmkfzxrpj.exe
i_wrpjhbztrm.exe
i_ztrljdbwto.exe
jeywrojgbz.exe
lfaysqkica.sys
lidbvtnlfd.exe
oigaysqlid.exe
rpjhbztrmj.sys
sqkidavtnl.sys
usmkfzxrpj.exe
wrpjhbztrm.exe
ztrljdbwto.exe
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
RecoveryStore.{FAB428A3-49BC-11F1-9F8B-761C58CE68AA}.dat
RecoveryStore.{FAB44FB3-49BC-11F1-9F8B-761C58CE68AA}.dat
suggestions[1].en-US
memory/852-109-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1260-81-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1328-138-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1624-161-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1624-155-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2028-143-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2324-130-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2432-168-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2596-126-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2680-93-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3120-45-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3132-159-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3608-105-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3612-164-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4308-147-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4740-33-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5040-151-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5040-21-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5444-139-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5444-134-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5472-67-0x0000000000010000-0x0000000000083000-memory.dmp