Analysis
- max time kernel
149s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
09/05/2026, 22:30
General
- Target 2026-05-09_852fc406678cfb7e3716d0b4b1c8e70d_amadey_darkgate_elex_smoke-loader_stop.exe
- Size 384KB
- Sample260509-2e8r7agy6m
- SHA256 fcf76d1db2169d8772357248b4ea875803ba5918f5ab80ec00d0b85f989e9070
Score
10/10
Malware Config
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 44 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 31 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious use of AdjustPrivilegeToken 20 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-09_852fc406678cfb7e3716d0b4b1c8e70d_amadey_darkgate_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-09_852fc406678cfb7e3716d0b4b1c8e70d_amadey_darkgate_elex_smoke-loader_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\mhfzxrpjhczusmke.exeC:\Temp\mhfzxrpjhczusmke.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xrpjhczurm.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\xrpjhczurm.exeC:\Temp\xrpjhczurm.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xrpjhczurm.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_xrpjhczurm.exeC:\Temp\i_xrpjhczurm.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hezpjhbztr.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\hezpjhbztr.exeC:\Temp\hezpjhbztr.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hezpjhbztr.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_hezpjhbztr.exeC:\Temp\i_hezpjhbztr.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ezwrojhbzt.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ezwrojhbzt.exeC:\Temp\ezwrojhbzt.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ezwrojhbzt.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ezwrojhbzt.exeC:\Temp\i_ezwrojhbzt.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vtolgeywqo.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\vtolgeywqo.exeC:\Temp\vtolgeywqo.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vtolgeywqo.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_vtolgeywqo.exeC:\Temp\i_vtolgeywqo.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qlidbvtnlg.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\qlidbvtnlg.exeC:\Temp\qlidbvtnlg.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qlidbvtnlg.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_qlidbvtnlg.exeC:\Temp\i_qlidbvtnlg.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qoigaysida.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\qoigaysida.exeC:\Temp\qoigaysida.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qoigaysida.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_qoigaysida.exeC:\Temp\i_qoigaysida.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fdxvpnifax.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\fdxvpnifax.exeC:\Temp\fdxvpnifax.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fdxvpnifax.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_fdxvpnifax.exeC:\Temp\i_fdxvpnifax.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zxrpkhcaus.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\zxrpkhcaus.exeC:\Temp\zxrpkhcaus.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zxrpkhcaus.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_zxrpkhcaus.exeC:\Temp\i_zxrpkhcaus.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wupmhfzxrp.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\wupmhfzxrp.exeC:\Temp\wupmhfzxrp.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wupmhfzxrp.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_wupmhfzxrp.exeC:\Temp\i_wupmhfzxrp.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\cwuomhezxr.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\cwuomhezxr.exeC:\Temp\cwuomhezxr.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_cwuomhezxr.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_cwuomhezxr.exeC:\Temp\i_cwuomhezxr.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ywrojhbztr.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ywrojhbztr.exeC:\Temp\ywrojhbztr.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ywrojhbztr.exe ups_ins3⤵
-
C:\Temp\i_ywrojhbztr.exeC:\Temp\i_ywrojhbztr.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ztrljdbwto.exe ups_run3⤵
-
C:\Temp\ztrljdbwto.exeC:\Temp\ztrljdbwto.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ztrljdbwto.exe ups_ins3⤵
-
C:\Temp\i_ztrljdbwto.exeC:\Temp\i_ztrljdbwto.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\tqljdbvtnl.exe ups_run3⤵
-
C:\Temp\tqljdbvtnl.exeC:\Temp\tqljdbvtnl.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_tqljdbvtnl.exe ups_ins3⤵
-
C:\Temp\i_tqljdbvtnl.exeC:\Temp\i_tqljdbvtnl.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vqnigaytql.exe ups_run3⤵
-
C:\Temp\vqnigaytql.exeC:\Temp\vqnigaytql.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vqnigaytql.exe ups_ins3⤵
-
C:\Temp\i_vqnigaytql.exeC:\Temp\i_vqnigaytql.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\sqkidavsnl.exe ups_run3⤵
-
C:\Temp\sqkidavsnl.exeC:\Temp\sqkidavsnl.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_sqkidavsnl.exe ups_ins3⤵
-
C:\Temp\i_sqkidavsnl.exeC:\Temp\i_sqkidavsnl.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qkicausnkf.exe ups_run3⤵
-
C:\Temp\qkicausnkf.exeC:\Temp\qkicausnkf.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qkicausnkf.exe ups_ins3⤵
-
C:\Temp\i_qkicausnkf.exeC:\Temp\i_qkicausnkf.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\khcausmkec.exe ups_run3⤵
-
C:\Temp\khcausmkec.exeC:\Temp\khcausmkec.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_khcausmkec.exe ups_ins3⤵
-
C:\Temp\i_khcausmkec.exeC:\Temp\i_khcausmkec.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pnhfzxrpkh.exe ups_run3⤵
-
C:\Temp\pnhfzxrpkh.exeC:\Temp\pnhfzxrpkh.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pnhfzxrpkh.exe ups_ins3⤵
-
C:\Temp\i_pnhfzxrpkh.exeC:\Temp\i_pnhfzxrpkh.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mjecwuomge.exe ups_run3⤵
-
C:\Temp\mjecwuomge.exeC:\Temp\mjecwuomge.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mjecwuomge.exe ups_ins3⤵
-
C:\Temp\i_mjecwuomge.exeC:\Temp\i_mjecwuomge.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jhbztrljeb.exe ups_run3⤵
-
C:\Temp\jhbztrljeb.exeC:\Temp\jhbztrljeb.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jhbztrljeb.exe ups_ins3⤵
-
C:\Temp\i_jhbztrljeb.exeC:\Temp\i_jhbztrljeb.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4836 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Temp\mhfzxrpjhczusmke.sysC:\Temp\mhfzxrpjhczusmke.sys1⤵
- Executes dropped EXE
-
C:\Temp\rmjecwuomh.sysC:\Temp\rmjecwuomh.sys1⤵
- Executes dropped EXE
-
C:\Temp\mgeywrojgb.sysC:\Temp\mgeywrojgb.sys1⤵
- Executes dropped EXE
-
C:\Temp\gbytrljdbw.sysC:\Temp\gbytrljdbw.sys1⤵
- Executes dropped EXE
-
C:\Temp\geywqoigtq.sysC:\Temp\geywqoigtq.sys1⤵
- Executes dropped EXE
-
C:\Temp\avqnigaysq.sysC:\Temp\avqnigaysq.sys1⤵
- Executes dropped EXE
-
C:\Temp\qkicavsnlf.sysC:\Temp\qkicavsnlf.sys1⤵
- Executes dropped EXE
-
C:\Temp\kfcxvpnhfz.sysC:\Temp\kfcxvpnhfz.sys1⤵
- Executes dropped EXE
-
C:\Temp\pkhcausmkf.sysC:\Temp\pkhcausmkf.sys1⤵
- Executes dropped EXE
-
C:\Temp\jhczusmkec.sysC:\Temp\jhczusmkec.sys1⤵
- Executes dropped EXE
-
C:\Temp\jebwuomgez.sysC:\Temp\jebwuomgez.sys1⤵
- Executes dropped EXE
-
C:\Temp\geywrojgbz.sysC:\Temp\geywrojgbz.sys1⤵
-
C:\Temp\mgeywqojgb.sysC:\Temp\mgeywqojgb.sys1⤵
-
C:\Temp\dbvtnlfdyv.sysC:\Temp\dbvtnlfdyv.sys1⤵
-
C:\Temp\dyvqnigays.sysC:\Temp\dyvqnigays.sys1⤵
-
C:\Temp\xvpnifaxsq.sysC:\Temp\xvpnifaxsq.sys1⤵
-
C:\Temp\dxvpnhfaxs.sysC:\Temp\dxvpnhfaxs.sys1⤵
-
C:\Temp\zusmkecwup.sysC:\Temp\zusmkecwup.sys1⤵
-
C:\Temp\xrpjhbzurm.sysC:\Temp\xrpjhbzurm.sys1⤵
-
C:\Temp\uomgezwroj.sysC:\Temp\uomgezwroj.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CreateProcess.exe
avqnigaysq.sys
ezwrojhbzt.exe
fdxvpnifax.exe
gbytrljdbw.sys
geywqoigtq.sys
hezpjhbztr.exe
i_ezwrojhbzt.exe
i_fdxvpnifax.exe
i_hezpjhbztr.exe
i_qlidbvtnlg.exe
i_qoigaysida.exe
i_vtolgeywqo.exe
i_xrpjhczurm.exe
kfcxvpnhfz.sys
mgeywrojgb.sys
mhfzxrpjhczusmke.exe
mhfzxrpjhczusmke.sys
qkicavsnlf.sys
qlidbvtnlg.exe
qoigaysida.exe
rmjecwuomh.sys
vtolgeywqo.exe
xrpjhczurm.exe
zxrpkhcaus.exe
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
suggestions[1].en-US
memory/220-136-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/468-50-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/952-168-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1112-144-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1328-105-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1560-132-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1616-93-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1708-111-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1776-19-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1780-38-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2632-115-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2972-160-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3564-156-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3572-152-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4248-148-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4344-140-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4544-26-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4740-81-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5068-164-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5108-65-0x0000000000010000-0x00000000000AB000-memory.dmp