Analysis
- max time kernel
149s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
09/05/2026, 03:58
General
- Target 2026-05-09_b96af26a0fa0d63ee0af813e2644b19e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 376KB
- Sample260509-ejnlgsdy6m
- SHA256 c565ddfd9e92161d2f180d080db5514bc67d596ab51f439e3a029846ce401dad
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 44 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 32 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious use of AdjustPrivilegeToken 20 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-09_b96af26a0fa0d63ee0af813e2644b19e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-09_b96af26a0fa0d63ee0af813e2644b19e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\ztrmjecwuomgezwr.exeC:\Temp\ztrmjecwuomgezwr.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jebwuomgbz.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\jebwuomgbz.exeC:\Temp\jebwuomgbz.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jebwuomgbz.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jebwuomgbz.exeC:\Temp\i_jebwuomgbz.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\oigbytrlgd.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\oigbytrlgd.exeC:\Temp\oigbytrlgd.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_oigbytrlgd.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_oigbytrlgd.exeC:\Temp\i_oigbytrlgd.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\olgeywqoig.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\olgeywqoig.exeC:\Temp\olgeywqoig.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_olgeywqoig.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_olgeywqoig.exeC:\Temp\i_olgeywqoig.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gaysqlidav.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\gaysqlidav.exeC:\Temp\gaysqlidav.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gaysqlidav.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_gaysqlidav.exeC:\Temp\i_gaysqlidav.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ysqkicavsn.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ysqkicavsn.exeC:\Temp\ysqkicavsn.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ysqkicavsn.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ysqkicavsn.exeC:\Temp\i_ysqkicavsn.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\spkicausmk.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\spkicausmk.exeC:\Temp\spkicausmk.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_spkicausmk.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_spkicausmk.exeC:\Temp\i_spkicausmk.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\usmkfcxvpn.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\usmkfcxvpn.exeC:\Temp\usmkfcxvpn.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_usmkfcxvpn.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_usmkfcxvpn.exeC:\Temp\i_usmkfcxvpn.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pjhczurmke.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\pjhczurmke.exeC:\Temp\pjhczurmke.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pjhczurmke.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_pjhczurmke.exeC:\Temp\i_pjhczurmke.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mgezwrpjhb.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\mgezwrpjhb.exeC:\Temp\mgezwrpjhb.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mgezwrpjhb.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_mgezwrpjhb.exeC:\Temp\i_mgezwrpjhb.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\geywqojgbz.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\geywqojgbz.exeC:\Temp\geywqojgbz.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_geywqojgbz.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_geywqojgbz.exeC:\Temp\i_geywqojgbz.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\oigbytolgd.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\oigbytolgd.exeC:\Temp\oigbytolgd.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_oigbytolgd.exe ups_ins3⤵
-
C:\Temp\i_oigbytolgd.exeC:\Temp\i_oigbytolgd.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\igaytqlidb.exe ups_run3⤵
-
C:\Temp\igaytqlidb.exeC:\Temp\igaytqlidb.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_igaytqlidb.exe ups_ins3⤵
-
C:\Temp\i_igaytqlidb.exeC:\Temp\i_igaytqlidb.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\icavsnlfdx.exe ups_run3⤵
-
C:\Temp\icavsnlfdx.exeC:\Temp\icavsnlfdx.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_icavsnlfdx.exe ups_ins3⤵
-
C:\Temp\i_icavsnlfdx.exeC:\Temp\i_icavsnlfdx.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fdxvpnhfax.exe ups_run3⤵
-
C:\Temp\fdxvpnhfax.exeC:\Temp\fdxvpnhfax.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fdxvpnhfax.exe ups_ins3⤵
-
C:\Temp\i_fdxvpnhfax.exeC:\Temp\i_fdxvpnhfax.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kfcxvpnhfa.exe ups_run3⤵
-
C:\Temp\kfcxvpnhfa.exeC:\Temp\kfcxvpnhfa.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kfcxvpnhfa.exe ups_ins3⤵
-
C:\Temp\i_kfcxvpnhfa.exeC:\Temp\i_kfcxvpnhfa.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hczusmkecw.exe ups_run3⤵
-
C:\Temp\hczusmkecw.exeC:\Temp\hczusmkecw.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hczusmkecw.exe ups_ins3⤵
-
C:\Temp\i_hczusmkecw.exeC:\Temp\i_hczusmkecw.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ezwrpjhbzu.exe ups_run3⤵
-
C:\Temp\ezwrpjhbzu.exeC:\Temp\ezwrpjhbzu.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ezwrpjhbzu.exe ups_ins3⤵
-
C:\Temp\i_ezwrpjhbzu.exeC:\Temp\i_ezwrpjhbzu.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bztrmjebwu.exe ups_run3⤵
-
C:\Temp\bztrmjebwu.exeC:\Temp\bztrmjebwu.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bztrmjebwu.exe ups_ins3⤵
-
C:\Temp\i_bztrmjebwu.exeC:\Temp\i_bztrmjebwu.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jebwtomgey.exe ups_run3⤵
-
C:\Temp\jebwtomgey.exeC:\Temp\jebwtomgey.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jebwtomgey.exe ups_ins3⤵
-
C:\Temp\i_jebwtomgey.exeC:\Temp\i_jebwtomgey.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dywqoigayt.exe ups_run3⤵
-
C:\Temp\dywqoigayt.exeC:\Temp\dywqoigayt.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dywqoigayt.exe ups_ins3⤵
-
C:\Temp\i_dywqoigayt.exeC:\Temp\i_dywqoigayt.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4164 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Temp\ztrmjecwuomgezwr.sysC:\Temp\ztrmjecwuomgezwr.sys1⤵
- Executes dropped EXE
-
C:\Temp\ebwuomgeyw.sysC:\Temp\ebwuomgeyw.sys1⤵
- Executes dropped EXE
-
C:\Temp\ytqljdbvtn.sysC:\Temp\ytqljdbvtn.sys1⤵
- Executes dropped EXE
-
C:\Temp\nlfdyvqoig.sysC:\Temp\nlfdyvqoig.sys1⤵
- Executes dropped EXE
-
C:\Temp\fdxvqnifay.sysC:\Temp\fdxvqnifay.sys1⤵
- Executes dropped EXE
-
C:\Temp\lfdxvpnifa.sysC:\Temp\lfdxvpnifa.sys1⤵
- Executes dropped EXE
-
C:\Temp\causmkecxu.sysC:\Temp\causmkecxu.sys1⤵
- Executes dropped EXE
-
C:\Temp\wupmhfzxrp.sysC:\Temp\wupmhfzxrp.sys1⤵
- Executes dropped EXE
-
C:\Temp\urmkecwuom.sysC:\Temp\urmkecwuom.sys1⤵
- Executes dropped EXE
-
C:\Temp\ztrmjecwuo.sysC:\Temp\ztrmjecwuo.sys1⤵
- Executes dropped EXE
-
C:\Temp\wtomgeywqo.sysC:\Temp\wtomgeywqo.sys1⤵
- Executes dropped EXE
-
C:\Temp\tnlgdywqoi.sysC:\Temp\tnlgdywqoi.sys1⤵
-
C:\Temp\qnigaysqki.sysC:\Temp\qnigaysqki.sys1⤵
-
C:\Temp\ysqkidavtn.sysC:\Temp\ysqkidavtn.sys1⤵
-
C:\Temp\sqkicausnk.sysC:\Temp\sqkicausnk.sys1⤵
-
C:\Temp\pmhfzxrpkh.sysC:\Temp\pmhfzxrpkh.sys1⤵
-
C:\Temp\mkecwuomhe.sysC:\Temp\mkecwuomhe.sys1⤵
-
C:\Temp\rojhbztrmj.sysC:\Temp\rojhbztrmj.sys1⤵
-
C:\Temp\rojhbztrlj.sysC:\Temp\rojhbztrlj.sys1⤵
-
C:\Temp\ojdbvtolge.sysC:\Temp\ojdbvtolge.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CreateProcess.exe
causmkecxu.sys
ebwuomgeyw.sys
fdxvqnifay.sys
gaysqlidav.exe
i_gaysqlidav.exe
i_jebwuomgbz.exe
i_oigbytrlgd.exe
i_olgeywqoig.exe
i_spkicausmk.exe
i_usmkfcxvpn.exe
i_ysqkicavsn.exe
jebwuomgbz.exe
lfdxvpnifa.sys
nlfdyvqoig.sys
oigbytrlgd.exe
olgeywqoig.exe
pjhczurmke.exe
spkicausmk.exe
usmkfcxvpn.exe
wupmhfzxrp.sys
ysqkicavsn.exe
ytqljdbvtn.sys
ztrmjecwuomgezwr.exe
ztrmjecwuomgezwr.sys
suggestions[1].en-US
memory/220-124-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1260-71-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1616-152-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1696-45-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1752-144-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1828-128-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1832-132-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2604-86-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2680-148-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2968-57-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3244-136-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3432-33-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3800-160-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4116-156-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4180-106-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4504-120-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4592-98-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4708-140-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4708-14-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4852-21-0x0000000000010000-0x00000000000AB000-memory.dmp