Analysis
- max time kernel
149s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
10/05/2026, 12:59
General
- Target 2026-05-10_d3d9c88a722d3163e5888eb6de39f529_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
- Size 291KB
- Sample260510-p8a2ssct9m
- SHA256 5efd8f9f288751ce94d56ac85a78e92c2bef4fee18c51c9d45721af8ab45afef
Malware Config
Extracted
-
systex
-
http://xytets.com:2345/t.asp?os=wangba8102
-
http://xytets.com:2345/ll/out.txt
-
http://xytets.com:2345/t.asp?os=home8102
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Custom signatureUPX dump on OEP (original entry point) 64 IoCs
- Executes dropped EXE 64 IoCs
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- System Location Discovery: System Language Discovery 1 TTPs 44 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 58 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 19 IoCs
- Suspicious use of AdjustPrivilegeToken 20 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SetWindowsHookEx 10 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_d3d9c88a722d3163e5888eb6de39f529_coinminer_elex_redline-stealer_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-10_d3d9c88a722d3163e5888eb6de39f529_coinminer_elex_redline-stealer_rhadamanthys_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home81022⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4292 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2184 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\mgbztomgey.exe ups_run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\mgbztomgey.exeC:\Temp\mgbztomgey.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_mgbztomgey.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_mgbztomgey.exeC:\Temp\i_mgbztomgey.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ojgbytrljd.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\ojgbytrljd.exeC:\Temp\ojgbytrljd.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ojgbytrljd.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_ojgbytrljd.exeC:\Temp\i_ojgbytrljd.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\aytqljdbvt.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\aytqljdbvt.exeC:\Temp\aytqljdbvt.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_aytqljdbvt.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_aytqljdbvt.exeC:\Temp\i_aytqljdbvt.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ysicavsnlf.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\ysicavsnlf.exeC:\Temp\ysicavsnlf.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ysicavsnlf.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_ysicavsnlf.exeC:\Temp\i_ysicavsnlf.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\lfdxvpnifa.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\lfdxvpnifa.exeC:\Temp\lfdxvpnifa.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_lfdxvpnifa.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_lfdxvpnifa.exeC:\Temp\i_lfdxvpnifa.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\xsmkecxupn.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\xsmkecxupn.exeC:\Temp\xsmkecxupn.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_xsmkecxupn.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_xsmkecxupn.exeC:\Temp\i_xsmkecxupn.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\kecxupmhfz.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\kecxupmhfz.exeC:\Temp\kecxupmhfz.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_kecxupmhfz.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_kecxupmhfz.exeC:\Temp\i_kecxupmhfz.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\zuomgezwro.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\zuomgezwro.exeC:\Temp\zuomgezwro.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_zuomgezwro.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_zuomgezwro.exeC:\Temp\i_zuomgezwro.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\wuomgezwrp.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\wuomgezwrp.exeC:\Temp\wuomgezwrp.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_wuomgezwrp.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_wuomgezwrp.exeC:\Temp\i_wuomgezwrp.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\mgeywqojgb.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\mgeywqojgb.exeC:\Temp\mgeywqojgb.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_mgeywqojgb.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_mgeywqojgb.exeC:\Temp\i_mgeywqojgb.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\bvtnlgdyvq.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\bvtnlgdyvq.exeC:\Temp\bvtnlgdyvq.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_bvtnlgdyvq.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_bvtnlgdyvq.exeC:\Temp\i_bvtnlgdyvq.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\tnlfdxvqni.exe ups_run2⤵
-
C:\Temp\tnlfdxvqni.exeC:\Temp\tnlfdxvqni.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_tnlfdxvqni.exe ups_ins2⤵
-
C:\Temp\i_tnlfdxvqni.exeC:\Temp\i_tnlfdxvqni.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\pnifaysqki.exe ups_run2⤵
-
C:\Temp\pnifaysqki.exeC:\Temp\pnifaysqki.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_pnifaysqki.exe ups_ins2⤵
-
C:\Temp\i_pnifaysqki.exeC:\Temp\i_pnifaysqki.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\nhfaxsqkic.exe ups_run2⤵
-
C:\Temp\nhfaxsqkic.exeC:\Temp\nhfaxsqkic.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_nhfaxsqkic.exe ups_ins2⤵
-
C:\Temp\i_nhfaxsqkic.exeC:\Temp\i_nhfaxsqkic.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ecxupmhfzx.exe ups_run2⤵
-
C:\Temp\ecxupmhfzx.exeC:\Temp\ecxupmhfzx.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ecxupmhfzx.exe ups_ins2⤵
-
C:\Temp\i_ecxupmhfzx.exeC:\Temp\i_ecxupmhfzx.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\hfrpjhczur.exe ups_run2⤵
-
C:\Temp\hfrpjhczur.exeC:\Temp\hfrpjhczur.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_hfrpjhczur.exe ups_ins2⤵
-
C:\Temp\i_hfrpjhczur.exeC:\Temp\i_hfrpjhczur.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\bzurmjecwu.exe ups_run2⤵
-
C:\Temp\bzurmjecwu.exeC:\Temp\bzurmjecwu.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_bzurmjecwu.exe ups_ins2⤵
-
C:\Temp\i_bzurmjecwu.exeC:\Temp\i_bzurmjecwu.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ztrljebwto.exe ups_run2⤵
-
C:\Temp\ztrljebwto.exeC:\Temp\ztrljebwto.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ztrljebwto.exe ups_ins2⤵
-
C:\Temp\i_ztrljebwto.exeC:\Temp\i_ztrljebwto.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\bvtnlgdywq.exe ups_run2⤵
-
C:\Temp\bvtnlgdywq.exeC:\Temp\bvtnlgdywq.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_bvtnlgdywq.exe ups_ins2⤵
-
C:\Temp\i_bvtnlgdywq.exeC:\Temp\i_bvtnlgdywq.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ysqlidavtn.exe ups_run2⤵
-
C:\Temp\ysqlidavtn.exeC:\Temp\ysqlidavtn.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ysqlidavtn.exe ups_ins2⤵
-
C:\Temp\i_ysqlidavtn.exeC:\Temp\i_ysqlidavtn.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Temp\ytrljdbwto.sysC:\Temp\ytrljdbwto.sys1⤵
- Executes dropped EXE
-
C:\Temp\tnlgdqoiga.sysC:\Temp\tnlgdqoiga.sys1⤵
- Executes dropped EXE
-
C:\Temp\idbvtnlfdy.sysC:\Temp\idbvtnlfdy.sys1⤵
- Executes dropped EXE
-
C:\Temp\sqkicausnk.sysC:\Temp\sqkicausnk.sys1⤵
- Executes dropped EXE
-
C:\Temp\hcausnkfdx.sysC:\Temp\hcausnkfdx.sys1⤵
- Executes dropped EXE
-
C:\Temp\zpjhczusmk.sysC:\Temp\zpjhczusmk.sys1⤵
- Executes dropped EXE
-
C:\Temp\pmhfzxrpjh.sysC:\Temp\pmhfzxrpjh.sys1⤵
- Executes dropped EXE
-
C:\Temp\hbztrmjebw.sysC:\Temp\hbztrmjebw.sys1⤵
- Executes dropped EXE
-
C:\Temp\trljdbwtom.sysC:\Temp\trljdbwtom.sys1⤵
- Executes dropped EXE
-
C:\Temp\lgeywqoigb.sysC:\Temp\lgeywqoigb.sys1⤵
- Executes dropped EXE
-
C:\Temp\lgdywqoiga.sysC:\Temp\lgdywqoiga.sys1⤵
-
C:\Temp\dysqkidavt.sysC:\Temp\dysqkidavt.sys1⤵
-
C:\Temp\xsnkfcxvpn.sysC:\Temp\xsnkfcxvpn.sys1⤵
-
C:\Temp\xvpfzxspkh.sysC:\Temp\xvpfzxspkh.sys1⤵
-
C:\Temp\smkecwupmh.sysC:\Temp\smkecwupmh.sys1⤵
-
C:\Temp\mhezxrpjhb.sysC:\Temp\mhezxrpjhb.sys1⤵
-
C:\Temp\gezwrojhbz.sysC:\Temp\gezwrojhbz.sys1⤵
-
C:\Temp\jdbwtomywq.sysC:\Temp\jdbwtomywq.sys1⤵
-
C:\Temp\olgdywqoig.sysC:\Temp\olgdywqoig.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CP.exe
aytqljdbvt.exe
hcausnkfdx.sys
i_aytqljdbvt.exe
i_kecxupmhfz.exe
i_lfdxvpnifa.exe
i_mgbztomgey.exe
i_ojgbytrljd.exe
i_xsmkecxupn.exe
i_ysicavsnlf.exe
idbvtnlfdy.sys
kecxupmhfz.exe
lfdxvpnifa.exe
mgbztomgey.exe
ojgbytrljd.exe
pmhfzxrpjh.sys
sqkicausnk.sys
tnlgdqoiga.sys
xsmkecxupn.exe
ysicavsnlf.exe
ytrljdbwto.sys
zpjhczusmk.sys
zuomgezwro.exe
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
RecoveryStore.{65CE5937-4C70-11F1-87B0-EAA6BA3891E2}.dat
RecoveryStore.{65D0BBD9-4C70-11F1-87B0-EAA6BA3891E2}.dat
suggestions[1].en-US
memory/332-54-0x0000000000010000-0x0000000000083000-memory.dmp
memory/408-136-0x00000000000E0000-0x000000000012B000-memory.dmp
memory/408-138-0x00000000000E0000-0x000000000012B000-memory.dmp
memory/552-214-0x0000000000010000-0x0000000000083000-memory.dmp
memory/628-100-0x0000000000F70000-0x0000000000FBB000-memory.dmp
memory/628-97-0x0000000000F70000-0x0000000000FBB000-memory.dmp
memory/832-195-0x00000000001B0000-0x00000000001FB000-memory.dmp
memory/832-197-0x00000000001B0000-0x00000000001FB000-memory.dmp
memory/1044-144-0x0000000000AA0000-0x0000000000AEB000-memory.dmp
memory/1044-146-0x0000000000AA0000-0x0000000000AEB000-memory.dmp
memory/1044-75-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1092-208-0x00000000002D0000-0x000000000031B000-memory.dmp
memory/1092-209-0x00000000002D0000-0x000000000031B000-memory.dmp
memory/1280-213-0x00000000005A0000-0x00000000005EB000-memory.dmp
memory/1280-211-0x00000000005A0000-0x00000000005EB000-memory.dmp
memory/1500-22-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1500-189-0x00000000005C0000-0x000000000060B000-memory.dmp
memory/1500-187-0x00000000005C0000-0x000000000060B000-memory.dmp
memory/1684-193-0x0000000000610000-0x000000000065B000-memory.dmp
memory/1684-192-0x0000000000610000-0x000000000065B000-memory.dmp
memory/2016-174-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2076-235-0x00000000001E0000-0x000000000022B000-memory.dmp
memory/2252-58-0x0000000000030000-0x000000000007B000-memory.dmp
memory/2252-61-0x0000000000030000-0x000000000007B000-memory.dmp
memory/2392-203-0x0000000000500000-0x000000000054B000-memory.dmp
memory/2392-205-0x0000000000500000-0x000000000054B000-memory.dmp
memory/2396-224-0x00000000007F0000-0x000000000083B000-memory.dmp
memory/2396-225-0x00000000007F0000-0x000000000083B000-memory.dmp
memory/2408-182-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2424-43-0x0000000000AD0000-0x0000000000B1B000-memory.dmp
memory/2424-45-0x0000000000AD0000-0x0000000000B1B000-memory.dmp
memory/2568-139-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2568-148-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2648-142-0x0000000000380000-0x00000000003CB000-memory.dmp
memory/2648-141-0x0000000000380000-0x00000000003CB000-memory.dmp
memory/2784-88-0x0000000000CC0000-0x0000000000D0B000-memory.dmp
memory/2784-91-0x0000000000CC0000-0x0000000000D0B000-memory.dmp
memory/2992-198-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3004-151-0x0000000000EE0000-0x0000000000F2B000-memory.dmp
memory/3004-150-0x0000000000EE0000-0x0000000000F2B000-memory.dmp
memory/3016-219-0x00000000003E0000-0x000000000042B000-memory.dmp
memory/3016-221-0x00000000003E0000-0x000000000042B000-memory.dmp
memory/3112-147-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3140-227-0x00000000003F0000-0x000000000043B000-memory.dmp
memory/3140-229-0x00000000003F0000-0x000000000043B000-memory.dmp
memory/3184-49-0x00000000001B0000-0x00000000001FB000-memory.dmp
memory/3184-52-0x00000000001B0000-0x00000000001FB000-memory.dmp
memory/3340-230-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3352-222-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3372-112-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3448-65-0x0000000000BD0000-0x0000000000C1B000-memory.dmp
memory/3448-73-0x0000000000BD0000-0x0000000000C1B000-memory.dmp
memory/3772-200-0x0000000000D50000-0x0000000000D9B000-memory.dmp
memory/3772-201-0x0000000000D50000-0x0000000000D9B000-memory.dmp
memory/3820-12-0x0000000000280000-0x00000000002CB000-memory.dmp
memory/3820-10-0x0000000000280000-0x00000000002CB000-memory.dmp
memory/3908-20-0x0000000000290000-0x00000000002DB000-memory.dmp
memory/3908-0-0x0000000000290000-0x00000000002DB000-memory.dmp
memory/3996-38-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4028-156-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4052-93-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4112-33-0x0000000000590000-0x00000000005DB000-memory.dmp
memory/4112-36-0x0000000000590000-0x00000000005DB000-memory.dmp
memory/4116-177-0x0000000000BB0000-0x0000000000BFB000-memory.dmp
memory/4116-176-0x0000000000BB0000-0x0000000000BFB000-memory.dmp
memory/4156-128-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4320-181-0x0000000000E10000-0x0000000000E5B000-memory.dmp
memory/4320-179-0x0000000000E10000-0x0000000000E5B000-memory.dmp
memory/4340-153-0x0000000000610000-0x000000000065B000-memory.dmp
memory/4340-155-0x0000000000610000-0x000000000065B000-memory.dmp
memory/4348-185-0x00000000002A0000-0x00000000002EB000-memory.dmp
memory/4348-184-0x00000000002A0000-0x00000000002EB000-memory.dmp
memory/4380-216-0x0000000000570000-0x00000000005BB000-memory.dmp
memory/4380-217-0x0000000000570000-0x00000000005BB000-memory.dmp
memory/4452-232-0x0000000000EF0000-0x0000000000F3B000-memory.dmp
memory/4452-233-0x0000000000EF0000-0x0000000000F3B000-memory.dmp
memory/4456-29-0x0000000000DA0000-0x0000000000DEB000-memory.dmp
memory/4456-27-0x0000000000DA0000-0x0000000000DEB000-memory.dmp
memory/4492-104-0x00000000008C0000-0x000000000090B000-memory.dmp
memory/4492-110-0x00000000008C0000-0x000000000090B000-memory.dmp
memory/4500-84-0x0000000000230000-0x000000000027B000-memory.dmp
memory/4500-81-0x0000000000230000-0x000000000027B000-memory.dmp
memory/4580-132-0x00000000008C0000-0x000000000090B000-memory.dmp
memory/4580-134-0x00000000008C0000-0x000000000090B000-memory.dmp
memory/4624-19-0x0000000000A80000-0x0000000000ACB000-memory.dmp
memory/4624-16-0x0000000000A80000-0x0000000000ACB000-memory.dmp
memory/4628-126-0x00000000003E0000-0x000000000042B000-memory.dmp
memory/4628-123-0x00000000003E0000-0x000000000042B000-memory.dmp
memory/4672-190-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4736-161-0x0000000000080000-0x00000000000CB000-memory.dmp
memory/4736-173-0x0000000000080000-0x00000000000CB000-memory.dmp
memory/4820-206-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4884-119-0x00000000002A0000-0x00000000002EB000-memory.dmp
memory/4884-116-0x00000000002A0000-0x00000000002EB000-memory.dmp
memory/5108-158-0x00000000008B0000-0x00000000008FB000-memory.dmp
memory/5108-159-0x00000000008B0000-0x00000000008FB000-memory.dmp