Analysis
- max time kernel
149s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
11/05/2026, 00:42
General
- Target 2026-05-11_2bc365c29d5c7d8180bba14ba6a74ae1_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 361KB
- Sample260511-a2jm2ab15m
- SHA256 312fb5d9ac28ee61ab826ef3a3b30be78e303c712f231b03b1870b1c705d7d8e
Malware Config
Extracted
-
systex
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 43 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 35 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 62 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-11_2bc365c29d5c7d8180bba14ba6a74ae1_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-11_2bc365c29d5c7d8180bba14ba6a74ae1_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\eywrojgbztrljebw.exeC:\Temp\eywrojgbztrljebw.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ojhbztrlje.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\ojhbztrlje.exeC:\Temp\ojhbztrlje.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ojhbztrlje.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ojhbztrlje.exeC:\Temp\i_ojhbztrlje.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qljdbvtnlg.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\qljdbvtnlg.exeC:\Temp\qljdbvtnlg.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qljdbvtnlg.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_qljdbvtnlg.exeC:\Temp\i_qljdbvtnlg.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\idbvtnlgdy.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\idbvtnlgdy.exeC:\Temp\idbvtnlgdy.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_idbvtnlgdy.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_idbvtnlgdy.exeC:\Temp\i_idbvtnlgdy.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\avtnlfdxvq.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\avtnlfdxvq.exeC:\Temp\avtnlfdxvq.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_avtnlfdxvq.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_avtnlfdxvq.exeC:\Temp\i_avtnlfdxvq.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vsnlfaxsqk.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\vsnlfaxsqk.exeC:\Temp\vsnlfaxsqk.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vsnlfaxsqk.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_vsnlfaxsqk.exeC:\Temp\i_vsnlfaxsqk.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nhfzxspkic.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\nhfzxspkic.exeC:\Temp\nhfzxspkic.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nhfzxspkic.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_nhfzxspkic.exeC:\Temp\i_nhfzxspkic.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wuomhfzxrp.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\wuomhfzxrp.exeC:\Temp\wuomhfzxrp.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wuomhfzxrp.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_wuomhfzxrp.exeC:\Temp\i_wuomhfzxrp.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\omhezxrpjh.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\omhezxrpjh.exeC:\Temp\omhezxrpjh.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_omhezxrpjh.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_omhezxrpjh.exeC:\Temp\i_omhezxrpjh.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jhbztrmjeb.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jhbztrmjeb.exeC:\Temp\jhbztrmjeb.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jhbztrmjeb.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jhbztrmjeb.exeC:\Temp\i_jhbztrmjeb.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\eywqojgbzt.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\eywqojgbzt.exeC:\Temp\eywqojgbzt.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_eywqojgbzt.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_eywqojgbzt.exeC:\Temp\i_eywqojgbzt.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\tqljdbvtnl.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\tqljdbvtnl.exeC:\Temp\tqljdbvtnl.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_tqljdbvtnl.exe ups_ins3⤵
-
C:\Temp\i_tqljdbvtnl.exeC:\Temp\i_tqljdbvtnl.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nigaysqlid.exe ups_run3⤵
-
C:\Temp\nigaysqlid.exeC:\Temp\nigaysqlid.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nigaysqlid.exe ups_ins3⤵
-
C:\Temp\i_nigaysqlid.exeC:\Temp\i_nigaysqlid.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kidavsnlfd.exe ups_run3⤵
-
C:\Temp\kidavsnlfd.exeC:\Temp\kidavsnlfd.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kidavsnlfd.exe ups_ins3⤵
-
C:\Temp\i_kidavsnlfd.exeC:\Temp\i_kidavsnlfd.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fcxvpnhfzx.exe ups_run3⤵
-
C:\Temp\fcxvpnhfzx.exeC:\Temp\fcxvpnhfzx.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fcxvpnhfzx.exe ups_ins3⤵
-
C:\Temp\i_fcxvpnhfzx.exeC:\Temp\i_fcxvpnhfzx.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\cxupjhczus.exe ups_run3⤵
-
C:\Temp\cxupjhczus.exeC:\Temp\cxupjhczus.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_cxupjhczus.exe ups_ins3⤵
-
C:\Temp\i_cxupjhczus.exeC:\Temp\i_cxupjhczus.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\uomhezwrpj.exe ups_run3⤵
-
C:\Temp\uomhezwrpj.exeC:\Temp\uomhezwrpj.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_uomhezwrpj.exe ups_ins3⤵
-
C:\Temp\i_uomhezwrpj.exeC:\Temp\i_uomhezwrpj.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wuomgezwrp.exe ups_run3⤵
-
C:\Temp\wuomgezwrp.exeC:\Temp\wuomgezwrp.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wuomgezwrp.exe ups_ins3⤵
-
C:\Temp\i_wuomgezwrp.exeC:\Temp\i_wuomgezwrp.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qojgbztrlj.exe ups_run3⤵
-
C:\Temp\qojgbztrlj.exeC:\Temp\qojgbztrlj.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qojgbztrlj.exe ups_ins3⤵
-
C:\Temp\i_qojgbztrlj.exeC:\Temp\i_qojgbztrlj.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ljdbvtolge.exe ups_run3⤵
-
C:\Temp\ljdbvtolge.exeC:\Temp\ljdbvtolge.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ljdbvtolge.exe ups_ins3⤵
-
C:\Temp\i_ljdbvtolge.exeC:\Temp\i_ljdbvtolge.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gaytqlidbv.exe ups_run3⤵
-
C:\Temp\gaytqlidbv.exeC:\Temp\gaytqlidbv.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4164 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Temp\eywrojgbztrljebw.sysC:\Temp\eywrojgbztrljebw.sys1⤵
- Executes dropped EXE
-
C:\Temp\bztrljdbwt.sysC:\Temp\bztrljdbwt.sys1⤵
- Executes dropped EXE
-
C:\Temp\tnlgdyvqoi.sysC:\Temp\tnlgdyvqoi.sys1⤵
- Executes dropped EXE
-
C:\Temp\tnlfdyvqoi.sysC:\Temp\tnlfdyvqoi.sys1⤵
- Executes dropped EXE
-
C:\Temp\idxvpnifay.sysC:\Temp\idxvpnifay.sys1⤵
- Executes dropped EXE
-
C:\Temp\xspkicausm.sysC:\Temp\xspkicausm.sys1⤵
- Executes dropped EXE
-
C:\Temp\kecxupnhfz.sysC:\Temp\kecxupnhfz.sys1⤵
- Executes dropped EXE
-
C:\Temp\hezxrpjhcz.sysC:\Temp\hezxrpjhcz.sys1⤵
- Executes dropped EXE
-
C:\Temp\uomgeywroj.sysC:\Temp\uomgeywroj.sys1⤵
- Executes dropped EXE
-
C:\Temp\ojgbztrljd.sysC:\Temp\ojgbztrljd.sys1⤵
- Executes dropped EXE
-
C:\Temp\dbvtnlgdyw.sysC:\Temp\dbvtnlgdyw.sys1⤵
- Executes dropped EXE
-
C:\Temp\gaytqlidbv.sysC:\Temp\gaytqlidbv.sys1⤵
-
C:\Temp\ysnlfdxvpn.sysC:\Temp\ysnlfdxvpn.sys1⤵
-
C:\Temp\pnhfaxsqki.sysC:\Temp\pnhfaxsqki.sys1⤵
-
C:\Temp\nhfzxspkhc.sysC:\Temp\nhfzxspkhc.sys1⤵
-
C:\Temp\mhezxrpjhc.sysC:\Temp\mhezxrpjhc.sys1⤵
-
C:\Temp\gezwrpjhbz.sysC:\Temp\gezwrpjhbz.sys1⤵
-
C:\Temp\eywrojhbzt.sysC:\Temp\eywrojhbzt.sys1⤵
-
C:\Temp\vtolgdywqo.sysC:\Temp\vtolgdywqo.sys1⤵
-
C:\Temp\ytqljdbvtn.sysC:\Temp\ytqljdbvtn.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CreateProcess.exe
avtnlfdxvq.exe
bztrljdbwt.sys
eywrojgbztrljebw.exe
eywrojgbztrljebw.sys
hezxrpjhcz.sys
i_avtnlfdxvq.exe
i_idbvtnlgdy.exe
i_nhfzxspkic.exe
i_ojhbztrlje.exe
i_qljdbvtnlg.exe
i_vsnlfaxsqk.exe
i_wuomhfzxrp.exe
idbvtnlgdy.exe
idxvpnifay.sys
kecxupnhfz.sys
nhfzxspkic.exe
ojhbztrlje.exe
omhezxrpjh.exe
qljdbvtnlg.exe
tnlfdyvqoi.sys
tnlgdyvqoi.sys
vsnlfaxsqk.exe
wuomhfzxrp.exe
xspkicausm.sys
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
suggestions[1].en-US
memory/220-22-0x0000000000850000-0x000000000092C000-memory.dmp
memory/364-202-0x00000000008A0000-0x000000000097C000-memory.dmp
memory/548-206-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/556-112-0x00000000007A0000-0x000000000087C000-memory.dmp
memory/712-174-0x00000000008F0000-0x00000000009CC000-memory.dmp
memory/756-24-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/852-121-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/880-132-0x0000000000930000-0x0000000000A0C000-memory.dmp
memory/932-67-0x00000000008A0000-0x000000000097C000-memory.dmp
memory/1016-45-0x00000000008B0000-0x000000000098C000-memory.dmp
memory/1080-173-0x0000000000950000-0x0000000000A2C000-memory.dmp
memory/1164-159-0x0000000000940000-0x0000000000A1C000-memory.dmp
memory/1280-72-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1468-167-0x0000000000860000-0x000000000093C000-memory.dmp
memory/1628-185-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1628-157-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1628-220-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1684-39-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1700-82-0x0000000000960000-0x0000000000A3C000-memory.dmp
memory/1744-222-0x0000000000940000-0x0000000000A1C000-memory.dmp
memory/1768-219-0x00000000008C0000-0x000000000099C000-memory.dmp
memory/1852-89-0x00000000008D0000-0x00000000009AC000-memory.dmp
memory/1972-37-0x0000000000940000-0x0000000000A1C000-memory.dmp
memory/2024-212-0x0000000000860000-0x000000000093C000-memory.dmp
memory/2252-54-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2292-14-0x0000000000960000-0x0000000000A3C000-memory.dmp
memory/2348-199-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2396-181-0x0000000000970000-0x0000000000A4C000-memory.dmp
memory/2520-156-0x0000000000810000-0x00000000008EC000-memory.dmp
memory/2560-166-0x00000000008C0000-0x000000000099C000-memory.dmp
memory/2632-83-0x0000000000920000-0x00000000009FC000-memory.dmp
memory/2736-160-0x0000000000890000-0x000000000096C000-memory.dmp
memory/2756-201-0x0000000000910000-0x00000000009EC000-memory.dmp
memory/2780-205-0x0000000000890000-0x000000000096C000-memory.dmp
memory/3056-184-0x0000000000960000-0x0000000000A3C000-memory.dmp
memory/3084-106-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3100-31-0x0000000000920000-0x00000000009FC000-memory.dmp
memory/3132-113-0x0000000000980000-0x0000000000A5C000-memory.dmp
memory/3136-61-0x0000000000870000-0x000000000094C000-memory.dmp
memory/3380-133-0x0000000000860000-0x000000000093C000-memory.dmp
memory/3392-153-0x00000000008E0000-0x00000000009BC000-memory.dmp
memory/3452-150-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3580-170-0x0000000000980000-0x0000000000A5C000-memory.dmp
memory/3624-198-0x0000000000970000-0x0000000000A4C000-memory.dmp
memory/3716-129-0x0000000000890000-0x000000000096C000-memory.dmp
memory/3728-13-0x0000000000790000-0x000000000086C000-memory.dmp
memory/3788-130-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3868-164-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3908-209-0x0000000000990000-0x0000000000A6C000-memory.dmp
memory/4052-149-0x00000000008C0000-0x000000000099C000-memory.dmp
memory/4064-30-0x0000000000760000-0x000000000083C000-memory.dmp
memory/4144-187-0x0000000000890000-0x000000000096C000-memory.dmp
memory/4180-119-0x0000000000950000-0x0000000000A2C000-memory.dmp
memory/4224-180-0x0000000000730000-0x000000000080C000-memory.dmp
memory/4232-104-0x0000000000940000-0x0000000000A1C000-memory.dmp
memory/4240-213-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4332-163-0x00000000008D0000-0x00000000009AC000-memory.dmp
memory/4360-177-0x0000000000960000-0x0000000000A3C000-memory.dmp
memory/4392-171-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4424-192-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4452-60-0x00000000007F0000-0x00000000008CC000-memory.dmp
memory/4480-195-0x00000000005B0000-0x000000000068C000-memory.dmp
memory/4572-215-0x0000000000940000-0x0000000000A1C000-memory.dmp
memory/4572-91-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4592-152-0x0000000000910000-0x00000000009EC000-memory.dmp
memory/4736-223-0x0000000000950000-0x0000000000A2C000-memory.dmp
memory/4740-188-0x0000000000930000-0x0000000000A0C000-memory.dmp
memory/4744-208-0x00000000008C0000-0x000000000099C000-memory.dmp
memory/4796-16-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4816-178-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4836-194-0x0000000000940000-0x0000000000A1C000-memory.dmp
memory/4848-191-0x0000000000860000-0x000000000093C000-memory.dmp
memory/4880-46-0x00000000006B0000-0x000000000078C000-memory.dmp
memory/4928-97-0x0000000000990000-0x0000000000A6C000-memory.dmp
memory/4948-98-0x0000000000890000-0x000000000096C000-memory.dmp
memory/4980-125-0x00000000007B0000-0x000000000088C000-memory.dmp
memory/4984-216-0x0000000000920000-0x00000000009FC000-memory.dmp
memory/4988-52-0x00000000005D0000-0x00000000006AC000-memory.dmp
memory/5092-126-0x00000000008B0000-0x000000000098C000-memory.dmp