Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
11/05/2026, 10:30
General
- Target 2026-05-11_5b3346af6ad3dad25d308a3132f670ae_amadey_darkgate_elex_smoke-loader_stop.exe
- Size 384KB
- Sample260511-mj3dmsfs9v
- SHA256 4e6f011e003491320680f8acc1f5edc34915fc2f020276f65c595aa008713016
Malware Config
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 43 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 35 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 62 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-11_5b3346af6ad3dad25d308a3132f670ae_amadey_darkgate_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-11_5b3346af6ad3dad25d308a3132f670ae_amadey_darkgate_elex_smoke-loader_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\xvpnhfzxspkicaus.exeC:\Temp\xvpnhfzxspkicaus.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fzxrpkhcau.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\fzxrpkhcau.exeC:\Temp\fzxrpkhcau.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fzxrpkhcau.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_fzxrpkhcau.exeC:\Temp\i_fzxrpkhcau.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hfzxrpkzus.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\hfzxrpkzus.exeC:\Temp\hfzxrpkzus.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hfzxrpkzus.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_hfzxrpkzus.exeC:\Temp\i_hfzxrpkzus.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zxrpjhbzur.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\zxrpjhbzur.exeC:\Temp\zxrpjhbzur.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zxrpjhbzur.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_zxrpjhbzur.exeC:\Temp\i_zxrpjhbzur.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\omgeywrojg.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\omgeywrojg.exeC:\Temp\omgeywrojg.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_omgeywrojg.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_omgeywrojg.exeC:\Temp\i_omgeywrojg.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\geywqojgbz.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\geywqojgbz.exeC:\Temp\geywqojgbz.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_geywqojgbz.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_geywqojgbz.exeC:\Temp\i_geywqojgbz.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bvtnlgdqoi.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\bvtnlgdqoi.exeC:\Temp\bvtnlgdqoi.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bvtnlgdqoi.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_bvtnlgdqoi.exeC:\Temp\i_bvtnlgdqoi.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\sqlidbvtnl.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\sqlidbvtnl.exeC:\Temp\sqlidbvtnl.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_sqlidbvtnl.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_sqlidbvtnl.exeC:\Temp\i_sqlidbvtnl.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nifaysqkid.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\nifaysqkid.exeC:\Temp\nifaysqkid.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nifaysqkid.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_nifaysqkid.exeC:\Temp\i_nifaysqkid.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\cxvpnhfzxs.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\cxvpnhfzxs.exeC:\Temp\cxvpnhfzxs.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_cxvpnhfzxs.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_cxvpnhfzxs.exeC:\Temp\i_cxvpnhfzxs.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fzxrpkhcam.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\fzxrpkhcam.exeC:\Temp\fzxrpkhcam.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fzxrpkhcam.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_fzxrpkhcam.exeC:\Temp\i_fzxrpkhcam.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zusmkecwup.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\zusmkecwup.exeC:\Temp\zusmkecwup.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zusmkecwup.exe ups_ins3⤵
-
C:\Temp\i_zusmkecwup.exeC:\Temp\i_zusmkecwup.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\uomgezwroj.exe ups_run3⤵
-
C:\Temp\uomgezwroj.exeC:\Temp\uomgezwroj.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_uomgezwroj.exe ups_ins3⤵
-
C:\Temp\i_uomgezwroj.exeC:\Temp\i_uomgezwroj.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rojgbztrlj.exe ups_run3⤵
-
C:\Temp\rojgbztrlj.exeC:\Temp\rojgbztrlj.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rojgbztrlj.exe ups_ins3⤵
-
C:\Temp\i_rojgbztrlj.exeC:\Temp\i_rojgbztrlj.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wqoigbytql.exe ups_run3⤵
-
C:\Temp\wqoigbytql.exeC:\Temp\wqoigbytql.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wqoigbytql.exe ups_ins3⤵
-
C:\Temp\i_wqoigbytql.exeC:\Temp\i_wqoigbytql.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lfdyvqoiga.exe ups_run3⤵
-
C:\Temp\lfdyvqoiga.exeC:\Temp\lfdyvqoiga.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_lfdyvqoiga.exe ups_ins3⤵
-
C:\Temp\i_lfdyvqoiga.exeC:\Temp\i_lfdyvqoiga.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fdxvqnifay.exe ups_run3⤵
-
C:\Temp\fdxvqnifay.exeC:\Temp\fdxvqnifay.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fdxvqnifay.exe ups_ins3⤵
-
C:\Temp\i_fdxvqnifay.exeC:\Temp\i_fdxvqnifay.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\axsqkicavs.exe ups_run3⤵
-
C:\Temp\axsqkicavs.exeC:\Temp\axsqkicavs.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_axsqkicavs.exe ups_ins3⤵
-
C:\Temp\i_axsqkicavs.exeC:\Temp\i_axsqkicavs.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\faxsqkicau.exe ups_run3⤵
-
C:\Temp\faxsqkicau.exeC:\Temp\faxsqkicau.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_faxsqkicau.exe ups_ins3⤵
-
C:\Temp\i_faxsqkicau.exeC:\Temp\i_faxsqkicau.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zupmhfzxrp.exe ups_run3⤵
-
C:\Temp\zupmhfzxrp.exeC:\Temp\zupmhfzxrp.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zupmhfzxrp.exe ups_ins3⤵
-
C:\Temp\i_zupmhfzxrp.exeC:\Temp\i_zupmhfzxrp.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jhbztrmjec.exe ups_run3⤵
-
C:\Temp\jhbztrmjec.exeC:\Temp\jhbztrmjec.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4472 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Temp\xvpnhfzxspkicaus.sysC:\Temp\xvpnhfzxspkicaus.sys1⤵
- Executes dropped EXE
-
C:\Temp\smkecwupmh.sysC:\Temp\smkecwupmh.sys1⤵
- Executes dropped EXE
-
C:\Temp\jecwuomhez.sysC:\Temp\jecwuomhez.sys1⤵
- Executes dropped EXE
-
C:\Temp\zwrojhbztr.sysC:\Temp\zwrojhbztr.sys1⤵
- Executes dropped EXE
-
C:\Temp\ywrojhbztr.sysC:\Temp\ywrojhbztr.sys1⤵
- Executes dropped EXE
-
C:\Temp\lgeywqoigb.sysC:\Temp\lgeywqoigb.sys1⤵
- Executes dropped EXE
-
C:\Temp\dyvqnigays.sysC:\Temp\dyvqnigays.sys1⤵
- Executes dropped EXE
-
C:\Temp\vsnlfdxvpn.sysC:\Temp\vsnlfdxvpn.sys1⤵
- Executes dropped EXE
-
C:\Temp\vpnhfaxsqk.sysC:\Temp\vpnhfaxsqk.sys1⤵
- Executes dropped EXE
-
C:\Temp\pkicausmkf.sysC:\Temp\pkicausmkf.sys1⤵
- Executes dropped EXE
-
C:\Temp\kecwupmhez.sysC:\Temp\kecwupmhez.sys1⤵
- Executes dropped EXE
-
C:\Temp\ezxrpjhbzu.sysC:\Temp\ezxrpjhbzu.sys1⤵
-
C:\Temp\jebwuomgey.sysC:\Temp\jebwuomgey.sys1⤵
-
C:\Temp\gbztrljdbw.sysC:\Temp\gbztrljdbw.sys1⤵
-
C:\Temp\ytqljdbvtn.sysC:\Temp\ytqljdbvtn.sys1⤵
-
C:\Temp\qnigaysqli.sysC:\Temp\qnigaysqli.sys1⤵
-
C:\Temp\snlfdxvpni.sysC:\Temp\snlfdxvpni.sys1⤵
-
C:\Temp\mkfcxvpnhf.sysC:\Temp\mkfcxvpnhf.sys1⤵
-
C:\Temp\hfzxrpjhcz.sysC:\Temp\hfzxrpjhcz.sys1⤵
-
C:\Temp\urmkecwuom.sysC:\Temp\urmkecwuom.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CreateProcess.exe
bvtnlgdqoi.exe
dyvqnigays.sys
fzxrpkhcau.exe
geywqojgbz.exe
hfzxrpkzus.exe
i_bvtnlgdqoi.exe
i_fzxrpkhcau.exe
i_geywqojgbz.exe
i_hfzxrpkzus.exe
i_omgeywrojg.exe
i_sqlidbvtnl.exe
i_zxrpjhbzur.exe
jecwuomhez.sys
lgeywqoigb.sys
nifaysqkid.exe
omgeywrojg.exe
smkecwupmh.sys
sqlidbvtnl.exe
vsnlfdxvpn.sys
xvpnhfzxspkicaus.exe
xvpnhfzxspkicaus.sys
ywrojhbztr.sys
zwrojhbztr.sys
zxrpjhbzur.exe
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
suggestions[1].en-US
memory/64-223-0x0000000000880000-0x00000000008FB000-memory.dmp
memory/536-204-0x0000000000890000-0x000000000090B000-memory.dmp
memory/540-177-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/568-215-0x0000000000870000-0x00000000008EB000-memory.dmp
memory/712-222-0x00000000006C0000-0x000000000073B000-memory.dmp
memory/872-186-0x00000000007E0000-0x000000000085B000-memory.dmp
memory/1028-14-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1068-156-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1156-148-0x0000000000660000-0x00000000006DB000-memory.dmp
memory/1228-200-0x0000000000870000-0x00000000008EB000-memory.dmp
memory/1260-220-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1504-30-0x0000000000910000-0x000000000098B000-memory.dmp
memory/1624-183-0x0000000000580000-0x00000000005FB000-memory.dmp
memory/1648-37-0x0000000000550000-0x00000000005CB000-memory.dmp
memory/1704-197-0x00000000007C0000-0x000000000083B000-memory.dmp
memory/1764-180-0x00000000008F0000-0x000000000096B000-memory.dmp
memory/1768-97-0x0000000000890000-0x000000000090B000-memory.dmp
memory/1984-24-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2012-165-0x0000000000870000-0x00000000008EB000-memory.dmp
memory/2060-159-0x0000000000910000-0x000000000098B000-memory.dmp
memory/2252-60-0x00000000008A0000-0x000000000091B000-memory.dmp
memory/2408-152-0x00000000008F0000-0x000000000096B000-memory.dmp
memory/2500-131-0x00000000008B0000-0x000000000092B000-memory.dmp
memory/2532-194-0x0000000000880000-0x00000000008FB000-memory.dmp
memory/2776-98-0x0000000000690000-0x000000000070B000-memory.dmp
memory/2940-76-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3168-132-0x00000000008C0000-0x000000000093B000-memory.dmp
memory/3192-207-0x00000000006A0000-0x000000000071B000-memory.dmp
memory/3308-208-0x0000000000880000-0x00000000008FB000-memory.dmp
memory/3312-149-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3384-61-0x0000000000850000-0x00000000008CB000-memory.dmp
memory/3504-54-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3684-112-0x0000000000910000-0x000000000098B000-memory.dmp
memory/3728-191-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3772-179-0x0000000000480000-0x00000000004FB000-memory.dmp
memory/3780-173-0x00000000004B0000-0x000000000052B000-memory.dmp
memory/3800-176-0x00000000008D0000-0x000000000094B000-memory.dmp
memory/3820-89-0x0000000000580000-0x00000000005FB000-memory.dmp
memory/3852-39-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4016-16-0x0000000000850000-0x00000000008CB000-memory.dmp
memory/4076-211-0x0000000000870000-0x00000000008EB000-memory.dmp
memory/4140-106-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4152-190-0x0000000000660000-0x00000000006DB000-memory.dmp
memory/4160-91-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4176-169-0x0000000000890000-0x000000000090B000-memory.dmp
memory/4188-212-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4248-104-0x0000000000860000-0x00000000008DB000-memory.dmp
memory/4392-118-0x0000000000890000-0x000000000090B000-memory.dmp
memory/4616-219-0x0000000000870000-0x00000000008EB000-memory.dmp
memory/4644-128-0x0000000000750000-0x00000000007CB000-memory.dmp
memory/4676-120-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4732-163-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4772-46-0x0000000000880000-0x00000000008FB000-memory.dmp
memory/4784-170-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5012-205-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5012-213-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5112-52-0x0000000000870000-0x00000000008EB000-memory.dmp
memory/5140-83-0x0000000000860000-0x00000000008DB000-memory.dmp
memory/5148-172-0x0000000000850000-0x00000000008CB000-memory.dmp
memory/5168-155-0x00000000005B0000-0x000000000062B000-memory.dmp
memory/5188-193-0x00000000008E0000-0x000000000095B000-memory.dmp
memory/5232-124-0x00000000004B0000-0x000000000052B000-memory.dmp
memory/5256-70-0x0000000000790000-0x000000000080B000-memory.dmp
memory/5260-15-0x0000000000750000-0x00000000007CB000-memory.dmp
memory/5296-129-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5380-187-0x0000000000650000-0x00000000006CB000-memory.dmp
memory/5432-82-0x00000000005A0000-0x000000000061B000-memory.dmp
memory/5500-216-0x0000000000560000-0x00000000005DB000-memory.dmp
memory/5552-45-0x0000000000530000-0x00000000005AB000-memory.dmp
memory/5560-198-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5616-158-0x00000000008B0000-0x000000000092B000-memory.dmp
memory/5660-162-0x00000000004C0000-0x000000000053B000-memory.dmp
memory/5780-166-0x00000000008E0000-0x000000000095B000-memory.dmp
memory/5792-125-0x00000000008D0000-0x000000000094B000-memory.dmp
memory/5812-31-0x0000000000860000-0x00000000008DB000-memory.dmp
memory/5816-151-0x0000000000870000-0x00000000008EB000-memory.dmp
memory/5900-201-0x0000000000680000-0x00000000006FB000-memory.dmp
memory/5936-184-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5976-22-0x00000000008E0000-0x000000000095B000-memory.dmp