Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
11/05/2026, 14:06
General
- Target 2026-05-11_ffbae59244c001dd2bc86c542ca42c79_elex_redline-stealer_rhadamanthys_stop.exe
- Size 230KB
- Sample260511-revkfsft5r
- SHA256 6b01af793837b983d231c2fb1c14f9989e7b29d59212cc31737bba0aed647625
Malware Config
Extracted
-
systex
-
http://xytets.com:2345/t.asp?os=wangba8102
-
http://xytets.com:2345/ll/out.txt
-
http://xytets.com:2345/t.asp?os=home8102
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 44 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 51 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 19 IoCs
- Suspicious use of AdjustPrivilegeToken 20 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SetWindowsHookEx 10 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-11_ffbae59244c001dd2bc86c542ca42c79_elex_redline-stealer_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-11_ffbae59244c001dd2bc86c542ca42c79_elex_redline-stealer_rhadamanthys_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home81022⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4304 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5324 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\smkfdxvpni.exe ups_run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\smkfdxvpni.exeC:\Temp\smkfdxvpni.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_smkfdxvpni.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_smkfdxvpni.exeC:\Temp\i_smkfdxvpni.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\usmkecxupn.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\usmkecxupn.exeC:\Temp\usmkecxupn.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_usmkecxupn.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_usmkecxupn.exeC:\Temp\i_usmkecxupn.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\hezxrpjhbz.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\hezxrpjhbz.exeC:\Temp\hezxrpjhbz.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_hezxrpjhbz.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_hezxrpjhbz.exeC:\Temp\i_hezxrpjhbz.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\rmjecwuomg.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\rmjecwuomg.exeC:\Temp\rmjecwuomg.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_rmjecwuomg.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_rmjecwuomg.exeC:\Temp\i_rmjecwuomg.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\jebwuomgey.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\jebwuomgey.exeC:\Temp\jebwuomgey.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_jebwuomgey.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_jebwuomgey.exeC:\Temp\i_jebwuomgey.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\tnlgdywqoi.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\tnlgdywqoi.exeC:\Temp\tnlgdywqoi.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_tnlgdywqoi.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_tnlgdywqoi.exeC:\Temp\i_tnlgdywqoi.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\dyvqoigayt.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\dyvqoigayt.exeC:\Temp\dyvqoigayt.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_dyvqoigayt.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_dyvqoigayt.exeC:\Temp\i_dyvqoigayt.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\snlfdxvpni.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\snlfdxvpni.exeC:\Temp\snlfdxvpni.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_snlfdxvpni.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_snlfdxvpni.exeC:\Temp\i_snlfdxvpni.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\nifaysqkau.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\nifaysqkau.exeC:\Temp\nifaysqkau.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_nifaysqkau.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_nifaysqkau.exeC:\Temp\i_nifaysqkau.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\fzxrpkhcau.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\fzxrpkhcau.exeC:\Temp\fzxrpkhcau.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_fzxrpkhcau.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_fzxrpkhcau.exeC:\Temp\i_fzxrpkhcau.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\xrpjhbzurm.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\xrpjhbzurm.exeC:\Temp\xrpjhbzurm.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_xrpjhbzurm.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_xrpjhbzurm.exeC:\Temp\i_xrpjhbzurm.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\jhbztrmjeb.exe ups_run2⤵
-
C:\Temp\jhbztrmjeb.exeC:\Temp\jhbztrmjeb.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_jhbztrmjeb.exe ups_ins2⤵
-
C:\Temp\i_jhbztrmjeb.exeC:\Temp\i_jhbztrmjeb.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\geywrojhtr.exe ups_run2⤵
-
C:\Temp\geywrojhtr.exeC:\Temp\geywrojhtr.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_geywrojhtr.exe ups_ins2⤵
-
C:\Temp\i_geywrojhtr.exeC:\Temp\i_geywrojhtr.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\wqoigbytrl.exe ups_run2⤵
-
C:\Temp\wqoigbytrl.exeC:\Temp\wqoigbytrl.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_wqoigbytrl.exe ups_ins2⤵
-
C:\Temp\i_wqoigbytrl.exeC:\Temp\i_wqoigbytrl.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\idbvtnlfdy.exe ups_run2⤵
-
C:\Temp\idbvtnlfdy.exeC:\Temp\idbvtnlfdy.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_idbvtnlfdy.exe ups_ins2⤵
-
C:\Temp\i_idbvtnlfdy.exeC:\Temp\i_idbvtnlfdy.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\xvqnigaysq.exe ups_run2⤵
-
C:\Temp\xvqnigaysq.exeC:\Temp\xvqnigaysq.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_xvqnigaysq.exe ups_ins2⤵
-
C:\Temp\i_xvqnigaysq.exeC:\Temp\i_xvqnigaysq.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\vsnkfdxnhf.exe ups_run2⤵
-
C:\Temp\vsnkfdxnhf.exeC:\Temp\vsnkfdxnhf.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_vsnkfdxnhf.exe ups_ins2⤵
-
C:\Temp\i_vsnkfdxnhf.exeC:\Temp\i_vsnkfdxnhf.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\nicausmkfc.exe ups_run2⤵
-
C:\Temp\nicausmkfc.exeC:\Temp\nicausmkfc.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_nicausmkfc.exe ups_ins2⤵
-
C:\Temp\i_nicausmkfc.exeC:\Temp\i_nicausmkfc.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\cxupkhcaus.exe ups_run2⤵
-
C:\Temp\cxupkhcaus.exeC:\Temp\cxupkhcaus.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_cxupkhcaus.exe ups_ins2⤵
-
C:\Temp\i_cxupkhcaus.exeC:\Temp\i_cxupkhcaus.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\pjecwuomhe.exe ups_run2⤵
-
C:\Temp\pjecwuomhe.exeC:\Temp\pjecwuomhe.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_pjecwuomhe.exe ups_ins2⤵
-
C:\Temp\i_pjecwuomhe.exeC:\Temp\i_pjecwuomhe.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Temp\ezxrpkhczu.sysC:\Temp\ezxrpkhczu.sys1⤵
- Executes dropped EXE
-
C:\Temp\uomhezxrpj.sysC:\Temp\uomhezxrpj.sys1⤵
- Executes dropped EXE
-
C:\Temp\kecwuomhez.sysC:\Temp\kecwuomhez.sys1⤵
- Executes dropped EXE
-
C:\Temp\uomgeywroj.sysC:\Temp\uomgeywroj.sys1⤵
- Executes dropped EXE
-
C:\Temp\dbwtolgeyw.sysC:\Temp\dbwtolgeyw.sys1⤵
- Executes dropped EXE
-
C:\Temp\nigaytqlid.sysC:\Temp\nigaytqlid.sys1⤵
- Executes dropped EXE
-
C:\Temp\lfdxvqniga.sysC:\Temp\lfdxvqniga.sys1⤵
- Executes dropped EXE
-
C:\Temp\ysqkicavsn.sysC:\Temp\ysqkicavsn.sys1⤵
- Executes dropped EXE
-
C:\Temp\pnhfaxspki.sysC:\Temp\pnhfaxspki.sys1⤵
- Executes dropped EXE
-
C:\Temp\hfzxrpkhca.sysC:\Temp\hfzxrpkhca.sys1⤵
- Executes dropped EXE
-
C:\Temp\ezxrpjhczu.sysC:\Temp\ezxrpjhczu.sys1⤵
-
C:\Temp\rojhbztrlj.sysC:\Temp\rojhbztrlj.sys1⤵
-
C:\Temp\gbytrljdbv.sysC:\Temp\gbytrljdbv.sys1⤵
-
C:\Temp\tqljdbvtol.sysC:\Temp\tqljdbvtol.sys1⤵
-
C:\Temp\toigaysqla.sysC:\Temp\toigaysqla.sys1⤵
-
C:\Temp\idavtnlfdx.sysC:\Temp\idavtnlfdx.sys1⤵
-
C:\Temp\usmkfcxvpn.sysC:\Temp\usmkfcxvpn.sys1⤵
-
C:\Temp\mhfzxrpkhc.sysC:\Temp\mhfzxrpkhc.sys1⤵
-
C:\Temp\hczusmkeuo.sysC:\Temp\hczusmkeuo.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CP.exe
dbwtolgeyw.sys
dyvqoigayt.exe
ezxrpkhczu.sys
hezxrpjhbz.exe
i_dyvqoigayt.exe
i_hezxrpjhbz.exe
i_jebwuomgey.exe
i_rmjecwuomg.exe
i_smkfdxvpni.exe
i_tnlgdywqoi.exe
i_usmkecxupn.exe
jebwuomgey.exe
kecwuomhez.sys
lfdxvqniga.sys
nigaytqlid.sys
rmjecwuomg.exe
smkfdxvpni.exe
tnlgdywqoi.exe
uomgeywroj.sys
uomhezxrpj.sys
usmkecxupn.exe
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
RecoveryStore.{AACCC4CA-4D42-11F1-A918-C67DC819AE91}.dat
RecoveryStore.{AACF2A6D-4D42-11F1-A918-C67DC819AE91}.dat
suggestions[1].en-US
memory/224-200-0x0000000000840000-0x00000000008FF000-memory.dmp
memory/576-97-0x0000000000010000-0x0000000000083000-memory.dmp
memory/708-185-0x0000000000580000-0x000000000063F000-memory.dmp
memory/768-161-0x0000000000880000-0x000000000093F000-memory.dmp
memory/916-219-0x0000000000010000-0x0000000000083000-memory.dmp
memory/948-183-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1012-89-0x00000000005A0000-0x000000000065F000-memory.dmp
memory/1472-37-0x0000000000920000-0x00000000009DF000-memory.dmp
memory/1488-212-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1640-127-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1776-80-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1780-221-0x00000000008B0000-0x000000000096F000-memory.dmp
memory/1800-15-0x0000000000810000-0x00000000008CF000-memory.dmp
memory/1816-228-0x0000000000850000-0x000000000090F000-memory.dmp
memory/1892-88-0x00000000006F0000-0x00000000007AF000-memory.dmp
memory/1960-169-0x00000000005C0000-0x000000000067F000-memory.dmp
memory/2364-225-0x0000000000880000-0x000000000093F000-memory.dmp
memory/2380-118-0x00000000008D0000-0x000000000098F000-memory.dmp
memory/2408-215-0x0000000000750000-0x000000000080F000-memory.dmp
memory/2436-158-0x0000000000870000-0x000000000092F000-memory.dmp
memory/2472-201-0x00000000005D0000-0x000000000068F000-memory.dmp
memory/2480-186-0x0000000000910000-0x00000000009CF000-memory.dmp
memory/2492-131-0x0000000000880000-0x000000000093F000-memory.dmp
memory/2596-31-0x00000000008E0000-0x000000000099F000-memory.dmp
memory/3052-62-0x0000000000650000-0x000000000070F000-memory.dmp
memory/3100-40-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3100-24-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3144-152-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3172-148-0x0000000000880000-0x000000000093F000-memory.dmp
memory/3356-22-0x0000000000880000-0x000000000093F000-memory.dmp
memory/3428-130-0x0000000000840000-0x00000000008FF000-memory.dmp
memory/3456-229-0x0000000000910000-0x00000000009CF000-memory.dmp
memory/3596-147-0x00000000008C0000-0x000000000097F000-memory.dmp
memory/3696-53-0x0000000000850000-0x000000000090F000-memory.dmp
memory/3772-208-0x00000000005A0000-0x000000000065F000-memory.dmp
memory/3780-46-0x0000000000740000-0x00000000007FF000-memory.dmp
memory/3796-30-0x00000000008C0000-0x000000000097F000-memory.dmp
memory/3956-134-0x00000000008A0000-0x000000000095F000-memory.dmp
memory/3996-112-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4008-196-0x0000000000870000-0x000000000092F000-memory.dmp
memory/4212-189-0x00000000008D0000-0x000000000098F000-memory.dmp
memory/4308-55-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4348-207-0x0000000000900000-0x00000000009BF000-memory.dmp
memory/4504-104-0x00000000008E0000-0x000000000099F000-memory.dmp
memory/4552-61-0x0000000000860000-0x000000000091F000-memory.dmp
memory/4556-211-0x0000000000940000-0x00000000009FF000-memory.dmp
memory/4660-192-0x00000000008C0000-0x000000000097F000-memory.dmp
memory/4684-151-0x00000000008D0000-0x000000000098F000-memory.dmp
memory/4692-193-0x00000000008F0000-0x00000000009AF000-memory.dmp
memory/4772-204-0x0000000000880000-0x000000000093F000-memory.dmp
memory/4776-159-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4816-197-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4928-155-0x00000000008F0000-0x00000000009AF000-memory.dmp
memory/4996-222-0x0000000000860000-0x000000000091F000-memory.dmp
memory/5016-218-0x0000000000890000-0x000000000094F000-memory.dmp
memory/5068-95-0x0000000000880000-0x000000000093F000-memory.dmp
memory/5192-138-0x0000000000910000-0x00000000009CF000-memory.dmp
memory/5208-110-0x00000000008B0000-0x000000000096F000-memory.dmp
memory/5268-103-0x0000000000950000-0x0000000000A0F000-memory.dmp
memory/5348-78-0x0000000000840000-0x00000000008FF000-memory.dmp
memory/5360-205-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5396-162-0x0000000000880000-0x000000000093F000-memory.dmp
memory/5420-125-0x0000000000580000-0x000000000063F000-memory.dmp
memory/5520-166-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5532-145-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5588-168-0x00000000008E0000-0x000000000099F000-memory.dmp
memory/5616-154-0x0000000000860000-0x000000000091F000-memory.dmp
memory/5704-137-0x00000000007A0000-0x000000000085F000-memory.dmp
memory/5792-16-0x00000000008C0000-0x000000000097F000-memory.dmp
memory/5856-182-0x00000000008E0000-0x000000000099F000-memory.dmp
memory/5908-47-0x00000000008E0000-0x000000000099F000-memory.dmp
memory/5940-144-0x0000000000890000-0x000000000094F000-memory.dmp
memory/5940-39-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5956-198-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5956-190-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5988-135-0x0000000000010000-0x0000000000083000-memory.dmp
memory/6064-165-0x0000000000950000-0x0000000000A0F000-memory.dmp
memory/6080-226-0x0000000000010000-0x0000000000083000-memory.dmp
memory/6084-119-0x0000000000650000-0x000000000070F000-memory.dmp
memory/6136-214-0x0000000000670000-0x000000000072F000-memory.dmp