Analysis
- max time kernel
150s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20250619-en - resource tags
- submitted
11/05/2026, 15:58
General
- Target 2026-05-11_dbccb54bb850ef66a904e49874ebe8c0_amadey_darkgate_elex_smoke-loader_stop.exe
- Size 384KB
- Sample260511-telnnadz2x
- SHA256 a240f762f2f72b830edb1234367f078f83f3c91a4cafee3f500daa9bbc6e5050
Malware Config
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 44 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 37 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-11_dbccb54bb850ef66a904e49874ebe8c0_amadey_darkgate_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-11_dbccb54bb850ef66a904e49874ebe8c0_amadey_darkgate_elex_smoke-loader_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\bwuomgeywrojhbzt.exeC:\Temp\bwuomgeywrojhbzt.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mgeywrojgb.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\mgeywrojgb.exeC:\Temp\mgeywrojgb.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mgeywrojgb.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_mgeywrojgb.exeC:\Temp\i_mgeywrojgb.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qljdbvtolg.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\qljdbvtolg.exeC:\Temp\qljdbvtolg.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qljdbvtolg.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_qljdbvtolg.exeC:\Temp\i_qljdbvtolg.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qlidbvtnlg.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\qlidbvtnlg.exeC:\Temp\qlidbvtnlg.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qlidbvtnlg.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_qlidbvtnlg.exeC:\Temp\i_qlidbvtnlg.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\idavtnlfdx.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\idavtnlfdx.exeC:\Temp\idavtnlfdx.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_idavtnlfdx.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_idavtnlfdx.exeC:\Temp\i_idavtnlfdx.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dxsqkfdxvp.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\dxsqkfdxvp.exeC:\Temp\dxsqkfdxvp.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dxsqkfdxvp.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_dxsqkfdxvp.exeC:\Temp\i_dxsqkfdxvp.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\smkecxupnh.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\smkecxupnh.exeC:\Temp\smkecxupnh.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_smkecxupnh.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_smkecxupnh.exeC:\Temp\i_smkecxupnh.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pkhcausmke.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\pkhcausmke.exeC:\Temp\pkhcausmke.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pkhcausmke.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_pkhcausmke.exeC:\Temp\i_pkhcausmke.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gezwrpjhbz.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\gezwrpjhbz.exeC:\Temp\gezwrpjhbz.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gezwrpjhbz.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_gezwrpjhbz.exeC:\Temp\i_gezwrpjhbz.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bwuomgeywr.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\bwuomgeywr.exeC:\Temp\bwuomgeywr.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bwuomgeywr.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_bwuomgeywr.exeC:\Temp\i_bwuomgeywr.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vtolgeywqo.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\vtolgeywqo.exeC:\Temp\vtolgeywqo.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vtolgeywqo.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_vtolgeywqo.exeC:\Temp\i_vtolgeywqo.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bvtolgdywq.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\bvtolgdywq.exeC:\Temp\bvtolgdywq.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bvtolgdywq.exe ups_ins3⤵
-
C:\Temp\i_bvtolgdywq.exeC:\Temp\i_bvtolgdywq.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vqoigaytql.exe ups_run3⤵
-
C:\Temp\vqoigaytql.exeC:\Temp\vqoigaytql.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vqoigaytql.exe ups_ins3⤵
-
C:\Temp\i_vqoigaytql.exeC:\Temp\i_vqoigaytql.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qkicavsnlf.exe ups_run3⤵
-
C:\Temp\qkicavsnlf.exeC:\Temp\qkicavsnlf.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qkicavsnlf.exe ups_ins3⤵
-
C:\Temp\i_qkicavsnlf.exeC:\Temp\i_qkicavsnlf.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kfcxvpnhfz.exe ups_run3⤵
-
C:\Temp\kfcxvpnhfz.exeC:\Temp\kfcxvpnhfz.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kfcxvpnhfz.exe ups_ins3⤵
-
C:\Temp\i_kfcxvpnhfz.exeC:\Temp\i_kfcxvpnhfz.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nhfzxspkic.exe ups_run3⤵
-
C:\Temp\nhfzxspkic.exeC:\Temp\nhfzxspkic.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nhfzxspkic.exe ups_ins3⤵
-
C:\Temp\i_nhfzxspkic.exeC:\Temp\i_nhfzxspkic.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hczusmkecw.exe ups_run3⤵
-
C:\Temp\hczusmkecw.exeC:\Temp\hczusmkecw.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hczusmkecw.exe ups_ins3⤵
-
C:\Temp\i_hczusmkecw.exeC:\Temp\i_hczusmkecw.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ezwrpjhbzu.exe ups_run3⤵
-
C:\Temp\ezwrpjhbzu.exeC:\Temp\ezwrpjhbzu.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ezwrpjhbzu.exe ups_ins3⤵
-
C:\Temp\i_ezwrpjhbzu.exeC:\Temp\i_ezwrpjhbzu.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ztrljebwto.exe ups_run3⤵
-
C:\Temp\ztrljebwto.exeC:\Temp\ztrljebwto.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ztrljebwto.exe ups_ins3⤵
-
C:\Temp\i_ztrljebwto.exeC:\Temp\i_ztrljebwto.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\eywqojgbzt.exe ups_run3⤵
-
C:\Temp\eywqojgbzt.exeC:\Temp\eywqojgbzt.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_eywqojgbzt.exe ups_ins3⤵
-
C:\Temp\i_eywqojgbzt.exeC:\Temp\i_eywqojgbzt.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ywqoigaytq.exe ups_run3⤵
-
C:\Temp\ywqoigaytq.exeC:\Temp\ywqoigaytq.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ywqoigaytq.exe ups_ins3⤵
-
C:\Temp\i_ywqoigaytq.exeC:\Temp\i_ywqoigaytq.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2840 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Temp\bwuomgeywrojhbzt.sysC:\Temp\bwuomgeywrojhbzt.sys1⤵
- Executes dropped EXE
-
C:\Temp\jebwtomgey.sysC:\Temp\jebwtomgey.sys1⤵
- Executes dropped EXE
-
C:\Temp\bvtolgeywq.sysC:\Temp\bvtolgeywq.sys1⤵
- Executes dropped EXE
-
C:\Temp\qnigaysqli.sysC:\Temp\qnigaysqli.sys1⤵
- Executes dropped EXE
-
C:\Temp\kfdxvpnhfa.sysC:\Temp\kfdxvpnhfa.sys1⤵
- Executes dropped EXE
-
C:\Temp\kfaxsqkica.sysC:\Temp\kfaxsqkica.sys1⤵
- Executes dropped EXE
-
C:\Temp\xupnhfzxsp.sysC:\Temp\xupnhfzxsp.sys1⤵
- Executes dropped EXE
-
C:\Temp\rmkecwuomh.sysC:\Temp\rmkecwuomh.sys1⤵
- Executes dropped EXE
-
C:\Temp\jhbztrmjeb.sysC:\Temp\jhbztrmjeb.sys1⤵
- Executes dropped EXE
-
C:\Temp\omgeywrojh.sysC:\Temp\omgeywrojh.sys1⤵
- Executes dropped EXE
-
C:\Temp\lgeywqojgb.sysC:\Temp\lgeywqojgb.sys1⤵
- Executes dropped EXE
-
C:\Temp\dyvqnigays.sysC:\Temp\dyvqnigays.sys1⤵
-
C:\Temp\xvpnifaxsq.sysC:\Temp\xvpnifaxsq.sys1⤵
-
C:\Temp\dxvpnifays.sysC:\Temp\dxvpnifays.sys1⤵
-
C:\Temp\usmkfcxupn.sysC:\Temp\usmkfcxupn.sys1⤵
-
C:\Temp\pmhfzxrpkh.sysC:\Temp\pmhfzxrpkh.sys1⤵
-
C:\Temp\mgezwrojhb.sysC:\Temp\mgezwrojhb.sys1⤵
-
C:\Temp\omgezwrpjh.sysC:\Temp\omgezwrpjh.sys1⤵
-
C:\Temp\lgeywqoigb.sysC:\Temp\lgeywqoigb.sys1⤵
-
C:\Temp\jdbvtnlgdy.sysC:\Temp\jdbvtnlgdy.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CreateProcess.exe
bvtolgeywq.sys
bwuomgeywrojhbzt.exe
bwuomgeywrojhbzt.sys
dxsqkfdxvp.exe
gezwrpjhbz.exe
i_dxsqkfdxvp.exe
i_idavtnlfdx.exe
i_mgeywrojgb.exe
i_pkhcausmke.exe
i_qlidbvtnlg.exe
i_qljdbvtolg.exe
i_smkecxupnh.exe
idavtnlfdx.exe
jebwtomgey.sys
kfaxsqkica.sys
kfdxvpnhfa.sys
mgeywrojgb.exe
pkhcausmke.exe
qlidbvtnlg.exe
qljdbvtolg.exe
qnigaysqli.sys
rmkecwuomh.sys
smkecxupnh.exe
xupnhfzxsp.sys
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
suggestions[1].en-US
memory/392-173-0x0000000000490000-0x00000000004B5000-memory.dmp
memory/548-61-0x0000000000550000-0x0000000000575000-memory.dmp
memory/640-14-0x0000000000560000-0x0000000000585000-memory.dmp
memory/876-45-0x0000000000760000-0x0000000000785000-memory.dmp
memory/1028-212-0x0000000000860000-0x0000000000885000-memory.dmp
memory/1064-192-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1152-166-0x0000000000860000-0x0000000000885000-memory.dmp
memory/1240-104-0x0000000000580000-0x00000000005A5000-memory.dmp
memory/1484-97-0x0000000000580000-0x00000000005A5000-memory.dmp
memory/1540-121-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1588-216-0x0000000000870000-0x0000000000895000-memory.dmp
memory/1608-215-0x0000000000670000-0x0000000000695000-memory.dmp
memory/1864-160-0x0000000000580000-0x00000000005A5000-memory.dmp
memory/1924-159-0x0000000000620000-0x0000000000645000-memory.dmp
memory/2052-149-0x0000000000570000-0x0000000000595000-memory.dmp
memory/2200-191-0x0000000000670000-0x0000000000695000-memory.dmp
memory/2248-98-0x0000000000480000-0x00000000004A5000-memory.dmp
memory/2880-164-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2948-82-0x0000000000520000-0x0000000000545000-memory.dmp
memory/3068-130-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3396-220-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3672-194-0x0000000000760000-0x0000000000785000-memory.dmp
memory/3700-202-0x0000000000870000-0x0000000000895000-memory.dmp
memory/4028-178-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4124-198-0x0000000000560000-0x0000000000585000-memory.dmp
memory/4172-16-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4272-170-0x0000000000AA0000-0x0000000000AC5000-memory.dmp
memory/4308-72-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4364-119-0x0000000000680000-0x00000000006A5000-memory.dmp
memory/4388-83-0x0000000000520000-0x0000000000545000-memory.dmp
memory/4428-133-0x0000000000560000-0x0000000000585000-memory.dmp
memory/4444-205-0x0000000000490000-0x00000000004B5000-memory.dmp
memory/4472-24-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4476-132-0x0000000000770000-0x0000000000795000-memory.dmp
memory/4480-46-0x0000000000570000-0x0000000000595000-memory.dmp
memory/4552-89-0x0000000000560000-0x0000000000585000-memory.dmp
memory/4604-31-0x0000000000860000-0x0000000000885000-memory.dmp
memory/4644-163-0x0000000000490000-0x00000000004B5000-memory.dmp
memory/4692-52-0x0000000000550000-0x0000000000575000-memory.dmp
memory/4728-157-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4772-30-0x0000000000630000-0x0000000000655000-memory.dmp
memory/4776-206-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4824-39-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4828-152-0x0000000000550000-0x0000000000575000-memory.dmp
memory/4840-37-0x0000000000680000-0x00000000006A5000-memory.dmp
memory/4844-113-0x0000000000560000-0x0000000000585000-memory.dmp
memory/4848-219-0x0000000000870000-0x0000000000895000-memory.dmp
memory/4856-177-0x0000000000760000-0x0000000000785000-memory.dmp
memory/4860-167-0x0000000000560000-0x0000000000585000-memory.dmp
memory/4900-129-0x0000000000680000-0x00000000006A5000-memory.dmp
memory/4908-199-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4924-201-0x0000000000580000-0x00000000005A5000-memory.dmp
memory/4936-150-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4940-213-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4984-181-0x0000000000480000-0x00000000004A5000-memory.dmp
memory/5092-209-0x0000000000660000-0x0000000000685000-memory.dmp
memory/5116-153-0x0000000000870000-0x0000000000895000-memory.dmp
memory/5124-125-0x0000000000620000-0x0000000000645000-memory.dmp
memory/5164-60-0x0000000000550000-0x0000000000575000-memory.dmp
memory/5172-195-0x0000000000860000-0x0000000000885000-memory.dmp
memory/5272-180-0x0000000000560000-0x0000000000585000-memory.dmp
memory/5276-184-0x0000000000870000-0x0000000000895000-memory.dmp
memory/5308-91-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5372-222-0x0000000000880000-0x00000000008A5000-memory.dmp
memory/5428-185-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5484-106-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5500-188-0x0000000000770000-0x0000000000795000-memory.dmp
memory/5520-13-0x0000000000580000-0x00000000005A5000-memory.dmp
memory/5624-112-0x0000000000580000-0x00000000005A5000-memory.dmp
memory/5696-208-0x0000000000860000-0x0000000000885000-memory.dmp
memory/5720-156-0x0000000000860000-0x0000000000885000-memory.dmp
memory/5748-174-0x0000000000860000-0x0000000000885000-memory.dmp
memory/5784-67-0x0000000000480000-0x00000000004A5000-memory.dmp
memory/5824-54-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5864-126-0x0000000000660000-0x0000000000685000-memory.dmp
memory/5964-223-0x0000000000860000-0x0000000000885000-memory.dmp
memory/5976-171-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6064-187-0x0000000000A70000-0x0000000000A95000-memory.dmp
memory/6120-22-0x0000000000660000-0x0000000000685000-memory.dmp