Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
18/05/2026, 17:32
General
- Target 2026-05-18_d64088ed4fb203d2255a47042baba7fb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 722KB
- Sample260518-v4e3vaev8j
- SHA256 57481b7a1c2f41957c280faddd17e4cbd07991679e187292add283628e0db88a
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 41 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 32 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 60 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-18_d64088ed4fb203d2255a47042baba7fb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-18_d64088ed4fb203d2255a47042baba7fb_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\wuomgezwrojhbztr.exeC:\Temp\wuomgezwrojhbztr.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bztrmjecwu.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\bztrmjecwu.exeC:\Temp\bztrmjecwu.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bztrmjecwu.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_bztrmjecwu.exeC:\Temp\i_bztrmjecwu.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qoigbytqlj.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\qoigbytqlj.exeC:\Temp\qoigbytqlj.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qoigbytqlj.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_qoigbytqlj.exeC:\Temp\i_qoigbytqlj.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dtnlgdyvqo.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\dtnlgdyvqo.exeC:\Temp\dtnlgdyvqo.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dtnlgdyvqo.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_dtnlgdyvqo.exeC:\Temp\i_dtnlgdyvqo.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kidbvtnlfd.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\kidbvtnlfd.exeC:\Temp\kidbvtnlfd.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kidbvtnlfd.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_kidbvtnlfd.exeC:\Temp\i_kidbvtnlfd.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ysqkidxpni.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ysqkidxpni.exeC:\Temp\ysqkidxpni.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ysqkidxpni.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ysqkidxpni.exeC:\Temp\i_ysqkidxpni.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kfcxvpnhcx.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\kfcxvpnhcx.exeC:\Temp\kfcxvpnhcx.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kfcxvpnhcx.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_kfcxvpnhcx.exeC:\Temp\i_kfcxvpnhcx.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hcausmkecx.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\hcausmkecx.exeC:\Temp\hcausmkecx.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hcausmkecx.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_hcausmkecx.exeC:\Temp\i_hcausmkecx.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rmbwuomgez.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\rmbwuomgez.exeC:\Temp\rmbwuomgez.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rmbwuomgez.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_rmbwuomgez.exeC:\Temp\i_rmbwuomgez.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zuomgeywro.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\zuomgeywro.exeC:\Temp\zuomgeywro.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zuomgeywro.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_zuomgeywro.exeC:\Temp\i_zuomgeywro.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rlgeywqoig.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\rlgeywqoig.exeC:\Temp\rlgeywqoig.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rlgeywqoig.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_rlgeywqoig.exeC:\Temp\i_rlgeywqoig.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gaytqljdbv.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\gaytqljdbv.exeC:\Temp\gaytqljdbv.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gaytqljdbv.exe ups_ins3⤵
-
C:\Temp\i_gaytqljdbv.exeC:\Temp\i_gaytqljdbv.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\yvqoigaysq.exe ups_run3⤵
-
C:\Temp\yvqoigaysq.exeC:\Temp\yvqoigaysq.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_yvqoigaysq.exe ups_ins3⤵
-
C:\Temp\i_yvqoigaysq.exeC:\Temp\i_yvqoigaysq.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vsnlfdxvpk.exe ups_run3⤵
-
C:\Temp\vsnlfdxvpk.exeC:\Temp\vsnlfdxvpk.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vsnlfdxvpk.exe ups_ins3⤵
-
C:\Temp\i_vsnlfdxvpk.exeC:\Temp\i_vsnlfdxvpk.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nicausnkfd.exe ups_run3⤵
-
C:\Temp\nicausnkfd.exeC:\Temp\nicausnkfd.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nicausnkfd.exe ups_ins3⤵
-
C:\Temp\i_nicausnkfd.exeC:\Temp\i_nicausnkfd.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\cxupmhfzxr.exe ups_run3⤵
-
C:\Temp\cxupmhfzxr.exeC:\Temp\cxupmhfzxr.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_cxupmhfzxr.exe ups_ins3⤵
-
C:\Temp\i_cxupmhfzxr.exeC:\Temp\i_cxupmhfzxr.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\omhezurmke.exe ups_run3⤵
-
C:\Temp\omhezurmke.exeC:\Temp\omhezurmke.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_omhezurmke.exe ups_ins3⤵
-
C:\Temp\i_omhezurmke.exeC:\Temp\i_omhezurmke.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mjecwuomhe.exe ups_run3⤵
-
C:\Temp\mjecwuomhe.exeC:\Temp\mjecwuomhe.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mjecwuomhe.exe ups_ins3⤵
-
C:\Temp\i_mjecwuomhe.exeC:\Temp\i_mjecwuomhe.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bwtomgeywr.exe ups_run3⤵
-
C:\Temp\bwtomgeywr.exeC:\Temp\bwtomgeywr.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bwtomgeywr.exe ups_ins3⤵
-
C:\Temp\i_bwtomgeywr.exeC:\Temp\i_bwtomgeywr.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qoigbytqlj.exe ups_run3⤵
-
C:\Temp\qoigbytqlj.exeC:\Temp\qoigbytqlj.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qoigbytqlj.exe ups_ins3⤵
-
C:\Temp\i_qoigbytqlj.exeC:\Temp\i_qoigbytqlj.exe ups_ins4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:640 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Temp\wuomgezwrojhbztr.sysC:\Temp\wuomgezwrojhbztr.sys1⤵
- Executes dropped EXE
-
C:\Temp\jhbztrdbwt.sysC:\Temp\jhbztrdbwt.sys1⤵
- Executes dropped EXE
-
C:\Temp\oigbytrljd.sysC:\Temp\oigbytrljd.sys1⤵
- Executes dropped EXE
-
C:\Temp\ytoigaysql.sysC:\Temp\ytoigaysql.sys1⤵
- Executes dropped EXE
-
C:\Temp\anxvpnifay.sysC:\Temp\anxvpnifay.sys1⤵
- Executes dropped EXE
-
C:\Temp\vpkicausmk.sysC:\Temp\vpkicausmk.sys1⤵
- Executes dropped EXE
-
C:\Temp\xrpkhcamke.sysC:\Temp\xrpkhcamke.sys1⤵
- Executes dropped EXE
-
C:\Temp\cwupmhfzxr.sysC:\Temp\cwupmhfzxr.sys1⤵
- Executes dropped EXE
-
C:\Temp\gezwrpjhbz.sysC:\Temp\gezwrpjhbz.sys1⤵
- Executes dropped EXE
-
C:\Temp\ywqojgbztr.sysC:\Temp\ywqojgbztr.sys1⤵
- Executes dropped EXE
-
C:\Temp\vlgeywqoig.sysC:\Temp\vlgeywqoig.sys1⤵
- Executes dropped EXE
-
C:\Temp\nlfdyvqoig.sysC:\Temp\nlfdyvqoig.sys1⤵
-
C:\Temp\gaysqkidav.sysC:\Temp\gaysqkidav.sys1⤵
-
C:\Temp\vpnhfzxspk.sysC:\Temp\vpnhfzxspk.sys1⤵
-
C:\Temp\vpfzxspkhc.sysC:\Temp\vpfzxspkhc.sys1⤵
-
C:\Temp\hczusmkecx.sysC:\Temp\hczusmkecx.sys1⤵
-
C:\Temp\xrpjhbzurm.sysC:\Temp\xrpjhbzurm.sys1⤵
-
C:\Temp\jhbztrljeb.sysC:\Temp\jhbztrljeb.sys1⤵
-
C:\Temp\jvtolgeywq.sysC:\Temp\jvtolgeywq.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CreateProcess.exe
anxvpnifay.sys
bztrmjecwu.exe
cwupmhfzxr.sys
dtnlgdyvqo.exe
hcausmkecx.exe
i_bztrmjecwu.exe
i_dtnlgdyvqo.exe
i_hcausmkecx.exe
i_kfcxvpnhcx.exe
i_kidbvtnlfd.exe
i_qoigbytqlj.exe
i_ysqkidxpni.exe
jhbztrdbwt.sys
kfcxvpnhcx.exe
kidbvtnlfd.exe
oigbytrljd.sys
qoigbytqlj.exe
rmbwuomgez.exe
vpkicausmk.sys
wuomgezwrojhbztr.exe
wuomgezwrojhbztr.sys
xrpkhcamke.sys
ysqkidxpni.exe
ytoigaysql.sys
suggestions[1].en-US
memory/208-14-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/212-117-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/312-157-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1008-21-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1512-71-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1832-128-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1832-133-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2260-103-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2500-59-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2536-33-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2648-137-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2652-145-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2724-132-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2968-83-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3000-149-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3976-124-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4056-45-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4092-141-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4724-95-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4732-153-0x0000000000010000-0x00000000000AB000-memory.dmp