Analysis
- max time kernel
148s - max time network
143s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
04/06/2026, 15:37
General
- Target 2026-06-04_800e76f063bb3f2b81b6a2642b2ffe99_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 376KB
- Sample260604-s2zncsaw2p
- SHA256 fea7bbc1fd73403e48b2d7f744c916eff92561e7ac0d674317c961b81ea75a6d
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 41 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 29 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 3 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-04_800e76f063bb3f2b81b6a2642b2ffe99_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-04_800e76f063bb3f2b81b6a2642b2ffe99_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\tnlfdyvqoigaysql.exeC:\Temp\tnlfdyvqoigaysql.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dywqoigayt.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\dywqoigayt.exeC:\Temp\dywqoigayt.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dywqoigayt.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_dywqoigayt.exeC:\Temp\i_dywqoigayt.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\snlfdxvqni.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\snlfdxvqni.exeC:\Temp\snlfdxvqni.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_snlfdxvqni.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_snlfdxvqni.exeC:\Temp\i_snlfdxvqni.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nifavsqkfd.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\nifavsqkfd.exeC:\Temp\nifavsqkfd.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nifavsqkfd.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_nifavsqkfd.exeC:\Temp\i_nifavsqkfd.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zxvpnhfzxs.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\zxvpnhfzxs.exeC:\Temp\zxvpnhfzxs.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zxvpnhfzxs.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_zxvpnhfzxs.exeC:\Temp\i_zxvpnhfzxs.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mkecwrpmhe.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\mkecwrpmhe.exeC:\Temp\mkecwrpmhe.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mkecwrpmhe.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_mkecwrpmhe.exeC:\Temp\i_mkecwrpmhe.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wuomgezwrp.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\wuomgezwrp.exeC:\Temp\wuomgezwrp.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wuomgezwrp.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_wuomgezwrp.exeC:\Temp\i_wuomgezwrp.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wrojgbywro.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\wrojgbywro.exeC:\Temp\wrojgbywro.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wrojgbywro.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_wrojgbywro.exeC:\Temp\i_wrojgbywro.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rojgbztomg.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\rojgbztomg.exeC:\Temp\rojgbztomg.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rojgbztomg.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_rojgbztomg.exeC:\Temp\i_rojgbztomg.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jdbvtnlgdy.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jdbvtnlgdy.exeC:\Temp\jdbvtnlgdy.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jdbvtnlgdy.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jdbvtnlgdy.exeC:\Temp\i_jdbvtnlgdy.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ysqkicavsn.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ysqkicavsn.exeC:\Temp\ysqkicavsn.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ysqkicavsn.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ysqkicavsn.exeC:\Temp\i_ysqkicavsn.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vsnlfdxvpn.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\vsnlfdxvpn.exeC:\Temp\vsnlfdxvpn.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vsnlfdxvpn.exe ups_ins3⤵
-
C:\Temp\i_vsnlfdxvpn.exeC:\Temp\i_vsnlfdxvpn.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kicausmkfc.exe ups_run3⤵
-
C:\Temp\kicausmkfc.exeC:\Temp\kicausmkfc.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kicausmkfc.exe ups_ins3⤵
-
C:\Temp\i_kicausmkfc.exeC:\Temp\i_kicausmkfc.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\czusmkecxu.exe ups_run3⤵
-
C:\Temp\czusmkecxu.exeC:\Temp\czusmkecxu.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_czusmkecxu.exe ups_ins3⤵
-
C:\Temp\i_czusmkecxu.exeC:\Temp\i_czusmkecxu.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\omhezxrpjh.exe ups_run3⤵
-
C:\Temp\omhezxrpjh.exeC:\Temp\omhezxrpjh.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_omhezxrpjh.exe ups_ins3⤵
-
C:\Temp\i_omhezxrpjh.exeC:\Temp\i_omhezxrpjh.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jhbztomjec.exe ups_run3⤵
-
C:\Temp\jhbztomjec.exeC:\Temp\jhbztomjec.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jhbztomjec.exe ups_ins3⤵
-
C:\Temp\i_jhbztomjec.exeC:\Temp\i_jhbztomjec.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ebwuomgeyw.exe ups_run3⤵
-
C:\Temp\ebwuomgeyw.exeC:\Temp\ebwuomgeyw.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ebwuomgeyw.exe ups_ins3⤵
-
C:\Temp\i_ebwuomgeyw.exeC:\Temp\i_ebwuomgeyw.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ywqoigavtn.exe ups_run3⤵
-
C:\Temp\ywqoigavtn.exeC:\Temp\ywqoigavtn.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ywqoigavtn.exe ups_ins3⤵
-
C:\Temp\i_ywqoigavtn.exeC:\Temp\i_ywqoigavtn.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qkidavtnlf.exe ups_run3⤵
-
C:\Temp\qkidavtnlf.exeC:\Temp\qkidavtnlf.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qkidavtnlf.exe ups_ins3⤵
-
C:\Temp\i_qkidavtnlf.exeC:\Temp\i_qkidavtnlf.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vqcausnkfd.exe ups_run3⤵
-
C:\Temp\vqcausnkfd.exeC:\Temp\vqcausnkfd.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vqcausnkfd.exe ups_ins3⤵
-
C:\Temp\i_vqcausnkfd.exeC:\Temp\i_vqcausnkfd.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x2f4,0x7ffaa930c188,0x7ffaa930c194,0x7ffaa930c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1816,i,14311115794163286920,11337215894043972516,524288 --field-trial-handle=2120,i,862673351196735492,915476002087549174,262144 --variations-seed-version --mojo-platform-channel-handle=2148 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1580,i,9500948849457139624,8613533927998699758,262144 --field-trial-handle=2120,i,862673351196735492,915476002087549174,262144 --variations-seed-version --mojo-platform-channel-handle=2116 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2572,i,7506844188436941087,9256269108700391643,524288 --field-trial-handle=2120,i,862673351196735492,915476002087549174,262144 --variations-seed-version --mojo-platform-channel-handle=2560 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,8564772425519519248,14136739857506545116,2097152 --field-trial-handle=2120,i,862673351196735492,915476002087549174,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,16487267426290649560,17199369681003567098,2097152 --field-trial-handle=2120,i,862673351196735492,915476002087549174,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4776,i,10000433395185475446,18112504841726173392,524288 --field-trial-handle=2120,i,862673351196735492,915476002087549174,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4856,i,4298575454992440822,16548078788143499136,524288 --field-trial-handle=2120,i,862673351196735492,915476002087549174,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5736,i,16882559130656695074,5875073161732055340,524288 --field-trial-handle=2120,i,862673351196735492,915476002087549174,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5736,i,16882559130656695074,5875073161732055340,524288 --field-trial-handle=2120,i,862673351196735492,915476002087549174,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,4877444000889709147,1143083271476624190,524288 --field-trial-handle=2120,i,862673351196735492,915476002087549174,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:144⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.execookie_exporter.exe --cookie-json=11285⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5736,i,5882312730156103211,17225314238645954381,524288 --field-trial-handle=2120,i,862673351196735492,915476002087549174,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,17495522311357918291,7224068656486144080,524288 --field-trial-handle=2120,i,862673351196735492,915476002087549174,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5812,i,4561875071106755493,5762581619082139173,524288 --field-trial-handle=2120,i,862673351196735492,915476002087549174,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,5776196923270689629,18105791852158483862,524288 --field-trial-handle=2120,i,862673351196735492,915476002087549174,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=728,i,12790177814280669233,4214561636125388958,524288 --field-trial-handle=2120,i,862673351196735492,915476002087549174,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4992,i,5035981278694062149,17615896354331059046,524288 --field-trial-handle=2120,i,862673351196735492,915476002087549174,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5168,i,17368636942327565574,329959897384698540,524288 --field-trial-handle=2120,i,862673351196735492,915476002087549174,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,1443065946741202775,595018225331712884,524288 --field-trial-handle=2120,i,862673351196735492,915476002087549174,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5112,i,1007531620945947230,11558246751743839193,262144 --field-trial-handle=2120,i,862673351196735492,915476002087549174,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5344,i,523449624255576391,5826628472095688224,524288 --field-trial-handle=2120,i,862673351196735492,915476002087549174,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\tnlfdyvqoigaysql.sysC:\Temp\tnlfdyvqoigaysql.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\idavtnlfdx.sysC:\Temp\idavtnlfdx.sys1⤵
- Executes dropped EXE
-
C:\Temp\vsnlfdxvpn.sysC:\Temp\vsnlfdxvpn.sys1⤵
- Executes dropped EXE
-
C:\Temp\kecxupnhfz.sysC:\Temp\kecxupnhfz.sys1⤵
- Executes dropped EXE
-
C:\Temp\xupnhfzxrp.sysC:\Temp\xupnhfzxrp.sys1⤵
- Executes dropped EXE
-
C:\Temp\rmhezxrpjh.sysC:\Temp\rmhezxrpjh.sys1⤵
- Executes dropped EXE
-
C:\Temp\ebwuomgeyw.sysC:\Temp\ebwuomgeyw.sys1⤵
- Executes dropped EXE
-
C:\Temp\bwtolgeywr.sysC:\Temp\bwtolgeywr.sys1⤵
- Executes dropped EXE
-
C:\Temp\qnlgdytqli.sysC:\Temp\qnlgdytqli.sys1⤵
- Executes dropped EXE
-
C:\Temp\qlidbvtnlg.sysC:\Temp\qlidbvtnlg.sys1⤵
- Executes dropped EXE
-
C:\Temp\gaysqkicav.sysC:\Temp\gaysqkicav.sys1⤵
- Executes dropped EXE
-
C:\Temp\usnkfdxvpn.sysC:\Temp\usnkfdxvpn.sys1⤵
-
C:\Temp\mkecxupnhf.sysC:\Temp\mkecxupnhf.sys1⤵
-
C:\Temp\hezxrmkecw.sysC:\Temp\hezxrmkecw.sys1⤵
-
C:\Temp\urmkecwuom.sysC:\Temp\urmkecwuom.sys1⤵
-
C:\Temp\ljebwtomge.sysC:\Temp\ljebwtomge.sys1⤵
-
C:\Temp\jdbvtnlgdy.sysC:\Temp\jdbvtnlgdy.sys1⤵
-
C:\Temp\gdyoigaysq.sysC:\Temp\gdyoigaysq.sys1⤵
-
C:\Temp\davtnlfdxv.sysC:\Temp\davtnlfdxv.sys1⤵
-
C:\Temp\xsqkicausn.sysC:\Temp\xsqkicausn.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CreateProcess.exe
dywqoigayt.exe
i_dywqoigayt.exe
i_mkecwrpmhe.exe
i_nifavsqkfd.exe
i_snlfdxvqni.exe
i_wuomgezwrp.exe
i_zxvpnhfzxs.exe
idavtnlfdx.sys
kecxupnhfz.sys
mkecwrpmhe.exe
nifavsqkfd.exe
rmhezxrpjh.sys
snlfdxvqni.exe
tnlfdyvqoigaysql.exe
tnlfdyvqoigaysql.sys
vsnlfdxvpn.sys
wuomgezwrp.exe
xupnhfzxrp.sys
zxvpnhfzxs.exe
8782ee3a-bee3-4a97-ab33-f73535c0a0a8.tmp
settings.dat
settings.dat
BookmarkMergedSurfaceOrdering
BrowsingTopicsState
SiteList-Enterprise.json
HubApps
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Preferences
Preferences
Secure Preferences
sync_diagnostic.log
Local State
Local State
Local State
Local State
Local State
typosquatting_list.pb
metadata.json
metadata.json
metadata.json
d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
metadata.json
manifest.json
data.txt
manifest.json
manifest.json
memory/572-667-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1500-645-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1796-712-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2220-679-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2464-229-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2888-592-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3096-584-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3096-562-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3528-198-0x00000197BC290000-0x00000197BC64B000-memory.dmp
memory/3568-506-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3756-550-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3852-538-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4908-209-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5076-574-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5108-615-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5220-628-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5344-60-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5428-173-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5444-733-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5584-745-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5596-700-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5836-250-0x0000000000010000-0x00000000000AB000-memory.dmp