Analysis
- max time kernel
149s - max time network
133s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
30/06/2026, 04:31
General
- Target 2026-06-29_b6aa9c8f71a0584edb9b3d9181de58b3_elex_redline-stealer_rhadamanthys_stop.exe
- Size 230KB
- Sample260630-e5ntdae14m
- SHA256 43311c1f489a6de31c4e70618c8dd9b96daed010d39e57da697d7f7b838ca86b
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba8102
-
http://xytets.com:2345/ll/out.txt
-
http://xytets.com:2345/t.asp?os=home8102
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 43 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 46 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 19 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SetWindowsHookEx 10 IoCs
- Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-29_b6aa9c8f71a0584edb9b3d9181de58b3_elex_redline-stealer_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-29_b6aa9c8f71a0584edb9b3d9181de58b3_elex_redline-stealer_rhadamanthys_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home81022⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2640 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\cwumjecwmg.exe ups_run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\cwumjecwmg.exeC:\Temp\cwumjecwmg.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_cwumjecwmg.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_cwumjecwmg.exeC:\Temp\i_cwumjecwmg.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\trljdbwtom.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\trljdbwtom.exeC:\Temp\trljdbwtom.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_trljdbwtom.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_trljdbwtom.exeC:\Temp\i_trljdbwtom.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\dbvtnlgeyw.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\dbvtnlgeyw.exeC:\Temp\dbvtnlgeyw.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_dbvtnlgeyw.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_dbvtnlgeyw.exeC:\Temp\i_dbvtnlgeyw.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\tnlgdywqoi.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\tnlgdywqoi.exeC:\Temp\tnlgdywqoi.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_tnlgdywqoi.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_tnlgdywqoi.exeC:\Temp\i_tnlgdywqoi.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\dxvqnidavs.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\dxvqnidavs.exeC:\Temp\dxvqnidavs.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_dxvqnidavs.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_dxvqnidavs.exeC:\Temp\i_dxvqnidavs.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\xvpnhfaxsq.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\xvpnhfaxsq.exeC:\Temp\xvpnhfaxsq.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_xvpnhfaxsq.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_xvpnhfaxsq.exeC:\Temp\i_xvpnhfaxsq.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\hfzxrpkhca.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\hfzxrpkhca.exeC:\Temp\hfzxrpkhca.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_hfzxrpkhca.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_hfzxrpkhca.exeC:\Temp\i_hfzxrpkhca.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\zupmhfzxrp.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\zupmhfzxrp.exeC:\Temp\zupmhfzxrp.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_zupmhfzxrp.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_zupmhfzxrp.exeC:\Temp\i_zupmhfzxrp.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\jhbztrmjeb.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\jhbztrmjeb.exeC:\Temp\jhbztrmjeb.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_jhbztrmjeb.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_jhbztrmjeb.exeC:\Temp\i_jhbztrmjeb.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\mjebwuomge.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\mjebwuomge.exeC:\Temp\mjebwuomge.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_mjebwuomge.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_mjebwuomge.exeC:\Temp\i_mjebwuomge.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\eywqojgbyt.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\eywqojgbyt.exeC:\Temp\eywqojgbyt.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_eywqojgbyt.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_eywqojgbyt.exeC:\Temp\i_eywqojgbyt.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\sqlidbvtnl.exe ups_run2⤵
-
C:\Temp\sqlidbvtnl.exeC:\Temp\sqlidbvtnl.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_sqlidbvtnl.exe ups_ins2⤵
-
C:\Temp\i_sqlidbvtnl.exeC:\Temp\i_sqlidbvtnl.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\nigaysqkid.exe ups_run2⤵
-
C:\Temp\nigaysqkid.exeC:\Temp\nigaysqkid.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_nigaysqkid.exe ups_ins2⤵
-
C:\Temp\i_nigaysqkid.exeC:\Temp\i_nigaysqkid.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\kidavtnlfd.exe ups_run2⤵
-
C:\Temp\kidavtnlfd.exeC:\Temp\kidavtnlfd.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_kidavtnlfd.exe ups_ins2⤵
-
C:\Temp\i_kidavtnlfd.exeC:\Temp\i_kidavtnlfd.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\fzxspkicau.exe ups_run2⤵
-
C:\Temp\fzxspkicau.exeC:\Temp\fzxspkicau.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_fzxspkicau.exe ups_ins2⤵
-
C:\Temp\i_fzxspkicau.exeC:\Temp\i_fzxspkicau.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\zxrpkhczus.exe ups_run2⤵
-
C:\Temp\zxrpkhczus.exeC:\Temp\zxrpkhczus.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_zxrpkhczus.exe ups_ins2⤵
-
C:\Temp\i_zxrpkhczus.exeC:\Temp\i_zxrpkhczus.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\pjecwuomge.exe ups_run2⤵
-
C:\Temp\pjecwuomge.exeC:\Temp\pjecwuomge.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_pjecwuomge.exe ups_ins2⤵
-
C:\Temp\i_pjecwuomge.exeC:\Temp\i_pjecwuomge.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\mkecwuomhe.exe ups_run2⤵
-
C:\Temp\mkecwuomhe.exeC:\Temp\mkecwuomhe.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_mkecwuomhe.exe ups_ins2⤵
-
C:\Temp\i_mkecwuomhe.exeC:\Temp\i_mkecwuomhe.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ztrljdbwto.exe ups_run2⤵
-
C:\Temp\ztrljdbwto.exeC:\Temp\ztrljdbwto.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ztrljdbwto.exe ups_ins2⤵
-
C:\Temp\i_ztrljdbwto.exeC:\Temp\i_ztrljdbwto.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\btqljdbvtn.exe ups_run2⤵
-
C:\Temp\btqljdbvtn.exeC:\Temp\btqljdbvtn.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\Temp\ebwuomgeyw.sysC:\Temp\ebwuomgeyw.sys1⤵
- Executes dropped EXE
-
C:\Temp\oigbytrljd.sysC:\Temp\oigbytrljd.sys1⤵
- Executes dropped EXE
-
C:\Temp\aysqlidbvt.sysC:\Temp\aysqlidbvt.sys1⤵
- Executes dropped EXE
-
C:\Temp\tnlfdxvqni.sysC:\Temp\tnlfdxvqni.sys1⤵
- Executes dropped EXE
-
C:\Temp\icavsnkfdx.sysC:\Temp\icavsnkfdx.sys1⤵
- Executes dropped EXE
-
C:\Temp\smkfcxvpnh.sysC:\Temp\smkfcxvpnh.sys1⤵
- Executes dropped EXE
-
C:\Temp\hfzxrpkhca.sysC:\Temp\hfzxrpkhca.sys1⤵
- Executes dropped EXE
-
C:\Temp\cwuomhezxr.sysC:\Temp\cwuomhezxr.sys1⤵
- Executes dropped EXE
-
C:\Temp\wrpjhbztrm.sysC:\Temp\wrpjhbztrm.sys1⤵
- Executes dropped EXE
-
C:\Temp\ljdbwtomge.sysC:\Temp\ljdbwtomge.sys1⤵
- Executes dropped EXE
-
C:\Temp\dywqoigayt.sysC:\Temp\dywqoigayt.sys1⤵
-
C:\Temp\dbvtnlgdyv.sysC:\Temp\dbvtnlgdyv.sys1⤵
-
C:\Temp\sqkicavsnl.sysC:\Temp\sqkicavsnl.sys1⤵
-
C:\Temp\nkfdxvpnhf.sysC:\Temp\nkfdxvpnhf.sys1⤵
-
C:\Temp\kecxupnhfz.sysC:\Temp\kecxupnhfz.sys1⤵
-
C:\Temp\hcausmkecx.sysC:\Temp\hcausmkecx.sys1⤵
-
C:\Temp\trmjecwuom.sysC:\Temp\trmjecwuom.sys1⤵
-
C:\Temp\geywrojhbz.sysC:\Temp\geywrojhbz.sys1⤵
-
C:\Temp\tqljdbvtol.sysC:\Temp\tqljdbvtol.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CP.exe
aysqlidbvt.sys
cwumjecwmg.exe
dbvtnlgeyw.exe
dxvqnidavs.exe
ebwuomgeyw.sys
hfzxrpkhca.exe
hfzxrpkhca.sys
i_cwumjecwmg.exe
i_dbvtnlgeyw.exe
i_dxvqnidavs.exe
i_hfzxrpkhca.exe
i_tnlgdywqoi.exe
i_trljdbwtom.exe
i_xvpnhfaxsq.exe
icavsnkfdx.sys
oigbytrljd.sys
smkfcxvpnh.sys
tnlfdxvqni.sys
tnlgdywqoi.exe
trljdbwtom.exe
xvpnhfaxsq.exe
zupmhfzxrp.exe
RecoveryStore.{28452DE2-74AE-11F1-9F3C-5AB93EA64185}.dat
RecoveryStore.{28479354-74AE-11F1-9F3C-5AB93EA64185}.dat
suggestions[1].en-US
memory/400-99-0x0000000000010000-0x0000000000083000-memory.dmp
memory/448-153-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1244-78-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1792-145-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1936-141-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2284-90-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2664-133-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3080-121-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3268-149-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3452-129-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3468-28-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3600-52-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3816-137-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3968-117-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3972-40-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4460-16-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4496-66-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4544-125-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5016-113-0x0000000000010000-0x0000000000083000-memory.dmp