Analysis
- max time kernel
149s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
11/07/2026, 12:17
General
- Target 2026-07-11_dd2bd3f379140151ad91f9faa7d5cf51_amadey_darkgate_elex_smoke-loader_stop.exe
- Size 384KB
- Sample260711-pgcfjsbz61
- SHA256 09591209c21980e03037dcb79d281098a4cd703efaab77a01a35324602bc6ba0
Score
10/10
Malware Config
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 28 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 60 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-11_dd2bd3f379140151ad91f9faa7d5cf51_amadey_darkgate_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-11_dd2bd3f379140151ad91f9faa7d5cf51_amadey_darkgate_elex_smoke-loader_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\wuomgezwrojhbztr.exeC:\Temp\wuomgezwrojhbztr.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\eztrljebwt.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\eztrljebwt.exeC:\Temp\eztrljebwt.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_eztrljebwt.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_eztrljebwt.exeC:\Temp\i_eztrljebwt.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bvtolgeywq.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\bvtolgeywq.exeC:\Temp\bvtolgeywq.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bvtolgeywq.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_bvtolgeywq.exeC:\Temp\i_bvtolgeywq.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bvtigaysql.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\bvtigaysql.exeC:\Temp\bvtigaysql.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bvtigaysql.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_bvtigaysql.exeC:\Temp\i_bvtigaysql.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dxvpnifaxs.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\dxvpnifaxs.exeC:\Temp\dxvpnifaxs.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dxvpnifaxs.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_dxvpnifaxs.exeC:\Temp\i_dxvpnifaxs.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nkfdxvpnhx.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\nkfdxvpnhx.exeC:\Temp\nkfdxvpnhx.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nkfdxvpnhx.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_nkfdxvpnhx.exeC:\Temp\i_nkfdxvpnhx.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\smkfcxsmke.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\smkfcxsmke.exeC:\Temp\smkfcxsmke.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_smkfcxsmke.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_smkfcxsmke.exeC:\Temp\i_smkfcxsmke.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zurmkecwuo.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\zurmkecwuo.exeC:\Temp\zurmkecwuo.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zurmkecwuo.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_zurmkecwuo.exeC:\Temp\i_zurmkecwuo.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ezuomgeywr.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ezuomgeywr.exeC:\Temp\ezuomgeywr.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ezuomgeywr.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ezuomgeywr.exeC:\Temp\i_ezuomgeywr.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rlgeywqojg.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\rlgeywqojg.exeC:\Temp\rlgeywqojg.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rlgeywqojg.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_rlgeywqojg.exeC:\Temp\i_rlgeywqojg.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jeywrlgeyw.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jeywrlgeyw.exeC:\Temp\jeywrlgeyw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jeywrlgeyw.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jeywrlgeyw.exeC:\Temp\i_jeywrlgeyw.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ytqljdbvtn.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ytqljdbvtn.exeC:\Temp\ytqljdbvtn.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ytqljdbvtn.exe ups_ins3⤵
-
C:\Temp\i_ytqljdbvtn.exeC:\Temp\i_ytqljdbvtn.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lfdxvqnifa.exe ups_run3⤵
-
C:\Temp\lfdxvqnifa.exeC:\Temp\lfdxvqnifa.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_lfdxvqnifa.exe ups_ins3⤵
-
C:\Temp\i_lfdxvqnifa.exeC:\Temp\i_lfdxvqnifa.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dxvpnhfaxs.exe ups_run3⤵
-
C:\Temp\dxvpnhfaxs.exeC:\Temp\dxvpnhfaxs.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dxvpnhfaxs.exe ups_ins3⤵
-
C:\Temp\i_dxvpnhfaxs.exeC:\Temp\i_dxvpnhfaxs.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\axsqkicaus.exe ups_run3⤵
-
C:\Temp\axsqkicaus.exeC:\Temp\axsqkicaus.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_axsqkicaus.exe ups_ins3⤵
-
C:\Temp\i_axsqkicaus.exeC:\Temp\i_axsqkicaus.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rmkecxupmh.exe ups_run3⤵
-
C:\Temp\rmkecxupmh.exeC:\Temp\rmkecxupmh.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rmkecxupmh.exe ups_ins3⤵
-
C:\Temp\i_rmkecxupmh.exeC:\Temp\i_rmkecxupmh.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hczurmkecw.exe ups_run3⤵
-
C:\Temp\hczurmkecw.exeC:\Temp\hczurmkecw.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hczurmkecw.exe ups_ins3⤵
-
C:\Temp\i_hczurmkecw.exeC:\Temp\i_hczurmkecw.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\trljdbwuom.exe ups_run3⤵
-
C:\Temp\trljdbwuom.exeC:\Temp\trljdbwuom.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_trljdbwuom.exe ups_ins3⤵
-
C:\Temp\i_trljdbwuom.exeC:\Temp\i_trljdbwuom.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wqojgbztrl.exe ups_run3⤵
-
C:\Temp\wqojgbztrl.exeC:\Temp\wqojgbztrl.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wqojgbztrl.exe ups_ins3⤵
-
C:\Temp\i_wqojgbztrl.exeC:\Temp\i_wqojgbztrl.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ljdbvtolge.exe ups_run3⤵
-
C:\Temp\ljdbvtolge.exeC:\Temp\ljdbvtolge.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ljdbvtolge.exe ups_ins3⤵
-
C:\Temp\i_ljdbvtolge.exeC:\Temp\i_ljdbvtolge.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3416 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Temp\wuomgezwrojhbztr.sysC:\Temp\wuomgezwrojhbztr.sys1⤵
- Executes dropped EXE
-
C:\Temp\lgeywqoigb.sysC:\Temp\lgeywqoigb.sys1⤵
- Executes dropped EXE
-
C:\Temp\igaysqlidb.sysC:\Temp\igaysqlidb.sys1⤵
- Executes dropped EXE
-
C:\Temp\vqoigaysql.sysC:\Temp\vqoigaysql.sys1⤵
- Executes dropped EXE
-
C:\Temp\ysqkicavsn.sysC:\Temp\ysqkicavsn.sys1⤵
- Executes dropped EXE
-
C:\Temp\zxrpkhcaus.sysC:\Temp\zxrpkhcaus.sys1⤵
- Executes dropped EXE
-
C:\Temp\kecwupmhfz.sysC:\Temp\kecwupmhfz.sys1⤵
- Executes dropped EXE
-
C:\Temp\usecwuomhe.sysC:\Temp\usecwuomhe.sys1⤵
- Executes dropped EXE
-
C:\Temp\gezwrojhbz.sysC:\Temp\gezwrojhbz.sys1⤵
- Executes dropped EXE
-
C:\Temp\qojgbztrlj.sysC:\Temp\qojgbztrlj.sys1⤵
- Executes dropped EXE
-
C:\Temp\gdywqoigby.sysC:\Temp\gdywqoigby.sys1⤵
- Executes dropped EXE
-
C:\Temp\sqkidavtnl.sysC:\Temp\sqkidavtnl.sys1⤵
-
C:\Temp\vqnigaysqk.sysC:\Temp\vqnigaysqk.sys1⤵
-
C:\Temp\hfzxspkica.sysC:\Temp\hfzxspkica.sys1⤵
-
C:\Temp\zxrpjhczus.sysC:\Temp\zxrpjhczus.sys1⤵
-
C:\Temp\omhezxrpjh.sysC:\Temp\omhezxrpjh.sys1⤵
-
C:\Temp\mgezwrpjhb.sysC:\Temp\mgezwrpjhb.sys1⤵
-
C:\Temp\hbwtomgeyw.sysC:\Temp\hbwtomgeyw.sys1⤵
-
C:\Temp\wqljdbvtnl.sysC:\Temp\wqljdbvtnl.sys1⤵
-
C:\Temp\nlfdyvqoig.sysC:\Temp\nlfdyvqoig.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CreateProcess.exe
bvtigaysql.exe
bvtolgeywq.exe
dxvpnifaxs.exe
eztrljebwt.exe
ezuomgeywr.exe
i_bvtigaysql.exe
i_bvtolgeywq.exe
i_dxvpnifaxs.exe
i_eztrljebwt.exe
i_nkfdxvpnhx.exe
i_smkfcxsmke.exe
i_zurmkecwuo.exe
igaysqlidb.sys
kecwupmhfz.sys
lgeywqoigb.sys
nkfdxvpnhx.exe
smkfcxsmke.exe
usecwuomhe.sys
vqoigaysql.sys
wuomgezwrojhbztr.exe
wuomgezwrojhbztr.sys
ysqkicavsn.sys
zurmkecwuo.exe
zxrpkhcaus.sys
suggestions[1].en-US
memory/572-147-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1104-14-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1472-156-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1472-161-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1644-130-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1972-33-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2156-45-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2276-74-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2368-111-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2840-89-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3272-62-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3324-101-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3868-134-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3868-139-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3988-21-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4204-143-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4204-149-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4236-122-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4248-138-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4380-165-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4524-160-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4584-152-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5104-126-0x0000000000010000-0x00000000000AB000-memory.dmp