Analysis
- max time kernel
149s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
11/07/2026, 12:31
General
- Target 2026-07-11_bbf439406e9a87b3e904588ddd58b925_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 722KB
- Sample260711-pp9e9act2t
- SHA256 628d40dedc02b49adf86bb30a3d75b50df1b0d8b42a42527d4fd3aa0c1c956cb
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 35 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 60 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-11_bbf439406e9a87b3e904588ddd58b925_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-11_bbf439406e9a87b3e904588ddd58b925_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\ljebwuomgeywrobz.exeC:\Temp\ljebwuomgeywrobz.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gbytrlgeyw.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\gbytrlgeyw.exeC:\Temp\gbytrlgeyw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gbytrlgeyw.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_gbytrlgeyw.exeC:\Temp\i_gbytrlgeyw.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rljdbvtolg.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\rljdbvtolg.exeC:\Temp\rljdbvtolg.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rljdbvtolg.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_rljdbvtolg.exeC:\Temp\i_rljdbvtolg.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qkidavoiga.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\qkidavoiga.exeC:\Temp\qkidavoiga.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qkidavoiga.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_qkidavoiga.exeC:\Temp\i_qkidavoiga.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qkicavsnlf.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\qkicavsnlf.exeC:\Temp\qkicavsnlf.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qkicavsnlf.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_qkicavsnlf.exeC:\Temp\i_qkicavsnlf.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\aupnhfzxsp.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\aupnhfzxsp.exeC:\Temp\aupnhfzxsp.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_aupnhfzxsp.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_aupnhfzxsp.exeC:\Temp\i_aupnhfzxsp.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kecxupnhfa.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\kecxupnhfa.exeC:\Temp\kecxupnhfa.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kecxupnhfa.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_kecxupnhfa.exeC:\Temp\i_kecxupnhfa.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pjhbzurmke.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\pjhbzurmke.exeC:\Temp\pjhbzurmke.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pjhbzurmke.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_pjhbzurmke.exeC:\Temp\i_pjhbzurmke.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\omgezwrpjh.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\omgezwrpjh.exeC:\Temp\omgezwrpjh.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_omgezwrpjh.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_omgezwrpjh.exeC:\Temp\i_omgezwrpjh.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\eytrlgeywq.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\eytrlgeywq.exeC:\Temp\eytrlgeywq.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_eytrlgeywq.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_eytrlgeywq.exeC:\Temp\i_eytrlgeywq.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lidbvtnlgd.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\lidbvtnlgd.exeC:\Temp\lidbvtnlgd.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_lidbvtnlgd.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_lidbvtnlgd.exeC:\Temp\i_lidbvtnlgd.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\oigaysnlgd.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\oigaysnlgd.exeC:\Temp\oigaysnlgd.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_oigaysnlgd.exe ups_ins3⤵
-
C:\Temp\i_oigaysnlgd.exeC:\Temp\i_oigaysnlgd.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\davtnlfdxv.exe ups_run3⤵
-
C:\Temp\davtnlfdxv.exeC:\Temp\davtnlfdxv.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_davtnlfdxv.exe ups_ins3⤵
-
C:\Temp\i_davtnlfdxv.exeC:\Temp\i_davtnlfdxv.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vsnkfdxvpn.exe ups_run3⤵
-
C:\Temp\vsnkfdxvpn.exeC:\Temp\vsnkfdxvpn.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vsnkfdxvpn.exe ups_ins3⤵
-
C:\Temp\i_vsnkfdxvpn.exeC:\Temp\i_vsnkfdxvpn.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\smkfcxupnh.exe ups_run3⤵
-
C:\Temp\smkfcxupnh.exeC:\Temp\smkfcxupnh.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_smkfcxupnh.exe ups_ins3⤵
-
C:\Temp\i_smkfcxupnh.exeC:\Temp\i_smkfcxupnh.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rmkecwupmh.exe ups_run3⤵
-
C:\Temp\rmkecwupmh.exeC:\Temp\rmkecwupmh.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rmkecwupmh.exe ups_ins3⤵
-
C:\Temp\i_rmkecwupmh.exeC:\Temp\i_rmkecwupmh.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hezwrpjhcw.exe ups_run3⤵
-
C:\Temp\hezwrpjhcw.exeC:\Temp\hezwrpjhcw.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hezwrpjhcw.exe ups_ins3⤵
-
C:\Temp\i_hezwrpjhcw.exeC:\Temp\i_hezwrpjhcw.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bwuomgeywr.exe ups_run3⤵
-
C:\Temp\bwuomgeywr.exeC:\Temp\bwuomgeywr.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bwuomgeywr.exe ups_ins3⤵
-
C:\Temp\i_bwuomgeywr.exeC:\Temp\i_bwuomgeywr.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jdbwtolgey.exe ups_run3⤵
-
C:\Temp\jdbwtolgey.exeC:\Temp\jdbwtolgey.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jdbwtolgey.exe ups_ins3⤵
-
C:\Temp\i_jdbwtolgey.exeC:\Temp\i_jdbwtolgey.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lgdywqoiga.exe ups_run3⤵
-
C:\Temp\lgdywqoiga.exeC:\Temp\lgdywqoiga.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_lgdywqoiga.exe ups_ins3⤵
-
C:\Temp\i_lgdywqoiga.exeC:\Temp\i_lgdywqoiga.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3516 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Temp\ljebwuomgeywrobz.sysC:\Temp\ljebwuomgeywrobz.sys1⤵
- Executes dropped EXE
-
C:\Temp\ywqoigaytq.sysC:\Temp\ywqoigaytq.sys1⤵
- Executes dropped EXE
-
C:\Temp\bvqoigaysq.sysC:\Temp\bvqoigaysq.sys1⤵
- Executes dropped EXE
-
C:\Temp\avqnifaysq.sysC:\Temp\avqnifaysq.sys1⤵
- Executes dropped EXE
-
C:\Temp\snifaxsqki.sysC:\Temp\snifaxsqki.sys1⤵
- Executes dropped EXE
-
C:\Temp\vpnhfzxspk.sysC:\Temp\vpnhfzxspk.sys1⤵
- Executes dropped EXE
-
C:\Temp\zusmkecwup.sysC:\Temp\zusmkecwup.sys1⤵
- Executes dropped EXE
-
C:\Temp\zuomgezwrp.sysC:\Temp\zuomgezwrp.sys1⤵
- Executes dropped EXE
-
C:\Temp\ojgbytrljd.sysC:\Temp\ojgbytrljd.sys1⤵
- Executes dropped EXE
-
C:\Temp\eywqoigbyt.sysC:\Temp\eywqoigbyt.sys1⤵
- Executes dropped EXE
-
C:\Temp\vtnlgdywqo.sysC:\Temp\vtnlgdywqo.sys1⤵
- Executes dropped EXE
-
C:\Temp\nicavsnlfd.sysC:\Temp\nicavsnlfd.sys1⤵
-
C:\Temp\fausnkfcxv.sysC:\Temp\fausnkfcxv.sys1⤵
-
C:\Temp\hcausmkfcx.sysC:\Temp\hcausmkfcx.sys1⤵
-
C:\Temp\zxrpjhczus.sysC:\Temp\zxrpjhczus.sys1⤵
-
C:\Temp\rmkecwuomh.sysC:\Temp\rmkecwuomh.sys1⤵
-
C:\Temp\jdbwtomgey.sysC:\Temp\jdbwtomgey.sys1⤵
-
C:\Temp\mgbztrljdb.sysC:\Temp\mgbztrljdb.sys1⤵
-
C:\Temp\tqlidbvtnl.sysC:\Temp\tqlidbvtnl.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CreateProcess.exe
aupnhfzxsp.exe
avqnifaysq.sys
bvqoigaysq.sys
gbytrlgeyw.exe
i_aupnhfzxsp.exe
i_gbytrlgeyw.exe
i_kecxupnhfa.exe
i_pjhbzurmke.exe
i_qkicavsnlf.exe
i_qkidavoiga.exe
i_rljdbvtolg.exe
kecxupnhfa.exe
ljebwuomgeywrobz.exe
ljebwuomgeywrobz.sys
omgezwrpjh.exe
pjhbzurmke.exe
qkicavsnlf.exe
qkidavoiga.exe
rljdbvtolg.exe
snifaxsqki.sys
vpnhfzxspk.sys
ywqoigaytq.sys
zuomgezwrp.sys
zusmkecwup.sys
8A7891822FCFF127E4EADADE9757112B
8A7891822FCFF127E4EADADE9757112B
suggestions[1].en-US
memory/204-45-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/628-148-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1152-140-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1292-14-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1364-136-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1368-101-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1580-69-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1908-152-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2628-128-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2668-118-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2848-132-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3084-57-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3304-89-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3404-21-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3832-122-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4276-156-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4780-33-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4836-144-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4964-107-0x0000000000010000-0x00000000000AB000-memory.dmp