Analysis
- max time kernel
149s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
18/07/2026, 03:58
General
- Target 2026-07-17_4cd2651966a93e6d68184f36b44089a3_amadey_darkgate_elex_smoke-loader_stop.exe
- Size 384KB
- Sample260718-ejyfpafw8j
- SHA256 177e584adae758abb1205b308959363259f0063d49b492f36fbf0f5eae57eb25
Score
10/10
Malware Config
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 35 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 59 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-17_4cd2651966a93e6d68184f36b44089a3_amadey_darkgate_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-17_4cd2651966a93e6d68184f36b44089a3_amadey_darkgate_elex_smoke-loader_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\xrpkhczusmkecxup.exeC:\Temp\xrpkhczusmkecxup.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\czusmkecwu.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\czusmkecwu.exeC:\Temp\czusmkecwu.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_czusmkecwu.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_czusmkecwu.exeC:\Temp\i_czusmkecwu.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zwrpjhbztr.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\zwrpjhbztr.exeC:\Temp\zwrpjhbztr.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zwrpjhbztr.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_zwrpjhbztr.exeC:\Temp\i_zwrpjhbztr.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jgbztrlgey.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jgbztrlgey.exeC:\Temp\jgbztrlgey.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jgbztrlgey.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jgbztrlgey.exeC:\Temp\i_jgbztrlgey.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\tolgeywqoj.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\tolgeywqoj.exeC:\Temp\tolgeywqoj.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_tolgeywqoj.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_tolgeywqoj.exeC:\Temp\i_tolgeywqoj.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bvtnlgdywq.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\bvtnlgdywq.exeC:\Temp\bvtnlgdywq.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bvtnlgdywq.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_bvtnlgdywq.exeC:\Temp\i_bvtnlgdywq.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qoigaysqli.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\qoigaysqli.exeC:\Temp\qoigaysqli.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qoigaysqli.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_qoigaysqli.exeC:\Temp\i_qoigaysqli.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xvqkfaysqk.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\xvqkfaysqk.exeC:\Temp\xvqkfaysqk.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xvqkfaysqk.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_xvqkfaysqk.exeC:\Temp\i_xvqkfaysqk.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\icausmkfcx.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\icausmkfcx.exeC:\Temp\icausmkfcx.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_icausmkfcx.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_icausmkfcx.exeC:\Temp\i_icausmkfcx.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rpkhcausmk.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\rpkhcausmk.exeC:\Temp\rpkhcausmk.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rpkhcausmk.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_rpkhcausmk.exeC:\Temp\i_rpkhcausmk.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rmkecwupmh.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\rmkecwupmh.exeC:\Temp\rmkecwupmh.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rmkecwupmh.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_rmkecwupmh.exeC:\Temp\i_rmkecwupmh.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\cwrojhbztr.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\cwrojhbztr.exeC:\Temp\cwrojhbztr.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_cwrojhbztr.exe ups_ins3⤵
-
C:\Temp\i_cwrojhbztr.exeC:\Temp\i_cwrojhbztr.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qojgbytrlj.exe ups_run3⤵
-
C:\Temp\qojgbytrlj.exeC:\Temp\qojgbytrlj.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qojgbytrlj.exe ups_ins3⤵
-
C:\Temp\i_qojgbytrlj.exeC:\Temp\i_qojgbytrlj.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gaytqlgayt.exe ups_run3⤵
-
C:\Temp\gaytqlgayt.exeC:\Temp\gaytqlgayt.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gaytqlgayt.exe ups_ins3⤵
-
C:\Temp\i_gaytqlgayt.exeC:\Temp\i_gaytqlgayt.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dyvqoigayt.exe ups_run3⤵
-
C:\Temp\dyvqoigayt.exeC:\Temp\dyvqoigayt.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dyvqoigayt.exe ups_ins3⤵
-
C:\Temp\i_dyvqoigayt.exeC:\Temp\i_dyvqoigayt.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\snlfdxvpni.exe ups_run3⤵
-
C:\Temp\snlfdxvpni.exeC:\Temp\snlfdxvpni.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_snlfdxvpni.exe ups_ins3⤵
-
C:\Temp\i_snlfdxvpni.exeC:\Temp\i_snlfdxvpni.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kicausnkfc.exe ups_run3⤵
-
C:\Temp\kicausnkfc.exeC:\Temp\kicausnkfc.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kicausnkfc.exe ups_ins3⤵
-
C:\Temp\i_kicausnkfc.exeC:\Temp\i_kicausnkfc.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ecwupmhfzx.exe ups_run3⤵
-
C:\Temp\ecwupmhfzx.exeC:\Temp\ecwupmhfzx.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ecwupmhfzx.exe ups_ins3⤵
-
C:\Temp\i_ecwupmhfzx.exeC:\Temp\i_ecwupmhfzx.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ecxupnhfwu.exe ups_run3⤵
-
C:\Temp\ecxupnhfwu.exeC:\Temp\ecxupnhfwu.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ecxupnhfwu.exe ups_ins3⤵
-
C:\Temp\i_ecxupnhfwu.exeC:\Temp\i_ecxupnhfwu.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\uomhezxrpj.exe ups_run3⤵
-
C:\Temp\uomhezxrpj.exeC:\Temp\uomhezxrpj.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_uomhezxrpj.exe ups_ins3⤵
-
C:\Temp\i_uomhezxrpj.exeC:\Temp\i_uomhezxrpj.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2308 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Temp\xrpkhczusmkecxup.sysC:\Temp\xrpkhczusmkecxup.sys1⤵
- Executes dropped EXE
-
C:\Temp\jhbzurmkec.sysC:\Temp\jhbzurmkec.sys1⤵
- Executes dropped EXE
-
C:\Temp\tomgeywroj.sysC:\Temp\tomgeywroj.sys1⤵
- Executes dropped EXE
-
C:\Temp\bytrljdbvt.sysC:\Temp\bytrljdbvt.sys1⤵
- Executes dropped EXE
-
C:\Temp\qoigbytqlj.sysC:\Temp\qoigbytqlj.sys1⤵
- Executes dropped EXE
-
C:\Temp\bvtnlgdyvq.sysC:\Temp\bvtnlgdyvq.sys1⤵
- Executes dropped EXE
-
C:\Temp\icavsnlfdx.sysC:\Temp\icavsnlfdx.sys1⤵
- Executes dropped EXE
-
C:\Temp\pnhfaxsqki.sysC:\Temp\pnhfaxsqki.sys1⤵
- Executes dropped EXE
-
C:\Temp\hfzxrpkhca.sysC:\Temp\hfzxrpkhca.sys1⤵
- Executes dropped EXE
-
C:\Temp\zxrpjhbzur.sysC:\Temp\zxrpjhbzur.sys1⤵
- Executes dropped EXE
-
C:\Temp\jhbzurmjec.sysC:\Temp\jhbzurmjec.sys1⤵
- Executes dropped EXE
-
C:\Temp\bwtomgeywq.sysC:\Temp\bwtomgeywq.sys1⤵
-
C:\Temp\ztrljdbwto.sysC:\Temp\ztrljdbwto.sys1⤵
-
C:\Temp\ljdbvtnlgd.sysC:\Temp\ljdbvtnlgd.sys1⤵
-
C:\Temp\aysqkidavs.sysC:\Temp\aysqkidavs.sys1⤵
-
C:\Temp\vsnkfdxvpn.sysC:\Temp\vsnkfdxvpn.sys1⤵
-
C:\Temp\xspkicausm.sysC:\Temp\xspkicausm.sys1⤵
-
C:\Temp\mkecwupmhf.sysC:\Temp\mkecwupmhf.sys1⤵
-
C:\Temp\bzurmjecwu.sysC:\Temp\bzurmjecwu.sys1⤵
-
C:\Temp\uomgezwroj.sysC:\Temp\uomgezwroj.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CreateProcess.exe
bvtnlgdyvq.sys
bvtnlgdywq.exe
bytrljdbvt.sys
czusmkecwu.exe
i_bvtnlgdywq.exe
i_czusmkecwu.exe
i_jgbztrlgey.exe
i_qoigaysqli.exe
i_tolgeywqoj.exe
i_xvqkfaysqk.exe
i_zwrpjhbztr.exe
icausmkfcx.exe
icavsnlfdx.sys
jgbztrlgey.exe
jhbzurmkec.sys
pnhfaxsqki.sys
qoigaysqli.exe
qoigbytqlj.sys
tolgeywqoj.exe
tomgeywroj.sys
xrpkhczusmkecxup.exe
xrpkhczusmkecxup.sys
xvqkfaysqk.exe
zwrpjhbztr.exe
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
suggestions[1].en-US
memory/1060-88-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1228-120-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1244-160-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1336-62-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1612-144-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1752-100-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2224-132-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2544-152-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2700-124-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2836-148-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3272-14-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3496-156-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3500-21-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3748-33-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3752-106-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4200-140-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4592-136-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4592-76-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4676-128-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4856-45-0x0000000000010000-0x00000000000AB000-memory.dmp