Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
24/07/2026, 17:40
General
- Target 2026-07-24_fe2eed5b5357b255c125f5f26e864d4a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 722KB
- Sample260724-v84a8stthy
- SHA256 56121c92e649607c92c0effaf8610f3181c3157a7a1a006894b2f88c1911875f
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 35 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 60 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-24_fe2eed5b5357b255c125f5f26e864d4a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-24_fe2eed5b5357b255c125f5f26e864d4a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\hfzxrpjhczusmkec.exeC:\Temp\hfzxrpjhczusmkec.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rmkecwuomh.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\rmkecwuomh.exeC:\Temp\rmkecwuomh.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rmkecwuomh.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_rmkecwuomh.exeC:\Temp\i_rmkecwuomh.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rojhbztrlj.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\rojhbztrlj.exeC:\Temp\rojhbztrlj.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rojhbztrlj.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_rojhbztrlj.exeC:\Temp\i_rojhbztrlj.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\eywrojhbzt.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\eywrojhbzt.exeC:\Temp\eywrojhbzt.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_eywrojhbzt.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_eywrojhbzt.exeC:\Temp\i_eywrojhbzt.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ywqoigbytq.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ywqoigbytq.exeC:\Temp\ywqoigbytq.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ywqoigbytq.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ywqoigbytq.exeC:\Temp\i_ywqoigbytq.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dbvtnlgdyv.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\dbvtnlgdyv.exeC:\Temp\dbvtnlgdyv.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dbvtnlgdyv.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_dbvtnlgdyv.exeC:\Temp\i_dbvtnlgdyv.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fdxvqnigay.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\fdxvqnigay.exeC:\Temp\fdxvqnigay.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fdxvqnigay.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_fdxvqnigay.exeC:\Temp\i_fdxvqnigay.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nhfaxsnkxv.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\nhfaxsnkxv.exeC:\Temp\nhfaxsnkxv.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nhfaxsnkxv.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_nhfaxsnkxv.exeC:\Temp\i_nhfaxsnkxv.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\upnhfzxspk.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\upnhfzxspk.exeC:\Temp\upnhfzxspk.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_upnhfzxspk.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_upnhfzxspk.exeC:\Temp\i_upnhfzxspk.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\czusmkecxu.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\czusmkecxu.exeC:\Temp\czusmkecxu.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_czusmkecxu.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_czusmkecxu.exeC:\Temp\i_czusmkecxu.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rpjhbztrmj.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\rpjhbztrmj.exeC:\Temp\rpjhbztrmj.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rpjhbztrmj.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_rpjhbztrmj.exeC:\Temp\i_rpjhbztrmj.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mgerojgbzt.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\mgerojgbzt.exeC:\Temp\mgerojgbzt.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mgerojgbzt.exe ups_ins3⤵
-
C:\Temp\i_mgerojgbzt.exeC:\Temp\i_mgerojgbzt.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dbvtolgeyw.exe ups_run3⤵
-
C:\Temp\dbvtolgeyw.exeC:\Temp\dbvtolgeyw.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dbvtolgeyw.exe ups_ins3⤵
-
C:\Temp\i_dbvtolgeyw.exeC:\Temp\i_dbvtolgeyw.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\tnlgdywqoi.exe ups_run3⤵
-
C:\Temp\tnlgdywqoi.exeC:\Temp\tnlgdywqoi.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_tnlgdywqoi.exe ups_ins3⤵
-
C:\Temp\i_tnlgdywqoi.exeC:\Temp\i_tnlgdywqoi.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lfdyvqniga.exe ups_run3⤵
-
C:\Temp\lfdyvqniga.exeC:\Temp\lfdyvqniga.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_lfdyvqniga.exe ups_ins3⤵
-
C:\Temp\i_lfdyvqniga.exeC:\Temp\i_lfdyvqniga.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ifaqkicaus.exe ups_run3⤵
-
C:\Temp\ifaqkicaus.exeC:\Temp\ifaqkicaus.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ifaqkicaus.exe ups_ins3⤵
-
C:\Temp\i_ifaqkicaus.exeC:\Temp\i_ifaqkicaus.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xvpnhfaxsq.exe ups_run3⤵
-
C:\Temp\xvpnhfaxsq.exeC:\Temp\xvpnhfaxsq.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xvpnhfaxsq.exe ups_ins3⤵
-
C:\Temp\i_xvpnhfaxsq.exeC:\Temp\i_xvpnhfaxsq.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pnhfzxrpkh.exe ups_run3⤵
-
C:\Temp\pnhfzxrpkh.exeC:\Temp\pnhfzxrpkh.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pnhfzxrpkh.exe ups_ins3⤵
-
C:\Temp\i_pnhfzxrpkh.exeC:\Temp\i_pnhfzxrpkh.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bwuomhcwuo.exe ups_run3⤵
-
C:\Temp\bwuomhcwuo.exeC:\Temp\bwuomhcwuo.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bwuomhcwuo.exe ups_ins3⤵
-
C:\Temp\i_bwuomhcwuo.exeC:\Temp\i_bwuomhcwuo.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zwjhbztrmj.exe ups_run3⤵
-
C:\Temp\zwjhbztrmj.exeC:\Temp\zwjhbztrmj.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zwjhbztrmj.exe ups_ins3⤵
-
C:\Temp\i_zwjhbztrmj.exeC:\Temp\i_zwjhbztrmj.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2216 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Temp\hfzxrpjhczusmkec.sysC:\Temp\hfzxrpjhczusmkec.sys1⤵
- Executes dropped EXE
-
C:\Temp\okecwuomhe.sysC:\Temp\okecwuomhe.sys1⤵
- Executes dropped EXE
-
C:\Temp\mgeywqojgb.sysC:\Temp\mgeywqojgb.sys1⤵
- Executes dropped EXE
-
C:\Temp\jdbvtolgey.sysC:\Temp\jdbvtolgey.sys1⤵
- Executes dropped EXE
-
C:\Temp\oigaysqlid.sysC:\Temp\oigaysqlid.sys1⤵
- Executes dropped EXE
-
C:\Temp\ysqkidavtn.sysC:\Temp\ysqkidavtn.sys1⤵
- Executes dropped EXE
-
C:\Temp\vsnkfdxvpn.sysC:\Temp\vsnkfdxvpn.sys1⤵
- Executes dropped EXE
-
C:\Temp\causmkfcxv.sysC:\Temp\causmkfcxv.sys1⤵
- Executes dropped EXE
-
C:\Temp\khcausmkec.sysC:\Temp\khcausmkec.sys1⤵
- Executes dropped EXE
-
C:\Temp\jhczusecwu.sysC:\Temp\jhczusecwu.sys1⤵
- Executes dropped EXE
-
C:\Temp\trmjecwuom.sysC:\Temp\trmjecwuom.sys1⤵
- Executes dropped EXE
-
C:\Temp\ojgbytrljd.sysC:\Temp\ojgbytrljd.sys1⤵
-
C:\Temp\bvtnlfdyvq.sysC:\Temp\bvtnlfdyvq.sys1⤵
-
C:\Temp\avtnlxvqni.sysC:\Temp\avtnlxvqni.sys1⤵
-
C:\Temp\snlfdxvqni.sysC:\Temp\snlfdxvqni.sys1⤵
-
C:\Temp\icxvpnhfzx.sysC:\Temp\icxvpnhfzx.sys1⤵
-
C:\Temp\zusmkecxup.sysC:\Temp\zusmkecxup.sys1⤵
-
C:\Temp\upmhfrpjhc.sysC:\Temp\upmhfrpjhc.sys1⤵
-
C:\Temp\jecwuomgez.sysC:\Temp\jecwuomgez.sys1⤵
-
C:\Temp\ywqojgbztr.sysC:\Temp\ywqojgbztr.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CreateProcess.exe
causmkfcxv.sys
dbvtnlgdyv.exe
eywrojhbzt.exe
fdxvqnigay.exe
hfzxrpjhczusmkec.exe
hfzxrpjhczusmkec.sys
i_dbvtnlgdyv.exe
i_eywrojhbzt.exe
i_fdxvqnigay.exe
i_nhfaxsnkxv.exe
i_rmkecwuomh.exe
i_rojhbztrlj.exe
i_ywqoigbytq.exe
jdbvtolgey.sys
mgeywqojgb.sys
nhfaxsnkxv.exe
oigaysqlid.sys
okecwuomhe.sys
rmkecwuomh.exe
rojhbztrlj.exe
upnhfzxspk.exe
vsnkfdxvpn.sys
ysqkidavtn.sys
ywqoigbytq.exe
suggestions[1].en-US
memory/456-136-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/456-142-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1424-21-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2268-89-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2276-128-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2548-74-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2636-14-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2728-33-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2752-101-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2756-109-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3440-145-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3616-140-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3840-153-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4228-157-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4328-120-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4444-132-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4464-124-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4836-59-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4848-45-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4856-161-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5084-149-0x0000000000010000-0x00000000000AB000-memory.dmp