Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
30/07/2026, 15:38
General
- Target 2026-07-30_4925a390985c10644348d225e00025b5_amadey_darkgate_elex_smoke-loader_stop.exe
- Size 384KB
- Sample260730-s3dsaa1dlf
- SHA256 cb55f6cf362b88c548bdde1c616cf53a0eceeb8d912a550db42cc067b14d48d6
Score
10/10
Malware Config
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 35 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 60 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_4925a390985c10644348d225e00025b5_amadey_darkgate_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-30_4925a390985c10644348d225e00025b5_amadey_darkgate_elex_smoke-loader_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\ztrmjecwuomgezwr.exeC:\Temp\ztrmjecwuomgezwr.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ebwuomgeyw.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\ebwuomgeyw.exeC:\Temp\ebwuomgeyw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ebwuomgeyw.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ebwuomgeyw.exeC:\Temp\i_ebwuomgeyw.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qljeywqojg.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\qljeywqojg.exeC:\Temp\qljeywqojg.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qljeywqojg.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_qljeywqojg.exeC:\Temp\i_qljeywqojg.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lgeywqoigt.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\lgeywqoigt.exeC:\Temp\lgeywqoigt.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_lgeywqoigt.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_lgeywqoigt.exeC:\Temp\i_lgeywqoigt.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qnigaysqki.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\qnigaysqki.exeC:\Temp\qnigaysqki.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qnigaysqki.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_qnigaysqki.exeC:\Temp\i_qnigaysqki.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\avsnlfdxvp.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\avsnlfdxvp.exeC:\Temp\avsnlfdxvp.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_avsnlfdxvp.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_avsnlfdxvp.exeC:\Temp\i_avsnlfdxvp.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fausmkfcxu.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\fausmkfcxu.exeC:\Temp\fausmkfcxu.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fausmkfcxu.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_fausmkfcxu.exeC:\Temp\i_fausmkfcxu.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jhczusmhfz.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jhczusmhfz.exeC:\Temp\jhczusmhfz.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jhczusmhfz.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jhczusmhfz.exeC:\Temp\i_jhczusmhfz.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fzxrpjhczu.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\fzxrpjhczu.exeC:\Temp\fzxrpjhczu.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fzxrpjhczu.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_fzxrpjhczu.exeC:\Temp\i_fzxrpjhczu.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rmjebwuomg.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\rmjebwuomg.exeC:\Temp\rmjebwuomg.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rmjebwuomg.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_rmjebwuomg.exeC:\Temp\i_rmjebwuomg.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jeywqoigby.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jeywqoigby.exeC:\Temp\jeywqoigby.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jeywqoigby.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jeywqoigby.exeC:\Temp\i_jeywqoigby.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vqoigaytql.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\vqoigaytql.exeC:\Temp\vqoigaytql.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vqoigaytql.exe ups_ins3⤵
-
C:\Temp\i_vqoigaytql.exeC:\Temp\i_vqoigaytql.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qoidbvtnlg.exe ups_run3⤵
-
C:\Temp\qoidbvtnlg.exeC:\Temp\qoidbvtnlg.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qoidbvtnlg.exe ups_ins3⤵
-
C:\Temp\i_qoidbvtnlg.exeC:\Temp\i_qoidbvtnlg.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\aysqkicavs.exe ups_run3⤵
-
C:\Temp\aysqkicavs.exeC:\Temp\aysqkicavs.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_aysqkicavs.exe ups_ins3⤵
-
C:\Temp\i_aysqkicavs.exeC:\Temp\i_aysqkicavs.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nhfausmkfc.exe ups_run3⤵
-
C:\Temp\nhfausmkfc.exeC:\Temp\nhfausmkfc.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nhfausmkfc.exe ups_ins3⤵
-
C:\Temp\i_nhfausmkfc.exeC:\Temp\i_nhfausmkfc.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\usmkecwupm.exe ups_run3⤵
-
C:\Temp\usmkecwupm.exeC:\Temp\usmkecwupm.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_usmkecwupm.exe ups_ins3⤵
-
C:\Temp\i_usmkecwupm.exeC:\Temp\i_usmkecwupm.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rmkecxupnh.exe ups_run3⤵
-
C:\Temp\rmkecxupnh.exeC:\Temp\rmkecxupnh.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rmkecxupnh.exe ups_ins3⤵
-
C:\Temp\i_rmkecxupnh.exeC:\Temp\i_rmkecxupnh.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hbztrmjecw.exe ups_run3⤵
-
C:\Temp\hbztrmjecw.exeC:\Temp\hbztrmjecw.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hbztrmjecw.exe ups_ins3⤵
-
C:\Temp\i_hbztrmjecw.exeC:\Temp\i_hbztrmjecw.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wrojhbztrl.exe ups_run3⤵
-
C:\Temp\wrojhbztrl.exeC:\Temp\wrojhbztrl.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wrojhbztrl.exe ups_ins3⤵
-
C:\Temp\i_wrojhbztrl.exeC:\Temp\i_wrojhbztrl.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bwtolgeywq.exe ups_run3⤵
-
C:\Temp\bwtolgeywq.exeC:\Temp\bwtolgeywq.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bwtolgeywq.exe ups_ins3⤵
-
C:\Temp\i_bwtolgeywq.exeC:\Temp\i_bwtolgeywq.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2860 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Temp\ztrmjecwuomgezwr.sysC:\Temp\ztrmjecwuomgezwr.sys1⤵
- Executes dropped EXE
-
C:\Temp\jdbwtomgey.sysC:\Temp\jdbwtomgey.sys1⤵
- Executes dropped EXE
-
C:\Temp\tnlgdywqoi.sysC:\Temp\tnlgdywqoi.sys1⤵
- Executes dropped EXE
-
C:\Temp\aysqlidbvt.sysC:\Temp\aysqlidbvt.sys1⤵
- Executes dropped EXE
-
C:\Temp\ifaxsqkica.sysC:\Temp\ifaxsqkica.sys1⤵
- Executes dropped EXE
-
C:\Temp\vsnkxvpnhf.sysC:\Temp\vsnkxvpnhf.sys1⤵
- Executes dropped EXE
-
C:\Temp\fzxspkhcau.sysC:\Temp\fzxspkhcau.sys1⤵
- Executes dropped EXE
-
C:\Temp\pjhczurmke.sysC:\Temp\pjhczurmke.sys1⤵
- Executes dropped EXE
-
C:\Temp\zwrpjhbztr.sysC:\Temp\zwrpjhbztr.sys1⤵
- Executes dropped EXE
-
C:\Temp\rojgbztrlj.sysC:\Temp\rojgbztrlj.sys1⤵
- Executes dropped EXE
-
C:\Temp\ojgbytrljd.sysC:\Temp\ojgbytrljd.sys1⤵
- Executes dropped EXE
-
C:\Temp\bvtnlgdyvq.sysC:\Temp\bvtnlgdyvq.sys1⤵
-
C:\Temp\qkidavtnlf.sysC:\Temp\qkidavtnlf.sys1⤵
-
C:\Temp\ysnkfdxvpn.sysC:\Temp\ysnkfdxvpn.sys1⤵
-
C:\Temp\xsqkicxvpn.sysC:\Temp\xsqkicxvpn.sys1⤵
-
C:\Temp\cxupmhfzxr.sysC:\Temp\cxupmhfzxr.sys1⤵
-
C:\Temp\rmkecwuomh.sysC:\Temp\rmkecwuomh.sys1⤵
-
C:\Temp\hbwtomgeyw.sysC:\Temp\hbwtomgeyw.sys1⤵
-
C:\Temp\ebwuomgeyw.sysC:\Temp\ebwuomgeyw.sys1⤵
-
C:\Temp\gaytqljdbv.sysC:\Temp\gaytqljdbv.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CreateProcess.exe
avsnlfdxvp.exe
aysqlidbvt.sys
ebwuomgeyw.exe
fausmkfcxu.exe
fzxrpjhczu.exe
fzxspkhcau.sys
i_avsnlfdxvp.exe
i_ebwuomgeyw.exe
i_fausmkfcxu.exe
i_jhczusmhfz.exe
i_lgeywqoigt.exe
i_qljeywqojg.exe
i_qnigaysqki.exe
ifaxsqkica.sys
jdbwtomgey.sys
jhczusmhfz.exe
lgeywqoigt.exe
pjhczurmke.sys
qljeywqojg.exe
qnigaysqki.exe
tnlgdywqoi.sys
vsnkxvpnhf.sys
ztrmjecwuomgezwr.exe
ztrmjecwuomgezwr.sys
suggestions[1].en-US
memory/204-153-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/464-14-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/540-120-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1076-45-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1516-60-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1848-128-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1884-161-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2524-106-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2676-157-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3096-98-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3472-33-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3996-136-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4056-74-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4180-149-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4592-124-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4664-140-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4664-145-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4808-21-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4900-132-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5020-144-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5100-86-0x0000000000010000-0x00000000000AB000-memory.dmp