Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
30/07/2026, 17:38
General
- Target 2026-07-30_5cb53b07b7c2e6fc97a2c10b98ca9c09_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 361KB
- Sample260730-v74klsda86
- SHA256 77591b45744658c2f405ead9e12f9b49d4d1354ebc16527576d40b7416208441
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 29 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 60 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_5cb53b07b7c2e6fc97a2c10b98ca9c09_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-30_5cb53b07b7c2e6fc97a2c10b98ca9c09_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\geywrojgbztrljdb.exeC:\Temp\geywrojgbztrljdb.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ojhbztrlje.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\ojhbztrlje.exeC:\Temp\ojhbztrlje.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ojhbztrlje.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ojhbztrlje.exeC:\Temp\i_ojhbztrlje.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rljdbwtolg.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\rljdbwtolg.exeC:\Temp\rljdbwtolg.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rljdbwtolg.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_rljdbwtolg.exeC:\Temp\i_rljdbwtolg.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vtnlgdwqoi.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\vtnlgdwqoi.exeC:\Temp\vtnlgdwqoi.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vtnlgdwqoi.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_vtnlgdwqoi.exeC:\Temp\i_vtnlgdwqoi.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qkidavtnlf.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\qkidavtnlf.exeC:\Temp\qkidavtnlf.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qkidavtnlf.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_qkidavtnlf.exeC:\Temp\i_qkidavtnlf.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\aysqkicysq.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\aysqkicysq.exeC:\Temp\aysqkicysq.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_aysqkicysq.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_aysqkicysq.exeC:\Temp\i_aysqkicysq.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kfzxrpkhca.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\kfzxrpkhca.exeC:\Temp\kfzxrpkhca.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kfzxrpkhca.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_kfzxrpkhca.exeC:\Temp\i_kfzxrpkhca.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pjhczupmhf.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\pjhczupmhf.exeC:\Temp\pjhczupmhf.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pjhczupmhf.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_pjhczupmhf.exeC:\Temp\i_pjhczupmhf.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kecwupezwr.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\kecwupezwr.exeC:\Temp\kecwupezwr.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kecwupezwr.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_kecwupezwr.exeC:\Temp\i_kecwupezwr.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ztrmjecwuo.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ztrmjecwuo.exeC:\Temp\ztrmjecwuo.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ztrmjecwuo.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ztrmjecwuo.exeC:\Temp\i_ztrmjecwuo.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ojgbytrljd.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ojgbytrljd.exeC:\Temp\ojgbytrljd.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ojgbytrljd.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ojgbytrljd.exeC:\Temp\i_ojgbytrljd.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\aytqljdbvt.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\aytqljdbvt.exeC:\Temp\aytqljdbvt.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_aytqljdbvt.exe ups_ins3⤵
-
C:\Temp\i_aytqljdbvt.exeC:\Temp\i_aytqljdbvt.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dyvqoiysqk.exe ups_run3⤵
-
C:\Temp\dyvqoiysqk.exeC:\Temp\dyvqoiysqk.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dyvqoiysqk.exe ups_ins3⤵
-
C:\Temp\i_dyvqoiysqk.exeC:\Temp\i_dyvqoiysqk.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ysqkicavsn.exe ups_run3⤵
-
C:\Temp\ysqkicavsn.exeC:\Temp\ysqkicavsn.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ysqkicavsn.exe ups_ins3⤵
-
C:\Temp\i_ysqkicavsn.exeC:\Temp\i_ysqkicavsn.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kfdxvnkfcx.exe ups_run3⤵
-
C:\Temp\kfdxvnkfcx.exeC:\Temp\kfdxvnkfcx.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kfdxvnkfcx.exe ups_ins3⤵
-
C:\Temp\i_kfdxvnkfcx.exeC:\Temp\i_kfdxvnkfcx.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wupmhfzxrp.exe ups_run3⤵
-
C:\Temp\wupmhfzxrp.exeC:\Temp\wupmhfzxrp.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wupmhfzxrp.exe ups_ins3⤵
-
C:\Temp\i_wupmhfzxrp.exeC:\Temp\i_wupmhfzxrp.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\upmherpjhc.exe ups_run3⤵
-
C:\Temp\upmherpjhc.exeC:\Temp\upmherpjhc.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_upmherpjhc.exe ups_ins3⤵
-
C:\Temp\i_upmherpjhc.exeC:\Temp\i_upmherpjhc.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mjecwuomge.exe ups_run3⤵
-
C:\Temp\mjecwuomge.exeC:\Temp\mjecwuomge.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mjecwuomge.exe ups_ins3⤵
-
C:\Temp\i_mjecwuomge.exeC:\Temp\i_mjecwuomge.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bztrljebwt.exe ups_run3⤵
-
C:\Temp\bztrljebwt.exeC:\Temp\bztrljebwt.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bztrljebwt.exe ups_ins3⤵
-
C:\Temp\i_bztrljebwt.exeC:\Temp\i_bztrljebwt.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gbytolgdyw.exe ups_run3⤵
-
C:\Temp\gbytolgdyw.exeC:\Temp\gbytolgdyw.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gbytolgdyw.exe ups_ins3⤵
-
C:\Temp\i_gbytolgdyw.exeC:\Temp\i_gbytolgdyw.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4260 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Temp\geywrojgbztrljdb.sysC:\Temp\geywrojgbztrljdb.sys1⤵
- Executes dropped EXE
-
C:\Temp\ywqoigbytr.sysC:\Temp\ywqoigbytr.sys1⤵
- Executes dropped EXE
-
C:\Temp\ljdbvtnlgd.sysC:\Temp\ljdbvtnlgd.sys1⤵
- Executes dropped EXE
-
C:\Temp\bvqoigaysq.sysC:\Temp\bvqoigaysq.sys1⤵
- Executes dropped EXE
-
C:\Temp\lfdxvqnifa.sysC:\Temp\lfdxvqnifa.sys1⤵
- Executes dropped EXE
-
C:\Temp\spkicausmk.sysC:\Temp\spkicausmk.sys1⤵
- Executes dropped EXE
-
C:\Temp\hfzxspkica.sysC:\Temp\hfzxspkica.sys1⤵
- Executes dropped EXE
-
C:\Temp\rpjhczusmk.sysC:\Temp\rpjhczusmk.sys1⤵
- Executes dropped EXE
-
C:\Temp\hbztrljebw.sysC:\Temp\hbztrljebw.sys1⤵
- Executes dropped EXE
-
C:\Temp\bwqojgbztr.sysC:\Temp\bwqojgbztr.sys1⤵
- Executes dropped EXE
-
C:\Temp\tolgeywigb.sysC:\Temp\tolgeywigb.sys1⤵
- Executes dropped EXE
-
C:\Temp\idxvqnigay.sysC:\Temp\idxvqnigay.sys1⤵
-
C:\Temp\vpkicausnk.sysC:\Temp\vpkicausnk.sys1⤵
-
C:\Temp\pkicausmcx.sysC:\Temp\pkicausmcx.sys1⤵
-
C:\Temp\fzxrpkhczu.sysC:\Temp\fzxrpkhczu.sys1⤵
-
C:\Temp\xrpjhbzurm.sysC:\Temp\xrpjhbzurm.sys1⤵
-
C:\Temp\mgezwrojhb.sysC:\Temp\mgezwrojhb.sys1⤵
-
C:\Temp\dbwtomywqo.sysC:\Temp\dbwtomywqo.sys1⤵
-
C:\Temp\ojdbvtnlgd.sysC:\Temp\ojdbvtnlgd.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CreateProcess.exe
aysqkicysq.exe
bvqoigaysq.sys
geywrojgbztrljdb.exe
geywrojgbztrljdb.sys
hfzxspkica.sys
i_aysqkicysq.exe
i_kfzxrpkhca.exe
i_ojhbztrlje.exe
i_pjhczupmhf.exe
i_qkidavtnlf.exe
i_rljdbwtolg.exe
i_vtnlgdwqoi.exe
kecwupezwr.exe
kfzxrpkhca.exe
lfdxvqnifa.sys
ljdbvtnlgd.sys
ojhbztrlje.exe
pjhczupmhf.exe
qkidavtnlf.exe
rljdbwtolg.exe
rpjhczusmk.sys
spkicausmk.sys
vtnlgdwqoi.exe
ywqoigbytr.sys
suggestions[1].en-US
memory/1384-71-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1684-83-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1936-120-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2052-103-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2212-159-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2292-138-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2292-133-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2468-137-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2580-150-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2696-57-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3244-45-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3452-21-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3508-111-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3660-33-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3880-142-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4412-155-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4520-107-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4528-14-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4740-95-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4832-151-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4832-146-0x0000000000010000-0x00000000000AB000-memory.dmp