Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
02/08/2026, 03:34
General
- Target 2026-08-02_153ad271ffc7e43c47f0071dd634aedf_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 361KB
- Sample260802-d449asce95
- SHA256 94908dd2c6fff13ce302aa5f41c152938c209613cbae877357262743c3cc9ba0
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 25 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 60 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_153ad271ffc7e43c47f0071dd634aedf_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_153ad271ffc7e43c47f0071dd634aedf_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\xupmhfzxrpkhczus.exeC:\Temp\xupmhfzxrpkhczus.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zusmkecwup.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\zusmkecwup.exeC:\Temp\zusmkecwup.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zusmkecwup.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_zusmkecwup.exeC:\Temp\i_zusmkecwup.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ezxrpjhbzu.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ezxrpjhbzu.exeC:\Temp\ezxrpjhbzu.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ezxrpjhbzu.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ezxrpjhbzu.exeC:\Temp\i_ezxrpjhbzu.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gezwrjebwu.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\gezwrjebwu.exeC:\Temp\gezwrjebwu.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gezwrjebwu.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_gezwrjebwu.exeC:\Temp\i_gezwrjebwu.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\oigbytqljd.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\oigbytqljd.exeC:\Temp\oigbytqljd.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_oigbytqljd.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_oigbytqljd.exeC:\Temp\i_oigbytqljd.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vtnldavtnl.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\vtnldavtnl.exeC:\Temp\vtnldavtnl.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vtnldavtnl.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_vtnldavtnl.exeC:\Temp\i_vtnldavtnl.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qlfdyvqoig.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\qlfdyvqoig.exeC:\Temp\qlfdyvqoig.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qlfdyvqoig.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_qlfdyvqoig.exeC:\Temp\i_qlfdyvqoig.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ausnifaysq.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ausnifaysq.exeC:\Temp\ausnifaysq.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ausnifaysq.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ausnifaysq.exeC:\Temp\i_ausnifaysq.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kfcxvpnhfa.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\kfcxvpnhfa.exeC:\Temp\kfcxvpnhfa.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kfcxvpnhfa.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_kfcxvpnhfa.exeC:\Temp\i_kfcxvpnhfa.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\upkecwupmh.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\upkecwupmh.exeC:\Temp\upkecwupmh.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_upkecwupmh.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_upkecwupmh.exeC:\Temp\i_upkecwupmh.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jhczurmkec.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jhczurmkec.exeC:\Temp\jhczurmkec.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jhczurmkec.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jhczurmkec.exeC:\Temp\i_jhczurmkec.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ztrmgbztrl.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ztrmgbztrl.exeC:\Temp\ztrmgbztrl.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ztrmgbztrl.exe ups_ins3⤵
-
C:\Temp\i_ztrmgbztrl.exeC:\Temp\i_ztrmgbztrl.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\olgeywqojg.exe ups_run3⤵
-
C:\Temp\olgeywqojg.exeC:\Temp\olgeywqojg.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_olgeywqojg.exe ups_ins3⤵
-
C:\Temp\i_olgeywqojg.exeC:\Temp\i_olgeywqojg.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dywqoigayt.exe ups_run3⤵
-
C:\Temp\dywqoigayt.exeC:\Temp\dywqoigayt.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dywqoigayt.exe ups_ins3⤵
-
C:\Temp\i_dywqoigayt.exeC:\Temp\i_dywqoigayt.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fdyvqoigay.exe ups_run3⤵
-
C:\Temp\fdyvqoigay.exeC:\Temp\fdyvqoigay.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fdyvqoigay.exe ups_ins3⤵
-
C:\Temp\i_fdyvqoigay.exeC:\Temp\i_fdyvqoigay.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ysqkidavtn.exe ups_run3⤵
-
C:\Temp\ysqkidavtn.exeC:\Temp\ysqkidavtn.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ysqkidavtn.exe ups_ins3⤵
-
C:\Temp\i_ysqkidavtn.exeC:\Temp\i_ysqkidavtn.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kfaxspkica.exe ups_run3⤵
-
C:\Temp\kfaxspkica.exeC:\Temp\kfaxspkica.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kfaxspkica.exe ups_ins3⤵
-
C:\Temp\i_kfaxspkica.exeC:\Temp\i_kfaxspkica.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\causmkfcxu.exe ups_run3⤵
-
C:\Temp\causmkfcxu.exeC:\Temp\causmkfcxu.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_causmkfcxu.exe ups_ins3⤵
-
C:\Temp\i_causmkfcxu.exeC:\Temp\i_causmkfcxu.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zurmkecwup.exe ups_run3⤵
-
C:\Temp\zurmkecwup.exeC:\Temp\zurmkecwup.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zurmkecwup.exe ups_ins3⤵
-
C:\Temp\i_zurmkecwup.exeC:\Temp\i_zurmkecwup.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\uomhezwrpj.exe ups_run3⤵
-
C:\Temp\uomhezwrpj.exeC:\Temp\uomhezwrpj.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_uomhezwrpj.exe ups_ins3⤵
-
C:\Temp\i_uomhezwrpj.exeC:\Temp\i_uomhezwrpj.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2052 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Temp\xupmhfzxrpkhczus.sysC:\Temp\xupmhfzxrpkhczus.sys1⤵
- Executes dropped EXE
-
C:\Temp\mjecwuomge.sysC:\Temp\mjecwuomge.sys1⤵
- Executes dropped EXE
-
C:\Temp\rljebwuomg.sysC:\Temp\rljebwuomg.sys1⤵
- Executes dropped EXE
-
C:\Temp\vtolgeywqo.sysC:\Temp\vtolgeywqo.sys1⤵
- Executes dropped EXE
-
C:\Temp\oigbytrljd.sysC:\Temp\oigbytrljd.sys1⤵
- Executes dropped EXE
-
C:\Temp\ysqkidavtn.sysC:\Temp\ysqkidavtn.sys1⤵
- Executes dropped EXE
-
C:\Temp\ifaysqkica.sysC:\Temp\ifaysqkica.sys1⤵
- Executes dropped EXE
-
C:\Temp\spkicausmk.sysC:\Temp\spkicausmk.sys1⤵
- Executes dropped EXE
-
C:\Temp\kecxupnhfz.sysC:\Temp\kecxupnhfz.sys1⤵
- Executes dropped EXE
-
C:\Temp\urmkecwupm.sysC:\Temp\urmkecwupm.sys1⤵
- Executes dropped EXE
-
C:\Temp\gezwrpjhbz.sysC:\Temp\gezwrpjhbz.sys1⤵
- Executes dropped EXE
-
C:\Temp\ztrljdbwto.sysC:\Temp\ztrljdbwto.sys1⤵
-
C:\Temp\wqojgbztrl.sysC:\Temp\wqojgbztrl.sys1⤵
-
C:\Temp\qljdbvtnlg.sysC:\Temp\qljdbvtnlg.sys1⤵
-
C:\Temp\idavtnlfdy.sysC:\Temp\idavtnlfdy.sys1⤵
-
C:\Temp\sqkicavsnk.sysC:\Temp\sqkicavsnk.sys1⤵
-
C:\Temp\vpkhcausmk.sysC:\Temp\vpkhcausmk.sys1⤵
-
C:\Temp\hfzxrpjhcz.sysC:\Temp\hfzxrpjhcz.sys1⤵
-
C:\Temp\bztrmjecwu.sysC:\Temp\bztrmjecwu.sys1⤵
-
C:\Temp\rojgbztrlj.sysC:\Temp\rojgbztrlj.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CreateProcess.exe
ausnifaysq.exe
ezxrpjhbzu.exe
gezwrjebwu.exe
i_ausnifaysq.exe
i_ezxrpjhbzu.exe
i_gezwrjebwu.exe
i_oigbytqljd.exe
i_qlfdyvqoig.exe
i_vtnldavtnl.exe
i_zusmkecwup.exe
ifaysqkica.sys
kfcxvpnhfa.exe
mjecwuomge.sys
oigbytqljd.exe
oigbytrljd.sys
qlfdyvqoig.exe
rljebwuomg.sys
spkicausmk.sys
vtnldavtnl.exe
vtolgeywqo.sys
xupmhfzxrpkhczus.exe
xupmhfzxrpkhczus.sys
ysqkidavtn.sys
zusmkecwup.exe
suggestions[1].en-US
memory/8-26-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/632-19-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/708-89-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/820-158-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1140-166-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1192-132-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1232-117-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1560-128-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1752-109-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1780-136-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1804-150-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2068-124-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2328-162-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2460-77-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2500-101-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3012-50-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3408-51-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3408-38-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3412-113-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4316-63-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5016-154-0x0000000000010000-0x00000000000AB000-memory.dmp