Analysis
- max time kernel
149s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
02/08/2026, 17:05
General
- Target 2026-08-02_b8d87598907ed6a4ef4b34288c06a055_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
- Size 291KB
- Sample260802-vmcldstsgz
- SHA256 e274565d918d288859ec5df432111c41e8f83f1eaa47f03d74cc36d6db4f4157
Malware Config
Extracted
-
systex
-
http://xytets.com:2345/t.asp?os=wangba8102
-
http://xytets.com:2345/ll/out.txt
-
http://xytets.com:2345/t.asp?os=home8102
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- UPX dump on OEP (original entry point) 64 IoCs
- Executes dropped EXE 64 IoCs
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- System Location Discovery: System Language Discovery 1 TTPs 43 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 52 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 19 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SetWindowsHookEx 10 IoCs
- Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_b8d87598907ed6a4ef4b34288c06a055_coinminer_elex_redline-stealer_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_b8d87598907ed6a4ef4b34288c06a055_coinminer_elex_redline-stealer_rhadamanthys_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home81022⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5100 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4888 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\trmgbwuomg.exe ups_run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\trmgbwuomg.exeC:\Temp\trmgbwuomg.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_trmgbwuomg.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_trmgbwuomg.exeC:\Temp\i_trmgbwuomg.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\trljdbwtom.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\trljdbwtom.exeC:\Temp\trljdbwtom.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_trljdbwtom.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_trljdbwtom.exeC:\Temp\i_trljdbwtom.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\lgeywqoidy.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\lgeywqoidy.exeC:\Temp\lgeywqoidy.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_lgeywqoidy.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_lgeywqoidy.exeC:\Temp\i_lgeywqoidy.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\idbvtnlfdy.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\idbvtnlfdy.exeC:\Temp\idbvtnlfdy.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_idbvtnlfdy.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_idbvtnlfdy.exeC:\Temp\i_idbvtnlfdy.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ifaysqkica.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\ifaysqkica.exeC:\Temp\ifaysqkica.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ifaysqkica.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_ifaysqkica.exeC:\Temp\i_ifaysqkica.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\snkfdxvpnh.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\snkfdxvpnh.exeC:\Temp\snkfdxvpnh.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_snkfdxvpnh.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_snkfdxvpnh.exeC:\Temp\i_snkfdxvpnh.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\causmkecxu.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\causmkecxu.exeC:\Temp\causmkecxu.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_causmkecxu.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_causmkecxu.exeC:\Temp\i_causmkecxu.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\fzxrphezus.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\fzxrphezus.exeC:\Temp\fzxrphezus.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_fzxrphezus.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_fzxrphezus.exeC:\Temp\i_fzxrphezus.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\jhbztrljeb.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\jhbztrljeb.exeC:\Temp\jhbztrljeb.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_jhbztrljeb.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_jhbztrljeb.exeC:\Temp\i_jhbztrljeb.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\trljebwuom.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\trljebwuom.exeC:\Temp\trljebwuom.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_trljebwuom.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_trljebwuom.exeC:\Temp\i_trljebwuom.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\rljdbwtomg.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\rljdbwtomg.exeC:\Temp\rljdbwtomg.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_rljdbwtomg.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_rljdbwtomg.exeC:\Temp\i_rljdbwtomg.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ytqlidbvtn.exe ups_run2⤵
-
C:\Temp\ytqlidbvtn.exeC:\Temp\ytqlidbvtn.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ytqlidbvtn.exe ups_ins2⤵
-
C:\Temp\i_ytqlidbvtn.exeC:\Temp\i_ytqlidbvtn.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\kidavsnlfd.exe ups_run2⤵
-
C:\Temp\kidavsnlfd.exeC:\Temp\kidavsnlfd.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_kidavsnlfd.exe ups_ins2⤵
-
C:\Temp\i_kidavsnlfd.exeC:\Temp\i_kidavsnlfd.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\xvpnhfausn.exe ups_run2⤵
-
C:\Temp\xvpnhfausn.exeC:\Temp\xvpnhfausn.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_xvpnhfausn.exe ups_ins2⤵
-
C:\Temp\i_xvpnhfausn.exeC:\Temp\i_xvpnhfausn.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\vpnhfaxsqk.exe ups_run2⤵
-
C:\Temp\vpnhfaxsqk.exeC:\Temp\vpnhfaxsqk.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_vpnhfaxsqk.exe ups_ins2⤵
-
C:\Temp\i_vpnhfaxsqk.exeC:\Temp\i_vpnhfaxsqk.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ecwupmhfzx.exe ups_run2⤵
-
C:\Temp\ecwupmhfzx.exeC:\Temp\ecwupmhfzx.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ecwupmhfzx.exe ups_ins2⤵
-
C:\Temp\i_ecwupmhfzx.exeC:\Temp\i_ecwupmhfzx.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\urmkecwuom.exe ups_run2⤵
-
C:\Temp\urmkecwuom.exeC:\Temp\urmkecwuom.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_urmkecwuom.exe ups_ins2⤵
-
C:\Temp\i_urmkecwuom.exeC:\Temp\i_urmkecwuom.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ztrljdbwto.exe ups_run2⤵
-
C:\Temp\ztrljdbwto.exeC:\Temp\ztrljdbwto.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ztrljdbwto.exe ups_ins2⤵
-
C:\Temp\i_ztrljdbwto.exeC:\Temp\i_ztrljdbwto.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\trljebwtom.exe ups_run2⤵
-
C:\Temp\trljebwtom.exeC:\Temp\trljebwtom.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_trljebwtom.exe ups_ins2⤵
-
C:\Temp\i_trljebwtom.exeC:\Temp\i_trljebwtom.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\jdbvtolgey.exe ups_run2⤵
-
C:\Temp\jdbvtolgey.exeC:\Temp\jdbvtolgey.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\Temp\jebwuomgey.sysC:\Temp\jebwuomgey.sys1⤵
- Executes dropped EXE
-
C:\Temp\wqoigbytrl.sysC:\Temp\wqoigbytrl.sys1⤵
- Executes dropped EXE
-
C:\Temp\tnigaysqli.sysC:\Temp\tnigaysqli.sys1⤵
- Executes dropped EXE
-
C:\Temp\aysidavtnl.sysC:\Temp\aysidavtnl.sys1⤵
- Executes dropped EXE
-
C:\Temp\lfdxvpnifa.sysC:\Temp\lfdxvpnifa.sys1⤵
- Executes dropped EXE
-
C:\Temp\pkecxupnhf.sysC:\Temp\pkecxupnhf.sys1⤵
- Executes dropped EXE
-
C:\Temp\pjhczusmke.sysC:\Temp\pjhczusmke.sys1⤵
- Executes dropped EXE
-
C:\Temp\xrpjhbzurm.sysC:\Temp\xrpjhbzurm.sys1⤵
- Executes dropped EXE
-
C:\Temp\mgeywrojhb.sysC:\Temp\mgeywrojhb.sys1⤵
- Executes dropped EXE
-
C:\Temp\ywqojgbytr.sysC:\Temp\ywqojgbytr.sys1⤵
- Executes dropped EXE
-
C:\Temp\jdbvtolgdy.sysC:\Temp\jdbvtolgdy.sys1⤵
-
C:\Temp\vtnlfdyvqn.sysC:\Temp\vtnlfdyvqn.sys1⤵
-
C:\Temp\tnifaysqki.sysC:\Temp\tnifaysqki.sys1⤵
-
C:\Temp\causmkfcxv.sysC:\Temp\causmkfcxv.sys1⤵
-
C:\Temp\pnhfzxrpkh.sysC:\Temp\pnhfzxrpkh.sys1⤵
-
C:\Temp\ezwrpjhbzt.sysC:\Temp\ezwrpjhbzt.sys1⤵
-
C:\Temp\rpjhbzurmj.sysC:\Temp\rpjhbzurmj.sys1⤵
-
C:\Temp\ebwtomgeyw.sysC:\Temp\ebwtomgeyw.sys1⤵
-
C:\Temp\qljdbvtnlg.sysC:\Temp\qljdbvtnlg.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CP.exe
aysidavtnl.sys
causmkecxu.exe
i_causmkecxu.exe
i_idbvtnlfdy.exe
i_ifaysqkica.exe
i_lgeywqoidy.exe
i_snkfdxvpnh.exe
i_trljdbwtom.exe
i_trmgbwuomg.exe
idbvtnlfdy.exe
ifaysqkica.exe
jebwuomgey.sys
lfdxvpnifa.sys
lgeywqoidy.exe
pjhczusmke.sys
pkecxupnhf.sys
snkfdxvpnh.exe
tnigaysqli.sys
trljdbwtom.exe
trmgbwuomg.exe
wqoigbytrl.sys
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
RecoveryStore.{703C433F-8E94-11F1-92B0-7262BE72A49B}.dat
RecoveryStore.{703EA53F-8E94-11F1-92B0-7262BE72A49B}.dat
suggestions[1].en-US
memory/116-222-0x00000000001E0000-0x000000000022B000-memory.dmp
memory/116-224-0x00000000001E0000-0x000000000022B000-memory.dmp
memory/316-78-0x0000000000430000-0x000000000047B000-memory.dmp
memory/316-65-0x0000000000430000-0x000000000047B000-memory.dmp
memory/456-225-0x0000000000010000-0x0000000000083000-memory.dmp
memory/548-231-0x0000000000F90000-0x0000000000FDB000-memory.dmp
memory/548-233-0x0000000000F90000-0x0000000000FDB000-memory.dmp
memory/628-12-0x0000000000FE0000-0x000000000102B000-memory.dmp
memory/628-10-0x0000000000FE0000-0x000000000102B000-memory.dmp
memory/804-45-0x0000000000040000-0x000000000008B000-memory.dmp
memory/804-43-0x0000000000040000-0x000000000008B000-memory.dmp
memory/892-54-0x0000000000010000-0x0000000000083000-memory.dmp
memory/964-178-0x00000000007E0000-0x000000000082B000-memory.dmp
memory/964-179-0x00000000007E0000-0x000000000082B000-memory.dmp
memory/1208-130-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1224-187-0x0000000000C60000-0x0000000000CAB000-memory.dmp
memory/1224-186-0x0000000000C60000-0x0000000000CAB000-memory.dmp
memory/1620-38-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1792-80-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1812-29-0x0000000000B60000-0x0000000000BAB000-memory.dmp
memory/1812-27-0x0000000000B60000-0x0000000000BAB000-memory.dmp
memory/1928-17-0x0000000000080000-0x00000000000CB000-memory.dmp
memory/1928-19-0x0000000000080000-0x00000000000CB000-memory.dmp
memory/2084-98-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2136-196-0x0000000000D80000-0x0000000000DCB000-memory.dmp
memory/2136-195-0x0000000000D80000-0x0000000000DCB000-memory.dmp
memory/2156-203-0x0000000000E60000-0x0000000000EAB000-memory.dmp
memory/2156-204-0x0000000000E60000-0x0000000000EAB000-memory.dmp
memory/2428-119-0x0000000000290000-0x00000000002DB000-memory.dmp
memory/2428-121-0x0000000000290000-0x00000000002DB000-memory.dmp
memory/2480-201-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2752-175-0x0000000000BB0000-0x0000000000BFB000-memory.dmp
memory/2752-173-0x0000000000BB0000-0x0000000000BFB000-memory.dmp
memory/2796-136-0x00000000008D0000-0x000000000091B000-memory.dmp
memory/2796-138-0x00000000008D0000-0x000000000091B000-memory.dmp
memory/2972-22-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3228-192-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3448-149-0x0000000000200000-0x000000000024B000-memory.dmp
memory/3448-150-0x0000000000200000-0x000000000024B000-memory.dmp
memory/3724-229-0x0000000000920000-0x000000000096B000-memory.dmp
memory/3724-228-0x0000000000920000-0x000000000096B000-memory.dmp
memory/3752-134-0x0000000000120000-0x000000000016B000-memory.dmp
memory/3752-133-0x0000000000120000-0x000000000016B000-memory.dmp
memory/3880-189-0x0000000000210000-0x000000000025B000-memory.dmp
memory/3880-191-0x0000000000210000-0x000000000025B000-memory.dmp
memory/3908-103-0x0000000000AD0000-0x0000000000B1B000-memory.dmp
memory/3908-105-0x0000000000AD0000-0x0000000000B1B000-memory.dmp
memory/3972-237-0x0000000000170000-0x00000000001BB000-memory.dmp
memory/3972-236-0x0000000000170000-0x00000000001BB000-memory.dmp
memory/4176-165-0x0000000000730000-0x000000000077B000-memory.dmp
memory/4176-167-0x0000000000730000-0x000000000077B000-memory.dmp
memory/4216-220-0x00000000004C0000-0x000000000050B000-memory.dmp
memory/4216-219-0x00000000004C0000-0x000000000050B000-memory.dmp
memory/4300-112-0x0000000000850000-0x000000000089B000-memory.dmp
memory/4300-109-0x0000000000850000-0x000000000089B000-memory.dmp
memory/4580-94-0x00000000001B0000-0x00000000001FB000-memory.dmp
memory/4580-96-0x00000000001B0000-0x00000000001FB000-memory.dmp
memory/4604-206-0x0000000000420000-0x000000000046B000-memory.dmp
memory/4604-208-0x0000000000420000-0x000000000046B000-memory.dmp
memory/4616-226-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4616-217-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4628-176-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4824-89-0x0000000000260000-0x00000000002AB000-memory.dmp
memory/4824-88-0x0000000000260000-0x00000000002AB000-memory.dmp
memory/4836-147-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4996-168-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5008-234-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5068-214-0x0000000000700000-0x000000000074B000-memory.dmp
memory/5068-216-0x0000000000700000-0x000000000074B000-memory.dmp
memory/5224-144-0x0000000000BA0000-0x0000000000BEB000-memory.dmp
memory/5224-146-0x0000000000BA0000-0x0000000000BEB000-memory.dmp
memory/5240-114-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5244-58-0x00000000005B0000-0x00000000005FB000-memory.dmp
memory/5244-61-0x00000000005B0000-0x00000000005FB000-memory.dmp
memory/5356-141-0x0000000000A50000-0x0000000000A9B000-memory.dmp
memory/5356-142-0x0000000000A50000-0x0000000000A9B000-memory.dmp
memory/5404-211-0x0000000000AB0000-0x0000000000AFB000-memory.dmp
memory/5404-212-0x0000000000AB0000-0x0000000000AFB000-memory.dmp
memory/5508-49-0x00000000000F0000-0x000000000013B000-memory.dmp
memory/5508-52-0x00000000000F0000-0x000000000013B000-memory.dmp
memory/5616-200-0x0000000000130000-0x000000000017B000-memory.dmp
memory/5616-198-0x0000000000130000-0x000000000017B000-memory.dmp
memory/5640-170-0x0000000000E60000-0x0000000000EAB000-memory.dmp
memory/5640-171-0x0000000000E60000-0x0000000000EAB000-memory.dmp
memory/5652-139-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5656-193-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5656-184-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5692-183-0x0000000000410000-0x000000000045B000-memory.dmp
memory/5692-181-0x0000000000410000-0x000000000045B000-memory.dmp
memory/5700-0-0x0000000000A00000-0x0000000000A4B000-memory.dmp
memory/5700-20-0x0000000000A00000-0x0000000000A4B000-memory.dmp
memory/5812-128-0x0000000000520000-0x000000000056B000-memory.dmp
memory/5812-125-0x0000000000520000-0x000000000056B000-memory.dmp
memory/5836-209-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5924-36-0x00000000001D0000-0x000000000021B000-memory.dmp
memory/5924-33-0x00000000001D0000-0x000000000021B000-memory.dmp