Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
02/08/2026, 18:12
General
- Target 2026-08-02_6b7751ad4afefbe08b06f2eeafef8acc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 722KB
- Sample260802-wth77adh33
- SHA256 613505b6c38b3a0b753f75896fabd3cf0b1b41f83383cab6f6a680c843586c4f
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 25 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 19 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 60 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_6b7751ad4afefbe08b06f2eeafef8acc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_6b7751ad4afefbe08b06f2eeafef8acc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\usmkecxupnhfzxrp.exeC:\Temp\usmkecxupnhfzxrp.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zxspkhcaus.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\zxspkhcaus.exeC:\Temp\zxspkhcaus.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zxspkhcaus.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_zxspkhcaus.exeC:\Temp\i_zxspkhcaus.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hbzrpkezxr.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\hbzrpkezxr.exeC:\Temp\hbzrpkezxr.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hbzrpkezxr.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_hbzrpkezxr.exeC:\Temp\i_hbzrpkezxr.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wtomgeywrp.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\wtomgeywrp.exeC:\Temp\wtomgeywrp.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wtomgeywrp.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_wtomgeywrp.exeC:\Temp\i_wtomgeywrp.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vtolgeywqo.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\vtolgeywqo.exeC:\Temp\vtolgeywqo.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vtolgeywqo.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_vtolgeywqo.exeC:\Temp\i_vtolgeywqo.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\aytqljdbvt.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\aytqljdbvt.exeC:\Temp\aytqljdbvt.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_aytqljdbvt.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_aytqljdbvt.exeC:\Temp\i_aytqljdbvt.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\avtnlgdyvq.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\avtnlgdyvq.exeC:\Temp\avtnlgdyvq.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_avtnlgdyvq.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_avtnlgdyvq.exeC:\Temp\i_avtnlgdyvq.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\aysqkicavs.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\aysqkicavs.exeC:\Temp\aysqkicavs.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_aysqkicavs.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_aysqkicavs.exeC:\Temp\i_aysqkicavs.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\faxsqkicau.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\faxsqkicau.exeC:\Temp\faxsqkicau.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_faxsqkicau.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_faxsqkicau.exeC:\Temp\i_faxsqkicau.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kfcxmhfzxr.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\kfcxmhfzxr.exeC:\Temp\kfcxmhfzxr.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kfcxmhfzxr.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_kfcxmhfzxr.exeC:\Temp\i_kfcxmhfzxr.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rmkecwupmh.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\rmkecwupmh.exeC:\Temp\rmkecwupmh.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rmkecwupmh.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_rmkecwupmh.exeC:\Temp\i_rmkecwupmh.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ztomgeywro.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ztomgeywro.exeC:\Temp\ztomgeywro.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ztomgeywro.exe ups_ins3⤵
-
C:\Temp\i_ztomgeywro.exeC:\Temp\i_ztomgeywro.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gbztrljdbw.exe ups_run3⤵
-
C:\Temp\gbztrljdbw.exeC:\Temp\gbztrljdbw.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gbztrljdbw.exe ups_ins3⤵
-
C:\Temp\i_gbztrljdbw.exeC:\Temp\i_gbztrljdbw.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bytrljdbvt.exe ups_run3⤵
-
C:\Temp\bytrljdbvt.exeC:\Temp\bytrljdbvt.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bytrljdbvt.exe ups_ins3⤵
-
C:\Temp\i_bytrljdbvt.exeC:\Temp\i_bytrljdbvt.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dyvqoigayt.exe ups_run3⤵
-
C:\Temp\dyvqoigayt.exeC:\Temp\dyvqoigayt.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dyvqoigayt.exe ups_ins3⤵
-
C:\Temp\i_dyvqoigayt.exeC:\Temp\i_dyvqoigayt.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\avsnlfdysq.exe ups_run3⤵
-
C:\Temp\avsnlfdysq.exeC:\Temp\avsnlfdysq.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_avsnlfdysq.exe ups_ins3⤵
-
C:\Temp\i_avsnlfdysq.exeC:\Temp\i_avsnlfdysq.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nhfaxsqkic.exe ups_run3⤵
-
C:\Temp\nhfaxsqkic.exeC:\Temp\nhfaxsqkic.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nhfaxsqkic.exe ups_ins3⤵
-
C:\Temp\i_nhfaxsqkic.exeC:\Temp\i_nhfaxsqkic.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\upnhfzxsmk.exe ups_run3⤵
-
C:\Temp\upnhfzxsmk.exeC:\Temp\upnhfzxsmk.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_upnhfzxsmk.exe ups_ins3⤵
-
C:\Temp\i_upnhfzxsmk.exeC:\Temp\i_upnhfzxsmk.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mkecwupmhf.exe ups_run3⤵
-
C:\Temp\mkecwupmhf.exeC:\Temp\mkecwupmhf.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mkecwupmhf.exe ups_ins3⤵
-
C:\Temp\i_mkecwupmhf.exeC:\Temp\i_mkecwupmhf.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\trmjebwuom.exe ups_run3⤵
-
C:\Temp\trmjebwuom.exeC:\Temp\trmjebwuom.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_trmjebwuom.exe ups_ins3⤵
-
C:\Temp\i_trmjebwuom.exeC:\Temp\i_trmjebwuom.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2892 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Temp\usmkecxupnhfzxrp.sysC:\Temp\usmkecxupnhfzxrp.sys1⤵
- Executes dropped EXE
-
C:\Temp\wuomhezxrp.sysC:\Temp\wuomhezxrp.sys1⤵
- Executes dropped EXE
-
C:\Temp\gezwrojhbz.sysC:\Temp\gezwrojhbz.sys1⤵
- Executes dropped EXE
-
C:\Temp\omgeywrojh.sysC:\Temp\omgeywrojh.sys1⤵
- Executes dropped EXE
-
C:\Temp\ljdbvtolge.sysC:\Temp\ljdbvtolge.sys1⤵
- Executes dropped EXE
-
C:\Temp\lfdyvqoiga.sysC:\Temp\lfdyvqoiga.sys1⤵
- Executes dropped EXE
-
C:\Temp\qkfdxvqnig.sysC:\Temp\qkfdxvqnig.sys1⤵
- Executes dropped EXE
-
C:\Temp\usnkfdxvpn.sysC:\Temp\usnkfdxvpn.sys1⤵
- Executes dropped EXE
-
C:\Temp\upkhcausmk.sysC:\Temp\upkhcausmk.sys1⤵
- Executes dropped EXE
-
C:\Temp\zxrpjhczur.sysC:\Temp\zxrpjhczur.sys1⤵
- Executes dropped EXE
-
C:\Temp\jecwuomhez.sysC:\Temp\jecwuomhez.sys1⤵
- Executes dropped EXE
-
C:\Temp\rljdbwtomg.sysC:\Temp\rljdbwtomg.sys1⤵
-
C:\Temp\tolgeywqoi.sysC:\Temp\tolgeywqoi.sys1⤵
-
C:\Temp\nlgdywqoig.sysC:\Temp\nlgdywqoig.sys1⤵
-
C:\Temp\lfdyvqniga.sysC:\Temp\lfdyvqniga.sys1⤵
-
C:\Temp\nhfaxsqkic.sysC:\Temp\nhfaxsqkic.sys1⤵
-
C:\Temp\xrpjhczusm.sysC:\Temp\xrpjhczusm.sys1⤵
-
C:\Temp\hbzurmkecw.sysC:\Temp\hbzurmkecw.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CreateProcess.exe
avtnlgdyvq.exe
aysqkicavs.exe
aytqljdbvt.exe
faxsqkicau.exe
gezwrojhbz.sys
hbzrpkezxr.exe
i_avtnlgdyvq.exe
i_aysqkicavs.exe
i_aytqljdbvt.exe
i_hbzrpkezxr.exe
i_vtolgeywqo.exe
i_wtomgeywrp.exe
i_zxspkhcaus.exe
lfdyvqoiga.sys
ljdbvtolge.sys
omgeywrojh.sys
qkfdxvqnig.sys
usmkecxupnhfzxrp.exe
usmkecxupnhfzxrp.sys
usnkfdxvpn.sys
vtolgeywqo.exe
wtomgeywrp.exe
wuomhezxrp.sys
zxspkhcaus.exe
suggestions[1].en-US
memory/460-116-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1328-50-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1384-134-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1456-146-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1456-38-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1904-142-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2248-88-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2620-153-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2876-138-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2956-108-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3008-157-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3448-26-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3640-100-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3820-64-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3820-16-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4216-161-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4896-117-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4896-112-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4996-76-0x0000000000010000-0x00000000000AB000-memory.dmp