Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
02/08/2026, 19:43
General
- Target 2026-08-02_09f4553a11547b2a4ba6fa5b6491bd8a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
- Size 365KB
- Sample260802-yfap1afk6x
- SHA256 b0db04c986a940e45412201bdf2e02434c1ecb8b72636c8cb0176e752349a383
Score
10/10
Malware Config
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 32 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 60 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_09f4553a11547b2a4ba6fa5b6491bd8a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_09f4553a11547b2a4ba6fa5b6491bd8a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\rljebwuomgbztrlj.exeC:\Temp\rljebwuomgbztrlj.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zwrojhbztr.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\zwrojhbztr.exeC:\Temp\zwrojhbztr.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zwrojhbztr.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_zwrojhbztr.exeC:\Temp\i_zwrojhbztr.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\tnlgdywqoi.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\tnlgdywqoi.exeC:\Temp\tnlgdywqoi.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_tnlgdywqoi.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_tnlgdywqoi.exeC:\Temp\i_tnlgdywqoi.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ysqldyvqoi.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ysqldyvqoi.exeC:\Temp\ysqldyvqoi.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ysqldyvqoi.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ysqldyvqoi.exeC:\Temp\i_ysqldyvqoi.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\igaysqkida.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\igaysqkida.exeC:\Temp\igaysqkida.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_igaysqkida.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_igaysqkida.exeC:\Temp\i_igaysqkida.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\avsnlfaxsq.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\avsnlfaxsq.exeC:\Temp\avsnlfaxsq.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_avsnlfaxsq.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_avsnlfaxsq.exeC:\Temp\i_avsnlfaxsq.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hfzxspkhca.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\hfzxspkhca.exeC:\Temp\hfzxspkhca.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hfzxspkhca.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_hfzxspkhca.exeC:\Temp\i_hfzxspkhca.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\upmhfzuomh.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\upmhfzuomh.exeC:\Temp\upmhfzuomh.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_upmhfzuomh.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_upmhfzuomh.exeC:\Temp\i_upmhfzuomh.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\cwuomhezxr.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\cwuomhezxr.exeC:\Temp\cwuomhezxr.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_cwuomhezxr.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_cwuomhezxr.exeC:\Temp\i_cwuomhezxr.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gezwrpjhbz.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\gezwrpjhbz.exeC:\Temp\gezwrpjhbz.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gezwrpjhbz.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_gezwrpjhbz.exeC:\Temp\i_gezwrpjhbz.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lgeywqmgey.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\lgeywqmgey.exeC:\Temp\lgeywqmgey.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_lgeywqmgey.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_lgeywqmgey.exeC:\Temp\i_lgeywqmgey.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\sqlidbvtnl.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\sqlidbvtnl.exeC:\Temp\sqlidbvtnl.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_sqlidbvtnl.exe ups_ins3⤵
-
C:\Temp\i_sqlidbvtnl.exeC:\Temp\i_sqlidbvtnl.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\icavsnlfdx.exe ups_run3⤵
-
C:\Temp\icavsnlfdx.exeC:\Temp\icavsnlfdx.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_icavsnlfdx.exe ups_ins3⤵
-
C:\Temp\i_icavsnlfdx.exeC:\Temp\i_icavsnlfdx.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ifaysqkica.exe ups_run3⤵
-
C:\Temp\ifaysqkica.exeC:\Temp\ifaysqkica.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ifaysqkica.exe ups_ins3⤵
-
C:\Temp\i_ifaysqkica.exeC:\Temp\i_ifaysqkica.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\usnkfdxvpn.exe ups_run3⤵
-
C:\Temp\usnkfdxvpn.exeC:\Temp\usnkfdxvpn.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_usnkfdxvpn.exe ups_ins3⤵
-
C:\Temp\i_usnkfdxvpn.exeC:\Temp\i_usnkfdxvpn.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mkecxrpkhc.exe ups_run3⤵
-
C:\Temp\mkecxrpkhc.exeC:\Temp\mkecxrpkhc.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mkecxrpkhc.exe ups_ins3⤵
-
C:\Temp\i_mkecxrpkhc.exeC:\Temp\i_mkecxrpkhc.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ecwupmhezx.exe ups_run3⤵
-
C:\Temp\ecwupmhezx.exeC:\Temp\ecwupmhezx.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ecwupmhezx.exe ups_ins3⤵
-
C:\Temp\i_ecwupmhezx.exeC:\Temp\i_ecwupmhezx.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\cwuomecwug.exe ups_run3⤵
-
C:\Temp\cwuomecwug.exeC:\Temp\cwuomecwug.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_cwuomecwug.exe ups_ins3⤵
-
C:\Temp\i_cwuomecwug.exeC:\Temp\i_cwuomecwug.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\uomgeywroj.exe ups_run3⤵
-
C:\Temp\uomgeywroj.exeC:\Temp\uomgeywroj.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_uomgeywroj.exe ups_ins3⤵
-
C:\Temp\i_uomgeywroj.exeC:\Temp\i_uomgeywroj.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ywqoigbytq.exe ups_run3⤵
-
C:\Temp\ywqoigbytq.exeC:\Temp\ywqoigbytq.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ywqoigbytq.exe ups_ins3⤵
-
C:\Temp\i_ywqoigbytq.exeC:\Temp\i_ywqoigbytq.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1800 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Temp\rljebwuomgbztrlj.sysC:\Temp\rljebwuomgbztrlj.sys1⤵
- Executes dropped EXE
-
C:\Temp\dbwtomgeyw.sysC:\Temp\dbwtomgeyw.sys1⤵
- Executes dropped EXE
-
C:\Temp\fdyvqoigay.sysC:\Temp\fdyvqoigay.sys1⤵
- Executes dropped EXE
-
C:\Temp\xvqnigaysq.sysC:\Temp\xvqnigaysq.sys1⤵
- Executes dropped EXE
-
C:\Temp\hfaxsqkica.sysC:\Temp\hfaxsqkica.sys1⤵
- Executes dropped EXE
-
C:\Temp\spkicausnk.sysC:\Temp\spkicausnk.sys1⤵
- Executes dropped EXE
-
C:\Temp\causmkecxu.sysC:\Temp\causmkecxu.sys1⤵
- Executes dropped EXE
-
C:\Temp\rpjhbzuomh.sysC:\Temp\rpjhbzuomh.sys1⤵
- Executes dropped EXE
-
C:\Temp\rmjebwuomg.sysC:\Temp\rmjebwuomg.sys1⤵
- Executes dropped EXE
-
C:\Temp\ywqoigbytr.sysC:\Temp\ywqoigbytr.sys1⤵
- Executes dropped EXE
-
C:\Temp\dbvtnlgdyw.sysC:\Temp\dbvtnlgdyw.sys1⤵
- Executes dropped EXE
-
C:\Temp\yvqoigaysq.sysC:\Temp\yvqoigaysq.sys1⤵
-
C:\Temp\snlfdxvqni.sysC:\Temp\snlfdxvqni.sys1⤵
-
C:\Temp\faxspkicau.sysC:\Temp\faxspkicau.sys1⤵
-
C:\Temp\usmkecwupm.sysC:\Temp\usmkecwupm.sys1⤵
-
C:\Temp\xrpjhczusm.sysC:\Temp\xrpjhczusm.sys1⤵
-
C:\Temp\jebwuomgez.sysC:\Temp\jebwuomgez.sys1⤵
-
C:\Temp\bwtomgeywq.sysC:\Temp\bwtomgeywq.sys1⤵
-
C:\Temp\jdbvtolgey.sysC:\Temp\jdbvtolgey.sys1⤵
-
C:\Temp\bvtnlgdyvq.sysC:\Temp\bvtnlgdyvq.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CreateProcess.exe
avsnlfaxsq.exe
causmkecxu.sys
cwuomhezxr.exe
dbwtomgeyw.sys
fdyvqoigay.sys
hfaxsqkica.sys
hfzxspkhca.exe
i_avsnlfaxsq.exe
i_hfzxspkhca.exe
i_igaysqkida.exe
i_tnlgdywqoi.exe
i_upmhfzuomh.exe
i_ysqldyvqoi.exe
i_zwrojhbztr.exe
igaysqkida.exe
rljebwuomgbztrlj.exe
rljebwuomgbztrlj.sys
rpjhbzuomh.sys
spkicausnk.sys
tnlgdywqoi.exe
upmhfzuomh.exe
xvqnigaysq.sys
ysqldyvqoi.exe
zwrojhbztr.exe
suggestions[1].en-US
memory/316-131-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/548-159-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/636-135-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1352-57-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1416-14-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1424-21-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1672-123-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1768-151-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2068-163-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2964-89-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3532-60-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3532-45-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3908-143-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4304-101-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4396-147-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4460-139-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4540-127-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4648-72-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4928-33-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5016-155-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5116-109-0x0000000000010000-0x00000000000AB000-memory.dmp