Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
08/08/2026, 13:28
General
- Target 2026-08-08_5ea7fc3d3d0e00215ced5576f3f18fa6_elex_redline-stealer_rhadamanthys_stop.exe
- Size 230KB
- Sample260808-qqt8dsdf88
- SHA256 014baa14e88d4fe1453b7addbdf028ee87e7abf07489f4594bd3cac497b8aedd
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba8102
-
http://xytets.com:2345/ll/out.txt
-
http://xytets.com:2345/t.asp?os=home8102
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 44 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 52 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 19 IoCs
- Suspicious use of AdjustPrivilegeToken 20 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SetWindowsHookEx 10 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_5ea7fc3d3d0e00215ced5576f3f18fa6_elex_redline-stealer_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_5ea7fc3d3d0e00215ced5576f3f18fa6_elex_redline-stealer_rhadamanthys_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home81022⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2468 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:456 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\igbytolgdy.exe ups_run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\igbytolgdy.exeC:\Temp\igbytolgdy.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_igbytolgdy.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_igbytolgdy.exeC:\Temp\i_igbytolgdy.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\idavtnlfdy.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\idavtnlfdy.exeC:\Temp\idavtnlfdy.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_idavtnlfdy.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_idavtnlfdy.exeC:\Temp\i_idavtnlfdy.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\tnlfdxvqni.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\tnlfdxvqni.exeC:\Temp\tnlfdxvqni.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_tnlfdxvqni.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_tnlfdxvqni.exeC:\Temp\i_tnlfdxvqni.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\qkfdxvpnhf.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\qkfdxvpnhf.exeC:\Temp\qkfdxvpnhf.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_qkfdxvpnhf.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_qkfdxvpnhf.exeC:\Temp\i_qkfdxvpnhf.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\cxupnhfzus.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\cxupnhfzus.exeC:\Temp\cxupnhfzus.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_cxupnhfzus.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_cxupnhfzus.exeC:\Temp\i_cxupnhfzus.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\omhezxrpjh.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\omhezxrpjh.exeC:\Temp\omhezxrpjh.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_omhezxrpjh.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_omhezxrpjh.exeC:\Temp\i_omhezxrpjh.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ezwrojhbzt.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\ezwrojhbzt.exeC:\Temp\ezwrojhbzt.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ezwrojhbzt.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_ezwrojhbzt.exeC:\Temp\i_ezwrojhbzt.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ztrmjebwuo.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\ztrmjebwuo.exeC:\Temp\ztrmjebwuo.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ztrmjebwuo.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_ztrmjebwuo.exeC:\Temp\i_ztrmjebwuo.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ljdbwtomge.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\ljdbwtomge.exeC:\Temp\ljdbwtomge.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ljdbwtomge.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_ljdbwtomge.exeC:\Temp\i_ljdbwtomge.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\aysqljdbvt.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\aysqljdbvt.exeC:\Temp\aysqljdbvt.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_aysqljdbvt.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_aysqljdbvt.exeC:\Temp\i_aysqljdbvt.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\sqlidavtnl.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\sqlidavtnl.exeC:\Temp\sqlidavtnl.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_sqlidavtnl.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_sqlidavtnl.exeC:\Temp\i_sqlidavtnl.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\qkicavsnkf.exe ups_run2⤵
-
C:\Temp\qkicavsnkf.exeC:\Temp\qkicavsnkf.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_qkicavsnkf.exe ups_ins2⤵
-
C:\Temp\i_qkicavsnkf.exeC:\Temp\i_qkicavsnkf.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\kicausnkfd.exe ups_run2⤵
-
C:\Temp\kicausnkfd.exeC:\Temp\kicausnkfd.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_kicausnkfd.exe ups_ins2⤵
-
C:\Temp\i_kicausnkfd.exeC:\Temp\i_kicausnkfd.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\usmkecwupn.exe ups_run2⤵
-
C:\Temp\usmkecwupn.exeC:\Temp\usmkecwupn.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_usmkecwupn.exe ups_ins2⤵
-
C:\Temp\i_usmkecwupn.exeC:\Temp\i_usmkecwupn.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\kecwupmhez.exe ups_run2⤵
-
C:\Temp\kecwupmhez.exeC:\Temp\kecwupmhez.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_kecwupmhez.exe ups_ins2⤵
-
C:\Temp\i_kecwupmhez.exeC:\Temp\i_kecwupmhez.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ezwrpjhbzt.exe ups_run2⤵
-
C:\Temp\ezwrpjhbzt.exeC:\Temp\ezwrpjhbzt.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ezwrpjhbzt.exe ups_ins2⤵
-
C:\Temp\i_ezwrpjhbzt.exeC:\Temp\i_ezwrpjhbzt.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\tolgbztrlj.exe ups_run2⤵
-
C:\Temp\tolgbztrlj.exeC:\Temp\tolgbztrlj.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_tolgbztrlj.exe ups_ins2⤵
-
C:\Temp\i_tolgbztrlj.exeC:\Temp\i_tolgbztrlj.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\idbvtnlgdy.exe ups_run2⤵
-
C:\Temp\idbvtnlgdy.exeC:\Temp\idbvtnlgdy.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_idbvtnlgdy.exe ups_ins2⤵
-
C:\Temp\i_idbvtnlgdy.exeC:\Temp\i_idbvtnlgdy.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ysqlidbvtn.exe ups_run2⤵
-
C:\Temp\ysqlidbvtn.exeC:\Temp\ysqlidbvtn.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ysqlidbvtn.exe ups_ins2⤵
-
C:\Temp\i_ysqlidbvtn.exeC:\Temp\i_ysqlidbvtn.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\vqnigaysqd.exe ups_run2⤵
-
C:\Temp\vqnigaysqd.exeC:\Temp\vqnigaysqd.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_vqnigaysqd.exe ups_ins2⤵
-
C:\Temp\i_vqnigaysqd.exeC:\Temp\i_vqnigaysqd.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Temp\tnlgdyvqoi.sysC:\Temp\tnlgdyvqoi.sys1⤵
- Executes dropped EXE
-
C:\Temp\igaysqkida.sysC:\Temp\igaysqkida.sys1⤵
- Executes dropped EXE
-
C:\Temp\xvpnifaysq.sysC:\Temp\xvpnifaysq.sys1⤵
- Executes dropped EXE
-
C:\Temp\nhfzxspkic.sysC:\Temp\nhfzxspkic.sys1⤵
- Executes dropped EXE
-
C:\Temp\zusmkecwup.sysC:\Temp\zusmkecwup.sys1⤵
- Executes dropped EXE
-
C:\Temp\xrpjhczurm.sysC:\Temp\xrpjhczurm.sys1⤵
- Executes dropped EXE
-
C:\Temp\gezwrpjhbz.sysC:\Temp\gezwrpjhbz.sys1⤵
- Executes dropped EXE
-
C:\Temp\wrojgbztrl.sysC:\Temp\wrojgbztrl.sys1⤵
- Executes dropped EXE
-
C:\Temp\oigbytqljd.sysC:\Temp\oigbytqljd.sys1⤵
- Executes dropped EXE
-
C:\Temp\lfdyvqoiga.sysC:\Temp\lfdyvqoiga.sys1⤵
- Executes dropped EXE
-
C:\Temp\avpnifaysq.sysC:\Temp\avpnifaysq.sys1⤵
-
C:\Temp\spkicausmk.sysC:\Temp\spkicausmk.sys1⤵
-
C:\Temp\ecxupnhfzx.sysC:\Temp\ecxupnhfzx.sys1⤵
-
C:\Temp\zurmkecwup.sysC:\Temp\zurmkecwup.sys1⤵
-
C:\Temp\pjebwuomge.sysC:\Temp\pjebwuomge.sys1⤵
-
C:\Temp\bztrljdbwt.sysC:\Temp\bztrljdbwt.sys1⤵
-
C:\Temp\tolgeywqoi.sysC:\Temp\tolgeywqoi.sys1⤵
-
C:\Temp\nlfdyvqoig.sysC:\Temp\nlfdyvqoig.sys1⤵
-
C:\Temp\fdyvqoigay.sysC:\Temp\fdyvqoigay.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CP.exe
cxupnhfzus.exe
ezwrojhbzt.exe
gezwrpjhbz.sys
i_cxupnhfzus.exe
i_ezwrojhbzt.exe
i_idavtnlfdy.exe
i_igbytolgdy.exe
i_omhezxrpjh.exe
i_qkfdxvpnhf.exe
i_tnlfdxvqni.exe
idavtnlfdy.exe
igaysqkida.sys
igbytolgdy.exe
nhfzxspkic.sys
omhezxrpjh.exe
qkfdxvpnhf.exe
tnlfdxvqni.exe
tnlgdyvqoi.sys
xrpjhczurm.sys
xvpnifaysq.sys
ztrmjebwuo.exe
zusmkecwup.sys
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
RecoveryStore.{08B46890-932D-11F1-B995-C24FA7D2CAFF}.dat
RecoveryStore.{08B6CAFA-932D-11F1-B995-C24FA7D2CAFF}.dat
suggestions[1].en-US
memory/364-16-0x0000000000010000-0x0000000000083000-memory.dmp
memory/868-162-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1300-111-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1300-116-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2008-166-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2540-142-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2780-88-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3284-100-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3396-150-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3476-146-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3500-76-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3732-115-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3732-134-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3772-107-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4056-158-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4148-28-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4320-154-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4408-40-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4708-133-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4756-138-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5072-62-0x0000000000010000-0x0000000000083000-memory.dmp