Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
09/08/2026, 09:04
General
- Target 2026-08-09_b8145036bf64a9c846dcfe418ea244d8_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 361KB
- Sample260809-k116ssvale
- SHA256 ddc82293f89e90597e2aa638a883010c4eb12c7319eef01a2431a0b1cf2269a8
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 31 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 60 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_b8145036bf64a9c846dcfe418ea244d8_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_b8145036bf64a9c846dcfe418ea244d8_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\kecwuomhezxrpjhb.exeC:\Temp\kecwuomhezxrpjhb.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\smkecwupmh.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\smkecwupmh.exeC:\Temp\smkecwupmh.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_smkecwupmh.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_smkecwupmh.exeC:\Temp\i_smkecwupmh.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mhbztrljeb.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\mhbztrljeb.exeC:\Temp\mhbztrljeb.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mhbztrljeb.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_mhbztrljeb.exeC:\Temp\i_mhbztrljeb.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ytrljdbwuo.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ytrljdbwuo.exeC:\Temp\ytrljdbwuo.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ytrljdbwuo.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ytrljdbwuo.exeC:\Temp\i_ytrljdbwuo.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jdbwtolgey.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jdbwtolgey.exeC:\Temp\jdbwtolgey.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jdbwtolgey.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jdbwtolgey.exeC:\Temp\i_jdbwtolgey.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\oidbvqniga.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\oidbvqniga.exeC:\Temp\oidbvqniga.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_oidbvqniga.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_oidbvqniga.exeC:\Temp\i_oidbvqniga.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ysnlfdxvpn.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ysnlfdxvpn.exeC:\Temp\ysnlfdxvpn.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ysnlfdxvpn.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ysnlfdxvpn.exeC:\Temp\i_ysnlfdxvpn.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nifaysqkau.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\nifaysqkau.exeC:\Temp\nifaysqkau.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nifaysqkau.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_nifaysqkau.exeC:\Temp\i_nifaysqkau.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\smkfcxvpnh.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\smkfcxvpnh.exeC:\Temp\smkfcxvpnh.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_smkfcxvpnh.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_smkfcxvpnh.exeC:\Temp\i_smkfcxvpnh.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ezxrpjhczu.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ezxrpjhczu.exeC:\Temp\ezxrpjhczu.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ezxrpjhczu.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ezxrpjhczu.exeC:\Temp\i_ezxrpjhczu.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rmjebwuomg.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\rmjebwuomg.exeC:\Temp\rmjebwuomg.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rmjebwuomg.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_rmjebwuomg.exeC:\Temp\i_rmjebwuomg.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gerojgbzto.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\gerojgbzto.exeC:\Temp\gerojgbzto.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gerojgbzto.exe ups_ins3⤵
-
C:\Temp\i_gerojgbzto.exeC:\Temp\i_gerojgbzto.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jdbvtolgby.exe ups_run3⤵
-
C:\Temp\jdbvtolgby.exeC:\Temp\jdbvtolgby.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jdbvtolgby.exe ups_ins3⤵
-
C:\Temp\i_jdbvtolgby.exeC:\Temp\i_jdbvtolgby.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vtnlgdyvqo.exe ups_run3⤵
-
C:\Temp\vtnlgdyvqo.exeC:\Temp\vtnlgdyvqo.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vtnlgdyvqo.exe ups_ins3⤵
-
C:\Temp\i_vtnlgdyvqo.exeC:\Temp\i_vtnlgdyvqo.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kidavtnlfa.exe ups_run3⤵
-
C:\Temp\kidavtnlfa.exeC:\Temp\kidavtnlfa.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kidavtnlfa.exe ups_ins3⤵
-
C:\Temp\i_kidavtnlfa.exeC:\Temp\i_kidavtnlfa.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ysnkfdxvpn.exe ups_run3⤵
-
C:\Temp\ysnkfdxvpn.exeC:\Temp\ysnkfdxvpn.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ysnkfdxvpn.exe ups_ins3⤵
-
C:\Temp\i_ysnkfdxvpn.exeC:\Temp\i_ysnkfdxvpn.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pkhcausmkf.exe ups_run3⤵
-
C:\Temp\pkhcausmkf.exeC:\Temp\pkhcausmkf.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pkhcausmkf.exe ups_ins3⤵
-
C:\Temp\i_pkhcausmkf.exeC:\Temp\i_pkhcausmkf.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fzusmkecwu.exe ups_run3⤵
-
C:\Temp\fzusmkecwu.exeC:\Temp\fzusmkecwu.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fzusmkecwu.exe ups_ins3⤵
-
C:\Temp\i_fzusmkecwu.exeC:\Temp\i_fzusmkecwu.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\trmjecwuom.exe ups_run3⤵
-
C:\Temp\trmjecwuom.exeC:\Temp\trmjecwuom.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_trmjecwuom.exe ups_ins3⤵
-
C:\Temp\i_trmjecwuom.exeC:\Temp\i_trmjecwuom.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\omgeytrlje.exe ups_run3⤵
-
C:\Temp\omgeytrlje.exeC:\Temp\omgeytrlje.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_omgeytrlje.exe ups_ins3⤵
-
C:\Temp\i_omgeytrlje.exeC:\Temp\i_omgeytrlje.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1020 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Temp\kecwuomhezxrpjhb.sysC:\Temp\kecwuomhezxrpjhb.sys1⤵
- Executes dropped EXE
-
C:\Temp\ezxrpjhbzu.sysC:\Temp\ezxrpjhbzu.sys1⤵
- Executes dropped EXE
-
C:\Temp\jebwuomgey.sysC:\Temp\jebwuomgey.sys1⤵
- Executes dropped EXE
-
C:\Temp\toigbytrlj.sysC:\Temp\toigbytrlj.sys1⤵
- Executes dropped EXE
-
C:\Temp\vtnlgdywqo.sysC:\Temp\vtnlgdywqo.sys1⤵
- Executes dropped EXE
-
C:\Temp\nlfdyvqoig.sysC:\Temp\nlfdyvqoig.sys1⤵
- Executes dropped EXE
-
C:\Temp\ysnkfdxvpn.sysC:\Temp\ysnkfdxvpn.sys1⤵
- Executes dropped EXE
-
C:\Temp\zxrpkhcaus.sysC:\Temp\zxrpkhcaus.sys1⤵
- Executes dropped EXE
-
C:\Temp\pkhcausmke.sysC:\Temp\pkhcausmke.sys1⤵
- Executes dropped EXE
-
C:\Temp\kecwupezwr.sysC:\Temp\kecwupezwr.sys1⤵
- Executes dropped EXE
-
C:\Temp\rljebwuomg.sysC:\Temp\rljebwuomg.sys1⤵
- Executes dropped EXE
-
C:\Temp\tomgeywqoj.sysC:\Temp\tomgeywqoj.sys1⤵
-
C:\Temp\gdywqoigby.sysC:\Temp\gdywqoigby.sys1⤵
-
C:\Temp\vqoigaysql.sysC:\Temp\vqoigaysql.sys1⤵
-
C:\Temp\nifaysqkic.sysC:\Temp\nifaysqkic.sys1⤵
-
C:\Temp\ausnkfdxvp.sysC:\Temp\ausnkfdxvp.sys1⤵
-
C:\Temp\pkecxupnhf.sysC:\Temp\pkecxupnhf.sys1⤵
-
C:\Temp\hbzurmkecw.sysC:\Temp\hbzurmkecw.sys1⤵
-
C:\Temp\ztrljebwuo.sysC:\Temp\ztrljebwuo.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CreateProcess.exe
ezxrpjhbzu.sys
i_jdbwtolgey.exe
i_mhbztrljeb.exe
i_nifaysqkau.exe
i_oidbvqniga.exe
i_smkecwupmh.exe
i_ysnlfdxvpn.exe
i_ytrljdbwuo.exe
jdbwtolgey.exe
jebwuomgey.sys
kecwuomhezxrpjhb.exe
kecwuomhezxrpjhb.sys
mhbztrljeb.exe
nifaysqkau.exe
nlfdyvqoig.sys
oidbvqniga.exe
smkecwupmh.exe
smkfcxvpnh.exe
toigbytrlj.sys
vtnlgdywqo.sys
ysnkfdxvpn.sys
ysnlfdxvpn.exe
ytrljdbwuo.exe
zxrpkhcaus.sys
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
suggestions[1].en-US
memory/976-19-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1016-93-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2084-153-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2356-122-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2464-149-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2676-67-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2908-157-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3176-111-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3356-50-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3388-168-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3592-164-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3904-81-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3948-105-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4624-38-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4692-118-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4884-142-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4884-136-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4924-140-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5108-26-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5116-145-0x0000000000010000-0x00000000000AB000-memory.dmp