Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
10/08/2026, 09:29
General
- Target 2026-08-10_e4885ee4e5f2adf7563d7652b460e722_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
- Size 389KB
- Sample260810-lf5txsen2x
- SHA256 7501b1fa21f16f8b49f50f85347da56c422e10caf53a2d24d526d0b8bbb01bab
Score
10/10
Malware Config
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 35 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 60 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_e4885ee4e5f2adf7563d7652b460e722_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_e4885ee4e5f2adf7563d7652b460e722_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\tomgeywqobytrljd.exeC:\Temp\tomgeywqobytrljd.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\tomgeywqoj.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\tomgeywqoj.exeC:\Temp\tomgeywqoj.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_tomgeywqoj.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_tomgeywqoj.exeC:\Temp\i_tomgeywqoj.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gaytqljdbv.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\gaytqljdbv.exeC:\Temp\gaytqljdbv.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gaytqljdbv.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_gaytqljdbv.exeC:\Temp\i_gaytqljdbv.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lidbvtndav.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\lidbvtndav.exeC:\Temp\lidbvtndav.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_lidbvtndav.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_lidbvtndav.exeC:\Temp\i_lidbvtndav.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nlfdxvqnif.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\nlfdxvqnif.exeC:\Temp\nlfdxvqnif.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nlfdxvqnif.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_nlfdxvqnif.exeC:\Temp\i_nlfdxvqnif.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\smkfaxsqki.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\smkfaxsqki.exeC:\Temp\smkfaxsqki.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_smkfaxsqki.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_smkfaxsqki.exeC:\Temp\i_smkfaxsqki.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\causmkfcxm.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\causmkfcxm.exeC:\Temp\causmkfcxm.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_causmkfcxm.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_causmkfcxm.exeC:\Temp\i_causmkfcxm.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\upjhczusmk.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\upjhczusmk.exeC:\Temp\upjhczusmk.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_upjhczusmk.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_upjhczusmk.exeC:\Temp\i_upjhczusmk.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zwrojhbzto.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\zwrojhbzto.exeC:\Temp\zwrojhbzto.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zwrojhbzto.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_zwrojhbzto.exeC:\Temp\i_zwrojhbzto.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ljebwtomge.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ljebwtomge.exeC:\Temp\ljebwtomge.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ljebwtomge.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ljebwtomge.exeC:\Temp\i_ljebwtomge.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dbvtgdyvqo.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\dbvtgdyvqo.exeC:\Temp\dbvtgdyvqo.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dbvtgdyvqo.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_dbvtgdyvqo.exeC:\Temp\i_dbvtgdyvqo.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\oigaytqlid.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\oigaytqlid.exeC:\Temp\oigaytqlid.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_oigaytqlid.exe ups_ins3⤵
-
C:\Temp\i_oigaytqlid.exeC:\Temp\i_oigaytqlid.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dxvqnigays.exe ups_run3⤵
-
C:\Temp\dxvqnigays.exeC:\Temp\dxvqnigays.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dxvqnigays.exe ups_ins3⤵
-
C:\Temp\i_dxvqnigays.exeC:\Temp\i_dxvqnigays.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pnhfzxsqki.exe ups_run3⤵
-
C:\Temp\pnhfzxsqki.exeC:\Temp\pnhfzxsqki.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pnhfzxsqki.exe ups_ins3⤵
-
C:\Temp\i_pnhfzxsqki.exeC:\Temp\i_pnhfzxsqki.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\sfzxrpkhcz.exe ups_run3⤵
-
C:\Temp\sfzxrpkhcz.exeC:\Temp\sfzxrpkhcz.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_sfzxrpkhcz.exe ups_ins3⤵
-
C:\Temp\i_sfzxrpkhcz.exeC:\Temp\i_sfzxrpkhcz.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hczusmkecx.exe ups_run3⤵
-
C:\Temp\hczusmkecx.exeC:\Temp\hczusmkecx.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hczusmkecx.exe ups_ins3⤵
-
C:\Temp\i_hczusmkecx.exeC:\Temp\i_hczusmkecx.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zxrpjhbzur.exe ups_run3⤵
-
C:\Temp\zxrpjhbzur.exeC:\Temp\zxrpjhbzur.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zxrpjhbzur.exe ups_ins3⤵
-
C:\Temp\i_zxrpjhbzur.exeC:\Temp\i_zxrpjhbzur.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\omgeywrojg.exe ups_run3⤵
-
C:\Temp\omgeywrojg.exeC:\Temp\omgeywrojg.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_omgeywrojg.exe ups_ins3⤵
-
C:\Temp\i_omgeywrojg.exeC:\Temp\i_omgeywrojg.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\omywqoigby.exe ups_run3⤵
-
C:\Temp\omywqoigby.exeC:\Temp\omywqoigby.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_omywqoigby.exe ups_ins3⤵
-
C:\Temp\i_omywqoigby.exeC:\Temp\i_omywqoigby.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jdbvtolgdy.exe ups_run3⤵
-
C:\Temp\jdbvtolgdy.exeC:\Temp\jdbvtolgdy.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jdbvtolgdy.exe ups_ins3⤵
-
C:\Temp\i_jdbvtolgdy.exeC:\Temp\i_jdbvtolgdy.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4740 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Temp\tomgeywqobytrljd.sysC:\Temp\tomgeywqobytrljd.sys1⤵
- Executes dropped EXE
-
C:\Temp\rljdbvtolg.sysC:\Temp\rljdbvtolg.sys1⤵
- Executes dropped EXE
-
C:\Temp\sqlidavtnl.sysC:\Temp\sqlidavtnl.sys1⤵
- Executes dropped EXE
-
C:\Temp\ysqkicavsn.sysC:\Temp\ysqkicavsn.sys1⤵
- Executes dropped EXE
-
C:\Temp\kfdxvpnifa.sysC:\Temp\kfdxvpnifa.sys1⤵
- Executes dropped EXE
-
C:\Temp\nhfzxrpkhc.sysC:\Temp\nhfzxrpkhc.sys1⤵
- Executes dropped EXE
-
C:\Temp\czusmkecwu.sysC:\Temp\czusmkecwu.sys1⤵
- Executes dropped EXE
-
C:\Temp\jhbzurmjec.sysC:\Temp\jhbzurmjec.sys1⤵
- Executes dropped EXE
-
C:\Temp\eywrojhtrl.sysC:\Temp\eywrojhtrl.sys1⤵
- Executes dropped EXE
-
C:\Temp\omgeywqojg.sysC:\Temp\omgeywqojg.sys1⤵
- Executes dropped EXE
-
C:\Temp\ytnlfdyvqo.sysC:\Temp\ytnlfdyvqo.sys1⤵
- Executes dropped EXE
-
C:\Temp\lfdxvpnifa.sysC:\Temp\lfdxvpnifa.sys1⤵
-
C:\Temp\icankfdxvp.sysC:\Temp\icankfdxvp.sys1⤵
-
C:\Temp\axspkicaus.sysC:\Temp\axspkicaus.sys1⤵
-
C:\Temp\pnhfzxrpkh.sysC:\Temp\pnhfzxrpkh.sys1⤵
-
C:\Temp\gezwrpjhbz.sysC:\Temp\gezwrpjhbz.sys1⤵
-
C:\Temp\hbztjebwuo.sysC:\Temp\hbztjebwuo.sys1⤵
-
C:\Temp\ytrljebwto.sysC:\Temp\ytrljebwto.sys1⤵
-
C:\Temp\qoigbytrlj.sysC:\Temp\qoigbytrlj.sys1⤵
-
C:\Temp\idbvtnlfdy.sysC:\Temp\idbvtnlfdy.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CreateProcess.exe
causmkfcxm.exe
czusmkecwu.sys
gaytqljdbv.exe
i_causmkfcxm.exe
i_gaytqljdbv.exe
i_lidbvtndav.exe
i_nlfdxvqnif.exe
i_smkfaxsqki.exe
i_tomgeywqoj.exe
i_upjhczusmk.exe
jhbzurmjec.sys
kfdxvpnifa.sys
lidbvtndav.exe
nhfzxrpkhc.sys
nlfdxvqnif.exe
rljdbvtolg.sys
smkfaxsqki.exe
sqlidavtnl.sys
tomgeywqobytrljd.exe
tomgeywqobytrljd.sys
tomgeywqoj.exe
upjhczusmk.exe
ysqkicavsn.sys
zwrojhbzto.exe
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
suggestions[1].en-US
memory/436-130-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/644-45-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1012-146-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1052-167-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1300-14-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1404-158-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1568-21-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1876-150-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2652-109-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2900-91-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3524-138-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3964-142-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4420-163-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4448-33-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4524-65-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4528-134-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4688-103-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4912-154-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4912-159-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4984-79-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5116-126-0x0000000000010000-0x00000000000AB000-memory.dmp