Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
14/08/2026, 03:57
General
- Target 2026-08-14_8216e86307746d35e22108350d4a0629_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 361KB
- Sample260814-ejectack7v
- SHA256 7178922224a97c1d2315f5d0c18c3ebe6e401dd21daf1def77a2a6bb59b1dff8
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 58 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 60 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-14_8216e86307746d35e22108350d4a0629_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-14_8216e86307746d35e22108350d4a0629_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\cxupmhfzxrpjhczu.exeC:\Temp\cxupmhfzxrpjhczu.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nhfzxrpkhc.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\nhfzxrpkhc.exeC:\Temp\nhfzxrpkhc.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nhfzxrpkhc.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_nhfzxrpkhc.exeC:\Temp\i_nhfzxrpkhc.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mhezxrpjhb.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\mhezxrpjhb.exeC:\Temp\mhezxrpjhb.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mhezxrpjhb.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_mhezxrpjhb.exeC:\Temp\i_mhezxrpjhb.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ojhbztomge.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ojhbztomge.exeC:\Temp\ojhbztomge.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ojhbztomge.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ojhbztomge.exeC:\Temp\i_ojhbztomge.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vtolgeywqo.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\vtolgeywqo.exeC:\Temp\vtolgeywqo.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vtolgeywqo.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_vtolgeywqo.exeC:\Temp\i_vtolgeywqo.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dywqoigbyt.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\dywqoigbyt.exeC:\Temp\dywqoigbyt.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dywqoigbyt.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_dywqoigbyt.exeC:\Temp\i_dywqoigbyt.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lfdyvqniga.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\lfdyvqniga.exeC:\Temp\lfdyvqniga.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_lfdyvqniga.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_lfdyvqniga.exeC:\Temp\i_lfdyvqniga.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nlfdxvpnif.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\nlfdxvpnif.exeC:\Temp\nlfdxvpnif.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nlfdxvpnif.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_nlfdxvpnif.exeC:\Temp\i_nlfdxvpnif.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\smkfcxupnh.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\smkfcxupnh.exeC:\Temp\smkfcxupnh.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_smkfcxupnh.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_smkfcxupnh.exeC:\Temp\i_smkfcxupnh.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nhcausmkec.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\nhcausmkec.exeC:\Temp\nhcausmkec.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nhcausmkec.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_nhcausmkec.exeC:\Temp\i_nhcausmkec.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zuomhezxrp.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\zuomhezxrp.exeC:\Temp\zuomhezxrp.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zuomhezxrp.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_zuomhezxrp.exeC:\Temp\i_zuomhezxrp.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ojhbztrmje.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ojhbztrmje.exeC:\Temp\ojhbztrmje.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ojhbztrmje.exe ups_ins3⤵
-
C:\Temp\i_ojhbztrmje.exeC:\Temp\i_ojhbztrmje.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dywqojgbyt.exe ups_run3⤵
-
C:\Temp\dywqojgbyt.exeC:\Temp\dywqojgbyt.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dywqojgbyt.exe ups_ins3⤵
-
C:\Temp\i_dywqojgbyt.exeC:\Temp\i_dywqojgbyt.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ywqoigbytq.exe ups_run3⤵
-
C:\Temp\ywqoigbytq.exeC:\Temp\ywqoigbytq.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ywqoigbytq.exe ups_ins3⤵
-
C:\Temp\i_ywqoigbytq.exeC:\Temp\i_ywqoigbytq.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qljdbvtnlg.exe ups_run3⤵
-
C:\Temp\qljdbvtnlg.exeC:\Temp\qljdbvtnlg.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qljdbvtnlg.exe ups_ins3⤵
-
C:\Temp\i_qljdbvtnlg.exeC:\Temp\i_qljdbvtnlg.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gaysqkidav.exe ups_run3⤵
-
C:\Temp\gaysqkidav.exeC:\Temp\gaysqkidav.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gaysqkidav.exe ups_ins3⤵
-
C:\Temp\i_gaysqkidav.exeC:\Temp\i_gaysqkidav.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\avpnhfaxsp.exe ups_run3⤵
-
C:\Temp\avpnhfaxsp.exeC:\Temp\avpnhfaxsp.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_avpnhfaxsp.exe ups_ins3⤵
-
C:\Temp\i_avpnhfaxsp.exeC:\Temp\i_avpnhfaxsp.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ausnkfcxsp.exe ups_run3⤵
-
C:\Temp\ausnkfcxsp.exeC:\Temp\ausnkfcxsp.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ausnkfcxsp.exe ups_ins3⤵
-
C:\Temp\i_ausnkfcxsp.exeC:\Temp\i_ausnkfcxsp.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pjhczusmke.exe ups_run3⤵
-
C:\Temp\pjhczusmke.exeC:\Temp\pjhczusmke.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pjhczusmke.exe ups_ins3⤵
-
C:\Temp\i_pjhczusmke.exeC:\Temp\i_pjhczusmke.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ezwrpjhbzt.exe ups_run3⤵
-
C:\Temp\ezwrpjhbzt.exeC:\Temp\ezwrpjhbzt.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ezwrpjhbzt.exe ups_ins3⤵
-
C:\Temp\i_ezwrpjhbzt.exeC:\Temp\i_ezwrpjhbzt.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1752 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Temp\cxupmhfzxrpjhczu.sysC:\Temp\cxupmhfzxrpjhczu.sys1⤵
- Executes dropped EXE
-
C:\Temp\xrpjhczusm.sysC:\Temp\xrpjhczusm.sys1⤵
- Executes dropped EXE
-
C:\Temp\ztrmjecwuo.sysC:\Temp\ztrmjecwuo.sys1⤵
- Executes dropped EXE
-
C:\Temp\omgeywrojh.sysC:\Temp\omgeywrojh.sys1⤵
- Executes dropped EXE
-
C:\Temp\ljdbvtolgd.sysC:\Temp\ljdbvtolgd.sys1⤵
- Executes dropped EXE
-
C:\Temp\wqoigaytql.sysC:\Temp\wqoigaytql.sys1⤵
- Executes dropped EXE
-
C:\Temp\xsqkidavtn.sysC:\Temp\xsqkidavtn.sys1⤵
- Executes dropped EXE
-
C:\Temp\lfdxvpnifa.sysC:\Temp\lfdxvpnifa.sys1⤵
- Executes dropped EXE
-
C:\Temp\usmkfcxvpn.sysC:\Temp\usmkfcxvpn.sys1⤵
- Executes dropped EXE
-
C:\Temp\hfzxrpjhcz.sysC:\Temp\hfzxrpjhcz.sys1⤵
- Executes dropped EXE
-
C:\Temp\zuomgezwro.sysC:\Temp\zuomgezwro.sys1⤵
- Executes dropped EXE
-
C:\Temp\wrojhbztrm.sysC:\Temp\wrojhbztrm.sys1⤵
-
C:\Temp\jdbvtolgey.sysC:\Temp\jdbvtolgey.sys1⤵
-
C:\Temp\ywqoigbytq.sysC:\Temp\ywqoigbytq.sys1⤵
-
C:\Temp\nifaysqkic.sysC:\Temp\nifaysqkic.sys1⤵
-
C:\Temp\qnigaysqki.sysC:\Temp\qnigaysqki.sys1⤵
-
C:\Temp\hfaxsqkica.sysC:\Temp\hfaxsqkica.sys1⤵
-
C:\Temp\ausmkecxup.sysC:\Temp\ausmkecxup.sys1⤵
-
C:\Temp\pkecwuomhe.sysC:\Temp\pkecwuomhe.sys1⤵
-
C:\Temp\jhbzurmjec.sysC:\Temp\jhbzurmjec.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CreateProcess.exe
cxupmhfzxrpjhczu.exe
cxupmhfzxrpjhczu.sys
dywqoigbyt.exe
i_dywqoigbyt.exe
i_lfdyvqniga.exe
i_mhezxrpjhb.exe
i_nhfzxrpkhc.exe
i_nlfdxvpnif.exe
i_ojhbztomge.exe
i_vtolgeywqo.exe
lfdxvpnifa.sys
lfdyvqniga.exe
ljdbvtolgd.sys
mhezxrpjhb.exe
nhfzxrpkhc.exe
nlfdxvpnif.exe
ojhbztomge.exe
omgeywrojh.sys
smkfcxupnh.exe
vtolgeywqo.exe
wqoigaytql.sys
xrpjhczusm.sys
xsqkidavtn.sys
ztrmjecwuo.sys
8A7891822FCFF127E4EADADE9757112B
8A7891822FCFF127E4EADADE9757112B
search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
suggestions[1].en-US
Kno6695.tmp
memory/1400-174-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1408-154-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1840-63-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1960-37-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2052-178-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2284-125-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2344-170-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2756-186-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3036-143-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3448-194-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3716-166-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3876-137-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4272-190-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4392-108-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4532-77-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4780-23-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4884-162-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4904-158-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4916-14-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5052-182-0x0000000000010000-0x00000000000AB000-memory.dmp