Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
16/08/2026, 08:26
General
- Target 2026-08-16_20457fc7d9f6354cac7fc1b4c10fc192_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 361KB
- Sample260816-kb2e9stdnb
- SHA256 df782502780e887ebdea0b2cfc95d0cd945f5fc4a16b555fd1408b92b4ca7df5
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 32 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 60 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-16_20457fc7d9f6354cac7fc1b4c10fc192_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-16_20457fc7d9f6354cac7fc1b4c10fc192_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\ztrljebwuomgeywr.exeC:\Temp\ztrljebwuomgeywr.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hbztrdbwto.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\hbztrdbwto.exeC:\Temp\hbztrdbwto.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hbztrdbwto.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_hbztrdbwto.exeC:\Temp\i_hbztrdbwto.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\tolgeywqoi.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\tolgeywqoi.exeC:\Temp\tolgeywqoi.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_tolgeywqoi.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_tolgeywqoi.exeC:\Temp\i_tolgeywqoi.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vqnigaysqk.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\vqnigaysqk.exeC:\Temp\vqnigaysqk.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vqnigaysqk.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_vqnigaysqk.exeC:\Temp\i_vqnigaysqk.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\avpnifaysn.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\avpnifaysn.exeC:\Temp\avpnifaysn.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_avpnifaysn.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_avpnifaysn.exeC:\Temp\i_avpnifaysn.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\icxvpnhfax.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\icxvpnhfax.exeC:\Temp\icxvpnhfax.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_icxvpnhfax.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_icxvpnhfax.exeC:\Temp\i_icxvpnhfax.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rpkhcaupnh.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\rpkhcaupnh.exeC:\Temp\rpkhcaupnh.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rpkhcaupnh.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_rpkhcaupnh.exeC:\Temp\i_rpkhcaupnh.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zxrpjhczus.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\zxrpjhczus.exeC:\Temp\zxrpjhczus.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zxrpjhczus.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_zxrpjhczus.exeC:\Temp\i_zxrpjhczus.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\eywrmjecwu.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\eywrmjecwu.exeC:\Temp\eywrmjecwu.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_eywrmjecwu.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_eywrmjecwu.exeC:\Temp\i_eywrmjecwu.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rojgbztrlj.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\rojgbztrlj.exeC:\Temp\rojgbztrlj.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rojgbztrlj.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_rojgbztrlj.exeC:\Temp\i_rojgbztrlj.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gbytqljdbv.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\gbytqljdbv.exeC:\Temp\gbytqljdbv.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gbytqljdbv.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_gbytqljdbv.exeC:\Temp\i_gbytqljdbv.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lgaysqlidy.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\lgaysqlidy.exeC:\Temp\lgaysqlidy.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_lgaysqlidy.exe ups_ins3⤵
-
C:\Temp\i_lgaysqlidy.exeC:\Temp\i_lgaysqlidy.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\avtnlfdxvq.exe ups_run3⤵
-
C:\Temp\avtnlfdxvq.exeC:\Temp\avtnlfdxvq.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_avtnlfdxvq.exe ups_ins3⤵
-
C:\Temp\i_avtnlfdxvq.exeC:\Temp\i_avtnlfdxvq.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mkfcxvpnhf.exe ups_run3⤵
-
C:\Temp\mkfcxvpnhf.exeC:\Temp\mkfcxvpnhf.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mkfcxvpnhf.exe ups_ins3⤵
-
C:\Temp\i_mkfcxvpnhf.exeC:\Temp\i_mkfcxvpnhf.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\cxupfzxspk.exe ups_run3⤵
-
C:\Temp\cxupfzxspk.exeC:\Temp\cxupfzxspk.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_cxupfzxspk.exe ups_ins3⤵
-
C:\Temp\i_cxupfzxspk.exeC:\Temp\i_cxupfzxspk.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pmhezxrpjh.exe ups_run3⤵
-
C:\Temp\pmhezxrpjh.exeC:\Temp\pmhezxrpjh.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pmhezxrpjh.exe ups_ins3⤵
-
C:\Temp\i_pmhezxrpjh.exeC:\Temp\i_pmhezxrpjh.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ecwrpjhbzu.exe ups_run3⤵
-
C:\Temp\ecwrpjhbzu.exeC:\Temp\ecwrpjhbzu.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ecwrpjhbzu.exe ups_ins3⤵
-
C:\Temp\i_ecwrpjhbzu.exeC:\Temp\i_ecwrpjhbzu.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wrojhbztrl.exe ups_run3⤵
-
C:\Temp\wrojhbztrl.exeC:\Temp\wrojhbztrl.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wrojhbztrl.exe ups_ins3⤵
-
C:\Temp\i_wrojhbztrl.exeC:\Temp\i_wrojhbztrl.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wqoiytqljd.exe ups_run3⤵
-
C:\Temp\wqoiytqljd.exeC:\Temp\wqoiytqljd.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wqoiytqljd.exe ups_ins3⤵
-
C:\Temp\i_wqoiytqljd.exeC:\Temp\i_wqoiytqljd.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ojdbvtolgd.exe ups_run3⤵
-
C:\Temp\ojdbvtolgd.exeC:\Temp\ojdbvtolgd.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ojdbvtolgd.exe ups_ins3⤵
-
C:\Temp\i_ojdbvtolgd.exeC:\Temp\i_ojdbvtolgd.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2020 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Temp\ztrljebwuomgeywr.sysC:\Temp\ztrljebwuomgeywr.sys1⤵
- Executes dropped EXE
-
C:\Temp\dbwtolgeyw.sysC:\Temp\dbwtolgeyw.sys1⤵
- Executes dropped EXE
-
C:\Temp\gaysqlidbv.sysC:\Temp\gaysqlidbv.sys1⤵
- Executes dropped EXE
-
C:\Temp\igaysqkida.sysC:\Temp\igaysqkida.sys1⤵
- Executes dropped EXE
-
C:\Temp\xsqkicausn.sysC:\Temp\xsqkicausn.sys1⤵
- Executes dropped EXE
-
C:\Temp\cxspkhcaus.sysC:\Temp\cxspkhcaus.sys1⤵
- Executes dropped EXE
-
C:\Temp\kecwuomhez.sysC:\Temp\kecwuomhez.sys1⤵
- Executes dropped EXE
-
C:\Temp\pjhbztrmje.sysC:\Temp\pjhbztrmje.sys1⤵
- Executes dropped EXE
-
C:\Temp\geywrojgbz.sysC:\Temp\geywrojgbz.sys1⤵
- Executes dropped EXE
-
C:\Temp\wqoigbytrl.sysC:\Temp\wqoigbytrl.sys1⤵
- Executes dropped EXE
-
C:\Temp\aysqjdbvtn.sysC:\Temp\aysqjdbvtn.sys1⤵
- Executes dropped EXE
-
C:\Temp\icavsnlfdx.sysC:\Temp\icavsnlfdx.sys1⤵
-
C:\Temp\idxvpnifaq.sysC:\Temp\idxvpnifaq.sys1⤵
-
C:\Temp\nkfdxvpnhf.sysC:\Temp\nkfdxvpnhf.sys1⤵
-
C:\Temp\zusmkecwup.sysC:\Temp\zusmkecwup.sys1⤵
-
C:\Temp\pjhbzurmke.sysC:\Temp\pjhbzurmke.sys1⤵
-
C:\Temp\mgezwjgbzt.sysC:\Temp\mgezwjgbzt.sys1⤵
-
C:\Temp\dbwtomgeyw.sysC:\Temp\dbwtomgeyw.sys1⤵
-
C:\Temp\wqoigaytql.sysC:\Temp\wqoigaytql.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CreateProcess.exe
avpnifaysn.exe
cxspkhcaus.sys
dbwtolgeyw.sys
eywrmjecwu.exe
gaysqlidbv.sys
hbztrdbwto.exe
i_avpnifaysn.exe
i_hbztrdbwto.exe
i_icxvpnhfax.exe
i_rpkhcaupnh.exe
i_tolgeywqoi.exe
i_vqnigaysqk.exe
i_zxrpjhczus.exe
icxvpnhfax.exe
igaysqkida.sys
kecwuomhez.sys
pjhbztrmje.sys
rpkhcaupnh.exe
tolgeywqoi.exe
vqnigaysqk.exe
xsqkicausn.sys
ztrljebwuomgeywr.exe
ztrljebwuomgeywr.sys
zxrpjhczus.exe
suggestions[1].en-US
memory/748-33-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/748-133-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1016-128-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1016-134-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1392-71-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2024-154-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2028-146-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2228-59-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2356-142-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3416-124-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3416-129-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3716-45-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3736-14-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4184-120-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4384-138-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4384-150-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4528-98-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4544-106-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4544-86-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4840-21-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4860-158-0x0000000000010000-0x00000000000AB000-memory.dmp