Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
20/08/2026, 00:04
General
- Target 2026-08-19_9b938e04dcb9f7f0d8951e6fa27372ec_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 361KB
- Sample260820-acqeaaad39
- SHA256 b48195eb019be781b9d37c606434aeb48892207102e27a22bbc58fae88345256
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 32 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 60 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-19_9b938e04dcb9f7f0d8951e6fa27372ec_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-19_9b938e04dcb9f7f0d8951e6fa27372ec_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\rojgbztrljebwtom.exeC:\Temp\rojgbztrljebwtom.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bztrljebwu.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\bztrljebwu.exeC:\Temp\bztrljebwu.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bztrljebwu.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_bztrljebwu.exeC:\Temp\i_bztrljebwu.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dywqojgbyt.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\dywqojgbyt.exeC:\Temp\dywqojgbyt.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dywqojgbyt.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_dywqojgbyt.exeC:\Temp\i_dywqojgbyt.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lfdyvqogay.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\lfdyvqogay.exeC:\Temp\lfdyvqogay.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_lfdyvqogay.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_lfdyvqogay.exeC:\Temp\i_lfdyvqogay.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vpnifaysqk.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\vpnifaysqk.exeC:\Temp\vpnifaysqk.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vpnifaysqk.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_vpnifaysqk.exeC:\Temp\i_vpnifaysqk.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nhfaxsqlfd.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\nhfaxsqlfd.exeC:\Temp\nhfaxsqlfd.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nhfaxsqlfd.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_nhfaxsqlfd.exeC:\Temp\i_nhfaxsqlfd.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xspkhcausm.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\xspkhcausm.exeC:\Temp\xspkhcausm.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xspkhcausm.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_xspkhcausm.exeC:\Temp\i_xspkhcausm.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mhezxrpjhc.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\mhezxrpjhc.exeC:\Temp\mhezxrpjhc.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mhezxrpjhc.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_mhezxrpjhc.exeC:\Temp\i_mhezxrpjhc.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\uomgezwrmj.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\uomgezwrmj.exeC:\Temp\uomgezwrmj.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_uomgezwrmj.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_uomgezwrmj.exeC:\Temp\i_uomgezwrmj.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\etolgeywqo.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\etolgeywqo.exeC:\Temp\etolgeywqo.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_etolgeywqo.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_etolgeywqo.exeC:\Temp\i_etolgeywqo.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qojgbvtolg.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\qojgbvtolg.exeC:\Temp\qojgbvtolg.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qojgbvtolg.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_qojgbvtolg.exeC:\Temp\i_qojgbvtolg.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\idyvqoigay.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\idyvqoigay.exeC:\Temp\idyvqoigay.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_idyvqoigay.exe ups_ins3⤵
-
C:\Temp\i_idyvqoigay.exeC:\Temp\i_idyvqoigay.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xvpnifavqn.exe ups_run3⤵
-
C:\Temp\xvpnifavqn.exeC:\Temp\xvpnifavqn.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xvpnifavqn.exe ups_ins3⤵
-
C:\Temp\i_xvpnifavqn.exeC:\Temp\i_xvpnifavqn.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xnhfaxspki.exe ups_run3⤵
-
C:\Temp\xnhfaxspki.exeC:\Temp\xnhfaxspki.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xnhfaxspki.exe ups_ins3⤵
-
C:\Temp\i_xnhfaxspki.exeC:\Temp\i_xnhfaxspki.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pnhfzxspkh.exe ups_run3⤵
-
C:\Temp\pnhfzxspkh.exeC:\Temp\pnhfzxspkh.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pnhfzxspkh.exe ups_ins3⤵
-
C:\Temp\i_pnhfzxspkh.exeC:\Temp\i_pnhfzxspkh.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\cwupjhczus.exe ups_run3⤵
-
C:\Temp\cwupjhczus.exeC:\Temp\cwupjhczus.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_cwupjhczus.exe ups_ins3⤵
-
C:\Temp\i_cwupjhczus.exeC:\Temp\i_cwupjhczus.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\uomhezwrpj.exe ups_run3⤵
-
C:\Temp\uomhezwrpj.exeC:\Temp\uomhezwrpj.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_uomhezwrpj.exe ups_ins3⤵
-
C:\Temp\i_uomhezwrpj.exeC:\Temp\i_uomhezwrpj.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ugeywrmjeb.exe ups_run3⤵
-
C:\Temp\ugeywrmjeb.exeC:\Temp\ugeywrmjeb.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ugeywrmjeb.exe ups_ins3⤵
-
C:\Temp\i_ugeywrmjeb.exeC:\Temp\i_ugeywrmjeb.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mgeywqojgb.exe ups_run3⤵
-
C:\Temp\mgeywqojgb.exeC:\Temp\mgeywqojgb.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mgeywqojgb.exe ups_ins3⤵
-
C:\Temp\i_mgeywqojgb.exeC:\Temp\i_mgeywqojgb.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bytrljdbvt.exe ups_run3⤵
-
C:\Temp\bytrljdbvt.exeC:\Temp\bytrljdbvt.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bytrljdbvt.exe ups_ins3⤵
-
C:\Temp\i_bytrljdbvt.exeC:\Temp\i_bytrljdbvt.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1696 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Temp\rojgbztrljebwtom.sysC:\Temp\rojgbztrljebwtom.sys1⤵
- Executes dropped EXE
-
C:\Temp\ljdbvtolge.sysC:\Temp\ljdbvtolge.sys1⤵
- Executes dropped EXE
-
C:\Temp\tqlidbvtnl.sysC:\Temp\tqlidbvtnl.sys1⤵
- Executes dropped EXE
-
C:\Temp\lidbvtnlfd.sysC:\Temp\lidbvtnlfd.sys1⤵
- Executes dropped EXE
-
C:\Temp\ysqkidavsn.sysC:\Temp\ysqkidavsn.sys1⤵
- Executes dropped EXE
-
C:\Temp\icausnkfcx.sysC:\Temp\icausnkfcx.sys1⤵
- Executes dropped EXE
-
C:\Temp\xrpkhcausm.sysC:\Temp\xrpkhcausm.sys1⤵
- Executes dropped EXE
-
C:\Temp\jhbzurmbwu.sysC:\Temp\jhbzurmbwu.sys1⤵
- Executes dropped EXE
-
C:\Temp\ojhbztrlje.sysC:\Temp\ojhbztrlje.sys1⤵
- Executes dropped EXE
-
C:\Temp\bwtomgeywq.sysC:\Temp\bwtomgeywq.sys1⤵
- Executes dropped EXE
-
C:\Temp\toigaytqlj.sysC:\Temp\toigaytqlj.sys1⤵
- Executes dropped EXE
-
C:\Temp\qlavtnlfdx.sysC:\Temp\qlavtnlfdx.sys1⤵
-
C:\Temp\icavsnlfdx.sysC:\Temp\icavsnlfdx.sys1⤵
-
C:\Temp\ausnkfcxvp.sysC:\Temp\ausnkfcxvp.sys1⤵
-
C:\Temp\nhfzxspkhc.sysC:\Temp\nhfzxspkhc.sys1⤵
-
C:\Temp\mhurmkecwu.sysC:\Temp\mhurmkecwu.sys1⤵
-
C:\Temp\bzurmjecwu.sysC:\Temp\bzurmjecwu.sys1⤵
-
C:\Temp\wrljebwtom.sysC:\Temp\wrljebwtom.sys1⤵
-
C:\Temp\igaytqljdb.sysC:\Temp\igaytqljdb.sys1⤵
-
C:\Temp\lgaykidavt.sysC:\Temp\lgaykidavt.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CreateProcess.exe
bztrljebwu.exe
dywqojgbyt.exe
i_bztrljebwu.exe
i_dywqojgbyt.exe
i_lfdyvqogay.exe
i_mhezxrpjhc.exe
i_nhfaxsqlfd.exe
i_vpnifaysqk.exe
i_xspkhcausm.exe
icausnkfcx.sys
jhbzurmbwu.sys
lfdyvqogay.exe
lidbvtnlfd.sys
ljdbvtolge.sys
mhezxrpjhc.exe
nhfaxsqlfd.exe
rojgbztrljebwtom.exe
rojgbztrljebwtom.sys
tqlidbvtnl.sys
uomgezwrmj.exe
vpnifaysqk.exe
xrpkhcausm.sys
xspkhcausm.exe
ysqkidavsn.sys
suggestions[1].en-US
memory/116-72-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/560-153-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/932-157-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1096-161-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1228-107-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1440-21-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1540-133-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1584-99-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2360-46-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2508-129-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2584-121-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3392-149-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3540-87-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3564-145-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4300-137-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4308-125-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4308-34-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4736-141-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4796-14-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4796-31-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5088-58-0x0000000000010000-0x00000000000AB000-memory.dmp