Analysis
- max time kernel
150s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
03/09/2026, 23:21
General
- Target 2026-09-03_c3c561ac5c8c1ac01e7a9c4762091a72_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 361KB
- Sample260903-3b3bnstyhs
- SHA256 69d12cdcf08620bf6241810c3dfdbdcba0f6bf11e4ad32141996d4eabebf1b54
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 32 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 62 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-03_c3c561ac5c8c1ac01e7a9c4762091a72_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-03_c3c561ac5c8c1ac01e7a9c4762091a72_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\ezxrpjhbzurmkecw.exeC:\Temp\ezxrpjhbzurmkecw.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pjhczusmke.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\pjhczusmke.exeC:\Temp\pjhczusmke.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pjhczusmke.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_pjhczusmke.exeC:\Temp\i_pjhczusmke.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jebwuomgey.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jebwuomgey.exeC:\Temp\jebwuomgey.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jebwuomgey.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jebwuomgey.exeC:\Temp\i_jebwuomgey.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bztrdbwrlj.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\bztrdbwrlj.exeC:\Temp\bztrdbwrlj.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bztrdbwrlj.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_bztrdbwrlj.exeC:\Temp\i_bztrdbwrlj.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\olgdywqoig.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\olgdywqoig.exeC:\Temp\olgdywqoig.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_olgdywqoig.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_olgdywqoig.exeC:\Temp\i_olgdywqoig.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bvtnlfdvqo.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\bvtnlfdvqo.exeC:\Temp\bvtnlfdvqo.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bvtnlfdvqo.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_bvtnlfdvqo.exeC:\Temp\i_bvtnlfdvqo.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nifaysqkic.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\nifaysqkic.exeC:\Temp\nifaysqkic.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nifaysqkic.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_nifaysqkic.exeC:\Temp\i_nifaysqkic.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xvpnhfaupn.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\xvpnhfaupn.exeC:\Temp\xvpnhfaupn.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xvpnhfaupn.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_xvpnhfaupn.exeC:\Temp\i_xvpnhfaupn.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kfcxvpnhfz.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\kfcxvpnhfz.exeC:\Temp\kfcxvpnhfz.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kfcxvpnhfz.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_kfcxvpnhfz.exeC:\Temp\i_kfcxvpnhfz.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pmhfzxrpjh.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\pmhfzxrpjh.exeC:\Temp\pmhfzxrpjh.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pmhfzxrpjh.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_pmhfzxrpjh.exeC:\Temp\i_pmhfzxrpjh.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jhbztrmjec.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jhbztrmjec.exeC:\Temp\jhbztrmjec.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jhbztrmjec.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jhbztrmjec.exeC:\Temp\i_jhbztrmjec.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ywrojhbztr.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ywrojhbztr.exeC:\Temp\ywrojhbztr.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ywrojhbztr.exe ups_ins3⤵
-
C:\Temp\i_ywrojhbztr.exeC:\Temp\i_ywrojhbztr.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ywqojgbztr.exe ups_run3⤵
-
C:\Temp\ywqojgbztr.exeC:\Temp\ywqojgbztr.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ywqojgbztr.exe ups_ins3⤵
-
C:\Temp\i_ywqojgbztr.exeC:\Temp\i_ywqojgbztr.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qoigaytqlj.exe ups_run3⤵
-
C:\Temp\qoigaytqlj.exeC:\Temp\qoigaytqlj.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qoigaytqlj.exe ups_ins3⤵
-
C:\Temp\i_qoigaytqlj.exeC:\Temp\i_qoigaytqlj.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\idavtnlfdx.exe ups_run3⤵
-
C:\Temp\idavtnlfdx.exeC:\Temp\idavtnlfdx.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_idavtnlfdx.exe ups_ins3⤵
-
C:\Temp\i_idavtnlfdx.exeC:\Temp\i_idavtnlfdx.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\axspkicaus.exe ups_run3⤵
-
C:\Temp\axspkicaus.exeC:\Temp\axspkicaus.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_axspkicaus.exe ups_ins3⤵
-
C:\Temp\i_axspkicaus.exeC:\Temp\i_axspkicaus.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\cxvpnhfzxs.exe ups_run3⤵
-
C:\Temp\cxvpnhfzxs.exeC:\Temp\cxvpnhfzxs.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_cxvpnhfzxs.exe ups_ins3⤵
-
C:\Temp\i_cxvpnhfzxs.exeC:\Temp\i_cxvpnhfzxs.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\usmkecxupm.exe ups_run3⤵
-
C:\Temp\usmkecxupm.exeC:\Temp\usmkecxupm.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_usmkecxupm.exe ups_ins3⤵
-
C:\Temp\i_usmkecxupm.exeC:\Temp\i_usmkecxupm.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rmkecwuomh.exe ups_run3⤵
-
C:\Temp\rmkecwuomh.exeC:\Temp\rmkecwuomh.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rmkecwuomh.exe ups_ins3⤵
-
C:\Temp\i_rmkecwuomh.exeC:\Temp\i_rmkecwuomh.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jebwuomgey.exe ups_run3⤵
-
C:\Temp\jebwuomgey.exeC:\Temp\jebwuomgey.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jebwuomgey.exe ups_ins3⤵
-
C:\Temp\i_jebwuomgey.exeC:\Temp\i_jebwuomgey.exe ups_ins4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ljeytrljeb.exe ups_run3⤵
-
C:\Temp\ljeytrljeb.exeC:\Temp\ljeytrljeb.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1784 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Temp\ezxrpjhbzurmkecw.sysC:\Temp\ezxrpjhbzurmkecw.sys1⤵
- Executes dropped EXE
-
C:\Temp\zxrpjhbzmj.sysC:\Temp\zxrpjhbzmj.sys1⤵
- Executes dropped EXE
-
C:\Temp\mgezwrojhb.sysC:\Temp\mgezwrojhb.sys1⤵
- Executes dropped EXE
-
C:\Temp\ytrljdbvto.sysC:\Temp\ytrljdbvto.sys1⤵
- Executes dropped EXE
-
C:\Temp\igaytqljdb.sysC:\Temp\igaytqljdb.sys1⤵
- Executes dropped EXE
-
C:\Temp\davlfdxvqn.sysC:\Temp\davlfdxvqn.sys1⤵
- Executes dropped EXE
-
C:\Temp\qkicausnkf.sysC:\Temp\qkicausnkf.sys1⤵
- Executes dropped EXE
-
C:\Temp\spkhcausmk.sysC:\Temp\spkhcausmk.sys1⤵
- Executes dropped EXE
-
C:\Temp\wupmhezxrp.sysC:\Temp\wupmhezxrp.sys1⤵
- Executes dropped EXE
-
C:\Temp\uomhezxrpj.sysC:\Temp\uomhezxrpj.sys1⤵
- Executes dropped EXE
-
C:\Temp\rljebwuomg.sysC:\Temp\rljebwuomg.sys1⤵
- Executes dropped EXE
-
C:\Temp\geywqoigby.sysC:\Temp\geywqoigby.sys1⤵
-
C:\Temp\bvtnlgdyvq.sysC:\Temp\bvtnlgdyvq.sys1⤵
-
C:\Temp\qoigaysqli.sysC:\Temp\qoigaysqli.sys1⤵
-
C:\Temp\snlfdxvpni.sysC:\Temp\snlfdxvpni.sys1⤵
-
C:\Temp\kicausnkfd.sysC:\Temp\kicausnkfd.sys1⤵
-
C:\Temp\fzxspkhcau.sysC:\Temp\fzxspkhcau.sys1⤵
-
C:\Temp\hfrpjhczur.sysC:\Temp\hfrpjhczur.sys1⤵
-
C:\Temp\zwrojhbztr.sysC:\Temp\zwrojhbztr.sys1⤵
-
C:\Temp\wrojhbztrl.sysC:\Temp\wrojhbztrl.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CreateProcess.exe
bvtnlfdvqo.exe
bztrdbwrlj.exe
davlfdxvqn.sys
ezxrpjhbzurmkecw.exe
ezxrpjhbzurmkecw.sys
i_bvtnlfdvqo.exe
i_bztrdbwrlj.exe
i_jebwuomgey.exe
i_nifaysqkic.exe
i_olgdywqoig.exe
i_pjhczusmke.exe
i_xvpnhfaupn.exe
igaytqljdb.sys
jebwuomgey.exe
kfcxvpnhfz.exe
mgezwrojhb.sys
nifaysqkic.exe
olgdywqoig.exe
pjhczusmke.exe
qkicausnkf.sys
spkhcausmk.sys
xvpnhfaupn.exe
ytrljdbvto.sys
zxrpjhbzmj.sys
suggestions[1].en-US
memory/612-106-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/612-60-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/760-131-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/932-21-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1428-14-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1496-159-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1796-143-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2312-151-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2504-147-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3052-155-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3152-98-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3416-135-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3816-74-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3892-45-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4264-127-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4364-123-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4572-33-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4752-139-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4864-163-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4968-86-0x0000000000010000-0x00000000000AB000-memory.dmp