Analysis
- max time kernel
149s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
02/10/2026, 06:32
General
- Target 2026-10-01_a9337bc59c6973b7c5121919c8e602b4_amadey_darkgate_elex_smoke-loader_stop.exe
- Size 384KB
- Sample261002-hartbssflc
- SHA256 c8997b2fb3399e77c702eeb96ac3542de6a679d4d331d7789d89f18db23ab697
Score
10/10
Malware Config
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 35 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 60 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-01_a9337bc59c6973b7c5121919c8e602b4_amadey_darkgate_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-01_a9337bc59c6973b7c5121919c8e602b4_amadey_darkgate_elex_smoke-loader_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\lfdxvpnicavsnkfd.exeC:\Temp\lfdxvpnicavsnkfd.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nifaysnifa.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\nifaysnifa.exeC:\Temp\nifaysnifa.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nifaysnifa.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_nifaysnifa.exeC:\Temp\i_nifaysnifa.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\aupnhfzxsp.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\aupnhfzxsp.exeC:\Temp\aupnhfzxsp.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_aupnhfzxsp.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_aupnhfzxsp.exeC:\Temp\i_aupnhfzxsp.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zxrpjhczur.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\zxrpjhczur.exeC:\Temp\zxrpjhczur.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zxrpjhczur.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_zxrpjhczur.exeC:\Temp\i_zxrpjhczur.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rpjhczupjh.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\rpjhczupjh.exeC:\Temp\rpjhczupjh.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rpjhczupjh.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_rpjhczupjh.exeC:\Temp\i_rpjhczupjh.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ezwrojhbzt.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ezwrojhbzt.exeC:\Temp\ezwrojhbzt.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ezwrojhbzt.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ezwrojhbzt.exeC:\Temp\i_ezwrojhbzt.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ljdbwtomge.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ljdbwtomge.exeC:\Temp\ljdbwtomge.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ljdbwtomge.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ljdbwtomge.exeC:\Temp\i_ljdbwtomge.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qlgbvtnlfd.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\qlgbvtnlfd.exeC:\Temp\qlgbvtnlfd.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qlgbvtnlfd.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_qlgbvtnlfd.exeC:\Temp\i_qlgbvtnlfd.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\davtnlxvqn.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\davtnlxvqn.exeC:\Temp\davtnlxvqn.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_davtnlxvqn.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_davtnlxvqn.exeC:\Temp\i_davtnlxvqn.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\sqkfdxvqni.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\sqkfdxvqni.exeC:\Temp\sqkfdxvqni.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_sqkfdxvqni.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_sqkfdxvqni.exeC:\Temp\i_sqkfdxvqni.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kfcxvpnhfz.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\kfcxvpnhfz.exeC:\Temp\kfcxvpnhfz.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kfcxvpnhfz.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_kfcxvpnhfz.exeC:\Temp\i_kfcxvpnhfz.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xupnhzxrpj.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\xupnhzxrpj.exeC:\Temp\xupnhzxrpj.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xupnhzxrpj.exe ups_ins3⤵
-
C:\Temp\i_xupnhzxrpj.exeC:\Temp\i_xupnhzxrpj.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xrpjhurmke.exe ups_run3⤵
-
C:\Temp\xrpjhurmke.exeC:\Temp\xrpjhurmke.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xrpjhurmke.exe ups_ins3⤵
-
C:\Temp\i_xrpjhurmke.exeC:\Temp\i_xrpjhurmke.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mgezwrojhb.exe ups_run3⤵
-
C:\Temp\mgezwrojhb.exeC:\Temp\mgezwrojhb.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mgezwrojhb.exe ups_ins3⤵
-
C:\Temp\i_mgezwrojhb.exeC:\Temp\i_mgezwrojhb.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bwtomgeywq.exe ups_run3⤵
-
C:\Temp\bwtomgeywq.exeC:\Temp\bwtomgeywq.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bwtomgeywq.exe ups_ins3⤵
-
C:\Temp\i_bwtomgeywq.exeC:\Temp\i_bwtomgeywq.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\oigaytqljd.exe ups_run3⤵
-
C:\Temp\oigaytqljd.exeC:\Temp\oigaytqljd.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_oigaytqljd.exe ups_ins3⤵
-
C:\Temp\i_oigaytqljd.exeC:\Temp\i_oigaytqljd.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jdyoigaysq.exe ups_run3⤵
-
C:\Temp\jdyoigaysq.exeC:\Temp\jdyoigaysq.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jdyoigaysq.exe ups_ins3⤵
-
C:\Temp\i_jdyoigaysq.exeC:\Temp\i_jdyoigaysq.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\tnlfdxvqni.exe ups_run3⤵
-
C:\Temp\tnlfdxvqni.exeC:\Temp\tnlfdxvqni.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_tnlfdxvqni.exe ups_ins3⤵
-
C:\Temp\i_tnlfdxvqni.exeC:\Temp\i_tnlfdxvqni.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\faxsnkfcxv.exe ups_run3⤵
-
C:\Temp\faxsnkfcxv.exeC:\Temp\faxsnkfcxv.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_faxsnkfcxv.exe ups_ins3⤵
-
C:\Temp\i_faxsnkfcxv.exeC:\Temp\i_faxsnkfcxv.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xrpkhcausm.exe ups_run3⤵
-
C:\Temp\xrpkhcausm.exeC:\Temp\xrpkhcausm.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xrpkhcausm.exe ups_ins3⤵
-
C:\Temp\i_xrpkhcausm.exeC:\Temp\i_xrpkhcausm.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3476 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Temp\lfdxvpnicavsnkfd.sysC:\Temp\lfdxvpnicavsnkfd.sys1⤵
- Executes dropped EXE
-
C:\Temp\pkfcxvpnhf.sysC:\Temp\pkfcxvpnhf.sys1⤵
- Executes dropped EXE
-
C:\Temp\smkecxupnh.sysC:\Temp\smkecxupnh.sys1⤵
- Executes dropped EXE
-
C:\Temp\cxrpjhbzur.sysC:\Temp\cxrpjhbzur.sys1⤵
- Executes dropped EXE
-
C:\Temp\pjhbzurmje.sysC:\Temp\pjhbzurmje.sys1⤵
- Executes dropped EXE
-
C:\Temp\wqojgbytrl.sysC:\Temp\wqojgbytrl.sys1⤵
- Executes dropped EXE
-
C:\Temp\gbytqljdbv.sysC:\Temp\gbytqljdbv.sys1⤵
- Executes dropped EXE
-
C:\Temp\nlgdyvqoig.sysC:\Temp\nlgdyvqoig.sys1⤵
- Executes dropped EXE
-
C:\Temp\dxvqnigays.sysC:\Temp\dxvqnigays.sys1⤵
- Executes dropped EXE
-
C:\Temp\spkicausnk.sysC:\Temp\spkicausnk.sys1⤵
- Executes dropped EXE
-
C:\Temp\pkfcxupfzx.sysC:\Temp\pkfcxupfzx.sys1⤵
- Executes dropped EXE
-
C:\Temp\ecxupnhfzx.sysC:\Temp\ecxupnhfzx.sys1⤵
-
C:\Temp\trmjecwuom.sysC:\Temp\trmjecwuom.sys1⤵
-
C:\Temp\mgezwrojhb.sysC:\Temp\mgezwrojhb.sys1⤵
-
C:\Temp\gbztrlbvto.sysC:\Temp\gbztrlbvto.sys1⤵
-
C:\Temp\qoigbytrlj.sysC:\Temp\qoigbytrlj.sys1⤵
-
C:\Temp\aysqlidbvt.sysC:\Temp\aysqlidbvt.sys1⤵
-
C:\Temp\qkicavsnlf.sysC:\Temp\qkicavsnlf.sys1⤵
-
C:\Temp\nkfvpnhfzx.sysC:\Temp\nkfvpnhfzx.sys1⤵
-
C:\Temp\czusmkecxu.sysC:\Temp\czusmkecxu.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CreateProcess.exe
aupnhfzxsp.exe
cxrpjhbzur.sys
davtnlxvqn.exe
ezwrojhbzt.exe
gbytqljdbv.sys
i_aupnhfzxsp.exe
i_ezwrojhbzt.exe
i_ljdbwtomge.exe
i_nifaysnifa.exe
i_qlgbvtnlfd.exe
i_rpjhczupjh.exe
i_zxrpjhczur.exe
lfdxvpnicavsnkfd.exe
lfdxvpnicavsnkfd.sys
ljdbwtomge.exe
nifaysnifa.exe
nlgdyvqoig.sys
pjhbzurmje.sys
pkfcxvpnhf.sys
qlgbvtnlfd.exe
rpjhczupjh.exe
smkecxupnh.sys
wqojgbytrl.sys
zxrpjhczur.exe
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
suggestions[1].en-US
memory/412-128-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/624-140-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/752-132-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/880-21-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1548-148-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1564-76-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1720-8-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1784-124-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1816-62-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1920-88-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2112-33-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2320-136-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2584-45-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3224-100-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3292-156-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3444-160-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3504-152-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3540-120-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3668-106-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3928-144-0x0000000000010000-0x00000000000AB000-memory.dmp