Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
06/10/2026, 12:20
General
- Target 2026-10-06_73f57dc0b88ad7a4dfe29270d1c5bce2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 376KB
- Sample261006-phyeeays2l
- SHA256 cb5fc887f588410911cc333369cce1310bdd4fe003f878b052abb707313e27fe
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 31 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 19 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 60 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-06_73f57dc0b88ad7a4dfe29270d1c5bce2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-06_73f57dc0b88ad7a4dfe29270d1c5bce2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\aysqlfdxsqkicxvp.exeC:\Temp\aysqlfdxsqkicxvp.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\favsnlfdxv.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\favsnlfdxv.exeC:\Temp\favsnlfdxv.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_favsnlfdxv.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_favsnlfdxv.exeC:\Temp\i_favsnlfdxv.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\cxupnhcxvp.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\cxupnhcxvp.exeC:\Temp\cxupnhcxvp.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_cxupnhcxvp.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_cxupnhcxvp.exeC:\Temp\i_cxupnhcxvp.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ausmkecxup.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ausmkecxup.exeC:\Temp\ausmkecxup.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ausmkecxup.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ausmkecxup.exeC:\Temp\i_ausmkecxup.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\cwrpjhbzur.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\cwrpjhbzur.exeC:\Temp\cwrpjhbzur.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_cwrpjhbzur.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_cwrpjhbzur.exeC:\Temp\i_cwrpjhbzur.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\geywrpjhbw.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\geywrpjhbw.exeC:\Temp\geywrpjhbw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_geywrpjhbw.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_geywrpjhbw.exeC:\Temp\i_geywrpjhbw.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\geywolgeyw.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\geywolgeyw.exeC:\Temp\geywolgeyw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_geywolgeyw.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_geywolgeyw.exeC:\Temp\i_geywolgeyw.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\oigaytqljd.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\oigaytqljd.exeC:\Temp\oigaytqljd.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_oigaytqljd.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_oigaytqljd.exeC:\Temp\i_oigaytqljd.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\tnlfdxvqni.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\tnlfdxvqni.exeC:\Temp\tnlfdxvqni.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_tnlfdxvqni.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_tnlfdxvqni.exeC:\Temp\i_tnlfdxvqni.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lfdxvpnifa.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\lfdxvpnifa.exeC:\Temp\lfdxvpnifa.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_lfdxvpnifa.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_lfdxvpnifa.exeC:\Temp\i_lfdxvpnifa.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\spkicausmk.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\spkicausmk.exeC:\Temp\spkicausmk.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_spkicausmk.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_spkicausmk.exeC:\Temp\i_spkicausmk.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zusmkecwup.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\zusmkecwup.exeC:\Temp\zusmkecwup.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zusmkecwup.exe ups_ins3⤵
-
C:\Temp\i_zusmkecwup.exeC:\Temp\i_zusmkecwup.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mkecwupmhe.exe ups_run3⤵
-
C:\Temp\mkecwupmhe.exeC:\Temp\mkecwupmhe.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mkecwupmhe.exe ups_ins3⤵
-
C:\Temp\i_mkecwupmhe.exeC:\Temp\i_mkecwupmhe.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\tomgezwjhb.exe ups_run3⤵
-
C:\Temp\tomgezwjhb.exeC:\Temp\tomgezwjhb.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_tomgezwjhb.exe ups_ins3⤵
-
C:\Temp\i_tomgezwjhb.exeC:\Temp\i_tomgezwjhb.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\geywrojhbz.exe ups_run3⤵
-
C:\Temp\geywrojhbz.exeC:\Temp\geywrojhbz.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_geywrojhbz.exe ups_ins3⤵
-
C:\Temp\i_geywrojhbz.exeC:\Temp\i_geywrojhbz.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\toigaytqlj.exe ups_run3⤵
-
C:\Temp\toigaytqlj.exeC:\Temp\toigaytqlj.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_toigaytqlj.exe ups_ins3⤵
-
C:\Temp\i_toigaytqlj.exeC:\Temp\i_toigaytqlj.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dbvtnlfdyv.exe ups_run3⤵
-
C:\Temp\dbvtnlfdyv.exeC:\Temp\dbvtnlfdyv.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dbvtnlfdyv.exe ups_ins3⤵
-
C:\Temp\i_dbvtnlfdyv.exeC:\Temp\i_dbvtnlfdyv.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\tndxvqkfdx.exe ups_run3⤵
-
C:\Temp\tndxvqkfdx.exeC:\Temp\tndxvqkfdx.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_tndxvqkfdx.exe ups_ins3⤵
-
C:\Temp\i_tndxvqkfdx.exeC:\Temp\i_tndxvqkfdx.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\usnkfcxvpn.exe ups_run3⤵
-
C:\Temp\usnkfcxvpn.exeC:\Temp\usnkfcxvpn.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_usnkfcxvpn.exe ups_ins3⤵
-
C:\Temp\i_usnkfcxvpn.exeC:\Temp\i_usnkfcxvpn.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fzxspkhcau.exe ups_run3⤵
-
C:\Temp\fzxspkhcau.exeC:\Temp\fzxspkhcau.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fzxspkhcau.exe ups_ins3⤵
-
C:\Temp\i_fzxspkhcau.exeC:\Temp\i_fzxspkhcau.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2180 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Temp\aysqlfdxsqkicxvp.sysC:\Temp\aysqlfdxsqkicxvp.sys1⤵
- Executes dropped EXE
-
C:\Temp\nhfaxsqkic.sysC:\Temp\nhfaxsqkic.sys1⤵
- Executes dropped EXE
-
C:\Temp\pnhfzpjhcz.sysC:\Temp\pnhfzpjhcz.sys1⤵
- Executes dropped EXE
-
C:\Temp\rmkecwuomh.sysC:\Temp\rmkecwuomh.sys1⤵
- Executes dropped EXE
-
C:\Temp\rpjhbztrmj.sysC:\Temp\rpjhbztrmj.sys1⤵
- Executes dropped EXE
-
C:\Temp\rljdbvtolg.sysC:\Temp\rljdbvtolg.sys1⤵
- Executes dropped EXE
-
C:\Temp\vtolgdywqo.sysC:\Temp\vtolgdywqo.sys1⤵
- Executes dropped EXE
-
C:\Temp\lgdywqoiga.sysC:\Temp\lgdywqoiga.sys1⤵
- Executes dropped EXE
-
C:\Temp\vqnigaysqk.sysC:\Temp\vqnigaysqk.sys1⤵
- Executes dropped EXE
-
C:\Temp\causnkfdxv.sysC:\Temp\causnkfdxv.sys1⤵
- Executes dropped EXE
-
C:\Temp\kecxupnhfz.sysC:\Temp\kecxupnhfz.sys1⤵
- Executes dropped EXE
-
C:\Temp\ezxrpjhczu.sysC:\Temp\ezxrpjhczu.sys1⤵
-
C:\Temp\ezwrpjhbzu.sysC:\Temp\ezwrpjhbzu.sys1⤵
-
C:\Temp\rljdbwtomg.sysC:\Temp\rljdbwtomg.sys1⤵
-
C:\Temp\bytrljdbvt.sysC:\Temp\bytrljdbvt.sys1⤵
-
C:\Temp\vqoigaykid.sysC:\Temp\vqoigaykid.sys1⤵
-
C:\Temp\dxvqnigays.sysC:\Temp\dxvqnigays.sys1⤵
-
C:\Temp\fdxvpnifax.sysC:\Temp\fdxvpnifax.sys1⤵
-
C:\Temp\pkecxupnhf.sysC:\Temp\pkecxupnhf.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ausmkecxup.exe
aysqlfdxsqkicxvp.exe
aysqlfdxsqkicxvp.sys
cwrpjhbzur.exe
cxupnhcxvp.exe
favsnlfdxv.exe
geywolgeyw.exe
geywrpjhbw.exe
i_ausmkecxup.exe
i_cwrpjhbzur.exe
i_cxupnhcxvp.exe
i_favsnlfdxv.exe
i_geywolgeyw.exe
i_geywrpjhbw.exe
i_oigaytqljd.exe
lgdywqoiga.sys
nhfaxsqkic.sys
oigaytqljd.exe
pnhfzpjhcz.sys
rljdbvtolg.sys
rmkecwuomh.sys
rpjhbztrmj.sys
tnlfdxvqni.exe
vtolgdywqo.sys
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
suggestions[1].en-US
CreateProcess.exe
memory/396-148-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/444-132-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/536-165-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/560-93-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/704-136-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1260-81-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1652-38-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1652-140-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2056-144-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2264-156-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2264-161-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3424-50-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4052-111-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4432-26-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4472-12-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4672-105-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5144-152-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5304-67-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5472-160-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6136-128-0x0000000000010000-0x00000000000AB000-memory.dmp