Analysis
- max time kernel
149s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
24/10/2026, 03:32
General
- Target 2026-10-22_99be23ca88eaa1a3d62cc7b305f98e5b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 376KB
- Sample261024-d3lesshv7q
- SHA256 5c061e4df6124051680d7110a84e62783d4b72802da103f5bf63a315856c21a3
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 43 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 31 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 62 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-22_99be23ca88eaa1a3d62cc7b305f98e5b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_99be23ca88eaa1a3d62cc7b305f98e5b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\ytrljdbwtolgeywq.exeC:\Temp\ytrljdbwtolgeywq.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gbytrlgbyt.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\gbytrlgbyt.exeC:\Temp\gbytrlgbyt.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gbytrlgbyt.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_gbytrlgbyt.exeC:\Temp\i_gbytrlgbyt.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fdyvqnigay.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\fdyvqnigay.exeC:\Temp\fdyvqnigay.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fdyvqnigay.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_fdyvqnigay.exeC:\Temp\i_fdyvqnigay.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nlfdxvpifa.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\nlfdxvpifa.exeC:\Temp\nlfdxvpifa.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nlfdxvpifa.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_nlfdxvpifa.exeC:\Temp\i_nlfdxvpifa.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\aysqkausnk.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\aysqkausnk.exeC:\Temp\aysqkausnk.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_aysqkausnk.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_aysqkausnk.exeC:\Temp\i_aysqkausnk.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kfcxvmkecx.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\kfcxvmkecx.exeC:\Temp\kfcxvmkecx.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kfcxvmkecx.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_kfcxvmkecx.exeC:\Temp\i_kfcxvmkecx.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zusmkecxup.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\zusmkecxup.exeC:\Temp\zusmkecxup.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zusmkecxup.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_zusmkecxup.exeC:\Temp\i_zusmkecxup.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jecwupjecw.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jecwupjecw.exeC:\Temp\jecwupjecw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jecwupjecw.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jecwupjecw.exeC:\Temp\i_jecwupjecw.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\erojgbztrl.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\erojgbztrl.exeC:\Temp\erojgbztrl.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_erojgbztrl.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_erojgbztrl.exeC:\Temp\i_erojgbztrl.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\olgeywqojg.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\olgeywqojg.exeC:\Temp\olgeywqojg.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_olgeywqojg.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_olgeywqojg.exeC:\Temp\i_olgeywqojg.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gdywqoigay.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\gdywqoigay.exeC:\Temp\gdywqoigay.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gdywqoigay.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_gdywqoigay.exeC:\Temp\i_gdywqoigay.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\yvqnifaysq.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\yvqnifaysq.exeC:\Temp\yvqnifaysq.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_yvqnifaysq.exe ups_ins3⤵
-
C:\Temp\i_yvqnifaysq.exeC:\Temp\i_yvqnifaysq.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ankfdxvpnh.exe ups_run3⤵
-
C:\Temp\ankfdxvpnh.exeC:\Temp\ankfdxvpnh.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ankfdxvpnh.exe ups_ins3⤵
-
C:\Temp\i_ankfdxvpnh.exeC:\Temp\i_ankfdxvpnh.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vpnhfzxspk.exe ups_run3⤵
-
C:\Temp\vpnhfzxspk.exeC:\Temp\vpnhfzxspk.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vpnhfzxspk.exe ups_ins3⤵
-
C:\Temp\i_vpnhfzxspk.exeC:\Temp\i_vpnhfzxspk.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kecwupmhca.exe ups_run3⤵
-
C:\Temp\kecwupmhca.exeC:\Temp\kecwupmhca.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kecwupmhca.exe ups_ins3⤵
-
C:\Temp\i_kecwupmhca.exeC:\Temp\i_kecwupmhca.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zwrpjhbztr.exe ups_run3⤵
-
C:\Temp\zwrpjhbztr.exeC:\Temp\zwrpjhbztr.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zwrpjhbztr.exe ups_ins3⤵
-
C:\Temp\i_zwrpjhbztr.exeC:\Temp\i_zwrpjhbztr.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zwjhbztrmj.exe ups_run3⤵
-
C:\Temp\zwjhbztrmj.exeC:\Temp\zwjhbztrmj.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zwjhbztrmj.exe ups_ins3⤵
-
C:\Temp\i_zwjhbztrmj.exeC:\Temp\i_zwjhbztrmj.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\trljeztrlj.exe ups_run3⤵
-
C:\Temp\trljeztrlj.exeC:\Temp\trljeztrlj.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_trljeztrlj.exe ups_ins3⤵
-
C:\Temp\i_trljeztrlj.exeC:\Temp\i_trljeztrlj.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\oigaytqljd.exe ups_run3⤵
-
C:\Temp\oigaytqljd.exeC:\Temp\oigaytqljd.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_oigaytqljd.exe ups_ins3⤵
-
C:\Temp\i_oigaytqljd.exeC:\Temp\i_oigaytqljd.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fdyvqnigav.exe ups_run3⤵
-
C:\Temp\fdyvqnigav.exeC:\Temp\fdyvqnigav.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fdyvqnigav.exe ups_ins3⤵
-
C:\Temp\i_fdyvqnigav.exeC:\Temp\i_fdyvqnigav.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ifaysqcaus.exe ups_run3⤵
-
C:\Temp\ifaysqcaus.exeC:\Temp\ifaysqcaus.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3444 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Temp\ytrljdbwtolgeywq.sysC:\Temp\ytrljdbwtolgeywq.sys1⤵
- Executes dropped EXE
-
C:\Temp\tnlgdywqoi.sysC:\Temp\tnlgdywqoi.sys1⤵
- Executes dropped EXE
-
C:\Temp\fdyvqoigay.sysC:\Temp\fdyvqoigay.sys1⤵
- Executes dropped EXE
-
C:\Temp\kicavsnlfa.sysC:\Temp\kicavsnlfa.sys1⤵
- Executes dropped EXE
-
C:\Temp\spkicausnk.sysC:\Temp\spkicausnk.sys1⤵
- Executes dropped EXE
-
C:\Temp\hczurmkecw.sysC:\Temp\hczurmkecw.sys1⤵
- Executes dropped EXE
-
C:\Temp\cxrpbztrmj.sysC:\Temp\cxrpbztrmj.sys1⤵
- Executes dropped EXE
-
C:\Temp\mjecwuomge.sysC:\Temp\mjecwuomge.sys1⤵
- Executes dropped EXE
-
C:\Temp\ytrljdbwto.sysC:\Temp\ytrljdbwto.sys1⤵
- Executes dropped EXE
-
C:\Temp\qlfdyvtnlg.sysC:\Temp\qlfdyvtnlg.sys1⤵
- Executes dropped EXE
-
C:\Temp\nlxvqnifay.sysC:\Temp\nlxvqnifay.sys1⤵
- Executes dropped EXE
-
C:\Temp\lfaysqkida.sysC:\Temp\lfaysqkida.sys1⤵
-
C:\Temp\causnkfcxv.sysC:\Temp\causnkfcxv.sys1⤵
-
C:\Temp\upkhcausmk.sysC:\Temp\upkhcausmk.sys1⤵
-
C:\Temp\smkeuomhez.sysC:\Temp\smkeuomhez.sys1⤵
-
C:\Temp\gezwrojhbz.sysC:\Temp\gezwrojhbz.sys1⤵
-
C:\Temp\eywrojhbzt.sysC:\Temp\eywrojhbzt.sys1⤵
-
C:\Temp\wqoigaytql.sysC:\Temp\wqoigaytql.sys1⤵
-
C:\Temp\ytqljdbnlf.sysC:\Temp\ytqljdbnlf.sys1⤵
-
C:\Temp\tnlfdxvqni.sysC:\Temp\tnlfdxvqni.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CreateProcess.exe
aysqkausnk.exe
cxrpbztrmj.sys
erojgbztrl.exe
fdyvqnigay.exe
fdyvqoigay.sys
gbytrlgbyt.exe
hczurmkecw.sys
i_aysqkausnk.exe
i_fdyvqnigay.exe
i_gbytrlgbyt.exe
i_jecwupjecw.exe
i_kfcxvmkecx.exe
i_nlfdxvpifa.exe
i_zusmkecxup.exe
jecwupjecw.exe
kfcxvmkecx.exe
kicavsnlfa.sys
mjecwuomge.sys
nlfdxvpifa.exe
spkicausnk.sys
tnlgdywqoi.sys
ytrljdbwtolgeywq.exe
ytrljdbwtolgeywq.sys
zusmkecxup.exe
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
suggestions[1].en-US
memory/1044-152-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1452-165-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1624-81-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1796-132-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1800-161-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1800-156-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1968-67-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2820-19-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3020-140-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3304-26-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3728-136-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3956-111-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4132-105-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4336-144-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4416-93-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4424-128-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4476-148-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4540-50-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4880-38-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4904-169-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5072-160-0x0000000000010000-0x00000000000AB000-memory.dmp