Analysis
- max time kernel
149s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
26/10/2026, 03:50
General
- Target 2026-10-26_47b121c2532b9f2dc9d892c26dd6d7d5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 361KB
- Sample261026-eec9ysds5p
- SHA256 a67bae26494183613a3867810ba05ce57efd34d63a19f4df964296b23b74e0ab
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 43 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 35 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 62 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-26_47b121c2532b9f2dc9d892c26dd6d7d5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-26_47b121c2532b9f2dc9d892c26dd6d7d5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\nlfdxvifaysqkica.exeC:\Temp\nlfdxvifaysqkica.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nigaysqkid.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\nigaysqkid.exeC:\Temp\nigaysqkid.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nigaysqkid.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_nigaysqkid.exeC:\Temp\i_nigaysqkid.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\usnkfdxvpn.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\usnkfdxvpn.exeC:\Temp\usnkfdxvpn.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_usnkfdxvpn.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_usnkfdxvpn.exeC:\Temp\i_usnkfdxvpn.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fzxspkicxu.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\fzxspkicxu.exeC:\Temp\fzxspkicxu.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fzxspkicxu.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_fzxspkicxu.exeC:\Temp\i_fzxspkicxu.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\upmhfzxrpk.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\upmhfzxrpk.exeC:\Temp\upmhfzxrpk.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_upmhfzxrpk.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_upmhfzxrpk.exeC:\Temp\i_upmhfzxrpk.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ecwuomgezu.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ecwuomgezu.exeC:\Temp\ecwuomgezu.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ecwuomgezu.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ecwuomgezu.exeC:\Temp\i_ecwuomgezu.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bztrmjebwu.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\bztrmjebwu.exeC:\Temp\bztrmjebwu.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bztrmjebwu.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_bztrmjebwu.exeC:\Temp\i_bztrmjebwu.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ljdbwtomgb.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ljdbwtomgb.exeC:\Temp\ljdbwtomgb.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ljdbwtomgb.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ljdbwtomgb.exeC:\Temp\i_ljdbwtomgb.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ytqljdbvtn.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ytqljdbvtn.exeC:\Temp\ytqljdbvtn.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ytqljdbvtn.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ytqljdbvtn.exeC:\Temp\i_ytqljdbvtn.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kicavsnlfa.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\kicavsnlfa.exeC:\Temp\kicavsnlfa.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kicavsnlfa.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_kicavsnlfa.exeC:\Temp\i_kicavsnlfa.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nifavpnifa.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\nifavpnifa.exeC:\Temp\nifavpnifa.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nifavpnifa.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_nifavpnifa.exeC:\Temp\i_nifavpnifa.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fcxvpnhfax.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\fcxvpnhfax.exeC:\Temp\fcxvpnhfax.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fcxvpnhfax.exe ups_ins3⤵
-
C:\Temp\i_fcxvpnhfax.exeC:\Temp\i_fcxvpnhfax.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zusmkecxup.exe ups_run3⤵
-
C:\Temp\zusmkecxup.exeC:\Temp\zusmkecxup.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zusmkecxup.exe ups_ins3⤵
-
C:\Temp\i_zusmkecxup.exeC:\Temp\i_zusmkecxup.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\urmkecwupm.exe ups_run3⤵
-
C:\Temp\urmkecwupm.exeC:\Temp\urmkecwupm.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_urmkecwupm.exe ups_ins3⤵
-
C:\Temp\i_urmkecwupm.exeC:\Temp\i_urmkecwupm.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wrpjhbztrm.exe ups_run3⤵
-
C:\Temp\wrpjhbztrm.exeC:\Temp\wrpjhbztrm.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wrpjhbztrm.exe ups_ins3⤵
-
C:\Temp\i_wrpjhbztrm.exeC:\Temp\i_wrpjhbztrm.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rljdbwtolg.exe ups_run3⤵
-
C:\Temp\rljdbwtolg.exeC:\Temp\rljdbwtolg.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rljdbwtolg.exe ups_ins3⤵
-
C:\Temp\i_rljdbwtolg.exeC:\Temp\i_rljdbwtolg.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ljdbvtnlgd.exe ups_run3⤵
-
C:\Temp\ljdbvtnlgd.exeC:\Temp\ljdbvtnlgd.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ljdbvtnlgd.exe ups_ins3⤵
-
C:\Temp\i_ljdbvtnlgd.exeC:\Temp\i_ljdbvtnlgd.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fdyvqoigay.exe ups_run3⤵
-
C:\Temp\fdyvqoigay.exeC:\Temp\fdyvqoigay.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fdyvqoigay.exe ups_ins3⤵
-
C:\Temp\i_fdyvqoigay.exeC:\Temp\i_fdyvqoigay.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\cavsnigays.exe ups_run3⤵
-
C:\Temp\cavsnigays.exeC:\Temp\cavsnigays.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_cavsnigays.exe ups_ins3⤵
-
C:\Temp\i_cavsnigays.exeC:\Temp\i_cavsnigays.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\avsnlfdxvp.exe ups_run3⤵
-
C:\Temp\avsnlfdxvp.exeC:\Temp\avsnlfdxvp.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_avsnlfdxvp.exe ups_ins3⤵
-
C:\Temp\i_avsnlfdxvp.exeC:\Temp\i_avsnlfdxvp.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\smkecxupnh.exe ups_run3⤵
-
C:\Temp\smkecxupnh.exeC:\Temp\smkecxupnh.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2892 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Temp\nlfdxvifaysqkica.sysC:\Temp\nlfdxvifaysqkica.sys1⤵
- Executes dropped EXE
-
C:\Temp\fdxvpnifay.sysC:\Temp\fdxvpnifay.sys1⤵
- Executes dropped EXE
-
C:\Temp\nkfcxvpnhf.sysC:\Temp\nkfcxvpnhf.sys1⤵
- Executes dropped EXE
-
C:\Temp\cwupmhezxr.sysC:\Temp\cwupmhezxr.sys1⤵
- Executes dropped EXE
-
C:\Temp\xrpjhczurm.sysC:\Temp\xrpjhczurm.sys1⤵
- Executes dropped EXE
-
C:\Temp\mgezwrpjhb.sysC:\Temp\mgezwrpjhb.sys1⤵
- Executes dropped EXE
-
C:\Temp\wrojgbztrl.sysC:\Temp\wrojgbztrl.sys1⤵
- Executes dropped EXE
-
C:\Temp\gaytqlidbv.sysC:\Temp\gaytqlidbv.sys1⤵
- Executes dropped EXE
-
C:\Temp\dyvqoigays.sysC:\Temp\dyvqoigays.sys1⤵
- Executes dropped EXE
-
C:\Temp\vsnlfdxvqn.sysC:\Temp\vsnlfdxvqn.sys1⤵
- Executes dropped EXE
-
C:\Temp\pkicausnkf.sysC:\Temp\pkicausnkf.sys1⤵
- Executes dropped EXE
-
C:\Temp\hfzxrpkhcz.sysC:\Temp\hfzxrpkhcz.sys1⤵
-
C:\Temp\jhczurmkec.sysC:\Temp\jhczurmkec.sys1⤵
-
C:\Temp\ecwuomhezw.sysC:\Temp\ecwuomhezw.sys1⤵
-
C:\Temp\ywrojgbztr.sysC:\Temp\ywrojgbztr.sys1⤵
-
C:\Temp\wqoigbytql.sysC:\Temp\wqoigbytql.sys1⤵
-
C:\Temp\ytqljdbvto.sysC:\Temp\ytqljdbvto.sys1⤵
-
C:\Temp\nigaysqkid.sysC:\Temp\nigaysqkid.sys1⤵
-
C:\Temp\icausnkfdx.sysC:\Temp\icausnkfdx.sys1⤵
-
C:\Temp\zxspkhcaus.sysC:\Temp\zxspkhcaus.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CreateProcess.exe
bztrmjebwu.exe
cwupmhezxr.sys
ecwuomgezu.exe
fdxvpnifay.sys
fzxspkicxu.exe
gaytqlidbv.sys
i_bztrmjebwu.exe
i_ecwuomgezu.exe
i_fzxspkicxu.exe
i_ljdbwtomgb.exe
i_nigaysqkid.exe
i_upmhfzxrpk.exe
i_usnkfdxvpn.exe
ljdbwtomgb.exe
mgezwrpjhb.sys
nigaysqkid.exe
nkfcxvpnhf.sys
nlfdxvifaysqkica.exe
nlfdxvifaysqkica.sys
upmhfzxrpk.exe
usnkfdxvpn.exe
wrojgbztrl.sys
xrpjhczurm.sys
ytqljdbvtn.exe
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
suggestions[1].en-US
memory/628-155-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/944-131-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1460-21-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2076-76-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2112-45-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2172-123-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2228-127-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2332-33-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2472-156-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2472-151-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2756-14-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2756-62-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3112-164-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3676-135-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3864-143-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4028-139-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4136-160-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4728-106-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4780-88-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4828-100-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5088-147-0x0000000000010000-0x00000000000AB000-memory.dmp