Analysis
- max time kernel
149s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
31/10/2026, 02:51
General
- Target 2026-10-30_5c6d85cf82185cb6d2e35507aab9178c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
- Size 381KB
- Sample261031-dcf3dsvs7l
- SHA256 3e63ad0c49aa3ce9cf224e9082a99c3943754474de4da289aaa2e16f11020ea9
Score
10/10
Malware Config
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 43 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 31 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 62 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-30_5c6d85cf82185cb6d2e35507aab9178c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-30_5c6d85cf82185cb6d2e35507aab9178c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\vqoigaysqlidbvtn.exeC:\Temp\vqoigaysqlidbvtn.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\aysqlidavt.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\aysqlidavt.exeC:\Temp\aysqlidavt.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_aysqlidavt.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_aysqlidavt.exeC:\Temp\i_aysqlidavt.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hfaxsqkica.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\hfaxsqkica.exeC:\Temp\hfaxsqkica.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hfaxsqkica.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_hfaxsqkica.exeC:\Temp\i_hfaxsqkica.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\smkfcxvpnf.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\smkfcxvpnf.exeC:\Temp\smkfcxvpnf.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_smkfcxvpnf.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_smkfcxvpnf.exeC:\Temp\i_smkfcxvpnf.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\khcamkecwu.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\khcamkecwu.exeC:\Temp\khcamkecwu.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_khcamkecwu.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_khcamkecwu.exeC:\Temp\i_khcamkecwu.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\usmkecwuph.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\usmkecwuph.exeC:\Temp\usmkecwuph.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_usmkecwuph.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_usmkecwuph.exeC:\Temp\i_usmkecwuph.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zwrpjhbztr.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\zwrpjhbztr.exeC:\Temp\zwrpjhbztr.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zwrpjhbztr.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_zwrpjhbztr.exeC:\Temp\i_zwrpjhbztr.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\geywqoigby.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\geywqoigby.exeC:\Temp\geywqoigby.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_geywqoigby.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_geywqoigby.exeC:\Temp\i_geywqoigby.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vqoigaytql.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\vqoigaytql.exeC:\Temp\vqoigaytql.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vqoigaytql.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_vqoigaytql.exeC:\Temp\i_vqoigaytql.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\oigaysqlid.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\oigaysqlid.exeC:\Temp\oigaysqlid.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_oigaysqlid.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_oigaysqlid.exeC:\Temp\i_oigaysqlid.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\idavtnlfdx.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\idavtnlfdx.exeC:\Temp\idavtnlfdx.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_idavtnlfdx.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_idavtnlfdx.exeC:\Temp\i_idavtnlfdx.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\axsqkicavs.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\axsqkicavs.exeC:\Temp\axsqkicavs.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_axsqkicavs.exe ups_ins3⤵
-
C:\Temp\i_axsqkicavs.exeC:\Temp\i_axsqkicavs.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\upnhfzusmk.exe ups_run3⤵
-
C:\Temp\upnhfzusmk.exeC:\Temp\upnhfzusmk.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_upnhfzusmk.exe ups_ins3⤵
-
C:\Temp\i_upnhfzusmk.exeC:\Temp\i_upnhfzusmk.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\usmkecxupm.exe ups_run3⤵
-
C:\Temp\usmkecxupm.exeC:\Temp\usmkecxupm.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_usmkecxupm.exe ups_ins3⤵
-
C:\Temp\i_usmkecxupm.exeC:\Temp\i_usmkecxupm.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pjhbzurmke.exe ups_run3⤵
-
C:\Temp\pjhbzurmke.exeC:\Temp\pjhbzurmke.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pjhbzurmke.exe ups_ins3⤵
-
C:\Temp\i_pjhbzurmke.exeC:\Temp\i_pjhbzurmke.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\geywrljebw.exe ups_run3⤵
-
C:\Temp\geywrljebw.exeC:\Temp\geywrljebw.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_geywrljebw.exe ups_ins3⤵
-
C:\Temp\i_geywrljebw.exeC:\Temp\i_geywrljebw.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jytrljdbwt.exe ups_run3⤵
-
C:\Temp\jytrljdbwt.exeC:\Temp\jytrljdbwt.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jytrljdbwt.exe ups_ins3⤵
-
C:\Temp\i_jytrljdbwt.exeC:\Temp\i_jytrljdbwt.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dywqoigayt.exe ups_run3⤵
-
C:\Temp\dywqoigayt.exeC:\Temp\dywqoigayt.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dywqoigayt.exe ups_ins3⤵
-
C:\Temp\i_dywqoigayt.exeC:\Temp\i_dywqoigayt.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ysqkidavtn.exe ups_run3⤵
-
C:\Temp\ysqkidavtn.exeC:\Temp\ysqkidavtn.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ysqkidavtn.exe ups_ins3⤵
-
C:\Temp\i_ysqkidavtn.exeC:\Temp\i_ysqkidavtn.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\sqkicavsnl.exe ups_run3⤵
-
C:\Temp\sqkicavsnl.exeC:\Temp\sqkicavsnl.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_sqkicavsnl.exe ups_ins3⤵
-
C:\Temp\i_sqkicavsnl.exeC:\Temp\i_sqkicavsnl.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\snkfvpnhca.exe ups_run3⤵
-
C:\Temp\snkfvpnhca.exeC:\Temp\snkfvpnhca.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4732 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Temp\vqoigaysqlidbvtn.sysC:\Temp\vqoigaysqlidbvtn.sys1⤵
- Executes dropped EXE
-
C:\Temp\sqkidavsnl.sysC:\Temp\sqkidavsnl.sys1⤵
- Executes dropped EXE
-
C:\Temp\ifaysqkaus.sysC:\Temp\ifaysqkaus.sys1⤵
- Executes dropped EXE
-
C:\Temp\upnhfzxspk.sysC:\Temp\upnhfzxspk.sys1⤵
- Executes dropped EXE
-
C:\Temp\ezxrpjhczu.sysC:\Temp\ezxrpjhczu.sys1⤵
- Executes dropped EXE
-
C:\Temp\jecwuomhez.sysC:\Temp\jecwuomhez.sys1⤵
- Executes dropped EXE
-
C:\Temp\rljdbwtomg.sysC:\Temp\rljdbwtomg.sys1⤵
- Executes dropped EXE
-
C:\Temp\ljdbvtolge.sysC:\Temp\ljdbvtolge.sys1⤵
- Executes dropped EXE
-
C:\Temp\ytnlgdyvqo.sysC:\Temp\ytnlgdyvqo.sys1⤵
- Executes dropped EXE
-
C:\Temp\qnigaysqli.sysC:\Temp\qnigaysqli.sys1⤵
- Executes dropped EXE
-
C:\Temp\kfaxspkica.sysC:\Temp\kfaxspkica.sys1⤵
- Executes dropped EXE
-
C:\Temp\kicausnkfc.sysC:\Temp\kicausnkfc.sys1⤵
-
C:\Temp\fzxrpkhcau.sysC:\Temp\fzxrpkhcau.sys1⤵
-
C:\Temp\wrpjhczurm.sysC:\Temp\wrpjhczurm.sys1⤵
-
C:\Temp\ztjebwuomg.sysC:\Temp\ztjebwuomg.sys1⤵
-
C:\Temp\qojgbytrlj.sysC:\Temp\qojgbytrlj.sys1⤵
-
C:\Temp\ljdbvtolgd.sysC:\Temp\ljdbvtolgd.sys1⤵
-
C:\Temp\idyvqnigay.sysC:\Temp\idyvqnigay.sys1⤵
-
C:\Temp\lfaysqcaus.sysC:\Temp\lfaysqcaus.sys1⤵
-
C:\Temp\ausnkfdxvp.sysC:\Temp\ausnkfdxvp.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CreateProcess.exe
aysqlidavt.exe
ezxrpjhczu.sys
geywqoigby.exe
hfaxsqkica.exe
i_aysqlidavt.exe
i_geywqoigby.exe
i_hfaxsqkica.exe
i_khcamkecwu.exe
i_smkfcxvpnf.exe
i_usmkecwuph.exe
i_zwrpjhbztr.exe
ifaysqkaus.sys
jecwuomhez.sys
khcamkecwu.exe
ljdbvtolge.sys
rljdbwtomg.sys
smkfcxvpnf.exe
sqkidavsnl.sys
upnhfzxspk.sys
usmkecwuph.exe
vqoigaysqlidbvtn.exe
vqoigaysqlidbvtn.sys
vqoigaytql.exe
zwrpjhbztr.exe
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
suggestions[1].en-US
memory/636-50-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/696-148-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1212-81-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1352-19-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1960-128-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1972-153-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2320-38-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2524-149-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2524-144-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3292-165-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3292-170-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3300-161-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3880-111-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4020-169-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4196-93-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4240-67-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4272-132-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4420-105-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4596-136-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4940-157-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5504-26-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5828-140-0x0000000000010000-0x00000000000AB000-memory.dmp