Analysis
- max time kernel
149s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
11/11/2026, 01:03
General
- Target 2026-11-09_23bd91e76533fa54f921a3fb20d7646f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 361KB
- Sample261111-behb5aes5y
- SHA256 dde916746734ce1d8c6b888a89e3b3b83f92671b96ac260af6c5fc0c83b1cae7
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 43 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 35 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 62 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-09_23bd91e76533fa54f921a3fb20d7646f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-09_23bd91e76533fa54f921a3fb20d7646f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\aysqkidavtnlfdxv.exeC:\Temp\aysqkidavtnlfdxv.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lgaysicavs.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\lgaysicavs.exeC:\Temp\lgaysicavs.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_lgaysicavs.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_lgaysicavs.exeC:\Temp\i_lgaysicavs.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\usnlfdxvpn.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\usnlfdxvpn.exeC:\Temp\usnlfdxvpn.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_usnlfdxvpn.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_usnlfdxvpn.exeC:\Temp\i_usnlfdxvpn.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\khcausmkfc.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\khcausmkfc.exeC:\Temp\khcausmkfc.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_khcausmkfc.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_khcausmkfc.exeC:\Temp\i_khcausmkfc.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zusmhcwupm.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\zusmhcwupm.exeC:\Temp\zusmhcwupm.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zusmhcwupm.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_zusmhcwupm.exeC:\Temp\i_zusmhcwupm.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jhbzurmjec.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jhbzurmjec.exeC:\Temp\jhbzurmjec.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jhbzurmjec.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jhbzurmjec.exeC:\Temp\i_jhbzurmjec.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bwuojhbztr.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\bwuojhbztr.exeC:\Temp\bwuojhbztr.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bwuojhbztr.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_bwuojhbztr.exeC:\Temp\i_bwuojhbztr.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\oigbytrljd.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\oigbytrljd.exeC:\Temp\oigbytrljd.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_oigbytrljd.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_oigbytrljd.exeC:\Temp\i_oigbytrljd.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bvtnlgdywq.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\bvtnlgdywq.exeC:\Temp\bvtnlgdywq.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bvtnlgdywq.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_bvtnlgdywq.exeC:\Temp\i_bvtnlgdywq.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vqnigaysqk.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\vqnigaysqk.exeC:\Temp\vqnigaysqk.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vqnigaysqk.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_vqnigaysqk.exeC:\Temp\i_vqnigaysqk.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ysqkidavtn.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ysqkidavtn.exeC:\Temp\ysqkidavtn.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ysqkidavtn.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ysqkidavtn.exeC:\Temp\i_ysqkidavtn.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pkicausmkf.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\pkicausmkf.exeC:\Temp\pkicausmkf.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pkicausmkf.exe ups_ins3⤵
-
C:\Temp\i_pkicausmkf.exeC:\Temp\i_pkicausmkf.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jhczusmkec.exe ups_run3⤵
-
C:\Temp\jhczusmkec.exeC:\Temp\jhczusmkec.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jhczusmkec.exe ups_ins3⤵
-
C:\Temp\i_jhczusmkec.exeC:\Temp\i_jhczusmkec.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bzurmjecwu.exe ups_run3⤵
-
C:\Temp\bzurmjecwu.exeC:\Temp\bzurmjecwu.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bzurmjecwu.exe ups_ins3⤵
-
C:\Temp\i_bzurmjecwu.exeC:\Temp\i_bzurmjecwu.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hbzuomhezw.exe ups_run3⤵
-
C:\Temp\hbzuomhezw.exeC:\Temp\hbzuomhezw.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hbzuomhezw.exe ups_ins3⤵
-
C:\Temp\i_hbzuomhezw.exeC:\Temp\i_hbzuomhezw.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ywqojgbztr.exe ups_run3⤵
-
C:\Temp\ywqojgbztr.exeC:\Temp\ywqojgbztr.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ywqojgbztr.exe ups_ins3⤵
-
C:\Temp\i_ywqojgbztr.exeC:\Temp\i_ywqojgbztr.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qoigbytqlj.exe ups_run3⤵
-
C:\Temp\qoigbytqlj.exeC:\Temp\qoigbytqlj.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qoigbytqlj.exe ups_ins3⤵
-
C:\Temp\i_qoigbytqlj.exeC:\Temp\i_qoigbytqlj.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lfdyvqoiga.exe ups_run3⤵
-
C:\Temp\lfdyvqoiga.exeC:\Temp\lfdyvqoiga.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_lfdyvqoiga.exe ups_ins3⤵
-
C:\Temp\i_lfdyvqoiga.exeC:\Temp\i_lfdyvqoiga.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fdxvqnigav.exe ups_run3⤵
-
C:\Temp\fdxvqnigav.exeC:\Temp\fdxvqnigav.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fdxvqnigav.exe ups_ins3⤵
-
C:\Temp\i_fdxvqnigav.exeC:\Temp\i_fdxvqnigav.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\sqkicausnk.exe ups_run3⤵
-
C:\Temp\sqkicausnk.exeC:\Temp\sqkicausnk.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_sqkicausnk.exe ups_ins3⤵
-
C:\Temp\i_sqkicausnk.exeC:\Temp\i_sqkicausnk.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kecxupnhfz.exe ups_run3⤵
-
C:\Temp\kecxupnhfz.exeC:\Temp\kecxupnhfz.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5612 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Temp\aysqkidavtnlfdxv.sysC:\Temp\aysqkidavtnlfdxv.sys1⤵
- Executes dropped EXE
-
C:\Temp\faxsqkicav.sysC:\Temp\faxsqkicav.sys1⤵
- Executes dropped EXE
-
C:\Temp\vpnhfzxspk.sysC:\Temp\vpnhfzxspk.sys1⤵
- Executes dropped EXE
-
C:\Temp\kfzxrpkhcz.sysC:\Temp\kfzxrpkhcz.sys1⤵
- Executes dropped EXE
-
C:\Temp\cwupmhfzxr.sysC:\Temp\cwupmhfzxr.sys1⤵
- Executes dropped EXE
-
C:\Temp\mgezwrpjhb.sysC:\Temp\mgezwrpjhb.sys1⤵
- Executes dropped EXE
-
C:\Temp\ztrljdbwto.sysC:\Temp\ztrljdbwto.sys1⤵
- Executes dropped EXE
-
C:\Temp\igbytrljdb.sysC:\Temp\igbytrljdb.sys1⤵
- Executes dropped EXE
-
C:\Temp\oigaytqljd.sysC:\Temp\oigaytqljd.sys1⤵
- Executes dropped EXE
-
C:\Temp\faysqkicav.sysC:\Temp\faysqkicav.sys1⤵
- Executes dropped EXE
-
C:\Temp\xvpnhfaxsp.sysC:\Temp\xvpnhfaxsp.sys1⤵
- Executes dropped EXE
-
C:\Temp\usmkecxupn.sysC:\Temp\usmkecxupn.sys1⤵
-
C:\Temp\upmhfzxrpj.sysC:\Temp\upmhfzxrpj.sys1⤵
-
C:\Temp\pjhbztrmje.sysC:\Temp\pjhbztrmje.sys1⤵
-
C:\Temp\jebwuomgey.sysC:\Temp\jebwuomgey.sys1⤵
-
C:\Temp\jytrljdbwq.sysC:\Temp\jytrljdbwq.sys1⤵
-
C:\Temp\bytrljdbvt.sysC:\Temp\bytrljdbvt.sys1⤵
-
C:\Temp\qlidbvtnlf.sysC:\Temp\qlidbvtnlf.sys1⤵
-
C:\Temp\cavsnlfdxv.sysC:\Temp\cavsnlfdxv.sys1⤵
-
C:\Temp\spkhcausmk.sysC:\Temp\spkhcausmk.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CreateProcess.exe
aysqkidavtnlfdxv.exe
aysqkidavtnlfdxv.sys
bvtnlgdywq.exe
bwuojhbztr.exe
cwupmhfzxr.sys
faxsqkicav.sys
i_bwuojhbztr.exe
i_jhbzurmjec.exe
i_khcausmkfc.exe
i_lgaysicavs.exe
i_oigbytrljd.exe
i_usnlfdxvpn.exe
i_zusmhcwupm.exe
igbytrljdb.sys
jhbzurmjec.exe
kfzxrpkhcz.sys
khcausmkfc.exe
lgaysicavs.exe
mgezwrpjhb.sys
oigbytrljd.exe
usnlfdxvpn.exe
vpnhfzxspk.sys
ztrljdbwto.sys
zusmhcwupm.exe
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
suggestions[1].en-US
memory/436-127-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/548-45-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1196-21-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1332-106-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1340-62-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1780-76-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2292-123-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2688-14-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3436-100-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3756-139-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4236-131-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4316-144-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4332-164-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4396-33-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4596-156-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4624-152-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5608-88-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5628-148-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5864-160-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5864-165-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6016-140-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6016-135-0x0000000000010000-0x00000000000AB000-memory.dmp