Analysis
- max time kernel
96s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260617-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/06/2026, 03:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-27_ae39f71e8b8dc0876c8b67a649e6e636_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-27_ae39f71e8b8dc0876c8b67a649e6e636_elex_emotet_stop.exe
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 2026-06-27_ae39f71e8b8dc0876c8b67a649e6e636_elex_emotet_stop.exe
- Size 208KB
- Sample260629-ehebescw6z
- SHA256 b6c8a5d31b10857011cfb0016128e59987ddb072d9fc3dea595801b0e34ed550
- MD5 ae39f71e8b8dc0876c8b67a649e6e636
- SHA1 b5e68fedfcac96e4ff2195810fdc1127a477963f
- SHA512 47231cd5a7c8aaf512077cdd8e63c165c63f06601e6c331acc06026a05c9e0a2a8734b2d1de58c2ec6ef9b2f5b48009c7364da4c1900ac0c660d335ec81b45d4
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbclcdL+LOfv4NLthEjQT6j:MlZtbLWIgd1LZ9oECZbclc5+LOXQEj1
- TLSH T10D247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4360 FNYIWPE.exe 4232 IVLXN.exe 5576 WQWYSSJ.exe 2732 YOKS.exe 296 TBPCSA.exe 4632 YBP.exe 4928 QKRVFAK.exe 4848 DUHTT.exe 4932 JIGUYF.exe 2500 NYNUC.exe 1416 RGTCOQX.exe 5452 BEZWD.exe 2140 FUGW.exe 3740 LHFXM.exe 4648 NFSS.exe 2324 CICWNPB.exe 756 BTFM.exe 2296 ADP.exe 1940 GZTDK.exe 5664 ZRJ.exe 5876 OHKFAM.exe 6096 RUBPTFO.exe 2028 INEXUL.exe 872 QTQMFS.exe 4280 OETUN.exe 5996 YBZODGC.exe 468 XMJEDM.exe 4880 KXSDSX.exe 1540 LAW.exe 3120 NYJ.exe 1080 VDOZXUZ.exe 4784 ZTUHJ.exe 4012 FHUIG.exe 5580 UKD.exe 5672 TUOCAQI.exe 1272 SFRSIW.exe 764 KIV.exe 5984 ZDEAHY.exe 3596 JBSNO.exe 4432 TBUAAMR.exe 124 KKW.exe 5432 FXSON.exe 2504 INHO.exe 1688 DAMGCC.exe 4444 NYRS.exe 4276 ILWCU.exe 6052 RUYPXHS.exe 2792 ZZDVIO.exe 4004 OUMA.exe 1676 AFXNKN.exe 2244 MYAGKUH.exe 5512 QGHG.exe 2964 TWNOIXJ.exe 2288 AJMON.exe 3576 NUD.exe 704 CKEFAY.exe 3376 RFNR.exe 5864 BNPWX.exe 412 BITS.exe 5632 HJBF.exe 3016 CEFPVI.exe 428 WRK.exe 1764 IKFR.exe 2452 TCIKO.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\BBGRX.exe.bat XTARLM.exe File created C:\windows\SysWOW64\YJCS.exe HJO.exe File created C:\windows\SysWOW64\JIGUYF.exe DUHTT.exe File created C:\windows\SysWOW64\VDOZXUZ.exe NYJ.exe File created C:\windows\SysWOW64\UKD.exe.bat FHUIG.exe File created C:\windows\SysWOW64\AJMON.exe TWNOIXJ.exe File created C:\windows\SysWOW64\TWKUJH.exe BOIP.exe File created C:\windows\SysWOW64\TWKUJH.exe.bat BOIP.exe File opened for modification C:\windows\SysWOW64\XQWN.exe RQOAXU.exe File created C:\windows\SysWOW64\XQWN.exe.bat RQOAXU.exe File created C:\windows\SysWOW64\UQPH.exe ZDLXLAW.exe File created C:\windows\SysWOW64\HJO.exe YBMHLJP.exe File created C:\windows\SysWOW64\TBPCSA.exe YOKS.exe File created C:\windows\SysWOW64\KXSDSX.exe.bat XMJEDM.exe File created C:\windows\SysWOW64\AJMON.exe.bat TWNOIXJ.exe File created C:\windows\SysWOW64\TQVH.exe KQT.exe File created C:\windows\SysWOW64\WDEGRIH.exe BIAOGI.exe File created C:\windows\SysWOW64\MDPBXL.exe IVIB.exe File created C:\windows\SysWOW64\RUBPTFO.exe OHKFAM.exe File created C:\windows\SysWOW64\TBUAAMR.exe JBSNO.exe File created C:\windows\SysWOW64\INHO.exe FXSON.exe File created C:\windows\SysWOW64\JTK.exe OGFTCE.exe File created C:\windows\SysWOW64\XTARLM.exe XQWN.exe File created C:\windows\SysWOW64\HKMWSR.exe BJEAJ.exe File created C:\windows\SysWOW64\VXS.exe.bat MXQLSN.exe File opened for modification C:\windows\SysWOW64\JIGUYF.exe DUHTT.exe File created C:\windows\SysWOW64\ZTUHJ.exe.bat VDOZXUZ.exe File created C:\windows\SysWOW64\TCIKO.exe IKFR.exe File created C:\windows\SysWOW64\FNYIWPE.exe.bat 2026-06-27_ae39f71e8b8dc0876c8b67a649e6e636_elex_emotet_stop.exe File created C:\windows\SysWOW64\TBPCSA.exe.bat YOKS.exe File opened for modification C:\windows\SysWOW64\TQVH.exe KQT.exe File created C:\windows\SysWOW64\IKSPV.exe.bat CKK.exe File created C:\windows\SysWOW64\NYRS.exe.bat DAMGCC.exe File created C:\windows\SysWOW64\TWNOIXJ.exe QGHG.exe File opened for modification C:\windows\SysWOW64\CKEFAY.exe NUD.exe File created C:\windows\SysWOW64\IMLT.exe TWKUJH.exe File created C:\windows\SysWOW64\BBGRX.exe XTARLM.exe File opened for modification C:\windows\SysWOW64\YBP.exe TBPCSA.exe File created C:\windows\SysWOW64\RUBPTFO.exe.bat OHKFAM.exe File created C:\windows\SysWOW64\KXSDSX.exe XMJEDM.exe File created C:\windows\SysWOW64\UKD.exe FHUIG.exe File created C:\windows\SysWOW64\XTARLM.exe.bat XQWN.exe File created C:\windows\SysWOW64\IKSPV.exe CKK.exe File created C:\windows\SysWOW64\LSS.exe HKMWSR.exe File created C:\windows\SysWOW64\LSS.exe.bat HKMWSR.exe File created C:\windows\SysWOW64\YBP.exe.bat TBPCSA.exe File opened for modification C:\windows\SysWOW64\ZRJ.exe GZTDK.exe File created C:\windows\SysWOW64\LAW.exe.bat KXSDSX.exe File created C:\windows\SysWOW64\VDOZXUZ.exe.bat NYJ.exe File created C:\windows\SysWOW64\KKW.exe TBUAAMR.exe File created C:\windows\SysWOW64\IMLT.exe.bat TWKUJH.exe File opened for modification C:\windows\SysWOW64\IKSPV.exe CKK.exe File created C:\windows\SysWOW64\WDEGRIH.exe.bat BIAOGI.exe File opened for modification C:\windows\SysWOW64\XNVMKUH.exe DAQDAV.exe File created C:\windows\SysWOW64\YCMDZD.exe.bat SGUU.exe File created C:\windows\SysWOW64\ZXX.exe YCMDZD.exe File created C:\windows\SysWOW64\GYJI.exe.bat IXCUJWH.exe File created C:\windows\SysWOW64\IVLXN.exe FNYIWPE.exe File created C:\windows\SysWOW64\JIGUYF.exe.bat DUHTT.exe File opened for modification C:\windows\SysWOW64\ZTUHJ.exe VDOZXUZ.exe File opened for modification C:\windows\SysWOW64\NYRS.exe DAMGCC.exe File created C:\windows\SysWOW64\CKEFAY.exe NUD.exe File created C:\windows\SysWOW64\DAQDAV.exe.bat IMLT.exe File opened for modification C:\windows\SysWOW64\HKMWSR.exe BJEAJ.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\BIAOGI.exe MAZXIUV.exe File created C:\windows\system\BIAOGI.exe.bat MAZXIUV.exe File opened for modification C:\windows\system\BTFM.exe CICWNPB.exe File created C:\windows\system\ADP.exe.bat BTFM.exe File created C:\windows\SFRSIW.exe.bat TUOCAQI.exe File created C:\windows\system\JZZ.exe.bat OMUQGZ.exe File opened for modification C:\windows\system\ROZEOT.exe WBUV.exe File created C:\windows\system\CGCXXAR.exe.bat ROZEOT.exe File created C:\windows\MXQLSN.exe.bat XCHG.exe File opened for modification C:\windows\system\OETUN.exe QTQMFS.exe File created C:\windows\TUOCAQI.exe UKD.exe File created C:\windows\FXSON.exe.bat KKW.exe File opened for modification C:\windows\system\NUD.exe AJMON.exe File created C:\windows\ODKXT.exe GYJI.exe File created C:\windows\system\FWM.exe.bat CJPUANN.exe File opened for modification C:\windows\MUJK.exe BBGRX.exe File created C:\windows\CKK.exe.bat MUJK.exe File created C:\windows\system\WQWYSSJ.exe IVLXN.exe File opened for modification C:\windows\system\NFSS.exe LHFXM.exe File created C:\windows\system\CJPUANN.exe ODKXT.exe File created C:\windows\system\QRJP.exe.bat WDEGRIH.exe File created C:\windows\system\BJEAJ.exe.bat QRJP.exe File created C:\windows\PIHWRCW.exe.bat LSS.exe File created C:\windows\system\SBEUU.exe GIBJ.exe File created C:\windows\system\YBMHLJP.exe.bat SBEUU.exe File opened for modification C:\windows\CICWNPB.exe NFSS.exe File created C:\windows\DNCAU.exe XNVMKUH.exe File created C:\windows\system\MAZXIUV.exe IKSPV.exe File created C:\windows\OHKFAM.exe ZRJ.exe File opened for modification C:\windows\system\QTQMFS.exe INEXUL.exe File opened for modification C:\windows\KIV.exe SFRSIW.exe File created C:\windows\system\BITS.exe.bat BNPWX.exe File created C:\windows\PIHWRCW.exe LSS.exe File created C:\windows\system\BTFM.exe.bat CICWNPB.exe File opened for modification C:\windows\system\KQT.exe TCIKO.exe File created C:\windows\TSCIO.exe.bat ZXX.exe File created C:\windows\system\SHDCZP.exe.bat FWM.exe File created C:\windows\MUJK.exe.bat BBGRX.exe File opened for modification C:\windows\system\CGCXXAR.exe ROZEOT.exe File opened for modification C:\windows\DUHTT.exe QKRVFAK.exe File created C:\windows\DUHTT.exe.bat QKRVFAK.exe File created C:\windows\KIV.exe SFRSIW.exe File created C:\windows\system\DAMGCC.exe INHO.exe File opened for modification C:\windows\RFNR.exe CKEFAY.exe File created C:\windows\system\SGUU.exe.bat JTK.exe File created C:\windows\system\RGTCOQX.exe NYNUC.exe File created C:\windows\NYJ.exe LAW.exe File opened for modification C:\windows\ZDEAHY.exe KIV.exe File created C:\windows\QGHG.exe MYAGKUH.exe File created C:\windows\system\IXCUJWH.exe PFHCAO.exe File created C:\windows\system\QRJP.exe WDEGRIH.exe File created C:\windows\YOKS.exe.bat WQWYSSJ.exe File created C:\windows\system\BTFM.exe CICWNPB.exe File created C:\windows\system\CJPUANN.exe.bat ODKXT.exe File created C:\windows\MUJK.exe BBGRX.exe File opened for modification C:\windows\WBUV.exe MDPBXL.exe File created C:\windows\YOKS.exe WQWYSSJ.exe File opened for modification C:\windows\system\RGTCOQX.exe NYNUC.exe File opened for modification C:\windows\system\ADP.exe BTFM.exe File created C:\windows\QGHG.exe.bat MYAGKUH.exe File created C:\windows\system\HJBF.exe BITS.exe File opened for modification C:\windows\CKK.exe MUJK.exe File created C:\windows\system\XCHG.exe CGCXXAR.exe File opened for modification C:\windows\TUOCAQI.exe UKD.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 64 IoCs
pid pid_target Process procid_target 1256 4464 WerFault.exe 88 4944 4360 WerFault.exe 93 5348 4232 WerFault.exe 99 2528 5576 WerFault.exe 104 1696 2732 WerFault.exe 109 5512 296 WerFault.exe 114 4332 4632 WerFault.exe 119 4560 4928 WerFault.exe 124 2452 4848 WerFault.exe 129 1488 4932 WerFault.exe 134 5728 2500 WerFault.exe 139 2116 1416 WerFault.exe 144 4532 5452 WerFault.exe 149 5984 2140 WerFault.exe 154 5960 3740 WerFault.exe 159 1896 4648 WerFault.exe 164 900 2324 WerFault.exe 169 5152 756 WerFault.exe 174 2964 2296 WerFault.exe 179 5524 1940 WerFault.exe 184 5464 5664 WerFault.exe 189 2328 5876 WerFault.exe 194 5672 6096 WerFault.exe 199 1272 2028 WerFault.exe 204 764 872 WerFault.exe 209 420 4280 WerFault.exe 214 2216 5996 WerFault.exe 219 2428 468 WerFault.exe 224 2780 4880 WerFault.exe 229 3268 1540 WerFault.exe 234 3240 3120 WerFault.exe 239 4912 1080 WerFault.exe 244 2672 4784 WerFault.exe 249 4336 4012 WerFault.exe 254 5444 5580 WerFault.exe 259 4480 5672 WerFault.exe 264 5980 1272 WerFault.exe 269 4004 764 WerFault.exe 274 4244 5984 WerFault.exe 279 5024 3596 WerFault.exe 284 1696 4432 WerFault.exe 289 5616 124 WerFault.exe 294 1996 5432 WerFault.exe 299 5412 2504 WerFault.exe 304 4952 1688 WerFault.exe 309 2804 4444 WerFault.exe 314 2740 4276 WerFault.exe 319 5700 6052 WerFault.exe 324 420 2792 WerFault.exe 329 2528 4004 WerFault.exe 334 5024 1676 WerFault.exe 339 4832 2244 WerFault.exe 344 3960 5512 WerFault.exe 349 4912 2964 WerFault.exe 354 2760 2288 WerFault.exe 359 2464 3576 WerFault.exe 364 3360 704 WerFault.exe 369 2432 3376 WerFault.exe 374 2800 5864 WerFault.exe 379 5688 412 WerFault.exe 384 1828 5632 WerFault.exe 389 1160 3016 WerFault.exe 394 1516 428 WerFault.exe 399 2440 1764 WerFault.exe 404 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IVLXN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RUBPTFO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LAW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BITS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JZZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WBUV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IKFR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JIGUYF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZTUHJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language INHO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CKEFAY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OUMA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AFXNKN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language URCS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BNPWX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DAQDAV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XNVMKUH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MUJK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FNYIWPE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NUD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MAZXIUV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YJCS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CGCXXAR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PFHCAO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BIAOGI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-27_ae39f71e8b8dc0876c8b67a649e6e636_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QRJP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SBEUU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OHKFAM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OETUN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ILWCU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KQT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YBMHLJP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EKKFKZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MDPBXL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XMJEDM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TSCIO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZRJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NYJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4464 2026-06-27_ae39f71e8b8dc0876c8b67a649e6e636_elex_emotet_stop.exe 4464 2026-06-27_ae39f71e8b8dc0876c8b67a649e6e636_elex_emotet_stop.exe 4360 FNYIWPE.exe 4360 FNYIWPE.exe 4232 IVLXN.exe 4232 IVLXN.exe 5576 WQWYSSJ.exe 5576 WQWYSSJ.exe 2732 YOKS.exe 2732 YOKS.exe 296 TBPCSA.exe 296 TBPCSA.exe 4632 YBP.exe 4632 YBP.exe 4928 QKRVFAK.exe 4928 QKRVFAK.exe 4848 DUHTT.exe 4848 DUHTT.exe 4932 JIGUYF.exe 4932 JIGUYF.exe 2500 NYNUC.exe 2500 NYNUC.exe 1416 RGTCOQX.exe 1416 RGTCOQX.exe 5452 BEZWD.exe 5452 BEZWD.exe 2140 FUGW.exe 2140 FUGW.exe 3740 LHFXM.exe 3740 LHFXM.exe 4648 NFSS.exe 4648 NFSS.exe 2324 CICWNPB.exe 2324 CICWNPB.exe 756 BTFM.exe 756 BTFM.exe 2296 ADP.exe 2296 ADP.exe 1940 GZTDK.exe 1940 GZTDK.exe 5664 ZRJ.exe 5664 ZRJ.exe 5876 OHKFAM.exe 5876 OHKFAM.exe 6096 RUBPTFO.exe 6096 RUBPTFO.exe 2028 INEXUL.exe 2028 INEXUL.exe 872 QTQMFS.exe 872 QTQMFS.exe 4280 OETUN.exe 4280 OETUN.exe 5996 YBZODGC.exe 5996 YBZODGC.exe 468 XMJEDM.exe 468 XMJEDM.exe 4880 KXSDSX.exe 4880 KXSDSX.exe 1540 LAW.exe 1540 LAW.exe 3120 NYJ.exe 3120 NYJ.exe 1080 VDOZXUZ.exe 1080 VDOZXUZ.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4464 2026-06-27_ae39f71e8b8dc0876c8b67a649e6e636_elex_emotet_stop.exe 4464 2026-06-27_ae39f71e8b8dc0876c8b67a649e6e636_elex_emotet_stop.exe 4360 FNYIWPE.exe 4360 FNYIWPE.exe 4232 IVLXN.exe 4232 IVLXN.exe 5576 WQWYSSJ.exe 5576 WQWYSSJ.exe 2732 YOKS.exe 2732 YOKS.exe 296 TBPCSA.exe 296 TBPCSA.exe 4632 YBP.exe 4632 YBP.exe 4928 QKRVFAK.exe 4928 QKRVFAK.exe 4848 DUHTT.exe 4848 DUHTT.exe 4932 JIGUYF.exe 4932 JIGUYF.exe 2500 NYNUC.exe 2500 NYNUC.exe 1416 RGTCOQX.exe 1416 RGTCOQX.exe 5452 BEZWD.exe 5452 BEZWD.exe 2140 FUGW.exe 2140 FUGW.exe 3740 LHFXM.exe 3740 LHFXM.exe 4648 NFSS.exe 4648 NFSS.exe 2324 CICWNPB.exe 2324 CICWNPB.exe 756 BTFM.exe 756 BTFM.exe 2296 ADP.exe 2296 ADP.exe 1940 GZTDK.exe 1940 GZTDK.exe 5664 ZRJ.exe 5664 ZRJ.exe 5876 OHKFAM.exe 5876 OHKFAM.exe 6096 RUBPTFO.exe 6096 RUBPTFO.exe 2028 INEXUL.exe 2028 INEXUL.exe 872 QTQMFS.exe 872 QTQMFS.exe 4280 OETUN.exe 4280 OETUN.exe 5996 YBZODGC.exe 5996 YBZODGC.exe 468 XMJEDM.exe 468 XMJEDM.exe 4880 KXSDSX.exe 4880 KXSDSX.exe 1540 LAW.exe 1540 LAW.exe 3120 NYJ.exe 3120 NYJ.exe 1080 VDOZXUZ.exe 1080 VDOZXUZ.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4464 wrote to memory of 1612 4464 2026-06-27_ae39f71e8b8dc0876c8b67a649e6e636_elex_emotet_stop.exe 89 PID 1612 wrote to memory of 4360 1612 cmd.exe 93 PID 4360 wrote to memory of 3244 4360 FNYIWPE.exe 95 PID 3244 wrote to memory of 4232 3244 cmd.exe 99 PID 4232 wrote to memory of 688 4232 IVLXN.exe 100 PID 688 wrote to memory of 5576 688 cmd.exe 104 PID 5576 wrote to memory of 800 5576 WQWYSSJ.exe 105 PID 800 wrote to memory of 2732 800 cmd.exe 109 PID 2732 wrote to memory of 6008 2732 YOKS.exe 110 PID 6008 wrote to memory of 296 6008 cmd.exe 114 PID 296 wrote to memory of 1876 296 TBPCSA.exe 115 PID 1876 wrote to memory of 4632 1876 cmd.exe 119 PID 4632 wrote to memory of 720 4632 YBP.exe 120 PID 720 wrote to memory of 4928 720 cmd.exe 124 PID 4928 wrote to memory of 3492 4928 QKRVFAK.exe 125 PID 3492 wrote to memory of 4848 3492 cmd.exe 129 PID 4848 wrote to memory of 5004 4848 DUHTT.exe 130 PID 5004 wrote to memory of 4932 5004 cmd.exe 134 PID 4932 wrote to memory of 2784 4932 JIGUYF.exe 135 PID 2784 wrote to memory of 2500 2784 cmd.exe 139 PID 2500 wrote to memory of 3012 2500 NYNUC.exe 140 PID 3012 wrote to memory of 1416 3012 cmd.exe 144 PID 1416 wrote to memory of 5612 1416 RGTCOQX.exe 145 PID 5612 wrote to memory of 5452 5612 cmd.exe 149 PID 5452 wrote to memory of 4272 5452 BEZWD.exe 150 PID 4272 wrote to memory of 2140 4272 cmd.exe 154 PID 2140 wrote to memory of 1360 2140 FUGW.exe 155 PID 1360 wrote to memory of 3740 1360 cmd.exe 159 PID 3740 wrote to memory of 5404 3740 LHFXM.exe 160 PID 5404 wrote to memory of 4648 5404 cmd.exe 164 PID 4648 wrote to memory of 3048 4648 NFSS.exe 165 PID 3048 wrote to memory of 2324 3048 cmd.exe 169 PID 2324 wrote to memory of 1780 2324 CICWNPB.exe 170 PID 1780 wrote to memory of 756 1780 cmd.exe 174 PID 756 wrote to memory of 920 756 BTFM.exe 175 PID 920 wrote to memory of 2296 920 cmd.exe 179 PID 2296 wrote to memory of 1748 2296 ADP.exe 180 PID 1748 wrote to memory of 1940 1748 cmd.exe 184 PID 1940 wrote to memory of 4808 1940 GZTDK.exe 185 PID 4808 wrote to memory of 5664 4808 cmd.exe 189 PID 5664 wrote to memory of 5148 5664 ZRJ.exe 190 PID 5148 wrote to memory of 5876 5148 cmd.exe 194 PID 5876 wrote to memory of 1072 5876 OHKFAM.exe 195 PID 1072 wrote to memory of 6096 1072 cmd.exe 199 PID 6096 wrote to memory of 2808 6096 RUBPTFO.exe 200 PID 2808 wrote to memory of 2028 2808 cmd.exe 204 PID 2028 wrote to memory of 2220 2028 INEXUL.exe 205 PID 2220 wrote to memory of 872 2220 cmd.exe 209 PID 872 wrote to memory of 3292 872 QTQMFS.exe 210 PID 3292 wrote to memory of 4280 3292 cmd.exe 214 PID 4280 wrote to memory of 1308 4280 OETUN.exe 215 PID 1308 wrote to memory of 5996 1308 cmd.exe 219 PID 5996 wrote to memory of 1292 5996 YBZODGC.exe 220 PID 1292 wrote to memory of 468 1292 cmd.exe 224 PID 468 wrote to memory of 5656 468 XMJEDM.exe 225 PID 5656 wrote to memory of 4880 5656 cmd.exe 229 PID 4880 wrote to memory of 900 4880 KXSDSX.exe 230 PID 900 wrote to memory of 1540 900 cmd.exe 234 PID 1540 wrote to memory of 5436 1540 LAW.exe 235 PID 5436 wrote to memory of 3120 5436 cmd.exe 239 PID 3120 wrote to memory of 572 3120 NYJ.exe 240 PID 572 wrote to memory of 1080 572 cmd.exe 244 PID 1080 wrote to memory of 4560 1080 VDOZXUZ.exe 245 PID 4560 wrote to memory of 4784 4560 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-27_ae39f71e8b8dc0876c8b67a649e6e636_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-27_ae39f71e8b8dc0876c8b67a649e6e636_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FNYIWPE.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\windows\SysWOW64\FNYIWPE.exeC:\windows\system32\FNYIWPE.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IVLXN.exe.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3244 -
C:\windows\SysWOW64\IVLXN.exeC:\windows\system32\IVLXN.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WQWYSSJ.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:688 -
C:\windows\system\WQWYSSJ.exeC:\windows\system\WQWYSSJ.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YOKS.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:800 -
C:\windows\YOKS.exeC:\windows\YOKS.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TBPCSA.exe.bat" "10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6008 -
C:\windows\SysWOW64\TBPCSA.exeC:\windows\system32\TBPCSA.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YBP.exe.bat" "12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\windows\SysWOW64\YBP.exeC:\windows\system32\YBP.exe13⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QKRVFAK.exe.bat" "14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:720 -
C:\windows\SysWOW64\QKRVFAK.exeC:\windows\system32\QKRVFAK.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DUHTT.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\windows\DUHTT.exeC:\windows\DUHTT.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JIGUYF.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\windows\SysWOW64\JIGUYF.exeC:\windows\system32\JIGUYF.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NYNUC.exe.bat" "20⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\windows\system\NYNUC.exeC:\windows\system\NYNUC.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RGTCOQX.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\windows\system\RGTCOQX.exeC:\windows\system\RGTCOQX.exe23⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BEZWD.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:5612 -
C:\windows\SysWOW64\BEZWD.exeC:\windows\system32\BEZWD.exe25⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FUGW.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\windows\SysWOW64\FUGW.exeC:\windows\system32\FUGW.exe27⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LHFXM.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\windows\system\LHFXM.exeC:\windows\system\LHFXM.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NFSS.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:5404 -
C:\windows\system\NFSS.exeC:\windows\system\NFSS.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CICWNPB.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\windows\CICWNPB.exeC:\windows\CICWNPB.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BTFM.exe.bat" "34⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\windows\system\BTFM.exeC:\windows\system\BTFM.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ADP.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:920 -
C:\windows\system\ADP.exeC:\windows\system\ADP.exe37⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GZTDK.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\windows\SysWOW64\GZTDK.exeC:\windows\system32\GZTDK.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZRJ.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\windows\SysWOW64\ZRJ.exeC:\windows\system32\ZRJ.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5664 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OHKFAM.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:5148 -
C:\windows\OHKFAM.exeC:\windows\OHKFAM.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RUBPTFO.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\windows\SysWOW64\RUBPTFO.exeC:\windows\system32\RUBPTFO.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6096 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\INEXUL.exe.bat" "46⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\windows\SysWOW64\INEXUL.exeC:\windows\system32\INEXUL.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QTQMFS.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\windows\system\QTQMFS.exeC:\windows\system\QTQMFS.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OETUN.exe.bat" "50⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\windows\system\OETUN.exeC:\windows\system\OETUN.exe51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YBZODGC.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\windows\system\YBZODGC.exeC:\windows\system\YBZODGC.exe53⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XMJEDM.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\windows\system\XMJEDM.exeC:\windows\system\XMJEDM.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KXSDSX.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:5656 -
C:\windows\SysWOW64\KXSDSX.exeC:\windows\system32\KXSDSX.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LAW.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:900 -
C:\windows\SysWOW64\LAW.exeC:\windows\system32\LAW.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NYJ.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:5436 -
C:\windows\NYJ.exeC:\windows\NYJ.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VDOZXUZ.exe.bat" "62⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:572 -
C:\windows\SysWOW64\VDOZXUZ.exeC:\windows\system32\VDOZXUZ.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZTUHJ.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\windows\SysWOW64\ZTUHJ.exeC:\windows\system32\ZTUHJ.exe65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4784 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FHUIG.exe.bat" "66⤵PID:5008
-
C:\windows\FHUIG.exeC:\windows\FHUIG.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UKD.exe.bat" "68⤵PID:3632
-
C:\windows\SysWOW64\UKD.exeC:\windows\system32\UKD.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TUOCAQI.exe.bat" "70⤵PID:988
-
C:\windows\TUOCAQI.exeC:\windows\TUOCAQI.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5672 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SFRSIW.exe.bat" "72⤵PID:3932
-
C:\windows\SFRSIW.exeC:\windows\SFRSIW.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1272 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KIV.exe.bat" "74⤵PID:4556
-
C:\windows\KIV.exeC:\windows\KIV.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZDEAHY.exe.bat" "76⤵PID:3988
-
C:\windows\ZDEAHY.exeC:\windows\ZDEAHY.exe77⤵
- Executes dropped EXE
PID:5984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JBSNO.exe.bat" "78⤵PID:1500
-
C:\windows\system\JBSNO.exeC:\windows\system\JBSNO.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TBUAAMR.exe.bat" "80⤵
- System Location Discovery: System Language Discovery
PID:2264 -
C:\windows\SysWOW64\TBUAAMR.exeC:\windows\system32\TBUAAMR.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KKW.exe.bat" "82⤵PID:3160
-
C:\windows\SysWOW64\KKW.exeC:\windows\system32\KKW.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FXSON.exe.bat" "84⤵PID:1860
-
C:\windows\FXSON.exeC:\windows\FXSON.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\INHO.exe.bat" "86⤵PID:5740
-
C:\windows\SysWOW64\INHO.exeC:\windows\system32\INHO.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DAMGCC.exe.bat" "88⤵PID:3832
-
C:\windows\system\DAMGCC.exeC:\windows\system\DAMGCC.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NYRS.exe.bat" "90⤵PID:3096
-
C:\windows\SysWOW64\NYRS.exeC:\windows\system32\NYRS.exe91⤵
- Executes dropped EXE
PID:4444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ILWCU.exe.bat" "92⤵PID:1856
-
C:\windows\ILWCU.exeC:\windows\ILWCU.exe93⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4276 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RUYPXHS.exe.bat" "94⤵PID:5444
-
C:\windows\SysWOW64\RUYPXHS.exeC:\windows\system32\RUYPXHS.exe95⤵
- Executes dropped EXE
PID:6052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZZDVIO.exe.bat" "96⤵PID:4908
-
C:\windows\system\ZZDVIO.exeC:\windows\system\ZZDVIO.exe97⤵
- Executes dropped EXE
PID:2792 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OUMA.exe.bat" "98⤵PID:5344
-
C:\windows\system\OUMA.exeC:\windows\system\OUMA.exe99⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AFXNKN.exe.bat" "100⤵PID:1720
-
C:\windows\AFXNKN.exeC:\windows\AFXNKN.exe101⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1676 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MYAGKUH.exe.bat" "102⤵PID:5236
-
C:\windows\MYAGKUH.exeC:\windows\MYAGKUH.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QGHG.exe.bat" "104⤵PID:2780
-
C:\windows\QGHG.exeC:\windows\QGHG.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TWNOIXJ.exe.bat" "106⤵PID:5124
-
C:\windows\SysWOW64\TWNOIXJ.exeC:\windows\system32\TWNOIXJ.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AJMON.exe.bat" "108⤵PID:1132
-
C:\windows\SysWOW64\AJMON.exeC:\windows\system32\AJMON.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2288 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NUD.exe.bat" "110⤵PID:3452
-
C:\windows\system\NUD.exeC:\windows\system\NUD.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CKEFAY.exe.bat" "112⤵PID:2724
-
C:\windows\SysWOW64\CKEFAY.exeC:\windows\system32\CKEFAY.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RFNR.exe.bat" "114⤵PID:5276
-
C:\windows\RFNR.exeC:\windows\RFNR.exe115⤵
- Executes dropped EXE
PID:3376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BNPWX.exe.bat" "116⤵PID:5428
-
C:\windows\SysWOW64\BNPWX.exeC:\windows\system32\BNPWX.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BITS.exe.bat" "118⤵PID:5992
-
C:\windows\system\BITS.exeC:\windows\system\BITS.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HJBF.exe.bat" "120⤵PID:6072
-
C:\windows\system\HJBF.exeC:\windows\system\HJBF.exe121⤵
- Executes dropped EXE
PID:5632
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-