Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/06/2026, 06:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-27_6487ea63b0afd284a063c233016e89a7_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-27_6487ea63b0afd284a063c233016e89a7_elex_emotet_stop.exe
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 2026-06-27_6487ea63b0afd284a063c233016e89a7_elex_emotet_stop.exe
- Size 208KB
- Sample260629-hey37sft21
- SHA256 3f89ffd390817625b71e45641038ea3e909b25df6d60ed75b4ed22ac669c0dd6
- MD5 6487ea63b0afd284a063c233016e89a7
- SHA1 a4a4789c0b2d52cb5e96a49d675286538c2abbb2
- SHA512 f6ab26840bc11b1181bbcf31c2ab4eb11145afed48f032321827393c4e6b177adb31c02bf61202d32638610d4afa3301c83c6539ae20b81b8a7bfd16e77418ab
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlcKL+LOfA4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFlcS+LOYkEj1
- TLSH T18C247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2068 RZN.exe 5180 GPBXPC.exe 1564 HSF.exe 6668 FNECZ.exe 1424 LOLPIP.exe 4828 WGGIREB.exe 2376 LBYMC.exe 5708 LHQBLE.exe 6700 IMWYSFG.exe 2092 NNDMB.exe 460 IAIVMI.exe 4288 IOAKNVR.exe 3704 ZTL.exe 4336 FOKCAU.exe 6416 UJU.exe 7012 PXYQD.exe 6520 IACUIXB.exe 3204 ZIE.exe 5484 GDWDXP.exe 5836 OJOSGCH.exe 2772 DEXER.exe 3964 FBYYYD.exe 2748 APDIADM.exe 1100 GPLVR.exe 5788 GDDKS.exe 1772 KLS.exe 3612 OTYSJ.exe 6244 KYWPYFU.exe 3716 WRZ.exe 6604 SWF.exe 1304 UUY.exe 3968 PHDJW.exe 7000 JVISGKX.exe 5192 PVPG.exe 3140 YDRLS.exe 4928 QJC.exe 6472 QWCR.exe 5808 MUAO.exe 6612 MMIQFI.exe 996 GAN.exe 2488 SSQSXXM.exe 6184 UQJMVMU.exe 1960 LDUEL.exe 2216 LJUTNV.exe 5996 CWFLDSZ.exe 3108 XJJ.exe 6468 RXGDX.exe 2088 XSF.exe 2032 DSNAL.exe 6828 OLQT.exe 6988 MLYGCYK.exe 3452 PZCQ.exe 6180 PEVE.exe 5804 VECSXND.exe 3672 JKI.exe 1856 LIJJKMN.exe 3404 EFNPXTO.exe 3944 ZTRY.exe 3264 ZGSNJ.exe 1116 FHZBSAH.exe 4796 JPGBE.exe 5128 JUGPFXY.exe 720 LHLZ.exe 5556 PXSHCPA.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\AJMEO.exe YTLCH.exe File opened for modification C:\windows\SysWOW64\HDLPU.exe YDJK.exe File created C:\windows\SysWOW64\LBYMC.exe WGGIREB.exe File created C:\windows\SysWOW64\DEXER.exe OJOSGCH.exe File opened for modification C:\windows\SysWOW64\XSF.exe RXGDX.exe File created C:\windows\SysWOW64\ZGSNJ.exe ZTRY.exe File created C:\windows\SysWOW64\NJMMJ.exe.bat DBK.exe File created C:\windows\SysWOW64\FCQ.exe DHLURV.exe File created C:\windows\SysWOW64\YTGE.exe.bat NAD.exe File created C:\windows\SysWOW64\TOGV.exe TIN.exe File created C:\windows\SysWOW64\UUY.exe SWF.exe File created C:\windows\SysWOW64\NBOVCHE.exe SGRLA.exe File opened for modification C:\windows\SysWOW64\LGBL.exe JQHR.exe File created C:\windows\SysWOW64\BMB.exe.bat MRRPUOK.exe File opened for modification C:\windows\SysWOW64\KLS.exe GDDKS.exe File created C:\windows\SysWOW64\CWFLDSZ.exe.bat LJUTNV.exe File created C:\windows\SysWOW64\RXGDX.exe XJJ.exe File created C:\windows\SysWOW64\LOLPIP.exe.bat FNECZ.exe File opened for modification C:\windows\SysWOW64\GDDKS.exe GPLVR.exe File created C:\windows\SysWOW64\RXGDX.exe.bat XJJ.exe File created C:\windows\SysWOW64\XSF.exe.bat RXGDX.exe File created C:\windows\SysWOW64\OLQT.exe DSNAL.exe File created C:\windows\SysWOW64\NJCWY.exe.bat IJU.exe File created C:\windows\SysWOW64\AOK.exe GBFUQE.exe File opened for modification C:\windows\SysWOW64\IXUV.exe LROY.exe File created C:\windows\SysWOW64\EPBQTWW.exe TXGXTG.exe File created C:\windows\SysWOW64\OLQT.exe.bat DSNAL.exe File created C:\windows\SysWOW64\FHZBSAH.exe.bat ZGSNJ.exe File opened for modification C:\windows\SysWOW64\WQRQGAZ.exe CDMGW.exe File created C:\windows\SysWOW64\NJMMJ.exe DBK.exe File opened for modification C:\windows\SysWOW64\YTGE.exe NAD.exe File opened for modification C:\windows\SysWOW64\PMR.exe ETOSRH.exe File created C:\windows\SysWOW64\AMNJ.exe.bat OEGJRVH.exe File created C:\windows\SysWOW64\GPBXPC.exe RZN.exe File created C:\windows\SysWOW64\CWFLDSZ.exe LJUTNV.exe File opened for modification C:\windows\SysWOW64\XJJ.exe CWFLDSZ.exe File opened for modification C:\windows\SysWOW64\DSNAL.exe XSF.exe File created C:\windows\SysWOW64\QXBP.exe.bat KWUBOMR.exe File created C:\windows\SysWOW64\TBUAAMR.exe NJMMJ.exe File opened for modification C:\windows\SysWOW64\EVB.exe EPBQTWW.exe File created C:\windows\SysWOW64\WDIR.exe.bat NVGMM.exe File created C:\windows\SysWOW64\PXYQD.exe UJU.exe File opened for modification C:\windows\SysWOW64\MMIQFI.exe MUAO.exe File created C:\windows\SysWOW64\LDUEL.exe.bat UQJMVMU.exe File created C:\windows\SysWOW64\PTFIO.exe.bat EACP.exe File created C:\windows\SysWOW64\PWCKGFV.exe IBF.exe File opened for modification C:\windows\SysWOW64\NVGMM.exe THBV.exe File created C:\windows\SysWOW64\BMB.exe MRRPUOK.exe File created C:\windows\SysWOW64\HDLPU.exe.bat YDJK.exe File created C:\windows\SysWOW64\TOGV.exe.bat TIN.exe File created C:\windows\SysWOW64\MRRPUOK.exe.bat KBQNORU.exe File created C:\windows\SysWOW64\GPBXPC.exe.bat RZN.exe File opened for modification C:\windows\SysWOW64\OLQT.exe DSNAL.exe File created C:\windows\SysWOW64\PXSHCPA.exe.bat LHLZ.exe File created C:\windows\SysWOW64\EVB.exe EPBQTWW.exe File created C:\windows\SysWOW64\HDLPU.exe YDJK.exe File created C:\windows\SysWOW64\LBYMC.exe.bat WGGIREB.exe File created C:\windows\SysWOW64\GDWDXP.exe.bat ZIE.exe File created C:\windows\SysWOW64\KYWPYFU.exe.bat OTYSJ.exe File created C:\windows\SysWOW64\IAFBJRE.exe LVA.exe File opened for modification C:\windows\SysWOW64\KKW.exe TBUAAMR.exe File created C:\windows\SysWOW64\KKW.exe.bat TBUAAMR.exe File created C:\windows\SysWOW64\PMR.exe ETOSRH.exe File created C:\windows\SysWOW64\NVGMM.exe THBV.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\JUGPFXY.exe.bat JPGBE.exe File created C:\windows\SVKL.exe SCKJ.exe File created C:\windows\system\XDD.exe.bat UPYBHP.exe File created C:\windows\OQGUIQ.exe.bat TDJL.exe File created C:\windows\system\SXBIYS.exe.bat BKR.exe File opened for modification C:\windows\system\NNDMB.exe IMWYSFG.exe File created C:\windows\BNKO.exe.bat QVH.exe File created C:\windows\system\BPWIGW.exe QXBP.exe File opened for modification C:\windows\ILG.exe TQXOM.exe File created C:\windows\system\NWXGG.exe.bat PWCKGFV.exe File created C:\windows\system\OTYSJ.exe KLS.exe File created C:\windows\UFPZ.exe.bat YZRC.exe File opened for modification C:\windows\THBV.exe REZO.exe File created C:\windows\RADBB.exe.bat FII.exe File opened for modification C:\windows\BER.exe VEROYOC.exe File created C:\windows\YDJK.exe.bat SDCXAFX.exe File created C:\windows\system\LJUTNV.exe.bat LDUEL.exe File opened for modification C:\windows\system\EFNPXTO.exe LIJJKMN.exe File created C:\windows\system\UPYBHP.exe UFPZ.exe File created C:\windows\WQTOAOO.exe AKVZLEM.exe File created C:\windows\system\TIN.exe.bat WDIR.exe File opened for modification C:\windows\system\TXGXTG.exe KKW.exe File created C:\windows\REZO.exe.bat NWXGG.exe File opened for modification C:\windows\GAN.exe MMIQFI.exe File created C:\windows\system\LJUTNV.exe LDUEL.exe File created C:\windows\MLYGCYK.exe.bat OLQT.exe File created C:\windows\KUA.exe.bat CPITFLK.exe File created C:\windows\system\GBFUQE.exe.bat LGBL.exe File created C:\windows\system\YTLCH.exe.bat RADBB.exe File created C:\windows\VEROYOC.exe AJMEO.exe File opened for modification C:\windows\system\GBFUQE.exe LGBL.exe File created C:\windows\IBF.exe.bat PTFIO.exe File opened for modification C:\windows\REZO.exe NWXGG.exe File opened for modification C:\windows\FBYYYD.exe DEXER.exe File opened for modification C:\windows\ZTL.exe IOAKNVR.exe File created C:\windows\QWCR.exe.bat QJC.exe File created C:\windows\system\VECSXND.exe PEVE.exe File created C:\windows\system\JKI.exe.bat VECSXND.exe File created C:\windows\system\LIJJKMN.exe JKI.exe File created C:\windows\system\EFNPXTO.exe LIJJKMN.exe File created C:\windows\system\LVA.exe.bat UKJOCNH.exe File created C:\windows\system\ZIE.exe IACUIXB.exe File opened for modification C:\windows\LROY.exe AZT.exe File created C:\windows\system\EACP.exe.bat WQTOAOO.exe File created C:\windows\MLYGCYK.exe OLQT.exe File created C:\windows\system\EFNPXTO.exe.bat LIJJKMN.exe File created C:\windows\SCKJ.exe XPFAMNK.exe File created C:\windows\HMTK.exe VTY.exe File opened for modification C:\windows\MUAO.exe QWCR.exe File created C:\windows\system\JJU.exe HMTK.exe File created C:\windows\system\YACLWK.exe BVXWPA.exe File created C:\windows\ILG.exe.bat TQXOM.exe File created C:\windows\FII.exe.bat BABIHN.exe File created C:\windows\system\OJOSGCH.exe.bat GDWDXP.exe File created C:\windows\system\PEVE.exe.bat PZCQ.exe File created C:\windows\IJU.exe.bat WQRQGAZ.exe File opened for modification C:\windows\DHLURV.exe ROIJQ.exe File opened for modification C:\windows\system\IACUIXB.exe PXYQD.exe File created C:\windows\QRGQY.exe RGQTZ.exe File opened for modification C:\windows\system\ROIJQ.exe TOBOZ.exe File created C:\windows\system\GPLVR.exe APDIADM.exe File created C:\windows\ZTRY.exe.bat EFNPXTO.exe File opened for modification C:\windows\QRGQY.exe RGQTZ.exe File created C:\windows\system\BVXWPA.exe.bat BPWIGW.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 64 IoCs
pid pid_target Process procid_target 5884 4612 WerFault.exe 89 3672 2068 WerFault.exe 94 3152 5180 WerFault.exe 100 7136 1564 WerFault.exe 105 5480 6668 WerFault.exe 110 6624 1424 WerFault.exe 115 4532 4828 WerFault.exe 120 4956 2376 WerFault.exe 125 6800 5708 WerFault.exe 130 504 6700 WerFault.exe 135 6944 2092 WerFault.exe 140 6544 460 WerFault.exe 145 6148 4288 WerFault.exe 150 5316 3704 WerFault.exe 155 1236 4336 WerFault.exe 160 2568 6416 WerFault.exe 165 3096 7012 WerFault.exe 170 3884 6520 WerFault.exe 175 6128 3204 WerFault.exe 180 2936 5484 WerFault.exe 185 5636 5836 WerFault.exe 190 2552 2772 WerFault.exe 194 1108 3964 WerFault.exe 200 4604 2748 WerFault.exe 205 6224 1100 WerFault.exe 210 4180 5788 WerFault.exe 215 2312 1772 WerFault.exe 220 2320 3612 WerFault.exe 225 1588 6244 WerFault.exe 230 5652 3716 WerFault.exe 235 7068 6604 WerFault.exe 240 6316 1304 WerFault.exe 245 6968 3968 WerFault.exe 250 4384 7000 WerFault.exe 255 2076 5192 WerFault.exe 260 2108 3140 WerFault.exe 265 2456 4928 WerFault.exe 270 580 6472 WerFault.exe 275 5636 5808 WerFault.exe 280 6620 6612 WerFault.exe 285 1596 996 WerFault.exe 290 1276 2488 WerFault.exe 294 2024 6184 WerFault.exe 300 1756 1960 WerFault.exe 305 5332 2216 WerFault.exe 310 2992 5996 WerFault.exe 315 1868 3108 WerFault.exe 320 3128 6468 WerFault.exe 325 1340 2088 WerFault.exe 330 7116 2032 WerFault.exe 335 3256 6828 WerFault.exe 340 4516 6988 WerFault.exe 345 1724 3452 WerFault.exe 350 4280 6180 WerFault.exe 355 1764 5804 WerFault.exe 360 2336 3672 WerFault.exe 365 5668 1856 WerFault.exe 370 4468 3404 WerFault.exe 375 4728 3944 WerFault.exe 380 2524 3264 WerFault.exe 385 1368 1116 WerFault.exe 390 5696 4796 WerFault.exe 395 5968 5128 WerFault.exe 400 6576 720 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BPWIGW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KLS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LIJJKMN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BNKO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OQGUIQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PXYQD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TBUAAMR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ROIJQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FHZBSAH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NNDMB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JJU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FCQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZIE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RADBB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JUGPFXY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PXSHCPA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IAFBJRE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DHLURV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WQTOAOO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OTYSJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MMIQFI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PWCKGFV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LBYMC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GDDKS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YTGE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KUA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HDLPU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PHDJW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TQXOM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EFNPXTO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IBV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IJU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GBFUQE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RZN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IACUIXB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NJMMJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KBQNORU.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4612 2026-06-27_6487ea63b0afd284a063c233016e89a7_elex_emotet_stop.exe 4612 2026-06-27_6487ea63b0afd284a063c233016e89a7_elex_emotet_stop.exe 2068 RZN.exe 2068 RZN.exe 5180 GPBXPC.exe 5180 GPBXPC.exe 1564 HSF.exe 1564 HSF.exe 6668 FNECZ.exe 6668 FNECZ.exe 1424 LOLPIP.exe 1424 LOLPIP.exe 4828 WGGIREB.exe 4828 WGGIREB.exe 2376 LBYMC.exe 2376 LBYMC.exe 5708 LHQBLE.exe 5708 LHQBLE.exe 6700 IMWYSFG.exe 6700 IMWYSFG.exe 2092 NNDMB.exe 2092 NNDMB.exe 460 IAIVMI.exe 460 IAIVMI.exe 4288 IOAKNVR.exe 4288 IOAKNVR.exe 3704 ZTL.exe 3704 ZTL.exe 4336 FOKCAU.exe 4336 FOKCAU.exe 6416 UJU.exe 6416 UJU.exe 7012 PXYQD.exe 7012 PXYQD.exe 6520 IACUIXB.exe 6520 IACUIXB.exe 3204 ZIE.exe 3204 ZIE.exe 5484 GDWDXP.exe 5484 GDWDXP.exe 5836 OJOSGCH.exe 5836 OJOSGCH.exe 2772 DEXER.exe 2772 DEXER.exe 3964 FBYYYD.exe 3964 FBYYYD.exe 2748 APDIADM.exe 2748 APDIADM.exe 1100 GPLVR.exe 1100 GPLVR.exe 5788 GDDKS.exe 5788 GDDKS.exe 1772 KLS.exe 1772 KLS.exe 3612 OTYSJ.exe 3612 OTYSJ.exe 6244 KYWPYFU.exe 6244 KYWPYFU.exe 3716 WRZ.exe 3716 WRZ.exe 6604 SWF.exe 6604 SWF.exe 1304 UUY.exe 1304 UUY.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4612 2026-06-27_6487ea63b0afd284a063c233016e89a7_elex_emotet_stop.exe 4612 2026-06-27_6487ea63b0afd284a063c233016e89a7_elex_emotet_stop.exe 2068 RZN.exe 2068 RZN.exe 5180 GPBXPC.exe 5180 GPBXPC.exe 1564 HSF.exe 1564 HSF.exe 6668 FNECZ.exe 6668 FNECZ.exe 1424 LOLPIP.exe 1424 LOLPIP.exe 4828 WGGIREB.exe 4828 WGGIREB.exe 2376 LBYMC.exe 2376 LBYMC.exe 5708 LHQBLE.exe 5708 LHQBLE.exe 6700 IMWYSFG.exe 6700 IMWYSFG.exe 2092 NNDMB.exe 2092 NNDMB.exe 460 IAIVMI.exe 460 IAIVMI.exe 4288 IOAKNVR.exe 4288 IOAKNVR.exe 3704 ZTL.exe 3704 ZTL.exe 4336 FOKCAU.exe 4336 FOKCAU.exe 6416 UJU.exe 6416 UJU.exe 7012 PXYQD.exe 7012 PXYQD.exe 6520 IACUIXB.exe 6520 IACUIXB.exe 3204 ZIE.exe 3204 ZIE.exe 5484 GDWDXP.exe 5484 GDWDXP.exe 5836 OJOSGCH.exe 5836 OJOSGCH.exe 2772 DEXER.exe 2772 DEXER.exe 3964 FBYYYD.exe 3964 FBYYYD.exe 2748 APDIADM.exe 2748 APDIADM.exe 1100 GPLVR.exe 1100 GPLVR.exe 5788 GDDKS.exe 5788 GDDKS.exe 1772 KLS.exe 1772 KLS.exe 3612 OTYSJ.exe 3612 OTYSJ.exe 6244 KYWPYFU.exe 6244 KYWPYFU.exe 3716 WRZ.exe 3716 WRZ.exe 6604 SWF.exe 6604 SWF.exe 1304 UUY.exe 1304 UUY.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4612 wrote to memory of 4060 4612 2026-06-27_6487ea63b0afd284a063c233016e89a7_elex_emotet_stop.exe 90 PID 4060 wrote to memory of 2068 4060 cmd.exe 94 PID 2068 wrote to memory of 7148 2068 RZN.exe 96 PID 7148 wrote to memory of 5180 7148 cmd.exe 100 PID 5180 wrote to memory of 1980 5180 GPBXPC.exe 101 PID 1980 wrote to memory of 1564 1980 cmd.exe 105 PID 1564 wrote to memory of 5832 1564 HSF.exe 106 PID 5832 wrote to memory of 6668 5832 cmd.exe 110 PID 6668 wrote to memory of 5660 6668 FNECZ.exe 111 PID 5660 wrote to memory of 1424 5660 cmd.exe 115 PID 1424 wrote to memory of 5040 1424 LOLPIP.exe 116 PID 5040 wrote to memory of 4828 5040 cmd.exe 120 PID 4828 wrote to memory of 3764 4828 WGGIREB.exe 121 PID 3764 wrote to memory of 2376 3764 cmd.exe 125 PID 2376 wrote to memory of 1988 2376 LBYMC.exe 126 PID 1988 wrote to memory of 5708 1988 cmd.exe 130 PID 5708 wrote to memory of 6724 5708 LHQBLE.exe 131 PID 6724 wrote to memory of 6700 6724 cmd.exe 135 PID 6700 wrote to memory of 5132 6700 IMWYSFG.exe 136 PID 5132 wrote to memory of 2092 5132 cmd.exe 140 PID 2092 wrote to memory of 248 2092 NNDMB.exe 141 PID 248 wrote to memory of 460 248 cmd.exe 145 PID 460 wrote to memory of 6240 460 IAIVMI.exe 146 PID 6240 wrote to memory of 4288 6240 cmd.exe 150 PID 4288 wrote to memory of 4552 4288 IOAKNVR.exe 151 PID 4552 wrote to memory of 3704 4552 cmd.exe 155 PID 3704 wrote to memory of 5500 3704 ZTL.exe 156 PID 5500 wrote to memory of 4336 5500 cmd.exe 160 PID 4336 wrote to memory of 1664 4336 FOKCAU.exe 161 PID 1664 wrote to memory of 6416 1664 cmd.exe 165 PID 6416 wrote to memory of 6752 6416 UJU.exe 166 PID 6752 wrote to memory of 7012 6752 cmd.exe 170 PID 7012 wrote to memory of 5108 7012 PXYQD.exe 171 PID 5108 wrote to memory of 6520 5108 cmd.exe 175 PID 6520 wrote to memory of 4224 6520 IACUIXB.exe 176 PID 4224 wrote to memory of 3204 4224 cmd.exe 180 PID 3204 wrote to memory of 5884 3204 ZIE.exe 181 PID 5884 wrote to memory of 5484 5884 cmd.exe 185 PID 5484 wrote to memory of 1812 5484 GDWDXP.exe 186 PID 1812 wrote to memory of 5836 1812 cmd.exe 190 PID 5836 wrote to memory of 7052 5836 OJOSGCH.exe 191 PID 7052 wrote to memory of 2772 7052 cmd.exe 194 PID 2772 wrote to memory of 5468 2772 DEXER.exe 196 PID 5468 wrote to memory of 3964 5468 cmd.exe 200 PID 3964 wrote to memory of 4132 3964 FBYYYD.exe 201 PID 4132 wrote to memory of 2748 4132 cmd.exe 205 PID 2748 wrote to memory of 6428 2748 APDIADM.exe 206 PID 6428 wrote to memory of 1100 6428 cmd.exe 210 PID 1100 wrote to memory of 7060 1100 GPLVR.exe 211 PID 7060 wrote to memory of 5788 7060 cmd.exe 215 PID 5788 wrote to memory of 6580 5788 GDDKS.exe 216 PID 6580 wrote to memory of 1772 6580 cmd.exe 220 PID 1772 wrote to memory of 4308 1772 KLS.exe 221 PID 4308 wrote to memory of 3612 4308 cmd.exe 225 PID 3612 wrote to memory of 364 3612 OTYSJ.exe 226 PID 364 wrote to memory of 6244 364 cmd.exe 230 PID 6244 wrote to memory of 2892 6244 KYWPYFU.exe 231 PID 2892 wrote to memory of 3716 2892 cmd.exe 235 PID 3716 wrote to memory of 1580 3716 WRZ.exe 236 PID 1580 wrote to memory of 6604 1580 cmd.exe 240 PID 6604 wrote to memory of 1736 6604 SWF.exe 241 PID 1736 wrote to memory of 1304 1736 cmd.exe 245 PID 1304 wrote to memory of 1384 1304 UUY.exe 246 PID 1384 wrote to memory of 3968 1384 cmd.exe 250
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-27_6487ea63b0afd284a063c233016e89a7_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-27_6487ea63b0afd284a063c233016e89a7_elex_emotet_stop.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RZN.exe.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\windows\SysWOW64\RZN.exeC:\windows\system32\RZN.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GPBXPC.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:7148 -
C:\windows\SysWOW64\GPBXPC.exeC:\windows\system32\GPBXPC.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5180 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HSF.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\windows\system\HSF.exeC:\windows\system\HSF.exe7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FNECZ.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:5832 -
C:\windows\FNECZ.exeC:\windows\FNECZ.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LOLPIP.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:5660 -
C:\windows\SysWOW64\LOLPIP.exeC:\windows\system32\LOLPIP.exe11⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WGGIREB.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\windows\SysWOW64\WGGIREB.exeC:\windows\system32\WGGIREB.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LBYMC.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\windows\SysWOW64\LBYMC.exeC:\windows\system32\LBYMC.exe15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LHQBLE.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\windows\system\LHQBLE.exeC:\windows\system\LHQBLE.exe17⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IMWYSFG.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:6724 -
C:\windows\system\IMWYSFG.exeC:\windows\system\IMWYSFG.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NNDMB.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:5132 -
C:\windows\system\NNDMB.exeC:\windows\system\NNDMB.exe21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IAIVMI.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:248 -
C:\windows\SysWOW64\IAIVMI.exeC:\windows\system32\IAIVMI.exe23⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IOAKNVR.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:6240 -
C:\windows\IOAKNVR.exeC:\windows\IOAKNVR.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZTL.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\windows\ZTL.exeC:\windows\ZTL.exe27⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FOKCAU.exe.bat" "28⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5500 -
C:\windows\system\FOKCAU.exeC:\windows\system\FOKCAU.exe29⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UJU.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\windows\system\UJU.exeC:\windows\system\UJU.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PXYQD.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:6752 -
C:\windows\SysWOW64\PXYQD.exeC:\windows\system32\PXYQD.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:7012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IACUIXB.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\windows\system\IACUIXB.exeC:\windows\system\IACUIXB.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZIE.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\windows\system\ZIE.exeC:\windows\system\ZIE.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3204 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GDWDXP.exe.bat" "38⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5884 -
C:\windows\SysWOW64\GDWDXP.exeC:\windows\system32\GDWDXP.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5484 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OJOSGCH.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\windows\system\OJOSGCH.exeC:\windows\system\OJOSGCH.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DEXER.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:7052 -
C:\windows\SysWOW64\DEXER.exeC:\windows\system32\DEXER.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FBYYYD.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:5468 -
C:\windows\FBYYYD.exeC:\windows\FBYYYD.exe45⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\APDIADM.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\windows\APDIADM.exeC:\windows\APDIADM.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GPLVR.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:6428 -
C:\windows\system\GPLVR.exeC:\windows\system\GPLVR.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GDDKS.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:7060 -
C:\windows\SysWOW64\GDDKS.exeC:\windows\system32\GDDKS.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KLS.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:6580 -
C:\windows\SysWOW64\KLS.exeC:\windows\system32\KLS.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OTYSJ.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\windows\system\OTYSJ.exeC:\windows\system\OTYSJ.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KYWPYFU.exe.bat" "56⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:364 -
C:\windows\SysWOW64\KYWPYFU.exeC:\windows\system32\KYWPYFU.exe57⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WRZ.exe.bat" "58⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\windows\WRZ.exeC:\windows\WRZ.exe59⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SWF.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\windows\SWF.exeC:\windows\SWF.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6604 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UUY.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\windows\SysWOW64\UUY.exeC:\windows\system32\UUY.exe63⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PHDJW.exe.bat" "64⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\windows\PHDJW.exeC:\windows\PHDJW.exe65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JVISGKX.exe.bat" "66⤵PID:2532
-
C:\windows\system\JVISGKX.exeC:\windows\system\JVISGKX.exe67⤵
- Executes dropped EXE
PID:7000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PVPG.exe.bat" "68⤵PID:2112
-
C:\windows\SysWOW64\PVPG.exeC:\windows\system32\PVPG.exe69⤵
- Executes dropped EXE
PID:5192 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YDRLS.exe.bat" "70⤵PID:6772
-
C:\windows\system\YDRLS.exeC:\windows\system\YDRLS.exe71⤵
- Executes dropped EXE
PID:3140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QJC.exe.bat" "72⤵PID:2492
-
C:\windows\SysWOW64\QJC.exeC:\windows\system32\QJC.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QWCR.exe.bat" "74⤵
- System Location Discovery: System Language Discovery
PID:5928 -
C:\windows\QWCR.exeC:\windows\QWCR.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MUAO.exe.bat" "76⤵PID:2260
-
C:\windows\MUAO.exeC:\windows\MUAO.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MMIQFI.exe.bat" "78⤵PID:7144
-
C:\windows\SysWOW64\MMIQFI.exeC:\windows\system32\MMIQFI.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GAN.exe.bat" "80⤵PID:7056
-
C:\windows\GAN.exeC:\windows\GAN.exe81⤵
- Executes dropped EXE
PID:996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SSQSXXM.exe.bat" "82⤵
- System Location Discovery: System Language Discovery
PID:3676 -
C:\windows\system\SSQSXXM.exeC:\windows\system\SSQSXXM.exe83⤵
- Executes dropped EXE
PID:2488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UQJMVMU.exe.bat" "84⤵PID:4404
-
C:\windows\system\UQJMVMU.exeC:\windows\system\UQJMVMU.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6184 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LDUEL.exe.bat" "86⤵PID:1396
-
C:\windows\SysWOW64\LDUEL.exeC:\windows\system32\LDUEL.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LJUTNV.exe.bat" "88⤵
- System Location Discovery: System Language Discovery
PID:1308 -
C:\windows\system\LJUTNV.exeC:\windows\system\LJUTNV.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2216 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CWFLDSZ.exe.bat" "90⤵PID:6524
-
C:\windows\SysWOW64\CWFLDSZ.exeC:\windows\system32\CWFLDSZ.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XJJ.exe.bat" "92⤵PID:2956
-
C:\windows\SysWOW64\XJJ.exeC:\windows\system32\XJJ.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RXGDX.exe.bat" "94⤵PID:1372
-
C:\windows\SysWOW64\RXGDX.exeC:\windows\system32\RXGDX.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XSF.exe.bat" "96⤵PID:5360
-
C:\windows\SysWOW64\XSF.exeC:\windows\system32\XSF.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DSNAL.exe.bat" "98⤵
- System Location Discovery: System Language Discovery
PID:2776 -
C:\windows\SysWOW64\DSNAL.exeC:\windows\system32\DSNAL.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2032 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OLQT.exe.bat" "100⤵PID:2084
-
C:\windows\SysWOW64\OLQT.exeC:\windows\system32\OLQT.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MLYGCYK.exe.bat" "102⤵PID:1644
-
C:\windows\MLYGCYK.exeC:\windows\MLYGCYK.exe103⤵
- Executes dropped EXE
PID:6988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PZCQ.exe.bat" "104⤵PID:6768
-
C:\windows\PZCQ.exeC:\windows\PZCQ.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PEVE.exe.bat" "106⤵PID:5172
-
C:\windows\system\PEVE.exeC:\windows\system\PEVE.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6180 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VECSXND.exe.bat" "108⤵PID:3688
-
C:\windows\system\VECSXND.exeC:\windows\system\VECSXND.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JKI.exe.bat" "110⤵PID:2456
-
C:\windows\system\JKI.exeC:\windows\system\JKI.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3672 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LIJJKMN.exe.bat" "112⤵PID:1720
-
C:\windows\system\LIJJKMN.exeC:\windows\system\LIJJKMN.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EFNPXTO.exe.bat" "114⤵PID:3068
-
C:\windows\system\EFNPXTO.exeC:\windows\system\EFNPXTO.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZTRY.exe.bat" "116⤵PID:6936
-
C:\windows\ZTRY.exeC:\windows\ZTRY.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZGSNJ.exe.bat" "118⤵PID:4864
-
C:\windows\SysWOW64\ZGSNJ.exeC:\windows\system32\ZGSNJ.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FHZBSAH.exe.bat" "120⤵
- System Location Discovery: System Language Discovery
PID:6696 -
C:\windows\SysWOW64\FHZBSAH.exeC:\windows\system32\FHZBSAH.exe121⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1116
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-