Analysis
- max time kernel
90s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260617-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/06/2026, 07:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-27_47d5edca7f7686fe4d6457ca7d33c5d9_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-27_47d5edca7f7686fe4d6457ca7d33c5d9_elex_emotet_stop.exe
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 2026-06-27_47d5edca7f7686fe4d6457ca7d33c5d9_elex_emotet_stop.exe
- Size 208KB
- Sample260629-jm9qcagv21
- SHA256 7113a2a5e78dc1cab89a8703603f78193dcc25150d96b0e30e46f376e062201d
- MD5 47d5edca7f7686fe4d6457ca7d33c5d9
- SHA1 efa14255535082a23f3b64704ce35b4c69edd1b6
- SHA512 bd7aa77224d5609815e2b33d984a83a1ae76784c3b210c98777010463dbb41a1fea7d8ab69906a1ac5fc0cade3e0cf46c18b5c362270e396680e7a71741e3810
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbclcdL+LOfc4NLthEjQT6E:MlZtbLWIgd1LZ9oECZbclc5+LOUQEj6
- TLSH T1EC247D2236D2C073E4B7023188F6C7787BB6BD919B36928B77C03B4D6E715A68A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4716 WDNTN.exe 1308 BDB.exe 2128 DLWCIT.exe 2792 EOAGW.exe 2356 CPITFLK.exe 2856 IKH.exe 3580 XFQHVB.exe 5736 YIUCAZJ.exe 6064 HIWHLW.exe 4616 NJEVUZ.exe 4304 WRGI.exe 3720 VCI.exe 5416 USUTUPT.exe 2524 UVFX.exe 1904 WSL.exe 5528 RGQTZ.exe 4440 IOSGCL.exe 5140 YETXJ.exe 1056 UKD.exe 4080 AXCNWF.exe 4692 PAMZ.exe 1016 TIAABK.exe 2520 MLE.exe 900 WJK.exe 2364 CEJ.exe 1360 GMQ.exe 5788 MMX.exe 1252 GACVY.exe 4836 ZDGZ.exe 2664 AGKVJL.exe 3688 FGR.exe 3156 ETQR.exe 832 ORW.exe 5572 DUOQXM.exe 2556 ZNPSB.exe 6024 FNX.exe 248 JQVBS.exe 3716 ZTF.exe 2004 ITHLO.exe 2304 XOQ.exe 5064 YSCT.exe 3164 WNTTKBS.exe 5396 IVIBW.exe 3456 XYR.exe 432 SLWP.exe 4484 HBX.exe 1996 FCECH.exe 2400 ZPJMRVI.exe 912 LHEFRL.exe 5912 VFSZH.exe 2800 EGUEKRI.exe 5896 TJDIV.exe 2704 BOWXX.exe 4084 QJN.exe 3272 ARHO.exe 3032 PIQ.exe 5496 CKYEOH.exe 1440 SAZW.exe 924 MOENXU.exe 624 WLKZMC.exe 704 KWAY.exe 4528 IHD.exe 2484 HAGEKHZ.exe 3364 AVK.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\AXCNWF.exe UKD.exe File created C:\windows\SysWOW64\FGR.exe AGKVJL.exe File created C:\windows\SysWOW64\ARHO.exe QJN.exe File created C:\windows\SysWOW64\VQDU.exe BDY.exe File opened for modification C:\windows\SysWOW64\PROX.exe POKUV.exe File created C:\windows\SysWOW64\NTFBDVD.exe.bat SJWD.exe File opened for modification C:\windows\SysWOW64\YOM.exe GGKRJ.exe File opened for modification C:\windows\SysWOW64\HPJB.exe AZI.exe File opened for modification C:\windows\SysWOW64\BDB.exe WDNTN.exe File created C:\windows\SysWOW64\USUTUPT.exe VCI.exe File created C:\windows\SysWOW64\MMX.exe GMQ.exe File opened for modification C:\windows\SysWOW64\ARHO.exe QJN.exe File created C:\windows\SysWOW64\NICR.exe JSORES.exe File opened for modification C:\windows\SysWOW64\YETXJ.exe IOSGCL.exe File opened for modification C:\windows\SysWOW64\TJDIV.exe EGUEKRI.exe File created C:\windows\SysWOW64\PMAHJR.exe.bat UYVQZ.exe File opened for modification C:\windows\SysWOW64\EUCAE.exe JHX.exe File opened for modification C:\windows\SysWOW64\GES.exe HTPG.exe File created C:\windows\SysWOW64\GES.exe.bat HTPG.exe File created C:\windows\SysWOW64\ETQR.exe FGR.exe File created C:\windows\SysWOW64\NICR.exe.bat JSORES.exe File created C:\windows\SysWOW64\HXA.exe.bat SCRFX.exe File created C:\windows\SysWOW64\JQVBS.exe FNX.exe File created C:\windows\SysWOW64\GKV.exe PXLKMQP.exe File created C:\windows\SysWOW64\GKV.exe.bat PXLKMQP.exe File created C:\windows\SysWOW64\AXCNWF.exe UKD.exe File created C:\windows\SysWOW64\FCECH.exe HBX.exe File opened for modification C:\windows\SysWOW64\FHDONKL.exe MEZ.exe File opened for modification C:\windows\SysWOW64\UKD.exe YETXJ.exe File created C:\windows\SysWOW64\MMX.exe.bat GMQ.exe File opened for modification C:\windows\SysWOW64\HBX.exe SLWP.exe File created C:\windows\SysWOW64\EUCAE.exe JHX.exe File created C:\windows\SysWOW64\GES.exe HTPG.exe File opened for modification C:\windows\SysWOW64\GKV.exe PXLKMQP.exe File created C:\windows\SysWOW64\KBMBZV.exe LQKL.exe File created C:\windows\SysWOW64\XNRLN.exe.bat EUCAE.exe File created C:\windows\SysWOW64\PAMZ.exe AXCNWF.exe File created C:\windows\SysWOW64\RJLBI.exe NTFBDVD.exe File opened for modification C:\windows\SysWOW64\KBMBZV.exe LQKL.exe File created C:\windows\SysWOW64\DUOQXM.exe ORW.exe File opened for modification C:\windows\SysWOW64\NICR.exe JSORES.exe File created C:\windows\SysWOW64\RJLBI.exe.bat NTFBDVD.exe File created C:\windows\SysWOW64\KBMBZV.exe.bat LQKL.exe File created C:\windows\SysWOW64\YETXJ.exe.bat IOSGCL.exe File opened for modification C:\windows\SysWOW64\FGR.exe AGKVJL.exe File created C:\windows\SysWOW64\ETQR.exe.bat FGR.exe File created C:\windows\SysWOW64\DUOQXM.exe.bat ORW.exe File opened for modification C:\windows\SysWOW64\JQVBS.exe FNX.exe File created C:\windows\SysWOW64\FCECH.exe.bat HBX.exe File created C:\windows\SysWOW64\VQDU.exe.bat BDY.exe File created C:\windows\SysWOW64\JQVBS.exe.bat FNX.exe File created C:\windows\SysWOW64\HBX.exe SLWP.exe File created C:\windows\SysWOW64\TJDIV.exe EGUEKRI.exe File created C:\windows\SysWOW64\FHDONKL.exe.bat MEZ.exe File created C:\windows\SysWOW64\AXCNWF.exe.bat UKD.exe File created C:\windows\SysWOW64\JZNH.exe.bat RRL.exe File created C:\windows\SysWOW64\UYVQZ.exe.bat QVXCZYR.exe File created C:\windows\SysWOW64\NTFBDVD.exe SJWD.exe File created C:\windows\SysWOW64\HPJB.exe AZI.exe File created C:\windows\SysWOW64\YETXJ.exe IOSGCL.exe File created C:\windows\SysWOW64\ZDGZ.exe GACVY.exe File created C:\windows\SysWOW64\UYVQZ.exe QVXCZYR.exe File opened for modification C:\windows\SysWOW64\NTFBDVD.exe SJWD.exe File created C:\windows\SysWOW64\UKD.exe YETXJ.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\YIUCAZJ.exe XFQHVB.exe File created C:\windows\IVIBW.exe.bat WNTTKBS.exe File opened for modification C:\windows\system\XYR.exe IVIBW.exe File created C:\windows\AVK.exe.bat HAGEKHZ.exe File created C:\windows\system\PQBMIK.exe AVK.exe File created C:\windows\NFKXFMY.exe ZAKL.exe File created C:\windows\system\HTPG.exe.bat NFKXFMY.exe File created C:\windows\FWR.exe KBMBZV.exe File opened for modification C:\windows\system\FNX.exe ZNPSB.exe File created C:\windows\ZTF.exe JQVBS.exe File created C:\windows\system\WNTTKBS.exe.bat YSCT.exe File created C:\windows\QVXCZYR.exe BAGY.exe File created C:\windows\QVXCZYR.exe.bat BAGY.exe File created C:\windows\system\POKUV.exe WTG.exe File opened for modification C:\windows\system\GGKRJ.exe ZQJ.exe File opened for modification C:\windows\system\LQKL.exe GKV.exe File created C:\windows\HIWHLW.exe.bat YIUCAZJ.exe File created C:\windows\WRGI.exe.bat NJEVUZ.exe File created C:\windows\system\MLE.exe TIAABK.exe File created C:\windows\system\JSORES.exe.bat QPKOZ.exe File created C:\windows\GIDIR.exe HXA.exe File created C:\windows\GMQ.exe CEJ.exe File created C:\windows\AGKVJL.exe.bat ZDGZ.exe File opened for modification C:\windows\system\WNTTKBS.exe YSCT.exe File opened for modification C:\windows\system\LHEFRL.exe ZPJMRVI.exe File created C:\windows\system\RXAPXQ.exe YUWMSAE.exe File created C:\windows\TZDXMY.exe PROX.exe File opened for modification C:\windows\TIAABK.exe PAMZ.exe File opened for modification C:\windows\system\SLWP.exe XYR.exe File created C:\windows\system\ZPJMRVI.exe.bat FCECH.exe File created C:\windows\system\LHEFRL.exe.bat ZPJMRVI.exe File created C:\windows\system\PIQ.exe ARHO.exe File opened for modification C:\windows\system\PIQ.exe ARHO.exe File created C:\windows\IHD.exe KWAY.exe File opened for modification C:\windows\RRL.exe EGCEP.exe File created C:\windows\system\XYR.exe.bat IVIBW.exe File created C:\windows\system\IXCUJWH.exe RXAPXQ.exe File opened for modification C:\windows\WTG.exe VQDU.exe File created C:\windows\system\KYKI.exe.bat GIDIR.exe File opened for modification C:\windows\KQSRR.exe RNOV.exe File created C:\windows\HIWHLW.exe YIUCAZJ.exe File created C:\windows\BOWXX.exe.bat TJDIV.exe File created C:\windows\system\QJN.exe BOWXX.exe File opened for modification C:\windows\SAZW.exe CKYEOH.exe File created C:\windows\IHD.exe.bat KWAY.exe File opened for modification C:\windows\AVK.exe HAGEKHZ.exe File created C:\windows\system\IXCUJWH.exe.bat RXAPXQ.exe File opened for modification C:\windows\system\WDNTN.exe 2026-06-27_47d5edca7f7686fe4d6457ca7d33c5d9_elex_emotet_stop.exe File created C:\windows\WRGI.exe NJEVUZ.exe File opened for modification C:\windows\system\MLE.exe TIAABK.exe File opened for modification C:\windows\system\WJK.exe MLE.exe File created C:\windows\system\ITHLO.exe ZTF.exe File created C:\windows\FWR.exe.bat KBMBZV.exe File opened for modification C:\windows\CPITFLK.exe EOAGW.exe File created C:\windows\system\IKH.exe CPITFLK.exe File opened for modification C:\windows\HIWHLW.exe YIUCAZJ.exe File created C:\windows\CEJ.exe WJK.exe File opened for modification C:\windows\CEJ.exe WJK.exe File created C:\windows\RRL.exe.bat EGCEP.exe File created C:\windows\system\MEZ.exe.bat GES.exe File created C:\windows\system\KYKI.exe GIDIR.exe File created C:\windows\system\WDNTN.exe 2026-06-27_47d5edca7f7686fe4d6457ca7d33c5d9_elex_emotet_stop.exe File opened for modification C:\windows\system\POKUV.exe WTG.exe File opened for modification C:\windows\ZAKL.exe TZDXMY.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 64 IoCs
pid pid_target Process procid_target 3276 1116 WerFault.exe 88 5600 4716 WerFault.exe 93 2932 1308 WerFault.exe 99 244 2128 WerFault.exe 104 5128 2792 WerFault.exe 109 3488 2356 WerFault.exe 114 1020 2856 WerFault.exe 119 2244 3580 WerFault.exe 124 2404 5736 WerFault.exe 129 4076 6064 WerFault.exe 134 6088 4616 WerFault.exe 139 2556 4304 WerFault.exe 144 4208 3720 WerFault.exe 149 4804 5416 WerFault.exe 154 872 2524 WerFault.exe 159 5328 1904 WerFault.exe 164 3308 5528 WerFault.exe 169 4776 4440 WerFault.exe 174 5772 5140 WerFault.exe 179 5864 1056 WerFault.exe 184 3512 4080 WerFault.exe 189 3432 4692 WerFault.exe 194 2256 1016 WerFault.exe 199 2484 2520 WerFault.exe 204 4624 900 WerFault.exe 209 3052 2364 WerFault.exe 214 1372 1360 WerFault.exe 219 1976 5788 WerFault.exe 224 3488 1252 WerFault.exe 229 5472 4836 WerFault.exe 234 4816 2664 WerFault.exe 239 560 3688 WerFault.exe 244 960 3156 WerFault.exe 249 2152 832 WerFault.exe 254 4128 5572 WerFault.exe 259 2264 2556 WerFault.exe 264 1276 6024 WerFault.exe 269 3852 248 WerFault.exe 274 4508 3716 WerFault.exe 280 3028 2004 WerFault.exe 285 1020 2304 WerFault.exe 290 3340 5064 WerFault.exe 295 4688 3164 WerFault.exe 300 2088 5396 WerFault.exe 305 1316 3456 WerFault.exe 310 3940 432 WerFault.exe 315 5412 4484 WerFault.exe 320 3616 1996 WerFault.exe 325 4732 2400 WerFault.exe 330 5468 912 WerFault.exe 335 920 5912 WerFault.exe 340 612 2800 WerFault.exe 345 720 5896 WerFault.exe 350 2308 2704 WerFault.exe 355 5928 4084 WerFault.exe 360 5568 3272 WerFault.exe 365 1976 3032 WerFault.exe 370 6104 5496 WerFault.exe 375 4808 1440 WerFault.exe 380 6076 924 WerFault.exe 385 4076 624 WerFault.exe 390 2700 704 WerFault.exe 395 2596 4528 WerFault.exe 400 3280 2484 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MEZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GGKRJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VQDU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NFKXFMY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GIDIR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PXLKMQP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UKD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YSCT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PROX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FWR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DUOQXM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MMX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JQVBS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AXCNWF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MLE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HIWHLW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZDGZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZTF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ETQR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BAGY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WJK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LHEFRL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AGKVJL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HTPG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RNOV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HPJB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UVFX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VFSZH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BOWXX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RXAPXQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UYVQZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QPKOZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YOM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JHX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XNRLN.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1116 2026-06-27_47d5edca7f7686fe4d6457ca7d33c5d9_elex_emotet_stop.exe 1116 2026-06-27_47d5edca7f7686fe4d6457ca7d33c5d9_elex_emotet_stop.exe 4716 WDNTN.exe 4716 WDNTN.exe 1308 BDB.exe 1308 BDB.exe 2128 DLWCIT.exe 2128 DLWCIT.exe 2792 EOAGW.exe 2792 EOAGW.exe 2356 CPITFLK.exe 2356 CPITFLK.exe 2856 IKH.exe 2856 IKH.exe 3580 XFQHVB.exe 3580 XFQHVB.exe 5736 YIUCAZJ.exe 5736 YIUCAZJ.exe 6064 HIWHLW.exe 6064 HIWHLW.exe 4616 NJEVUZ.exe 4616 NJEVUZ.exe 4304 WRGI.exe 4304 WRGI.exe 3720 VCI.exe 3720 VCI.exe 5416 USUTUPT.exe 5416 USUTUPT.exe 2524 UVFX.exe 2524 UVFX.exe 1904 WSL.exe 1904 WSL.exe 5528 RGQTZ.exe 5528 RGQTZ.exe 4440 IOSGCL.exe 4440 IOSGCL.exe 5140 YETXJ.exe 5140 YETXJ.exe 1056 UKD.exe 1056 UKD.exe 4080 AXCNWF.exe 4080 AXCNWF.exe 4692 PAMZ.exe 4692 PAMZ.exe 1016 TIAABK.exe 1016 TIAABK.exe 2520 MLE.exe 2520 MLE.exe 900 WJK.exe 900 WJK.exe 2364 CEJ.exe 2364 CEJ.exe 1360 GMQ.exe 1360 GMQ.exe 5788 MMX.exe 5788 MMX.exe 1252 GACVY.exe 1252 GACVY.exe 4836 ZDGZ.exe 4836 ZDGZ.exe 2664 AGKVJL.exe 2664 AGKVJL.exe 3688 FGR.exe 3688 FGR.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1116 2026-06-27_47d5edca7f7686fe4d6457ca7d33c5d9_elex_emotet_stop.exe 1116 2026-06-27_47d5edca7f7686fe4d6457ca7d33c5d9_elex_emotet_stop.exe 4716 WDNTN.exe 4716 WDNTN.exe 1308 BDB.exe 1308 BDB.exe 2128 DLWCIT.exe 2128 DLWCIT.exe 2792 EOAGW.exe 2792 EOAGW.exe 2356 CPITFLK.exe 2356 CPITFLK.exe 2856 IKH.exe 2856 IKH.exe 3580 XFQHVB.exe 3580 XFQHVB.exe 5736 YIUCAZJ.exe 5736 YIUCAZJ.exe 6064 HIWHLW.exe 6064 HIWHLW.exe 4616 NJEVUZ.exe 4616 NJEVUZ.exe 4304 WRGI.exe 4304 WRGI.exe 3720 VCI.exe 3720 VCI.exe 5416 USUTUPT.exe 5416 USUTUPT.exe 2524 UVFX.exe 2524 UVFX.exe 1904 WSL.exe 1904 WSL.exe 5528 RGQTZ.exe 5528 RGQTZ.exe 4440 IOSGCL.exe 4440 IOSGCL.exe 5140 YETXJ.exe 5140 YETXJ.exe 1056 UKD.exe 1056 UKD.exe 4080 AXCNWF.exe 4080 AXCNWF.exe 4692 PAMZ.exe 4692 PAMZ.exe 1016 TIAABK.exe 1016 TIAABK.exe 2520 MLE.exe 2520 MLE.exe 900 WJK.exe 900 WJK.exe 2364 CEJ.exe 2364 CEJ.exe 1360 GMQ.exe 1360 GMQ.exe 5788 MMX.exe 5788 MMX.exe 1252 GACVY.exe 1252 GACVY.exe 4836 ZDGZ.exe 4836 ZDGZ.exe 2664 AGKVJL.exe 2664 AGKVJL.exe 3688 FGR.exe 3688 FGR.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1116 wrote to memory of 2040 1116 2026-06-27_47d5edca7f7686fe4d6457ca7d33c5d9_elex_emotet_stop.exe 89 PID 2040 wrote to memory of 4716 2040 cmd.exe 93 PID 4716 wrote to memory of 5960 4716 WDNTN.exe 95 PID 5960 wrote to memory of 1308 5960 cmd.exe 99 PID 1308 wrote to memory of 3640 1308 BDB.exe 100 PID 3640 wrote to memory of 2128 3640 cmd.exe 104 PID 2128 wrote to memory of 2008 2128 DLWCIT.exe 105 PID 2008 wrote to memory of 2792 2008 cmd.exe 109 PID 2792 wrote to memory of 5936 2792 EOAGW.exe 110 PID 5936 wrote to memory of 2356 5936 cmd.exe 114 PID 2356 wrote to memory of 3968 2356 CPITFLK.exe 115 PID 3968 wrote to memory of 2856 3968 cmd.exe 119 PID 2856 wrote to memory of 3724 2856 IKH.exe 120 PID 3724 wrote to memory of 3580 3724 cmd.exe 124 PID 3580 wrote to memory of 5408 3580 XFQHVB.exe 125 PID 5408 wrote to memory of 5736 5408 cmd.exe 129 PID 5736 wrote to memory of 4756 5736 YIUCAZJ.exe 130 PID 4756 wrote to memory of 6064 4756 cmd.exe 134 PID 6064 wrote to memory of 696 6064 HIWHLW.exe 135 PID 696 wrote to memory of 4616 696 cmd.exe 139 PID 4616 wrote to memory of 4540 4616 NJEVUZ.exe 140 PID 4540 wrote to memory of 4304 4540 cmd.exe 144 PID 4304 wrote to memory of 3704 4304 WRGI.exe 145 PID 3704 wrote to memory of 3720 3704 cmd.exe 149 PID 3720 wrote to memory of 4544 3720 VCI.exe 150 PID 4544 wrote to memory of 5416 4544 cmd.exe 154 PID 5416 wrote to memory of 3924 5416 USUTUPT.exe 155 PID 3924 wrote to memory of 2524 3924 cmd.exe 159 PID 2524 wrote to memory of 5000 2524 UVFX.exe 160 PID 5000 wrote to memory of 1904 5000 cmd.exe 164 PID 1904 wrote to memory of 1768 1904 WSL.exe 165 PID 1768 wrote to memory of 5528 1768 cmd.exe 169 PID 5528 wrote to memory of 4992 5528 RGQTZ.exe 170 PID 4992 wrote to memory of 4440 4992 cmd.exe 174 PID 4440 wrote to memory of 1652 4440 IOSGCL.exe 175 PID 1652 wrote to memory of 5140 1652 cmd.exe 179 PID 5140 wrote to memory of 2916 5140 YETXJ.exe 180 PID 2916 wrote to memory of 1056 2916 cmd.exe 184 PID 1056 wrote to memory of 5580 1056 UKD.exe 185 PID 5580 wrote to memory of 4080 5580 cmd.exe 189 PID 4080 wrote to memory of 2588 4080 AXCNWF.exe 190 PID 2588 wrote to memory of 4692 2588 cmd.exe 194 PID 4692 wrote to memory of 5776 4692 PAMZ.exe 195 PID 5776 wrote to memory of 1016 5776 cmd.exe 199 PID 1016 wrote to memory of 2804 1016 TIAABK.exe 200 PID 2804 wrote to memory of 2520 2804 cmd.exe 204 PID 2520 wrote to memory of 1484 2520 MLE.exe 205 PID 1484 wrote to memory of 900 1484 cmd.exe 209 PID 900 wrote to memory of 1100 900 WJK.exe 210 PID 1100 wrote to memory of 2364 1100 cmd.exe 214 PID 2364 wrote to memory of 4344 2364 CEJ.exe 215 PID 4344 wrote to memory of 1360 4344 cmd.exe 219 PID 1360 wrote to memory of 3384 1360 GMQ.exe 220 PID 3384 wrote to memory of 5788 3384 cmd.exe 224 PID 5788 wrote to memory of 1908 5788 MMX.exe 225 PID 1908 wrote to memory of 1252 1908 cmd.exe 229 PID 1252 wrote to memory of 3308 1252 GACVY.exe 230 PID 3308 wrote to memory of 4836 3308 cmd.exe 234 PID 4836 wrote to memory of 5576 4836 ZDGZ.exe 235 PID 5576 wrote to memory of 2664 5576 cmd.exe 239 PID 2664 wrote to memory of 5632 2664 AGKVJL.exe 240 PID 5632 wrote to memory of 3688 5632 cmd.exe 244 PID 3688 wrote to memory of 1444 3688 FGR.exe 245 PID 1444 wrote to memory of 3156 1444 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-27_47d5edca7f7686fe4d6457ca7d33c5d9_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-27_47d5edca7f7686fe4d6457ca7d33c5d9_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WDNTN.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\windows\system\WDNTN.exeC:\windows\system\WDNTN.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BDB.exe.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5960 -
C:\windows\SysWOW64\BDB.exeC:\windows\system32\BDB.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DLWCIT.exe.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3640 -
C:\windows\DLWCIT.exeC:\windows\DLWCIT.exe7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EOAGW.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\windows\SysWOW64\EOAGW.exeC:\windows\system32\EOAGW.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CPITFLK.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:5936 -
C:\windows\CPITFLK.exeC:\windows\CPITFLK.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IKH.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\windows\system\IKH.exeC:\windows\system\IKH.exe13⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XFQHVB.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:3724 -
C:\windows\system\XFQHVB.exeC:\windows\system\XFQHVB.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YIUCAZJ.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:5408 -
C:\windows\YIUCAZJ.exeC:\windows\YIUCAZJ.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HIWHLW.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\windows\HIWHLW.exeC:\windows\HIWHLW.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NJEVUZ.exe.bat" "20⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:696 -
C:\windows\NJEVUZ.exeC:\windows\NJEVUZ.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WRGI.exe.bat" "22⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\windows\WRGI.exeC:\windows\WRGI.exe23⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VCI.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\windows\system\VCI.exeC:\windows\system\VCI.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\USUTUPT.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\windows\SysWOW64\USUTUPT.exeC:\windows\system32\USUTUPT.exe27⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UVFX.exe.bat" "28⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\windows\system\UVFX.exeC:\windows\system\UVFX.exe29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WSL.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\windows\SysWOW64\WSL.exeC:\windows\system32\WSL.exe31⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RGQTZ.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\windows\system\RGQTZ.exeC:\windows\system\RGQTZ.exe33⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5528 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IOSGCL.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\windows\IOSGCL.exeC:\windows\IOSGCL.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YETXJ.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\windows\SysWOW64\YETXJ.exeC:\windows\system32\YETXJ.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UKD.exe.bat" "38⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\windows\SysWOW64\UKD.exeC:\windows\system32\UKD.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AXCNWF.exe.bat" "40⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5580 -
C:\windows\SysWOW64\AXCNWF.exeC:\windows\system32\AXCNWF.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PAMZ.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\windows\SysWOW64\PAMZ.exeC:\windows\system32\PAMZ.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TIAABK.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:5776 -
C:\windows\TIAABK.exeC:\windows\TIAABK.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MLE.exe.bat" "46⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\windows\system\MLE.exeC:\windows\system\MLE.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WJK.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\windows\system\WJK.exeC:\windows\system\WJK.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CEJ.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\windows\CEJ.exeC:\windows\CEJ.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GMQ.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\windows\GMQ.exeC:\windows\GMQ.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MMX.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\windows\SysWOW64\MMX.exeC:\windows\system32\MMX.exe55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GACVY.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\windows\system\GACVY.exeC:\windows\system\GACVY.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZDGZ.exe.bat" "58⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\windows\SysWOW64\ZDGZ.exeC:\windows\system32\ZDGZ.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AGKVJL.exe.bat" "60⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5576 -
C:\windows\AGKVJL.exeC:\windows\AGKVJL.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FGR.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:5632 -
C:\windows\SysWOW64\FGR.exeC:\windows\system32\FGR.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ETQR.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\windows\SysWOW64\ETQR.exeC:\windows\system32\ETQR.exe65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3156 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ORW.exe.bat" "66⤵PID:4160
-
C:\windows\system\ORW.exeC:\windows\system\ORW.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DUOQXM.exe.bat" "68⤵PID:5352
-
C:\windows\SysWOW64\DUOQXM.exeC:\windows\system32\DUOQXM.exe69⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZNPSB.exe.bat" "70⤵PID:5692
-
C:\windows\SysWOW64\ZNPSB.exeC:\windows\system32\ZNPSB.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FNX.exe.bat" "72⤵PID:4748
-
C:\windows\system\FNX.exeC:\windows\system\FNX.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6024 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JQVBS.exe.bat" "74⤵PID:5324
-
C:\windows\SysWOW64\JQVBS.exeC:\windows\system32\JQVBS.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZTF.exe.bat" "76⤵
- System Location Discovery: System Language Discovery
PID:5328 -
C:\windows\ZTF.exeC:\windows\ZTF.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ITHLO.exe.bat" "78⤵
- System Location Discovery: System Language Discovery
PID:5764 -
C:\windows\system\ITHLO.exeC:\windows\system\ITHLO.exe79⤵
- Executes dropped EXE
PID:2004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XOQ.exe.bat" "80⤵PID:3404
-
C:\windows\XOQ.exeC:\windows\XOQ.exe81⤵
- Executes dropped EXE
PID:2304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YSCT.exe.bat" "82⤵PID:2936
-
C:\windows\system\YSCT.exeC:\windows\system\YSCT.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WNTTKBS.exe.bat" "84⤵PID:5476
-
C:\windows\system\WNTTKBS.exeC:\windows\system\WNTTKBS.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3164 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IVIBW.exe.bat" "86⤵PID:3860
-
C:\windows\IVIBW.exeC:\windows\IVIBW.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XYR.exe.bat" "88⤵PID:1144
-
C:\windows\system\XYR.exeC:\windows\system\XYR.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SLWP.exe.bat" "90⤵PID:5032
-
C:\windows\system\SLWP.exeC:\windows\system\SLWP.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HBX.exe.bat" "92⤵
- System Location Discovery: System Language Discovery
PID:3124 -
C:\windows\SysWOW64\HBX.exeC:\windows\system32\HBX.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4484 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FCECH.exe.bat" "94⤵PID:256
-
C:\windows\SysWOW64\FCECH.exeC:\windows\system32\FCECH.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZPJMRVI.exe.bat" "96⤵PID:5904
-
C:\windows\system\ZPJMRVI.exeC:\windows\system\ZPJMRVI.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LHEFRL.exe.bat" "98⤵
- System Location Discovery: System Language Discovery
PID:3696 -
C:\windows\system\LHEFRL.exeC:\windows\system\LHEFRL.exe99⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VFSZH.exe.bat" "100⤵
- System Location Discovery: System Language Discovery
PID:3312 -
C:\windows\VFSZH.exeC:\windows\VFSZH.exe101⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EGUEKRI.exe.bat" "102⤵PID:596
-
C:\windows\system\EGUEKRI.exeC:\windows\system\EGUEKRI.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TJDIV.exe.bat" "104⤵PID:5952
-
C:\windows\SysWOW64\TJDIV.exeC:\windows\system32\TJDIV.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5896 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BOWXX.exe.bat" "106⤵PID:5732
-
C:\windows\BOWXX.exeC:\windows\BOWXX.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QJN.exe.bat" "108⤵PID:2088
-
C:\windows\system\QJN.exeC:\windows\system\QJN.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ARHO.exe.bat" "110⤵PID:1316
-
C:\windows\SysWOW64\ARHO.exeC:\windows\system32\ARHO.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3272 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PIQ.exe.bat" "112⤵PID:572
-
C:\windows\system\PIQ.exeC:\windows\system\PIQ.exe113⤵
- Executes dropped EXE
PID:3032 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CKYEOH.exe.bat" "114⤵PID:4284
-
C:\windows\CKYEOH.exeC:\windows\CKYEOH.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SAZW.exe.bat" "116⤵PID:5392
-
C:\windows\SAZW.exeC:\windows\SAZW.exe117⤵
- Executes dropped EXE
PID:1440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MOENXU.exe.bat" "118⤵PID:200
-
C:\windows\MOENXU.exeC:\windows\MOENXU.exe119⤵
- Executes dropped EXE
PID:924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WLKZMC.exe.bat" "120⤵
- System Location Discovery: System Language Discovery
PID:5280 -
C:\windows\WLKZMC.exeC:\windows\WLKZMC.exe121⤵
- Executes dropped EXE
PID:624
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-