Analysis
- max time kernel
101s - max time network
123s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/06/2026, 19:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-25_ea8ad78d299ca77b28d6977b15fe37c7_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-25_ea8ad78d299ca77b28d6977b15fe37c7_elex_emotet_stop.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 2026-06-25_ea8ad78d299ca77b28d6977b15fe37c7_elex_emotet_stop.exe
- Size 320KB
- Sample260629-xt3ghads7t
- SHA256 231d5f822b7706413402d3f60b0d05f8f531de086acac99a1e957af8af2d1893
- MD5 ea8ad78d299ca77b28d6977b15fe37c7
- SHA1 7f4714c822bbef849c8b30eca17981d636deda06
- SHA512 5cd2f907d6f23d872a927b32b7a8a72bbbfec1be207b9370495d92f196b89d97541e167d0a5a3b77d6ac030bb26f7c1b607b47b44b39ad462d2e8d23ca15aa96
- SSDEEP 6144:MlZtbLWIgd1LZ9oECZbxlUS+LOMkEjWbjcSbcY+CA:OLWI09QZb6LOMkFbzs
- TLSH T139647D12B6C1C072D4AF02328CE2C7A826B5BC519F7586CB77D87B4EEE315D29A35391
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1196 GQMGOKC.exe 5228 EBDCBLY.exe 5872 OUNK.exe 1124 RHEL.exe 3260 APGRCF.exe 1688 PKQ.exe 2656 KYUMX.exe 5932 ZOVE.exe 4484 UYECSQF.exe 5604 NBQYYF.exe 3916 TPHHCI.exe 5068 ISYL.exe 956 HDB.exe 5544 UNKAKM.exe 3172 YQIN.exe 3332 OLZZDAZ.exe 4780 GODVJQ.exe 1288 MPL.exe 5628 QSJE.exe 3180 UAP.exe 2880 XVUNO.exe 756 BDB.exe 2368 VRGF.exe 3568 QMLONN.exe 2356 KZP.exe 5576 OHWXJ.exe 3812 AAZQRNG.exe 4140 FAHE.exe 4488 MVYNF.exe 5616 ZYCLKJ.exe 1852 MJKK.exe 2320 BZLBXIK.exe 5748 WMQL.exe 5776 RIVCSH.exe 3336 PXOX.exe 5804 TFI.exe 5988 JDHQUFG.exe 2632 CYGTYBP.exe 8 CRHVENV.exe 5904 EHI.exe 3256 UFH.exe 4252 TUOCAQI.exe 5612 YXKJNH.exe 4980 LIOHSYX.exe 5900 PQVHE.exe 4944 KLZZGII.exe 5980 QMHM.exe 4712 FCIEWGY.exe 2988 JKPMI.exe 2888 YAQDPM.exe 4204 MLYCDP.exe 2576 QDIEH.exe 3592 UTO.exe 5788 KJPEAZ.exe 4184 TWAWQDM.exe 1616 RHLMYJ.exe 5668 ONJJFTC.exe 5608 OSJ.exe 3976 YQOKOG.exe 5720 TDTTZGC.exe 3964 MWJEIHL.exe 4280 KWQAZ.exe 1920 MUJUX.exe 5648 DULZJEE.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\APGRCF.exe.bat RHEL.exe File created C:\windows\SysWOW64\AAZQRNG.exe.bat OHWXJ.exe File opened for modification C:\windows\SysWOW64\UTO.exe QDIEH.exe File created C:\windows\SysWOW64\HXICIUS.exe.bat XPGXW.exe File created C:\windows\SysWOW64\OZDRITB.exe.bat KWFW.exe File opened for modification C:\windows\SysWOW64\QMLONN.exe VRGF.exe File created C:\windows\SysWOW64\CYGTYBP.exe JDHQUFG.exe File created C:\windows\SysWOW64\UTO.exe QDIEH.exe File created C:\windows\SysWOW64\MUJUX.exe KWQAZ.exe File created C:\windows\SysWOW64\NRUB.exe EQSWIG.exe File created C:\windows\SysWOW64\NEREG.exe.bat HMJR.exe File opened for modification C:\windows\SysWOW64\PCKYN.exe NEREG.exe File opened for modification C:\windows\SysWOW64\OZDRITB.exe KWFW.exe File created C:\windows\SysWOW64\QMLONN.exe.bat VRGF.exe File opened for modification C:\windows\SysWOW64\APGRCF.exe RHEL.exe File opened for modification C:\windows\SysWOW64\GODVJQ.exe OLZZDAZ.exe File created C:\windows\SysWOW64\FAHE.exe AAZQRNG.exe File opened for modification C:\windows\SysWOW64\YAQDPM.exe JKPMI.exe File created C:\windows\SysWOW64\TDTTZGC.exe.bat YQOKOG.exe File created C:\windows\SysWOW64\QRERG.exe CHVAS.exe File created C:\windows\SysWOW64\QKVSRD.exe CAM.exe File opened for modification C:\windows\SysWOW64\AAZQRNG.exe OHWXJ.exe File created C:\windows\SysWOW64\QKVSRD.exe.bat CAM.exe File created C:\windows\SysWOW64\DSTM.exe.bat IFOCSWO.exe File created C:\windows\SysWOW64\UPCOFW.exe POUA.exe File created C:\windows\SysWOW64\BDB.exe.bat XVUNO.exe File created C:\windows\SysWOW64\MUJUX.exe.bat KWQAZ.exe File created C:\windows\SysWOW64\TRKWZUL.exe.bat LMGIPWP.exe File opened for modification C:\windows\SysWOW64\HMJR.exe HJGNKR.exe File created C:\windows\SysWOW64\NEREG.exe HMJR.exe File opened for modification C:\windows\SysWOW64\XNO.exe OZDRITB.exe File created C:\windows\SysWOW64\EBDCBLY.exe.bat GQMGOKC.exe File opened for modification C:\windows\SysWOW64\JDHQUFG.exe TFI.exe File opened for modification C:\windows\SysWOW64\KGNT.exe ZOK.exe File opened for modification C:\windows\SysWOW64\ZMTQ.exe KGNT.exe File created C:\windows\SysWOW64\QRERG.exe.bat CHVAS.exe File created C:\windows\SysWOW64\HXNAP.exe.bat NFXPYGV.exe File created C:\windows\SysWOW64\KWFW.exe.bat CMWVUNK.exe File created C:\windows\SysWOW64\UPCOFW.exe.bat POUA.exe File created C:\windows\SysWOW64\UAP.exe.bat QSJE.exe File opened for modification C:\windows\SysWOW64\YXKJNH.exe TUOCAQI.exe File created C:\windows\SysWOW64\YXKJNH.exe.bat TUOCAQI.exe File opened for modification C:\windows\SysWOW64\QKVSRD.exe CAM.exe File created C:\windows\SysWOW64\FAHE.exe.bat AAZQRNG.exe File opened for modification C:\windows\SysWOW64\CYGTYBP.exe JDHQUFG.exe File created C:\windows\SysWOW64\KLZZGII.exe PQVHE.exe File created C:\windows\SysWOW64\ONJJFTC.exe.bat RHLMYJ.exe File opened for modification C:\windows\SysWOW64\HXICIUS.exe XPGXW.exe File created C:\windows\SysWOW64\BDB.exe XVUNO.exe File created C:\windows\SysWOW64\OHWXJ.exe.bat KZP.exe File created C:\windows\SysWOW64\TDTTZGC.exe YQOKOG.exe File created C:\windows\SysWOW64\KWQAZ.exe.bat MWJEIHL.exe File opened for modification C:\windows\SysWOW64\MUJUX.exe KWQAZ.exe File opened for modification C:\windows\SysWOW64\KLZZGII.exe PQVHE.exe File created C:\windows\SysWOW64\YAQDPM.exe JKPMI.exe File created C:\windows\SysWOW64\EBDCBLY.exe GQMGOKC.exe File created C:\windows\SysWOW64\UTO.exe.bat QDIEH.exe File opened for modification C:\windows\SysWOW64\ONJJFTC.exe RHLMYJ.exe File opened for modification C:\windows\SysWOW64\DULZJEE.exe MUJUX.exe File created C:\windows\SysWOW64\TRKWZUL.exe LMGIPWP.exe File created C:\windows\SysWOW64\GVTQRX.exe.bat QKVSRD.exe File created C:\windows\SysWOW64\VQDU.exe GVTQRX.exe File created C:\windows\SysWOW64\UAP.exe QSJE.exe File created C:\windows\SysWOW64\GVTQRX.exe QKVSRD.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\MVYNF.exe.bat FAHE.exe File created C:\windows\OUNK.exe EBDCBLY.exe File opened for modification C:\windows\KYUMX.exe PKQ.exe File created C:\windows\EHI.exe CRHVENV.exe File created C:\windows\system\LMGIPWP.exe OGASIM.exe File opened for modification C:\windows\GQMGOKC.exe 2026-06-25_ea8ad78d299ca77b28d6977b15fe37c7_elex_emotet_stop.exe File created C:\windows\HDB.exe.bat ISYL.exe File opened for modification C:\windows\system\ADHS.exe OVBKSXM.exe File opened for modification C:\windows\system\YAUBXYB.exe FINQNXL.exe File created C:\windows\system\CNLDVND.exe RUI.exe File opened for modification C:\windows\system\PXOX.exe RIVCSH.exe File created C:\windows\system\FCIEWGY.exe QMHM.exe File opened for modification C:\windows\system\RHLMYJ.exe TWAWQDM.exe File created C:\windows\system\DDGZPE.exe.bat HXICIUS.exe File created C:\windows\HDB.exe ISYL.exe File opened for modification C:\windows\CRHVENV.exe CYGTYBP.exe File created C:\windows\system\KJPEAZ.exe UTO.exe File created C:\windows\ZOVE.exe KYUMX.exe File created C:\windows\MPL.exe GODVJQ.exe File created C:\windows\system\PXOX.exe.bat RIVCSH.exe File created C:\windows\OVBKSXM.exe DULZJEE.exe File created C:\windows\JXL.exe.bat FPF.exe File created C:\windows\EYIFP.exe.bat PTK.exe File created C:\windows\DWZ.exe.bat DTNLIW.exe File opened for modification C:\windows\OUNK.exe EBDCBLY.exe File opened for modification C:\windows\HDB.exe ISYL.exe File created C:\windows\system\UOHOZW.exe.bat WDRYAB.exe File created C:\windows\MPL.exe.bat GODVJQ.exe File created C:\windows\JXL.exe FPF.exe File created C:\windows\system\RZSSRE.exe RUZDP.exe File created C:\windows\VRGF.exe BDB.exe File created C:\windows\NDIES.exe.bat DDGZPE.exe File created C:\windows\ODWP.exe KVPPQEQ.exe File created C:\windows\CAM.exe TRKWZUL.exe File created C:\windows\CMWVUNK.exe.bat JJTZH.exe File opened for modification C:\windows\MVYNF.exe FAHE.exe File created C:\windows\EHI.exe.bat CRHVENV.exe File created C:\windows\system\JKPMI.exe FCIEWGY.exe File created C:\windows\NDIES.exe DDGZPE.exe File opened for modification C:\windows\system\LMGIPWP.exe OGASIM.exe File created C:\windows\HJGNKR.exe VQDU.exe File opened for modification C:\windows\system\NFXPYGV.exe RZSSRE.exe File opened for modification C:\windows\RUI.exe UPCOFW.exe File opened for modification C:\windows\system\UNKAKM.exe HDB.exe File opened for modification C:\windows\system\ZYCLKJ.exe MVYNF.exe File created C:\windows\BZLBXIK.exe.bat MJKK.exe File created C:\windows\system\MLYCDP.exe.bat YAQDPM.exe File created C:\windows\system\YUWMSAE.exe BOYWLRC.exe File created C:\windows\system\ZYCLKJ.exe MVYNF.exe File created C:\windows\system\TWAWQDM.exe KJPEAZ.exe File created C:\windows\system\GKW.exe BZSY.exe File created C:\windows\CHVAS.exe NRUB.exe File created C:\windows\system\ZDMWI.exe.bat EPIN.exe File created C:\windows\RUI.exe UPCOFW.exe File created C:\windows\ZOVE.exe.bat KYUMX.exe File created C:\windows\ZOK.exe.bat ADHS.exe File created C:\windows\system\KEOJD.exe ZMTQ.exe File created C:\windows\PTK.exe.bat JXL.exe File created C:\windows\BOYWLRC.exe MTHK.exe File created C:\windows\system\RUZDP.exe.bat UOHOZW.exe File created C:\windows\DTNLIW.exe.bat ZLH.exe File created C:\windows\system\XPGXW.exe.bat GKW.exe File opened for modification C:\windows\QGPF.exe HXNAP.exe File created C:\windows\YQIN.exe UNKAKM.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 64 IoCs
pid pid_target Process procid_target 5552 6008 WerFault.exe 86 4372 1196 WerFault.exe 90 3708 5228 WerFault.exe 97 5888 5872 WerFault.exe 102 724 1124 WerFault.exe 107 2840 3260 WerFault.exe 112 4748 1688 WerFault.exe 117 1920 2656 WerFault.exe 122 5620 5932 WerFault.exe 127 2492 4484 WerFault.exe 132 5980 5604 WerFault.exe 137 5728 3916 WerFault.exe 142 5660 5068 WerFault.exe 147 4368 956 WerFault.exe 152 3268 5544 WerFault.exe 157 2812 3172 WerFault.exe 161 2876 3332 WerFault.exe 167 2324 4780 WerFault.exe 172 3392 1288 WerFault.exe 177 6060 5628 WerFault.exe 182 1692 3180 WerFault.exe 187 5896 2880 WerFault.exe 192 2336 756 WerFault.exe 197 4540 2368 WerFault.exe 202 5540 3568 WerFault.exe 207 2888 2356 WerFault.exe 212 5020 5576 WerFault.exe 217 5028 3812 WerFault.exe 222 248 4140 WerFault.exe 227 5596 4488 WerFault.exe 232 2016 5616 WerFault.exe 237 1988 1852 WerFault.exe 242 2288 2320 WerFault.exe 247 3576 5748 WerFault.exe 252 5364 5776 WerFault.exe 257 4956 3336 WerFault.exe 261 2116 5804 WerFault.exe 267 5712 5988 WerFault.exe 272 1996 2632 WerFault.exe 277 5708 8 WerFault.exe 282 6124 5904 WerFault.exe 286 724 3256 WerFault.exe 291 5920 4252 WerFault.exe 296 1828 5612 WerFault.exe 301 4148 4980 WerFault.exe 307 916 5900 WerFault.exe 312 5504 4944 WerFault.exe 317 2392 5980 WerFault.exe 322 5296 4712 WerFault.exe 327 6112 2988 WerFault.exe 332 5416 2888 WerFault.exe 337 2608 4204 WerFault.exe 342 5952 2576 WerFault.exe 347 1680 3592 WerFault.exe 352 2756 5788 WerFault.exe 357 4816 4184 WerFault.exe 362 1336 1616 WerFault.exe 367 3368 5668 WerFault.exe 372 5948 5608 WerFault.exe 377 3352 3976 WerFault.exe 382 5236 5720 WerFault.exe 387 2024 3964 WerFault.exe 392 3208 4280 WerFault.exe 397 1724 1920 WerFault.exe 402 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YQOKOG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XNO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QDIEH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NEREG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GKW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JJTZH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KVPPQEQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QSJE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RHLMYJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HXNAP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TUOCAQI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RZSSRE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VRGF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OUNK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RIVCSH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZOK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MTHK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JXL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KWFW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KZP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MVYNF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WMQL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RUI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UTO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 6008 2026-06-25_ea8ad78d299ca77b28d6977b15fe37c7_elex_emotet_stop.exe 6008 2026-06-25_ea8ad78d299ca77b28d6977b15fe37c7_elex_emotet_stop.exe 1196 GQMGOKC.exe 1196 GQMGOKC.exe 5228 EBDCBLY.exe 5228 EBDCBLY.exe 5872 OUNK.exe 5872 OUNK.exe 1124 RHEL.exe 1124 RHEL.exe 3260 APGRCF.exe 3260 APGRCF.exe 1688 PKQ.exe 1688 PKQ.exe 2656 KYUMX.exe 2656 KYUMX.exe 5932 ZOVE.exe 5932 ZOVE.exe 4484 UYECSQF.exe 4484 UYECSQF.exe 5604 NBQYYF.exe 5604 NBQYYF.exe 3916 TPHHCI.exe 3916 TPHHCI.exe 5068 ISYL.exe 5068 ISYL.exe 956 HDB.exe 956 HDB.exe 5544 UNKAKM.exe 5544 UNKAKM.exe 3172 YQIN.exe 3172 YQIN.exe 3332 OLZZDAZ.exe 3332 OLZZDAZ.exe 4780 GODVJQ.exe 4780 GODVJQ.exe 1288 MPL.exe 1288 MPL.exe 5628 QSJE.exe 5628 QSJE.exe 3180 UAP.exe 3180 UAP.exe 2880 XVUNO.exe 2880 XVUNO.exe 756 BDB.exe 756 BDB.exe 2368 VRGF.exe 2368 VRGF.exe 3568 QMLONN.exe 3568 QMLONN.exe 2356 KZP.exe 2356 KZP.exe 5576 OHWXJ.exe 5576 OHWXJ.exe 3812 AAZQRNG.exe 3812 AAZQRNG.exe 4140 FAHE.exe 4140 FAHE.exe 4488 MVYNF.exe 4488 MVYNF.exe 5616 ZYCLKJ.exe 5616 ZYCLKJ.exe 1852 MJKK.exe 1852 MJKK.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 6008 2026-06-25_ea8ad78d299ca77b28d6977b15fe37c7_elex_emotet_stop.exe 6008 2026-06-25_ea8ad78d299ca77b28d6977b15fe37c7_elex_emotet_stop.exe 1196 GQMGOKC.exe 1196 GQMGOKC.exe 5228 EBDCBLY.exe 5228 EBDCBLY.exe 5872 OUNK.exe 5872 OUNK.exe 1124 RHEL.exe 1124 RHEL.exe 3260 APGRCF.exe 3260 APGRCF.exe 1688 PKQ.exe 1688 PKQ.exe 2656 KYUMX.exe 2656 KYUMX.exe 5932 ZOVE.exe 5932 ZOVE.exe 4484 UYECSQF.exe 4484 UYECSQF.exe 5604 NBQYYF.exe 5604 NBQYYF.exe 3916 TPHHCI.exe 3916 TPHHCI.exe 5068 ISYL.exe 5068 ISYL.exe 956 HDB.exe 956 HDB.exe 5544 UNKAKM.exe 5544 UNKAKM.exe 3172 YQIN.exe 3172 YQIN.exe 3332 OLZZDAZ.exe 3332 OLZZDAZ.exe 4780 GODVJQ.exe 4780 GODVJQ.exe 1288 MPL.exe 1288 MPL.exe 5628 QSJE.exe 5628 QSJE.exe 3180 UAP.exe 3180 UAP.exe 2880 XVUNO.exe 2880 XVUNO.exe 756 BDB.exe 756 BDB.exe 2368 VRGF.exe 2368 VRGF.exe 3568 QMLONN.exe 3568 QMLONN.exe 2356 KZP.exe 2356 KZP.exe 5576 OHWXJ.exe 5576 OHWXJ.exe 3812 AAZQRNG.exe 3812 AAZQRNG.exe 4140 FAHE.exe 4140 FAHE.exe 4488 MVYNF.exe 4488 MVYNF.exe 5616 ZYCLKJ.exe 5616 ZYCLKJ.exe 1852 MJKK.exe 1852 MJKK.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 6008 wrote to memory of 6076 6008 2026-06-25_ea8ad78d299ca77b28d6977b15fe37c7_elex_emotet_stop.exe 87 PID 6076 wrote to memory of 1196 6076 cmd.exe 90 PID 1196 wrote to memory of 5640 1196 GQMGOKC.exe 93 PID 5640 wrote to memory of 5228 5640 cmd.exe 97 PID 5228 wrote to memory of 5016 5228 EBDCBLY.exe 98 PID 5016 wrote to memory of 5872 5016 cmd.exe 102 PID 5872 wrote to memory of 3644 5872 OUNK.exe 103 PID 3644 wrote to memory of 1124 3644 cmd.exe 107 PID 1124 wrote to memory of 1432 1124 RHEL.exe 108 PID 1432 wrote to memory of 3260 1432 cmd.exe 112 PID 3260 wrote to memory of 6064 3260 APGRCF.exe 113 PID 6064 wrote to memory of 1688 6064 cmd.exe 117 PID 1688 wrote to memory of 472 1688 PKQ.exe 118 PID 472 wrote to memory of 2656 472 cmd.exe 122 PID 2656 wrote to memory of 5832 2656 KYUMX.exe 123 PID 5832 wrote to memory of 5932 5832 cmd.exe 127 PID 5932 wrote to memory of 2916 5932 ZOVE.exe 128 PID 2916 wrote to memory of 4484 2916 cmd.exe 132 PID 4484 wrote to memory of 5632 4484 UYECSQF.exe 133 PID 5632 wrote to memory of 5604 5632 cmd.exe 137 PID 5604 wrote to memory of 5652 5604 NBQYYF.exe 138 PID 5652 wrote to memory of 3916 5652 cmd.exe 142 PID 3916 wrote to memory of 2428 3916 TPHHCI.exe 143 PID 2428 wrote to memory of 5068 2428 cmd.exe 147 PID 5068 wrote to memory of 5824 5068 ISYL.exe 148 PID 5824 wrote to memory of 956 5824 cmd.exe 152 PID 956 wrote to memory of 4428 956 HDB.exe 153 PID 4428 wrote to memory of 5544 4428 cmd.exe 157 PID 5544 wrote to memory of 5380 5544 UNKAKM.exe 158 PID 5380 wrote to memory of 3172 5380 cmd.exe 161 PID 3172 wrote to memory of 5048 3172 YQIN.exe 163 PID 5048 wrote to memory of 3332 5048 cmd.exe 167 PID 3332 wrote to memory of 3156 3332 OLZZDAZ.exe 168 PID 3156 wrote to memory of 4780 3156 cmd.exe 172 PID 4780 wrote to memory of 4672 4780 GODVJQ.exe 173 PID 4672 wrote to memory of 1288 4672 cmd.exe 177 PID 1288 wrote to memory of 4212 1288 MPL.exe 178 PID 4212 wrote to memory of 5628 4212 cmd.exe 182 PID 5628 wrote to memory of 1900 5628 QSJE.exe 183 PID 1900 wrote to memory of 3180 1900 cmd.exe 187 PID 3180 wrote to memory of 4924 3180 UAP.exe 188 PID 4924 wrote to memory of 2880 4924 cmd.exe 192 PID 2880 wrote to memory of 4936 2880 XVUNO.exe 193 PID 4936 wrote to memory of 756 4936 cmd.exe 197 PID 756 wrote to memory of 1760 756 BDB.exe 198 PID 1760 wrote to memory of 2368 1760 cmd.exe 202 PID 2368 wrote to memory of 548 2368 VRGF.exe 203 PID 548 wrote to memory of 3568 548 cmd.exe 207 PID 3568 wrote to memory of 2460 3568 QMLONN.exe 208 PID 2460 wrote to memory of 2356 2460 cmd.exe 212 PID 2356 wrote to memory of 4952 2356 KZP.exe 213 PID 4952 wrote to memory of 5576 4952 cmd.exe 217 PID 5576 wrote to memory of 1284 5576 OHWXJ.exe 218 PID 1284 wrote to memory of 3812 1284 cmd.exe 222 PID 3812 wrote to memory of 2828 3812 AAZQRNG.exe 223 PID 2828 wrote to memory of 4140 2828 cmd.exe 227 PID 4140 wrote to memory of 4832 4140 FAHE.exe 228 PID 4832 wrote to memory of 4488 4832 cmd.exe 232 PID 4488 wrote to memory of 4384 4488 MVYNF.exe 233 PID 4384 wrote to memory of 5616 4384 cmd.exe 237 PID 5616 wrote to memory of 1008 5616 ZYCLKJ.exe 238 PID 1008 wrote to memory of 1852 1008 cmd.exe 242 PID 1852 wrote to memory of 3884 1852 MJKK.exe 243 PID 3884 wrote to memory of 2320 3884 cmd.exe 247
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-25_ea8ad78d299ca77b28d6977b15fe37c7_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-25_ea8ad78d299ca77b28d6977b15fe37c7_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6008 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GQMGOKC.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:6076 -
C:\windows\GQMGOKC.exeC:\windows\GQMGOKC.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EBDCBLY.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:5640 -
C:\windows\SysWOW64\EBDCBLY.exeC:\windows\system32\EBDCBLY.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5228 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OUNK.exe.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\windows\OUNK.exeC:\windows\OUNK.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RHEL.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:3644 -
C:\windows\system\RHEL.exeC:\windows\system\RHEL.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\APGRCF.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\windows\SysWOW64\APGRCF.exeC:\windows\system32\APGRCF.exe11⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PKQ.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:6064 -
C:\windows\PKQ.exeC:\windows\PKQ.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KYUMX.exe.bat" "14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:472 -
C:\windows\KYUMX.exeC:\windows\KYUMX.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZOVE.exe.bat" "16⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5832 -
C:\windows\ZOVE.exeC:\windows\ZOVE.exe17⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UYECSQF.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\windows\system\UYECSQF.exeC:\windows\system\UYECSQF.exe19⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NBQYYF.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:5632 -
C:\windows\NBQYYF.exeC:\windows\NBQYYF.exe21⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5604 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TPHHCI.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:5652 -
C:\windows\system\TPHHCI.exeC:\windows\system\TPHHCI.exe23⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ISYL.exe.bat" "24⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\windows\SysWOW64\ISYL.exeC:\windows\system32\ISYL.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HDB.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:5824 -
C:\windows\HDB.exeC:\windows\HDB.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UNKAKM.exe.bat" "28⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\windows\system\UNKAKM.exeC:\windows\system\UNKAKM.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YQIN.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:5380 -
C:\windows\YQIN.exeC:\windows\YQIN.exe31⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OLZZDAZ.exe.bat" "32⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\windows\system\OLZZDAZ.exeC:\windows\system\OLZZDAZ.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GODVJQ.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\windows\SysWOW64\GODVJQ.exeC:\windows\system32\GODVJQ.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MPL.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\windows\MPL.exeC:\windows\MPL.exe37⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QSJE.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\windows\SysWOW64\QSJE.exeC:\windows\system32\QSJE.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5628 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UAP.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\windows\SysWOW64\UAP.exeC:\windows\system32\UAP.exe41⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XVUNO.exe.bat" "42⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\windows\system\XVUNO.exeC:\windows\system\XVUNO.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BDB.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\windows\SysWOW64\BDB.exeC:\windows\system32\BDB.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VRGF.exe.bat" "46⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\windows\VRGF.exeC:\windows\VRGF.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QMLONN.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:548 -
C:\windows\SysWOW64\QMLONN.exeC:\windows\system32\QMLONN.exe49⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KZP.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\windows\system\KZP.exeC:\windows\system\KZP.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OHWXJ.exe.bat" "52⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\windows\SysWOW64\OHWXJ.exeC:\windows\system32\OHWXJ.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AAZQRNG.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\windows\SysWOW64\AAZQRNG.exeC:\windows\system32\AAZQRNG.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FAHE.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\windows\SysWOW64\FAHE.exeC:\windows\system32\FAHE.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MVYNF.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\windows\MVYNF.exeC:\windows\MVYNF.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZYCLKJ.exe.bat" "60⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\windows\system\ZYCLKJ.exeC:\windows\system\ZYCLKJ.exe61⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MJKK.exe.bat" "62⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1008 -
C:\windows\MJKK.exeC:\windows\MJKK.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BZLBXIK.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\windows\BZLBXIK.exeC:\windows\BZLBXIK.exe65⤵
- Executes dropped EXE
PID:2320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WMQL.exe.bat" "66⤵PID:3956
-
C:\windows\system\WMQL.exeC:\windows\system\WMQL.exe67⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RIVCSH.exe.bat" "68⤵PID:5864
-
C:\windows\system\RIVCSH.exeC:\windows\system\RIVCSH.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PXOX.exe.bat" "70⤵
- System Location Discovery: System Language Discovery
PID:2296 -
C:\windows\system\PXOX.exeC:\windows\system\PXOX.exe71⤵
- Executes dropped EXE
PID:3336 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TFI.exe.bat" "72⤵PID:5460
-
C:\windows\system\TFI.exeC:\windows\system\TFI.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JDHQUFG.exe.bat" "74⤵PID:5248
-
C:\windows\SysWOW64\JDHQUFG.exeC:\windows\system32\JDHQUFG.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CYGTYBP.exe.bat" "76⤵PID:1204
-
C:\windows\SysWOW64\CYGTYBP.exeC:\windows\system32\CYGTYBP.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2632 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CRHVENV.exe.bat" "78⤵PID:1740
-
C:\windows\CRHVENV.exeC:\windows\CRHVENV.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:8 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EHI.exe.bat" "80⤵PID:2468
-
C:\windows\EHI.exeC:\windows\EHI.exe81⤵
- Executes dropped EXE
PID:5904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UFH.exe.bat" "82⤵PID:236
-
C:\windows\UFH.exeC:\windows\UFH.exe83⤵
- Executes dropped EXE
PID:3256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TUOCAQI.exe.bat" "84⤵PID:5148
-
C:\windows\TUOCAQI.exeC:\windows\TUOCAQI.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YXKJNH.exe.bat" "86⤵PID:4624
-
C:\windows\SysWOW64\YXKJNH.exeC:\windows\system32\YXKJNH.exe87⤵
- Executes dropped EXE
PID:5612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LIOHSYX.exe.bat" "88⤵PID:3036
-
C:\windows\system\LIOHSYX.exeC:\windows\system\LIOHSYX.exe89⤵
- Executes dropped EXE
PID:4980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PQVHE.exe.bat" "90⤵PID:4260
-
C:\windows\system\PQVHE.exeC:\windows\system\PQVHE.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KLZZGII.exe.bat" "92⤵PID:5636
-
C:\windows\SysWOW64\KLZZGII.exeC:\windows\system32\KLZZGII.exe93⤵
- Executes dropped EXE
PID:4944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QMHM.exe.bat" "94⤵PID:3908
-
C:\windows\system\QMHM.exeC:\windows\system\QMHM.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FCIEWGY.exe.bat" "96⤵
- System Location Discovery: System Language Discovery
PID:4956 -
C:\windows\system\FCIEWGY.exeC:\windows\system\FCIEWGY.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JKPMI.exe.bat" "98⤵PID:616
-
C:\windows\system\JKPMI.exeC:\windows\system\JKPMI.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YAQDPM.exe.bat" "100⤵PID:2512
-
C:\windows\SysWOW64\YAQDPM.exeC:\windows\system32\YAQDPM.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MLYCDP.exe.bat" "102⤵
- System Location Discovery: System Language Discovery
PID:2008 -
C:\windows\system\MLYCDP.exeC:\windows\system\MLYCDP.exe103⤵
- Executes dropped EXE
PID:4204 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QDIEH.exe.bat" "104⤵PID:3716
-
C:\windows\QDIEH.exeC:\windows\QDIEH.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UTO.exe.bat" "106⤵
- System Location Discovery: System Language Discovery
PID:2204 -
C:\windows\SysWOW64\UTO.exeC:\windows\system32\UTO.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KJPEAZ.exe.bat" "108⤵PID:2228
-
C:\windows\system\KJPEAZ.exeC:\windows\system\KJPEAZ.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TWAWQDM.exe.bat" "110⤵
- System Location Discovery: System Language Discovery
PID:6060 -
C:\windows\system\TWAWQDM.exeC:\windows\system\TWAWQDM.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4184 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RHLMYJ.exe.bat" "112⤵PID:2332
-
C:\windows\system\RHLMYJ.exeC:\windows\system\RHLMYJ.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ONJJFTC.exe.bat" "114⤵
- System Location Discovery: System Language Discovery
PID:5896 -
C:\windows\SysWOW64\ONJJFTC.exeC:\windows\system32\ONJJFTC.exe115⤵
- Executes dropped EXE
PID:5668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OSJ.exe.bat" "116⤵
- System Location Discovery: System Language Discovery
PID:428 -
C:\windows\OSJ.exeC:\windows\OSJ.exe117⤵
- Executes dropped EXE
PID:5608 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YQOKOG.exe.bat" "118⤵
- System Location Discovery: System Language Discovery
PID:4844 -
C:\windows\YQOKOG.exeC:\windows\YQOKOG.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TDTTZGC.exe.bat" "120⤵PID:2168
-
C:\windows\SysWOW64\TDTTZGC.exeC:\windows\system32\TDTTZGC.exe121⤵
- Executes dropped EXE
PID:5720
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-