Analysis
- max time kernel
79s - max time network
122s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260630-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
01/07/2026, 02:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-30_f4574ef4494f2c4b64e6b2a376e8614c_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-30_f4574ef4494f2c4b64e6b2a376e8614c_elex_emotet_stop.exe
Resource
win11ltsc2024-20260630-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 2026-06-30_f4574ef4494f2c4b64e6b2a376e8614c_elex_emotet_stop.exe
- Size 282KB
- Sample260701-chqckses8v
- SHA256 079497f77e2906bd47fc5d352e64690eec0c1c153d649fe00684acf65a1edf9e
- MD5 f4574ef4494f2c4b64e6b2a376e8614c
- SHA1 ab290f6677b980c8ef86e1952d6b85d21a6c8e0a
- SHA512 3b8fd66c5700f7e070a1e96c6e2c34f953b631eb2ebdf434d3e42822abfcefd1f652e17f04b3a76b550792237e5dde4066ff401c196a86719e13a924932f9ec2
- SSDEEP 6144:TlZtbLWIgd1LZ9oECZbxlUS+LOykEjiPISUOgW9X+hOGzC/:RLWI09QZb6LOykmZzcukG2/
- TLSH T1E1549F1776C28273D5A3037209DAC6E9B73ABC71573686C72794730D2B72EA5873A381
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2716 XSXFX.exe 3408 XNQPG.exe 2364 VLB.exe 4724 UVEICCI.exe 5736 DEG.exe 5000 SZXSYU.exe 4308 YUOA.exe 3600 THTKFX.exe 3068 XPA.exe 1480 BGOKEA.exe 1816 NOV.exe 2208 WWXX.exe 5732 AEEX.exe 4304 RMGKJ.exe 5860 KHJGPDX.exe 5700 QDVH.exe 2164 AABTKA.exe 612 NLJSYL.exe 2228 DBKRFZY.exe 4276 SWBVQ.exe 4428 TZFZ.exe 1716 LCJVJZ.exe 3084 KNMLJ.exe 1312 FARUUNV.exe 2188 WBT.exe 5572 DECMQX.exe 4780 ABI.exe 1376 GXHK.exe 5748 CCRZ.exe 936 KISNU.exe 3948 ZLB.exe 4332 UYGB.exe 3344 PLLKZE.exe 3796 EBMKG.exe 4968 IJSKKSJ.exe 4472 OKAY.exe 2444 GNEBHC.exe 1032 YVG.exe 2268 CDMGW.exe 2108 NWPZEI.exe 1000 WEREIFU.exe 6136 LZBRT.exe 3484 MCFM.exe 2804 FXIQMG.exe 4168 FAUMR.exe 2096 TLD.exe 3840 BQP.exe 6128 DOVLYNO.exe 4992 HPXOJR.exe 5788 NPE.exe 6068 RSCXSF.exe 5988 VARX.exe 4856 KDABQKY.exe 4124 JODRYY.exe 4712 TOFWCVW.exe 4180 EHI.exe 5196 TKSBVX.exe 3020 OXX.exe 1572 FXZQ.exe 5004 JNFQVN.exe 5900 DBK.exe 1340 NYQ.exe 4140 NEQ.exe 2956 MCBLJNZ.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\UVEICCI.exe VLB.exe File created C:\windows\SysWOW64\GNEBHC.exe OKAY.exe File created C:\windows\SysWOW64\HPXOJR.exe DOVLYNO.exe File opened for modification C:\windows\SysWOW64\NYQ.exe DBK.exe File created C:\windows\SysWOW64\LXVUPNO.exe.bat GEM.exe File created C:\windows\SysWOW64\EAJWW.exe OJIXQMV.exe File opened for modification C:\windows\SysWOW64\EAJWW.exe OJIXQMV.exe File created C:\windows\SysWOW64\FZIZTOO.exe QJHAMS.exe File created C:\windows\SysWOW64\DEG.exe UVEICCI.exe File created C:\windows\SysWOW64\XPA.exe.bat THTKFX.exe File created C:\windows\SysWOW64\JNFQVN.exe FXZQ.exe File created C:\windows\SysWOW64\UCCDS.exe MXPWI.exe File opened for modification C:\windows\SysWOW64\YVG.exe GNEBHC.exe File opened for modification C:\windows\SysWOW64\HPXOJR.exe DOVLYNO.exe File created C:\windows\SysWOW64\SAR.exe TFSVLK.exe File created C:\windows\SysWOW64\XSXFX.exe 2026-06-30_f4574ef4494f2c4b64e6b2a376e8614c_elex_emotet_stop.exe File created C:\windows\SysWOW64\ABI.exe.bat DECMQX.exe File opened for modification C:\windows\SysWOW64\GNEBHC.exe OKAY.exe File opened for modification C:\windows\SysWOW64\BQP.exe TLD.exe File opened for modification C:\windows\SysWOW64\HPGU.exe MCBLJNZ.exe File created C:\windows\SysWOW64\LXVUPNO.exe GEM.exe File created C:\windows\SysWOW64\DEG.exe.bat UVEICCI.exe File created C:\windows\SysWOW64\WWXX.exe NOV.exe File created C:\windows\SysWOW64\YVG.exe GNEBHC.exe File opened for modification C:\windows\SysWOW64\FXIQMG.exe MCFM.exe File created C:\windows\SysWOW64\FXIQMG.exe.bat MCFM.exe File created C:\windows\SysWOW64\NPE.exe HPXOJR.exe File created C:\windows\SysWOW64\NPE.exe.bat HPXOJR.exe File created C:\windows\SysWOW64\HPGU.exe.bat MCBLJNZ.exe File created C:\windows\SysWOW64\QDVH.exe.bat KHJGPDX.exe File created C:\windows\SysWOW64\EBMKG.exe PLLKZE.exe File created C:\windows\SysWOW64\EBMKG.exe.bat PLLKZE.exe File created C:\windows\SysWOW64\YVG.exe.bat GNEBHC.exe File created C:\windows\SysWOW64\MBAAAID.exe.bat TATP.exe File opened for modification C:\windows\SysWOW64\RMGKJ.exe AEEX.exe File created C:\windows\SysWOW64\KLBOUBH.exe YDUGH.exe File opened for modification C:\windows\SysWOW64\FZIZTOO.exe QJHAMS.exe File created C:\windows\SysWOW64\FZIZTOO.exe.bat QJHAMS.exe File created C:\windows\SysWOW64\XSXFX.exe.bat 2026-06-30_f4574ef4494f2c4b64e6b2a376e8614c_elex_emotet_stop.exe File created C:\windows\SysWOW64\XPA.exe THTKFX.exe File opened for modification C:\windows\SysWOW64\WWXX.exe NOV.exe File opened for modification C:\windows\SysWOW64\QDVH.exe KHJGPDX.exe File created C:\windows\SysWOW64\DBKRFZY.exe.bat NLJSYL.exe File created C:\windows\SysWOW64\TZFZ.exe SWBVQ.exe File created C:\windows\SysWOW64\ABI.exe DECMQX.exe File created C:\windows\SysWOW64\HPXOJR.exe.bat DOVLYNO.exe File created C:\windows\SysWOW64\WWXX.exe.bat NOV.exe File opened for modification C:\windows\SysWOW64\PLLKZE.exe UYGB.exe File opened for modification C:\windows\SysWOW64\NPE.exe HPXOJR.exe File opened for modification C:\windows\SysWOW64\UCCDS.exe MXPWI.exe File created C:\windows\SysWOW64\UCCDS.exe.bat MXPWI.exe File created C:\windows\SysWOW64\NUZEE.exe.bat FZIZTOO.exe File created C:\windows\SysWOW64\FARUUNV.exe KNMLJ.exe File created C:\windows\SysWOW64\PLLKZE.exe UYGB.exe File created C:\windows\SysWOW64\GNEBHC.exe.bat OKAY.exe File created C:\windows\SysWOW64\BQP.exe TLD.exe File created C:\windows\SysWOW64\KLBOUBH.exe.bat YDUGH.exe File opened for modification C:\windows\SysWOW64\LXVUPNO.exe GEM.exe File created C:\windows\SysWOW64\IXZV.exe WEW.exe File created C:\windows\SysWOW64\IXZV.exe.bat WEW.exe File created C:\windows\SysWOW64\RMGKJ.exe AEEX.exe File opened for modification C:\windows\SysWOW64\FARUUNV.exe KNMLJ.exe File created C:\windows\SysWOW64\FARUUNV.exe.bat KNMLJ.exe File opened for modification C:\windows\SysWOW64\ABI.exe DECMQX.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\system\MCBLJNZ.exe NEQ.exe File opened for modification C:\windows\NQAJGDW.exe DQYWCY.exe File created C:\windows\system\YUOA.exe SZXSYU.exe File created C:\windows\NLJSYL.exe.bat AABTKA.exe File opened for modification C:\windows\system\DECMQX.exe WBT.exe File opened for modification C:\windows\system\NWPZEI.exe CDMGW.exe File created C:\windows\TLD.exe.bat FAUMR.exe File created C:\windows\IGXNBBS.exe EYIFP.exe File opened for modification C:\windows\IGXNBBS.exe EYIFP.exe File created C:\windows\system\TATP.exe YNOFHHG.exe File opened for modification C:\windows\system\WBT.exe FARUUNV.exe File created C:\windows\system\FAUMR.exe.bat FXIQMG.exe File opened for modification C:\windows\system\KDABQKY.exe VARX.exe File opened for modification C:\windows\OXX.exe TKSBVX.exe File created C:\windows\OXX.exe.bat TKSBVX.exe File opened for modification C:\windows\system\NEQ.exe NYQ.exe File opened for modification C:\windows\system\TATP.exe YNOFHHG.exe File created C:\windows\CKAD.exe.bat NUZEE.exe File opened for modification C:\windows\XNQPG.exe XSXFX.exe File opened for modification C:\windows\VLB.exe XNQPG.exe File created C:\windows\CDMGW.exe YVG.exe File created C:\windows\system\MCBLJNZ.exe.bat NEQ.exe File created C:\windows\QVK.exe MFEWFC.exe File created C:\windows\system\ZLB.exe KISNU.exe File created C:\windows\system\THTKFX.exe.bat YUOA.exe File opened for modification C:\windows\system\AABTKA.exe QDVH.exe File opened for modification C:\windows\NLJSYL.exe AABTKA.exe File created C:\windows\system\OKAY.exe IJSKKSJ.exe File created C:\windows\system\RSCXSF.exe.bat NPE.exe File created C:\windows\system\YDUGH.exe.bat WFHMAAL.exe File created C:\windows\NQAJGDW.exe.bat DQYWCY.exe File created C:\windows\system\KHJGPDX.exe.bat RMGKJ.exe File created C:\windows\system\WEREIFU.exe.bat NWPZEI.exe File created C:\windows\NQAJGDW.exe DQYWCY.exe File created C:\windows\GBQODIT.exe CLJOR.exe File created C:\windows\system\MXPWI.exe GBQODIT.exe File created C:\windows\EYIFP.exe.bat UQGALEU.exe File opened for modification C:\windows\LZBRT.exe WEREIFU.exe File created C:\windows\system\RSCXSF.exe NPE.exe File created C:\windows\system\JODRYY.exe.bat KDABQKY.exe File created C:\windows\system\UQGALEU.exe PQHMUK.exe File opened for modification C:\windows\system\YNOFHHG.exe EAJWW.exe File created C:\windows\system\CRRTFR.exe HWMK.exe File created C:\windows\system\TFSVLK.exe.bat IXZV.exe File opened for modification C:\windows\system\DQYWCY.exe SAR.exe File created C:\windows\system\FXZQ.exe OXX.exe File created C:\windows\system\TFSVLK.exe IXZV.exe File opened for modification C:\windows\system\TFSVLK.exe IXZV.exe File created C:\windows\system\CLJOR.exe.bat NQAJGDW.exe File created C:\windows\IGXNBBS.exe.bat EYIFP.exe File opened for modification C:\windows\system\BGOKEA.exe XPA.exe File created C:\windows\IJSKKSJ.exe.bat EBMKG.exe File created C:\windows\system\FAUMR.exe FXIQMG.exe File opened for modification C:\windows\TLD.exe FAUMR.exe File created C:\windows\system\MCBLJNZ.exe NEQ.exe File created C:\windows\system\WEW.exe.bat CRRTFR.exe File opened for modification C:\windows\system\CLJOR.exe NQAJGDW.exe File created C:\windows\system\UQGALEU.exe.bat PQHMUK.exe File opened for modification C:\windows\system\SZXSYU.exe DEG.exe File created C:\windows\system\BGOKEA.exe XPA.exe File created C:\windows\system\AEEX.exe WWXX.exe File created C:\windows\IJSKKSJ.exe EBMKG.exe File created C:\windows\system\MCFM.exe LZBRT.exe File created C:\windows\system\VARX.exe.bat RSCXSF.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 64 IoCs
pid pid_target Process procid_target 5648 1648 WerFault.exe 86 1128 2716 WerFault.exe 91 560 3408 WerFault.exe 97 5988 2364 WerFault.exe 102 2312 4724 WerFault.exe 107 3508 5736 WerFault.exe 112 1928 5000 WerFault.exe 117 3868 4308 WerFault.exe 122 1492 3600 WerFault.exe 127 4560 3068 WerFault.exe 132 3608 1480 WerFault.exe 137 5556 1816 WerFault.exe 142 3160 2208 WerFault.exe 147 5116 5732 WerFault.exe 152 5032 4304 WerFault.exe 157 3052 5860 WerFault.exe 162 3140 5700 WerFault.exe 167 5720 2164 WerFault.exe 172 1620 612 WerFault.exe 177 4720 2228 WerFault.exe 182 3020 4276 WerFault.exe 187 3016 4428 WerFault.exe 192 5272 1716 WerFault.exe 197 4072 3084 WerFault.exe 202 5212 1312 WerFault.exe 207 5240 2188 WerFault.exe 212 5996 5572 WerFault.exe 217 2376 4780 WerFault.exe 222 4616 1376 WerFault.exe 227 3188 5748 WerFault.exe 232 2016 936 WerFault.exe 237 4900 3948 WerFault.exe 242 2260 4332 WerFault.exe 247 2536 3344 WerFault.exe 252 4456 3796 WerFault.exe 257 1572 4968 WerFault.exe 262 1772 4472 WerFault.exe 267 5228 2444 WerFault.exe 272 1636 1032 WerFault.exe 277 2504 2268 WerFault.exe 282 5868 2108 WerFault.exe 287 2552 1000 WerFault.exe 292 5532 6136 WerFault.exe 297 2740 3484 WerFault.exe 302 2448 2804 WerFault.exe 307 4148 4168 WerFault.exe 312 3556 2096 WerFault.exe 317 3872 3840 WerFault.exe 322 5792 6128 WerFault.exe 327 2064 4992 WerFault.exe 332 2708 5788 WerFault.exe 337 5492 6068 WerFault.exe 342 5868 5988 WerFault.exe 347 2400 4856 WerFault.exe 352 844 4124 WerFault.exe 357 2740 4712 WerFault.exe 362 4416 4180 WerFault.exe 367 4148 5196 WerFault.exe 372 4480 3020 WerFault.exe 377 1844 1572 WerFault.exe 382 812 5004 WerFault.exe 387 2176 5900 WerFault.exe 392 4872 1340 WerFault.exe 397 1128 4140 WerFault.exe 402 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MXPWI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KISNU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FXZQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LXVUPNO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EYIFP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ABI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KDABQKY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JNFQVN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DBK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XSXFX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VLB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WBT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TKSBVX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WWXX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TZFZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TOFWCVW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OXX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MFEWFC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AABTKA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RSCXSF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NQAJGDW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EAJWW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YUOA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CCRZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GNEBHC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FXIQMG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FAUMR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QVK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DECMQX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-30_f4574ef4494f2c4b64e6b2a376e8614c_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QDVH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MCBLJNZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YNOFHHG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QJHAMS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XPA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DOVLYNO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NUBOFOP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FZIZTOO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1648 2026-06-30_f4574ef4494f2c4b64e6b2a376e8614c_elex_emotet_stop.exe 1648 2026-06-30_f4574ef4494f2c4b64e6b2a376e8614c_elex_emotet_stop.exe 2716 XSXFX.exe 2716 XSXFX.exe 3408 XNQPG.exe 3408 XNQPG.exe 2364 VLB.exe 2364 VLB.exe 4724 UVEICCI.exe 4724 UVEICCI.exe 5736 DEG.exe 5736 DEG.exe 5000 SZXSYU.exe 5000 SZXSYU.exe 4308 YUOA.exe 4308 YUOA.exe 3600 THTKFX.exe 3600 THTKFX.exe 3068 XPA.exe 3068 XPA.exe 1480 BGOKEA.exe 1480 BGOKEA.exe 1816 NOV.exe 1816 NOV.exe 2208 WWXX.exe 2208 WWXX.exe 5732 AEEX.exe 5732 AEEX.exe 4304 RMGKJ.exe 4304 RMGKJ.exe 5860 KHJGPDX.exe 5860 KHJGPDX.exe 5700 QDVH.exe 5700 QDVH.exe 2164 AABTKA.exe 2164 AABTKA.exe 612 NLJSYL.exe 612 NLJSYL.exe 2228 DBKRFZY.exe 2228 DBKRFZY.exe 4276 SWBVQ.exe 4276 SWBVQ.exe 4428 TZFZ.exe 4428 TZFZ.exe 1716 LCJVJZ.exe 1716 LCJVJZ.exe 3084 KNMLJ.exe 3084 KNMLJ.exe 1312 FARUUNV.exe 1312 FARUUNV.exe 2188 WBT.exe 2188 WBT.exe 5572 DECMQX.exe 5572 DECMQX.exe 4780 ABI.exe 4780 ABI.exe 1376 GXHK.exe 1376 GXHK.exe 5748 CCRZ.exe 5748 CCRZ.exe 936 KISNU.exe 936 KISNU.exe 3948 ZLB.exe 3948 ZLB.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1648 2026-06-30_f4574ef4494f2c4b64e6b2a376e8614c_elex_emotet_stop.exe 1648 2026-06-30_f4574ef4494f2c4b64e6b2a376e8614c_elex_emotet_stop.exe 2716 XSXFX.exe 2716 XSXFX.exe 3408 XNQPG.exe 3408 XNQPG.exe 2364 VLB.exe 2364 VLB.exe 4724 UVEICCI.exe 4724 UVEICCI.exe 5736 DEG.exe 5736 DEG.exe 5000 SZXSYU.exe 5000 SZXSYU.exe 4308 YUOA.exe 4308 YUOA.exe 3600 THTKFX.exe 3600 THTKFX.exe 3068 XPA.exe 3068 XPA.exe 1480 BGOKEA.exe 1480 BGOKEA.exe 1816 NOV.exe 1816 NOV.exe 2208 WWXX.exe 2208 WWXX.exe 5732 AEEX.exe 5732 AEEX.exe 4304 RMGKJ.exe 4304 RMGKJ.exe 5860 KHJGPDX.exe 5860 KHJGPDX.exe 5700 QDVH.exe 5700 QDVH.exe 2164 AABTKA.exe 2164 AABTKA.exe 612 NLJSYL.exe 612 NLJSYL.exe 2228 DBKRFZY.exe 2228 DBKRFZY.exe 4276 SWBVQ.exe 4276 SWBVQ.exe 4428 TZFZ.exe 4428 TZFZ.exe 1716 LCJVJZ.exe 1716 LCJVJZ.exe 3084 KNMLJ.exe 3084 KNMLJ.exe 1312 FARUUNV.exe 1312 FARUUNV.exe 2188 WBT.exe 2188 WBT.exe 5572 DECMQX.exe 5572 DECMQX.exe 4780 ABI.exe 4780 ABI.exe 1376 GXHK.exe 1376 GXHK.exe 5748 CCRZ.exe 5748 CCRZ.exe 936 KISNU.exe 936 KISNU.exe 3948 ZLB.exe 3948 ZLB.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1648 wrote to memory of 5376 1648 2026-06-30_f4574ef4494f2c4b64e6b2a376e8614c_elex_emotet_stop.exe 87 PID 5376 wrote to memory of 2716 5376 cmd.exe 91 PID 2716 wrote to memory of 3632 2716 XSXFX.exe 93 PID 3632 wrote to memory of 3408 3632 cmd.exe 97 PID 3408 wrote to memory of 1044 3408 XNQPG.exe 98 PID 1044 wrote to memory of 2364 1044 cmd.exe 102 PID 2364 wrote to memory of 6100 2364 VLB.exe 103 PID 6100 wrote to memory of 4724 6100 cmd.exe 107 PID 4724 wrote to memory of 5856 4724 UVEICCI.exe 108 PID 5856 wrote to memory of 5736 5856 cmd.exe 112 PID 5736 wrote to memory of 204 5736 DEG.exe 113 PID 204 wrote to memory of 5000 204 cmd.exe 117 PID 5000 wrote to memory of 2812 5000 SZXSYU.exe 118 PID 2812 wrote to memory of 4308 2812 cmd.exe 122 PID 4308 wrote to memory of 3236 4308 YUOA.exe 123 PID 3236 wrote to memory of 3600 3236 cmd.exe 127 PID 3600 wrote to memory of 2156 3600 THTKFX.exe 128 PID 2156 wrote to memory of 3068 2156 cmd.exe 132 PID 3068 wrote to memory of 4252 3068 XPA.exe 133 PID 4252 wrote to memory of 1480 4252 cmd.exe 137 PID 1480 wrote to memory of 1204 1480 BGOKEA.exe 138 PID 1204 wrote to memory of 1816 1204 cmd.exe 142 PID 1816 wrote to memory of 4468 1816 NOV.exe 143 PID 4468 wrote to memory of 2208 4468 cmd.exe 147 PID 2208 wrote to memory of 6116 2208 WWXX.exe 148 PID 6116 wrote to memory of 5732 6116 cmd.exe 152 PID 5732 wrote to memory of 3448 5732 AEEX.exe 153 PID 3448 wrote to memory of 4304 3448 cmd.exe 157 PID 4304 wrote to memory of 4208 4304 RMGKJ.exe 158 PID 4208 wrote to memory of 5860 4208 cmd.exe 162 PID 5860 wrote to memory of 4316 5860 KHJGPDX.exe 163 PID 4316 wrote to memory of 5700 4316 cmd.exe 167 PID 5700 wrote to memory of 3744 5700 QDVH.exe 168 PID 3744 wrote to memory of 2164 3744 cmd.exe 172 PID 2164 wrote to memory of 3208 2164 AABTKA.exe 173 PID 3208 wrote to memory of 612 3208 cmd.exe 177 PID 612 wrote to memory of 1940 612 NLJSYL.exe 178 PID 1940 wrote to memory of 2228 1940 cmd.exe 182 PID 2228 wrote to memory of 972 2228 DBKRFZY.exe 183 PID 972 wrote to memory of 4276 972 cmd.exe 187 PID 4276 wrote to memory of 2928 4276 SWBVQ.exe 188 PID 2928 wrote to memory of 4428 2928 cmd.exe 192 PID 4428 wrote to memory of 2076 4428 TZFZ.exe 193 PID 2076 wrote to memory of 1716 2076 cmd.exe 197 PID 1716 wrote to memory of 5428 1716 LCJVJZ.exe 198 PID 5428 wrote to memory of 3084 5428 cmd.exe 202 PID 3084 wrote to memory of 2680 3084 KNMLJ.exe 203 PID 2680 wrote to memory of 1312 2680 cmd.exe 207 PID 1312 wrote to memory of 1136 1312 FARUUNV.exe 208 PID 1136 wrote to memory of 2188 1136 cmd.exe 212 PID 2188 wrote to memory of 5260 2188 WBT.exe 213 PID 5260 wrote to memory of 5572 5260 cmd.exe 217 PID 5572 wrote to memory of 2524 5572 DECMQX.exe 218 PID 2524 wrote to memory of 4780 2524 cmd.exe 222 PID 4780 wrote to memory of 4104 4780 ABI.exe 223 PID 4104 wrote to memory of 1376 4104 cmd.exe 227 PID 1376 wrote to memory of 4136 1376 GXHK.exe 228 PID 4136 wrote to memory of 5748 4136 cmd.exe 232 PID 5748 wrote to memory of 112 5748 CCRZ.exe 233 PID 112 wrote to memory of 936 112 cmd.exe 237 PID 936 wrote to memory of 2276 936 KISNU.exe 238 PID 2276 wrote to memory of 3948 2276 cmd.exe 242 PID 3948 wrote to memory of 3508 3948 ZLB.exe 243 PID 3508 wrote to memory of 4332 3508 cmd.exe 247
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f4574ef4494f2c4b64e6b2a376e8614c_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-30_f4574ef4494f2c4b64e6b2a376e8614c_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XSXFX.exe.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5376 -
C:\windows\SysWOW64\XSXFX.exeC:\windows\system32\XSXFX.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XNQPG.exe.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3632 -
C:\windows\XNQPG.exeC:\windows\XNQPG.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VLB.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\windows\VLB.exeC:\windows\VLB.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UVEICCI.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:6100 -
C:\windows\SysWOW64\UVEICCI.exeC:\windows\system32\UVEICCI.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DEG.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:5856 -
C:\windows\SysWOW64\DEG.exeC:\windows\system32\DEG.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SZXSYU.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:204 -
C:\windows\system\SZXSYU.exeC:\windows\system\SZXSYU.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YUOA.exe.bat" "14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\windows\system\YUOA.exeC:\windows\system\YUOA.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\THTKFX.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:3236 -
C:\windows\system\THTKFX.exeC:\windows\system\THTKFX.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XPA.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\windows\SysWOW64\XPA.exeC:\windows\system32\XPA.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BGOKEA.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\windows\system\BGOKEA.exeC:\windows\system\BGOKEA.exe21⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NOV.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\windows\NOV.exeC:\windows\NOV.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WWXX.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\windows\SysWOW64\WWXX.exeC:\windows\system32\WWXX.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AEEX.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:6116 -
C:\windows\system\AEEX.exeC:\windows\system\AEEX.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RMGKJ.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\windows\SysWOW64\RMGKJ.exeC:\windows\system32\RMGKJ.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KHJGPDX.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\windows\system\KHJGPDX.exeC:\windows\system\KHJGPDX.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QDVH.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\windows\SysWOW64\QDVH.exeC:\windows\system32\QDVH.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AABTKA.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:3744 -
C:\windows\system\AABTKA.exeC:\windows\system\AABTKA.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NLJSYL.exe.bat" "36⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3208 -
C:\windows\NLJSYL.exeC:\windows\NLJSYL.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DBKRFZY.exe.bat" "38⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\windows\SysWOW64\DBKRFZY.exeC:\windows\system32\DBKRFZY.exe39⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SWBVQ.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:972 -
C:\windows\system\SWBVQ.exeC:\windows\system\SWBVQ.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TZFZ.exe.bat" "42⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\windows\SysWOW64\TZFZ.exeC:\windows\system32\TZFZ.exe43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LCJVJZ.exe.bat" "44⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\windows\LCJVJZ.exeC:\windows\LCJVJZ.exe45⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KNMLJ.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:5428 -
C:\windows\SysWOW64\KNMLJ.exeC:\windows\system32\KNMLJ.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FARUUNV.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\windows\SysWOW64\FARUUNV.exeC:\windows\system32\FARUUNV.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WBT.exe.bat" "50⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\windows\system\WBT.exeC:\windows\system\WBT.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DECMQX.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:5260 -
C:\windows\system\DECMQX.exeC:\windows\system\DECMQX.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ABI.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\windows\SysWOW64\ABI.exeC:\windows\system32\ABI.exe55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GXHK.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\windows\system\GXHK.exeC:\windows\system\GXHK.exe57⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CCRZ.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\windows\CCRZ.exeC:\windows\CCRZ.exe59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KISNU.exe.bat" "60⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:112 -
C:\windows\KISNU.exeC:\windows\KISNU.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZLB.exe.bat" "62⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\windows\system\ZLB.exeC:\windows\system\ZLB.exe63⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UYGB.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:3508 -
C:\windows\system\UYGB.exeC:\windows\system\UYGB.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4332 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PLLKZE.exe.bat" "66⤵PID:4840
-
C:\windows\SysWOW64\PLLKZE.exeC:\windows\system32\PLLKZE.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EBMKG.exe.bat" "68⤵PID:1420
-
C:\windows\SysWOW64\EBMKG.exeC:\windows\system32\EBMKG.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IJSKKSJ.exe.bat" "70⤵PID:5544
-
C:\windows\IJSKKSJ.exeC:\windows\IJSKKSJ.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OKAY.exe.bat" "72⤵PID:3384
-
C:\windows\system\OKAY.exeC:\windows\system\OKAY.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GNEBHC.exe.bat" "74⤵PID:1516
-
C:\windows\SysWOW64\GNEBHC.exeC:\windows\system32\GNEBHC.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YVG.exe.bat" "76⤵PID:5520
-
C:\windows\SysWOW64\YVG.exeC:\windows\system32\YVG.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1032 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CDMGW.exe.bat" "78⤵
- System Location Discovery: System Language Discovery
PID:2036 -
C:\windows\CDMGW.exeC:\windows\CDMGW.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NWPZEI.exe.bat" "80⤵PID:2756
-
C:\windows\system\NWPZEI.exeC:\windows\system\NWPZEI.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WEREIFU.exe.bat" "82⤵PID:5684
-
C:\windows\system\WEREIFU.exeC:\windows\system\WEREIFU.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LZBRT.exe.bat" "84⤵PID:4936
-
C:\windows\LZBRT.exeC:\windows\LZBRT.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6136 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MCFM.exe.bat" "86⤵PID:1868
-
C:\windows\system\MCFM.exeC:\windows\system\MCFM.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3484 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FXIQMG.exe.bat" "88⤵PID:4668
-
C:\windows\SysWOW64\FXIQMG.exeC:\windows\system32\FXIQMG.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FAUMR.exe.bat" "90⤵
- System Location Discovery: System Language Discovery
PID:5836 -
C:\windows\system\FAUMR.exeC:\windows\system\FAUMR.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4168 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TLD.exe.bat" "92⤵PID:5368
-
C:\windows\TLD.exeC:\windows\TLD.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2096 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BQP.exe.bat" "94⤵
- System Location Discovery: System Language Discovery
PID:1936 -
C:\windows\SysWOW64\BQP.exeC:\windows\system32\BQP.exe95⤵
- Executes dropped EXE
PID:3840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DOVLYNO.exe.bat" "96⤵
- System Location Discovery: System Language Discovery
PID:5400 -
C:\windows\system\DOVLYNO.exeC:\windows\system\DOVLYNO.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:6128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HPXOJR.exe.bat" "98⤵PID:5324
-
C:\windows\SysWOW64\HPXOJR.exeC:\windows\system32\HPXOJR.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NPE.exe.bat" "100⤵
- System Location Discovery: System Language Discovery
PID:5228 -
C:\windows\SysWOW64\NPE.exeC:\windows\system32\NPE.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RSCXSF.exe.bat" "102⤵
- System Location Discovery: System Language Discovery
PID:1012 -
C:\windows\system\RSCXSF.exeC:\windows\system\RSCXSF.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VARX.exe.bat" "104⤵
- System Location Discovery: System Language Discovery
PID:6040 -
C:\windows\system\VARX.exeC:\windows\system\VARX.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KDABQKY.exe.bat" "106⤵
- System Location Discovery: System Language Discovery
PID:3464 -
C:\windows\system\KDABQKY.exeC:\windows\system\KDABQKY.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JODRYY.exe.bat" "108⤵PID:4844
-
C:\windows\system\JODRYY.exeC:\windows\system\JODRYY.exe109⤵
- Executes dropped EXE
PID:4124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TOFWCVW.exe.bat" "110⤵PID:3772
-
C:\windows\TOFWCVW.exeC:\windows\TOFWCVW.exe111⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EHI.exe.bat" "112⤵PID:2024
-
C:\windows\EHI.exeC:\windows\EHI.exe113⤵
- Executes dropped EXE
PID:4180 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TKSBVX.exe.bat" "114⤵PID:1404
-
C:\windows\SysWOW64\TKSBVX.exeC:\windows\system32\TKSBVX.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5196 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OXX.exe.bat" "116⤵PID:3588
-
C:\windows\OXX.exeC:\windows\OXX.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3020 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FXZQ.exe.bat" "118⤵PID:2780
-
C:\windows\system\FXZQ.exeC:\windows\system\FXZQ.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JNFQVN.exe.bat" "120⤵PID:1724
-
C:\windows\SysWOW64\JNFQVN.exeC:\windows\system32\JNFQVN.exe121⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5004
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-