Analysis
- max time kernel
82s - max time network
122s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260630-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
01/07/2026, 15:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-01_5f459a2d13f4dadb1e0dbfbd3717c959_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-01_5f459a2d13f4dadb1e0dbfbd3717c959_elex_emotet_stop.exe
Resource
win11ltsc2024-20260630-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 2026-07-01_5f459a2d13f4dadb1e0dbfbd3717c959_elex_emotet_stop.exe
- Size 208KB
- Sample260701-sshcqag15k
- SHA256 6fdd0aeee2460ca5311f025fcba008d38667f1c426def5f5044462fd5aad5cac
- MD5 5f459a2d13f4dadb1e0dbfbd3717c959
- SHA1 fd19391cf9e48679b38487fc70e85f6ea83bd448
- SHA512 434c0d9cfca75e22abf5f8747908d4c67e12e086e82423d6c06b9c01d942a43026f221358c0fb74d3d00ec6aef46afe97ddb134672ed06645dc771c29d724e2f
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbclcdL+LOfc4NLthEjQT6E:MlZtbLWIgd1LZ9oECZbclc5+LOkQEj6
- TLSH T1F7247D2235D2C073E4B7023188F6C7787BB6BD919B36928B7BC03B4D6E315A68A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1912 LHFXM.exe 4556 MFZYY.exe 2024 FXOJP.exe 3828 ATTBZQX.exe 5976 UGYK.exe 552 VJCGPG.exe 4468 GCJRZH.exe 5728 MXJA.exe 2356 LNCVQPT.exe 3920 ADD.exe 4260 ELJUJV.exe 516 OJPOR.exe 3344 HMTK.exe 2912 YUVXHZ.exe 5716 CCB.exe 2244 RSCXSF.exe 5232 TQQJ.exe 3408 XYXRMF.exe 3112 HWCLBO.exe 5684 LMR.exe 976 RHIMKB.exe 4692 GCAY.exe 5472 WSBQC.exe 4620 LNK.exe 1180 UNMH.exe 2168 YDTH.exe 1012 QEVMO.exe 2924 BWQFXG.exe 4528 ZUJIK.exe 1208 HKK.exe 5316 YKMN.exe 5032 CASNGXT.exe 2852 RVCRR.exe 3668 QGNH.exe 1924 JJQLFO.exe 1904 URX.exe 3188 TKABAMJ.exe 3224 XSHB.exe 4852 VNGJRZN.exe 1764 ATYZHC.exe 3648 PJZQ.exe 4164 TRGYSI.exe 2784 CZIDV.exe 5392 SURIOA.exe 6132 DNUAPIL.exe 3780 DQYWCY.exe 1408 FOD.exe 5844 XOFWNM.exe 1028 BEME.exe 4532 VRRNJW.exe 2460 FPF.exe 5864 DPMVI.exe 3560 UQGALEU.exe 1680 TBRQUS.exe 1788 OWW.exe 2856 UWDNN.exe 2984 YEKNSEC.exe 5948 SSPF.exe 1504 WDNSCXT.exe 5540 CDVF.exe 5972 IDCTCU.exe 5680 DQH.exe 204 XEMUW.exe 3804 DZDVTW.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\ATTBZQX.exe FXOJP.exe File created C:\windows\SysWOW64\GCAY.exe.bat RHIMKB.exe File created C:\windows\SysWOW64\ZUJIK.exe BWQFXG.exe File opened for modification C:\windows\SysWOW64\VNGJRZN.exe XSHB.exe File created C:\windows\SysWOW64\OWW.exe.bat TBRQUS.exe File opened for modification C:\windows\SysWOW64\CECN.exe ZJL.exe File opened for modification C:\windows\SysWOW64\FAPH.exe TSJZUCL.exe File created C:\windows\SysWOW64\JAN.exe LCUF.exe File created C:\windows\SysWOW64\QEVMO.exe YDTH.exe File opened for modification C:\windows\SysWOW64\TKABAMJ.exe URX.exe File created C:\windows\SysWOW64\BEME.exe.bat XOFWNM.exe File opened for modification C:\windows\SysWOW64\SSPF.exe YEKNSEC.exe File opened for modification C:\windows\SysWOW64\JAN.exe LCUF.exe File opened for modification C:\windows\SysWOW64\JIUYMM.exe TSTYF.exe File opened for modification C:\windows\SysWOW64\GCAY.exe RHIMKB.exe File created C:\windows\SysWOW64\DPMVI.exe FPF.exe File created C:\windows\SysWOW64\SSPF.exe YEKNSEC.exe File created C:\windows\SysWOW64\DQH.exe.bat IDCTCU.exe File created C:\windows\SysWOW64\XEMUW.exe DQH.exe File opened for modification C:\windows\SysWOW64\PDVQPPL.exe YDTDMK.exe File created C:\windows\SysWOW64\MFZYY.exe LHFXM.exe File created C:\windows\SysWOW64\VNGJRZN.exe.bat XSHB.exe File opened for modification C:\windows\SysWOW64\OWW.exe TBRQUS.exe File created C:\windows\SysWOW64\STKMGRJ.exe PFFDE.exe File created C:\windows\SysWOW64\JAN.exe.bat LCUF.exe File opened for modification C:\windows\SysWOW64\MFZYY.exe LHFXM.exe File created C:\windows\SysWOW64\HWCLBO.exe XYXRMF.exe File created C:\windows\SysWOW64\GCAY.exe RHIMKB.exe File created C:\windows\SysWOW64\XSHB.exe.bat TKABAMJ.exe File created C:\windows\SysWOW64\VNGJRZN.exe XSHB.exe File created C:\windows\SysWOW64\PDVQPPL.exe.bat YDTDMK.exe File opened for modification C:\windows\SysWOW64\LJWOCE.exe AQTVT.exe File created C:\windows\SysWOW64\QEVMO.exe.bat YDTH.exe File created C:\windows\SysWOW64\TKABAMJ.exe.bat URX.exe File created C:\windows\SysWOW64\VOHYB.exe.bat GTX.exe File opened for modification C:\windows\SysWOW64\YKMN.exe HKK.exe File opened for modification C:\windows\SysWOW64\DPMVI.exe FPF.exe File opened for modification C:\windows\SysWOW64\KJH.exe CECN.exe File created C:\windows\SysWOW64\ATTBZQX.exe.bat FXOJP.exe File opened for modification C:\windows\SysWOW64\QEVMO.exe YDTH.exe File created C:\windows\SysWOW64\JJQLFO.exe QGNH.exe File opened for modification C:\windows\SysWOW64\BEME.exe XOFWNM.exe File opened for modification C:\windows\SysWOW64\IDCTCU.exe CDVF.exe File opened for modification C:\windows\SysWOW64\XEMUW.exe DQH.exe File created C:\windows\SysWOW64\XEMUW.exe.bat DQH.exe File opened for modification C:\windows\SysWOW64\STKMGRJ.exe PFFDE.exe File created C:\windows\SysWOW64\XSHB.exe TKABAMJ.exe File created C:\windows\SysWOW64\ZUJIK.exe.bat BWQFXG.exe File created C:\windows\SysWOW64\DPMVI.exe.bat FPF.exe File created C:\windows\SysWOW64\TBRQUS.exe UQGALEU.exe File opened for modification C:\windows\SysWOW64\UWDNN.exe OWW.exe File created C:\windows\SysWOW64\KJH.exe CECN.exe File created C:\windows\SysWOW64\PDVQPPL.exe YDTDMK.exe File opened for modification C:\windows\SysWOW64\UVHCG.exe FSY.exe File created C:\windows\SysWOW64\HWCLBO.exe.bat XYXRMF.exe File created C:\windows\SysWOW64\ATYZHC.exe.bat VNGJRZN.exe File created C:\windows\SysWOW64\DQH.exe IDCTCU.exe File created C:\windows\SysWOW64\STKMGRJ.exe.bat PFFDE.exe File created C:\windows\SysWOW64\CECN.exe.bat ZJL.exe File created C:\windows\SysWOW64\KJH.exe.bat CECN.exe File opened for modification C:\windows\SysWOW64\YDTDMK.exe FAPH.exe File created C:\windows\SysWOW64\LJWOCE.exe.bat AQTVT.exe File created C:\windows\SysWOW64\YKMN.exe HKK.exe File created C:\windows\SysWOW64\YKMN.exe.bat HKK.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\GCJRZH.exe VJCGPG.exe File created C:\windows\PJZQ.exe ATYZHC.exe File created C:\windows\VRRNJW.exe BEME.exe File opened for modification C:\windows\system\CRSPY.exe MWJLFGV.exe File created C:\windows\system\LRUUBY.exe.bat CRSPY.exe File opened for modification C:\windows\NSMLOXQ.exe FMZ.exe File created C:\windows\system\UBPQMCV.exe JIUYMM.exe File opened for modification C:\windows\FXOJP.exe MFZYY.exe File opened for modification C:\windows\system\ADD.exe LNCVQPT.exe File opened for modification C:\windows\system\TQQJ.exe RSCXSF.exe File created C:\windows\system\LMR.exe.bat HWCLBO.exe File created C:\windows\system\UNMH.exe.bat LNK.exe File opened for modification C:\windows\system\DQYWCY.exe DNUAPIL.exe File created C:\windows\system\XOFWNM.exe FOD.exe File created C:\windows\system\YEKNSEC.exe UWDNN.exe File created C:\windows\system\OJPOR.exe.bat ELJUJV.exe File opened for modification C:\windows\system\CCB.exe YUVXHZ.exe File created C:\windows\system\TQQJ.exe RSCXSF.exe File opened for modification C:\windows\WDNSCXT.exe SSPF.exe File opened for modification C:\windows\CPWQ.exe DZDVTW.exe File opened for modification C:\windows\system\DWPZS.exe XBQQ.exe File created C:\windows\LCUF.exe.bat DWPZS.exe File created C:\windows\FZEYW.exe FWB.exe File opened for modification C:\windows\BWQFXG.exe QEVMO.exe File opened for modification C:\windows\PJZQ.exe ATYZHC.exe File created C:\windows\TRGYSI.exe PJZQ.exe File opened for modification C:\windows\system\FOD.exe DQYWCY.exe File opened for modification C:\windows\system\YEKNSEC.exe UWDNN.exe File created C:\windows\system\CDVF.exe.bat WDNSCXT.exe File created C:\windows\system\PFFDE.exe LXY.exe File created C:\windows\system\PFFDE.exe.bat LXY.exe File created C:\windows\system\ADD.exe.bat LNCVQPT.exe File created C:\windows\FXOJP.exe MFZYY.exe File opened for modification C:\windows\system\LMR.exe HWCLBO.exe File opened for modification C:\windows\system\HKK.exe ZUJIK.exe File created C:\windows\system\URX.exe.bat JJQLFO.exe File created C:\windows\DZDVTW.exe.bat XEMUW.exe File created C:\windows\CPWQ.exe DZDVTW.exe File opened for modification C:\windows\system\DYVA.exe CDREWPQ.exe File created C:\windows\LNK.exe.bat WSBQC.exe File created C:\windows\CZIDV.exe TRGYSI.exe File created C:\windows\FSY.exe PCXZ.exe File created C:\windows\GTX.exe SNXIGKI.exe File opened for modification C:\windows\system\RSCXSF.exe CCB.exe File opened for modification C:\windows\QGNH.exe RVCRR.exe File created C:\windows\CZIDV.exe.bat TRGYSI.exe File created C:\windows\system\DNUAPIL.exe.bat SURIOA.exe File opened for modification C:\windows\system\XOFWNM.exe FOD.exe File created C:\windows\system\IGZMDF.exe.bat PDVQPPL.exe File created C:\windows\system\DWPZS.exe.bat XBQQ.exe File created C:\windows\FWB.exe DYVA.exe File created C:\windows\RHIMKB.exe.bat LMR.exe File created C:\windows\FPF.exe.bat VRRNJW.exe File created C:\windows\system\UQGALEU.exe DPMVI.exe File created C:\windows\system\CZOAAH.exe FZEYW.exe File created C:\windows\AQTVT.exe.bat UVHCG.exe File created C:\windows\system\UBPQMCV.exe.bat JIUYMM.exe File opened for modification C:\windows\HMTK.exe OJPOR.exe File created C:\windows\system\CCB.exe YUVXHZ.exe File created C:\windows\CASNGXT.exe.bat YKMN.exe File created C:\windows\WDNSCXT.exe.bat SSPF.exe File opened for modification C:\windows\FZEYW.exe FWB.exe File created C:\windows\system\CRSPY.exe MWJLFGV.exe File created C:\windows\system\YUVXHZ.exe.bat HMTK.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 64 IoCs
pid pid_target Process procid_target 3680 1908 WerFault.exe 87 2912 1912 WerFault.exe 92 1296 4556 WerFault.exe 98 1832 2024 WerFault.exe 103 1920 3828 WerFault.exe 108 2864 5976 WerFault.exe 113 1044 552 WerFault.exe 118 4668 4468 WerFault.exe 123 1484 5728 WerFault.exe 128 2856 2356 WerFault.exe 133 2436 3920 WerFault.exe 138 1972 4260 WerFault.exe 143 5448 516 WerFault.exe 148 6124 3344 WerFault.exe 153 1296 2912 WerFault.exe 158 2776 5716 WerFault.exe 163 5864 2244 WerFault.exe 168 2036 5232 WerFault.exe 173 4236 3408 WerFault.exe 178 4172 3112 WerFault.exe 183 3832 5684 WerFault.exe 188 5760 976 WerFault.exe 193 1408 4692 WerFault.exe 198 5876 5472 WerFault.exe 203 1852 4620 WerFault.exe 208 5216 1180 WerFault.exe 213 1504 2168 WerFault.exe 218 3136 1012 WerFault.exe 223 4840 2924 WerFault.exe 228 2156 4528 WerFault.exe 233 1948 1208 WerFault.exe 238 2828 5316 WerFault.exe 243 1192 5032 WerFault.exe 248 2992 2852 WerFault.exe 253 3952 3668 WerFault.exe 258 6120 1924 WerFault.exe 263 3960 1904 WerFault.exe 268 4412 3188 WerFault.exe 273 5656 3224 WerFault.exe 279 5704 4852 WerFault.exe 284 1344 1764 WerFault.exe 289 5940 3648 WerFault.exe 294 4352 4164 WerFault.exe 299 5860 2784 WerFault.exe 304 4780 5392 WerFault.exe 309 5984 6132 WerFault.exe 314 4988 3780 WerFault.exe 319 4504 1408 WerFault.exe 324 1584 5844 WerFault.exe 329 2672 1028 WerFault.exe 334 1648 4532 WerFault.exe 339 1456 2460 WerFault.exe 344 52 5864 WerFault.exe 349 4788 3560 WerFault.exe 354 5596 1680 WerFault.exe 359 4752 1788 WerFault.exe 364 1676 2856 WerFault.exe 369 4504 2984 WerFault.exe 374 5952 5948 WerFault.exe 379 5692 1504 WerFault.exe 384 5068 5540 WerFault.exe 389 4696 5972 WerFault.exe 394 2828 5680 WerFault.exe 399 3396 204 WerFault.exe 404 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XEMUW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LRUUBY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OWW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DZDVTW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CZOAAH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GZETR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BWQFXG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZUJIK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FOD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PDVQPPL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UNMH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JIUYMM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YUVXHZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TBRQUS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DWPZS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FWB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SURIOA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LCUF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XSHB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TRGYSI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CPWQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DYVA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MWJLFGV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LHFXM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FAPH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NSMLOXQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GCJRZH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ELJUJV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HMTK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1908 2026-07-01_5f459a2d13f4dadb1e0dbfbd3717c959_elex_emotet_stop.exe 1908 2026-07-01_5f459a2d13f4dadb1e0dbfbd3717c959_elex_emotet_stop.exe 1912 LHFXM.exe 1912 LHFXM.exe 4556 MFZYY.exe 4556 MFZYY.exe 2024 FXOJP.exe 2024 FXOJP.exe 3828 ATTBZQX.exe 3828 ATTBZQX.exe 5976 UGYK.exe 5976 UGYK.exe 552 VJCGPG.exe 552 VJCGPG.exe 4468 GCJRZH.exe 4468 GCJRZH.exe 5728 MXJA.exe 5728 MXJA.exe 2356 LNCVQPT.exe 2356 LNCVQPT.exe 3920 ADD.exe 3920 ADD.exe 4260 ELJUJV.exe 4260 ELJUJV.exe 516 OJPOR.exe 516 OJPOR.exe 3344 HMTK.exe 3344 HMTK.exe 2912 YUVXHZ.exe 2912 YUVXHZ.exe 5716 CCB.exe 5716 CCB.exe 2244 RSCXSF.exe 2244 RSCXSF.exe 5232 TQQJ.exe 5232 TQQJ.exe 3408 XYXRMF.exe 3408 XYXRMF.exe 3112 HWCLBO.exe 3112 HWCLBO.exe 5684 LMR.exe 5684 LMR.exe 976 RHIMKB.exe 976 RHIMKB.exe 4692 GCAY.exe 4692 GCAY.exe 5472 WSBQC.exe 5472 WSBQC.exe 4620 LNK.exe 4620 LNK.exe 1180 UNMH.exe 1180 UNMH.exe 2168 YDTH.exe 2168 YDTH.exe 1012 QEVMO.exe 1012 QEVMO.exe 2924 BWQFXG.exe 2924 BWQFXG.exe 4528 ZUJIK.exe 4528 ZUJIK.exe 1208 HKK.exe 1208 HKK.exe 5316 YKMN.exe 5316 YKMN.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1908 2026-07-01_5f459a2d13f4dadb1e0dbfbd3717c959_elex_emotet_stop.exe 1908 2026-07-01_5f459a2d13f4dadb1e0dbfbd3717c959_elex_emotet_stop.exe 1912 LHFXM.exe 1912 LHFXM.exe 4556 MFZYY.exe 4556 MFZYY.exe 2024 FXOJP.exe 2024 FXOJP.exe 3828 ATTBZQX.exe 3828 ATTBZQX.exe 5976 UGYK.exe 5976 UGYK.exe 552 VJCGPG.exe 552 VJCGPG.exe 4468 GCJRZH.exe 4468 GCJRZH.exe 5728 MXJA.exe 5728 MXJA.exe 2356 LNCVQPT.exe 2356 LNCVQPT.exe 3920 ADD.exe 3920 ADD.exe 4260 ELJUJV.exe 4260 ELJUJV.exe 516 OJPOR.exe 516 OJPOR.exe 3344 HMTK.exe 3344 HMTK.exe 2912 YUVXHZ.exe 2912 YUVXHZ.exe 5716 CCB.exe 5716 CCB.exe 2244 RSCXSF.exe 2244 RSCXSF.exe 5232 TQQJ.exe 5232 TQQJ.exe 3408 XYXRMF.exe 3408 XYXRMF.exe 3112 HWCLBO.exe 3112 HWCLBO.exe 5684 LMR.exe 5684 LMR.exe 976 RHIMKB.exe 976 RHIMKB.exe 4692 GCAY.exe 4692 GCAY.exe 5472 WSBQC.exe 5472 WSBQC.exe 4620 LNK.exe 4620 LNK.exe 1180 UNMH.exe 1180 UNMH.exe 2168 YDTH.exe 2168 YDTH.exe 1012 QEVMO.exe 1012 QEVMO.exe 2924 BWQFXG.exe 2924 BWQFXG.exe 4528 ZUJIK.exe 4528 ZUJIK.exe 1208 HKK.exe 1208 HKK.exe 5316 YKMN.exe 5316 YKMN.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1908 wrote to memory of 476 1908 2026-07-01_5f459a2d13f4dadb1e0dbfbd3717c959_elex_emotet_stop.exe 88 PID 476 wrote to memory of 1912 476 cmd.exe 92 PID 1912 wrote to memory of 2332 1912 LHFXM.exe 94 PID 2332 wrote to memory of 4556 2332 cmd.exe 98 PID 4556 wrote to memory of 5772 4556 MFZYY.exe 99 PID 5772 wrote to memory of 2024 5772 cmd.exe 103 PID 2024 wrote to memory of 4276 2024 FXOJP.exe 104 PID 4276 wrote to memory of 3828 4276 cmd.exe 108 PID 3828 wrote to memory of 3080 3828 ATTBZQX.exe 109 PID 3080 wrote to memory of 5976 3080 cmd.exe 113 PID 5976 wrote to memory of 340 5976 UGYK.exe 114 PID 340 wrote to memory of 552 340 cmd.exe 118 PID 552 wrote to memory of 4452 552 VJCGPG.exe 119 PID 4452 wrote to memory of 4468 4452 cmd.exe 123 PID 4468 wrote to memory of 5812 4468 GCJRZH.exe 124 PID 5812 wrote to memory of 5728 5812 cmd.exe 128 PID 5728 wrote to memory of 3440 5728 MXJA.exe 129 PID 3440 wrote to memory of 2356 3440 cmd.exe 133 PID 2356 wrote to memory of 1348 2356 LNCVQPT.exe 134 PID 1348 wrote to memory of 3920 1348 cmd.exe 138 PID 3920 wrote to memory of 5512 3920 ADD.exe 139 PID 5512 wrote to memory of 4260 5512 cmd.exe 143 PID 4260 wrote to memory of 2408 4260 ELJUJV.exe 144 PID 2408 wrote to memory of 516 2408 cmd.exe 148 PID 516 wrote to memory of 4808 516 OJPOR.exe 149 PID 4808 wrote to memory of 3344 4808 cmd.exe 153 PID 3344 wrote to memory of 2104 3344 HMTK.exe 154 PID 2104 wrote to memory of 2912 2104 cmd.exe 158 PID 2912 wrote to memory of 2704 2912 YUVXHZ.exe 159 PID 2704 wrote to memory of 5716 2704 cmd.exe 163 PID 5716 wrote to memory of 5140 5716 CCB.exe 164 PID 5140 wrote to memory of 2244 5140 cmd.exe 168 PID 2244 wrote to memory of 1420 2244 RSCXSF.exe 169 PID 1420 wrote to memory of 5232 1420 cmd.exe 173 PID 5232 wrote to memory of 2432 5232 TQQJ.exe 174 PID 2432 wrote to memory of 3408 2432 cmd.exe 178 PID 3408 wrote to memory of 688 3408 XYXRMF.exe 179 PID 688 wrote to memory of 3112 688 cmd.exe 183 PID 3112 wrote to memory of 1616 3112 HWCLBO.exe 184 PID 1616 wrote to memory of 5684 1616 cmd.exe 188 PID 5684 wrote to memory of 1056 5684 LMR.exe 189 PID 1056 wrote to memory of 976 1056 cmd.exe 193 PID 976 wrote to memory of 5024 976 RHIMKB.exe 194 PID 5024 wrote to memory of 4692 5024 cmd.exe 198 PID 4692 wrote to memory of 4896 4692 GCAY.exe 199 PID 4896 wrote to memory of 5472 4896 cmd.exe 203 PID 5472 wrote to memory of 2660 5472 WSBQC.exe 204 PID 2660 wrote to memory of 4620 2660 cmd.exe 208 PID 4620 wrote to memory of 5256 4620 LNK.exe 209 PID 5256 wrote to memory of 1180 5256 cmd.exe 213 PID 1180 wrote to memory of 5980 1180 UNMH.exe 214 PID 5980 wrote to memory of 2168 5980 cmd.exe 218 PID 2168 wrote to memory of 2556 2168 YDTH.exe 219 PID 2556 wrote to memory of 1012 2556 cmd.exe 223 PID 1012 wrote to memory of 2792 1012 QEVMO.exe 224 PID 2792 wrote to memory of 2924 2792 cmd.exe 228 PID 2924 wrote to memory of 1212 2924 BWQFXG.exe 229 PID 1212 wrote to memory of 4528 1212 cmd.exe 233 PID 4528 wrote to memory of 3032 4528 ZUJIK.exe 234 PID 3032 wrote to memory of 1208 3032 cmd.exe 238 PID 1208 wrote to memory of 4248 1208 HKK.exe 239 PID 4248 wrote to memory of 5316 4248 cmd.exe 243 PID 5316 wrote to memory of 1808 5316 YKMN.exe 244 PID 1808 wrote to memory of 5032 1808 cmd.exe 248
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-01_5f459a2d13f4dadb1e0dbfbd3717c959_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-01_5f459a2d13f4dadb1e0dbfbd3717c959_elex_emotet_stop.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LHFXM.exe.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:476 -
C:\windows\system\LHFXM.exeC:\windows\system\LHFXM.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MFZYY.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\windows\SysWOW64\MFZYY.exeC:\windows\system32\MFZYY.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FXOJP.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:5772 -
C:\windows\FXOJP.exeC:\windows\FXOJP.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ATTBZQX.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\windows\SysWOW64\ATTBZQX.exeC:\windows\system32\ATTBZQX.exe9⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UGYK.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:3080 -
C:\windows\system\UGYK.exeC:\windows\system\UGYK.exe11⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VJCGPG.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:340 -
C:\windows\VJCGPG.exeC:\windows\VJCGPG.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GCJRZH.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\windows\system\GCJRZH.exeC:\windows\system\GCJRZH.exe15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MXJA.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:5812 -
C:\windows\system\MXJA.exeC:\windows\system\MXJA.exe17⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5728 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LNCVQPT.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\windows\LNCVQPT.exeC:\windows\LNCVQPT.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ADD.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\windows\system\ADD.exeC:\windows\system\ADD.exe21⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ELJUJV.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:5512 -
C:\windows\system\ELJUJV.exeC:\windows\system\ELJUJV.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OJPOR.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\windows\system\OJPOR.exeC:\windows\system\OJPOR.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HMTK.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\windows\HMTK.exeC:\windows\HMTK.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YUVXHZ.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\windows\system\YUVXHZ.exeC:\windows\system\YUVXHZ.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CCB.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\windows\system\CCB.exeC:\windows\system\CCB.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RSCXSF.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:5140 -
C:\windows\system\RSCXSF.exeC:\windows\system\RSCXSF.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TQQJ.exe.bat" "34⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\windows\system\TQQJ.exeC:\windows\system\TQQJ.exe35⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5232 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XYXRMF.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\windows\XYXRMF.exeC:\windows\XYXRMF.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HWCLBO.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:688 -
C:\windows\SysWOW64\HWCLBO.exeC:\windows\system32\HWCLBO.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LMR.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\windows\system\LMR.exeC:\windows\system\LMR.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5684 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RHIMKB.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\windows\RHIMKB.exeC:\windows\RHIMKB.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GCAY.exe.bat" "44⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\windows\SysWOW64\GCAY.exeC:\windows\system32\GCAY.exe45⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WSBQC.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\windows\WSBQC.exeC:\windows\WSBQC.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LNK.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\windows\LNK.exeC:\windows\LNK.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UNMH.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:5256 -
C:\windows\system\UNMH.exeC:\windows\system\UNMH.exe51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YDTH.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:5980 -
C:\windows\YDTH.exeC:\windows\YDTH.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QEVMO.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\windows\SysWOW64\QEVMO.exeC:\windows\system32\QEVMO.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BWQFXG.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\windows\BWQFXG.exeC:\windows\BWQFXG.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZUJIK.exe.bat" "58⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\windows\SysWOW64\ZUJIK.exeC:\windows\system32\ZUJIK.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HKK.exe.bat" "60⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\windows\system\HKK.exeC:\windows\system\HKK.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YKMN.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\windows\SysWOW64\YKMN.exeC:\windows\system32\YKMN.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5316 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CASNGXT.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\windows\CASNGXT.exeC:\windows\CASNGXT.exe65⤵
- Executes dropped EXE
PID:5032 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RVCRR.exe.bat" "66⤵
- System Location Discovery: System Language Discovery
PID:1916 -
C:\windows\system\RVCRR.exeC:\windows\system\RVCRR.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QGNH.exe.bat" "68⤵
- System Location Discovery: System Language Discovery
PID:2296 -
C:\windows\QGNH.exeC:\windows\QGNH.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JJQLFO.exe.bat" "70⤵PID:5604
-
C:\windows\SysWOW64\JJQLFO.exeC:\windows\system32\JJQLFO.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\URX.exe.bat" "72⤵PID:4144
-
C:\windows\system\URX.exeC:\windows\system\URX.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TKABAMJ.exe.bat" "74⤵PID:4476
-
C:\windows\SysWOW64\TKABAMJ.exeC:\windows\system32\TKABAMJ.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XSHB.exe.bat" "76⤵PID:608
-
C:\windows\SysWOW64\XSHB.exeC:\windows\system32\XSHB.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3224 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VNGJRZN.exe.bat" "78⤵PID:5048
-
C:\windows\SysWOW64\VNGJRZN.exeC:\windows\system32\VNGJRZN.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ATYZHC.exe.bat" "80⤵PID:1088
-
C:\windows\SysWOW64\ATYZHC.exeC:\windows\system32\ATYZHC.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PJZQ.exe.bat" "82⤵
- System Location Discovery: System Language Discovery
PID:4816 -
C:\windows\PJZQ.exeC:\windows\PJZQ.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3648 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TRGYSI.exe.bat" "84⤵
- System Location Discovery: System Language Discovery
PID:3280 -
C:\windows\TRGYSI.exeC:\windows\TRGYSI.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4164 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CZIDV.exe.bat" "86⤵
- System Location Discovery: System Language Discovery
PID:5824 -
C:\windows\CZIDV.exeC:\windows\CZIDV.exe87⤵
- Executes dropped EXE
PID:2784 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SURIOA.exe.bat" "88⤵PID:2088
-
C:\windows\SURIOA.exeC:\windows\SURIOA.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DNUAPIL.exe.bat" "90⤵
- System Location Discovery: System Language Discovery
PID:3944 -
C:\windows\system\DNUAPIL.exeC:\windows\system\DNUAPIL.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DQYWCY.exe.bat" "92⤵PID:5116
-
C:\windows\system\DQYWCY.exeC:\windows\system\DQYWCY.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FOD.exe.bat" "94⤵
- System Location Discovery: System Language Discovery
PID:1856 -
C:\windows\system\FOD.exeC:\windows\system\FOD.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XOFWNM.exe.bat" "96⤵
- System Location Discovery: System Language Discovery
PID:2236 -
C:\windows\system\XOFWNM.exeC:\windows\system\XOFWNM.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BEME.exe.bat" "98⤵PID:5216
-
C:\windows\SysWOW64\BEME.exeC:\windows\system32\BEME.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1028 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VRRNJW.exe.bat" "100⤵PID:1636
-
C:\windows\VRRNJW.exeC:\windows\VRRNJW.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FPF.exe.bat" "102⤵PID:2548
-
C:\windows\FPF.exeC:\windows\FPF.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DPMVI.exe.bat" "104⤵
- System Location Discovery: System Language Discovery
PID:2344 -
C:\windows\SysWOW64\DPMVI.exeC:\windows\system32\DPMVI.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UQGALEU.exe.bat" "106⤵PID:1536
-
C:\windows\system\UQGALEU.exeC:\windows\system\UQGALEU.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TBRQUS.exe.bat" "108⤵
- System Location Discovery: System Language Discovery
PID:1100 -
C:\windows\SysWOW64\TBRQUS.exeC:\windows\system32\TBRQUS.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1680 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OWW.exe.bat" "110⤵PID:3052
-
C:\windows\SysWOW64\OWW.exeC:\windows\system32\OWW.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UWDNN.exe.bat" "112⤵PID:5792
-
C:\windows\SysWOW64\UWDNN.exeC:\windows\system32\UWDNN.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YEKNSEC.exe.bat" "114⤵PID:5464
-
C:\windows\system\YEKNSEC.exeC:\windows\system\YEKNSEC.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SSPF.exe.bat" "116⤵PID:1564
-
C:\windows\SysWOW64\SSPF.exeC:\windows\system32\SSPF.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WDNSCXT.exe.bat" "118⤵
- System Location Discovery: System Language Discovery
PID:5892 -
C:\windows\WDNSCXT.exeC:\windows\WDNSCXT.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CDVF.exe.bat" "120⤵PID:5396
-
C:\windows\system\CDVF.exeC:\windows\system\CDVF.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5540
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-