Analysis
- max time kernel
81s - max time network
123s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/07/2026, 02:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-06_86d4d08b914916ac1af32f5b9c320ed0_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-06_86d4d08b914916ac1af32f5b9c320ed0_elex_emotet_stop.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 2026-07-06_86d4d08b914916ac1af32f5b9c320ed0_elex_emotet_stop.exe
- Size 384KB
- Sample260707-c1fabsf18w
- SHA256 0e7cd357ecde95e577641768ebfadbb18e020ccd7f9a51d44d69cc5c701e6423
- MD5 86d4d08b914916ac1af32f5b9c320ed0
- SHA1 4be3082853444544e504b37be420f62fde08062a
- SHA512 12401891b32b4fa05c48efa0c75cf5397b7a43ac733a283a3ec7e6debc7101eaeeb1f686f57dd04c743ae6dc3dc2a8ce4b5b8ebd8aea403e146a7f6f0ea87941
- SSDEEP 6144:TlZtbLWIgd1LZ9oECZbxlUS+LOTkEjiPISUOgW9X+hOGzC/NM:RLWI09QZb6LOTkmZzcukG2/
- TLSH T1E8848E167AC58333D1A302715CEB86A4773ABCA1A7B687872798720D6773BB44737390
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5752 GWUU.exe 2476 ZPDLR.exe 4596 XHGBAZR.exe 5908 YXNK.exe 2456 IVB.exe 3424 DQGOU.exe 2156 SLP.exe 6084 YZOTJI.exe 2420 CPV.exe 4324 RKFGPN.exe 5264 PFEGLQH.exe 5488 NVRY.exe 2924 LGU.exe 5872 DOI.exe 3724 QZRKDE.exe 992 HZTPOCL.exe 1940 JXGJWKU.exe 3132 TVMEDT.exe 2140 VTSY.exe 2124 UDC.exe 5484 UGGKH.exe 5560 WEME.exe 3024 VPX.exe 3832 ZFDUJM.exe 1320 AAH.exe 2096 SDLTUR.exe 2424 IYUY.exe 764 KGDUU.exe 472 DJHYZWT.exe 4840 NHNLHFU.exe 4716 MSXB.exe 3168 FLFL.exe 2448 JBLULE.exe 2084 ILWCU.exe 5568 AOAF.exe 5452 WZJENKN.exe 4092 ACHRV.exe 4140 NFX.exe 1052 KGZSNKT.exe 5004 ZBQEY.exe 1936 YTTM.exe 3956 NJUMOZF.exe 2744 PHAGVHO.exe 1092 ZXNA.exe 4824 MIWRRAS.exe 4500 UNWFA.exe 488 PJNPMZ.exe 5740 XOFWNM.exe 1044 KZWU.exe 3976 KEOJD.exe 1740 FSTSNBK.exe 4456 WFDKD.exe 4560 QSITNYM.exe 3048 AQOO.exe 2216 ETMJUZG.exe 2600 SECAJ.exe 5904 WUJI.exe 4148 NULNYA.exe 2724 NNUOME.exe 2804 HAY.exe 2648 ZASD.exe 264 RDE.exe 4852 SHICT.exe 1744 UEOW.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\JXGJWKU.exe HZTPOCL.exe File created C:\windows\SysWOW64\KGZSNKT.exe NFX.exe File opened for modification C:\windows\SysWOW64\CMAE.exe TEY.exe File created C:\windows\SysWOW64\MAOGO.exe VPYJH.exe File opened for modification C:\windows\SysWOW64\RFCX.exe FMZ.exe File created C:\windows\SysWOW64\NHNLHFU.exe DJHYZWT.exe File created C:\windows\SysWOW64\KZWU.exe.bat XOFWNM.exe File opened for modification C:\windows\SysWOW64\FSTSNBK.exe KEOJD.exe File created C:\windows\SysWOW64\VPYJH.exe GUGE.exe File created C:\windows\SysWOW64\KOGQB.exe EOZCSDT.exe File created C:\windows\SysWOW64\NKT.exe.bat JEJU.exe File created C:\windows\SysWOW64\YOM.exe.bat STNVI.exe File opened for modification C:\windows\SysWOW64\YXNK.exe XHGBAZR.exe File opened for modification C:\windows\SysWOW64\DJHYZWT.exe KGDUU.exe File opened for modification C:\windows\SysWOW64\WEUA.exe UGHF.exe File created C:\windows\SysWOW64\CMAE.exe TEY.exe File created C:\windows\SysWOW64\NKT.exe JEJU.exe File created C:\windows\SysWOW64\YZOTJI.exe SLP.exe File opened for modification C:\windows\SysWOW64\YZOTJI.exe SLP.exe File created C:\windows\SysWOW64\ETMJUZG.exe AQOO.exe File created C:\windows\SysWOW64\ETMJUZG.exe.bat AQOO.exe File created C:\windows\SysWOW64\WEUA.exe UGHF.exe File created C:\windows\SysWOW64\VCKNR.exe.bat PCCZIJP.exe File created C:\windows\SysWOW64\NDQDXY.exe BLVTP.exe File opened for modification C:\windows\SysWOW64\NDQDXY.exe BLVTP.exe File created C:\windows\SysWOW64\YXNK.exe.bat XHGBAZR.exe File opened for modification C:\windows\SysWOW64\LGU.exe NVRY.exe File created C:\windows\SysWOW64\VTSY.exe TVMEDT.exe File created C:\windows\SysWOW64\AAH.exe.bat ZFDUJM.exe File opened for modification C:\windows\SysWOW64\NHNLHFU.exe DJHYZWT.exe File created C:\windows\SysWOW64\CMAE.exe.bat TEY.exe File created C:\windows\SysWOW64\MAOGO.exe.bat VPYJH.exe File created C:\windows\SysWOW64\YNROJ.exe.bat WQDUTS.exe File created C:\windows\SysWOW64\LGU.exe.bat NVRY.exe File opened for modification C:\windows\SysWOW64\AOAF.exe ILWCU.exe File opened for modification C:\windows\SysWOW64\ETMJUZG.exe AQOO.exe File created C:\windows\SysWOW64\YNROJ.exe WQDUTS.exe File created C:\windows\SysWOW64\JEJU.exe.bat TOIVEC.exe File created C:\windows\SysWOW64\STNVI.exe.bat EIEWUIZ.exe File created C:\windows\SysWOW64\YOM.exe STNVI.exe File created C:\windows\SysWOW64\RFCX.exe FMZ.exe File opened for modification C:\windows\SysWOW64\VTSY.exe TVMEDT.exe File created C:\windows\SysWOW64\NHNLHFU.exe.bat DJHYZWT.exe File opened for modification C:\windows\SysWOW64\YNROJ.exe WQDUTS.exe File opened for modification C:\windows\SysWOW64\STNVI.exe EIEWUIZ.exe File created C:\windows\SysWOW64\RFCX.exe.bat FMZ.exe File created C:\windows\SysWOW64\SDLTUR.exe AAH.exe File created C:\windows\SysWOW64\AOAF.exe ILWCU.exe File opened for modification C:\windows\SysWOW64\VCKNR.exe PCCZIJP.exe File created C:\windows\SysWOW64\KOGQB.exe.bat EOZCSDT.exe File created C:\windows\SysWOW64\JXGJWKU.exe.bat HZTPOCL.exe File opened for modification C:\windows\SysWOW64\AAH.exe ZFDUJM.exe File opened for modification C:\windows\SysWOW64\SDLTUR.exe AAH.exe File created C:\windows\SysWOW64\FLFL.exe MSXB.exe File created C:\windows\SysWOW64\FLFL.exe.bat MSXB.exe File created C:\windows\SysWOW64\NFX.exe.bat ACHRV.exe File created C:\windows\SysWOW64\JXGJWKU.exe HZTPOCL.exe File opened for modification C:\windows\SysWOW64\FLFL.exe MSXB.exe File created C:\windows\SysWOW64\KZWU.exe XOFWNM.exe File created C:\windows\SysWOW64\FSTSNBK.exe KEOJD.exe File opened for modification C:\windows\SysWOW64\HAY.exe NNUOME.exe File created C:\windows\SysWOW64\VPYJH.exe.bat GUGE.exe File opened for modification C:\windows\SysWOW64\KOGQB.exe EOZCSDT.exe File opened for modification C:\windows\SysWOW64\YOM.exe STNVI.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\UNWFA.exe.bat MIWRRAS.exe File created C:\windows\system\KEOJD.exe KZWU.exe File opened for modification C:\windows\WUJI.exe SECAJ.exe File opened for modification C:\windows\ZPDLR.exe GWUU.exe File created C:\windows\SLP.exe.bat DQGOU.exe File created C:\windows\system\NJUMOZF.exe.bat YTTM.exe File created C:\windows\NULNYA.exe.bat WUJI.exe File created C:\windows\system\UGHF.exe.bat ZSCWXVP.exe File created C:\windows\system\GUGE.exe CMAE.exe File created C:\windows\system\CUZL.exe BZVHECS.exe File created C:\windows\RKFGPN.exe.bat CPV.exe File created C:\windows\system\UGGKH.exe.bat UDC.exe File created C:\windows\UEOW.exe.bat SHICT.exe File created C:\windows\TSCIO.exe.bat NXDH.exe File created C:\windows\system\GUGE.exe.bat CMAE.exe File created C:\windows\EOZCSDT.exe.bat YNROJ.exe File opened for modification C:\windows\GWUU.exe 2026-07-06_86d4d08b914916ac1af32f5b9c320ed0_elex_emotet_stop.exe File opened for modification C:\windows\PHAGVHO.exe NJUMOZF.exe File created C:\windows\system\NNUOME.exe NULNYA.exe File opened for modification C:\windows\LUVZW.exe WEUA.exe File created C:\windows\BMDSCP.exe.bat YZLRRE.exe File created C:\windows\BZVHECS.exe.bat BMDSCP.exe File created C:\windows\system\NJUMOZF.exe YTTM.exe File created C:\windows\SECAJ.exe ETMJUZG.exe File created C:\windows\NXDH.exe.bat UEOW.exe File created C:\windows\TSCIO.exe NXDH.exe File created C:\windows\system\CUZL.exe.bat BZVHECS.exe File created C:\windows\system\CPZZI.exe.bat NKT.exe File created C:\windows\system\HZTPOCL.exe.bat QZRKDE.exe File created C:\windows\system\UGGKH.exe UDC.exe File created C:\windows\system\JBLULE.exe FLFL.exe File created C:\windows\YTTM.exe.bat ZBQEY.exe File opened for modification C:\windows\system\NJUMOZF.exe YTTM.exe File created C:\windows\ZXNA.exe PHAGVHO.exe File created C:\windows\system\KEOJD.exe.bat KZWU.exe File created C:\windows\system\QSITNYM.exe WFDKD.exe File created C:\windows\GWUU.exe.bat 2026-07-06_86d4d08b914916ac1af32f5b9c320ed0_elex_emotet_stop.exe File opened for modification C:\windows\DQGOU.exe IVB.exe File opened for modification C:\windows\system\QSITNYM.exe WFDKD.exe File opened for modification C:\windows\system\NNUOME.exe NULNYA.exe File created C:\windows\KKT.exe QPOWBM.exe File created C:\windows\KKT.exe.bat QPOWBM.exe File created C:\windows\system\CPV.exe.bat YZOTJI.exe File created C:\windows\system\MSXB.exe.bat NHNLHFU.exe File created C:\windows\PHAGVHO.exe NJUMOZF.exe File created C:\windows\system\AQOO.exe.bat QSITNYM.exe File created C:\windows\WUJI.exe.bat SECAJ.exe File created C:\windows\system\WQDUTS.exe CUZL.exe File created C:\windows\system\ACHRV.exe.bat WZJENKN.exe File created C:\windows\system\BLVTP.exe KKT.exe File created C:\windows\system\TOIVEC.exe.bat KOGQB.exe File created C:\windows\XHGBAZR.exe.bat ZPDLR.exe File opened for modification C:\windows\WFDKD.exe FSTSNBK.exe File created C:\windows\system\SHICT.exe.bat RDE.exe File opened for modification C:\windows\TSCIO.exe NXDH.exe File created C:\windows\XHGBAZR.exe ZPDLR.exe File opened for modification C:\windows\system\TVMEDT.exe JXGJWKU.exe File opened for modification C:\windows\system\UNWFA.exe MIWRRAS.exe File created C:\windows\system\HZTPOCL.exe QZRKDE.exe File opened for modification C:\windows\system\HZTPOCL.exe QZRKDE.exe File opened for modification C:\windows\IYUY.exe SDLTUR.exe File created C:\windows\PHAGVHO.exe.bat NJUMOZF.exe File created C:\windows\system\PJNPMZ.exe.bat UNWFA.exe File created C:\windows\NULNYA.exe WUJI.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 64 IoCs
pid pid_target Process procid_target 988 5128 WerFault.exe 86 5476 5752 WerFault.exe 91 5504 2476 WerFault.exe 97 6052 4596 WerFault.exe 102 1900 5908 WerFault.exe 107 1604 2456 WerFault.exe 112 4976 3424 WerFault.exe 117 1140 2156 WerFault.exe 122 2792 6084 WerFault.exe 127 2388 2420 WerFault.exe 132 2520 4324 WerFault.exe 137 3136 5264 WerFault.exe 142 476 5488 WerFault.exe 147 3680 2924 WerFault.exe 152 2868 5872 WerFault.exe 157 1324 3724 WerFault.exe 162 2176 992 WerFault.exe 167 2596 1940 WerFault.exe 172 4396 3132 WerFault.exe 177 2448 2140 WerFault.exe 182 1064 2124 WerFault.exe 187 1928 5484 WerFault.exe 192 5460 5560 WerFault.exe 197 1876 3024 WerFault.exe 202 4696 3832 WerFault.exe 207 3872 1320 WerFault.exe 212 3272 2096 WerFault.exe 217 3976 2424 WerFault.exe 222 1324 764 WerFault.exe 227 3052 472 WerFault.exe 232 5912 4840 WerFault.exe 237 3268 4716 WerFault.exe 242 2568 3168 WerFault.exe 246 5968 2448 WerFault.exe 252 5716 2084 WerFault.exe 257 3560 5568 WerFault.exe 262 2036 5452 WerFault.exe 267 5064 4092 WerFault.exe 272 2724 4140 WerFault.exe 277 5476 1052 WerFault.exe 281 2648 5004 WerFault.exe 287 2464 1936 WerFault.exe 292 4588 3956 WerFault.exe 297 2680 2744 WerFault.exe 302 6004 1092 WerFault.exe 307 3228 4824 WerFault.exe 312 2940 4500 WerFault.exe 317 5964 488 WerFault.exe 322 2008 5740 WerFault.exe 327 5172 1044 WerFault.exe 332 6020 3976 WerFault.exe 337 1564 1740 WerFault.exe 342 3120 4456 WerFault.exe 347 1744 4560 WerFault.exe 352 5968 3048 WerFault.exe 357 4392 2216 WerFault.exe 362 1552 2600 WerFault.exe 367 1248 5904 WerFault.exe 372 5696 4148 WerFault.exe 377 5140 2724 WerFault.exe 382 2704 2804 WerFault.exe 387 5220 2648 WerFault.exe 392 5240 264 WerFault.exe 397 5224 4852 WerFault.exe 402 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VPYJH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XOFWNM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QSITNYM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NFX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GUGE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MAOGO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JBLULE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PCCZIJP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WQDUTS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EDEISV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NULNYA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EOZCSDT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TOIVEC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YOM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CWTEZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RDE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BDY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KOGQB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KGDUU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FSTSNBK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SLP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YZOTJI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NHNLHFU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZXNA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language STNVI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VCKNR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SDLTUR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WZJENKN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WEUA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LUVZW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TEY.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5128 2026-07-06_86d4d08b914916ac1af32f5b9c320ed0_elex_emotet_stop.exe 5128 2026-07-06_86d4d08b914916ac1af32f5b9c320ed0_elex_emotet_stop.exe 5752 GWUU.exe 5752 GWUU.exe 2476 ZPDLR.exe 2476 ZPDLR.exe 4596 XHGBAZR.exe 4596 XHGBAZR.exe 5908 YXNK.exe 5908 YXNK.exe 2456 IVB.exe 2456 IVB.exe 3424 DQGOU.exe 3424 DQGOU.exe 2156 SLP.exe 2156 SLP.exe 6084 YZOTJI.exe 6084 YZOTJI.exe 2420 CPV.exe 2420 CPV.exe 4324 RKFGPN.exe 4324 RKFGPN.exe 5264 PFEGLQH.exe 5264 PFEGLQH.exe 5488 NVRY.exe 5488 NVRY.exe 2924 LGU.exe 2924 LGU.exe 5872 DOI.exe 5872 DOI.exe 3724 QZRKDE.exe 3724 QZRKDE.exe 992 HZTPOCL.exe 992 HZTPOCL.exe 1940 JXGJWKU.exe 1940 JXGJWKU.exe 3132 TVMEDT.exe 3132 TVMEDT.exe 2140 VTSY.exe 2140 VTSY.exe 2124 UDC.exe 2124 UDC.exe 5484 UGGKH.exe 5484 UGGKH.exe 5560 WEME.exe 5560 WEME.exe 3024 VPX.exe 3024 VPX.exe 3832 ZFDUJM.exe 3832 ZFDUJM.exe 1320 AAH.exe 1320 AAH.exe 2096 SDLTUR.exe 2096 SDLTUR.exe 2424 IYUY.exe 2424 IYUY.exe 764 KGDUU.exe 764 KGDUU.exe 472 DJHYZWT.exe 472 DJHYZWT.exe 4840 NHNLHFU.exe 4840 NHNLHFU.exe 4716 MSXB.exe 4716 MSXB.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 5128 2026-07-06_86d4d08b914916ac1af32f5b9c320ed0_elex_emotet_stop.exe 5128 2026-07-06_86d4d08b914916ac1af32f5b9c320ed0_elex_emotet_stop.exe 5752 GWUU.exe 5752 GWUU.exe 2476 ZPDLR.exe 2476 ZPDLR.exe 4596 XHGBAZR.exe 4596 XHGBAZR.exe 5908 YXNK.exe 5908 YXNK.exe 2456 IVB.exe 2456 IVB.exe 3424 DQGOU.exe 3424 DQGOU.exe 2156 SLP.exe 2156 SLP.exe 6084 YZOTJI.exe 6084 YZOTJI.exe 2420 CPV.exe 2420 CPV.exe 4324 RKFGPN.exe 4324 RKFGPN.exe 5264 PFEGLQH.exe 5264 PFEGLQH.exe 5488 NVRY.exe 5488 NVRY.exe 2924 LGU.exe 2924 LGU.exe 5872 DOI.exe 5872 DOI.exe 3724 QZRKDE.exe 3724 QZRKDE.exe 992 HZTPOCL.exe 992 HZTPOCL.exe 1940 JXGJWKU.exe 1940 JXGJWKU.exe 3132 TVMEDT.exe 3132 TVMEDT.exe 2140 VTSY.exe 2140 VTSY.exe 2124 UDC.exe 2124 UDC.exe 5484 UGGKH.exe 5484 UGGKH.exe 5560 WEME.exe 5560 WEME.exe 3024 VPX.exe 3024 VPX.exe 3832 ZFDUJM.exe 3832 ZFDUJM.exe 1320 AAH.exe 1320 AAH.exe 2096 SDLTUR.exe 2096 SDLTUR.exe 2424 IYUY.exe 2424 IYUY.exe 764 KGDUU.exe 764 KGDUU.exe 472 DJHYZWT.exe 472 DJHYZWT.exe 4840 NHNLHFU.exe 4840 NHNLHFU.exe 4716 MSXB.exe 4716 MSXB.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5128 wrote to memory of 3704 5128 2026-07-06_86d4d08b914916ac1af32f5b9c320ed0_elex_emotet_stop.exe 87 PID 3704 wrote to memory of 5752 3704 cmd.exe 91 PID 5752 wrote to memory of 2228 5752 GWUU.exe 93 PID 2228 wrote to memory of 2476 2228 cmd.exe 97 PID 2476 wrote to memory of 5012 2476 ZPDLR.exe 98 PID 5012 wrote to memory of 4596 5012 cmd.exe 102 PID 4596 wrote to memory of 4676 4596 XHGBAZR.exe 103 PID 4676 wrote to memory of 5908 4676 cmd.exe 107 PID 5908 wrote to memory of 2808 5908 YXNK.exe 108 PID 2808 wrote to memory of 2456 2808 cmd.exe 112 PID 2456 wrote to memory of 3484 2456 IVB.exe 113 PID 3484 wrote to memory of 3424 3484 cmd.exe 117 PID 3424 wrote to memory of 1272 3424 DQGOU.exe 118 PID 1272 wrote to memory of 2156 1272 cmd.exe 122 PID 2156 wrote to memory of 4356 2156 SLP.exe 123 PID 4356 wrote to memory of 6084 4356 cmd.exe 127 PID 6084 wrote to memory of 5372 6084 YZOTJI.exe 128 PID 5372 wrote to memory of 2420 5372 cmd.exe 132 PID 2420 wrote to memory of 3420 2420 CPV.exe 133 PID 3420 wrote to memory of 4324 3420 cmd.exe 137 PID 4324 wrote to memory of 1428 4324 RKFGPN.exe 138 PID 1428 wrote to memory of 5264 1428 cmd.exe 142 PID 5264 wrote to memory of 3552 5264 PFEGLQH.exe 143 PID 3552 wrote to memory of 5488 3552 cmd.exe 147 PID 5488 wrote to memory of 4172 5488 NVRY.exe 148 PID 4172 wrote to memory of 2924 4172 cmd.exe 152 PID 2924 wrote to memory of 5972 2924 LGU.exe 153 PID 5972 wrote to memory of 5872 5972 cmd.exe 157 PID 5872 wrote to memory of 852 5872 DOI.exe 158 PID 852 wrote to memory of 3724 852 cmd.exe 162 PID 3724 wrote to memory of 5680 3724 QZRKDE.exe 163 PID 5680 wrote to memory of 992 5680 cmd.exe 167 PID 992 wrote to memory of 1404 992 HZTPOCL.exe 168 PID 1404 wrote to memory of 1940 1404 cmd.exe 172 PID 1940 wrote to memory of 700 1940 JXGJWKU.exe 173 PID 700 wrote to memory of 3132 700 cmd.exe 177 PID 3132 wrote to memory of 5360 3132 TVMEDT.exe 178 PID 5360 wrote to memory of 2140 5360 cmd.exe 182 PID 2140 wrote to memory of 4448 2140 VTSY.exe 183 PID 4448 wrote to memory of 2124 4448 cmd.exe 187 PID 2124 wrote to memory of 3844 2124 UDC.exe 188 PID 3844 wrote to memory of 5484 3844 cmd.exe 192 PID 5484 wrote to memory of 2332 5484 UGGKH.exe 193 PID 2332 wrote to memory of 5560 2332 cmd.exe 197 PID 5560 wrote to memory of 820 5560 WEME.exe 198 PID 820 wrote to memory of 3024 820 cmd.exe 202 PID 3024 wrote to memory of 5472 3024 VPX.exe 203 PID 5472 wrote to memory of 3832 5472 cmd.exe 207 PID 3832 wrote to memory of 3136 3832 ZFDUJM.exe 208 PID 3136 wrote to memory of 1320 3136 cmd.exe 212 PID 1320 wrote to memory of 1808 1320 AAH.exe 213 PID 1808 wrote to memory of 2096 1808 cmd.exe 217 PID 2096 wrote to memory of 3264 2096 SDLTUR.exe 218 PID 3264 wrote to memory of 2424 3264 cmd.exe 222 PID 2424 wrote to memory of 2868 2424 IYUY.exe 223 PID 2868 wrote to memory of 764 2868 cmd.exe 227 PID 764 wrote to memory of 4980 764 KGDUU.exe 228 PID 4980 wrote to memory of 472 4980 cmd.exe 232 PID 472 wrote to memory of 1212 472 DJHYZWT.exe 233 PID 1212 wrote to memory of 4840 1212 cmd.exe 237 PID 4840 wrote to memory of 2768 4840 NHNLHFU.exe 238 PID 2768 wrote to memory of 4716 2768 cmd.exe 242 PID 4716 wrote to memory of 2012 4716 MSXB.exe 243 PID 2012 wrote to memory of 3168 2012 cmd.exe 246
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_86d4d08b914916ac1af32f5b9c320ed0_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-06_86d4d08b914916ac1af32f5b9c320ed0_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GWUU.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\windows\GWUU.exeC:\windows\GWUU.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZPDLR.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\windows\ZPDLR.exeC:\windows\ZPDLR.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XHGBAZR.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\windows\XHGBAZR.exeC:\windows\XHGBAZR.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YXNK.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\windows\SysWOW64\YXNK.exeC:\windows\system32\YXNK.exe9⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IVB.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\windows\IVB.exeC:\windows\IVB.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DQGOU.exe.bat" "12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\windows\DQGOU.exeC:\windows\DQGOU.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SLP.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\windows\SLP.exeC:\windows\SLP.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YZOTJI.exe.bat" "16⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\windows\SysWOW64\YZOTJI.exeC:\windows\system32\YZOTJI.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CPV.exe.bat" "18⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5372 -
C:\windows\system\CPV.exeC:\windows\system\CPV.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RKFGPN.exe.bat" "20⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\windows\RKFGPN.exeC:\windows\RKFGPN.exe21⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PFEGLQH.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\windows\PFEGLQH.exeC:\windows\PFEGLQH.exe23⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NVRY.exe.bat" "24⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\windows\SysWOW64\NVRY.exeC:\windows\system32\NVRY.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LGU.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\windows\SysWOW64\LGU.exeC:\windows\system32\LGU.exe27⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DOI.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:5972 -
C:\windows\DOI.exeC:\windows\DOI.exe29⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QZRKDE.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:852 -
C:\windows\system\QZRKDE.exeC:\windows\system\QZRKDE.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HZTPOCL.exe.bat" "32⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5680 -
C:\windows\system\HZTPOCL.exeC:\windows\system\HZTPOCL.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JXGJWKU.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\windows\SysWOW64\JXGJWKU.exeC:\windows\system32\JXGJWKU.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TVMEDT.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:700 -
C:\windows\system\TVMEDT.exeC:\windows\system\TVMEDT.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VTSY.exe.bat" "38⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5360 -
C:\windows\SysWOW64\VTSY.exeC:\windows\system32\VTSY.exe39⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UDC.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\windows\UDC.exeC:\windows\UDC.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UGGKH.exe.bat" "42⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\windows\system\UGGKH.exeC:\windows\system\UGGKH.exe43⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5484 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WEME.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\windows\WEME.exeC:\windows\WEME.exe45⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VPX.exe.bat" "46⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:820 -
C:\windows\SysWOW64\VPX.exeC:\windows\system32\VPX.exe47⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZFDUJM.exe.bat" "48⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5472 -
C:\windows\ZFDUJM.exeC:\windows\ZFDUJM.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AAH.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\windows\SysWOW64\AAH.exeC:\windows\system32\AAH.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SDLTUR.exe.bat" "52⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\windows\SysWOW64\SDLTUR.exeC:\windows\system32\SDLTUR.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IYUY.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\windows\IYUY.exeC:\windows\IYUY.exe55⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KGDUU.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\windows\KGDUU.exeC:\windows\KGDUU.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DJHYZWT.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\windows\SysWOW64\DJHYZWT.exeC:\windows\system32\DJHYZWT.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NHNLHFU.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\windows\SysWOW64\NHNLHFU.exeC:\windows\system32\NHNLHFU.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MSXB.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\windows\system\MSXB.exeC:\windows\system\MSXB.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FLFL.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\windows\SysWOW64\FLFL.exeC:\windows\system32\FLFL.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3168 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JBLULE.exe.bat" "66⤵PID:2204
-
C:\windows\system\JBLULE.exeC:\windows\system\JBLULE.exe67⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ILWCU.exe.bat" "68⤵PID:3868
-
C:\windows\ILWCU.exeC:\windows\ILWCU.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AOAF.exe.bat" "70⤵PID:5356
-
C:\windows\SysWOW64\AOAF.exeC:\windows\system32\AOAF.exe71⤵
- Executes dropped EXE
PID:5568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WZJENKN.exe.bat" "72⤵PID:4816
-
C:\windows\system\WZJENKN.exeC:\windows\system\WZJENKN.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ACHRV.exe.bat" "74⤵PID:2844
-
C:\windows\system\ACHRV.exeC:\windows\system\ACHRV.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NFX.exe.bat" "76⤵PID:632
-
C:\windows\SysWOW64\NFX.exeC:\windows\system32\NFX.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KGZSNKT.exe.bat" "78⤵
- System Location Discovery: System Language Discovery
PID:5184 -
C:\windows\SysWOW64\KGZSNKT.exeC:\windows\system32\KGZSNKT.exe79⤵
- Executes dropped EXE
PID:1052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZBQEY.exe.bat" "80⤵
- System Location Discovery: System Language Discovery
PID:1384 -
C:\windows\system\ZBQEY.exeC:\windows\system\ZBQEY.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YTTM.exe.bat" "82⤵
- System Location Discovery: System Language Discovery
PID:1292 -
C:\windows\YTTM.exeC:\windows\YTTM.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NJUMOZF.exe.bat" "84⤵PID:1864
-
C:\windows\system\NJUMOZF.exeC:\windows\system\NJUMOZF.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PHAGVHO.exe.bat" "86⤵PID:5412
-
C:\windows\PHAGVHO.exeC:\windows\PHAGVHO.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2744 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZXNA.exe.bat" "88⤵PID:1752
-
C:\windows\ZXNA.exeC:\windows\ZXNA.exe89⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MIWRRAS.exe.bat" "90⤵
- System Location Discovery: System Language Discovery
PID:4252 -
C:\windows\system\MIWRRAS.exeC:\windows\system\MIWRRAS.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UNWFA.exe.bat" "92⤵PID:3044
-
C:\windows\system\UNWFA.exeC:\windows\system\UNWFA.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PJNPMZ.exe.bat" "94⤵PID:5468
-
C:\windows\system\PJNPMZ.exeC:\windows\system\PJNPMZ.exe95⤵
- Executes dropped EXE
PID:488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XOFWNM.exe.bat" "96⤵PID:6008
-
C:\windows\system\XOFWNM.exeC:\windows\system\XOFWNM.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KZWU.exe.bat" "98⤵PID:2908
-
C:\windows\SysWOW64\KZWU.exeC:\windows\system32\KZWU.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KEOJD.exe.bat" "100⤵PID:3380
-
C:\windows\system\KEOJD.exeC:\windows\system\KEOJD.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FSTSNBK.exe.bat" "102⤵
- System Location Discovery: System Language Discovery
PID:364 -
C:\windows\SysWOW64\FSTSNBK.exeC:\windows\system32\FSTSNBK.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WFDKD.exe.bat" "104⤵PID:3428
-
C:\windows\WFDKD.exeC:\windows\WFDKD.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QSITNYM.exe.bat" "106⤵PID:5916
-
C:\windows\system\QSITNYM.exeC:\windows\system\QSITNYM.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AQOO.exe.bat" "108⤵
- System Location Discovery: System Language Discovery
PID:1644 -
C:\windows\system\AQOO.exeC:\windows\system\AQOO.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3048 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ETMJUZG.exe.bat" "110⤵
- System Location Discovery: System Language Discovery
PID:1660 -
C:\windows\SysWOW64\ETMJUZG.exeC:\windows\system32\ETMJUZG.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2216 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SECAJ.exe.bat" "112⤵
- System Location Discovery: System Language Discovery
PID:5724 -
C:\windows\SECAJ.exeC:\windows\SECAJ.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WUJI.exe.bat" "114⤵PID:4688
-
C:\windows\WUJI.exeC:\windows\WUJI.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NULNYA.exe.bat" "116⤵PID:464
-
C:\windows\NULNYA.exeC:\windows\NULNYA.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4148 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NNUOME.exe.bat" "118⤵
- System Location Discovery: System Language Discovery
PID:2024 -
C:\windows\system\NNUOME.exeC:\windows\system\NNUOME.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HAY.exe.bat" "120⤵PID:5500
-
C:\windows\SysWOW64\HAY.exeC:\windows\system32\HAY.exe121⤵
- Executes dropped EXE
PID:2804
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-