Analysis
- max time kernel
81s - max time network
121s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/07/2026, 14:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-09_caa2d2abe7de143bbdeb72025554e065_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-09_caa2d2abe7de143bbdeb72025554e065_elex_emotet_stop.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 2026-07-09_caa2d2abe7de143bbdeb72025554e065_elex_emotet_stop.exe
- Size 208KB
- Sample260709-rt7tbsb13m
- SHA256 642f332d2cdec51501549e4ba4be6f0f1ef0b0a1911d8819396ac59259879d34
- MD5 caa2d2abe7de143bbdeb72025554e065
- SHA1 410353abc664774cc622f76eb82dcab80a13a2e2
- SHA512 a6856cc9070d3c2164068ec3416fdf76629b3619edf4e0e17e38b9058fe993e9ae7f72c8563c3972aae85a2aa09f07379834601caab8607735b3a0772b4a8556
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbclcdL+LOfg4NLthEjQT6j:MlZtbLWIgd1LZ9oECZbclc5+LOIQEj1
- TLSH T171247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 6112 EBMKG.exe 1616 YPRSVH.exe 2296 OXAMD.exe 1100 SFHMPSC.exe 5204 HVIL.exe 2640 PJU.exe 1944 OZGV.exe 1728 DPHMS.exe 3512 WSKQ.exe 4608 UCV.exe 3504 EABTVR.exe 4328 UVKF.exe 6076 BLLWNZN.exe 5992 NBAE.exe 2888 URB.exe 788 PUJUUQ.exe 4508 RSPPB.exe 3320 BQC.exe 4864 HLCKO.exe 2856 VWK.exe 540 NROEH.exe 2724 JCEDV.exe 3224 YSFUCAH.exe 5576 LCOTQLC.exe 1248 KNRJRR.exe 2196 RDSAYNN.exe 2476 SGDELD.exe 1120 LZLPVE.exe 5668 NXYJ.exe 1840 HPGU.exe 5716 FAJ.exe 1872 PILP.exe 3736 KLBOUBH.exe 2200 BEEECH.exe 5348 MMK.exe 1376 FPOAUPT.exe 3556 JXDIY.exe 5972 YNE.exe 3732 VTC.exe 4392 KJDWTA.exe 2384 JYWRO.exe 5504 HUVZKJS.exe 4136 CEEQZ.exe 4524 GMK.exe 1624 VCLPRZ.exe 4528 DBGYIK.exe 2360 RWK.exe 5712 KZWU.exe 4056 SEBB.exe 6004 LHEFRL.exe 2668 CIGK.exe 4176 EGUEKRI.exe 2568 FJYAQG.exe 4380 STGY.exe 3528 AZGN.exe 3668 YXS.exe 4480 IXUV.exe 5940 IAX.exe 5352 WDOPXI.exe 3856 FLIU.exe 1968 PJVPQNA.exe 4672 EZWGP.exe 3552 IHD.exe 4752 VSMNQE.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\DPHMS.exe OZGV.exe File created C:\windows\SysWOW64\KJDWTA.exe VTC.exe File created C:\windows\SysWOW64\JYWRO.exe KJDWTA.exe File opened for modification C:\windows\SysWOW64\SEBB.exe KZWU.exe File created C:\windows\SysWOW64\PJVPQNA.exe FLIU.exe File created C:\windows\SysWOW64\QHIW.exe.bat ROFGS.exe File created C:\windows\SysWOW64\HUVZKJS.exe.bat JYWRO.exe File created C:\windows\SysWOW64\SEBB.exe.bat KZWU.exe File opened for modification C:\windows\SysWOW64\RSPPB.exe PUJUUQ.exe File opened for modification C:\windows\SysWOW64\PILP.exe FAJ.exe File created C:\windows\SysWOW64\VCLPRZ.exe.bat GMK.exe File created C:\windows\SysWOW64\BVR.exe MNIU.exe File created C:\windows\SysWOW64\DPHMS.exe OZGV.exe File created C:\windows\SysWOW64\KLBOUBH.exe PILP.exe File created C:\windows\SysWOW64\DMRRJN.exe.bat DJOV.exe File created C:\windows\SysWOW64\RSPPB.exe PUJUUQ.exe File opened for modification C:\windows\SysWOW64\MMK.exe BEEECH.exe File created C:\windows\SysWOW64\PJU.exe HVIL.exe File created C:\windows\SysWOW64\BQC.exe.bat RSPPB.exe File created C:\windows\SysWOW64\FLIU.exe WDOPXI.exe File created C:\windows\SysWOW64\FLIU.exe.bat WDOPXI.exe File created C:\windows\SysWOW64\HHCBHSF.exe SRTCAF.exe File created C:\windows\SysWOW64\UCV.exe.bat WSKQ.exe File created C:\windows\SysWOW64\VTC.exe.bat YNE.exe File opened for modification C:\windows\SysWOW64\HHCBHSF.exe SRTCAF.exe File opened for modification C:\windows\SysWOW64\QHIW.exe ROFGS.exe File created C:\windows\SysWOW64\LCOTQLC.exe YSFUCAH.exe File opened for modification C:\windows\SysWOW64\AZGN.exe STGY.exe File opened for modification C:\windows\SysWOW64\PJVPQNA.exe FLIU.exe File opened for modification C:\windows\SysWOW64\LCOTQLC.exe YSFUCAH.exe File created C:\windows\SysWOW64\PILP.exe FAJ.exe File created C:\windows\SysWOW64\VTC.exe YNE.exe File opened for modification C:\windows\SysWOW64\DBGYIK.exe QQQ.exe File created C:\windows\SysWOW64\QHIW.exe ROFGS.exe File created C:\windows\SysWOW64\SZLLN.exe.bat QBKJ.exe File created C:\windows\SysWOW64\UCV.exe WSKQ.exe File created C:\windows\SysWOW64\BLLWNZN.exe UVKF.exe File created C:\windows\SysWOW64\RSPPB.exe.bat PUJUUQ.exe File created C:\windows\SysWOW64\BVR.exe.bat MNIU.exe File created C:\windows\SysWOW64\RNJ.exe GZKZ.exe File opened for modification C:\windows\SysWOW64\QKVSRD.exe RNJ.exe File created C:\windows\SysWOW64\VWK.exe HLCKO.exe File opened for modification C:\windows\SysWOW64\KLBOUBH.exe PILP.exe File created C:\windows\SysWOW64\DBGYIK.exe.bat QQQ.exe File opened for modification C:\windows\SysWOW64\FLIU.exe WDOPXI.exe File opened for modification C:\windows\SysWOW64\DMRRJN.exe DJOV.exe File opened for modification C:\windows\SysWOW64\BVR.exe MNIU.exe File opened for modification C:\windows\SysWOW64\UCV.exe WSKQ.exe File created C:\windows\SysWOW64\HPGU.exe NXYJ.exe File created C:\windows\SysWOW64\PJVPQNA.exe.bat FLIU.exe File created C:\windows\SysWOW64\DPHMS.exe.bat OZGV.exe File created C:\windows\SysWOW64\HHCBHSF.exe.bat SRTCAF.exe File opened for modification C:\windows\SysWOW64\ROFGS.exe WMPHDTJ.exe File opened for modification C:\windows\SysWOW64\AOBBIQM.exe HLXFV.exe File created C:\windows\SysWOW64\AOBBIQM.exe.bat HLXFV.exe File created C:\windows\SysWOW64\URB.exe.bat NBAE.exe File opened for modification C:\windows\SysWOW64\VCLPRZ.exe GMK.exe File created C:\windows\SysWOW64\IXUV.exe.bat YXS.exe File created C:\windows\SysWOW64\DMRRJN.exe DJOV.exe File created C:\windows\SysWOW64\IXUV.exe YXS.exe File created C:\windows\SysWOW64\DJOV.exe VTNWX.exe File created C:\windows\SysWOW64\LCOTQLC.exe.bat YSFUCAH.exe File opened for modification C:\windows\SysWOW64\HUVZKJS.exe JYWRO.exe File opened for modification C:\windows\SysWOW64\DJOV.exe VTNWX.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\GYD.exe.bat RIUSFU.exe File opened for modification C:\windows\system\QBKJ.exe XGGNBWB.exe File created C:\windows\OZGV.exe.bat PJU.exe File created C:\windows\system\HLCKO.exe.bat BQC.exe File created C:\windows\system\FAJ.exe.bat HPGU.exe File opened for modification C:\windows\system\YNE.exe JXDIY.exe File created C:\windows\EZWGP.exe.bat PJVPQNA.exe File opened for modification C:\windows\RIUSFU.exe NSOS.exe File opened for modification C:\windows\VTNWX.exe GYD.exe File created C:\windows\IYWU.exe.bat YARA.exe File created C:\windows\HVIL.exe SFHMPSC.exe File opened for modification C:\windows\NBAE.exe BLLWNZN.exe File opened for modification C:\windows\system\LZLPVE.exe SGDELD.exe File opened for modification C:\windows\JXDIY.exe FPOAUPT.exe File created C:\windows\system\STGY.exe FJYAQG.exe File created C:\windows\GYD.exe RIUSFU.exe File created C:\windows\HUU.exe.bat SZLLN.exe File created C:\windows\system\FBM.exe.bat GIBJ.exe File created C:\windows\OXAMD.exe.bat YPRSVH.exe File created C:\windows\OZGV.exe PJU.exe File created C:\windows\YSFUCAH.exe JCEDV.exe File created C:\windows\system\SGDELD.exe RDSAYNN.exe File opened for modification C:\windows\WDOPXI.exe IAX.exe File created C:\windows\system\MNIU.exe.bat IXCUJWH.exe File opened for modification C:\windows\FPOAUPT.exe MMK.exe File created C:\windows\WDOPXI.exe IAX.exe File created C:\windows\IHD.exe EZWGP.exe File created C:\windows\LFTKGO.exe HUU.exe File opened for modification C:\windows\WMPHDTJ.exe FBM.exe File created C:\windows\HVIL.exe.bat SFHMPSC.exe File created C:\windows\NXYJ.exe LZLPVE.exe File opened for modification C:\windows\system\FAJ.exe HPGU.exe File created C:\windows\WPVUW.exe.bat DMRRJN.exe File opened for modification C:\windows\LFTKGO.exe HUU.exe File created C:\windows\GIBJ.exe.bat LFTKGO.exe File created C:\windows\NIEHWV.exe.bat HSL.exe File created C:\windows\system\LHEFRL.exe.bat SEBB.exe File created C:\windows\GIBJ.exe LFTKGO.exe File created C:\windows\system\WSKQ.exe DPHMS.exe File created C:\windows\PUJUUQ.exe URB.exe File created C:\windows\system\HLCKO.exe BQC.exe File created C:\windows\system\JCEDV.exe NROEH.exe File opened for modification C:\windows\system\CEEQZ.exe HUVZKJS.exe File created C:\windows\system\EGUEKRI.exe CIGK.exe File created C:\windows\EZWGP.exe PJVPQNA.exe File created C:\windows\system\LMGIPWP.exe.bat FLYUG.exe File opened for modification C:\windows\EABTVR.exe UCV.exe File created C:\windows\EABTVR.exe.bat UCV.exe File opened for modification C:\windows\YSFUCAH.exe JCEDV.exe File opened for modification C:\windows\system\SGDELD.exe RDSAYNN.exe File opened for modification C:\windows\IHD.exe EZWGP.exe File opened for modification C:\windows\DLBEZW.exe IYWU.exe File opened for modification C:\windows\system\WSKQ.exe DPHMS.exe File opened for modification C:\windows\PUJUUQ.exe URB.exe File created C:\windows\system\CIGK.exe LHEFRL.exe File created C:\windows\YXS.exe AZGN.exe File created C:\windows\system\SRTCAF.exe.bat ITNHTX.exe File created C:\windows\IYWU.exe YARA.exe File opened for modification C:\windows\OXAMD.exe YPRSVH.exe File opened for modification C:\windows\system\SFHMPSC.exe OXAMD.exe File opened for modification C:\windows\GYD.exe RIUSFU.exe File created C:\windows\system\GZKZ.exe.bat LMGIPWP.exe File created C:\windows\YPRSVH.exe.bat EBMKG.exe File created C:\windows\system\SFHMPSC.exe OXAMD.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 64 IoCs
pid pid_target Process procid_target 5388 5112 WerFault.exe 87 4432 6112 WerFault.exe 92 1288 1616 WerFault.exe 98 3932 2296 WerFault.exe 103 1800 1100 WerFault.exe 108 2236 5204 WerFault.exe 113 3052 2640 WerFault.exe 118 6080 1944 WerFault.exe 123 2316 1728 WerFault.exe 128 1504 3512 WerFault.exe 133 3224 4608 WerFault.exe 138 5616 3504 WerFault.exe 143 2100 4328 WerFault.exe 148 984 6076 WerFault.exe 153 3016 5992 WerFault.exe 158 5820 2888 WerFault.exe 163 240 788 WerFault.exe 168 5352 4508 WerFault.exe 173 4372 3320 WerFault.exe 178 2068 4864 WerFault.exe 183 3868 2856 WerFault.exe 188 564 540 WerFault.exe 193 5724 2724 WerFault.exe 197 1072 3224 WerFault.exe 203 1228 5576 WerFault.exe 208 5444 1248 WerFault.exe 213 4756 2196 WerFault.exe 218 1532 2476 WerFault.exe 223 5956 1120 WerFault.exe 228 5020 5668 WerFault.exe 233 1584 1840 WerFault.exe 238 416 5716 WerFault.exe 243 1220 1872 WerFault.exe 248 5456 3736 WerFault.exe 253 2776 2200 WerFault.exe 258 1852 5348 WerFault.exe 263 984 1376 WerFault.exe 269 2164 3556 WerFault.exe 274 5432 5972 WerFault.exe 279 5788 3732 WerFault.exe 284 5628 4392 WerFault.exe 289 1976 2384 WerFault.exe 294 3500 5504 WerFault.exe 299 2568 4136 WerFault.exe 304 1668 4524 WerFault.exe 309 1560 1624 WerFault.exe 314 2576 3904 WerFault.exe 319 2160 4528 WerFault.exe 324 4852 2360 WerFault.exe 329 4948 5712 WerFault.exe 334 1768 4056 WerFault.exe 339 1424 6004 WerFault.exe 344 5492 2668 WerFault.exe 349 5456 4176 WerFault.exe 354 5764 2568 WerFault.exe 359 6036 4380 WerFault.exe 364 5568 3528 WerFault.exe 369 6048 3668 WerFault.exe 374 6056 4480 WerFault.exe 379 3588 5940 WerFault.exe 384 4376 5352 WerFault.exe 389 5476 3856 WerFault.exe 394 2464 1968 WerFault.exe 399 2908 4672 WerFault.exe 404 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HPGU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RWK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WDOPXI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CIGK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EGUEKRI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LMGIPWP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QHIW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SRTCAF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LXIBTL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NROEH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QQQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UVKF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RSPPB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FPOAUPT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DJOV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DMRRJN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SFHMPSC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DPHMS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KJDWTA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HVIL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IXCUJWH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ITNHTX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BLLWNZN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IAX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QKVSRD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UCV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YNE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language STGY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VSMNQE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HUU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PUJUUQ.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5112 2026-07-09_caa2d2abe7de143bbdeb72025554e065_elex_emotet_stop.exe 5112 2026-07-09_caa2d2abe7de143bbdeb72025554e065_elex_emotet_stop.exe 6112 EBMKG.exe 6112 EBMKG.exe 1616 YPRSVH.exe 1616 YPRSVH.exe 2296 OXAMD.exe 2296 OXAMD.exe 1100 SFHMPSC.exe 1100 SFHMPSC.exe 5204 HVIL.exe 5204 HVIL.exe 2640 PJU.exe 2640 PJU.exe 1944 OZGV.exe 1944 OZGV.exe 1728 DPHMS.exe 1728 DPHMS.exe 3512 WSKQ.exe 3512 WSKQ.exe 4608 UCV.exe 4608 UCV.exe 3504 EABTVR.exe 3504 EABTVR.exe 4328 UVKF.exe 4328 UVKF.exe 6076 BLLWNZN.exe 6076 BLLWNZN.exe 5992 NBAE.exe 5992 NBAE.exe 2888 URB.exe 2888 URB.exe 788 PUJUUQ.exe 788 PUJUUQ.exe 4508 RSPPB.exe 4508 RSPPB.exe 3320 BQC.exe 3320 BQC.exe 4864 HLCKO.exe 4864 HLCKO.exe 2856 VWK.exe 2856 VWK.exe 540 NROEH.exe 540 NROEH.exe 2724 JCEDV.exe 2724 JCEDV.exe 3224 YSFUCAH.exe 3224 YSFUCAH.exe 5576 LCOTQLC.exe 5576 LCOTQLC.exe 1248 KNRJRR.exe 1248 KNRJRR.exe 2196 RDSAYNN.exe 2196 RDSAYNN.exe 2476 SGDELD.exe 2476 SGDELD.exe 1120 LZLPVE.exe 1120 LZLPVE.exe 5668 NXYJ.exe 5668 NXYJ.exe 1840 HPGU.exe 1840 HPGU.exe 5716 FAJ.exe 5716 FAJ.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 5112 2026-07-09_caa2d2abe7de143bbdeb72025554e065_elex_emotet_stop.exe 5112 2026-07-09_caa2d2abe7de143bbdeb72025554e065_elex_emotet_stop.exe 6112 EBMKG.exe 6112 EBMKG.exe 1616 YPRSVH.exe 1616 YPRSVH.exe 2296 OXAMD.exe 2296 OXAMD.exe 1100 SFHMPSC.exe 1100 SFHMPSC.exe 5204 HVIL.exe 5204 HVIL.exe 2640 PJU.exe 2640 PJU.exe 1944 OZGV.exe 1944 OZGV.exe 1728 DPHMS.exe 1728 DPHMS.exe 3512 WSKQ.exe 3512 WSKQ.exe 4608 UCV.exe 4608 UCV.exe 3504 EABTVR.exe 3504 EABTVR.exe 4328 UVKF.exe 4328 UVKF.exe 6076 BLLWNZN.exe 6076 BLLWNZN.exe 5992 NBAE.exe 5992 NBAE.exe 2888 URB.exe 2888 URB.exe 788 PUJUUQ.exe 788 PUJUUQ.exe 4508 RSPPB.exe 4508 RSPPB.exe 3320 BQC.exe 3320 BQC.exe 4864 HLCKO.exe 4864 HLCKO.exe 2856 VWK.exe 2856 VWK.exe 540 NROEH.exe 540 NROEH.exe 2724 JCEDV.exe 2724 JCEDV.exe 3224 YSFUCAH.exe 3224 YSFUCAH.exe 5576 LCOTQLC.exe 5576 LCOTQLC.exe 1248 KNRJRR.exe 1248 KNRJRR.exe 2196 RDSAYNN.exe 2196 RDSAYNN.exe 2476 SGDELD.exe 2476 SGDELD.exe 1120 LZLPVE.exe 1120 LZLPVE.exe 5668 NXYJ.exe 5668 NXYJ.exe 1840 HPGU.exe 1840 HPGU.exe 5716 FAJ.exe 5716 FAJ.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5112 wrote to memory of 5768 5112 2026-07-09_caa2d2abe7de143bbdeb72025554e065_elex_emotet_stop.exe 88 PID 5768 wrote to memory of 6112 5768 cmd.exe 92 PID 6112 wrote to memory of 5920 6112 EBMKG.exe 94 PID 5920 wrote to memory of 1616 5920 cmd.exe 98 PID 1616 wrote to memory of 4204 1616 YPRSVH.exe 99 PID 4204 wrote to memory of 2296 4204 cmd.exe 103 PID 2296 wrote to memory of 2900 2296 OXAMD.exe 104 PID 2900 wrote to memory of 1100 2900 cmd.exe 108 PID 1100 wrote to memory of 4468 1100 SFHMPSC.exe 109 PID 4468 wrote to memory of 5204 4468 cmd.exe 113 PID 5204 wrote to memory of 5760 5204 HVIL.exe 114 PID 5760 wrote to memory of 2640 5760 cmd.exe 118 PID 2640 wrote to memory of 5012 2640 PJU.exe 119 PID 5012 wrote to memory of 1944 5012 cmd.exe 123 PID 1944 wrote to memory of 988 1944 OZGV.exe 124 PID 988 wrote to memory of 1728 988 cmd.exe 128 PID 1728 wrote to memory of 4188 1728 DPHMS.exe 129 PID 4188 wrote to memory of 3512 4188 cmd.exe 133 PID 3512 wrote to memory of 1456 3512 WSKQ.exe 134 PID 1456 wrote to memory of 4608 1456 cmd.exe 138 PID 4608 wrote to memory of 2488 4608 UCV.exe 139 PID 2488 wrote to memory of 3504 2488 cmd.exe 143 PID 3504 wrote to memory of 3128 3504 EABTVR.exe 144 PID 3128 wrote to memory of 4328 3128 cmd.exe 148 PID 4328 wrote to memory of 792 4328 UVKF.exe 149 PID 792 wrote to memory of 6076 792 cmd.exe 153 PID 6076 wrote to memory of 3424 6076 BLLWNZN.exe 154 PID 3424 wrote to memory of 5992 3424 cmd.exe 158 PID 5992 wrote to memory of 1168 5992 NBAE.exe 159 PID 1168 wrote to memory of 2888 1168 cmd.exe 163 PID 2888 wrote to memory of 5152 2888 URB.exe 164 PID 5152 wrote to memory of 788 5152 cmd.exe 168 PID 788 wrote to memory of 292 788 PUJUUQ.exe 169 PID 292 wrote to memory of 4508 292 cmd.exe 173 PID 4508 wrote to memory of 3912 4508 RSPPB.exe 174 PID 3912 wrote to memory of 3320 3912 cmd.exe 178 PID 3320 wrote to memory of 5736 3320 BQC.exe 179 PID 5736 wrote to memory of 4864 5736 cmd.exe 183 PID 4864 wrote to memory of 3232 4864 HLCKO.exe 184 PID 3232 wrote to memory of 2856 3232 cmd.exe 188 PID 2856 wrote to memory of 4388 2856 VWK.exe 189 PID 4388 wrote to memory of 540 4388 cmd.exe 193 PID 540 wrote to memory of 2912 540 NROEH.exe 194 PID 2912 wrote to memory of 2724 2912 cmd.exe 197 PID 2724 wrote to memory of 2204 2724 JCEDV.exe 199 PID 2204 wrote to memory of 3224 2204 cmd.exe 203 PID 3224 wrote to memory of 2800 3224 YSFUCAH.exe 204 PID 2800 wrote to memory of 5576 2800 cmd.exe 208 PID 5576 wrote to memory of 2124 5576 LCOTQLC.exe 209 PID 2124 wrote to memory of 1248 2124 cmd.exe 213 PID 1248 wrote to memory of 4708 1248 KNRJRR.exe 214 PID 4708 wrote to memory of 2196 4708 cmd.exe 218 PID 2196 wrote to memory of 2260 2196 RDSAYNN.exe 219 PID 2260 wrote to memory of 2476 2260 cmd.exe 223 PID 2476 wrote to memory of 2916 2476 SGDELD.exe 224 PID 2916 wrote to memory of 1120 2916 cmd.exe 228 PID 1120 wrote to memory of 5708 1120 LZLPVE.exe 229 PID 5708 wrote to memory of 5668 5708 cmd.exe 233 PID 5668 wrote to memory of 3584 5668 NXYJ.exe 234 PID 3584 wrote to memory of 1840 3584 cmd.exe 238 PID 1840 wrote to memory of 4848 1840 HPGU.exe 239 PID 4848 wrote to memory of 5716 4848 cmd.exe 243 PID 5716 wrote to memory of 2312 5716 FAJ.exe 244 PID 2312 wrote to memory of 1872 2312 cmd.exe 248
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-09_caa2d2abe7de143bbdeb72025554e065_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-09_caa2d2abe7de143bbdeb72025554e065_elex_emotet_stop.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EBMKG.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:5768 -
C:\windows\SysWOW64\EBMKG.exeC:\windows\system32\EBMKG.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YPRSVH.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:5920 -
C:\windows\YPRSVH.exeC:\windows\YPRSVH.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OXAMD.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\windows\OXAMD.exeC:\windows\OXAMD.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SFHMPSC.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\windows\system\SFHMPSC.exeC:\windows\system\SFHMPSC.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HVIL.exe.bat" "10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\windows\HVIL.exeC:\windows\HVIL.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5204 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PJU.exe.bat" "12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5760 -
C:\windows\SysWOW64\PJU.exeC:\windows\system32\PJU.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OZGV.exe.bat" "14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\windows\OZGV.exeC:\windows\OZGV.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DPHMS.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:988 -
C:\windows\SysWOW64\DPHMS.exeC:\windows\system32\DPHMS.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WSKQ.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\windows\system\WSKQ.exeC:\windows\system\WSKQ.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UCV.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\windows\SysWOW64\UCV.exeC:\windows\system32\UCV.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EABTVR.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\windows\EABTVR.exeC:\windows\EABTVR.exe23⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UVKF.exe.bat" "24⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\windows\system\UVKF.exeC:\windows\system\UVKF.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BLLWNZN.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:792 -
C:\windows\SysWOW64\BLLWNZN.exeC:\windows\system32\BLLWNZN.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NBAE.exe.bat" "28⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\windows\NBAE.exeC:\windows\NBAE.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\URB.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\windows\SysWOW64\URB.exeC:\windows\system32\URB.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PUJUUQ.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:5152 -
C:\windows\PUJUUQ.exeC:\windows\PUJUUQ.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RSPPB.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:292 -
C:\windows\SysWOW64\RSPPB.exeC:\windows\system32\RSPPB.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BQC.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:3912 -
C:\windows\SysWOW64\BQC.exeC:\windows\system32\BQC.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HLCKO.exe.bat" "38⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5736 -
C:\windows\system\HLCKO.exeC:\windows\system\HLCKO.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VWK.exe.bat" "40⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3232 -
C:\windows\SysWOW64\VWK.exeC:\windows\system32\VWK.exe41⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NROEH.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\windows\system\NROEH.exeC:\windows\system\NROEH.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JCEDV.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\windows\system\JCEDV.exeC:\windows\system\JCEDV.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YSFUCAH.exe.bat" "46⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\windows\YSFUCAH.exeC:\windows\YSFUCAH.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3224 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LCOTQLC.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\windows\SysWOW64\LCOTQLC.exeC:\windows\system32\LCOTQLC.exe49⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KNRJRR.exe.bat" "50⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\windows\SysWOW64\KNRJRR.exeC:\windows\system32\KNRJRR.exe51⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RDSAYNN.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\windows\RDSAYNN.exeC:\windows\RDSAYNN.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SGDELD.exe.bat" "54⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\windows\system\SGDELD.exeC:\windows\system\SGDELD.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LZLPVE.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\windows\system\LZLPVE.exeC:\windows\system\LZLPVE.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NXYJ.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:5708 -
C:\windows\NXYJ.exeC:\windows\NXYJ.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HPGU.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:3584 -
C:\windows\SysWOW64\HPGU.exeC:\windows\system32\HPGU.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FAJ.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\windows\system\FAJ.exeC:\windows\system\FAJ.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PILP.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\windows\SysWOW64\PILP.exeC:\windows\system32\PILP.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KLBOUBH.exe.bat" "66⤵
- System Location Discovery: System Language Discovery
PID:5952 -
C:\windows\SysWOW64\KLBOUBH.exeC:\windows\system32\KLBOUBH.exe67⤵
- Executes dropped EXE
PID:3736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BEEECH.exe.bat" "68⤵PID:4804
-
C:\windows\BEEECH.exeC:\windows\BEEECH.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MMK.exe.bat" "70⤵
- System Location Discovery: System Language Discovery
PID:3796 -
C:\windows\SysWOW64\MMK.exeC:\windows\system32\MMK.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5348 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FPOAUPT.exe.bat" "72⤵PID:3720
-
C:\windows\FPOAUPT.exeC:\windows\FPOAUPT.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JXDIY.exe.bat" "74⤵PID:2992
-
C:\windows\JXDIY.exeC:\windows\JXDIY.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YNE.exe.bat" "76⤵PID:5172
-
C:\windows\system\YNE.exeC:\windows\system\YNE.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VTC.exe.bat" "78⤵
- System Location Discovery: System Language Discovery
PID:1484 -
C:\windows\SysWOW64\VTC.exeC:\windows\system32\VTC.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KJDWTA.exe.bat" "80⤵PID:6044
-
C:\windows\SysWOW64\KJDWTA.exeC:\windows\system32\KJDWTA.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JYWRO.exe.bat" "82⤵PID:5812
-
C:\windows\SysWOW64\JYWRO.exeC:\windows\system32\JYWRO.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HUVZKJS.exe.bat" "84⤵PID:3136
-
C:\windows\SysWOW64\HUVZKJS.exeC:\windows\system32\HUVZKJS.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CEEQZ.exe.bat" "86⤵PID:2840
-
C:\windows\system\CEEQZ.exeC:\windows\system\CEEQZ.exe87⤵
- Executes dropped EXE
PID:4136 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GMK.exe.bat" "88⤵
- System Location Discovery: System Language Discovery
PID:5500 -
C:\windows\system\GMK.exeC:\windows\system\GMK.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VCLPRZ.exe.bat" "90⤵PID:4680
-
C:\windows\SysWOW64\VCLPRZ.exeC:\windows\system32\VCLPRZ.exe91⤵
- Executes dropped EXE
PID:1624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QQQ.exe.bat" "92⤵
- System Location Discovery: System Language Discovery
PID:3100 -
C:\windows\system\QQQ.exeC:\windows\system\QQQ.exe93⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DBGYIK.exe.bat" "94⤵PID:2340
-
C:\windows\SysWOW64\DBGYIK.exeC:\windows\system32\DBGYIK.exe95⤵
- Executes dropped EXE
PID:4528 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RWK.exe.bat" "96⤵PID:976
-
C:\windows\SysWOW64\RWK.exeC:\windows\system32\RWK.exe97⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KZWU.exe.bat" "98⤵PID:4684
-
C:\windows\SysWOW64\KZWU.exeC:\windows\system32\KZWU.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SEBB.exe.bat" "100⤵PID:1720
-
C:\windows\SysWOW64\SEBB.exeC:\windows\system32\SEBB.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4056 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LHEFRL.exe.bat" "102⤵PID:3388
-
C:\windows\system\LHEFRL.exeC:\windows\system\LHEFRL.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CIGK.exe.bat" "104⤵PID:1492
-
C:\windows\system\CIGK.exeC:\windows\system\CIGK.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EGUEKRI.exe.bat" "106⤵
- System Location Discovery: System Language Discovery
PID:1988 -
C:\windows\system\EGUEKRI.exeC:\windows\system\EGUEKRI.exe107⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4176 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FJYAQG.exe.bat" "108⤵
- System Location Discovery: System Language Discovery
PID:3216 -
C:\windows\FJYAQG.exeC:\windows\FJYAQG.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\STGY.exe.bat" "110⤵
- System Location Discovery: System Language Discovery
PID:4916 -
C:\windows\system\STGY.exeC:\windows\system\STGY.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AZGN.exe.bat" "112⤵PID:5852
-
C:\windows\SysWOW64\AZGN.exeC:\windows\system32\AZGN.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3528 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YXS.exe.bat" "114⤵PID:4960
-
C:\windows\YXS.exeC:\windows\YXS.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IXUV.exe.bat" "116⤵
- System Location Discovery: System Language Discovery
PID:3016 -
C:\windows\SysWOW64\IXUV.exeC:\windows\system32\IXUV.exe117⤵
- Executes dropped EXE
PID:4480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IAX.exe.bat" "118⤵PID:2232
-
C:\windows\system\IAX.exeC:\windows\system\IAX.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WDOPXI.exe.bat" "120⤵PID:5560
-
C:\windows\WDOPXI.exeC:\windows\WDOPXI.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5352
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-