Analysis
- max time kernel
90s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/07/2026, 14:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-09_aa69dcc85f0c34cb623a7c9e2e2df8dc_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-09_aa69dcc85f0c34cb623a7c9e2e2df8dc_elex_emotet_stop.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 2026-07-09_aa69dcc85f0c34cb623a7c9e2e2df8dc_elex_emotet_stop.exe
- Size 208KB
- Sample260709-ryc5hscy6w
- SHA256 c22dbf687e7bbcfdafa7db1086a550ca71eb4fd764103429b46a18eaaf86c7a0
- MD5 aa69dcc85f0c34cb623a7c9e2e2df8dc
- SHA1 b9fec1f8c0ae0a585e58bd08c56fb96740f0239b
- SHA512 c308e54e46466c6b14939e4131535cd906795b93cd7d7a7d1faec59ed57fdbd63c76e46b857ee61813d44345e2a88832e2e6dd2fe851211d3f3fa6d425ad512a
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbclcdL+LOfV4NLthEjQT6c:MlZtbLWIgd1LZ9oECZbclc5+LO9QEje
- TLSH T19D247D2236D2C073E4B7023188F6C7787BB6BD919B36928B77C03B4D6E715A68A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5720 YFKCI.exe 5448 ZDFDTM.exe 5552 EDBF.exe 2292 DOE.exe 2344 SJNAA.exe 1872 CHTUH.exe 4724 ACSVMO.exe 2392 PXBZ.exe 4920 TFQHJT.exe 3692 BTIVLGC.exe 2596 FBPWXQ.exe 5224 URYNELN.exe 3380 PEVE.exe 2160 IXKP.exe 3256 DSPZIM.exe 5928 BDSPQ.exe 5604 UGVKWIW.exe 2480 EEJFDQ.exe 4216 IMQF.exe 2780 BPU.exe 1432 QKDN.exe 5780 HKFSRRF.exe 5632 LAMA.exe 1152 UAOFHG.exe 1968 QLEE.exe 5828 KYJNF.exe 5504 FUGW.exe 2208 OUICT.exe 3192 JHMLVOT.exe 344 LDRU.exe 4592 TTSUM.exe 1256 DQGOU.exe 6008 QTO.exe 1588 HCQSLA.exe 4560 WXAW.exe 1164 VSZXJ.exe 760 PFEGLQH.exe 3976 BNKO.exe 1708 UQO.exe 5216 ARW.exe 2904 SUACAQP.exe 1712 ECGCM.exe 5180 ZPLLWA.exe 5992 XKKU.exe 1956 MFUYMYQ.exe 3640 PBYI.exe 2248 PGZW.exe 3128 YTJOF.exe 1680 NJKN.exe 4380 IXPXW.exe 5296 XSY.exe 3436 DNYC.exe 4664 NLDW.exe 1488 IYIGE.exe 4804 CMNPOSK.exe 584 PWDOC.exe 1180 KKAXMDM.exe 1852 JULNNJ.exe 2792 DQQ.exe 5396 YDUGH.exe 2672 EDCURLN.exe 4932 EGGX.exe 720 GEM.exe 4528 YEOXP.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\EEJFDQ.exe UGVKWIW.exe File created C:\windows\SysWOW64\FUGW.exe KYJNF.exe File opened for modification C:\windows\SysWOW64\IXKP.exe PEVE.exe File created C:\windows\SysWOW64\DOE.exe.bat EDBF.exe File opened for modification C:\windows\SysWOW64\URYNELN.exe FBPWXQ.exe File created C:\windows\SysWOW64\IXKP.exe.bat PEVE.exe File created C:\windows\SysWOW64\VSZXJ.exe.bat WXAW.exe File created C:\windows\SysWOW64\EDBF.exe.bat ZDFDTM.exe File created C:\windows\SysWOW64\NLDW.exe DNYC.exe File created C:\windows\SysWOW64\EGGX.exe.bat EDCURLN.exe File created C:\windows\SysWOW64\JGGA.exe FYAAOZ.exe File created C:\windows\SysWOW64\APIFE.exe.bat JGGA.exe File created C:\windows\SysWOW64\MVYVG.exe.bat BCVC.exe File created C:\windows\SysWOW64\QLE.exe MVYVG.exe File created C:\windows\SysWOW64\FMOWEQ.exe QRFR.exe File created C:\windows\SysWOW64\XSY.exe.bat IXPXW.exe File opened for modification C:\windows\SysWOW64\HOVLJ.exe STMZYJP.exe File created C:\windows\SysWOW64\JGGA.exe.bat FYAAOZ.exe File created C:\windows\SysWOW64\APIFE.exe JGGA.exe File opened for modification C:\windows\SysWOW64\MVYVG.exe BCVC.exe File opened for modification C:\windows\SysWOW64\QLE.exe MVYVG.exe File created C:\windows\SysWOW64\DAQDAV.exe IMLT.exe File created C:\windows\SysWOW64\ZXX.exe.bat WKTPCU.exe File opened for modification C:\windows\SysWOW64\HKFSRRF.exe QKDN.exe File created C:\windows\SysWOW64\TTSUM.exe.bat LDRU.exe File created C:\windows\SysWOW64\SUACAQP.exe ARW.exe File created C:\windows\SysWOW64\KHAJ.exe HUVZKJS.exe File opened for modification C:\windows\SysWOW64\APIFE.exe JGGA.exe File created C:\windows\SysWOW64\QLE.exe.bat MVYVG.exe File created C:\windows\SysWOW64\ZXX.exe WKTPCU.exe File created C:\windows\SysWOW64\MVSUM.exe.bat SIO.exe File opened for modification C:\windows\SysWOW64\XSY.exe IXPXW.exe File created C:\windows\SysWOW64\URYNELN.exe FBPWXQ.exe File created C:\windows\SysWOW64\OUICT.exe.bat FUGW.exe File created C:\windows\SysWOW64\KHAJ.exe.bat HUVZKJS.exe File opened for modification C:\windows\SysWOW64\XNVMKUH.exe DAQDAV.exe File opened for modification C:\windows\SysWOW64\MJTJNL.exe MVSUM.exe File created C:\windows\SysWOW64\MJTJNL.exe.bat MVSUM.exe File created C:\windows\SysWOW64\NRF.exe.bat XAEI.exe File created C:\windows\SysWOW64\URYNELN.exe.bat FBPWXQ.exe File opened for modification C:\windows\SysWOW64\JHMLVOT.exe OUICT.exe File created C:\windows\SysWOW64\JHMLVOT.exe.bat OUICT.exe File created C:\windows\SysWOW64\SUACAQP.exe.bat ARW.exe File opened for modification C:\windows\SysWOW64\EGGX.exe EDCURLN.exe File created C:\windows\SysWOW64\MVYVG.exe BCVC.exe File created C:\windows\SysWOW64\XAEI.exe.bat USXIUCW.exe File created C:\windows\SysWOW64\IXKP.exe PEVE.exe File created C:\windows\SysWOW64\UQO.exe.bat BNKO.exe File created C:\windows\SysWOW64\XSY.exe IXPXW.exe File created C:\windows\SysWOW64\MVSUM.exe SIO.exe File created C:\windows\SysWOW64\MJTJNL.exe MVSUM.exe File created C:\windows\SysWOW64\HKFSRRF.exe QKDN.exe File opened for modification C:\windows\SysWOW64\UAOFHG.exe LAMA.exe File created C:\windows\SysWOW64\UAOFHG.exe.bat LAMA.exe File opened for modification C:\windows\SysWOW64\SUACAQP.exe ARW.exe File created C:\windows\SysWOW64\PBYI.exe MFUYMYQ.exe File opened for modification C:\windows\SysWOW64\YTJOF.exe PGZW.exe File opened for modification C:\windows\SysWOW64\KKAXMDM.exe PWDOC.exe File created C:\windows\SysWOW64\DAQDAV.exe.bat IMLT.exe File created C:\windows\SysWOW64\UAOFHG.exe LAMA.exe File created C:\windows\SysWOW64\JHMLVOT.exe OUICT.exe File created C:\windows\SysWOW64\TTSUM.exe LDRU.exe File opened for modification C:\windows\SysWOW64\UQO.exe BNKO.exe File opened for modification C:\windows\SysWOW64\PBYI.exe MFUYMYQ.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\CHTUH.exe SJNAA.exe File opened for modification C:\windows\BDSPQ.exe DSPZIM.exe File created C:\windows\system\QKDN.exe.bat BPU.exe File created C:\windows\ZPLLWA.exe.bat ECGCM.exe File created C:\windows\MFUYMYQ.exe XKKU.exe File created C:\windows\FYAAOZ.exe QIZ.exe File created C:\windows\system\TRM.exe NRF.exe File created C:\windows\HCQSLA.exe.bat QTO.exe File opened for modification C:\windows\system\IXPXW.exe NJKN.exe File created C:\windows\RKJNG.exe.bat KHAJ.exe File created C:\windows\system\NJRKQ.exe SOM.exe File created C:\windows\ODWP.exe.bat ZGQSNNK.exe File created C:\windows\FLYUG.exe ODWP.exe File created C:\windows\QLEE.exe UAOFHG.exe File created C:\windows\system\XXJ.exe RKJNG.exe File created C:\windows\system\QRFR.exe.bat QLE.exe File opened for modification C:\windows\system\NJRKQ.exe SOM.exe File created C:\windows\system\WRHXIG.exe.bat SJS.exe File created C:\windows\system\CZOAAH.exe TRM.exe File opened for modification C:\windows\QTO.exe DQGOU.exe File created C:\windows\QIZ.exe MSSAVT.exe File created C:\windows\MOENXU.exe.bat SAZW.exe File created C:\windows\system\GEM.exe.bat EGGX.exe File created C:\windows\system\NKLCE.exe JTF.exe File created C:\windows\system\ZDFDTM.exe.bat YFKCI.exe File created C:\windows\system\BTIVLGC.exe.bat TFQHJT.exe File created C:\windows\system\ECGCM.exe SUACAQP.exe File created C:\windows\NJKN.exe.bat YTJOF.exe File created C:\windows\system\DQQ.exe.bat JULNNJ.exe File created C:\windows\MHLYMW.exe.bat APIFE.exe File created C:\windows\BCVC.exe MHLYMW.exe File created C:\windows\system\YDUGH.exe.bat DQQ.exe File opened for modification C:\windows\EXZLSL.exe WRHXIG.exe File created C:\windows\system\TRM.exe.bat NRF.exe File created C:\windows\SAZW.exe XNVMKUH.exe File opened for modification C:\windows\SAZW.exe XNVMKUH.exe File opened for modification C:\windows\system\IMQF.exe EEJFDQ.exe File created C:\windows\system\QKDN.exe BPU.exe File opened for modification C:\windows\CMNPOSK.exe IYIGE.exe File created C:\windows\system\TFK.exe.bat NKLCE.exe File created C:\windows\system\BTIVLGC.exe TFQHJT.exe File opened for modification C:\windows\system\BTIVLGC.exe TFQHJT.exe File created C:\windows\system\DNYC.exe.bat XSY.exe File created C:\windows\system\XXJ.exe.bat RKJNG.exe File opened for modification C:\windows\TSCIO.exe ZXX.exe File created C:\windows\system\ZGQSNNK.exe KDHN.exe File opened for modification C:\windows\system\OSPUL.exe TFK.exe File created C:\windows\system\CZOAAH.exe.bat TRM.exe File created C:\windows\system\PEVE.exe.bat URYNELN.exe File opened for modification C:\windows\BPU.exe IMQF.exe File created C:\windows\IYIGE.exe.bat NLDW.exe File opened for modification C:\windows\JULNNJ.exe KKAXMDM.exe File opened for modification C:\windows\system\XXJ.exe RKJNG.exe File created C:\windows\ACSVMO.exe CHTUH.exe File created C:\windows\system\IMQF.exe EEJFDQ.exe File opened for modification C:\windows\PFEGLQH.exe VSZXJ.exe File opened for modification C:\windows\system\CDLHR.exe UPYBHP.exe File opened for modification C:\windows\MOENXU.exe SAZW.exe File created C:\windows\NJKN.exe YTJOF.exe File created C:\windows\CXHZ.exe.bat EXZLSL.exe File created C:\windows\system\OSPUL.exe.bat TFK.exe File opened for modification C:\windows\system\CZOAAH.exe TRM.exe File created C:\windows\system\YFKCI.exe 2026-07-09_aa69dcc85f0c34cb623a7c9e2e2df8dc_elex_emotet_stop.exe File created C:\windows\DQGOU.exe TTSUM.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
- Program crash 64 IoCs
pid pid_target Process procid_target 4312 1296 WerFault.exe 87 5672 5720 WerFault.exe 92 1688 5448 WerFault.exe 98 4292 5552 WerFault.exe 103 2440 2292 WerFault.exe 108 5696 2344 WerFault.exe 113 1724 1872 WerFault.exe 118 3336 4724 WerFault.exe 123 1428 2392 WerFault.exe 128 5480 4920 WerFault.exe 133 1680 3692 WerFault.exe 138 4328 2596 WerFault.exe 143 1484 5224 WerFault.exe 148 2388 3380 WerFault.exe 153 5088 2160 WerFault.exe 158 4296 3256 WerFault.exe 163 4420 5928 WerFault.exe 168 300 5604 WerFault.exe 173 4684 2480 WerFault.exe 178 3404 4216 WerFault.exe 183 1908 2780 WerFault.exe 188 2640 1432 WerFault.exe 193 3240 5780 WerFault.exe 198 6044 5632 WerFault.exe 203 5376 1152 WerFault.exe 208 5988 1968 WerFault.exe 213 5296 5828 WerFault.exe 218 3688 5504 WerFault.exe 223 4292 2208 WerFault.exe 228 1452 3192 WerFault.exe 233 256 344 WerFault.exe 238 5816 4592 WerFault.exe 243 5732 1256 WerFault.exe 248 2320 6008 WerFault.exe 253 5188 1588 WerFault.exe 258 2084 4560 WerFault.exe 263 2112 1164 WerFault.exe 268 5560 760 WerFault.exe 274 1896 3976 WerFault.exe 279 564 1708 WerFault.exe 284 5220 5216 WerFault.exe 289 4864 2904 WerFault.exe 294 2880 1712 WerFault.exe 299 1924 5180 WerFault.exe 304 4496 5992 WerFault.exe 309 6120 1956 WerFault.exe 314 3320 3640 WerFault.exe 319 3480 2248 WerFault.exe 324 5200 3128 WerFault.exe 329 4752 1680 WerFault.exe 334 1116 4380 WerFault.exe 339 3244 5296 WerFault.exe 344 1668 3436 WerFault.exe 349 3716 4664 WerFault.exe 354 4776 1488 WerFault.exe 358 5112 4804 WerFault.exe 364 4764 584 WerFault.exe 369 4732 1180 WerFault.exe 374 3472 1852 WerFault.exe 379 5440 2792 WerFault.exe 384 4392 5396 WerFault.exe 389 5964 2672 WerFault.exe 394 5784 4932 WerFault.exe 399 1668 720 WerFault.exe 404 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SOM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DQQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GEM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PGZW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IMLT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NJRKQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CXHZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UGVKWIW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JHMLVOT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VSZXJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MHLYMW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BDSPQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PFEGLQH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NRF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WRHXIG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IXKP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SJNAA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PXBZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BPU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FLYUG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KYJNF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WXAW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YEOXP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QLE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QTO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OUICT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZXX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JULNNJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1296 2026-07-09_aa69dcc85f0c34cb623a7c9e2e2df8dc_elex_emotet_stop.exe 1296 2026-07-09_aa69dcc85f0c34cb623a7c9e2e2df8dc_elex_emotet_stop.exe 5720 YFKCI.exe 5720 YFKCI.exe 5448 ZDFDTM.exe 5448 ZDFDTM.exe 5552 EDBF.exe 5552 EDBF.exe 2292 DOE.exe 2292 DOE.exe 2344 SJNAA.exe 2344 SJNAA.exe 1872 CHTUH.exe 1872 CHTUH.exe 4724 ACSVMO.exe 4724 ACSVMO.exe 2392 PXBZ.exe 2392 PXBZ.exe 4920 TFQHJT.exe 4920 TFQHJT.exe 3692 BTIVLGC.exe 3692 BTIVLGC.exe 2596 FBPWXQ.exe 2596 FBPWXQ.exe 5224 URYNELN.exe 5224 URYNELN.exe 3380 PEVE.exe 3380 PEVE.exe 2160 IXKP.exe 2160 IXKP.exe 3256 DSPZIM.exe 3256 DSPZIM.exe 5928 BDSPQ.exe 5928 BDSPQ.exe 5604 UGVKWIW.exe 5604 UGVKWIW.exe 2480 EEJFDQ.exe 2480 EEJFDQ.exe 4216 IMQF.exe 4216 IMQF.exe 2780 BPU.exe 2780 BPU.exe 1432 QKDN.exe 1432 QKDN.exe 5780 HKFSRRF.exe 5780 HKFSRRF.exe 5632 LAMA.exe 5632 LAMA.exe 1152 UAOFHG.exe 1152 UAOFHG.exe 1968 QLEE.exe 1968 QLEE.exe 5828 KYJNF.exe 5828 KYJNF.exe 5504 FUGW.exe 5504 FUGW.exe 2208 OUICT.exe 2208 OUICT.exe 3192 JHMLVOT.exe 3192 JHMLVOT.exe 344 LDRU.exe 344 LDRU.exe 4592 TTSUM.exe 4592 TTSUM.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1296 2026-07-09_aa69dcc85f0c34cb623a7c9e2e2df8dc_elex_emotet_stop.exe 1296 2026-07-09_aa69dcc85f0c34cb623a7c9e2e2df8dc_elex_emotet_stop.exe 5720 YFKCI.exe 5720 YFKCI.exe 5448 ZDFDTM.exe 5448 ZDFDTM.exe 5552 EDBF.exe 5552 EDBF.exe 2292 DOE.exe 2292 DOE.exe 2344 SJNAA.exe 2344 SJNAA.exe 1872 CHTUH.exe 1872 CHTUH.exe 4724 ACSVMO.exe 4724 ACSVMO.exe 2392 PXBZ.exe 2392 PXBZ.exe 4920 TFQHJT.exe 4920 TFQHJT.exe 3692 BTIVLGC.exe 3692 BTIVLGC.exe 2596 FBPWXQ.exe 2596 FBPWXQ.exe 5224 URYNELN.exe 5224 URYNELN.exe 3380 PEVE.exe 3380 PEVE.exe 2160 IXKP.exe 2160 IXKP.exe 3256 DSPZIM.exe 3256 DSPZIM.exe 5928 BDSPQ.exe 5928 BDSPQ.exe 5604 UGVKWIW.exe 5604 UGVKWIW.exe 2480 EEJFDQ.exe 2480 EEJFDQ.exe 4216 IMQF.exe 4216 IMQF.exe 2780 BPU.exe 2780 BPU.exe 1432 QKDN.exe 1432 QKDN.exe 5780 HKFSRRF.exe 5780 HKFSRRF.exe 5632 LAMA.exe 5632 LAMA.exe 1152 UAOFHG.exe 1152 UAOFHG.exe 1968 QLEE.exe 1968 QLEE.exe 5828 KYJNF.exe 5828 KYJNF.exe 5504 FUGW.exe 5504 FUGW.exe 2208 OUICT.exe 2208 OUICT.exe 3192 JHMLVOT.exe 3192 JHMLVOT.exe 344 LDRU.exe 344 LDRU.exe 4592 TTSUM.exe 4592 TTSUM.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1296 wrote to memory of 3880 1296 2026-07-09_aa69dcc85f0c34cb623a7c9e2e2df8dc_elex_emotet_stop.exe 88 PID 3880 wrote to memory of 5720 3880 cmd.exe 92 PID 5720 wrote to memory of 1044 5720 YFKCI.exe 94 PID 1044 wrote to memory of 5448 1044 cmd.exe 98 PID 5448 wrote to memory of 3592 5448 ZDFDTM.exe 99 PID 3592 wrote to memory of 5552 3592 cmd.exe 103 PID 5552 wrote to memory of 5872 5552 EDBF.exe 104 PID 5872 wrote to memory of 2292 5872 cmd.exe 108 PID 2292 wrote to memory of 5100 2292 DOE.exe 109 PID 5100 wrote to memory of 2344 5100 cmd.exe 113 PID 2344 wrote to memory of 5420 2344 SJNAA.exe 114 PID 5420 wrote to memory of 1872 5420 cmd.exe 118 PID 1872 wrote to memory of 2764 1872 CHTUH.exe 119 PID 2764 wrote to memory of 4724 2764 cmd.exe 123 PID 4724 wrote to memory of 3504 4724 ACSVMO.exe 124 PID 3504 wrote to memory of 2392 3504 cmd.exe 128 PID 2392 wrote to memory of 5428 2392 PXBZ.exe 129 PID 5428 wrote to memory of 4920 5428 cmd.exe 133 PID 4920 wrote to memory of 5968 4920 TFQHJT.exe 134 PID 5968 wrote to memory of 3692 5968 cmd.exe 138 PID 3692 wrote to memory of 3004 3692 BTIVLGC.exe 139 PID 3004 wrote to memory of 2596 3004 cmd.exe 143 PID 2596 wrote to memory of 1532 2596 FBPWXQ.exe 144 PID 1532 wrote to memory of 5224 1532 cmd.exe 148 PID 5224 wrote to memory of 1792 5224 URYNELN.exe 149 PID 1792 wrote to memory of 3380 1792 cmd.exe 153 PID 3380 wrote to memory of 4888 3380 PEVE.exe 154 PID 4888 wrote to memory of 2160 4888 cmd.exe 158 PID 2160 wrote to memory of 3516 2160 IXKP.exe 159 PID 3516 wrote to memory of 3256 3516 cmd.exe 163 PID 3256 wrote to memory of 4168 3256 DSPZIM.exe 164 PID 4168 wrote to memory of 5928 4168 cmd.exe 168 PID 5928 wrote to memory of 1672 5928 BDSPQ.exe 169 PID 1672 wrote to memory of 5604 1672 cmd.exe 173 PID 5604 wrote to memory of 3364 5604 UGVKWIW.exe 174 PID 3364 wrote to memory of 2480 3364 cmd.exe 178 PID 2480 wrote to memory of 5012 2480 EEJFDQ.exe 179 PID 5012 wrote to memory of 4216 5012 cmd.exe 183 PID 4216 wrote to memory of 5500 4216 IMQF.exe 184 PID 5500 wrote to memory of 2780 5500 cmd.exe 188 PID 2780 wrote to memory of 4612 2780 BPU.exe 189 PID 4612 wrote to memory of 1432 4612 cmd.exe 193 PID 1432 wrote to memory of 3900 1432 QKDN.exe 194 PID 3900 wrote to memory of 5780 3900 cmd.exe 198 PID 5780 wrote to memory of 5424 5780 HKFSRRF.exe 199 PID 5424 wrote to memory of 5632 5424 cmd.exe 203 PID 5632 wrote to memory of 5740 5632 LAMA.exe 204 PID 5740 wrote to memory of 1152 5740 cmd.exe 208 PID 1152 wrote to memory of 940 1152 UAOFHG.exe 209 PID 940 wrote to memory of 1968 940 cmd.exe 213 PID 1968 wrote to memory of 5648 1968 QLEE.exe 214 PID 5648 wrote to memory of 5828 5648 cmd.exe 218 PID 5828 wrote to memory of 3328 5828 KYJNF.exe 219 PID 3328 wrote to memory of 5504 3328 cmd.exe 223 PID 5504 wrote to memory of 1912 5504 FUGW.exe 224 PID 1912 wrote to memory of 2208 1912 cmd.exe 228 PID 2208 wrote to memory of 580 2208 OUICT.exe 229 PID 580 wrote to memory of 3192 580 cmd.exe 233 PID 3192 wrote to memory of 5540 3192 JHMLVOT.exe 234 PID 5540 wrote to memory of 344 5540 cmd.exe 238 PID 344 wrote to memory of 2924 344 LDRU.exe 239 PID 2924 wrote to memory of 4592 2924 cmd.exe 243 PID 4592 wrote to memory of 3612 4592 TTSUM.exe 244 PID 3612 wrote to memory of 1256 3612 cmd.exe 248
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-09_aa69dcc85f0c34cb623a7c9e2e2df8dc_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-09_aa69dcc85f0c34cb623a7c9e2e2df8dc_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YFKCI.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\windows\system\YFKCI.exeC:\windows\system\YFKCI.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZDFDTM.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\windows\system\ZDFDTM.exeC:\windows\system\ZDFDTM.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EDBF.exe.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3592 -
C:\windows\SysWOW64\EDBF.exeC:\windows\system32\EDBF.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DOE.exe.bat" "8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5872 -
C:\windows\SysWOW64\DOE.exeC:\windows\system32\DOE.exe9⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SJNAA.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\windows\system\SJNAA.exeC:\windows\system\SJNAA.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CHTUH.exe.bat" "12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5420 -
C:\windows\CHTUH.exeC:\windows\CHTUH.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ACSVMO.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\windows\ACSVMO.exeC:\windows\ACSVMO.exe15⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PXBZ.exe.bat" "16⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3504 -
C:\windows\system\PXBZ.exeC:\windows\system\PXBZ.exe17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TFQHJT.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:5428 -
C:\windows\system\TFQHJT.exeC:\windows\system\TFQHJT.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BTIVLGC.exe.bat" "20⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5968 -
C:\windows\system\BTIVLGC.exeC:\windows\system\BTIVLGC.exe21⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FBPWXQ.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\windows\SysWOW64\FBPWXQ.exeC:\windows\system32\FBPWXQ.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\URYNELN.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\windows\SysWOW64\URYNELN.exeC:\windows\system32\URYNELN.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5224 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PEVE.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\windows\system\PEVE.exeC:\windows\system\PEVE.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IXKP.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\windows\SysWOW64\IXKP.exeC:\windows\system32\IXKP.exe29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DSPZIM.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:3516 -
C:\windows\system\DSPZIM.exeC:\windows\system\DSPZIM.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BDSPQ.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\windows\BDSPQ.exeC:\windows\BDSPQ.exe33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UGVKWIW.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\windows\UGVKWIW.exeC:\windows\UGVKWIW.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5604 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EEJFDQ.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\windows\SysWOW64\EEJFDQ.exeC:\windows\system32\EEJFDQ.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IMQF.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\windows\system\IMQF.exeC:\windows\system\IMQF.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BPU.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:5500 -
C:\windows\BPU.exeC:\windows\BPU.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QKDN.exe.bat" "42⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\windows\system\QKDN.exeC:\windows\system\QKDN.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HKFSRRF.exe.bat" "44⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3900 -
C:\windows\SysWOW64\HKFSRRF.exeC:\windows\system32\HKFSRRF.exe45⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LAMA.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:5424 -
C:\windows\system\LAMA.exeC:\windows\system\LAMA.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5632 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UAOFHG.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:5740 -
C:\windows\SysWOW64\UAOFHG.exeC:\windows\system32\UAOFHG.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QLEE.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:940 -
C:\windows\QLEE.exeC:\windows\QLEE.exe51⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KYJNF.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:5648 -
C:\windows\KYJNF.exeC:\windows\KYJNF.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FUGW.exe.bat" "54⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\windows\SysWOW64\FUGW.exeC:\windows\system32\FUGW.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OUICT.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\windows\SysWOW64\OUICT.exeC:\windows\system32\OUICT.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JHMLVOT.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:580 -
C:\windows\SysWOW64\JHMLVOT.exeC:\windows\system32\JHMLVOT.exe59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LDRU.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:5540 -
C:\windows\LDRU.exeC:\windows\LDRU.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TTSUM.exe.bat" "62⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\windows\SysWOW64\TTSUM.exeC:\windows\system32\TTSUM.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DQGOU.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\windows\DQGOU.exeC:\windows\DQGOU.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QTO.exe.bat" "66⤵PID:2948
-
C:\windows\QTO.exeC:\windows\QTO.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6008 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HCQSLA.exe.bat" "68⤵
- System Location Discovery: System Language Discovery
PID:1428 -
C:\windows\HCQSLA.exeC:\windows\HCQSLA.exe69⤵
- Executes dropped EXE
PID:1588 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WXAW.exe.bat" "70⤵PID:2352
-
C:\windows\system\WXAW.exeC:\windows\system\WXAW.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VSZXJ.exe.bat" "72⤵PID:2868
-
C:\windows\SysWOW64\VSZXJ.exeC:\windows\system32\VSZXJ.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1164 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PFEGLQH.exe.bat" "74⤵PID:5412
-
C:\windows\PFEGLQH.exeC:\windows\PFEGLQH.exe75⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BNKO.exe.bat" "76⤵PID:1656
-
C:\windows\BNKO.exeC:\windows\BNKO.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UQO.exe.bat" "78⤵PID:5664
-
C:\windows\SysWOW64\UQO.exeC:\windows\system32\UQO.exe79⤵
- Executes dropped EXE
PID:1708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ARW.exe.bat" "80⤵
- System Location Discovery: System Language Discovery
PID:5460 -
C:\windows\system\ARW.exeC:\windows\system\ARW.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5216 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SUACAQP.exe.bat" "82⤵PID:1592
-
C:\windows\SysWOW64\SUACAQP.exeC:\windows\system32\SUACAQP.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ECGCM.exe.bat" "84⤵PID:1312
-
C:\windows\system\ECGCM.exeC:\windows\system\ECGCM.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZPLLWA.exe.bat" "86⤵
- System Location Discovery: System Language Discovery
PID:5876 -
C:\windows\ZPLLWA.exeC:\windows\ZPLLWA.exe87⤵
- Executes dropped EXE
PID:5180 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XKKU.exe.bat" "88⤵PID:3356
-
C:\windows\system\XKKU.exeC:\windows\system\XKKU.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MFUYMYQ.exe.bat" "90⤵PID:3104
-
C:\windows\MFUYMYQ.exeC:\windows\MFUYMYQ.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PBYI.exe.bat" "92⤵
- System Location Discovery: System Language Discovery
PID:2364 -
C:\windows\SysWOW64\PBYI.exeC:\windows\system32\PBYI.exe93⤵
- Executes dropped EXE
PID:3640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PGZW.exe.bat" "94⤵PID:1552
-
C:\windows\system\PGZW.exeC:\windows\system\PGZW.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YTJOF.exe.bat" "96⤵PID:2348
-
C:\windows\SysWOW64\YTJOF.exeC:\windows\system32\YTJOF.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NJKN.exe.bat" "98⤵
- System Location Discovery: System Language Discovery
PID:2768 -
C:\windows\NJKN.exeC:\windows\NJKN.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1680 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IXPXW.exe.bat" "100⤵PID:3036
-
C:\windows\system\IXPXW.exeC:\windows\system\IXPXW.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XSY.exe.bat" "102⤵PID:628
-
C:\windows\SysWOW64\XSY.exeC:\windows\system32\XSY.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DNYC.exe.bat" "104⤵PID:2368
-
C:\windows\system\DNYC.exeC:\windows\system\DNYC.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NLDW.exe.bat" "106⤵PID:5484
-
C:\windows\SysWOW64\NLDW.exeC:\windows\system32\NLDW.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4664 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IYIGE.exe.bat" "108⤵PID:2620
-
C:\windows\IYIGE.exeC:\windows\IYIGE.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CMNPOSK.exe.bat" "110⤵PID:2144
-
C:\windows\CMNPOSK.exeC:\windows\CMNPOSK.exe111⤵
- Executes dropped EXE
PID:4804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PWDOC.exe.bat" "112⤵PID:4656
-
C:\windows\system\PWDOC.exeC:\windows\system\PWDOC.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KKAXMDM.exe.bat" "114⤵PID:2908
-
C:\windows\SysWOW64\KKAXMDM.exeC:\windows\system32\KKAXMDM.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1180 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JULNNJ.exe.bat" "116⤵
- System Location Discovery: System Language Discovery
PID:6120 -
C:\windows\JULNNJ.exeC:\windows\JULNNJ.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DQQ.exe.bat" "118⤵
- System Location Discovery: System Language Discovery
PID:1836 -
C:\windows\system\DQQ.exeC:\windows\system\DQQ.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2792 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YDUGH.exe.bat" "120⤵
- System Location Discovery: System Language Discovery
PID:2116 -
C:\windows\system\YDUGH.exeC:\windows\system\YDUGH.exe121⤵
- Executes dropped EXE
PID:5396
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-