Analysis
- max time kernel
77s - max time network
122s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/07/2026, 16:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-09_f2d80c03f71dc28729e39e584247dfec_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-09_f2d80c03f71dc28729e39e584247dfec_elex_emotet_stop.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 2026-07-09_f2d80c03f71dc28729e39e584247dfec_elex_emotet_stop.exe
- Size 208KB
- Sample260709-tk7hbac17l
- SHA256 932b227ca9518b53a9b0f79433dc2f005199346a6a1712fd1374a3c48d5cc38e
- MD5 f2d80c03f71dc28729e39e584247dfec
- SHA1 ac36a687e01f1ec2d4301d12bd753c177f3cff52
- SHA512 7be7835846d7b773f293dd223794ddb4d99f9eac223a6e7628408bc7063cbba2dd7739bf25d85938fe4d2c27e1b234fc3c7de64ef2e4c73bab23d2fcfde0eed8
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlldL+LOf/4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFll5+LO3kEj1
- TLSH T1EF247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3404 FAADX.exe 1088 CIK.exe 3840 KOX.exe 3696 AEKCK.exe 4804 IRPIV.exe 2880 ZMVTV.exe 4208 TFKE.exe 1956 VDQ.exe 2080 STDQC.exe 3632 FZDB.exe 5420 RHWBZ.exe 2400 DUDZ.exe 5804 EXTVTQ.exe 1344 DFITFHE.exe 5868 OTHRK.exe 5732 RGYAWC.exe 5744 OHICHYY.exe 616 OKY.exe 4876 CHYKYT.exe 5704 EDPMJFR.exe 576 YQOKOG.exe 5532 GWBQZNJ.exe 1056 ROIJQ.exe 4644 ZCVQT.exe 2468 TUKBK.exe 5528 XXJ.exe 5740 BDTDBB.exe 2996 SOETJ.exe 1108 TRHX.exe 2228 LULTCN.exe 5452 VRRNJW.exe 5112 JUHM.exe 4300 YKIDECS.exe 4988 VLKFIY.exe 5476 XGBPURQ.exe 976 YBFL.exe 2716 XUQ.exe 1852 ZKWVXWX.exe 4144 XCYLGK.exe 4356 HAY.exe 5928 GLBOFKI.exe 4284 FWEEGY.exe 5068 FZIZTOO.exe 2640 HXVUBWP.exe 3420 OHLCS.exe 2560 QFQWAEM.exe 944 VGA.exe 4196 MQDOM.exe 824 FJSZE.exe 3908 CJUCI.exe 2784 VCKNR.exe 5824 KSL.exe 4220 YDTDMK.exe 5492 YGFGR.exe 2836 VYHJ.exe 6112 OBKMJU.exe 3164 JMBDXF.exe 2832 NUH.exe 796 CKIDILB.exe 2804 GAPL.exe 4584 QYVXJLY.exe 1960 JTHBP.exe 2428 JWKWURJ.exe 5656 NEREG.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\EXTVTQ.exe DUDZ.exe File opened for modification C:\windows\SysWOW64\OHICHYY.exe RGYAWC.exe File created C:\windows\SysWOW64\HAY.exe.bat XCYLGK.exe File created C:\windows\SysWOW64\MQDOM.exe VGA.exe File opened for modification C:\windows\SysWOW64\VCKNR.exe CJUCI.exe File opened for modification C:\windows\SysWOW64\KSL.exe VCKNR.exe File created C:\windows\SysWOW64\NEZ.exe YOM.exe File created C:\windows\SysWOW64\JUHM.exe.bat VRRNJW.exe File opened for modification C:\windows\SysWOW64\MQDOM.exe VGA.exe File created C:\windows\SysWOW64\GAPL.exe.bat CKIDILB.exe File created C:\windows\SysWOW64\JDKTJ.exe KSHDAX.exe File created C:\windows\SysWOW64\FJSZE.exe.bat MQDOM.exe File created C:\windows\SysWOW64\AEKCK.exe KOX.exe File created C:\windows\SysWOW64\VDQ.exe.bat TFKE.exe File created C:\windows\SysWOW64\OHICHYY.exe RGYAWC.exe File created C:\windows\SysWOW64\FZIZTOO.exe FWEEGY.exe File created C:\windows\SysWOW64\FZIZTOO.exe.bat FWEEGY.exe File opened for modification C:\windows\SysWOW64\CJUCI.exe FJSZE.exe File created C:\windows\SysWOW64\FWEEGY.exe.bat GLBOFKI.exe File created C:\windows\SysWOW64\NUH.exe JMBDXF.exe File opened for modification C:\windows\SysWOW64\ZKWVXWX.exe XUQ.exe File created C:\windows\SysWOW64\FJSZE.exe MQDOM.exe File created C:\windows\SysWOW64\KSL.exe.bat VCKNR.exe File opened for modification C:\windows\SysWOW64\GAPL.exe CKIDILB.exe File created C:\windows\SysWOW64\NEREG.exe JWKWURJ.exe File opened for modification C:\windows\SysWOW64\EBFYIMO.exe IVVJ.exe File created C:\windows\SysWOW64\EBFYIMO.exe.bat IVVJ.exe File created C:\windows\SysWOW64\EXTVTQ.exe.bat DUDZ.exe File opened for modification C:\windows\SysWOW64\HAY.exe XCYLGK.exe File opened for modification C:\windows\SysWOW64\FWEEGY.exe GLBOFKI.exe File created C:\windows\SysWOW64\KSL.exe VCKNR.exe File created C:\windows\SysWOW64\YOM.exe EBFYIMO.exe File created C:\windows\SysWOW64\FWEEGY.exe GLBOFKI.exe File created C:\windows\SysWOW64\AEKCK.exe.bat KOX.exe File created C:\windows\SysWOW64\OHICHYY.exe.bat RGYAWC.exe File created C:\windows\SysWOW64\VCKNR.exe CJUCI.exe File opened for modification C:\windows\SysWOW64\JDKTJ.exe KSHDAX.exe File created C:\windows\SysWOW64\EBFYIMO.exe IVVJ.exe File opened for modification C:\windows\SysWOW64\FZIZTOO.exe FWEEGY.exe File created C:\windows\SysWOW64\NUH.exe.bat JMBDXF.exe File created C:\windows\SysWOW64\WQGUHAZ.exe.bat YFV.exe File opened for modification C:\windows\SysWOW64\NTHAA.exe YDGBTWT.exe File opened for modification C:\windows\SysWOW64\XGBPURQ.exe VLKFIY.exe File created C:\windows\SysWOW64\YDTDMK.exe.bat KSL.exe File created C:\windows\SysWOW64\YOM.exe.bat EBFYIMO.exe File created C:\windows\SysWOW64\NEZ.exe.bat YOM.exe File created C:\windows\SysWOW64\JUHM.exe VRRNJW.exe File created C:\windows\SysWOW64\MQDOM.exe.bat VGA.exe File opened for modification C:\windows\SysWOW64\FJSZE.exe MQDOM.exe File created C:\windows\SysWOW64\ZKWVXWX.exe XUQ.exe File created C:\windows\SysWOW64\ZKWVXWX.exe.bat XUQ.exe File created C:\windows\SysWOW64\CJUCI.exe FJSZE.exe File created C:\windows\SysWOW64\JDKTJ.exe.bat KSHDAX.exe File created C:\windows\SysWOW64\NTHAA.exe.bat YDGBTWT.exe File created C:\windows\SysWOW64\VDQ.exe TFKE.exe File created C:\windows\SysWOW64\BDTDBB.exe XXJ.exe File opened for modification C:\windows\SysWOW64\JUHM.exe VRRNJW.exe File created C:\windows\SysWOW64\XGBPURQ.exe VLKFIY.exe File created C:\windows\SysWOW64\XGBPURQ.exe.bat VLKFIY.exe File created C:\windows\SysWOW64\HAY.exe XCYLGK.exe File created C:\windows\SysWOW64\VCKNR.exe.bat CJUCI.exe File created C:\windows\SysWOW64\YDTDMK.exe KSL.exe File created C:\windows\SysWOW64\BDTDBB.exe.bat XXJ.exe File opened for modification C:\windows\SysWOW64\NEREG.exe JWKWURJ.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\KOX.exe CIK.exe File created C:\windows\FZDB.exe.bat STDQC.exe File created C:\windows\system\OKY.exe.bat OHICHYY.exe File created C:\windows\EDPMJFR.exe CHYKYT.exe File created C:\windows\GWBQZNJ.exe YQOKOG.exe File created C:\windows\system\TRHX.exe.bat SOETJ.exe File created C:\windows\VRRNJW.exe LULTCN.exe File opened for modification C:\windows\VLKFIY.exe YKIDECS.exe File created C:\windows\system\RHWBZ.exe.bat FZDB.exe File created C:\windows\GLBOFKI.exe HAY.exe File created C:\windows\system\HXVUBWP.exe FZIZTOO.exe File created C:\windows\system\YBFL.exe.bat XGBPURQ.exe File created C:\windows\VGA.exe QFQWAEM.exe File opened for modification C:\windows\system\YGFGR.exe YDTDMK.exe File created C:\windows\UCG.exe.bat MXUU.exe File created C:\windows\YFV.exe VKE.exe File created C:\windows\DUDZ.exe RHWBZ.exe File created C:\windows\KOX.exe.bat CIK.exe File created C:\windows\system\LLV.exe.bat UCG.exe File created C:\windows\system\ZJPK.exe MGHLGO.exe File opened for modification C:\windows\system\TFKE.exe ZMVTV.exe File opened for modification C:\windows\DFITFHE.exe EXTVTQ.exe File opened for modification C:\windows\OTHRK.exe DFITFHE.exe File created C:\windows\system\YKIDECS.exe JUHM.exe File opened for modification C:\windows\OHLCS.exe HXVUBWP.exe File opened for modification C:\windows\IVVJ.exe JDKTJ.exe File opened for modification C:\windows\YFV.exe VKE.exe File created C:\windows\system\ZJPK.exe.bat MGHLGO.exe File created C:\windows\CIK.exe FAADX.exe File created C:\windows\VYHJ.exe.bat YGFGR.exe File opened for modification C:\windows\system\MGHLGO.exe WQGUHAZ.exe File created C:\windows\system\MGHLGO.exe.bat WQGUHAZ.exe File created C:\windows\system\WJZ.exe ZJPK.exe File created C:\windows\system\JWKWURJ.exe.bat JTHBP.exe File opened for modification C:\windows\KOX.exe CIK.exe File opened for modification C:\windows\system\ZMVTV.exe IRPIV.exe File created C:\windows\system\STDQC.exe VDQ.exe File opened for modification C:\windows\FZDB.exe STDQC.exe File opened for modification C:\windows\SOETJ.exe BDTDBB.exe File opened for modification C:\windows\system\TRHX.exe SOETJ.exe File created C:\windows\LULTCN.exe.bat TRHX.exe File created C:\windows\JMBDXF.exe.bat OBKMJU.exe File created C:\windows\system\ZMVTV.exe IRPIV.exe File opened for modification C:\windows\system\STDQC.exe VDQ.exe File created C:\windows\system\CHYKYT.exe OKY.exe File opened for modification C:\windows\VRRNJW.exe LULTCN.exe File created C:\windows\system\OBKMJU.exe.bat VYHJ.exe File created C:\windows\system\QYVXJLY.exe GAPL.exe File opened for modification C:\windows\system\MXUU.exe NEREG.exe File created C:\windows\system\MXUU.exe.bat NEREG.exe File opened for modification C:\windows\DUDZ.exe RHWBZ.exe File created C:\windows\system\QFQWAEM.exe OHLCS.exe File opened for modification C:\windows\system\LLV.exe UCG.exe File opened for modification C:\windows\APPCIQE.exe HWZR.exe File created C:\windows\system\YDGBTWT.exe IIOW.exe File created C:\windows\DUDZ.exe.bat RHWBZ.exe File opened for modification C:\windows\TUKBK.exe ZCVQT.exe File opened for modification C:\windows\CMUWYY.exe APPCIQE.exe File opened for modification C:\windows\system\ZJPK.exe MGHLGO.exe File opened for modification C:\windows\CIK.exe FAADX.exe File created C:\windows\system\RHWBZ.exe FZDB.exe File created C:\windows\VLKFIY.exe.bat YKIDECS.exe File opened for modification C:\windows\JMBDXF.exe OBKMJU.exe File created C:\windows\system\YDGBTWT.exe.bat IIOW.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 64 IoCs
pid pid_target Process procid_target 1568 3100 WerFault.exe 87 1060 3404 WerFault.exe 92 3716 1088 WerFault.exe 97 2860 3840 WerFault.exe 103 3040 3696 WerFault.exe 108 1032 4804 WerFault.exe 113 5832 2880 WerFault.exe 118 3364 4208 WerFault.exe 123 3944 1956 WerFault.exe 128 1136 2080 WerFault.exe 133 2708 3632 WerFault.exe 138 2004 5420 WerFault.exe 143 5028 2400 WerFault.exe 148 4064 5804 WerFault.exe 152 5740 1344 WerFault.exe 158 2996 5868 WerFault.exe 163 124 5732 WerFault.exe 168 5628 5744 WerFault.exe 173 2432 616 WerFault.exe 178 3208 4876 WerFault.exe 182 2828 5704 WerFault.exe 188 1212 576 WerFault.exe 193 3336 5532 WerFault.exe 198 4180 1056 WerFault.exe 202 6096 4644 WerFault.exe 208 5884 2468 WerFault.exe 213 4424 5528 WerFault.exe 218 5020 5740 WerFault.exe 223 5812 2996 WerFault.exe 228 3428 1108 WerFault.exe 233 1396 2228 WerFault.exe 238 5904 5452 WerFault.exe 243 3212 5112 WerFault.exe 248 6124 4300 WerFault.exe 253 5936 4988 WerFault.exe 259 5908 5476 WerFault.exe 264 5916 976 WerFault.exe 269 5724 2716 WerFault.exe 274 5460 1852 WerFault.exe 279 4280 4144 WerFault.exe 284 4136 4356 WerFault.exe 289 5272 5928 WerFault.exe 294 3096 4284 WerFault.exe 299 3396 5068 WerFault.exe 304 5612 2640 WerFault.exe 309 5208 3420 WerFault.exe 314 2604 2560 WerFault.exe 319 2144 944 WerFault.exe 324 5712 4196 WerFault.exe 329 1648 824 WerFault.exe 334 6132 3908 WerFault.exe 339 2952 2784 WerFault.exe 344 4364 5824 WerFault.exe 349 5340 4220 WerFault.exe 354 5920 5492 WerFault.exe 359 2712 2836 WerFault.exe 364 4412 6112 WerFault.exe 369 2144 3164 WerFault.exe 374 5712 2832 WerFault.exe 379 4480 796 WerFault.exe 384 2108 2804 WerFault.exe 389 5784 4584 WerFault.exe 394 4380 1960 WerFault.exe 399 2240 2428 WerFault.exe 404 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WQGUHAZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JMBDXF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KSHDAX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZKWVXWX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EBFYIMO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VKE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YFV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OHICHYY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BDTDBB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XCYLGK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GLBOFKI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FAADX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EDPMJFR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OHLCS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FJSZE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JWKWURJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UCG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TSNXC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XUQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FWEEGY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VGA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NEREG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WJZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AZGMK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TFKE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language STDQC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JUHM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YKIDECS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YGFGR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QYVXJLY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NEZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IRPIV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RHWBZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZCVQT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language APPCIQE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IIOW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HAY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CHYKYT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YDTDMK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NTHAA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3100 2026-07-09_f2d80c03f71dc28729e39e584247dfec_elex_emotet_stop.exe 3100 2026-07-09_f2d80c03f71dc28729e39e584247dfec_elex_emotet_stop.exe 3404 FAADX.exe 3404 FAADX.exe 1088 CIK.exe 1088 CIK.exe 3840 KOX.exe 3840 KOX.exe 3696 AEKCK.exe 3696 AEKCK.exe 4804 IRPIV.exe 4804 IRPIV.exe 2880 ZMVTV.exe 2880 ZMVTV.exe 4208 TFKE.exe 4208 TFKE.exe 1956 VDQ.exe 1956 VDQ.exe 2080 STDQC.exe 2080 STDQC.exe 3632 FZDB.exe 3632 FZDB.exe 5420 RHWBZ.exe 5420 RHWBZ.exe 2400 DUDZ.exe 2400 DUDZ.exe 5804 EXTVTQ.exe 5804 EXTVTQ.exe 1344 DFITFHE.exe 1344 DFITFHE.exe 5868 OTHRK.exe 5868 OTHRK.exe 5732 RGYAWC.exe 5732 RGYAWC.exe 5744 OHICHYY.exe 5744 OHICHYY.exe 616 OKY.exe 616 OKY.exe 4876 CHYKYT.exe 4876 CHYKYT.exe 5704 EDPMJFR.exe 5704 EDPMJFR.exe 576 YQOKOG.exe 576 YQOKOG.exe 5532 GWBQZNJ.exe 5532 GWBQZNJ.exe 1056 ROIJQ.exe 1056 ROIJQ.exe 4644 ZCVQT.exe 4644 ZCVQT.exe 2468 TUKBK.exe 2468 TUKBK.exe 5528 XXJ.exe 5528 XXJ.exe 5740 BDTDBB.exe 5740 BDTDBB.exe 2996 SOETJ.exe 2996 SOETJ.exe 1108 TRHX.exe 1108 TRHX.exe 2228 LULTCN.exe 2228 LULTCN.exe 5452 VRRNJW.exe 5452 VRRNJW.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 3100 2026-07-09_f2d80c03f71dc28729e39e584247dfec_elex_emotet_stop.exe 3100 2026-07-09_f2d80c03f71dc28729e39e584247dfec_elex_emotet_stop.exe 3404 FAADX.exe 3404 FAADX.exe 1088 CIK.exe 1088 CIK.exe 3840 KOX.exe 3840 KOX.exe 3696 AEKCK.exe 3696 AEKCK.exe 4804 IRPIV.exe 4804 IRPIV.exe 2880 ZMVTV.exe 2880 ZMVTV.exe 4208 TFKE.exe 4208 TFKE.exe 1956 VDQ.exe 1956 VDQ.exe 2080 STDQC.exe 2080 STDQC.exe 3632 FZDB.exe 3632 FZDB.exe 5420 RHWBZ.exe 5420 RHWBZ.exe 2400 DUDZ.exe 2400 DUDZ.exe 5804 EXTVTQ.exe 5804 EXTVTQ.exe 1344 DFITFHE.exe 1344 DFITFHE.exe 5868 OTHRK.exe 5868 OTHRK.exe 5732 RGYAWC.exe 5732 RGYAWC.exe 5744 OHICHYY.exe 5744 OHICHYY.exe 616 OKY.exe 616 OKY.exe 4876 CHYKYT.exe 4876 CHYKYT.exe 5704 EDPMJFR.exe 5704 EDPMJFR.exe 576 YQOKOG.exe 576 YQOKOG.exe 5532 GWBQZNJ.exe 5532 GWBQZNJ.exe 1056 ROIJQ.exe 1056 ROIJQ.exe 4644 ZCVQT.exe 4644 ZCVQT.exe 2468 TUKBK.exe 2468 TUKBK.exe 5528 XXJ.exe 5528 XXJ.exe 5740 BDTDBB.exe 5740 BDTDBB.exe 2996 SOETJ.exe 2996 SOETJ.exe 1108 TRHX.exe 1108 TRHX.exe 2228 LULTCN.exe 2228 LULTCN.exe 5452 VRRNJW.exe 5452 VRRNJW.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3100 wrote to memory of 2932 3100 2026-07-09_f2d80c03f71dc28729e39e584247dfec_elex_emotet_stop.exe 88 PID 2932 wrote to memory of 3404 2932 cmd.exe 92 PID 3404 wrote to memory of 1360 3404 FAADX.exe 94 PID 1360 wrote to memory of 1088 1360 cmd.exe 97 PID 1088 wrote to memory of 5164 1088 CIK.exe 99 PID 5164 wrote to memory of 3840 5164 cmd.exe 103 PID 3840 wrote to memory of 1996 3840 KOX.exe 104 PID 1996 wrote to memory of 3696 1996 cmd.exe 108 PID 3696 wrote to memory of 248 3696 AEKCK.exe 109 PID 248 wrote to memory of 4804 248 cmd.exe 113 PID 4804 wrote to memory of 4892 4804 IRPIV.exe 114 PID 4892 wrote to memory of 2880 4892 cmd.exe 118 PID 2880 wrote to memory of 5584 2880 ZMVTV.exe 119 PID 5584 wrote to memory of 4208 5584 cmd.exe 123 PID 4208 wrote to memory of 3288 4208 TFKE.exe 124 PID 3288 wrote to memory of 1956 3288 cmd.exe 128 PID 1956 wrote to memory of 4140 1956 VDQ.exe 129 PID 4140 wrote to memory of 2080 4140 cmd.exe 133 PID 2080 wrote to memory of 5700 2080 STDQC.exe 134 PID 5700 wrote to memory of 3632 5700 cmd.exe 138 PID 3632 wrote to memory of 4900 3632 FZDB.exe 139 PID 4900 wrote to memory of 5420 4900 cmd.exe 143 PID 5420 wrote to memory of 1064 5420 RHWBZ.exe 144 PID 1064 wrote to memory of 2400 1064 cmd.exe 148 PID 2400 wrote to memory of 3972 2400 DUDZ.exe 149 PID 3972 wrote to memory of 5804 3972 cmd.exe 152 PID 5804 wrote to memory of 2316 5804 EXTVTQ.exe 154 PID 2316 wrote to memory of 1344 2316 cmd.exe 158 PID 1344 wrote to memory of 1708 1344 DFITFHE.exe 159 PID 1708 wrote to memory of 5868 1708 cmd.exe 163 PID 5868 wrote to memory of 3716 5868 OTHRK.exe 164 PID 3716 wrote to memory of 5732 3716 cmd.exe 168 PID 5732 wrote to memory of 712 5732 RGYAWC.exe 169 PID 712 wrote to memory of 5744 712 cmd.exe 173 PID 5744 wrote to memory of 2928 5744 OHICHYY.exe 174 PID 2928 wrote to memory of 616 2928 cmd.exe 178 PID 616 wrote to memory of 956 616 OKY.exe 179 PID 956 wrote to memory of 4876 956 cmd.exe 182 PID 4876 wrote to memory of 1100 4876 CHYKYT.exe 184 PID 1100 wrote to memory of 5704 1100 cmd.exe 188 PID 5704 wrote to memory of 6012 5704 EDPMJFR.exe 189 PID 6012 wrote to memory of 576 6012 cmd.exe 193 PID 576 wrote to memory of 1500 576 YQOKOG.exe 194 PID 1500 wrote to memory of 5532 1500 cmd.exe 198 PID 5532 wrote to memory of 1328 5532 GWBQZNJ.exe 199 PID 1328 wrote to memory of 1056 1328 cmd.exe 202 PID 1056 wrote to memory of 2548 1056 ROIJQ.exe 204 PID 2548 wrote to memory of 4644 2548 cmd.exe 208 PID 4644 wrote to memory of 5400 4644 ZCVQT.exe 209 PID 5400 wrote to memory of 2468 5400 cmd.exe 213 PID 2468 wrote to memory of 1428 2468 TUKBK.exe 214 PID 1428 wrote to memory of 5528 1428 cmd.exe 218 PID 5528 wrote to memory of 1560 5528 XXJ.exe 219 PID 1560 wrote to memory of 5740 1560 cmd.exe 223 PID 5740 wrote to memory of 696 5740 BDTDBB.exe 224 PID 696 wrote to memory of 2996 696 cmd.exe 228 PID 2996 wrote to memory of 5500 2996 SOETJ.exe 229 PID 5500 wrote to memory of 1108 5500 cmd.exe 233 PID 1108 wrote to memory of 3452 1108 TRHX.exe 234 PID 3452 wrote to memory of 2228 3452 cmd.exe 238 PID 2228 wrote to memory of 760 2228 LULTCN.exe 239 PID 760 wrote to memory of 5452 760 cmd.exe 243 PID 5452 wrote to memory of 1232 5452 VRRNJW.exe 244 PID 1232 wrote to memory of 5112 1232 cmd.exe 248
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-09_f2d80c03f71dc28729e39e584247dfec_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-09_f2d80c03f71dc28729e39e584247dfec_elex_emotet_stop.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FAADX.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\windows\FAADX.exeC:\windows\FAADX.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CIK.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\windows\CIK.exeC:\windows\CIK.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KOX.exe.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5164 -
C:\windows\KOX.exeC:\windows\KOX.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AEKCK.exe.bat" "8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\windows\SysWOW64\AEKCK.exeC:\windows\system32\AEKCK.exe9⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IRPIV.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:248 -
C:\windows\IRPIV.exeC:\windows\IRPIV.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZMVTV.exe.bat" "12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\windows\system\ZMVTV.exeC:\windows\system\ZMVTV.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TFKE.exe.bat" "14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5584 -
C:\windows\system\TFKE.exeC:\windows\system\TFKE.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VDQ.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\windows\SysWOW64\VDQ.exeC:\windows\system32\VDQ.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\STDQC.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\windows\system\STDQC.exeC:\windows\system\STDQC.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FZDB.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:5700 -
C:\windows\FZDB.exeC:\windows\FZDB.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3632 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RHWBZ.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\windows\system\RHWBZ.exeC:\windows\system\RHWBZ.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DUDZ.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\windows\DUDZ.exeC:\windows\DUDZ.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EXTVTQ.exe.bat" "26⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3972 -
C:\windows\SysWOW64\EXTVTQ.exeC:\windows\system32\EXTVTQ.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DFITFHE.exe.bat" "28⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\windows\DFITFHE.exeC:\windows\DFITFHE.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OTHRK.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\windows\OTHRK.exeC:\windows\OTHRK.exe31⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RGYAWC.exe.bat" "32⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\windows\RGYAWC.exeC:\windows\RGYAWC.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OHICHYY.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:712 -
C:\windows\SysWOW64\OHICHYY.exeC:\windows\system32\OHICHYY.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5744 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OKY.exe.bat" "36⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\windows\system\OKY.exeC:\windows\system\OKY.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CHYKYT.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:956 -
C:\windows\system\CHYKYT.exeC:\windows\system\CHYKYT.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EDPMJFR.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\windows\EDPMJFR.exeC:\windows\EDPMJFR.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YQOKOG.exe.bat" "42⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6012 -
C:\windows\YQOKOG.exeC:\windows\YQOKOG.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GWBQZNJ.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\windows\GWBQZNJ.exeC:\windows\GWBQZNJ.exe45⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ROIJQ.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:1328 -
C:\windows\system\ROIJQ.exeC:\windows\system\ROIJQ.exe47⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZCVQT.exe.bat" "48⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\windows\system\ZCVQT.exeC:\windows\system\ZCVQT.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TUKBK.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:5400 -
C:\windows\TUKBK.exeC:\windows\TUKBK.exe51⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XXJ.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\windows\system\XXJ.exeC:\windows\system\XXJ.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5528 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BDTDBB.exe.bat" "54⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\windows\SysWOW64\BDTDBB.exeC:\windows\system32\BDTDBB.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SOETJ.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:696 -
C:\windows\SOETJ.exeC:\windows\SOETJ.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TRHX.exe.bat" "58⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5500 -
C:\windows\system\TRHX.exeC:\windows\system\TRHX.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LULTCN.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\windows\LULTCN.exeC:\windows\LULTCN.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VRRNJW.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:760 -
C:\windows\VRRNJW.exeC:\windows\VRRNJW.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JUHM.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\windows\SysWOW64\JUHM.exeC:\windows\system32\JUHM.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YKIDECS.exe.bat" "66⤵PID:5780
-
C:\windows\system\YKIDECS.exeC:\windows\system\YKIDECS.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VLKFIY.exe.bat" "68⤵
- System Location Discovery: System Language Discovery
PID:1504 -
C:\windows\VLKFIY.exeC:\windows\VLKFIY.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XGBPURQ.exe.bat" "70⤵PID:5108
-
C:\windows\SysWOW64\XGBPURQ.exeC:\windows\system32\XGBPURQ.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YBFL.exe.bat" "72⤵PID:3128
-
C:\windows\system\YBFL.exeC:\windows\system\YBFL.exe73⤵
- Executes dropped EXE
PID:976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XUQ.exe.bat" "74⤵PID:3480
-
C:\windows\XUQ.exeC:\windows\XUQ.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZKWVXWX.exe.bat" "76⤵PID:3964
-
C:\windows\SysWOW64\ZKWVXWX.exeC:\windows\system32\ZKWVXWX.exe77⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XCYLGK.exe.bat" "78⤵
- System Location Discovery: System Language Discovery
PID:4276 -
C:\windows\system\XCYLGK.exeC:\windows\system\XCYLGK.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HAY.exe.bat" "80⤵PID:2352
-
C:\windows\SysWOW64\HAY.exeC:\windows\system32\HAY.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4356 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GLBOFKI.exe.bat" "82⤵PID:1868
-
C:\windows\GLBOFKI.exeC:\windows\GLBOFKI.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FWEEGY.exe.bat" "84⤵PID:1572
-
C:\windows\SysWOW64\FWEEGY.exeC:\windows\system32\FWEEGY.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FZIZTOO.exe.bat" "86⤵PID:4816
-
C:\windows\SysWOW64\FZIZTOO.exeC:\windows\system32\FZIZTOO.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HXVUBWP.exe.bat" "88⤵PID:3400
-
C:\windows\system\HXVUBWP.exeC:\windows\system\HXVUBWP.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OHLCS.exe.bat" "90⤵
- System Location Discovery: System Language Discovery
PID:8 -
C:\windows\OHLCS.exeC:\windows\OHLCS.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QFQWAEM.exe.bat" "92⤵PID:2124
-
C:\windows\system\QFQWAEM.exeC:\windows\system\QFQWAEM.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VGA.exe.bat" "94⤵PID:1240
-
C:\windows\VGA.exeC:\windows\VGA.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MQDOM.exe.bat" "96⤵PID:2280
-
C:\windows\SysWOW64\MQDOM.exeC:\windows\system32\MQDOM.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4196 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FJSZE.exe.bat" "98⤵PID:3808
-
C:\windows\SysWOW64\FJSZE.exeC:\windows\system32\FJSZE.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CJUCI.exe.bat" "100⤵
- System Location Discovery: System Language Discovery
PID:3816 -
C:\windows\SysWOW64\CJUCI.exeC:\windows\system32\CJUCI.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VCKNR.exe.bat" "102⤵PID:3040
-
C:\windows\SysWOW64\VCKNR.exeC:\windows\system32\VCKNR.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2784 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KSL.exe.bat" "104⤵PID:2452
-
C:\windows\SysWOW64\KSL.exeC:\windows\system32\KSL.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YDTDMK.exe.bat" "106⤵PID:2480
-
C:\windows\SysWOW64\YDTDMK.exeC:\windows\system32\YDTDMK.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4220 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YGFGR.exe.bat" "108⤵PID:3364
-
C:\windows\system\YGFGR.exeC:\windows\system\YGFGR.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VYHJ.exe.bat" "110⤵PID:2948
-
C:\windows\VYHJ.exeC:\windows\VYHJ.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OBKMJU.exe.bat" "112⤵PID:3764
-
C:\windows\system\OBKMJU.exeC:\windows\system\OBKMJU.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JMBDXF.exe.bat" "114⤵PID:1368
-
C:\windows\JMBDXF.exeC:\windows\JMBDXF.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3164 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NUH.exe.bat" "116⤵PID:5176
-
C:\windows\SysWOW64\NUH.exeC:\windows\system32\NUH.exe117⤵
- Executes dropped EXE
PID:2832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CKIDILB.exe.bat" "118⤵PID:4424
-
C:\windows\CKIDILB.exeC:\windows\CKIDILB.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GAPL.exe.bat" "120⤵PID:1888
-
C:\windows\SysWOW64\GAPL.exeC:\windows\system32\GAPL.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2804
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-