Analysis
- max time kernel
92s - max time network
112s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/07/2026, 01:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-13_0422df33903fbb2c4434e742aadc0906_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-13_0422df33903fbb2c4434e742aadc0906_elex_emotet_stop.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 2026-07-13_0422df33903fbb2c4434e742aadc0906_elex_emotet_stop.exe
- Size 208KB
- Sample260714-camlqaex3s
- SHA256 fd12d9cae626dcad4494546b17568e2480e20c76975ed7fb757881ed661cce84
- MD5 0422df33903fbb2c4434e742aadc0906
- SHA1 f0196029edac75ee123ac9abbb84bd4f1d5a2d5d
- SHA512 3282f2bd7dfcf0be4bfa0f6d50f0140879a3522ea5b6ad2497b030d60b95991717413f130be0805ac93b381625e46f9e095381eb6a6e18cf041d732920abc794
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlldL+LOfq4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFll5+LOCkEj1
- TLSH T1AE247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3368 IGAPQ.exe 2576 VHBJNFZ.exe 5740 VMBYOSU.exe 5132 PIGH.exe 1460 VIOVHU.exe 5268 FGTH.exe 3140 YBX.exe 1264 YEBHI.exe 1648 ACOB.exe 5552 KZUVFZV.exe 1768 APVVL.exe 5912 PKE.exe 3292 PQFO.exe 4332 TGLOKF.exe 2920 UJPRP.exe 2872 DJRWBA.exe 600 HRYW.exe 5224 BNDGP.exe 628 CIGK.exe 1360 XDLTFI.exe 5468 DDTHWK.exe 4184 ZBZ.exe 4132 ZORS.exe 4848 YEKNSEC.exe 5996 SSPF.exe 4640 BARKF.exe 6076 HAY.exe 2940 PGR.exe 552 IJUIDHZ.exe 4464 OJCV.exe 3028 UJKJD.exe 1512 DKM.exe 924 FINQNXL.exe 2812 CNL.exe 4500 HNSBDB.exe 1208 ROUGHHR.exe 5672 IBF.exe 2616 GWEZB.exe 4452 SEL.exe 5952 QFSVW.exe 1392 SSXEHTG.exe 3492 SFX.exe 2432 WOETU.exe 5716 RBJCFYM.exe 4264 XBQQ.exe 5652 XPIEP.exe 5932 TMOBWP.exe 1832 XCVB.exe 996 DDDX.exe 4512 EYG.exe 5960 PQJM.exe 4816 TGQMSRU.exe 3312 NUV.exe 4944 UPUE.exe 4612 OCZNJU.exe 1800 ZVGYAV.exe 2828 FVO.exe 3520 NJOA.exe 4740 LJWOCE.exe 3748 NZPIATR.exe 5368 TZWWRVS.exe 5528 OUBN.exe 4768 IIGXEV.exe 6084 FNM.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\NUQ.exe WMOFZGR.exe File created C:\windows\SysWOW64\PKE.exe APVVL.exe File opened for modification C:\windows\SysWOW64\FGTH.exe VIOVHU.exe File created C:\windows\SysWOW64\QFSVW.exe SEL.exe File created C:\windows\SysWOW64\LJWOCE.exe.bat NJOA.exe File created C:\windows\SysWOW64\SPXJN.exe.bat QREH.exe File opened for modification C:\windows\SysWOW64\FUKP.exe XPK.exe File created C:\windows\SysWOW64\LIGZIF.exe TUV.exe File created C:\windows\SysWOW64\NUQ.exe.bat WMOFZGR.exe File created C:\windows\SysWOW64\ACOB.exe.bat YEBHI.exe File created C:\windows\SysWOW64\DDTHWK.exe.bat XDLTFI.exe File opened for modification C:\windows\SysWOW64\WOETU.exe SFX.exe File created C:\windows\SysWOW64\ROFGS.exe.bat WMPHDTJ.exe File opened for modification C:\windows\SysWOW64\FIWMCW.exe OIUHR.exe File created C:\windows\SysWOW64\TUV.exe KUTCPLF.exe File created C:\windows\SysWOW64\TUV.exe.bat KUTCPLF.exe File created C:\windows\SysWOW64\ROUGHHR.exe HNSBDB.exe File created C:\windows\SysWOW64\QFSVW.exe.bat SEL.exe File opened for modification C:\windows\SysWOW64\LJWOCE.exe NJOA.exe File created C:\windows\SysWOW64\SPXJN.exe QREH.exe File opened for modification C:\windows\SysWOW64\SPXJN.exe QREH.exe File created C:\windows\SysWOW64\IKGNYZC.exe SPXJN.exe File opened for modification C:\windows\SysWOW64\WDWORV.exe LKTVRGH.exe File created C:\windows\SysWOW64\FUKP.exe.bat XPK.exe File created C:\windows\SysWOW64\YEBHI.exe YBX.exe File created C:\windows\SysWOW64\DDTHWK.exe XDLTFI.exe File opened for modification C:\windows\SysWOW64\DDTHWK.exe XDLTFI.exe File created C:\windows\SysWOW64\HNSBDB.exe.bat CNL.exe File created C:\windows\SysWOW64\NJOA.exe.bat FVO.exe File opened for modification C:\windows\SysWOW64\WNOZ.exe FNM.exe File created C:\windows\SysWOW64\FIWMCW.exe OIUHR.exe File opened for modification C:\windows\SysWOW64\PKE.exe APVVL.exe File created C:\windows\SysWOW64\FGTH.exe VIOVHU.exe File opened for modification C:\windows\SysWOW64\HNSBDB.exe CNL.exe File opened for modification C:\windows\SysWOW64\NPQONW.exe EPOJK.exe File created C:\windows\SysWOW64\WDWORV.exe.bat LKTVRGH.exe File opened for modification C:\windows\SysWOW64\TUV.exe KUTCPLF.exe File opened for modification C:\windows\SysWOW64\LIGZIF.exe TUV.exe File opened for modification C:\windows\SysWOW64\PQFO.exe PKE.exe File created C:\windows\SysWOW64\HRYW.exe.bat DJRWBA.exe File created C:\windows\SysWOW64\XDLTFI.exe CIGK.exe File created C:\windows\SysWOW64\SSPF.exe YEKNSEC.exe File created C:\windows\SysWOW64\SSPF.exe.bat YEKNSEC.exe File created C:\windows\SysWOW64\HAY.exe BARKF.exe File created C:\windows\SysWOW64\ROUGHHR.exe.bat HNSBDB.exe File created C:\windows\SysWOW64\WOETU.exe.bat SFX.exe File created C:\windows\SysWOW64\YEBHI.exe.bat YBX.exe File created C:\windows\SysWOW64\HRYW.exe DJRWBA.exe File created C:\windows\SysWOW64\XDLTFI.exe.bat CIGK.exe File created C:\windows\SysWOW64\EYG.exe DDDX.exe File created C:\windows\SysWOW64\EYG.exe.bat DDDX.exe File created C:\windows\SysWOW64\TZWWRVS.exe NZPIATR.exe File opened for modification C:\windows\SysWOW64\TZWWRVS.exe NZPIATR.exe File created C:\windows\SysWOW64\FIWMCW.exe.bat OIUHR.exe File opened for modification C:\windows\SysWOW64\VHBJNFZ.exe IGAPQ.exe File opened for modification C:\windows\SysWOW64\QFSVW.exe SEL.exe File created C:\windows\SysWOW64\WOETU.exe SFX.exe File created C:\windows\SysWOW64\TZWWRVS.exe.bat NZPIATR.exe File created C:\windows\SysWOW64\WNOZ.exe FNM.exe File created C:\windows\SysWOW64\WNOZ.exe.bat FNM.exe File created C:\windows\SysWOW64\ROFGS.exe WMPHDTJ.exe File created C:\windows\SysWOW64\NPQONW.exe.bat EPOJK.exe File created C:\windows\SysWOW64\FGTH.exe.bat VIOVHU.exe File created C:\windows\SysWOW64\UJKJD.exe.bat OJCV.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\GWEZB.exe IBF.exe File created C:\windows\GWEZB.exe.bat IBF.exe File opened for modification C:\windows\system\XCVB.exe TMOBWP.exe File created C:\windows\IIYDSF.exe.bat SNO.exe File created C:\windows\KZUVFZV.exe ACOB.exe File created C:\windows\HUGUWWA.exe MGCLUW.exe File created C:\windows\XPK.exe HUAWP.exe File opened for modification C:\windows\XPK.exe HUAWP.exe File created C:\windows\ZCQJHW.exe.bat ERI.exe File created C:\windows\system\FVD.exe.bat LIGZIF.exe File created C:\windows\system\PGR.exe HAY.exe File created C:\windows\system\TGQMSRU.exe PQJM.exe File created C:\windows\system\NUV.exe TGQMSRU.exe File opened for modification C:\windows\DTNLIW.exe OVQO.exe File opened for modification C:\windows\system\RGV.exe ITKYN.exe File created C:\windows\DDDX.exe.bat XCVB.exe File opened for modification C:\windows\system\APVVL.exe KZUVFZV.exe File created C:\windows\system\BARKF.exe.bat SSPF.exe File created C:\windows\XBQQ.exe.bat RBJCFYM.exe File created C:\windows\system\KAOA.exe YIL.exe File opened for modification C:\windows\system\FVD.exe LIGZIF.exe File opened for modification C:\windows\system\BNDGP.exe HRYW.exe File created C:\windows\system\TGQMSRU.exe.bat PQJM.exe File created C:\windows\XPK.exe.bat HUAWP.exe File opened for modification C:\windows\system\NZEN.exe FTLY.exe File created C:\windows\UJPRP.exe TGLOKF.exe File opened for modification C:\windows\ZVGYAV.exe OCZNJU.exe File created C:\windows\system\MKCPCW.exe ROFGS.exe File created C:\windows\HUGUWWA.exe.bat MGCLUW.exe File opened for modification C:\windows\system\PGR.exe HAY.exe File created C:\windows\system\DKM.exe UJKJD.exe File created C:\windows\FNM.exe.bat IIGXEV.exe File created C:\windows\system\PGR.exe.bat HAY.exe File opened for modification C:\windows\IBF.exe ROUGHHR.exe File opened for modification C:\windows\system\TGQMSRU.exe PQJM.exe File opened for modification C:\windows\SNO.exe JFMLWNY.exe File created C:\windows\LXP.exe FXHKGK.exe File created C:\windows\OJCV.exe.bat IJUIDHZ.exe File created C:\windows\FVO.exe ZVGYAV.exe File created C:\windows\DCNVT.exe.bat XCF.exe File opened for modification C:\windows\system\JCJ.exe UZAWH.exe File created C:\windows\CGAUENR.exe WDWORV.exe File created C:\windows\system\VMBYOSU.exe.bat VHBJNFZ.exe File created C:\windows\system\APVVL.exe.bat KZUVFZV.exe File created C:\windows\FINQNXL.exe DKM.exe File opened for modification C:\windows\OIUHR.exe FUKP.exe File opened for modification C:\windows\JTV.exe DTNLIW.exe File created C:\windows\system\ZORS.exe.bat ZBZ.exe File created C:\windows\CNL.exe.bat FINQNXL.exe File opened for modification C:\windows\OCZNJU.exe UPUE.exe File opened for modification C:\windows\system\IIGXEV.exe OUBN.exe File created C:\windows\MTAHF.exe RGV.exe File created C:\windows\JFMLWNY.exe MZGWP.exe File created C:\windows\system\UNC.exe FIWMCW.exe File opened for modification C:\windows\ZBZ.exe DDTHWK.exe File opened for modification C:\windows\KBDB.exe CWC.exe File created C:\windows\FTLY.exe.bat HTEKRC.exe File opened for modification C:\windows\LXP.exe FXHKGK.exe File opened for modification C:\windows\FVO.exe ZVGYAV.exe File opened for modification C:\windows\system\SFX.exe SSXEHTG.exe File created C:\windows\system\QREH.exe HET.exe File opened for modification C:\windows\system\WPKR.exe LXP.exe File opened for modification C:\windows\FTLY.exe HTEKRC.exe File created C:\windows\system\IIGXEV.exe.bat OUBN.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 64 IoCs
pid pid_target Process procid_target 3320 4908 WerFault.exe 85 700 3368 WerFault.exe 90 1800 2576 WerFault.exe 96 2920 5740 WerFault.exe 101 5080 5132 WerFault.exe 106 5244 1460 WerFault.exe 111 3184 5268 WerFault.exe 116 3720 3140 WerFault.exe 121 4636 1264 WerFault.exe 126 5424 1648 WerFault.exe 131 3024 5552 WerFault.exe 136 5948 1768 WerFault.exe 141 4848 5912 WerFault.exe 146 5700 3292 WerFault.exe 151 4124 4332 WerFault.exe 156 3724 2920 WerFault.exe 161 1652 2872 WerFault.exe 166 3236 600 WerFault.exe 171 5976 5224 WerFault.exe 176 3260 628 WerFault.exe 181 5336 1360 WerFault.exe 186 4752 5468 WerFault.exe 191 2528 4184 WerFault.exe 196 2472 4132 WerFault.exe 201 4284 4848 WerFault.exe 206 1936 5996 WerFault.exe 211 3796 4640 WerFault.exe 216 2492 6076 WerFault.exe 221 1516 2940 WerFault.exe 226 5696 552 WerFault.exe 231 2876 4464 WerFault.exe 236 1876 3028 WerFault.exe 241 5252 1512 WerFault.exe 246 5716 924 WerFault.exe 251 4264 2812 WerFault.exe 256 3752 4500 WerFault.exe 261 1100 1208 WerFault.exe 266 3556 5672 WerFault.exe 271 1960 2616 WerFault.exe 276 3632 4452 WerFault.exe 282 5528 5952 WerFault.exe 287 3196 1392 WerFault.exe 292 5640 3492 WerFault.exe 297 5044 2432 WerFault.exe 302 3160 5716 WerFault.exe 307 2624 4264 WerFault.exe 312 4380 5652 WerFault.exe 317 776 5932 WerFault.exe 322 5516 1832 WerFault.exe 327 3748 996 WerFault.exe 332 4424 4512 WerFault.exe 337 5428 5960 WerFault.exe 342 2984 4816 WerFault.exe 347 5848 3312 WerFault.exe 352 4924 4944 WerFault.exe 357 4672 4612 WerFault.exe 362 5592 1800 WerFault.exe 367 5080 2828 WerFault.exe 372 5500 3520 WerFault.exe 377 2440 4740 WerFault.exe 382 1416 3748 WerFault.exe 387 3236 5368 WerFault.exe 392 2984 5528 WerFault.exe 397 4716 4768 WerFault.exe 402 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZBZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LTMODM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DTNLIW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TMOBWP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UJPRP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ROUGHHR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LJWOCE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QREH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BOZS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QFSVW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DDTHWK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HNSBDB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OUBN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WMPHDTJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MTAHF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NPQONW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IIYDSF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UPUE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CGAUENR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OCZNJU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MKCPCW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OVQO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WMOFZGR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JFMLWNY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LXP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VMBYOSU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZORS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RBJCFYM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ROFGS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WPKR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FUKP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HAY.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4908 2026-07-13_0422df33903fbb2c4434e742aadc0906_elex_emotet_stop.exe 4908 2026-07-13_0422df33903fbb2c4434e742aadc0906_elex_emotet_stop.exe 3368 IGAPQ.exe 3368 IGAPQ.exe 2576 VHBJNFZ.exe 2576 VHBJNFZ.exe 5740 VMBYOSU.exe 5740 VMBYOSU.exe 5132 PIGH.exe 5132 PIGH.exe 1460 VIOVHU.exe 1460 VIOVHU.exe 5268 FGTH.exe 5268 FGTH.exe 3140 YBX.exe 3140 YBX.exe 1264 YEBHI.exe 1264 YEBHI.exe 1648 ACOB.exe 1648 ACOB.exe 5552 KZUVFZV.exe 5552 KZUVFZV.exe 1768 APVVL.exe 1768 APVVL.exe 5912 PKE.exe 5912 PKE.exe 3292 PQFO.exe 3292 PQFO.exe 4332 TGLOKF.exe 4332 TGLOKF.exe 2920 UJPRP.exe 2920 UJPRP.exe 2872 DJRWBA.exe 2872 DJRWBA.exe 600 HRYW.exe 600 HRYW.exe 5224 BNDGP.exe 5224 BNDGP.exe 628 CIGK.exe 628 CIGK.exe 1360 XDLTFI.exe 1360 XDLTFI.exe 5468 DDTHWK.exe 5468 DDTHWK.exe 4184 ZBZ.exe 4184 ZBZ.exe 4132 ZORS.exe 4132 ZORS.exe 4848 YEKNSEC.exe 4848 YEKNSEC.exe 5996 SSPF.exe 5996 SSPF.exe 4640 BARKF.exe 4640 BARKF.exe 6076 HAY.exe 6076 HAY.exe 2940 PGR.exe 2940 PGR.exe 552 IJUIDHZ.exe 552 IJUIDHZ.exe 4464 OJCV.exe 4464 OJCV.exe 3028 UJKJD.exe 3028 UJKJD.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4908 2026-07-13_0422df33903fbb2c4434e742aadc0906_elex_emotet_stop.exe 4908 2026-07-13_0422df33903fbb2c4434e742aadc0906_elex_emotet_stop.exe 3368 IGAPQ.exe 3368 IGAPQ.exe 2576 VHBJNFZ.exe 2576 VHBJNFZ.exe 5740 VMBYOSU.exe 5740 VMBYOSU.exe 5132 PIGH.exe 5132 PIGH.exe 1460 VIOVHU.exe 1460 VIOVHU.exe 5268 FGTH.exe 5268 FGTH.exe 3140 YBX.exe 3140 YBX.exe 1264 YEBHI.exe 1264 YEBHI.exe 1648 ACOB.exe 1648 ACOB.exe 5552 KZUVFZV.exe 5552 KZUVFZV.exe 1768 APVVL.exe 1768 APVVL.exe 5912 PKE.exe 5912 PKE.exe 3292 PQFO.exe 3292 PQFO.exe 4332 TGLOKF.exe 4332 TGLOKF.exe 2920 UJPRP.exe 2920 UJPRP.exe 2872 DJRWBA.exe 2872 DJRWBA.exe 600 HRYW.exe 600 HRYW.exe 5224 BNDGP.exe 5224 BNDGP.exe 628 CIGK.exe 628 CIGK.exe 1360 XDLTFI.exe 1360 XDLTFI.exe 5468 DDTHWK.exe 5468 DDTHWK.exe 4184 ZBZ.exe 4184 ZBZ.exe 4132 ZORS.exe 4132 ZORS.exe 4848 YEKNSEC.exe 4848 YEKNSEC.exe 5996 SSPF.exe 5996 SSPF.exe 4640 BARKF.exe 4640 BARKF.exe 6076 HAY.exe 6076 HAY.exe 2940 PGR.exe 2940 PGR.exe 552 IJUIDHZ.exe 552 IJUIDHZ.exe 4464 OJCV.exe 4464 OJCV.exe 3028 UJKJD.exe 3028 UJKJD.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4908 wrote to memory of 4868 4908 2026-07-13_0422df33903fbb2c4434e742aadc0906_elex_emotet_stop.exe 86 PID 4868 wrote to memory of 3368 4868 cmd.exe 90 PID 3368 wrote to memory of 4308 3368 IGAPQ.exe 92 PID 4308 wrote to memory of 2576 4308 cmd.exe 96 PID 2576 wrote to memory of 1708 2576 VHBJNFZ.exe 97 PID 1708 wrote to memory of 5740 1708 cmd.exe 101 PID 5740 wrote to memory of 5348 5740 VMBYOSU.exe 102 PID 5348 wrote to memory of 5132 5348 cmd.exe 106 PID 5132 wrote to memory of 2536 5132 PIGH.exe 107 PID 2536 wrote to memory of 1460 2536 cmd.exe 111 PID 1460 wrote to memory of 2384 1460 VIOVHU.exe 112 PID 2384 wrote to memory of 5268 2384 cmd.exe 116 PID 5268 wrote to memory of 1752 5268 FGTH.exe 117 PID 1752 wrote to memory of 3140 1752 cmd.exe 121 PID 3140 wrote to memory of 4488 3140 YBX.exe 122 PID 4488 wrote to memory of 1264 4488 cmd.exe 126 PID 1264 wrote to memory of 5300 1264 YEBHI.exe 127 PID 5300 wrote to memory of 1648 5300 cmd.exe 131 PID 1648 wrote to memory of 3376 1648 ACOB.exe 132 PID 3376 wrote to memory of 5552 3376 cmd.exe 136 PID 5552 wrote to memory of 4732 5552 KZUVFZV.exe 137 PID 4732 wrote to memory of 1768 4732 cmd.exe 141 PID 1768 wrote to memory of 4316 1768 APVVL.exe 142 PID 4316 wrote to memory of 5912 4316 cmd.exe 146 PID 5912 wrote to memory of 4828 5912 PKE.exe 147 PID 4828 wrote to memory of 3292 4828 cmd.exe 151 PID 3292 wrote to memory of 5744 3292 PQFO.exe 152 PID 5744 wrote to memory of 4332 5744 cmd.exe 156 PID 4332 wrote to memory of 2868 4332 TGLOKF.exe 157 PID 2868 wrote to memory of 2920 2868 cmd.exe 161 PID 2920 wrote to memory of 2904 2920 UJPRP.exe 162 PID 2904 wrote to memory of 2872 2904 cmd.exe 166 PID 2872 wrote to memory of 3444 2872 DJRWBA.exe 167 PID 3444 wrote to memory of 600 3444 cmd.exe 171 PID 600 wrote to memory of 2888 600 HRYW.exe 172 PID 2888 wrote to memory of 5224 2888 cmd.exe 176 PID 5224 wrote to memory of 2500 5224 BNDGP.exe 177 PID 2500 wrote to memory of 628 2500 cmd.exe 181 PID 628 wrote to memory of 1332 628 CIGK.exe 182 PID 1332 wrote to memory of 1360 1332 cmd.exe 186 PID 1360 wrote to memory of 4344 1360 XDLTFI.exe 187 PID 4344 wrote to memory of 5468 4344 cmd.exe 191 PID 5468 wrote to memory of 2760 5468 DDTHWK.exe 192 PID 2760 wrote to memory of 4184 2760 cmd.exe 196 PID 4184 wrote to memory of 3080 4184 ZBZ.exe 197 PID 3080 wrote to memory of 4132 3080 cmd.exe 201 PID 4132 wrote to memory of 700 4132 ZORS.exe 202 PID 700 wrote to memory of 4848 700 cmd.exe 206 PID 4848 wrote to memory of 1796 4848 YEKNSEC.exe 207 PID 1796 wrote to memory of 5996 1796 cmd.exe 211 PID 5996 wrote to memory of 5880 5996 SSPF.exe 212 PID 5880 wrote to memory of 4640 5880 cmd.exe 216 PID 4640 wrote to memory of 3864 4640 BARKF.exe 217 PID 3864 wrote to memory of 6076 3864 cmd.exe 221 PID 6076 wrote to memory of 2288 6076 HAY.exe 222 PID 2288 wrote to memory of 2940 2288 cmd.exe 226 PID 2940 wrote to memory of 4536 2940 PGR.exe 227 PID 4536 wrote to memory of 552 4536 cmd.exe 231 PID 552 wrote to memory of 960 552 IJUIDHZ.exe 232 PID 960 wrote to memory of 4464 960 cmd.exe 236 PID 4464 wrote to memory of 4964 4464 OJCV.exe 237 PID 4964 wrote to memory of 3028 4964 cmd.exe 241 PID 3028 wrote to memory of 4092 3028 UJKJD.exe 242 PID 4092 wrote to memory of 1512 4092 cmd.exe 246
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-13_0422df33903fbb2c4434e742aadc0906_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-13_0422df33903fbb2c4434e742aadc0906_elex_emotet_stop.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IGAPQ.exe.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\windows\system\IGAPQ.exeC:\windows\system\IGAPQ.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VHBJNFZ.exe.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\windows\SysWOW64\VHBJNFZ.exeC:\windows\system32\VHBJNFZ.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VMBYOSU.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\windows\system\VMBYOSU.exeC:\windows\system\VMBYOSU.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PIGH.exe.bat" "8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5348 -
C:\windows\SysWOW64\PIGH.exeC:\windows\system32\PIGH.exe9⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VIOVHU.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\windows\SysWOW64\VIOVHU.exeC:\windows\system32\VIOVHU.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FGTH.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\windows\SysWOW64\FGTH.exeC:\windows\system32\FGTH.exe13⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YBX.exe.bat" "14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\windows\SysWOW64\YBX.exeC:\windows\system32\YBX.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YEBHI.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\windows\SysWOW64\YEBHI.exeC:\windows\system32\YEBHI.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ACOB.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:5300 -
C:\windows\SysWOW64\ACOB.exeC:\windows\system32\ACOB.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KZUVFZV.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\windows\KZUVFZV.exeC:\windows\KZUVFZV.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\APVVL.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\windows\system\APVVL.exeC:\windows\system\APVVL.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PKE.exe.bat" "24⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\windows\SysWOW64\PKE.exeC:\windows\system32\PKE.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PQFO.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\windows\SysWOW64\PQFO.exeC:\windows\system32\PQFO.exe27⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TGLOKF.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:5744 -
C:\windows\system\TGLOKF.exeC:\windows\system\TGLOKF.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UJPRP.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\windows\UJPRP.exeC:\windows\UJPRP.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DJRWBA.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\windows\system\DJRWBA.exeC:\windows\system\DJRWBA.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HRYW.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\windows\SysWOW64\HRYW.exeC:\windows\system32\HRYW.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BNDGP.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\windows\system\BNDGP.exeC:\windows\system\BNDGP.exe37⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5224 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CIGK.exe.bat" "38⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\windows\system\CIGK.exeC:\windows\system\CIGK.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:628 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XDLTFI.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\windows\SysWOW64\XDLTFI.exeC:\windows\system32\XDLTFI.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DDTHWK.exe.bat" "42⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\windows\SysWOW64\DDTHWK.exeC:\windows\system32\DDTHWK.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZBZ.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\windows\ZBZ.exeC:\windows\ZBZ.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZORS.exe.bat" "46⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3080 -
C:\windows\system\ZORS.exeC:\windows\system\ZORS.exe47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YEKNSEC.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:700 -
C:\windows\system\YEKNSEC.exeC:\windows\system\YEKNSEC.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SSPF.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\windows\SysWOW64\SSPF.exeC:\windows\system32\SSPF.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BARKF.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:5880 -
C:\windows\system\BARKF.exeC:\windows\system\BARKF.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HAY.exe.bat" "54⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3864 -
C:\windows\SysWOW64\HAY.exeC:\windows\system32\HAY.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PGR.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\windows\system\PGR.exeC:\windows\system\PGR.exe57⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IJUIDHZ.exe.bat" "58⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\windows\IJUIDHZ.exeC:\windows\IJUIDHZ.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OJCV.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:960 -
C:\windows\OJCV.exeC:\windows\OJCV.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UJKJD.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\windows\SysWOW64\UJKJD.exeC:\windows\system32\UJKJD.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DKM.exe.bat" "64⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\windows\system\DKM.exeC:\windows\system\DKM.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FINQNXL.exe.bat" "66⤵PID:4160
-
C:\windows\FINQNXL.exeC:\windows\FINQNXL.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CNL.exe.bat" "68⤵PID:3676
-
C:\windows\CNL.exeC:\windows\CNL.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HNSBDB.exe.bat" "70⤵PID:2496
-
C:\windows\SysWOW64\HNSBDB.exeC:\windows\system32\HNSBDB.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ROUGHHR.exe.bat" "72⤵PID:3240
-
C:\windows\SysWOW64\ROUGHHR.exeC:\windows\system32\ROUGHHR.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IBF.exe.bat" "74⤵PID:2568
-
C:\windows\IBF.exeC:\windows\IBF.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5672 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GWEZB.exe.bat" "76⤵PID:2244
-
C:\windows\GWEZB.exeC:\windows\GWEZB.exe77⤵
- Executes dropped EXE
PID:2616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SEL.exe.bat" "78⤵PID:1224
-
C:\windows\system\SEL.exeC:\windows\system\SEL.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QFSVW.exe.bat" "80⤵
- System Location Discovery: System Language Discovery
PID:5788 -
C:\windows\SysWOW64\QFSVW.exeC:\windows\system32\QFSVW.exe81⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SSXEHTG.exe.bat" "82⤵PID:3276
-
C:\windows\SSXEHTG.exeC:\windows\SSXEHTG.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SFX.exe.bat" "84⤵PID:3940
-
C:\windows\system\SFX.exeC:\windows\system\SFX.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WOETU.exe.bat" "86⤵PID:1568
-
C:\windows\SysWOW64\WOETU.exeC:\windows\system32\WOETU.exe87⤵
- Executes dropped EXE
PID:2432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RBJCFYM.exe.bat" "88⤵PID:4552
-
C:\windows\system\RBJCFYM.exeC:\windows\system\RBJCFYM.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XBQQ.exe.bat" "90⤵
- System Location Discovery: System Language Discovery
PID:828 -
C:\windows\XBQQ.exeC:\windows\XBQQ.exe91⤵
- Executes dropped EXE
PID:4264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XPIEP.exe.bat" "92⤵PID:3544
-
C:\windows\system\XPIEP.exeC:\windows\system\XPIEP.exe93⤵
- Executes dropped EXE
PID:5652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TMOBWP.exe.bat" "94⤵PID:5708
-
C:\windows\system\TMOBWP.exeC:\windows\system\TMOBWP.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XCVB.exe.bat" "96⤵PID:696
-
C:\windows\system\XCVB.exeC:\windows\system\XCVB.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DDDX.exe.bat" "98⤵PID:5964
-
C:\windows\DDDX.exeC:\windows\DDDX.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EYG.exe.bat" "100⤵PID:1368
-
C:\windows\SysWOW64\EYG.exeC:\windows\system32\EYG.exe101⤵
- Executes dropped EXE
PID:4512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PQJM.exe.bat" "102⤵
- System Location Discovery: System Language Discovery
PID:1352 -
C:\windows\PQJM.exeC:\windows\PQJM.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TGQMSRU.exe.bat" "104⤵
- System Location Discovery: System Language Discovery
PID:5012 -
C:\windows\system\TGQMSRU.exeC:\windows\system\TGQMSRU.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NUV.exe.bat" "106⤵
- System Location Discovery: System Language Discovery
PID:1876 -
C:\windows\system\NUV.exeC:\windows\system\NUV.exe107⤵
- Executes dropped EXE
PID:3312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UPUE.exe.bat" "108⤵PID:5616
-
C:\windows\system\UPUE.exeC:\windows\system\UPUE.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OCZNJU.exe.bat" "110⤵
- System Location Discovery: System Language Discovery
PID:5316 -
C:\windows\OCZNJU.exeC:\windows\OCZNJU.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZVGYAV.exe.bat" "112⤵PID:2340
-
C:\windows\ZVGYAV.exeC:\windows\ZVGYAV.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FVO.exe.bat" "114⤵
- System Location Discovery: System Language Discovery
PID:2028 -
C:\windows\FVO.exeC:\windows\FVO.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NJOA.exe.bat" "116⤵PID:3912
-
C:\windows\SysWOW64\NJOA.exeC:\windows\system32\NJOA.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LJWOCE.exe.bat" "118⤵
- System Location Discovery: System Language Discovery
PID:2428 -
C:\windows\SysWOW64\LJWOCE.exeC:\windows\system32\LJWOCE.exe119⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NZPIATR.exe.bat" "120⤵
- System Location Discovery: System Language Discovery
PID:4972 -
C:\windows\system\NZPIATR.exeC:\windows\system\NZPIATR.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3748
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-