Analysis
- max time kernel
148s - max time network
87s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/07/2026, 13:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-14_26abdf6a9d91e28f4a757d136bb31db4_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-14_26abdf6a9d91e28f4a757d136bb31db4_elex_emotet_stop.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 2026-07-14_26abdf6a9d91e28f4a757d136bb31db4_elex_emotet_stop.exe
- Size 208KB
- Sample260714-qeb8fags7v
- SHA256 2ef7726512d6053895e2658bc7669e031f257460416f7740105a4497b9706428
- MD5 26abdf6a9d91e28f4a757d136bb31db4
- SHA1 cde793cc8f539929bc87560edbd206ece6448c1e
- SHA512 739954ef8d2332d0c27af60674b2d9a87f12df54c0c7196e304f5481d08cdb0bdff5ba99664865696bf63647948c925c5e810781acf9d560f0483fbf7b94c504
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbclcdL+LOfd4NLthEjQT6E:MlZtbLWIgd1LZ9oECZbclc5+LOlQEjK
- TLSH T11F247D2235D2C073E4B7023188F6C7787BB6BD919B36928B77C03B4D6E315A68A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1888 KDCAMZD.exe 4216 RDSAYNN.exe 2516 WJK.exe 4868 PMOTT.exe 2480 TEXWFC.exe 2376 XUE.exe 5852 FAJ.exe 3088 YDUGH.exe 4544 RVCRR.exe 4944 UELOYE.exe 6028 YUR.exe 956 XFUETCH.exe 1512 GFW.exe 1212 TQNHLK.exe 3012 SAPXT.exe 4588 HDZ.exe 844 MWJEIHL.exe 5720 VELRTN.exe 5024 QSP.exe 724 QVTW.exe 3676 LIYGTC.exe 2128 KYJJG.exe 1000 XDJ.exe 5924 QZNQWJT.exe 6104 QCZU.exe 2748 FXIYMLD.exe 5980 ASNH.exe 3568 KQT.exe 5568 DLXGR.exe 6064 BEHW.exe 3260 LEBBD.exe 5088 REJ.exe 5316 RHVK.exe 4712 MUSTCN.exe 4924 XNVMKUH.exe 2608 BVBUX.exe 4560 WQGEZNJ.exe 1404 JTWUNXF.exe 4528 KWAY.exe 4352 UUG.exe 2444 SPFT.exe 2596 WXMTRR.exe 3876 WAQXE.exe 4760 NOAPME.exe 5012 LBZQ.exe 5476 HMIOFJB.exe 1736 QUK.exe 2840 UCQBVHZ.exe 4248 VFCX.exe 1544 YNJXNHW.exe 3564 MTJJW.exe 1020 ZWRID.exe 440 QETNOB.exe 4904 GZKZ.exe 2884 NPL.exe 4676 ZFSYS.exe 2816 IFUDVZ.exe 2724 XAEI.exe 4476 EWDJL.exe 4708 RHLHZ.exe 5836 AHNMDF.exe 5452 MXUU.exe 5308 SXBIYS.exe 4508 SDCXAFX.exe - Drops file in System32 directory 51 IoCs
description ioc Process File created C:\windows\SysWOW64\FXIYMLD.exe.bat QCZU.exe File created C:\windows\SysWOW64\MUSTCN.exe RHVK.exe File created C:\windows\SysWOW64\WAQXE.exe WXMTRR.exe File created C:\windows\SysWOW64\NOAPME.exe WAQXE.exe File opened for modification C:\windows\SysWOW64\QUK.exe HMIOFJB.exe File created C:\windows\SysWOW64\UELOYE.exe.bat RVCRR.exe File opened for modification C:\windows\SysWOW64\GFW.exe XFUETCH.exe File opened for modification C:\windows\SysWOW64\DLXGR.exe KQT.exe File created C:\windows\SysWOW64\LBZQ.exe NOAPME.exe File created C:\windows\SysWOW64\YNJXNHW.exe.bat VFCX.exe File created C:\windows\SysWOW64\ZFSYS.exe.bat NPL.exe File opened for modification C:\windows\SysWOW64\EWDJL.exe XAEI.exe File created C:\windows\SysWOW64\EWDJL.exe.bat XAEI.exe File created C:\windows\SysWOW64\XFUETCH.exe YUR.exe File created C:\windows\SysWOW64\QCZU.exe QZNQWJT.exe File opened for modification C:\windows\SysWOW64\WAQXE.exe WXMTRR.exe File created C:\windows\SysWOW64\QUK.exe HMIOFJB.exe File opened for modification C:\windows\SysWOW64\YNJXNHW.exe VFCX.exe File created C:\windows\SysWOW64\EWDJL.exe XAEI.exe File opened for modification C:\windows\SysWOW64\UELOYE.exe RVCRR.exe File created C:\windows\SysWOW64\GFW.exe XFUETCH.exe File opened for modification C:\windows\SysWOW64\QCZU.exe QZNQWJT.exe File created C:\windows\SysWOW64\DLXGR.exe.bat KQT.exe File created C:\windows\SysWOW64\RHVK.exe.bat REJ.exe File created C:\windows\SysWOW64\XNVMKUH.exe.bat MUSTCN.exe File created C:\windows\SysWOW64\LBZQ.exe.bat NOAPME.exe File created C:\windows\SysWOW64\QUK.exe.bat HMIOFJB.exe File created C:\windows\SysWOW64\XFUETCH.exe.bat YUR.exe File created C:\windows\SysWOW64\FXIYMLD.exe QCZU.exe File opened for modification C:\windows\SysWOW64\FXIYMLD.exe QCZU.exe File created C:\windows\SysWOW64\RHVK.exe REJ.exe File opened for modification C:\windows\SysWOW64\RHVK.exe REJ.exe File created C:\windows\SysWOW64\XNVMKUH.exe MUSTCN.exe File opened for modification C:\windows\SysWOW64\XNVMKUH.exe MUSTCN.exe File created C:\windows\SysWOW64\ZFSYS.exe NPL.exe File created C:\windows\SysWOW64\UELOYE.exe RVCRR.exe File created C:\windows\SysWOW64\GFW.exe.bat XFUETCH.exe File created C:\windows\SysWOW64\WAQXE.exe.bat WXMTRR.exe File opened for modification C:\windows\SysWOW64\ZFSYS.exe NPL.exe File created C:\windows\SysWOW64\XAEI.exe IFUDVZ.exe File created C:\windows\SysWOW64\XAEI.exe.bat IFUDVZ.exe File opened for modification C:\windows\SysWOW64\XFUETCH.exe YUR.exe File created C:\windows\SysWOW64\DLXGR.exe KQT.exe File opened for modification C:\windows\SysWOW64\MUSTCN.exe RHVK.exe File created C:\windows\SysWOW64\MUSTCN.exe.bat RHVK.exe File opened for modification C:\windows\SysWOW64\NOAPME.exe WAQXE.exe File created C:\windows\SysWOW64\NOAPME.exe.bat WAQXE.exe File opened for modification C:\windows\SysWOW64\LBZQ.exe NOAPME.exe File created C:\windows\SysWOW64\YNJXNHW.exe VFCX.exe File created C:\windows\SysWOW64\QCZU.exe.bat QZNQWJT.exe File opened for modification C:\windows\SysWOW64\XAEI.exe IFUDVZ.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\system\RVCRR.exe YDUGH.exe File created C:\windows\KDCAMZD.exe.bat 2026-07-14_26abdf6a9d91e28f4a757d136bb31db4_elex_emotet_stop.exe File created C:\windows\RDSAYNN.exe.bat KDCAMZD.exe File created C:\windows\system\XUE.exe.bat TEXWFC.exe File created C:\windows\system\GZKZ.exe.bat QETNOB.exe File opened for modification C:\windows\AHNMDF.exe RHLHZ.exe File created C:\windows\CLQKVR.exe.bat HYLBT.exe File created C:\windows\KDCAMZD.exe 2026-07-14_26abdf6a9d91e28f4a757d136bb31db4_elex_emotet_stop.exe File created C:\windows\system\MXUU.exe AHNMDF.exe File created C:\windows\TEXWFC.exe.bat PMOTT.exe File created C:\windows\BVBUX.exe.bat XNVMKUH.exe File created C:\windows\system\WJK.exe.bat RDSAYNN.exe File opened for modification C:\windows\TEXWFC.exe PMOTT.exe File created C:\windows\system\YDUGH.exe.bat FAJ.exe File opened for modification C:\windows\system\JTWUNXF.exe WQGEZNJ.exe File opened for modification C:\windows\system\UCQBVHZ.exe QUK.exe File created C:\windows\MTJJW.exe.bat YNJXNHW.exe File opened for modification C:\windows\QETNOB.exe ZWRID.exe File created C:\windows\AHNMDF.exe.bat RHLHZ.exe File created C:\windows\PMOTT.exe.bat WJK.exe File opened for modification C:\windows\YUR.exe UELOYE.exe File created C:\windows\TQNHLK.exe GFW.exe File created C:\windows\system\KYJJG.exe.bat LIYGTC.exe File opened for modification C:\windows\system\KQT.exe ASNH.exe File opened for modification C:\windows\system\LEBBD.exe BEHW.exe File created C:\windows\system\LEBBD.exe.bat BEHW.exe File created C:\windows\SPFT.exe UUG.exe File created C:\windows\ASNH.exe FXIYMLD.exe File opened for modification C:\windows\system\BEHW.exe DLXGR.exe File opened for modification C:\windows\BVBUX.exe XNVMKUH.exe File opened for modification C:\windows\system\MXUU.exe AHNMDF.exe File opened for modification C:\windows\SDCXAFX.exe SXBIYS.exe File opened for modification C:\windows\RDSAYNN.exe KDCAMZD.exe File created C:\windows\TQNHLK.exe.bat GFW.exe File opened for modification C:\windows\system\LIYGTC.exe QVTW.exe File created C:\windows\QZNQWJT.exe XDJ.exe File created C:\windows\system\KQT.exe ASNH.exe File created C:\windows\REJ.exe LEBBD.exe File created C:\windows\system\UUG.exe KWAY.exe File opened for modification C:\windows\system\RHLHZ.exe EWDJL.exe File created C:\windows\RDSAYNN.exe KDCAMZD.exe File created C:\windows\system\XDJ.exe.bat KYJJG.exe File opened for modification C:\windows\REJ.exe LEBBD.exe File created C:\windows\system\HYLBT.exe SDCXAFX.exe File created C:\windows\system\YDUGH.exe FAJ.exe File created C:\windows\YUR.exe UELOYE.exe File created C:\windows\PMOTT.exe WJK.exe File created C:\windows\QVTW.exe.bat QSP.exe File created C:\windows\system\LIYGTC.exe.bat QVTW.exe File created C:\windows\system\BEHW.exe.bat DLXGR.exe File created C:\windows\system\WXMTRR.exe.bat SPFT.exe File created C:\windows\system\JTWUNXF.exe.bat WQGEZNJ.exe File created C:\windows\system\GZKZ.exe QETNOB.exe File created C:\windows\system\UCQBVHZ.exe QUK.exe File opened for modification C:\windows\system\VFCX.exe UCQBVHZ.exe File created C:\windows\ZWRID.exe MTJJW.exe File opened for modification C:\windows\KDCAMZD.exe 2026-07-14_26abdf6a9d91e28f4a757d136bb31db4_elex_emotet_stop.exe File opened for modification C:\windows\PMOTT.exe WJK.exe File created C:\windows\HDZ.exe.bat SAPXT.exe File created C:\windows\QSP.exe.bat VELRTN.exe File created C:\windows\system\WQGEZNJ.exe BVBUX.exe File created C:\windows\system\WJK.exe RDSAYNN.exe File created C:\windows\system\RVCRR.exe.bat YDUGH.exe File opened for modification C:\windows\system\KWAY.exe JTWUNXF.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 64 IoCs
pid pid_target Process procid_target 1928 4304 WerFault.exe 87 2212 1888 WerFault.exe 92 3760 4216 WerFault.exe 98 5404 2516 WerFault.exe 103 716 4868 WerFault.exe 108 3308 2480 WerFault.exe 113 564 2376 WerFault.exe 118 1912 5852 WerFault.exe 123 1192 3088 WerFault.exe 127 904 4544 WerFault.exe 133 3412 4944 WerFault.exe 138 5372 6028 WerFault.exe 143 4568 956 WerFault.exe 148 2772 1512 WerFault.exe 153 1848 1212 WerFault.exe 158 5060 3012 WerFault.exe 163 5436 4588 WerFault.exe 168 3180 844 WerFault.exe 173 2936 5720 WerFault.exe 178 5460 5024 WerFault.exe 183 4264 724 WerFault.exe 188 4880 3676 WerFault.exe 193 5300 2128 WerFault.exe 198 2508 1000 WerFault.exe 203 4952 5924 WerFault.exe 208 5404 6104 WerFault.exe 213 2308 2748 WerFault.exe 218 1176 5980 WerFault.exe 223 4328 3568 WerFault.exe 228 1432 5568 WerFault.exe 233 2408 6064 WerFault.exe 238 4788 3260 WerFault.exe 243 4888 5088 WerFault.exe 248 5332 5316 WerFault.exe 253 2000 4712 WerFault.exe 258 5344 4924 WerFault.exe 263 4212 2608 WerFault.exe 268 2028 4560 WerFault.exe 274 3844 1404 WerFault.exe 279 5540 4528 WerFault.exe 284 1672 4352 WerFault.exe 289 472 2444 WerFault.exe 294 440 2596 WerFault.exe 299 4904 3876 WerFault.exe 304 2528 4760 WerFault.exe 309 2624 5012 WerFault.exe 314 4804 5476 WerFault.exe 319 1248 1736 WerFault.exe 324 2112 2840 WerFault.exe 329 5504 4248 WerFault.exe 334 1496 1544 WerFault.exe 339 2244 3564 WerFault.exe 344 5336 1020 WerFault.exe 349 5764 440 WerFault.exe 354 6068 4904 WerFault.exe 359 6040 2884 WerFault.exe 364 1884 4676 WerFault.exe 369 1076 2816 WerFault.exe 374 600 2724 WerFault.exe 379 4324 4476 WerFault.exe 384 1184 4708 WerFault.exe 389 5232 5836 WerFault.exe 394 2068 5452 WerFault.exe 399 5596 5308 WerFault.exe 404 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-14_26abdf6a9d91e28f4a757d136bb31db4_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PMOTT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WQGEZNJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VFCX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MXUU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VELRTN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JTWUNXF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZFSYS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IFUDVZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YDUGH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RHVK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QVTW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FXIYMLD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LEBBD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UCQBVHZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FAJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UELOYE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MWJEIHL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NOAPME.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RVCRR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XNVMKUH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BVBUX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GZKZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XUE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GFW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WJK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TQNHLK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QCZU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SPFT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QUK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RHLHZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QETNOB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MTJJW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YNJXNHW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NPL.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4304 2026-07-14_26abdf6a9d91e28f4a757d136bb31db4_elex_emotet_stop.exe 4304 2026-07-14_26abdf6a9d91e28f4a757d136bb31db4_elex_emotet_stop.exe 1888 KDCAMZD.exe 1888 KDCAMZD.exe 4216 RDSAYNN.exe 4216 RDSAYNN.exe 2516 WJK.exe 2516 WJK.exe 4868 PMOTT.exe 4868 PMOTT.exe 2480 TEXWFC.exe 2480 TEXWFC.exe 2376 XUE.exe 2376 XUE.exe 5852 FAJ.exe 5852 FAJ.exe 3088 YDUGH.exe 3088 YDUGH.exe 4544 RVCRR.exe 4544 RVCRR.exe 4944 UELOYE.exe 4944 UELOYE.exe 6028 YUR.exe 6028 YUR.exe 956 XFUETCH.exe 956 XFUETCH.exe 1512 GFW.exe 1512 GFW.exe 1212 TQNHLK.exe 1212 TQNHLK.exe 3012 SAPXT.exe 3012 SAPXT.exe 4588 HDZ.exe 4588 HDZ.exe 844 MWJEIHL.exe 844 MWJEIHL.exe 5720 VELRTN.exe 5720 VELRTN.exe 5024 QSP.exe 5024 QSP.exe 724 QVTW.exe 724 QVTW.exe 3676 LIYGTC.exe 3676 LIYGTC.exe 2128 KYJJG.exe 2128 KYJJG.exe 1000 XDJ.exe 1000 XDJ.exe 5924 QZNQWJT.exe 5924 QZNQWJT.exe 6104 QCZU.exe 6104 QCZU.exe 2748 FXIYMLD.exe 2748 FXIYMLD.exe 5980 ASNH.exe 5980 ASNH.exe 3568 KQT.exe 3568 KQT.exe 5568 DLXGR.exe 5568 DLXGR.exe 6064 BEHW.exe 6064 BEHW.exe 3260 LEBBD.exe 3260 LEBBD.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4304 2026-07-14_26abdf6a9d91e28f4a757d136bb31db4_elex_emotet_stop.exe 4304 2026-07-14_26abdf6a9d91e28f4a757d136bb31db4_elex_emotet_stop.exe 1888 KDCAMZD.exe 1888 KDCAMZD.exe 4216 RDSAYNN.exe 4216 RDSAYNN.exe 2516 WJK.exe 2516 WJK.exe 4868 PMOTT.exe 4868 PMOTT.exe 2480 TEXWFC.exe 2480 TEXWFC.exe 2376 XUE.exe 2376 XUE.exe 5852 FAJ.exe 5852 FAJ.exe 3088 YDUGH.exe 3088 YDUGH.exe 4544 RVCRR.exe 4544 RVCRR.exe 4944 UELOYE.exe 4944 UELOYE.exe 6028 YUR.exe 6028 YUR.exe 956 XFUETCH.exe 956 XFUETCH.exe 1512 GFW.exe 1512 GFW.exe 1212 TQNHLK.exe 1212 TQNHLK.exe 3012 SAPXT.exe 3012 SAPXT.exe 4588 HDZ.exe 4588 HDZ.exe 844 MWJEIHL.exe 844 MWJEIHL.exe 5720 VELRTN.exe 5720 VELRTN.exe 5024 QSP.exe 5024 QSP.exe 724 QVTW.exe 724 QVTW.exe 3676 LIYGTC.exe 3676 LIYGTC.exe 2128 KYJJG.exe 2128 KYJJG.exe 1000 XDJ.exe 1000 XDJ.exe 5924 QZNQWJT.exe 5924 QZNQWJT.exe 6104 QCZU.exe 6104 QCZU.exe 2748 FXIYMLD.exe 2748 FXIYMLD.exe 5980 ASNH.exe 5980 ASNH.exe 3568 KQT.exe 3568 KQT.exe 5568 DLXGR.exe 5568 DLXGR.exe 6064 BEHW.exe 6064 BEHW.exe 3260 LEBBD.exe 3260 LEBBD.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4304 wrote to memory of 1056 4304 2026-07-14_26abdf6a9d91e28f4a757d136bb31db4_elex_emotet_stop.exe 88 PID 1056 wrote to memory of 1888 1056 cmd.exe 92 PID 1888 wrote to memory of 4860 1888 KDCAMZD.exe 94 PID 4860 wrote to memory of 4216 4860 cmd.exe 98 PID 4216 wrote to memory of 2364 4216 RDSAYNN.exe 99 PID 2364 wrote to memory of 2516 2364 cmd.exe 103 PID 2516 wrote to memory of 3924 2516 WJK.exe 104 PID 3924 wrote to memory of 4868 3924 cmd.exe 108 PID 4868 wrote to memory of 2992 4868 PMOTT.exe 109 PID 2992 wrote to memory of 2480 2992 cmd.exe 113 PID 2480 wrote to memory of 5948 2480 TEXWFC.exe 114 PID 5948 wrote to memory of 2376 5948 cmd.exe 118 PID 2376 wrote to memory of 1036 2376 XUE.exe 119 PID 1036 wrote to memory of 5852 1036 cmd.exe 123 PID 5852 wrote to memory of 3952 5852 FAJ.exe 124 PID 3952 wrote to memory of 3088 3952 cmd.exe 127 PID 3088 wrote to memory of 5952 3088 YDUGH.exe 129 PID 5952 wrote to memory of 4544 5952 cmd.exe 133 PID 4544 wrote to memory of 4572 4544 RVCRR.exe 134 PID 4572 wrote to memory of 4944 4572 cmd.exe 138 PID 4944 wrote to memory of 1844 4944 UELOYE.exe 139 PID 1844 wrote to memory of 6028 1844 cmd.exe 143 PID 6028 wrote to memory of 2540 6028 YUR.exe 144 PID 2540 wrote to memory of 956 2540 cmd.exe 148 PID 956 wrote to memory of 4340 956 XFUETCH.exe 149 PID 4340 wrote to memory of 1512 4340 cmd.exe 153 PID 1512 wrote to memory of 924 1512 GFW.exe 154 PID 924 wrote to memory of 1212 924 cmd.exe 158 PID 1212 wrote to memory of 1964 1212 TQNHLK.exe 159 PID 1964 wrote to memory of 3012 1964 cmd.exe 163 PID 3012 wrote to memory of 2072 3012 SAPXT.exe 164 PID 2072 wrote to memory of 4588 2072 cmd.exe 168 PID 4588 wrote to memory of 3392 4588 HDZ.exe 169 PID 3392 wrote to memory of 844 3392 cmd.exe 173 PID 844 wrote to memory of 2688 844 MWJEIHL.exe 174 PID 2688 wrote to memory of 5720 2688 cmd.exe 178 PID 5720 wrote to memory of 4312 5720 VELRTN.exe 179 PID 4312 wrote to memory of 5024 4312 cmd.exe 183 PID 5024 wrote to memory of 4960 5024 QSP.exe 184 PID 4960 wrote to memory of 724 4960 cmd.exe 188 PID 724 wrote to memory of 6080 724 QVTW.exe 189 PID 6080 wrote to memory of 3676 6080 cmd.exe 193 PID 3676 wrote to memory of 3492 3676 LIYGTC.exe 194 PID 3492 wrote to memory of 2128 3492 cmd.exe 198 PID 2128 wrote to memory of 3064 2128 KYJJG.exe 199 PID 3064 wrote to memory of 1000 3064 cmd.exe 203 PID 1000 wrote to memory of 3432 1000 XDJ.exe 204 PID 3432 wrote to memory of 5924 3432 cmd.exe 208 PID 5924 wrote to memory of 5592 5924 QZNQWJT.exe 209 PID 5592 wrote to memory of 6104 5592 cmd.exe 213 PID 6104 wrote to memory of 4076 6104 QCZU.exe 214 PID 4076 wrote to memory of 2748 4076 cmd.exe 218 PID 2748 wrote to memory of 5456 2748 FXIYMLD.exe 219 PID 5456 wrote to memory of 5980 5456 cmd.exe 223 PID 5980 wrote to memory of 3444 5980 ASNH.exe 224 PID 3444 wrote to memory of 3568 3444 cmd.exe 228 PID 3568 wrote to memory of 5124 3568 KQT.exe 229 PID 5124 wrote to memory of 5568 5124 cmd.exe 233 PID 5568 wrote to memory of 5020 5568 DLXGR.exe 234 PID 5020 wrote to memory of 6064 5020 cmd.exe 238 PID 6064 wrote to memory of 1192 6064 BEHW.exe 239 PID 1192 wrote to memory of 3260 1192 cmd.exe 243 PID 3260 wrote to memory of 4300 3260 LEBBD.exe 244 PID 4300 wrote to memory of 5088 4300 cmd.exe 248
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-14_26abdf6a9d91e28f4a757d136bb31db4_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-14_26abdf6a9d91e28f4a757d136bb31db4_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KDCAMZD.exe.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\windows\KDCAMZD.exeC:\windows\KDCAMZD.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RDSAYNN.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\windows\RDSAYNN.exeC:\windows\RDSAYNN.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WJK.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\windows\system\WJK.exeC:\windows\system\WJK.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PMOTT.exe.bat" "8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\windows\PMOTT.exeC:\windows\PMOTT.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TEXWFC.exe.bat" "10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\windows\TEXWFC.exeC:\windows\TEXWFC.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XUE.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:5948 -
C:\windows\system\XUE.exeC:\windows\system\XUE.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FAJ.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\windows\system\FAJ.exeC:\windows\system\FAJ.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YDUGH.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\windows\system\YDUGH.exeC:\windows\system\YDUGH.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RVCRR.exe.bat" "18⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5952 -
C:\windows\system\RVCRR.exeC:\windows\system\RVCRR.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UELOYE.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\windows\SysWOW64\UELOYE.exeC:\windows\system32\UELOYE.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YUR.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\windows\YUR.exeC:\windows\YUR.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6028 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XFUETCH.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\windows\SysWOW64\XFUETCH.exeC:\windows\system32\XFUETCH.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GFW.exe.bat" "26⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\windows\SysWOW64\GFW.exeC:\windows\system32\GFW.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TQNHLK.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:924 -
C:\windows\TQNHLK.exeC:\windows\TQNHLK.exe29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SAPXT.exe.bat" "30⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\windows\SAPXT.exeC:\windows\SAPXT.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HDZ.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\windows\HDZ.exeC:\windows\HDZ.exe33⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MWJEIHL.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\windows\MWJEIHL.exeC:\windows\MWJEIHL.exe35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VELRTN.exe.bat" "36⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\windows\system\VELRTN.exeC:\windows\system\VELRTN.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QSP.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\windows\QSP.exeC:\windows\QSP.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QVTW.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\windows\QVTW.exeC:\windows\QVTW.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LIYGTC.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:6080 -
C:\windows\system\LIYGTC.exeC:\windows\system\LIYGTC.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3676 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KYJJG.exe.bat" "44⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\windows\system\KYJJG.exeC:\windows\system\KYJJG.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XDJ.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\windows\system\XDJ.exeC:\windows\system\XDJ.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QZNQWJT.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\windows\QZNQWJT.exeC:\windows\QZNQWJT.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QCZU.exe.bat" "50⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5592 -
C:\windows\SysWOW64\QCZU.exeC:\windows\system32\QCZU.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6104 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FXIYMLD.exe.bat" "52⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\windows\SysWOW64\FXIYMLD.exeC:\windows\system32\FXIYMLD.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ASNH.exe.bat" "54⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5456 -
C:\windows\ASNH.exeC:\windows\ASNH.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KQT.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\windows\system\KQT.exeC:\windows\system\KQT.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DLXGR.exe.bat" "58⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5124 -
C:\windows\SysWOW64\DLXGR.exeC:\windows\system32\DLXGR.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BEHW.exe.bat" "60⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\windows\system\BEHW.exeC:\windows\system\BEHW.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LEBBD.exe.bat" "62⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\windows\system\LEBBD.exeC:\windows\system\LEBBD.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\REJ.exe.bat" "64⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\windows\REJ.exeC:\windows\REJ.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RHVK.exe.bat" "66⤵
- System Location Discovery: System Language Discovery
PID:3104 -
C:\windows\SysWOW64\RHVK.exeC:\windows\system32\RHVK.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5316 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MUSTCN.exe.bat" "68⤵
- System Location Discovery: System Language Discovery
PID:1716 -
C:\windows\SysWOW64\MUSTCN.exeC:\windows\system32\MUSTCN.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XNVMKUH.exe.bat" "70⤵
- System Location Discovery: System Language Discovery
PID:4748 -
C:\windows\SysWOW64\XNVMKUH.exeC:\windows\system32\XNVMKUH.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BVBUX.exe.bat" "72⤵PID:3220
-
C:\windows\BVBUX.exeC:\windows\BVBUX.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2608 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WQGEZNJ.exe.bat" "74⤵PID:1556
-
C:\windows\system\WQGEZNJ.exeC:\windows\system\WQGEZNJ.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JTWUNXF.exe.bat" "76⤵
- System Location Discovery: System Language Discovery
PID:1772 -
C:\windows\system\JTWUNXF.exeC:\windows\system\JTWUNXF.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KWAY.exe.bat" "78⤵
- System Location Discovery: System Language Discovery
PID:5600 -
C:\windows\system\KWAY.exeC:\windows\system\KWAY.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4528 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UUG.exe.bat" "80⤵
- System Location Discovery: System Language Discovery
PID:1344 -
C:\windows\system\UUG.exeC:\windows\system\UUG.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SPFT.exe.bat" "82⤵PID:5772
-
C:\windows\SPFT.exeC:\windows\SPFT.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WXMTRR.exe.bat" "84⤵PID:904
-
C:\windows\system\WXMTRR.exeC:\windows\system\WXMTRR.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WAQXE.exe.bat" "86⤵PID:2548
-
C:\windows\SysWOW64\WAQXE.exeC:\windows\system32\WAQXE.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NOAPME.exe.bat" "88⤵
- System Location Discovery: System Language Discovery
PID:5748 -
C:\windows\SysWOW64\NOAPME.exeC:\windows\system32\NOAPME.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LBZQ.exe.bat" "90⤵PID:2496
-
C:\windows\SysWOW64\LBZQ.exeC:\windows\system32\LBZQ.exe91⤵
- Executes dropped EXE
PID:5012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HMIOFJB.exe.bat" "92⤵PID:3664
-
C:\windows\system\HMIOFJB.exeC:\windows\system\HMIOFJB.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QUK.exe.bat" "94⤵
- System Location Discovery: System Language Discovery
PID:4408 -
C:\windows\SysWOW64\QUK.exeC:\windows\system32\QUK.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UCQBVHZ.exe.bat" "96⤵
- System Location Discovery: System Language Discovery
PID:5556 -
C:\windows\system\UCQBVHZ.exeC:\windows\system\UCQBVHZ.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VFCX.exe.bat" "98⤵PID:2952
-
C:\windows\system\VFCX.exeC:\windows\system\VFCX.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YNJXNHW.exe.bat" "100⤵PID:4424
-
C:\windows\SysWOW64\YNJXNHW.exeC:\windows\system32\YNJXNHW.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MTJJW.exe.bat" "102⤵PID:4428
-
C:\windows\MTJJW.exeC:\windows\MTJJW.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZWRID.exe.bat" "104⤵PID:3252
-
C:\windows\ZWRID.exeC:\windows\ZWRID.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1020 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QETNOB.exe.bat" "106⤵PID:4500
-
C:\windows\QETNOB.exeC:\windows\QETNOB.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GZKZ.exe.bat" "108⤵PID:2696
-
C:\windows\system\GZKZ.exeC:\windows\system\GZKZ.exe109⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NPL.exe.bat" "110⤵
- System Location Discovery: System Language Discovery
PID:1372 -
C:\windows\NPL.exeC:\windows\NPL.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZFSYS.exe.bat" "112⤵PID:5044
-
C:\windows\SysWOW64\ZFSYS.exeC:\windows\system32\ZFSYS.exe113⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4676 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IFUDVZ.exe.bat" "114⤵PID:4420
-
C:\windows\IFUDVZ.exeC:\windows\IFUDVZ.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XAEI.exe.bat" "116⤵PID:3484
-
C:\windows\SysWOW64\XAEI.exeC:\windows\system32\XAEI.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EWDJL.exe.bat" "118⤵PID:2788
-
C:\windows\SysWOW64\EWDJL.exeC:\windows\system32\EWDJL.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RHLHZ.exe.bat" "120⤵PID:5540
-
C:\windows\system\RHLHZ.exeC:\windows\system\RHLHZ.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4708
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-