Analysis
- max time kernel
87s - max time network
113s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
15/07/2026, 09:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-15_9327f0353e0e40c1c21ca0e8351c02c6_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-15_9327f0353e0e40c1c21ca0e8351c02c6_elex_emotet_stop.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 2026-07-15_9327f0353e0e40c1c21ca0e8351c02c6_elex_emotet_stop.exe
- Size 208KB
- Sample260715-lprnnagy2k
- SHA256 e84e7f3f814d405bbfb1834da53053156a93d7b9db8f09ae58eacf51598e3355
- MD5 9327f0353e0e40c1c21ca0e8351c02c6
- SHA1 b767ab23948beb8674c3a580b9d290578a7020fb
- SHA512 96554d060cb92ae829df39aeb13d9029822fa22f6827f828f38f4a0591e59fd23e06fc4cf6b2a8ace64887e0d7acf427d08f5be64bdc77602f11803c938caca9
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbclcdL+LOfI4NLthEjQT6E:MlZtbLWIgd1LZ9oECZbclc5+LOQQEj6
- TLSH T14D247D2235D2C073E4B7023188F6C7787BB6BD919B36928B77C03B4D6E715A68A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4480 UJSDPT.exe 2032 BOLYDMR.exe 4132 TWAWQDM.exe 828 ZKZWM.exe 5108 ONJJFTC.exe 2424 SVPJS.exe 5900 BDROVJ.exe 1204 NLY.exe 432 GOKSNRY.exe 5872 OUOYXPT.exe 5368 ZMR.exe 2204 DCYZKP.exe 480 LIYGTC.exe 5924 PQFO.exe 2884 VQMBPP.exe 1736 ZGT.exe 5076 XRWRCNZ.exe 3976 HRYW.exe 3856 WUHJYF.exe 2188 CIGK.exe 5104 RLQOOVI.exe 4472 BLS.exe 4604 STUGV.exe 5664 MHZQFYB.exe 3188 ARHO.exe 2756 LKKZBQ.exe 3392 VIQTJ.exe 1624 BIXHSSO.exe 3100 VVCQ.exe 4720 VBCFE.exe 3804 LWM.exe 2848 RRLS.exe 2144 GMUWMQE.exe 4548 RFX.exe 3312 EQGOBA.exe 4964 OQIT.exe 2880 QOJ.exe 5920 UEQVX.exe 2860 WRUEHMC.exe 4996 REZO.exe 5496 GZJSCZ.exe 4340 KDHN.exe 5768 TQRFSXP.exe 3700 ODWP.exe 5284 FLYUG.exe 3928 SWG.exe 1672 TRKWZUL.exe 2584 CAM.exe 5020 XNRLN.exe 1460 SAWUXSR.exe 2156 OGCR.exe 5868 JTHBP.exe 4820 JWKWURJ.exe 4376 NEREG.exe 5692 IZWORJT.exe 1088 IFOCSWO.exe 1076 GVH.exe 3912 WLIX.exe 1448 QGNGWP.exe 3036 LTS.exe 696 PBYXL.exe 1396 GKA.exe 5280 MKIQ.exe 1508 VKKVJMQ.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\OUOYXPT.exe GOKSNRY.exe File created C:\windows\SysWOW64\OUOYXPT.exe.bat GOKSNRY.exe File created C:\windows\SysWOW64\VQMBPP.exe PQFO.exe File created C:\windows\SysWOW64\MHZQFYB.exe STUGV.exe File opened for modification C:\windows\SysWOW64\QOJ.exe OQIT.exe File created C:\windows\SysWOW64\WLIX.exe.bat GVH.exe File opened for modification C:\windows\SysWOW64\GKA.exe PBYXL.exe File created C:\windows\SysWOW64\SZTKSX.exe HHQSK.exe File created C:\windows\SysWOW64\ARHO.exe MHZQFYB.exe File created C:\windows\SysWOW64\WLIX.exe GVH.exe File created C:\windows\SysWOW64\HPJB.exe JCJ.exe File opened for modification C:\windows\SysWOW64\ILV.exe CKNKHT.exe File created C:\windows\SysWOW64\ILV.exe.bat CKNKHT.exe File created C:\windows\SysWOW64\OGAOJ.exe ZKRKYQZ.exe File created C:\windows\SysWOW64\BLW.exe.bat VLPTQQ.exe File created C:\windows\SysWOW64\YOEMNCZ.exe MYXM.exe File created C:\windows\SysWOW64\OUOYXPT.exe GOKSNRY.exe File opened for modification C:\windows\SysWOW64\HRYW.exe XRWRCNZ.exe File opened for modification C:\windows\SysWOW64\RRLS.exe LWM.exe File created C:\windows\SysWOW64\NEREG.exe.bat JWKWURJ.exe File created C:\windows\SysWOW64\ZLVE.exe HIDD.exe File created C:\windows\SysWOW64\BLW.exe VLPTQQ.exe File created C:\windows\SysWOW64\MHZQFYB.exe.bat STUGV.exe File opened for modification C:\windows\SysWOW64\XNRLN.exe CAM.exe File opened for modification C:\windows\SysWOW64\SAWUXSR.exe XNRLN.exe File created C:\windows\SysWOW64\OGAOJ.exe.bat ZKRKYQZ.exe File created C:\windows\SysWOW64\SMMLGHK.exe GJNQG.exe File created C:\windows\SysWOW64\ONJJFTC.exe ZKZWM.exe File created C:\windows\SysWOW64\ONJJFTC.exe.bat ZKZWM.exe File created C:\windows\SysWOW64\GOKSNRY.exe.bat NLY.exe File created C:\windows\SysWOW64\VIQTJ.exe LKKZBQ.exe File created C:\windows\SysWOW64\JTLZ.exe DTEL.exe File created C:\windows\SysWOW64\ARHO.exe.bat MHZQFYB.exe File created C:\windows\SysWOW64\IZWORJT.exe NEREG.exe File opened for modification C:\windows\SysWOW64\GOKSNRY.exe NLY.exe File opened for modification C:\windows\SysWOW64\WUHJYF.exe HRYW.exe File created C:\windows\SysWOW64\RRLS.exe LWM.exe File created C:\windows\SysWOW64\WRUEHMC.exe UEQVX.exe File opened for modification C:\windows\SysWOW64\XEKRBUX.exe KTCSMSB.exe File opened for modification C:\windows\SysWOW64\WLIX.exe GVH.exe File opened for modification C:\windows\SysWOW64\JTLZ.exe DTEL.exe File created C:\windows\SysWOW64\HCPXUK.exe NPKN.exe File created C:\windows\SysWOW64\IZWORJT.exe.bat NEREG.exe File opened for modification C:\windows\SysWOW64\ZLVE.exe HIDD.exe File opened for modification C:\windows\SysWOW64\HMQNCI.exe SWP.exe File created C:\windows\SysWOW64\JKQPNM.exe FUKP.exe File opened for modification C:\windows\SysWOW64\JKQPNM.exe FUKP.exe File created C:\windows\SysWOW64\NLY.exe BDROVJ.exe File created C:\windows\SysWOW64\VIQTJ.exe.bat LKKZBQ.exe File opened for modification C:\windows\SysWOW64\OGAOJ.exe ZKRKYQZ.exe File created C:\windows\SysWOW64\HMQNCI.exe.bat SWP.exe File created C:\windows\SysWOW64\MYXM.exe SLSCZJO.exe File created C:\windows\SysWOW64\BDROVJ.exe.bat SVPJS.exe File opened for modification C:\windows\SysWOW64\FUKP.exe ERGMW.exe File created C:\windows\SysWOW64\XRWRCNZ.exe.bat ZGT.exe File created C:\windows\SysWOW64\ILV.exe CKNKHT.exe File created C:\windows\SysWOW64\BDROVJ.exe SVPJS.exe File opened for modification C:\windows\SysWOW64\NLY.exe BDROVJ.exe File created C:\windows\SysWOW64\HRYW.exe XRWRCNZ.exe File created C:\windows\SysWOW64\SAWUXSR.exe.bat XNRLN.exe File opened for modification C:\windows\SysWOW64\SMMLGHK.exe GJNQG.exe File opened for modification C:\windows\SysWOW64\TQRFSXP.exe KDHN.exe File created C:\windows\SysWOW64\XNRLN.exe CAM.exe File created C:\windows\SysWOW64\WNOZ.exe.bat VKKVJMQ.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\BXKK.exe.bat QFH.exe File created C:\windows\GVH.exe.bat IFOCSWO.exe File created C:\windows\system\UBIKY.exe.bat LOYSJCD.exe File created C:\windows\system\OHQJJE.exe.bat KRJBFUG.exe File opened for modification C:\windows\QVU.exe OHQJJE.exe File opened for modification C:\windows\KTCSMSB.exe UDBTG.exe File created C:\windows\system\SWP.exe OGAOJ.exe File created C:\windows\system\SWP.exe.bat OGAOJ.exe File created C:\windows\BXKK.exe QFH.exe File created C:\windows\UJSDPT.exe.bat 2026-07-15_9327f0353e0e40c1c21ca0e8351c02c6_elex_emotet_stop.exe File created C:\windows\system\ZKZWM.exe.bat TWAWQDM.exe File opened for modification C:\windows\system\RFX.exe GMUWMQE.exe File created C:\windows\CAM.exe TRKWZUL.exe File created C:\windows\system\IFOCSWO.exe.bat IZWORJT.exe File created C:\windows\system\MKIQ.exe GKA.exe File opened for modification C:\windows\system\MKIQ.exe GKA.exe File created C:\windows\UDBTG.exe QVU.exe File created C:\windows\LWM.exe.bat VBCFE.exe File created C:\windows\EQGOBA.exe RFX.exe File created C:\windows\system\BOLYDMR.exe.bat UJSDPT.exe File opened for modification C:\windows\system\LIYGTC.exe DCYZKP.exe File created C:\windows\GZJSCZ.exe REZO.exe File opened for modification C:\windows\CAM.exe TRKWZUL.exe File created C:\windows\system\MKIQ.exe.bat GKA.exe File created C:\windows\UDBTG.exe.bat QVU.exe File created C:\windows\GMUWMQE.exe RRLS.exe File created C:\windows\system\RFX.exe.bat GMUWMQE.exe File created C:\windows\system\PBYXL.exe LTS.exe File created C:\windows\system\OHQJJE.exe KRJBFUG.exe File created C:\windows\HIDD.exe PFZ.exe File created C:\windows\system\JCJ.exe OGFQPY.exe File created C:\windows\system\NPKN.exe.bat SCNEALU.exe File created C:\windows\system\EXART.exe AHU.exe File opened for modification C:\windows\system\ZGT.exe VQMBPP.exe File opened for modification C:\windows\system\STUGV.exe BLS.exe File opened for modification C:\windows\system\VBCFE.exe VVCQ.exe File opened for modification C:\windows\REZO.exe WRUEHMC.exe File opened for modification C:\windows\UOWNFW.exe WNOZ.exe File created C:\windows\HIDD.exe.bat PFZ.exe File created C:\windows\OGFQPY.exe ZLVE.exe File opened for modification C:\windows\system\ZKRKYQZ.exe HCPXUK.exe File created C:\windows\SVPJS.exe.bat ONJJFTC.exe File opened for modification C:\windows\system\ZMR.exe OUOYXPT.exe File opened for modification C:\windows\BIXHSSO.exe VIQTJ.exe File opened for modification C:\windows\LWM.exe VBCFE.exe File created C:\windows\GMUWMQE.exe.bat RRLS.exe File created C:\windows\system\QGNGWP.exe WLIX.exe File created C:\windows\KTCSMSB.exe.bat UDBTG.exe File created C:\windows\DZKSXYE.exe XEKRBUX.exe File created C:\windows\UJSDPT.exe 2026-07-15_9327f0353e0e40c1c21ca0e8351c02c6_elex_emotet_stop.exe File created C:\windows\system\CIGK.exe.bat WUHJYF.exe File created C:\windows\system\VBCFE.exe.bat VVCQ.exe File created C:\windows\system\VKKVJMQ.exe MKIQ.exe File created C:\windows\system\UBIKY.exe LOYSJCD.exe File created C:\windows\system\NPKN.exe SCNEALU.exe File opened for modification C:\windows\system\VLPTQQ.exe BXKK.exe File opened for modification C:\windows\ZGWQEV.exe BLW.exe File opened for modification C:\windows\EQGOBA.exe RFX.exe File opened for modification C:\windows\KRJBFUG.exe UBIKY.exe File created C:\windows\system\VLPTQQ.exe.bat BXKK.exe File created C:\windows\system\HHQSK.exe.bat DZKSXYE.exe File created C:\windows\system\PFZ.exe SZTKSX.exe File created C:\windows\system\UTCGC.exe ILV.exe File created C:\windows\ZGWQEV.exe.bat BLW.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 64 IoCs
pid pid_target Process procid_target 3268 1464 WerFault.exe 86 4264 4480 WerFault.exe 91 3188 2032 WerFault.exe 97 3056 4132 WerFault.exe 102 1432 828 WerFault.exe 107 5096 5108 WerFault.exe 112 5944 2424 WerFault.exe 117 4720 5900 WerFault.exe 122 3400 1204 WerFault.exe 127 2008 432 WerFault.exe 132 5592 5872 WerFault.exe 137 4604 5368 WerFault.exe 142 5284 2204 WerFault.exe 147 3788 480 WerFault.exe 152 3464 5924 WerFault.exe 157 5464 2884 WerFault.exe 162 4580 1736 WerFault.exe 167 1816 5076 WerFault.exe 172 2540 3976 WerFault.exe 177 6024 3856 WerFault.exe 182 5912 2188 WerFault.exe 187 4796 5104 WerFault.exe 192 1112 4472 WerFault.exe 197 1952 4604 WerFault.exe 202 1076 5664 WerFault.exe 207 5680 3188 WerFault.exe 212 1960 2756 WerFault.exe 217 3820 3392 WerFault.exe 222 2852 1624 WerFault.exe 227 2704 3100 WerFault.exe 232 1840 4720 WerFault.exe 237 2012 3804 WerFault.exe 242 1576 2848 WerFault.exe 247 1132 2144 WerFault.exe 252 4336 4548 WerFault.exe 257 2812 3312 WerFault.exe 262 5116 4964 WerFault.exe 267 692 2880 WerFault.exe 272 1384 5920 WerFault.exe 278 4408 2860 WerFault.exe 283 3076 4996 WerFault.exe 288 4792 5496 WerFault.exe 293 4420 4340 WerFault.exe 298 5688 5768 WerFault.exe 303 2552 3700 WerFault.exe 308 3580 5284 WerFault.exe 313 3896 3928 WerFault.exe 318 1432 1672 WerFault.exe 323 716 2584 WerFault.exe 328 5092 5020 WerFault.exe 333 1300 1460 WerFault.exe 338 3460 2156 WerFault.exe 343 5516 5868 WerFault.exe 348 5980 4820 WerFault.exe 353 4728 4376 WerFault.exe 358 5884 5692 WerFault.exe 363 4636 1088 WerFault.exe 368 3008 1076 WerFault.exe 373 5816 3912 WerFault.exe 378 3568 1448 WerFault.exe 383 1072 3036 WerFault.exe 388 1640 696 WerFault.exe 393 2008 1396 WerFault.exe 398 2904 5280 WerFault.exe 403 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HRYW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ARHO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SWG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OGCR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WNOZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OHQJJE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VVCQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RRLS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UOWNFW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KTCSMSB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NLY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UEQVX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SZTKSX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language STUGV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ODWP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AHU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QFH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YOEMNCZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZLVE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OGFQPY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OGAOJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UBIKY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PFZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IZWORJT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVPJS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BLS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MHZQFYB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VBCFE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAWUXSR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QOJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IFOCSWO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GVH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1464 2026-07-15_9327f0353e0e40c1c21ca0e8351c02c6_elex_emotet_stop.exe 1464 2026-07-15_9327f0353e0e40c1c21ca0e8351c02c6_elex_emotet_stop.exe 4480 UJSDPT.exe 4480 UJSDPT.exe 2032 BOLYDMR.exe 2032 BOLYDMR.exe 4132 TWAWQDM.exe 4132 TWAWQDM.exe 828 ZKZWM.exe 828 ZKZWM.exe 5108 ONJJFTC.exe 5108 ONJJFTC.exe 2424 SVPJS.exe 2424 SVPJS.exe 5900 BDROVJ.exe 5900 BDROVJ.exe 1204 NLY.exe 1204 NLY.exe 432 GOKSNRY.exe 432 GOKSNRY.exe 5872 OUOYXPT.exe 5872 OUOYXPT.exe 5368 ZMR.exe 5368 ZMR.exe 2204 DCYZKP.exe 2204 DCYZKP.exe 480 LIYGTC.exe 480 LIYGTC.exe 5924 PQFO.exe 5924 PQFO.exe 2884 VQMBPP.exe 2884 VQMBPP.exe 1736 ZGT.exe 1736 ZGT.exe 5076 XRWRCNZ.exe 5076 XRWRCNZ.exe 3976 HRYW.exe 3976 HRYW.exe 3856 WUHJYF.exe 3856 WUHJYF.exe 2188 CIGK.exe 2188 CIGK.exe 5104 RLQOOVI.exe 5104 RLQOOVI.exe 4472 BLS.exe 4472 BLS.exe 4604 STUGV.exe 4604 STUGV.exe 5664 MHZQFYB.exe 5664 MHZQFYB.exe 3188 ARHO.exe 3188 ARHO.exe 2756 LKKZBQ.exe 2756 LKKZBQ.exe 3392 VIQTJ.exe 3392 VIQTJ.exe 1624 BIXHSSO.exe 1624 BIXHSSO.exe 3100 VVCQ.exe 3100 VVCQ.exe 4720 VBCFE.exe 4720 VBCFE.exe 3804 LWM.exe 3804 LWM.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1464 2026-07-15_9327f0353e0e40c1c21ca0e8351c02c6_elex_emotet_stop.exe 1464 2026-07-15_9327f0353e0e40c1c21ca0e8351c02c6_elex_emotet_stop.exe 4480 UJSDPT.exe 4480 UJSDPT.exe 2032 BOLYDMR.exe 2032 BOLYDMR.exe 4132 TWAWQDM.exe 4132 TWAWQDM.exe 828 ZKZWM.exe 828 ZKZWM.exe 5108 ONJJFTC.exe 5108 ONJJFTC.exe 2424 SVPJS.exe 2424 SVPJS.exe 5900 BDROVJ.exe 5900 BDROVJ.exe 1204 NLY.exe 1204 NLY.exe 432 GOKSNRY.exe 432 GOKSNRY.exe 5872 OUOYXPT.exe 5872 OUOYXPT.exe 5368 ZMR.exe 5368 ZMR.exe 2204 DCYZKP.exe 2204 DCYZKP.exe 480 LIYGTC.exe 480 LIYGTC.exe 5924 PQFO.exe 5924 PQFO.exe 2884 VQMBPP.exe 2884 VQMBPP.exe 1736 ZGT.exe 1736 ZGT.exe 5076 XRWRCNZ.exe 5076 XRWRCNZ.exe 3976 HRYW.exe 3976 HRYW.exe 3856 WUHJYF.exe 3856 WUHJYF.exe 2188 CIGK.exe 2188 CIGK.exe 5104 RLQOOVI.exe 5104 RLQOOVI.exe 4472 BLS.exe 4472 BLS.exe 4604 STUGV.exe 4604 STUGV.exe 5664 MHZQFYB.exe 5664 MHZQFYB.exe 3188 ARHO.exe 3188 ARHO.exe 2756 LKKZBQ.exe 2756 LKKZBQ.exe 3392 VIQTJ.exe 3392 VIQTJ.exe 1624 BIXHSSO.exe 1624 BIXHSSO.exe 3100 VVCQ.exe 3100 VVCQ.exe 4720 VBCFE.exe 4720 VBCFE.exe 3804 LWM.exe 3804 LWM.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1464 wrote to memory of 1348 1464 2026-07-15_9327f0353e0e40c1c21ca0e8351c02c6_elex_emotet_stop.exe 87 PID 1348 wrote to memory of 4480 1348 cmd.exe 91 PID 4480 wrote to memory of 1920 4480 UJSDPT.exe 93 PID 1920 wrote to memory of 2032 1920 cmd.exe 97 PID 2032 wrote to memory of 3404 2032 BOLYDMR.exe 98 PID 3404 wrote to memory of 4132 3404 cmd.exe 102 PID 4132 wrote to memory of 3344 4132 TWAWQDM.exe 103 PID 3344 wrote to memory of 828 3344 cmd.exe 107 PID 828 wrote to memory of 4932 828 ZKZWM.exe 108 PID 4932 wrote to memory of 5108 4932 cmd.exe 112 PID 5108 wrote to memory of 3196 5108 ONJJFTC.exe 113 PID 3196 wrote to memory of 2424 3196 cmd.exe 117 PID 2424 wrote to memory of 2524 2424 SVPJS.exe 118 PID 2524 wrote to memory of 5900 2524 cmd.exe 122 PID 5900 wrote to memory of 3604 5900 BDROVJ.exe 123 PID 3604 wrote to memory of 1204 3604 cmd.exe 127 PID 1204 wrote to memory of 1224 1204 NLY.exe 128 PID 1224 wrote to memory of 432 1224 cmd.exe 132 PID 432 wrote to memory of 4920 432 GOKSNRY.exe 133 PID 4920 wrote to memory of 5872 4920 cmd.exe 137 PID 5872 wrote to memory of 3784 5872 OUOYXPT.exe 138 PID 3784 wrote to memory of 5368 3784 cmd.exe 142 PID 5368 wrote to memory of 4464 5368 ZMR.exe 143 PID 4464 wrote to memory of 2204 4464 cmd.exe 147 PID 2204 wrote to memory of 4980 2204 DCYZKP.exe 148 PID 4980 wrote to memory of 480 4980 cmd.exe 152 PID 480 wrote to memory of 3408 480 LIYGTC.exe 153 PID 3408 wrote to memory of 5924 3408 cmd.exe 157 PID 5924 wrote to memory of 1968 5924 PQFO.exe 158 PID 1968 wrote to memory of 2884 1968 cmd.exe 162 PID 2884 wrote to memory of 1712 2884 VQMBPP.exe 163 PID 1712 wrote to memory of 1736 1712 cmd.exe 167 PID 1736 wrote to memory of 4412 1736 ZGT.exe 168 PID 4412 wrote to memory of 5076 4412 cmd.exe 172 PID 5076 wrote to memory of 2160 5076 XRWRCNZ.exe 173 PID 2160 wrote to memory of 3976 2160 cmd.exe 177 PID 3976 wrote to memory of 5072 3976 HRYW.exe 178 PID 5072 wrote to memory of 3856 5072 cmd.exe 182 PID 3856 wrote to memory of 4776 3856 WUHJYF.exe 183 PID 4776 wrote to memory of 2188 4776 cmd.exe 187 PID 2188 wrote to memory of 1488 2188 CIGK.exe 188 PID 1488 wrote to memory of 5104 1488 cmd.exe 192 PID 5104 wrote to memory of 4404 5104 RLQOOVI.exe 193 PID 4404 wrote to memory of 4472 4404 cmd.exe 197 PID 4472 wrote to memory of 2580 4472 BLS.exe 198 PID 2580 wrote to memory of 4604 2580 cmd.exe 202 PID 4604 wrote to memory of 4960 4604 STUGV.exe 203 PID 4960 wrote to memory of 5664 4960 cmd.exe 207 PID 5664 wrote to memory of 3216 5664 MHZQFYB.exe 208 PID 3216 wrote to memory of 3188 3216 cmd.exe 212 PID 3188 wrote to memory of 3528 3188 ARHO.exe 213 PID 3528 wrote to memory of 2756 3528 cmd.exe 217 PID 2756 wrote to memory of 2556 2756 LKKZBQ.exe 218 PID 2556 wrote to memory of 3392 2556 cmd.exe 222 PID 3392 wrote to memory of 1084 3392 VIQTJ.exe 223 PID 1084 wrote to memory of 1624 1084 cmd.exe 227 PID 1624 wrote to memory of 2348 1624 BIXHSSO.exe 228 PID 2348 wrote to memory of 3100 2348 cmd.exe 232 PID 3100 wrote to memory of 3576 3100 VVCQ.exe 233 PID 3576 wrote to memory of 4720 3576 cmd.exe 237 PID 4720 wrote to memory of 2724 4720 VBCFE.exe 238 PID 2724 wrote to memory of 3804 2724 cmd.exe 242 PID 3804 wrote to memory of 5024 3804 LWM.exe 243 PID 5024 wrote to memory of 2848 5024 cmd.exe 247
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-15_9327f0353e0e40c1c21ca0e8351c02c6_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-15_9327f0353e0e40c1c21ca0e8351c02c6_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UJSDPT.exe.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\windows\UJSDPT.exeC:\windows\UJSDPT.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BOLYDMR.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\windows\system\BOLYDMR.exeC:\windows\system\BOLYDMR.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TWAWQDM.exe.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\windows\system\TWAWQDM.exeC:\windows\system\TWAWQDM.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZKZWM.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\windows\system\ZKZWM.exeC:\windows\system\ZKZWM.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ONJJFTC.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\windows\SysWOW64\ONJJFTC.exeC:\windows\system32\ONJJFTC.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SVPJS.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\windows\SVPJS.exeC:\windows\SVPJS.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BDROVJ.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\windows\SysWOW64\BDROVJ.exeC:\windows\system32\BDROVJ.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NLY.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\windows\SysWOW64\NLY.exeC:\windows\system32\NLY.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GOKSNRY.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\windows\SysWOW64\GOKSNRY.exeC:\windows\system32\GOKSNRY.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OUOYXPT.exe.bat" "20⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\windows\SysWOW64\OUOYXPT.exeC:\windows\system32\OUOYXPT.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZMR.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:3784 -
C:\windows\system\ZMR.exeC:\windows\system\ZMR.exe23⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DCYZKP.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\windows\system\DCYZKP.exeC:\windows\system\DCYZKP.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LIYGTC.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\windows\system\LIYGTC.exeC:\windows\system\LIYGTC.exe27⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PQFO.exe.bat" "28⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\windows\SysWOW64\PQFO.exeC:\windows\system32\PQFO.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VQMBPP.exe.bat" "30⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\windows\SysWOW64\VQMBPP.exeC:\windows\system32\VQMBPP.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZGT.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\windows\system\ZGT.exeC:\windows\system\ZGT.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XRWRCNZ.exe.bat" "34⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\windows\SysWOW64\XRWRCNZ.exeC:\windows\system32\XRWRCNZ.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HRYW.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\windows\SysWOW64\HRYW.exeC:\windows\system32\HRYW.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WUHJYF.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\windows\SysWOW64\WUHJYF.exeC:\windows\system32\WUHJYF.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CIGK.exe.bat" "40⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\windows\system\CIGK.exeC:\windows\system\CIGK.exe41⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RLQOOVI.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\windows\SysWOW64\RLQOOVI.exeC:\windows\system32\RLQOOVI.exe43⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BLS.exe.bat" "44⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\windows\system\BLS.exeC:\windows\system\BLS.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\STUGV.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\windows\system\STUGV.exeC:\windows\system\STUGV.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MHZQFYB.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\windows\SysWOW64\MHZQFYB.exeC:\windows\system32\MHZQFYB.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5664 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ARHO.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:3216 -
C:\windows\SysWOW64\ARHO.exeC:\windows\system32\ARHO.exe51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LKKZBQ.exe.bat" "52⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\windows\system\LKKZBQ.exeC:\windows\system\LKKZBQ.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VIQTJ.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\windows\SysWOW64\VIQTJ.exeC:\windows\system32\VIQTJ.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BIXHSSO.exe.bat" "56⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\windows\BIXHSSO.exeC:\windows\BIXHSSO.exe57⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VVCQ.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\windows\SysWOW64\VVCQ.exeC:\windows\system32\VVCQ.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VBCFE.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\windows\system\VBCFE.exeC:\windows\system\VBCFE.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LWM.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\windows\LWM.exeC:\windows\LWM.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RRLS.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\windows\SysWOW64\RRLS.exeC:\windows\system32\RRLS.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GMUWMQE.exe.bat" "66⤵PID:5560
-
C:\windows\GMUWMQE.exeC:\windows\GMUWMQE.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RFX.exe.bat" "68⤵PID:2604
-
C:\windows\system\RFX.exeC:\windows\system\RFX.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EQGOBA.exe.bat" "70⤵PID:1848
-
C:\windows\EQGOBA.exeC:\windows\EQGOBA.exe71⤵
- Executes dropped EXE
PID:3312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OQIT.exe.bat" "72⤵PID:2652
-
C:\windows\OQIT.exeC:\windows\OQIT.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QOJ.exe.bat" "74⤵PID:1272
-
C:\windows\SysWOW64\QOJ.exeC:\windows\system32\QOJ.exe75⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UEQVX.exe.bat" "76⤵PID:2272
-
C:\windows\system\UEQVX.exeC:\windows\system\UEQVX.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WRUEHMC.exe.bat" "78⤵PID:1244
-
C:\windows\SysWOW64\WRUEHMC.exeC:\windows\system32\WRUEHMC.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\REZO.exe.bat" "80⤵PID:5276
-
C:\windows\REZO.exeC:\windows\REZO.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GZJSCZ.exe.bat" "82⤵
- System Location Discovery: System Language Discovery
PID:2704 -
C:\windows\GZJSCZ.exeC:\windows\GZJSCZ.exe83⤵
- Executes dropped EXE
PID:5496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KDHN.exe.bat" "84⤵PID:6032
-
C:\windows\system\KDHN.exeC:\windows\system\KDHN.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4340 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TQRFSXP.exe.bat" "86⤵PID:4904
-
C:\windows\SysWOW64\TQRFSXP.exeC:\windows\system32\TQRFSXP.exe87⤵
- Executes dropped EXE
PID:5768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ODWP.exe.bat" "88⤵
- System Location Discovery: System Language Discovery
PID:5168 -
C:\windows\ODWP.exeC:\windows\ODWP.exe89⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FLYUG.exe.bat" "90⤵PID:4504
-
C:\windows\FLYUG.exeC:\windows\FLYUG.exe91⤵
- Executes dropped EXE
PID:5284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SWG.exe.bat" "92⤵
- System Location Discovery: System Language Discovery
PID:4436 -
C:\windows\SysWOW64\SWG.exeC:\windows\system32\SWG.exe93⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TRKWZUL.exe.bat" "94⤵PID:1524
-
C:\windows\SysWOW64\TRKWZUL.exeC:\windows\system32\TRKWZUL.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1672 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CAM.exe.bat" "96⤵PID:4528
-
C:\windows\CAM.exeC:\windows\CAM.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XNRLN.exe.bat" "98⤵PID:2164
-
C:\windows\SysWOW64\XNRLN.exeC:\windows\system32\XNRLN.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5020 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SAWUXSR.exe.bat" "100⤵
- System Location Discovery: System Language Discovery
PID:4864 -
C:\windows\SysWOW64\SAWUXSR.exeC:\windows\system32\SAWUXSR.exe101⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OGCR.exe.bat" "102⤵PID:1976
-
C:\windows\SysWOW64\OGCR.exeC:\windows\system32\OGCR.exe103⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2156 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JTHBP.exe.bat" "104⤵PID:2788
-
C:\windows\JTHBP.exeC:\windows\JTHBP.exe105⤵
- Executes dropped EXE
PID:5868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JWKWURJ.exe.bat" "106⤵
- System Location Discovery: System Language Discovery
PID:5372 -
C:\windows\system\JWKWURJ.exeC:\windows\system\JWKWURJ.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NEREG.exe.bat" "108⤵PID:200
-
C:\windows\SysWOW64\NEREG.exeC:\windows\system32\NEREG.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IZWORJT.exe.bat" "110⤵PID:3764
-
C:\windows\SysWOW64\IZWORJT.exeC:\windows\system32\IZWORJT.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IFOCSWO.exe.bat" "112⤵PID:6100
-
C:\windows\system\IFOCSWO.exeC:\windows\system\IFOCSWO.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GVH.exe.bat" "114⤵PID:3612
-
C:\windows\GVH.exeC:\windows\GVH.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WLIX.exe.bat" "116⤵PID:4640
-
C:\windows\SysWOW64\WLIX.exeC:\windows\system32\WLIX.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QGNGWP.exe.bat" "118⤵
- System Location Discovery: System Language Discovery
PID:3916 -
C:\windows\system\QGNGWP.exeC:\windows\system\QGNGWP.exe119⤵
- Executes dropped EXE
PID:1448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LTS.exe.bat" "120⤵
- System Location Discovery: System Language Discovery
PID:3948 -
C:\windows\LTS.exeC:\windows\LTS.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3036
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-