Analysis
- max time kernel
71s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
15/07/2026, 10:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-15_3867149dd2db1cff0bc37b76981062ed_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-15_3867149dd2db1cff0bc37b76981062ed_elex_emotet_stop.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 2026-07-15_3867149dd2db1cff0bc37b76981062ed_elex_emotet_stop.exe
- Size 289KB
- Sample260715-mcph7sds31
- SHA256 c887f98b65db8125920bc4ba3b1ad70fe40363a4c769b797776b20ece6de836c
- MD5 3867149dd2db1cff0bc37b76981062ed
- SHA1 11a95c6e88de27a5056005ed6912042efbf3f012
- SHA512 e36757aca8b334794557613bc00b5205225527232ab08a247f6100589bac465610dd56e72205aebd366d423cc75f193ea6021b2c29dbef2144c900f5eee98f0b
- SSDEEP 6144:RlZtbLWIgd1LZ9oECZbxlUS+LO5kECzJLaQVbU5:fLWI09QZb6LO5klJLJbU5
- TLSH T1BB549E2236C2C133D5A3027149E6C7A9777ABCB1573686CB7BC4374D2A72AE58B35381
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2500 DAMGCC.exe 2720 IWEGML.exe 5196 LJVPFXQ.exe 1224 JUYFOL.exe 4404 INBVO.exe 2944 JIFRCHK.exe 5836 WSVPQSG.exe 5100 EYAWBQB.exe 1108 IOOW.exe 708 HZR.exe 5924 JWXHD.exe 1388 TUKBK.exe 3596 BAPHV.exe 3016 DYQCT.exe 5588 QIMI.exe 5108 QTVKMW.exe 1564 SROET.exe 2704 RJXFGXM.exe 2880 TZQZFU.exe 1492 ZZY.exe 3628 NFGZYAF.exe 5684 RLQOOVI.exe 2448 BLS.exe 2364 EBYBDL.exe 4504 OZMVL.exe 1804 EPNNSPW.exe 3484 XHUYJPE.exe 2736 XNVMKUH.exe 3464 JDOM.exe 3968 UWRFG.exe 3960 NRUB.exe 5568 OUYFZT.exe 3300 ZMOQIU.exe 4152 APS.exe 4620 GKDM.exe 2924 AYIWEH.exe 3224 ZJL.exe 4604 SJS.exe 5068 WRHXIG.exe 4692 KPHI.exe 2868 WFNQ.exe 616 DVOID.exe 3368 BLI.exe 3612 XRIW.exe 5208 KBQNORU.exe 4476 TCS.exe 2260 UFWWFMF.exe 2984 WCJQM.exe 4636 XYN.exe 2460 ZVTGHT.exe 2400 LLA.exe 1204 FZEYW.exe 4512 EJPO.exe 4932 XMT.exe 4732 BUAJW.exe 3616 SDCXAFX.exe 5176 HYLBT.exe 6116 HDLPU.exe 5060 LTS.exe 3804 CUUCKU.exe 3340 ZZESA.exe 1736 TVJBKP.exe 5964 SFUJL.exe 5936 CGOWWBG.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\XYN.exe.bat WCJQM.exe File created C:\windows\SysWOW64\HDLPU.exe HYLBT.exe File created C:\windows\SysWOW64\EXETRBV.exe.bat GBFSMYG.exe File created C:\windows\SysWOW64\KRFA.exe WQHSR.exe File opened for modification C:\windows\SysWOW64\XNVMKUH.exe XHUYJPE.exe File created C:\windows\SysWOW64\KBQNORU.exe XRIW.exe File opened for modification C:\windows\SysWOW64\KBQNORU.exe XRIW.exe File created C:\windows\SysWOW64\FXVN.exe.bat LKRWGRT.exe File created C:\windows\SysWOW64\IYFDD.exe EIY.exe File opened for modification C:\windows\SysWOW64\JTRZ.exe IYFDD.exe File created C:\windows\SysWOW64\IFKBV.exe.bat EXETRBV.exe File created C:\windows\SysWOW64\UFWWFMF.exe.bat TCS.exe File created C:\windows\SysWOW64\JUYFOL.exe.bat LJVPFXQ.exe File created C:\windows\SysWOW64\WSVPQSG.exe JIFRCHK.exe File created C:\windows\SysWOW64\TZQZFU.exe RJXFGXM.exe File opened for modification C:\windows\SysWOW64\TZQZFU.exe RJXFGXM.exe File created C:\windows\SysWOW64\OZMVL.exe EBYBDL.exe File created C:\windows\SysWOW64\EPNNSPW.exe.bat OZMVL.exe File created C:\windows\SysWOW64\WFNQ.exe KPHI.exe File created C:\windows\SysWOW64\INBVO.exe JUYFOL.exe File opened for modification C:\windows\SysWOW64\INBVO.exe JUYFOL.exe File opened for modification C:\windows\SysWOW64\OZMVL.exe EBYBDL.exe File opened for modification C:\windows\SysWOW64\TCS.exe KBQNORU.exe File opened for modification C:\windows\SysWOW64\LLA.exe ZVTGHT.exe File created C:\windows\SysWOW64\DVOID.exe WFNQ.exe File opened for modification C:\windows\SysWOW64\HDLPU.exe HYLBT.exe File opened for modification C:\windows\SysWOW64\CUUCKU.exe LTS.exe File opened for modification C:\windows\SysWOW64\NRUB.exe UWRFG.exe File created C:\windows\SysWOW64\TCS.exe.bat KBQNORU.exe File created C:\windows\SysWOW64\VUQEZV.exe PTI.exe File created C:\windows\SysWOW64\LKRWGRT.exe VUQEZV.exe File opened for modification C:\windows\SysWOW64\LKRWGRT.exe VUQEZV.exe File opened for modification C:\windows\SysWOW64\FXVN.exe LKRWGRT.exe File opened for modification C:\windows\SysWOW64\IFKBV.exe EXETRBV.exe File opened for modification C:\windows\SysWOW64\XYN.exe WCJQM.exe File created C:\windows\SysWOW64\NRUB.exe UWRFG.exe File created C:\windows\SysWOW64\EBYBDL.exe BLS.exe File created C:\windows\SysWOW64\NRUB.exe.bat UWRFG.exe File created C:\windows\SysWOW64\DVOID.exe.bat WFNQ.exe File created C:\windows\SysWOW64\LLA.exe.bat ZVTGHT.exe File created C:\windows\SysWOW64\TVJBKP.exe.bat ZZESA.exe File opened for modification C:\windows\SysWOW64\KRFA.exe WQHSR.exe File opened for modification C:\windows\SysWOW64\WSVPQSG.exe JIFRCHK.exe File created C:\windows\SysWOW64\XYN.exe WCJQM.exe File created C:\windows\SysWOW64\HDLPU.exe.bat HYLBT.exe File opened for modification C:\windows\SysWOW64\EIY.exe FXVN.exe File created C:\windows\SysWOW64\TZQZFU.exe.bat RJXFGXM.exe File created C:\windows\SysWOW64\RLQOOVI.exe NFGZYAF.exe File opened for modification C:\windows\SysWOW64\GKDM.exe APS.exe File opened for modification C:\windows\SysWOW64\WFNQ.exe KPHI.exe File created C:\windows\SysWOW64\LLA.exe ZVTGHT.exe File opened for modification C:\windows\SysWOW64\BUAJW.exe XMT.exe File created C:\windows\SysWOW64\CUUCKU.exe LTS.exe File created C:\windows\SysWOW64\JTRZ.exe IYFDD.exe File created C:\windows\SysWOW64\XNVMKUH.exe.bat XHUYJPE.exe File created C:\windows\SysWOW64\LRWTYNK.exe JTRZ.exe File created C:\windows\SysWOW64\KRFA.exe.bat WQHSR.exe File opened for modification C:\windows\SysWOW64\EPNNSPW.exe OZMVL.exe File created C:\windows\SysWOW64\XNVMKUH.exe XHUYJPE.exe File created C:\windows\SysWOW64\GKDM.exe APS.exe File opened for modification C:\windows\SysWOW64\TVJBKP.exe ZZESA.exe File created C:\windows\SysWOW64\VUQEZV.exe.bat PTI.exe File created C:\windows\SysWOW64\ZVTGHT.exe.bat XYN.exe File opened for modification C:\windows\SysWOW64\JUYFOL.exe LJVPFXQ.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\system\BAPHV.exe TUKBK.exe File opened for modification C:\windows\system\EJPO.exe FZEYW.exe File opened for modification C:\windows\system\SFUJL.exe TVJBKP.exe File created C:\windows\OCPKQGN.exe MEKQJYE.exe File created C:\windows\OCPKQGN.exe.bat MEKQJYE.exe File created C:\windows\IWEGML.exe.bat DAMGCC.exe File opened for modification C:\windows\system\EYAWBQB.exe WSVPQSG.exe File created C:\windows\SDCXAFX.exe BUAJW.exe File created C:\windows\ZZESA.exe.bat CUUCKU.exe File opened for modification C:\windows\UDILXA.exe BLAAOZ.exe File opened for modification C:\windows\JIFRCHK.exe INBVO.exe File created C:\windows\XRIW.exe.bat BLI.exe File created C:\windows\BLAAOZ.exe DQBRJ.exe File created C:\windows\IOOW.exe EYAWBQB.exe File created C:\windows\system\QIMI.exe.bat DYQCT.exe File created C:\windows\UWRFG.exe JDOM.exe File opened for modification C:\windows\system\RBFB.exe CGOWWBG.exe File created C:\windows\OFB.exe.bat OCPKQGN.exe File created C:\windows\system\LJVPFXQ.exe.bat IWEGML.exe File created C:\windows\system\BAPHV.exe.bat TUKBK.exe File opened for modification C:\windows\SROET.exe QTVKMW.exe File created C:\windows\RJXFGXM.exe.bat SROET.exe File created C:\windows\system\ZZY.exe.bat TZQZFU.exe File created C:\windows\AYIWEH.exe GKDM.exe File created C:\windows\system\SFUJL.exe.bat TVJBKP.exe File created C:\windows\OFB.exe OCPKQGN.exe File opened for modification C:\windows\IWEGML.exe DAMGCC.exe File opened for modification C:\windows\system\QTVKMW.exe QIMI.exe File created C:\windows\system\XHUYJPE.exe.bat EPNNSPW.exe File created C:\windows\system\OUYFZT.exe NRUB.exe File created C:\windows\system\GBFSMYG.exe.bat LRWTYNK.exe File created C:\windows\DQBRJ.exe.bat IFKBV.exe File opened for modification C:\windows\OCPKQGN.exe MEKQJYE.exe File created C:\windows\JIFRCHK.exe.bat INBVO.exe File created C:\windows\IOOW.exe.bat EYAWBQB.exe File opened for modification C:\windows\system\JWXHD.exe HZR.exe File created C:\windows\system\BLI.exe DVOID.exe File created C:\windows\XRIW.exe BLI.exe File opened for modification C:\windows\system\PTI.exe RBFB.exe File created C:\windows\DQBRJ.exe IFKBV.exe File created C:\windows\UDILXA.exe BLAAOZ.exe File created C:\windows\TUKBK.exe JWXHD.exe File opened for modification C:\windows\WCJQM.exe UFWWFMF.exe File created C:\windows\BLAAOZ.exe.bat DQBRJ.exe File created C:\windows\system\MEKQJYE.exe UDILXA.exe File opened for modification C:\windows\system\MEKQJYE.exe UDILXA.exe File created C:\windows\system\BLS.exe RLQOOVI.exe File opened for modification C:\windows\system\APS.exe ZMOQIU.exe File created C:\windows\KPHI.exe.bat WRHXIG.exe File created C:\windows\WQHSR.exe.bat KAOA.exe File created C:\windows\system\DAMGCC.exe 2026-07-15_3867149dd2db1cff0bc37b76981062ed_elex_emotet_stop.exe File created C:\windows\system\ZZY.exe TZQZFU.exe File created C:\windows\system\APS.exe.bat ZMOQIU.exe File created C:\windows\WCJQM.exe UFWWFMF.exe File created C:\windows\LTS.exe.bat HDLPU.exe File created C:\windows\system\RBFB.exe.bat CGOWWBG.exe File created C:\windows\JIFRCHK.exe INBVO.exe File created C:\windows\system\GBFSMYG.exe LRWTYNK.exe File opened for modification C:\windows\system\UKNBP.exe QCH.exe File created C:\windows\NFGZYAF.exe ZZY.exe File created C:\windows\JDOM.exe XNVMKUH.exe File created C:\windows\system\ZMOQIU.exe OUYFZT.exe File created C:\windows\AYIWEH.exe.bat GKDM.exe File created C:\windows\system\ZJL.exe.bat AYIWEH.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 64 IoCs
pid pid_target Process procid_target 4244 5888 WerFault.exe 86 3384 2500 WerFault.exe 91 5736 2720 WerFault.exe 97 796 5196 WerFault.exe 102 3804 1224 WerFault.exe 107 3200 4404 WerFault.exe 112 1976 2944 WerFault.exe 117 3208 5836 WerFault.exe 122 3688 5100 WerFault.exe 127 3400 1108 WerFault.exe 132 712 708 WerFault.exe 137 5592 5924 WerFault.exe 142 2920 1388 WerFault.exe 147 5864 3596 WerFault.exe 151 5204 3016 WerFault.exe 156 3484 5588 WerFault.exe 162 4220 5108 WerFault.exe 166 2100 1564 WerFault.exe 172 5760 2704 WerFault.exe 177 4400 2880 WerFault.exe 182 4368 1492 WerFault.exe 187 3788 3628 WerFault.exe 192 2624 5684 WerFault.exe 197 5320 2448 WerFault.exe 202 5864 2364 WerFault.exe 207 612 4504 WerFault.exe 212 3648 1804 WerFault.exe 217 1764 3484 WerFault.exe 222 4592 2736 WerFault.exe 227 2744 3464 WerFault.exe 232 1280 3968 WerFault.exe 237 544 3960 WerFault.exe 242 3580 5568 WerFault.exe 247 3044 3300 WerFault.exe 252 5412 4152 WerFault.exe 257 4968 4620 WerFault.exe 262 4648 2924 WerFault.exe 267 3804 3224 WerFault.exe 272 3936 4604 WerFault.exe 277 2380 5068 WerFault.exe 282 6076 4692 WerFault.exe 287 4556 2868 WerFault.exe 292 3132 616 WerFault.exe 297 3944 3368 WerFault.exe 302 5948 3612 WerFault.exe 307 5660 5208 WerFault.exe 312 4364 4476 WerFault.exe 317 4084 2260 WerFault.exe 322 5064 2984 WerFault.exe 327 5252 4636 WerFault.exe 332 2380 2460 WerFault.exe 337 6048 2400 WerFault.exe 342 5472 1204 WerFault.exe 347 1696 4512 WerFault.exe 352 6056 4932 WerFault.exe 357 4520 4732 WerFault.exe 362 2940 3616 WerFault.exe 367 4192 5176 WerFault.exe 372 5044 6116 WerFault.exe 377 5584 5060 WerFault.exe 382 2380 3804 WerFault.exe 387 2124 3340 WerFault.exe 392 1296 1736 WerFault.exe 397 1696 5964 WerFault.exe 402 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KAOA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EPNNSPW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WFNQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IWEGML.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HZR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RJXFGXM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXETRBV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JDOM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BLAAOZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IOOW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DVOID.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AYIWEH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XYN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GBFSMYG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OCPKQGN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JWXHD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XNVMKUH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZJL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MEKQJYE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LJVPFXQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language INBVO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DYQCT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QIMI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TZQZFU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LKRWGRT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DQBRJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EBYBDL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JTRZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EYAWBQB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IFKBV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NFGZYAF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QCH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WSVPQSG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5888 2026-07-15_3867149dd2db1cff0bc37b76981062ed_elex_emotet_stop.exe 5888 2026-07-15_3867149dd2db1cff0bc37b76981062ed_elex_emotet_stop.exe 2500 DAMGCC.exe 2500 DAMGCC.exe 2720 IWEGML.exe 2720 IWEGML.exe 5196 LJVPFXQ.exe 5196 LJVPFXQ.exe 1224 JUYFOL.exe 1224 JUYFOL.exe 4404 INBVO.exe 4404 INBVO.exe 2944 JIFRCHK.exe 2944 JIFRCHK.exe 5836 WSVPQSG.exe 5836 WSVPQSG.exe 5100 EYAWBQB.exe 5100 EYAWBQB.exe 1108 IOOW.exe 1108 IOOW.exe 708 HZR.exe 708 HZR.exe 5924 JWXHD.exe 5924 JWXHD.exe 1388 TUKBK.exe 1388 TUKBK.exe 3596 BAPHV.exe 3596 BAPHV.exe 3016 DYQCT.exe 3016 DYQCT.exe 5588 QIMI.exe 5588 QIMI.exe 5108 QTVKMW.exe 5108 QTVKMW.exe 1564 SROET.exe 1564 SROET.exe 2704 RJXFGXM.exe 2704 RJXFGXM.exe 2880 TZQZFU.exe 2880 TZQZFU.exe 1492 ZZY.exe 1492 ZZY.exe 3628 NFGZYAF.exe 3628 NFGZYAF.exe 5684 RLQOOVI.exe 5684 RLQOOVI.exe 2448 BLS.exe 2448 BLS.exe 2364 EBYBDL.exe 2364 EBYBDL.exe 4504 OZMVL.exe 4504 OZMVL.exe 1804 EPNNSPW.exe 1804 EPNNSPW.exe 3484 XHUYJPE.exe 3484 XHUYJPE.exe 2736 XNVMKUH.exe 2736 XNVMKUH.exe 3464 JDOM.exe 3464 JDOM.exe 3968 UWRFG.exe 3968 UWRFG.exe 3960 NRUB.exe 3960 NRUB.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 5888 2026-07-15_3867149dd2db1cff0bc37b76981062ed_elex_emotet_stop.exe 5888 2026-07-15_3867149dd2db1cff0bc37b76981062ed_elex_emotet_stop.exe 2500 DAMGCC.exe 2500 DAMGCC.exe 2720 IWEGML.exe 2720 IWEGML.exe 5196 LJVPFXQ.exe 5196 LJVPFXQ.exe 1224 JUYFOL.exe 1224 JUYFOL.exe 4404 INBVO.exe 4404 INBVO.exe 2944 JIFRCHK.exe 2944 JIFRCHK.exe 5836 WSVPQSG.exe 5836 WSVPQSG.exe 5100 EYAWBQB.exe 5100 EYAWBQB.exe 1108 IOOW.exe 1108 IOOW.exe 708 HZR.exe 708 HZR.exe 5924 JWXHD.exe 5924 JWXHD.exe 1388 TUKBK.exe 1388 TUKBK.exe 3596 BAPHV.exe 3596 BAPHV.exe 3016 DYQCT.exe 3016 DYQCT.exe 5588 QIMI.exe 5588 QIMI.exe 5108 QTVKMW.exe 5108 QTVKMW.exe 1564 SROET.exe 1564 SROET.exe 2704 RJXFGXM.exe 2704 RJXFGXM.exe 2880 TZQZFU.exe 2880 TZQZFU.exe 1492 ZZY.exe 1492 ZZY.exe 3628 NFGZYAF.exe 3628 NFGZYAF.exe 5684 RLQOOVI.exe 5684 RLQOOVI.exe 2448 BLS.exe 2448 BLS.exe 2364 EBYBDL.exe 2364 EBYBDL.exe 4504 OZMVL.exe 4504 OZMVL.exe 1804 EPNNSPW.exe 1804 EPNNSPW.exe 3484 XHUYJPE.exe 3484 XHUYJPE.exe 2736 XNVMKUH.exe 2736 XNVMKUH.exe 3464 JDOM.exe 3464 JDOM.exe 3968 UWRFG.exe 3968 UWRFG.exe 3960 NRUB.exe 3960 NRUB.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5888 wrote to memory of 3348 5888 2026-07-15_3867149dd2db1cff0bc37b76981062ed_elex_emotet_stop.exe 87 PID 3348 wrote to memory of 2500 3348 cmd.exe 91 PID 2500 wrote to memory of 620 2500 DAMGCC.exe 93 PID 620 wrote to memory of 2720 620 cmd.exe 97 PID 2720 wrote to memory of 260 2720 IWEGML.exe 98 PID 260 wrote to memory of 5196 260 cmd.exe 102 PID 5196 wrote to memory of 1872 5196 LJVPFXQ.exe 103 PID 1872 wrote to memory of 1224 1872 cmd.exe 107 PID 1224 wrote to memory of 1812 1224 JUYFOL.exe 108 PID 1812 wrote to memory of 4404 1812 cmd.exe 112 PID 4404 wrote to memory of 3920 4404 INBVO.exe 113 PID 3920 wrote to memory of 2944 3920 cmd.exe 117 PID 2944 wrote to memory of 2656 2944 JIFRCHK.exe 118 PID 2656 wrote to memory of 5836 2656 cmd.exe 122 PID 5836 wrote to memory of 4116 5836 WSVPQSG.exe 123 PID 4116 wrote to memory of 5100 4116 cmd.exe 127 PID 5100 wrote to memory of 716 5100 EYAWBQB.exe 128 PID 716 wrote to memory of 1108 716 cmd.exe 132 PID 1108 wrote to memory of 2432 1108 IOOW.exe 133 PID 2432 wrote to memory of 708 2432 cmd.exe 137 PID 708 wrote to memory of 3952 708 HZR.exe 138 PID 3952 wrote to memory of 5924 3952 cmd.exe 142 PID 5924 wrote to memory of 1340 5924 JWXHD.exe 143 PID 1340 wrote to memory of 1388 1340 cmd.exe 147 PID 1388 wrote to memory of 4788 1388 TUKBK.exe 148 PID 4788 wrote to memory of 3596 4788 cmd.exe 151 PID 3596 wrote to memory of 5552 3596 BAPHV.exe 153 PID 5552 wrote to memory of 3016 5552 cmd.exe 156 PID 3016 wrote to memory of 3496 3016 DYQCT.exe 158 PID 3496 wrote to memory of 5588 3496 cmd.exe 162 PID 5588 wrote to memory of 4120 5588 QIMI.exe 163 PID 4120 wrote to memory of 5108 4120 cmd.exe 166 PID 5108 wrote to memory of 3404 5108 QTVKMW.exe 168 PID 3404 wrote to memory of 1564 3404 cmd.exe 172 PID 1564 wrote to memory of 1252 1564 SROET.exe 173 PID 1252 wrote to memory of 2704 1252 cmd.exe 177 PID 2704 wrote to memory of 3364 2704 RJXFGXM.exe 178 PID 3364 wrote to memory of 2880 3364 cmd.exe 182 PID 2880 wrote to memory of 1144 2880 TZQZFU.exe 183 PID 1144 wrote to memory of 1492 1144 cmd.exe 187 PID 1492 wrote to memory of 4360 1492 ZZY.exe 188 PID 4360 wrote to memory of 3628 4360 cmd.exe 192 PID 3628 wrote to memory of 200 3628 NFGZYAF.exe 193 PID 200 wrote to memory of 5684 200 cmd.exe 197 PID 5684 wrote to memory of 1212 5684 RLQOOVI.exe 198 PID 1212 wrote to memory of 2448 1212 cmd.exe 202 PID 2448 wrote to memory of 2340 2448 BLS.exe 203 PID 2340 wrote to memory of 2364 2340 cmd.exe 207 PID 2364 wrote to memory of 2820 2364 EBYBDL.exe 208 PID 2820 wrote to memory of 4504 2820 cmd.exe 212 PID 4504 wrote to memory of 5996 4504 OZMVL.exe 213 PID 5996 wrote to memory of 1804 5996 cmd.exe 217 PID 1804 wrote to memory of 2632 1804 EPNNSPW.exe 218 PID 2632 wrote to memory of 3484 2632 cmd.exe 222 PID 3484 wrote to memory of 3560 3484 XHUYJPE.exe 223 PID 3560 wrote to memory of 2736 3560 cmd.exe 227 PID 2736 wrote to memory of 944 2736 XNVMKUH.exe 228 PID 944 wrote to memory of 3464 944 cmd.exe 232 PID 3464 wrote to memory of 1380 3464 JDOM.exe 233 PID 1380 wrote to memory of 3968 1380 cmd.exe 237 PID 3968 wrote to memory of 1116 3968 UWRFG.exe 238 PID 1116 wrote to memory of 3960 1116 cmd.exe 242 PID 3960 wrote to memory of 2284 3960 NRUB.exe 243 PID 2284 wrote to memory of 5568 2284 cmd.exe 247
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-15_3867149dd2db1cff0bc37b76981062ed_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-15_3867149dd2db1cff0bc37b76981062ed_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DAMGCC.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:3348 -
C:\windows\system\DAMGCC.exeC:\windows\system\DAMGCC.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IWEGML.exe.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:620 -
C:\windows\IWEGML.exeC:\windows\IWEGML.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LJVPFXQ.exe.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:260 -
C:\windows\system\LJVPFXQ.exeC:\windows\system\LJVPFXQ.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5196 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JUYFOL.exe.bat" "8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\windows\SysWOW64\JUYFOL.exeC:\windows\system32\JUYFOL.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\INBVO.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\windows\SysWOW64\INBVO.exeC:\windows\system32\INBVO.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JIFRCHK.exe.bat" "12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\windows\JIFRCHK.exeC:\windows\JIFRCHK.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WSVPQSG.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\windows\SysWOW64\WSVPQSG.exeC:\windows\system32\WSVPQSG.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EYAWBQB.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\windows\system\EYAWBQB.exeC:\windows\system\EYAWBQB.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IOOW.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:716 -
C:\windows\IOOW.exeC:\windows\IOOW.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HZR.exe.bat" "20⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\windows\HZR.exeC:\windows\HZR.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JWXHD.exe.bat" "22⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\windows\system\JWXHD.exeC:\windows\system\JWXHD.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TUKBK.exe.bat" "24⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\windows\TUKBK.exeC:\windows\TUKBK.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BAPHV.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\windows\system\BAPHV.exeC:\windows\system\BAPHV.exe27⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DYQCT.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:5552 -
C:\windows\DYQCT.exeC:\windows\DYQCT.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QIMI.exe.bat" "30⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\windows\system\QIMI.exeC:\windows\system\QIMI.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5588 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QTVKMW.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\windows\system\QTVKMW.exeC:\windows\system\QTVKMW.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SROET.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\windows\SROET.exeC:\windows\SROET.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RJXFGXM.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\windows\RJXFGXM.exeC:\windows\RJXFGXM.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TZQZFU.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\windows\SysWOW64\TZQZFU.exeC:\windows\system32\TZQZFU.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZZY.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\windows\system\ZZY.exeC:\windows\system\ZZY.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NFGZYAF.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\windows\NFGZYAF.exeC:\windows\NFGZYAF.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RLQOOVI.exe.bat" "44⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:200 -
C:\windows\SysWOW64\RLQOOVI.exeC:\windows\system32\RLQOOVI.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5684 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BLS.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\windows\system\BLS.exeC:\windows\system\BLS.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EBYBDL.exe.bat" "48⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\windows\SysWOW64\EBYBDL.exeC:\windows\system32\EBYBDL.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OZMVL.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\windows\SysWOW64\OZMVL.exeC:\windows\system32\OZMVL.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EPNNSPW.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:5996 -
C:\windows\SysWOW64\EPNNSPW.exeC:\windows\system32\EPNNSPW.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XHUYJPE.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\windows\system\XHUYJPE.exeC:\windows\system\XHUYJPE.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XNVMKUH.exe.bat" "56⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3560 -
C:\windows\SysWOW64\XNVMKUH.exeC:\windows\system32\XNVMKUH.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JDOM.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:944 -
C:\windows\JDOM.exeC:\windows\JDOM.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UWRFG.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\windows\UWRFG.exeC:\windows\UWRFG.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NRUB.exe.bat" "62⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\windows\SysWOW64\NRUB.exeC:\windows\system32\NRUB.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OUYFZT.exe.bat" "64⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\windows\system\OUYFZT.exeC:\windows\system\OUYFZT.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZMOQIU.exe.bat" "66⤵PID:5632
-
C:\windows\system\ZMOQIU.exeC:\windows\system\ZMOQIU.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\APS.exe.bat" "68⤵PID:4496
-
C:\windows\system\APS.exeC:\windows\system\APS.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4152 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GKDM.exe.bat" "70⤵PID:3076
-
C:\windows\SysWOW64\GKDM.exeC:\windows\system32\GKDM.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4620 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AYIWEH.exe.bat" "72⤵PID:1528
-
C:\windows\AYIWEH.exeC:\windows\AYIWEH.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZJL.exe.bat" "74⤵
- System Location Discovery: System Language Discovery
PID:6108 -
C:\windows\system\ZJL.exeC:\windows\system\ZJL.exe75⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3224 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SJS.exe.bat" "76⤵
- System Location Discovery: System Language Discovery
PID:4100 -
C:\windows\system\SJS.exeC:\windows\system\SJS.exe77⤵
- Executes dropped EXE
PID:4604 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WRHXIG.exe.bat" "78⤵
- System Location Discovery: System Language Discovery
PID:3856 -
C:\windows\system\WRHXIG.exeC:\windows\system\WRHXIG.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KPHI.exe.bat" "80⤵PID:2840
-
C:\windows\KPHI.exeC:\windows\KPHI.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WFNQ.exe.bat" "82⤵
- System Location Discovery: System Language Discovery
PID:1760 -
C:\windows\SysWOW64\WFNQ.exeC:\windows\system32\WFNQ.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DVOID.exe.bat" "84⤵
- System Location Discovery: System Language Discovery
PID:2776 -
C:\windows\SysWOW64\DVOID.exeC:\windows\system32\DVOID.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BLI.exe.bat" "86⤵PID:2160
-
C:\windows\system\BLI.exeC:\windows\system\BLI.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XRIW.exe.bat" "88⤵PID:2928
-
C:\windows\XRIW.exeC:\windows\XRIW.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KBQNORU.exe.bat" "90⤵
- System Location Discovery: System Language Discovery
PID:4272 -
C:\windows\SysWOW64\KBQNORU.exeC:\windows\system32\KBQNORU.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TCS.exe.bat" "92⤵PID:1908
-
C:\windows\SysWOW64\TCS.exeC:\windows\system32\TCS.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UFWWFMF.exe.bat" "94⤵
- System Location Discovery: System Language Discovery
PID:4796 -
C:\windows\SysWOW64\UFWWFMF.exeC:\windows\system32\UFWWFMF.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WCJQM.exe.bat" "96⤵PID:1484
-
C:\windows\WCJQM.exeC:\windows\WCJQM.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XYN.exe.bat" "98⤵PID:2392
-
C:\windows\SysWOW64\XYN.exeC:\windows\system32\XYN.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4636 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZVTGHT.exe.bat" "100⤵
- System Location Discovery: System Language Discovery
PID:1764 -
C:\windows\SysWOW64\ZVTGHT.exeC:\windows\system32\ZVTGHT.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LLA.exe.bat" "102⤵
- System Location Discovery: System Language Discovery
PID:5096 -
C:\windows\SysWOW64\LLA.exeC:\windows\system32\LLA.exe103⤵
- Executes dropped EXE
PID:2400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FZEYW.exe.bat" "104⤵
- System Location Discovery: System Language Discovery
PID:3020 -
C:\windows\FZEYW.exeC:\windows\FZEYW.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1204 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EJPO.exe.bat" "106⤵PID:5032
-
C:\windows\system\EJPO.exeC:\windows\system\EJPO.exe107⤵
- Executes dropped EXE
PID:4512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XMT.exe.bat" "108⤵PID:5384
-
C:\windows\system\XMT.exeC:\windows\system\XMT.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BUAJW.exe.bat" "110⤵PID:4560
-
C:\windows\SysWOW64\BUAJW.exeC:\windows\system32\BUAJW.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SDCXAFX.exe.bat" "112⤵
- System Location Discovery: System Language Discovery
PID:3384 -
C:\windows\SDCXAFX.exeC:\windows\SDCXAFX.exe113⤵
- Executes dropped EXE
PID:3616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HYLBT.exe.bat" "114⤵PID:4484
-
C:\windows\system\HYLBT.exeC:\windows\system\HYLBT.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5176 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HDLPU.exe.bat" "116⤵
- System Location Discovery: System Language Discovery
PID:3700 -
C:\windows\SysWOW64\HDLPU.exeC:\windows\system32\HDLPU.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LTS.exe.bat" "118⤵PID:300
-
C:\windows\LTS.exeC:\windows\LTS.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CUUCKU.exe.bat" "120⤵PID:932
-
C:\windows\SysWOW64\CUUCKU.exeC:\windows\system32\CUUCKU.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3804
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-