Analysis
- max time kernel
82s - max time network
110s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
15/07/2026, 10:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-15_0673ddb739d5b53d42816b97a4d6688c_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-15_0673ddb739d5b53d42816b97a4d6688c_elex_emotet_stop.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 2026-07-15_0673ddb739d5b53d42816b97a4d6688c_elex_emotet_stop.exe
- Size 448KB
- Sample260715-mphanadw7w
- SHA256 a1da4a6fa049411d722e2dc2f7d9f4558d7568bfcd2c860abcfd8f92deb111e6
- MD5 0673ddb739d5b53d42816b97a4d6688c
- SHA1 1b88276b6e89fccf6d320ab25b019657db4e294e
- SHA512 ba314c26fca3645b5353d0a796ffede83bffde0faed925b222bef59974d54534662d4684e869e30bfeb29490a874f664c511c46ec534652c48660939c9e4a598
- SSDEEP 6144:TlZtbLWIgd1LZ9oECZbxlUS+LOSkEjiPISUOgW9X+hOGzC/NM:RLWI09QZb6LOSkmZzcukG2/
- TLSH T1F4A49F20B9D58673E2630135689AF1A4B3BABCA0F765C28B3158B71C2773B90173E75D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1392 TXTZL.exe 612 ACN.exe 1084 OYYNGKJ.exe 6140 FGNLSBD.exe 2080 XGB.exe 4680 GODVJQ.exe 5832 ZHKGSR.exe 1544 PXLFZEF.exe 3452 MYVICI.exe 1536 ZAEGRT.exe 2652 QJSEDCE.exe 5476 TWX.exe 4960 KHADWQP.exe 4144 ZXJCDD.exe 252 HKNJF.exe 2916 CNE.exe 4600 KDFZAIS.exe 4668 FONYP.exe 4292 QGDJY.exe 5508 LCHSIMK.exe 4368 ASI.exe 2348 IXN.exe 3016 ZYPDDD.exe 1980 DOW.exe 2688 TJFQAI.exe 4944 IZO.exe 3048 BCSLMT.exe 2108 BFW.exe 3092 WSBQC.exe 4644 LNK.exe 4380 LTKJ.exe 5872 GGHAHJ.exe 1876 LGP.exe 3220 RHWBZ.exe 2808 RUWQAS.exe 3460 BSCCQ.exe 3248 UNGGVQX.exe 5992 PILP.exe 1212 ZGY.exe 4068 TTDTX.exe 1484 DRJ.exe 4488 OKMY.exe 5772 SSSGZH.exe 3864 CAU.exe 5788 MYAGKUH.exe 2560 BTJKD.exe 1384 BYKYFU.exe 1188 VMOIPUZ.exe 3152 QHTR.exe 716 CPAZDMC.exe 1580 GFGZ.exe 2720 PFIETCA.exe 3848 ZDOZI.exe 3100 UQTILKX.exe 4828 OEY.exe 2260 YMAFYHO.exe 1408 PZKXOEC.exe 3640 ASNH.exe 2112 LKIAF.exe 3576 XDLTFI.exe 4132 HBRN.exe 2456 LJFNHJ.exe 5692 WBAGHQA.exe 6112 OEEKUG.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\JTK.exe.bat DYLBH.exe File opened for modification C:\windows\SysWOW64\MVU.exe XADPX.exe File created C:\windows\SysWOW64\BFXDKTG.exe.bat GUGE.exe File opened for modification C:\windows\SysWOW64\XWCD.exe XRCO.exe File opened for modification C:\windows\SysWOW64\VMOIPUZ.exe BYKYFU.exe File opened for modification C:\windows\SysWOW64\PFIETCA.exe GFGZ.exe File created C:\windows\SysWOW64\IAZP.exe NEUGEMK.exe File opened for modification C:\windows\SysWOW64\HUIX.exe XWCD.exe File opened for modification C:\windows\SysWOW64\ZYPDDD.exe IXN.exe File created C:\windows\SysWOW64\ZXJCDD.exe.bat KHADWQP.exe File created C:\windows\SysWOW64\FONYP.exe KDFZAIS.exe File opened for modification C:\windows\SysWOW64\FONYP.exe KDFZAIS.exe File opened for modification C:\windows\SysWOW64\IXN.exe ASI.exe File created C:\windows\SysWOW64\IXN.exe.bat ASI.exe File created C:\windows\SysWOW64\PZKXOEC.exe.bat YMAFYHO.exe File opened for modification C:\windows\SysWOW64\NEUGEMK.exe LRQWT.exe File created C:\windows\SysWOW64\QGDJY.exe.bat FONYP.exe File created C:\windows\SysWOW64\ASI.exe LCHSIMK.exe File opened for modification C:\windows\SysWOW64\GGHAHJ.exe LTKJ.exe File created C:\windows\SysWOW64\PFIETCA.exe.bat GFGZ.exe File opened for modification C:\windows\SysWOW64\XDLTFI.exe LKIAF.exe File opened for modification C:\windows\SysWOW64\JTK.exe DYLBH.exe File created C:\windows\SysWOW64\CJUCI.exe.bat LZR.exe File created C:\windows\SysWOW64\XULAW.exe CJUCI.exe File created C:\windows\SysWOW64\ZXJCDD.exe KHADWQP.exe File created C:\windows\SysWOW64\ASI.exe.bat LCHSIMK.exe File created C:\windows\SysWOW64\IXN.exe ASI.exe File created C:\windows\SysWOW64\PILP.exe UNGGVQX.exe File created C:\windows\SysWOW64\IAZP.exe.bat NEUGEMK.exe File opened for modification C:\windows\SysWOW64\AJMEO.exe SDMQM.exe File created C:\windows\SysWOW64\YBXKZ.exe.bat GYU.exe File created C:\windows\SysWOW64\ZYPDDD.exe IXN.exe File created C:\windows\SysWOW64\BSCCQ.exe.bat RUWQAS.exe File created C:\windows\SysWOW64\NEUGEMK.exe LRQWT.exe File created C:\windows\SysWOW64\CJUCI.exe LZR.exe File created C:\windows\SysWOW64\HJEON.exe.bat TEY.exe File created C:\windows\SysWOW64\AJMEO.exe SDMQM.exe File created C:\windows\SysWOW64\AJMEO.exe.bat SDMQM.exe File created C:\windows\SysWOW64\XWCD.exe.bat XRCO.exe File created C:\windows\SysWOW64\PZKXOEC.exe YMAFYHO.exe File opened for modification C:\windows\SysWOW64\XADPX.exe XULAW.exe File created C:\windows\SysWOW64\HUIX.exe XWCD.exe File opened for modification C:\windows\SysWOW64\GODVJQ.exe XGB.exe File created C:\windows\SysWOW64\GODVJQ.exe.bat XGB.exe File opened for modification C:\windows\SysWOW64\ZHKGSR.exe GODVJQ.exe File created C:\windows\SysWOW64\FONYP.exe.bat KDFZAIS.exe File opened for modification C:\windows\SysWOW64\QGDJY.exe FONYP.exe File opened for modification C:\windows\SysWOW64\PILP.exe UNGGVQX.exe File created C:\windows\SysWOW64\HJEON.exe TEY.exe File opened for modification C:\windows\SysWOW64\LJWOCE.exe JLQUMWS.exe File opened for modification C:\windows\SysWOW64\ASI.exe LCHSIMK.exe File created C:\windows\SysWOW64\RUWQAS.exe.bat RHWBZ.exe File created C:\windows\SysWOW64\VMOIPUZ.exe BYKYFU.exe File created C:\windows\SysWOW64\WBAGHQA.exe.bat LJFNHJ.exe File created C:\windows\SysWOW64\JTK.exe DYLBH.exe File opened for modification C:\windows\SysWOW64\IAZP.exe NEUGEMK.exe File created C:\windows\SysWOW64\GAHDXO.exe.bat IAZP.exe File created C:\windows\SysWOW64\XULAW.exe.bat CJUCI.exe File created C:\windows\SysWOW64\ZYPDDD.exe.bat IXN.exe File opened for modification C:\windows\SysWOW64\GAHDXO.exe IAZP.exe File opened for modification C:\windows\SysWOW64\XULAW.exe CJUCI.exe File created C:\windows\SysWOW64\XADPX.exe XULAW.exe File opened for modification C:\windows\SysWOW64\IUATOE.exe BER.exe File created C:\windows\SysWOW64\LJWOCE.exe JLQUMWS.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\SSSGZH.exe.bat OKMY.exe File created C:\windows\system\OYYNGKJ.exe.bat ACN.exe File created C:\windows\system\SSSGZH.exe OKMY.exe File created C:\windows\system\BYKYFU.exe.bat BTJKD.exe File opened for modification C:\windows\system\ODBXOOO.exe EDZKLR.exe File created C:\windows\system\SDMQM.exe UNBN.exe File created C:\windows\system\LTKJ.exe.bat LNK.exe File created C:\windows\system\OEY.exe.bat UQTILKX.exe File opened for modification C:\windows\system\HBRN.exe XDLTFI.exe File opened for modification C:\windows\LJFNHJ.exe HBRN.exe File created C:\windows\TEY.exe BDWMDVL.exe File created C:\windows\BER.exe PMW.exe File created C:\windows\BER.exe.bat PMW.exe File created C:\windows\DLIGD.exe OVH.exe File opened for modification C:\windows\system\KHADWQP.exe TWX.exe File created C:\windows\UNGGVQX.exe BSCCQ.exe File created C:\windows\system\GFGZ.exe.bat CPAZDMC.exe File opened for modification C:\windows\system\JSJ.exe OEEKUG.exe File opened for modification C:\windows\ZSCWXVP.exe GAHDXO.exe File opened for modification C:\windows\system\SDMQM.exe UNBN.exe File opened for modification C:\windows\MYAGKUH.exe CAU.exe File created C:\windows\system\BYKYFU.exe BTJKD.exe File opened for modification C:\windows\system\CPAZDMC.exe QHTR.exe File created C:\windows\system\HBRN.exe XDLTFI.exe File created C:\windows\system\JSJ.exe.bat OEEKUG.exe File created C:\windows\ZSCWXVP.exe.bat GAHDXO.exe File created C:\windows\system\LZR.exe.bat DGJKL.exe File opened for modification C:\windows\PMW.exe AJMEO.exe File created C:\windows\system\QJSEDCE.exe.bat ZAEGRT.exe File created C:\windows\system\HKNJF.exe ZXJCDD.exe File created C:\windows\system\OKMY.exe DRJ.exe File created C:\windows\system\CPAZDMC.exe.bat QHTR.exe File created C:\windows\system\GFGZ.exe CPAZDMC.exe File opened for modification C:\windows\system\LRQWT.exe JTK.exe File opened for modification C:\windows\system\OVH.exe IUATOE.exe File created C:\windows\system\RHWBZ.exe.bat LGP.exe File created C:\windows\ZGY.exe.bat PILP.exe File created C:\windows\system\BTJKD.exe.bat MYAGKUH.exe File created C:\windows\UQTILKX.exe ZDOZI.exe File created C:\windows\system\OEEKUG.exe WBAGHQA.exe File opened for modification C:\windows\MYVICI.exe PXLFZEF.exe File created C:\windows\system\QJSEDCE.exe ZAEGRT.exe File created C:\windows\IZO.exe.bat TJFQAI.exe File created C:\windows\DGJKL.exe UGHF.exe File created C:\windows\GYU.exe WPSBIWJ.exe File opened for modification C:\windows\UNGGVQX.exe BSCCQ.exe File created C:\windows\system\DRJ.exe TTDTX.exe File created C:\windows\system\DRJ.exe.bat TTDTX.exe File created C:\windows\system\ODBXOOO.exe.bat EDZKLR.exe File created C:\windows\system\DYLBH.exe.bat ODBXOOO.exe File created C:\windows\system\ZAEGRT.exe MYVICI.exe File opened for modification C:\windows\system\ZAEGRT.exe MYVICI.exe File opened for modification C:\windows\system\TWX.exe QJSEDCE.exe File created C:\windows\DOW.exe ZYPDDD.exe File created C:\windows\LNK.exe WSBQC.exe File created C:\windows\JAS.exe.bat MVU.exe File opened for modification C:\windows\ZAWEPWW.exe BFXDKTG.exe File created C:\windows\PMW.exe AJMEO.exe File created C:\windows\ACN.exe TXTZL.exe File created C:\windows\system\FGNLSBD.exe.bat OYYNGKJ.exe File created C:\windows\system\PXLFZEF.exe.bat ZHKGSR.exe File created C:\windows\MYVICI.exe PXLFZEF.exe File created C:\windows\system\KHADWQP.exe.bat TWX.exe File opened for modification C:\windows\system\HKNJF.exe ZXJCDD.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 64 IoCs
pid pid_target Process procid_target 2800 1712 WerFault.exe 86 3248 1392 WerFault.exe 91 1648 612 WerFault.exe 97 3372 1084 WerFault.exe 102 4588 6140 WerFault.exe 107 580 2080 WerFault.exe 112 3028 4680 WerFault.exe 117 5724 5832 WerFault.exe 122 2520 1544 WerFault.exe 127 4888 3452 WerFault.exe 132 4332 1536 WerFault.exe 137 2700 2652 WerFault.exe 142 4880 5476 WerFault.exe 147 1320 4960 WerFault.exe 152 5916 4144 WerFault.exe 157 2948 252 WerFault.exe 162 1268 2916 WerFault.exe 167 4156 4600 WerFault.exe 172 1604 4668 WerFault.exe 177 1804 4292 WerFault.exe 182 5824 5508 WerFault.exe 187 2160 4368 WerFault.exe 192 5320 2348 WerFault.exe 197 5324 3016 WerFault.exe 202 960 1980 WerFault.exe 207 2096 2688 WerFault.exe 212 1400 4944 WerFault.exe 217 2424 3048 WerFault.exe 222 5096 2108 WerFault.exe 227 4416 3092 WerFault.exe 232 1772 4644 WerFault.exe 237 2504 4380 WerFault.exe 242 4716 5872 WerFault.exe 247 1196 1876 WerFault.exe 252 4888 3220 WerFault.exe 257 2708 2808 WerFault.exe 262 3324 3460 WerFault.exe 268 1016 3248 WerFault.exe 273 2736 5992 WerFault.exe 278 1740 1212 WerFault.exe 283 5844 4068 WerFault.exe 288 2480 1484 WerFault.exe 293 5448 4488 WerFault.exe 298 3592 5772 WerFault.exe 303 876 3864 WerFault.exe 308 2928 5788 WerFault.exe 313 1612 2560 WerFault.exe 318 3356 1384 WerFault.exe 323 2948 1188 WerFault.exe 328 580 3152 WerFault.exe 333 4284 716 WerFault.exe 338 5860 1580 WerFault.exe 343 1304 2720 WerFault.exe 348 6088 3848 WerFault.exe 353 3112 3100 WerFault.exe 358 3756 4828 WerFault.exe 363 5592 2260 WerFault.exe 368 3420 1408 WerFault.exe 373 120 3640 WerFault.exe 378 580 2112 WerFault.exe 383 3564 3576 WerFault.exe 388 5860 4132 WerFault.exe 393 2060 2456 WerFault.exe 398 6088 5692 WerFault.exe 403 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DGJKL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DOW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IAZP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IXN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ODBXOOO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DYLBH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HJEON.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BFXDKTG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PMW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TTDTX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GFGZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UQTILKX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CJUCI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZHKGSR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MYVICI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JTK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DLIGD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BCSLMT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-15_0673ddb739d5b53d42816b97a4d6688c_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OYYNGKJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FGNLSBD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZXJCDD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LNK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UNGGVQX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LCHSIMK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RHWBZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ASNH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UGHF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LJWOCE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ASI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LKIAF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LJFNHJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZSCWXVP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TEY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZAWEPWW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HBRN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GAHDXO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IUATOE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GYU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BER.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1712 2026-07-15_0673ddb739d5b53d42816b97a4d6688c_elex_emotet_stop.exe 1712 2026-07-15_0673ddb739d5b53d42816b97a4d6688c_elex_emotet_stop.exe 1392 TXTZL.exe 1392 TXTZL.exe 612 ACN.exe 612 ACN.exe 1084 OYYNGKJ.exe 1084 OYYNGKJ.exe 6140 FGNLSBD.exe 6140 FGNLSBD.exe 2080 XGB.exe 2080 XGB.exe 4680 GODVJQ.exe 4680 GODVJQ.exe 5832 ZHKGSR.exe 5832 ZHKGSR.exe 1544 PXLFZEF.exe 1544 PXLFZEF.exe 3452 MYVICI.exe 3452 MYVICI.exe 1536 ZAEGRT.exe 1536 ZAEGRT.exe 2652 QJSEDCE.exe 2652 QJSEDCE.exe 5476 TWX.exe 5476 TWX.exe 4960 KHADWQP.exe 4960 KHADWQP.exe 4144 ZXJCDD.exe 4144 ZXJCDD.exe 252 HKNJF.exe 252 HKNJF.exe 2916 CNE.exe 2916 CNE.exe 4600 KDFZAIS.exe 4600 KDFZAIS.exe 4668 FONYP.exe 4668 FONYP.exe 4292 QGDJY.exe 4292 QGDJY.exe 5508 LCHSIMK.exe 5508 LCHSIMK.exe 4368 ASI.exe 4368 ASI.exe 2348 IXN.exe 2348 IXN.exe 3016 ZYPDDD.exe 3016 ZYPDDD.exe 1980 DOW.exe 1980 DOW.exe 2688 TJFQAI.exe 2688 TJFQAI.exe 4944 IZO.exe 4944 IZO.exe 3048 BCSLMT.exe 3048 BCSLMT.exe 2108 BFW.exe 2108 BFW.exe 3092 WSBQC.exe 3092 WSBQC.exe 4644 LNK.exe 4644 LNK.exe 4380 LTKJ.exe 4380 LTKJ.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1712 2026-07-15_0673ddb739d5b53d42816b97a4d6688c_elex_emotet_stop.exe 1712 2026-07-15_0673ddb739d5b53d42816b97a4d6688c_elex_emotet_stop.exe 1392 TXTZL.exe 1392 TXTZL.exe 612 ACN.exe 612 ACN.exe 1084 OYYNGKJ.exe 1084 OYYNGKJ.exe 6140 FGNLSBD.exe 6140 FGNLSBD.exe 2080 XGB.exe 2080 XGB.exe 4680 GODVJQ.exe 4680 GODVJQ.exe 5832 ZHKGSR.exe 5832 ZHKGSR.exe 1544 PXLFZEF.exe 1544 PXLFZEF.exe 3452 MYVICI.exe 3452 MYVICI.exe 1536 ZAEGRT.exe 1536 ZAEGRT.exe 2652 QJSEDCE.exe 2652 QJSEDCE.exe 5476 TWX.exe 5476 TWX.exe 4960 KHADWQP.exe 4960 KHADWQP.exe 4144 ZXJCDD.exe 4144 ZXJCDD.exe 252 HKNJF.exe 252 HKNJF.exe 2916 CNE.exe 2916 CNE.exe 4600 KDFZAIS.exe 4600 KDFZAIS.exe 4668 FONYP.exe 4668 FONYP.exe 4292 QGDJY.exe 4292 QGDJY.exe 5508 LCHSIMK.exe 5508 LCHSIMK.exe 4368 ASI.exe 4368 ASI.exe 2348 IXN.exe 2348 IXN.exe 3016 ZYPDDD.exe 3016 ZYPDDD.exe 1980 DOW.exe 1980 DOW.exe 2688 TJFQAI.exe 2688 TJFQAI.exe 4944 IZO.exe 4944 IZO.exe 3048 BCSLMT.exe 3048 BCSLMT.exe 2108 BFW.exe 2108 BFW.exe 3092 WSBQC.exe 3092 WSBQC.exe 4644 LNK.exe 4644 LNK.exe 4380 LTKJ.exe 4380 LTKJ.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1712 wrote to memory of 5808 1712 2026-07-15_0673ddb739d5b53d42816b97a4d6688c_elex_emotet_stop.exe 87 PID 5808 wrote to memory of 1392 5808 cmd.exe 91 PID 1392 wrote to memory of 4748 1392 TXTZL.exe 93 PID 4748 wrote to memory of 612 4748 cmd.exe 97 PID 612 wrote to memory of 4628 612 ACN.exe 98 PID 4628 wrote to memory of 1084 4628 cmd.exe 102 PID 1084 wrote to memory of 5924 1084 OYYNGKJ.exe 103 PID 5924 wrote to memory of 6140 5924 cmd.exe 107 PID 6140 wrote to memory of 3524 6140 FGNLSBD.exe 108 PID 3524 wrote to memory of 2080 3524 cmd.exe 112 PID 2080 wrote to memory of 5040 2080 XGB.exe 113 PID 5040 wrote to memory of 4680 5040 cmd.exe 117 PID 4680 wrote to memory of 5780 4680 GODVJQ.exe 118 PID 5780 wrote to memory of 5832 5780 cmd.exe 122 PID 5832 wrote to memory of 3328 5832 ZHKGSR.exe 123 PID 3328 wrote to memory of 1544 3328 cmd.exe 127 PID 1544 wrote to memory of 2868 1544 PXLFZEF.exe 128 PID 2868 wrote to memory of 3452 2868 cmd.exe 132 PID 3452 wrote to memory of 1732 3452 MYVICI.exe 133 PID 1732 wrote to memory of 1536 1732 cmd.exe 137 PID 1536 wrote to memory of 932 1536 ZAEGRT.exe 138 PID 932 wrote to memory of 2652 932 cmd.exe 142 PID 2652 wrote to memory of 5168 2652 QJSEDCE.exe 143 PID 5168 wrote to memory of 5476 5168 cmd.exe 147 PID 5476 wrote to memory of 4548 5476 TWX.exe 148 PID 4548 wrote to memory of 4960 4548 cmd.exe 152 PID 4960 wrote to memory of 5176 4960 KHADWQP.exe 153 PID 5176 wrote to memory of 4144 5176 cmd.exe 157 PID 4144 wrote to memory of 5456 4144 ZXJCDD.exe 158 PID 5456 wrote to memory of 252 5456 cmd.exe 162 PID 252 wrote to memory of 4740 252 HKNJF.exe 163 PID 4740 wrote to memory of 2916 4740 cmd.exe 167 PID 2916 wrote to memory of 776 2916 CNE.exe 168 PID 776 wrote to memory of 4600 776 cmd.exe 172 PID 4600 wrote to memory of 1000 4600 KDFZAIS.exe 173 PID 1000 wrote to memory of 4668 1000 cmd.exe 177 PID 4668 wrote to memory of 5984 4668 FONYP.exe 178 PID 5984 wrote to memory of 4292 5984 cmd.exe 182 PID 4292 wrote to memory of 2556 4292 QGDJY.exe 183 PID 2556 wrote to memory of 5508 2556 cmd.exe 187 PID 5508 wrote to memory of 2768 5508 LCHSIMK.exe 188 PID 2768 wrote to memory of 4368 2768 cmd.exe 192 PID 4368 wrote to memory of 5032 4368 ASI.exe 193 PID 5032 wrote to memory of 2348 5032 cmd.exe 197 PID 2348 wrote to memory of 3440 2348 IXN.exe 198 PID 3440 wrote to memory of 3016 3440 cmd.exe 202 PID 3016 wrote to memory of 2288 3016 ZYPDDD.exe 203 PID 2288 wrote to memory of 1980 2288 cmd.exe 207 PID 1980 wrote to memory of 5648 1980 DOW.exe 208 PID 5648 wrote to memory of 2688 5648 cmd.exe 212 PID 2688 wrote to memory of 3472 2688 TJFQAI.exe 213 PID 3472 wrote to memory of 4944 3472 cmd.exe 217 PID 4944 wrote to memory of 2648 4944 IZO.exe 218 PID 2648 wrote to memory of 3048 2648 cmd.exe 222 PID 3048 wrote to memory of 3252 3048 BCSLMT.exe 223 PID 3252 wrote to memory of 2108 3252 cmd.exe 227 PID 2108 wrote to memory of 592 2108 BFW.exe 228 PID 592 wrote to memory of 3092 592 cmd.exe 232 PID 3092 wrote to memory of 3200 3092 WSBQC.exe 233 PID 3200 wrote to memory of 4644 3200 cmd.exe 237 PID 4644 wrote to memory of 1644 4644 LNK.exe 238 PID 1644 wrote to memory of 4380 1644 cmd.exe 242 PID 4380 wrote to memory of 4708 4380 LTKJ.exe 243 PID 4708 wrote to memory of 5872 4708 cmd.exe 247
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-15_0673ddb739d5b53d42816b97a4d6688c_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-15_0673ddb739d5b53d42816b97a4d6688c_elex_emotet_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TXTZL.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:5808 -
C:\windows\system\TXTZL.exeC:\windows\system\TXTZL.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ACN.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\windows\ACN.exeC:\windows\ACN.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OYYNGKJ.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\windows\system\OYYNGKJ.exeC:\windows\system\OYYNGKJ.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FGNLSBD.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:5924 -
C:\windows\system\FGNLSBD.exeC:\windows\system\FGNLSBD.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XGB.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:3524 -
C:\windows\XGB.exeC:\windows\XGB.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GODVJQ.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\windows\SysWOW64\GODVJQ.exeC:\windows\system32\GODVJQ.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZHKGSR.exe.bat" "14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5780 -
C:\windows\SysWOW64\ZHKGSR.exeC:\windows\system32\ZHKGSR.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PXLFZEF.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\windows\system\PXLFZEF.exeC:\windows\system\PXLFZEF.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MYVICI.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\windows\MYVICI.exeC:\windows\MYVICI.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZAEGRT.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\windows\system\ZAEGRT.exeC:\windows\system\ZAEGRT.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QJSEDCE.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:932 -
C:\windows\system\QJSEDCE.exeC:\windows\system\QJSEDCE.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TWX.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:5168 -
C:\windows\system\TWX.exeC:\windows\system\TWX.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KHADWQP.exe.bat" "26⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\windows\system\KHADWQP.exeC:\windows\system\KHADWQP.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZXJCDD.exe.bat" "28⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5176 -
C:\windows\SysWOW64\ZXJCDD.exeC:\windows\system32\ZXJCDD.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HKNJF.exe.bat" "30⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5456 -
C:\windows\system\HKNJF.exeC:\windows\system\HKNJF.exe31⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CNE.exe.bat" "32⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\windows\SysWOW64\CNE.exeC:\windows\system32\CNE.exe33⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KDFZAIS.exe.bat" "34⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:776 -
C:\windows\system\KDFZAIS.exeC:\windows\system\KDFZAIS.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FONYP.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:1000 -
C:\windows\SysWOW64\FONYP.exeC:\windows\system32\FONYP.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QGDJY.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:5984 -
C:\windows\SysWOW64\QGDJY.exeC:\windows\system32\QGDJY.exe39⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LCHSIMK.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\windows\system\LCHSIMK.exeC:\windows\system\LCHSIMK.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ASI.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\windows\SysWOW64\ASI.exeC:\windows\system32\ASI.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IXN.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\windows\SysWOW64\IXN.exeC:\windows\system32\IXN.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZYPDDD.exe.bat" "46⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\windows\SysWOW64\ZYPDDD.exeC:\windows\system32\ZYPDDD.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DOW.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\windows\DOW.exeC:\windows\DOW.exe49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TJFQAI.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:5648 -
C:\windows\system\TJFQAI.exeC:\windows\system\TJFQAI.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IZO.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\windows\IZO.exeC:\windows\IZO.exe53⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BCSLMT.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\windows\BCSLMT.exeC:\windows\BCSLMT.exe55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BFW.exe.bat" "56⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\windows\BFW.exeC:\windows\BFW.exe57⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WSBQC.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:592 -
C:\windows\WSBQC.exeC:\windows\WSBQC.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LNK.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:3200 -
C:\windows\LNK.exeC:\windows\LNK.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LTKJ.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\windows\system\LTKJ.exeC:\windows\system\LTKJ.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GGHAHJ.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\windows\SysWOW64\GGHAHJ.exeC:\windows\system32\GGHAHJ.exe65⤵
- Executes dropped EXE
PID:5872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LGP.exe.bat" "66⤵PID:5288
-
C:\windows\LGP.exeC:\windows\LGP.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RHWBZ.exe.bat" "68⤵PID:3596
-
C:\windows\system\RHWBZ.exeC:\windows\system\RHWBZ.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3220 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RUWQAS.exe.bat" "70⤵PID:2412
-
C:\windows\SysWOW64\RUWQAS.exeC:\windows\system32\RUWQAS.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BSCCQ.exe.bat" "72⤵PID:4492
-
C:\windows\SysWOW64\BSCCQ.exeC:\windows\system32\BSCCQ.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UNGGVQX.exe.bat" "74⤵PID:1480
-
C:\windows\UNGGVQX.exeC:\windows\UNGGVQX.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PILP.exe.bat" "76⤵PID:4892
-
C:\windows\SysWOW64\PILP.exeC:\windows\system32\PILP.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZGY.exe.bat" "78⤵PID:4952
-
C:\windows\ZGY.exeC:\windows\ZGY.exe79⤵
- Executes dropped EXE
PID:1212 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TTDTX.exe.bat" "80⤵PID:1104
-
C:\windows\SysWOW64\TTDTX.exeC:\windows\system32\TTDTX.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DRJ.exe.bat" "82⤵PID:1576
-
C:\windows\system\DRJ.exeC:\windows\system\DRJ.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1484 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OKMY.exe.bat" "84⤵PID:5880
-
C:\windows\system\OKMY.exeC:\windows\system\OKMY.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SSSGZH.exe.bat" "86⤵
- System Location Discovery: System Language Discovery
PID:4536 -
C:\windows\system\SSSGZH.exeC:\windows\system\SSSGZH.exe87⤵
- Executes dropped EXE
PID:5772 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CAU.exe.bat" "88⤵PID:4064
-
C:\windows\SysWOW64\CAU.exeC:\windows\system32\CAU.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MYAGKUH.exe.bat" "90⤵PID:2100
-
C:\windows\MYAGKUH.exeC:\windows\MYAGKUH.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BTJKD.exe.bat" "92⤵PID:5836
-
C:\windows\system\BTJKD.exeC:\windows\system\BTJKD.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BYKYFU.exe.bat" "94⤵
- System Location Discovery: System Language Discovery
PID:1220 -
C:\windows\system\BYKYFU.exeC:\windows\system\BYKYFU.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VMOIPUZ.exe.bat" "96⤵PID:240
-
C:\windows\SysWOW64\VMOIPUZ.exeC:\windows\system32\VMOIPUZ.exe97⤵
- Executes dropped EXE
PID:1188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QHTR.exe.bat" "98⤵PID:3616
-
C:\windows\system\QHTR.exeC:\windows\system\QHTR.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3152 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CPAZDMC.exe.bat" "100⤵PID:6132
-
C:\windows\system\CPAZDMC.exeC:\windows\system\CPAZDMC.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GFGZ.exe.bat" "102⤵PID:476
-
C:\windows\system\GFGZ.exeC:\windows\system\GFGZ.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PFIETCA.exe.bat" "104⤵PID:4156
-
C:\windows\SysWOW64\PFIETCA.exeC:\windows\system32\PFIETCA.exe105⤵
- Executes dropped EXE
PID:2720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZDOZI.exe.bat" "106⤵
- System Location Discovery: System Language Discovery
PID:2756 -
C:\windows\ZDOZI.exeC:\windows\ZDOZI.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UQTILKX.exe.bat" "108⤵PID:5500
-
C:\windows\UQTILKX.exeC:\windows\UQTILKX.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OEY.exe.bat" "110⤵PID:1436
-
C:\windows\system\OEY.exeC:\windows\system\OEY.exe111⤵
- Executes dropped EXE
PID:4828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YMAFYHO.exe.bat" "112⤵PID:916
-
C:\windows\system\YMAFYHO.exeC:\windows\system\YMAFYHO.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PZKXOEC.exe.bat" "114⤵
- System Location Discovery: System Language Discovery
PID:4756 -
C:\windows\SysWOW64\PZKXOEC.exeC:\windows\system32\PZKXOEC.exe115⤵
- Executes dropped EXE
PID:1408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ASNH.exe.bat" "116⤵PID:4472
-
C:\windows\ASNH.exeC:\windows\ASNH.exe117⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LKIAF.exe.bat" "118⤵PID:5888
-
C:\windows\SysWOW64\LKIAF.exeC:\windows\system32\LKIAF.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XDLTFI.exe.bat" "120⤵PID:5268
-
C:\windows\SysWOW64\XDLTFI.exeC:\windows\system32\XDLTFI.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3576
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-