Analysis
- max time kernel
92s - max time network
140s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
17/07/2026, 23:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-17_0bff78ebfa6b73d771057545ad8f7218_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-07-17_0bff78ebfa6b73d771057545ad8f7218_elex_emotet_stop.exe
- Size 208KB
- Sample260717-3zmacsdw21
- SHA256 1c659ba264ed7ef9860ba1152b6972824407fef9ae04e70230cdc957127266a6
- MD5 0bff78ebfa6b73d771057545ad8f7218
- SHA1 6173a4d346aa1cbaee983e419de22c77c8fa2602
- SHA512 2800d363f7c370e2a492a06c628ec715da0a3f25503af4678c3b35771200be86480e44558a879a274ec3ed5b8ac71d18201e30d1072b60343c0233fce741b298
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlldL+LOfq4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFll5+LOSkEj1
- TLSH T1B1247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 800 JYRT.exe 4632 FZIKOT.exe 5632 ACQI.exe 2992 UXVSE.exe 3028 WVBMU.exe 3932 ZIFVEEJ.exe 5352 ZOGKGRM.exe 2032 UBKT.exe 3588 MEO.exe 4796 BZYBGT.exe 5500 NRBMP.exe 2448 XPGHW.exe 5984 GYIMZO.exe 5656 JLN.exe 4912 XQTS.exe 2168 YLXWEO.exe 2852 EMEK.exe 4592 LCFBUET.exe 4492 CPQ.exe 4324 XCVCM.exe 6000 DYULRDL.exe 5032 STDQC.exe 4544 SGDELD.exe 2780 YHL.exe 2548 SUIBE.exe 4364 CUKGIC.exe 2008 WQP.exe 4724 MLYCDP.exe 4820 OYD.exe 5652 HBHHT.exe 2252 HWSL.exe 1848 AZWGMS.exe 4404 EPD.exe 1732 IXKPC.exe 1736 JANS.exe 5344 UTQLQ.exe 3084 OGVUAAV.exe 2864 LMTKHKX.exe 5424 GZYB.exe 4252 AMDKC.exe 708 ECJ.exe 504 ZPOUQ.exe 5988 QQQ.exe 2160 WQY.exe 3896 WEYBMG.exe 3368 LZHN.exe 5492 LEHC.exe 3024 AZRGSBV.exe 2968 VVWQ.exe 4600 BIVQZ.exe 2336 ZGG.exe 4440 AJKPZZR.exe 1284 JJMC.exe 3188 EWRMN.exe 684 IMX.exe 3012 ZNZR.exe 1240 OIJDOGH.exe 4328 NDIES.exe 1468 IOY.exe 4100 MWFCT.exe 5824 MJXRUR.exe 5596 QRERG.exe 4524 VSMNQE.exe 4136 CNL.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\LZHN.exe WEYBMG.exe File created C:\windows\SysWOW64\AZRGSBV.exe LEHC.exe File opened for modification C:\windows\SysWOW64\AJKPZZR.exe ZGG.exe File opened for modification C:\windows\SysWOW64\JJVJNS.exe TOM.exe File created C:\windows\SysWOW64\UIPJA.exe.bat CNL.exe File created C:\windows\SysWOW64\JJVJNS.exe TOM.exe File opened for modification C:\windows\SysWOW64\ECJ.exe AMDKC.exe File created C:\windows\SysWOW64\ZPOUQ.exe ECJ.exe File created C:\windows\SysWOW64\AJKPZZR.exe.bat ZGG.exe File created C:\windows\SysWOW64\ZNZR.exe IMX.exe File created C:\windows\SysWOW64\QRERG.exe MJXRUR.exe File created C:\windows\SysWOW64\QQA.exe.bat KQSRR.exe File created C:\windows\SysWOW64\ZPOUQ.exe.bat ECJ.exe File created C:\windows\SysWOW64\KGE.exe.bat JLAUPH.exe File created C:\windows\SysWOW64\UKTJJ.exe BHPFEZU.exe File created C:\windows\SysWOW64\ECJ.exe.bat AMDKC.exe File created C:\windows\SysWOW64\ZNZR.exe.bat IMX.exe File opened for modification C:\windows\SysWOW64\UXVSE.exe ACQI.exe File opened for modification C:\windows\SysWOW64\ZNZR.exe IMX.exe File created C:\windows\SysWOW64\PCPGEP.exe.bat EKMVD.exe File created C:\windows\SysWOW64\YLXWEO.exe XQTS.exe File created C:\windows\SysWOW64\CUKGIC.exe SUIBE.exe File opened for modification C:\windows\SysWOW64\LEM.exe WOLBIXQ.exe File created C:\windows\SysWOW64\CMFCR.exe.bat LEDP.exe File opened for modification C:\windows\SysWOW64\XQTS.exe JLN.exe File created C:\windows\SysWOW64\XQTS.exe.bat JLN.exe File created C:\windows\SysWOW64\AJKPZZR.exe ZGG.exe File created C:\windows\SysWOW64\BRFX.exe CUUCKU.exe File created C:\windows\SysWOW64\TCS.exe.bat BZOWMG.exe File created C:\windows\SysWOW64\CZQZEEP.exe.bat JWEDR.exe File opened for modification C:\windows\SysWOW64\PDSGAFY.exe FNM.exe File created C:\windows\SysWOW64\ACQI.exe FZIKOT.exe File created C:\windows\SysWOW64\LEM.exe WOLBIXQ.exe File opened for modification C:\windows\SysWOW64\BRFX.exe CUUCKU.exe File created C:\windows\SysWOW64\QTDIOKX.exe QQA.exe File created C:\windows\SysWOW64\WOLBIXQ.exe JMVCTUV.exe File created C:\windows\SysWOW64\UKTJJ.exe.bat BHPFEZU.exe File opened for modification C:\windows\SysWOW64\QTDIOKX.exe QQA.exe File created C:\windows\SysWOW64\OYD.exe MLYCDP.exe File created C:\windows\SysWOW64\AZWGMS.exe.bat HWSL.exe File created C:\windows\SysWOW64\LZHN.exe.bat WEYBMG.exe File created C:\windows\SysWOW64\EKMVD.exe.bat JOH.exe File opened for modification C:\windows\SysWOW64\XPGHW.exe NRBMP.exe File created C:\windows\SysWOW64\GARJR.exe LEM.exe File created C:\windows\SysWOW64\PCPGEP.exe EKMVD.exe File opened for modification C:\windows\SysWOW64\QRERG.exe MJXRUR.exe File created C:\windows\SysWOW64\JMVCTUV.exe RDTXQ.exe File created C:\windows\SysWOW64\YLXWEO.exe.bat XQTS.exe File created C:\windows\SysWOW64\CZQZEEP.exe JWEDR.exe File created C:\windows\SysWOW64\RJBL.exe.bat TWKKSN.exe File created C:\windows\SysWOW64\QQA.exe KQSRR.exe File created C:\windows\SysWOW64\CUUCKU.exe.bat CZQZEEP.exe File opened for modification C:\windows\SysWOW64\RJBL.exe TWKKSN.exe File created C:\windows\SysWOW64\APJ.exe.bat OHDBKG.exe File opened for modification C:\windows\SysWOW64\EKMVD.exe JOH.exe File created C:\windows\SysWOW64\AZWGMS.exe HWSL.exe File opened for modification C:\windows\SysWOW64\AZWGMS.exe HWSL.exe File opened for modification C:\windows\SysWOW64\TCS.exe BZOWMG.exe File created C:\windows\SysWOW64\JMVCTUV.exe.bat RDTXQ.exe File created C:\windows\SysWOW64\TCS.exe BZOWMG.exe File created C:\windows\SysWOW64\LEM.exe.bat WOLBIXQ.exe File opened for modification C:\windows\SysWOW64\CUUCKU.exe CZQZEEP.exe File created C:\windows\SysWOW64\JTRZ.exe BNQK.exe File created C:\windows\SysWOW64\APJ.exe OHDBKG.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\ZGG.exe BIVQZ.exe File opened for modification C:\windows\IMX.exe EWRMN.exe File created C:\windows\MEO.exe UBKT.exe File created C:\windows\EMEK.exe.bat YLXWEO.exe File created C:\windows\system\IXKPC.exe.bat EPD.exe File opened for modification C:\windows\ALE.exe AFEKOGH.exe File created C:\windows\system\RDTXQ.exe ETKYCMY.exe File opened for modification C:\windows\system\MNNJY.exe AUKQ.exe File created C:\windows\system\EPD.exe AZWGMS.exe File opened for modification C:\windows\system\MWFCT.exe IOY.exe File created C:\windows\system\LCFBUET.exe EMEK.exe File created C:\windows\system\WEYBMG.exe WQY.exe File created C:\windows\AUKQ.exe APJ.exe File created C:\windows\system\HBHHT.exe.bat OYD.exe File created C:\windows\FNM.exe.bat VFKHHZ.exe File created C:\windows\system\LMTKHKX.exe OGVUAAV.exe File created C:\windows\system\RDTXQ.exe.bat ETKYCMY.exe File opened for modification C:\windows\system\TWKKSN.exe ETT.exe File opened for modification C:\windows\system\GIJSIST.exe MNNJY.exe File created C:\windows\system\OGVUAAV.exe UTQLQ.exe File opened for modification C:\windows\system\NRBMP.exe BZYBGT.exe File created C:\windows\GZYB.exe LMTKHKX.exe File created C:\windows\system\VSMNQE.exe.bat QRERG.exe File opened for modification C:\windows\system\VVWQ.exe AZRGSBV.exe File created C:\windows\system\WEYBMG.exe.bat WQY.exe File created C:\windows\system\JJMC.exe.bat AJKPZZR.exe File created C:\windows\OHDBKG.exe.bat WEZYXQX.exe File opened for modification C:\windows\FZIKOT.exe JYRT.exe File created C:\windows\WVBMU.exe UXVSE.exe File created C:\windows\system\SUIBE.exe YHL.exe File created C:\windows\system\ZOGKGRM.exe.bat ZIFVEEJ.exe File created C:\windows\GYD.exe UIPJA.exe File opened for modification C:\windows\system\BZOWMG.exe GLJNC.exe File created C:\windows\system\XGY.exe GVVF.exe File opened for modification C:\windows\MEO.exe UBKT.exe File opened for modification C:\windows\system\TOM.exe ZBHNRF.exe File created C:\windows\AIQM.exe RHW.exe File created C:\windows\system\JYRT.exe.bat 2026-07-17_0bff78ebfa6b73d771057545ad8f7218_elex_emotet_stop.exe File opened for modification C:\windows\system\SUIBE.exe YHL.exe File opened for modification C:\windows\system\WEYBMG.exe WQY.exe File created C:\windows\system\XCVCM.exe.bat CPQ.exe File created C:\windows\system\OIJDOGH.exe.bat ZNZR.exe File opened for modification C:\windows\system\ZBHNRF.exe GYD.exe File created C:\windows\SJZTI.exe.bat BWOB.exe File opened for modification C:\windows\system\HWSL.exe HBHHT.exe File created C:\windows\system\QQQ.exe ZPOUQ.exe File created C:\windows\NDIES.exe.bat OIJDOGH.exe File created C:\windows\system\MWFCT.exe IOY.exe File created C:\windows\system\VSMNQE.exe QRERG.exe File created C:\windows\system\ZBHNRF.exe GYD.exe File created C:\windows\system\LCFBUET.exe.bat EMEK.exe File opened for modification C:\windows\system\OGVUAAV.exe UTQLQ.exe File opened for modification C:\windows\WQY.exe QQQ.exe File opened for modification C:\windows\system\WQP.exe CUKGIC.exe File created C:\windows\system\TOM.exe ZBHNRF.exe File created C:\windows\GVVF.exe GARJR.exe File opened for modification C:\windows\system\VFKHHZ.exe BRFX.exe File opened for modification C:\windows\RHW.exe CMFCR.exe File created C:\windows\FZIKOT.exe.bat JYRT.exe File opened for modification C:\windows\system\GYIMZO.exe XPGHW.exe File created C:\windows\system\AMDKC.exe.bat GZYB.exe File opened for modification C:\windows\system\LKSH.exe JPNXWFM.exe File opened for modification C:\windows\KQSRR.exe AIQM.exe File created C:\windows\system\JWEDR.exe.bat XGY.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4852 cmd.exe 2868 cmd.exe 3776 cmd.exe 1456 cmd.exe 5776 cmd.exe 4776 cmd.exe 5588 cmd.exe 1980 cmd.exe 1128 cmd.exe 5916 cmd.exe 4144 cmd.exe 124 cmd.exe 3508 cmd.exe 5440 cmd.exe 4564 cmd.exe 3380 cmd.exe 940 cmd.exe 1476 cmd.exe 236 cmd.exe 1548 cmd.exe 2944 cmd.exe 4332 cmd.exe 3928 cmd.exe 2856 cmd.exe 5948 cmd.exe 1520 cmd.exe 4348 cmd.exe 2292 cmd.exe 1876 cmd.exe 1564 cmd.exe 976 cmd.exe 4920 cmd.exe 2604 cmd.exe 4368 cmd.exe 1952 cmd.exe 2200 cmd.exe 4196 cmd.exe 4604 cmd.exe 1764 cmd.exe 4884 cmd.exe 3456 cmd.exe 1488 cmd.exe 788 cmd.exe 1316 cmd.exe 3544 cmd.exe 5888 cmd.exe 1028 cmd.exe 4108 cmd.exe 3440 cmd.exe 4552 cmd.exe 4192 cmd.exe 4432 cmd.exe 4444 cmd.exe 4812 cmd.exe 3788 cmd.exe 4080 cmd.exe 4800 cmd.exe 5320 cmd.exe 2544 cmd.exe 3060 cmd.exe 2468 cmd.exe 6108 cmd.exe 4880 cmd.exe 3940 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 5928 860 WerFault.exe 87 3560 800 WerFault.exe 93 824 4632 WerFault.exe 99 5700 5632 WerFault.exe 104 3948 2992 WerFault.exe 109 5940 3028 WerFault.exe 114 4480 3932 WerFault.exe 119 4092 5352 WerFault.exe 124 972 2032 WerFault.exe 129 3244 3588 WerFault.exe 134 4468 4796 WerFault.exe 139 3864 5500 WerFault.exe 144 3924 2448 WerFault.exe 149 3960 5984 WerFault.exe 154 4364 5656 WerFault.exe 159 4620 4912 WerFault.exe 164 2812 2168 WerFault.exe 169 4820 2852 WerFault.exe 174 2888 4592 WerFault.exe 179 4176 4492 WerFault.exe 184 4240 4324 WerFault.exe 189 1356 6000 WerFault.exe 194 2076 5032 WerFault.exe 199 5064 4544 WerFault.exe 204 620 2780 WerFault.exe 209 3368 2548 WerFault.exe 214 4184 4364 WerFault.exe 219 5228 2008 WerFault.exe 224 2004 4724 WerFault.exe 229 4252 4820 WerFault.exe 234 1200 5652 WerFault.exe 239 2524 2252 WerFault.exe 244 4216 1848 WerFault.exe 249 5100 4404 WerFault.exe 254 4312 1732 WerFault.exe 259 2308 1736 WerFault.exe 264 5636 5344 WerFault.exe 269 964 3084 WerFault.exe 274 2304 2864 WerFault.exe 279 1124 5424 WerFault.exe 285 2204 4252 WerFault.exe 290 1432 708 WerFault.exe 295 3764 504 WerFault.exe 300 1784 5988 WerFault.exe 305 620 2160 WerFault.exe 310 6088 3896 WerFault.exe 315 1036 3368 WerFault.exe 320 2412 5492 WerFault.exe 325 5240 3024 WerFault.exe 330 4924 2968 WerFault.exe 335 5016 4600 WerFault.exe 340 5400 2336 WerFault.exe 345 1256 4440 WerFault.exe 350 364 1284 WerFault.exe 355 2476 3188 WerFault.exe 360 2660 684 WerFault.exe 365 1084 3012 WerFault.exe 370 2304 1240 WerFault.exe 375 4128 4328 WerFault.exe 380 2940 1468 WerFault.exe 385 3340 4100 WerFault.exe 390 3364 5824 WerFault.exe 395 4780 5596 WerFault.exe 400 3576 4524 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QRERG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JMVCTUV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GIJSIST.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XQTS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SUIBE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PDSGAFY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XCVCM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UBKT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QTDIOKX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JLN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MJXRUR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WEZYXQX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YHL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ECJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QQQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CNL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UTQLQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IXKPC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ACQI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language APJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JJMC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CUUCKU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WEYBMG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AZRGSBV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BZOWMG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JLAUPH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WVBMU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MNNJY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JANS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RDTXQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OHDBKG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WQY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ALE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BHPFEZU.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 860 2026-07-17_0bff78ebfa6b73d771057545ad8f7218_elex_emotet_stop.exe 860 2026-07-17_0bff78ebfa6b73d771057545ad8f7218_elex_emotet_stop.exe 800 JYRT.exe 800 JYRT.exe 4632 FZIKOT.exe 4632 FZIKOT.exe 5632 ACQI.exe 5632 ACQI.exe 2992 UXVSE.exe 2992 UXVSE.exe 3028 WVBMU.exe 3028 WVBMU.exe 3932 ZIFVEEJ.exe 3932 ZIFVEEJ.exe 5352 ZOGKGRM.exe 5352 ZOGKGRM.exe 2032 UBKT.exe 2032 UBKT.exe 3588 MEO.exe 3588 MEO.exe 4796 BZYBGT.exe 4796 BZYBGT.exe 5500 NRBMP.exe 5500 NRBMP.exe 2448 XPGHW.exe 2448 XPGHW.exe 5984 GYIMZO.exe 5984 GYIMZO.exe 5656 JLN.exe 5656 JLN.exe 4912 XQTS.exe 4912 XQTS.exe 2168 YLXWEO.exe 2168 YLXWEO.exe 2852 EMEK.exe 2852 EMEK.exe 4592 LCFBUET.exe 4592 LCFBUET.exe 4492 CPQ.exe 4492 CPQ.exe 4324 XCVCM.exe 4324 XCVCM.exe 6000 DYULRDL.exe 6000 DYULRDL.exe 5032 STDQC.exe 5032 STDQC.exe 4544 SGDELD.exe 4544 SGDELD.exe 2780 YHL.exe 2780 YHL.exe 2548 SUIBE.exe 2548 SUIBE.exe 4364 CUKGIC.exe 4364 CUKGIC.exe 2008 WQP.exe 2008 WQP.exe 4724 MLYCDP.exe 4724 MLYCDP.exe 4820 OYD.exe 4820 OYD.exe 5652 HBHHT.exe 5652 HBHHT.exe 2252 HWSL.exe 2252 HWSL.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 860 2026-07-17_0bff78ebfa6b73d771057545ad8f7218_elex_emotet_stop.exe 860 2026-07-17_0bff78ebfa6b73d771057545ad8f7218_elex_emotet_stop.exe 800 JYRT.exe 800 JYRT.exe 4632 FZIKOT.exe 4632 FZIKOT.exe 5632 ACQI.exe 5632 ACQI.exe 2992 UXVSE.exe 2992 UXVSE.exe 3028 WVBMU.exe 3028 WVBMU.exe 3932 ZIFVEEJ.exe 3932 ZIFVEEJ.exe 5352 ZOGKGRM.exe 5352 ZOGKGRM.exe 2032 UBKT.exe 2032 UBKT.exe 3588 MEO.exe 3588 MEO.exe 4796 BZYBGT.exe 4796 BZYBGT.exe 5500 NRBMP.exe 5500 NRBMP.exe 2448 XPGHW.exe 2448 XPGHW.exe 5984 GYIMZO.exe 5984 GYIMZO.exe 5656 JLN.exe 5656 JLN.exe 4912 XQTS.exe 4912 XQTS.exe 2168 YLXWEO.exe 2168 YLXWEO.exe 2852 EMEK.exe 2852 EMEK.exe 4592 LCFBUET.exe 4592 LCFBUET.exe 4492 CPQ.exe 4492 CPQ.exe 4324 XCVCM.exe 4324 XCVCM.exe 6000 DYULRDL.exe 6000 DYULRDL.exe 5032 STDQC.exe 5032 STDQC.exe 4544 SGDELD.exe 4544 SGDELD.exe 2780 YHL.exe 2780 YHL.exe 2548 SUIBE.exe 2548 SUIBE.exe 4364 CUKGIC.exe 4364 CUKGIC.exe 2008 WQP.exe 2008 WQP.exe 4724 MLYCDP.exe 4724 MLYCDP.exe 4820 OYD.exe 4820 OYD.exe 5652 HBHHT.exe 5652 HBHHT.exe 2252 HWSL.exe 2252 HWSL.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 860 wrote to memory of 5084 860 2026-07-17_0bff78ebfa6b73d771057545ad8f7218_elex_emotet_stop.exe 89 PID 5084 wrote to memory of 800 5084 cmd.exe 93 PID 800 wrote to memory of 1128 800 JYRT.exe 95 PID 1128 wrote to memory of 4632 1128 cmd.exe 99 PID 4632 wrote to memory of 348 4632 FZIKOT.exe 100 PID 348 wrote to memory of 5632 348 cmd.exe 104 PID 5632 wrote to memory of 940 5632 ACQI.exe 105 PID 940 wrote to memory of 2992 940 cmd.exe 109 PID 2992 wrote to memory of 4920 2992 UXVSE.exe 110 PID 4920 wrote to memory of 3028 4920 cmd.exe 114 PID 3028 wrote to memory of 4356 3028 WVBMU.exe 115 PID 4356 wrote to memory of 3932 4356 cmd.exe 119 PID 3932 wrote to memory of 3712 3932 ZIFVEEJ.exe 120 PID 3712 wrote to memory of 5352 3712 cmd.exe 124 PID 5352 wrote to memory of 3020 5352 ZOGKGRM.exe 125 PID 3020 wrote to memory of 2032 3020 cmd.exe 129 PID 2032 wrote to memory of 1028 2032 UBKT.exe 130 PID 1028 wrote to memory of 3588 1028 cmd.exe 134 PID 3588 wrote to memory of 716 3588 MEO.exe 135 PID 716 wrote to memory of 4796 716 cmd.exe 139 PID 4796 wrote to memory of 4520 4796 BZYBGT.exe 140 PID 4520 wrote to memory of 5500 4520 cmd.exe 144 PID 5500 wrote to memory of 5976 5500 NRBMP.exe 145 PID 5976 wrote to memory of 2448 5976 cmd.exe 149 PID 2448 wrote to memory of 4124 2448 XPGHW.exe 150 PID 4124 wrote to memory of 5984 4124 cmd.exe 154 PID 5984 wrote to memory of 5948 5984 GYIMZO.exe 155 PID 5948 wrote to memory of 5656 5948 cmd.exe 159 PID 5656 wrote to memory of 4852 5656 JLN.exe 160 PID 4852 wrote to memory of 4912 4852 cmd.exe 164 PID 4912 wrote to memory of 3056 4912 XQTS.exe 165 PID 3056 wrote to memory of 2168 3056 cmd.exe 169 PID 2168 wrote to memory of 2024 2168 YLXWEO.exe 170 PID 2024 wrote to memory of 2852 2024 cmd.exe 174 PID 2852 wrote to memory of 5712 2852 EMEK.exe 175 PID 5712 wrote to memory of 4592 5712 cmd.exe 179 PID 4592 wrote to memory of 2068 4592 LCFBUET.exe 180 PID 2068 wrote to memory of 4492 2068 cmd.exe 184 PID 4492 wrote to memory of 1856 4492 CPQ.exe 185 PID 1856 wrote to memory of 4324 1856 cmd.exe 189 PID 4324 wrote to memory of 2428 4324 XCVCM.exe 190 PID 2428 wrote to memory of 6000 2428 cmd.exe 194 PID 6000 wrote to memory of 2708 6000 DYULRDL.exe 195 PID 2708 wrote to memory of 5032 2708 cmd.exe 199 PID 5032 wrote to memory of 1524 5032 STDQC.exe 200 PID 1524 wrote to memory of 4544 1524 cmd.exe 204 PID 4544 wrote to memory of 2892 4544 SGDELD.exe 205 PID 2892 wrote to memory of 2780 2892 cmd.exe 209 PID 2780 wrote to memory of 108 2780 YHL.exe 210 PID 108 wrote to memory of 2548 108 cmd.exe 214 PID 2548 wrote to memory of 788 2548 SUIBE.exe 215 PID 788 wrote to memory of 4364 788 cmd.exe 219 PID 4364 wrote to memory of 2088 4364 CUKGIC.exe 220 PID 2088 wrote to memory of 2008 2088 cmd.exe 224 PID 2008 wrote to memory of 1060 2008 WQP.exe 225 PID 1060 wrote to memory of 4724 1060 cmd.exe 229 PID 4724 wrote to memory of 1520 4724 MLYCDP.exe 230 PID 1520 wrote to memory of 4820 1520 cmd.exe 234 PID 4820 wrote to memory of 3440 4820 OYD.exe 235 PID 3440 wrote to memory of 5652 3440 cmd.exe 239 PID 5652 wrote to memory of 5916 5652 HBHHT.exe 240 PID 5916 wrote to memory of 2252 5916 cmd.exe 244 PID 2252 wrote to memory of 6108 2252 HWSL.exe 245 PID 6108 wrote to memory of 1848 6108 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-17_0bff78ebfa6b73d771057545ad8f7218_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-17_0bff78ebfa6b73d771057545ad8f7218_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JYRT.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\windows\system\JYRT.exeC:\windows\system\JYRT.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FZIKOT.exe.bat" "4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\windows\FZIKOT.exeC:\windows\FZIKOT.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ACQI.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:348 -
C:\windows\SysWOW64\ACQI.exeC:\windows\system32\ACQI.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5632 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UXVSE.exe.bat" "8⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:940 -
C:\windows\SysWOW64\UXVSE.exeC:\windows\system32\UXVSE.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WVBMU.exe.bat" "10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\windows\WVBMU.exeC:\windows\WVBMU.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZIFVEEJ.exe.bat" "12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\windows\SysWOW64\ZIFVEEJ.exeC:\windows\system32\ZIFVEEJ.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZOGKGRM.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\windows\system\ZOGKGRM.exeC:\windows\system\ZOGKGRM.exe15⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UBKT.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\windows\system\UBKT.exeC:\windows\system\UBKT.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MEO.exe.bat" "18⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\windows\MEO.exeC:\windows\MEO.exe19⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3588 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BZYBGT.exe.bat" "20⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:716 -
C:\windows\BZYBGT.exeC:\windows\BZYBGT.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NRBMP.exe.bat" "22⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\windows\system\NRBMP.exeC:\windows\system\NRBMP.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XPGHW.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:5976 -
C:\windows\SysWOW64\XPGHW.exeC:\windows\system32\XPGHW.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GYIMZO.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\windows\system\GYIMZO.exeC:\windows\system\GYIMZO.exe27⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JLN.exe.bat" "28⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5948 -
C:\windows\JLN.exeC:\windows\JLN.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5656 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XQTS.exe.bat" "30⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\windows\SysWOW64\XQTS.exeC:\windows\system32\XQTS.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YLXWEO.exe.bat" "32⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\windows\SysWOW64\YLXWEO.exeC:\windows\system32\YLXWEO.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EMEK.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\windows\EMEK.exeC:\windows\EMEK.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LCFBUET.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:5712 -
C:\windows\system\LCFBUET.exeC:\windows\system\LCFBUET.exe37⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CPQ.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\windows\system\CPQ.exeC:\windows\system\CPQ.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XCVCM.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\windows\system\XCVCM.exeC:\windows\system\XCVCM.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DYULRDL.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\windows\DYULRDL.exeC:\windows\DYULRDL.exe43⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\STDQC.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\windows\system\STDQC.exeC:\windows\system\STDQC.exe45⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SGDELD.exe.bat" "46⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\windows\system\SGDELD.exeC:\windows\system\SGDELD.exe47⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YHL.exe.bat" "48⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\windows\YHL.exeC:\windows\YHL.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SUIBE.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:108 -
C:\windows\system\SUIBE.exeC:\windows\system\SUIBE.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CUKGIC.exe.bat" "52⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:788 -
C:\windows\SysWOW64\CUKGIC.exeC:\windows\system32\CUKGIC.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WQP.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\windows\system\WQP.exeC:\windows\system\WQP.exe55⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MLYCDP.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\windows\system\MLYCDP.exeC:\windows\system\MLYCDP.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OYD.exe.bat" "58⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\windows\SysWOW64\OYD.exeC:\windows\system32\OYD.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HBHHT.exe.bat" "60⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\windows\system\HBHHT.exeC:\windows\system\HBHHT.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HWSL.exe.bat" "62⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5916 -
C:\windows\system\HWSL.exeC:\windows\system\HWSL.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AZWGMS.exe.bat" "64⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6108 -
C:\windows\SysWOW64\AZWGMS.exeC:\windows\system32\AZWGMS.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EPD.exe.bat" "66⤵PID:4372
-
C:\windows\system\EPD.exeC:\windows\system\EPD.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IXKPC.exe.bat" "68⤵
- Executes a command shell one-liner
PID:2604 -
C:\windows\system\IXKPC.exeC:\windows\system\IXKPC.exe69⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JANS.exe.bat" "70⤵
- Executes a command shell one-liner
PID:4080 -
C:\windows\JANS.exeC:\windows\JANS.exe71⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UTQLQ.exe.bat" "72⤵
- System Location Discovery: System Language Discovery
PID:1728 -
C:\windows\UTQLQ.exeC:\windows\UTQLQ.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OGVUAAV.exe.bat" "74⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4368 -
C:\windows\system\OGVUAAV.exeC:\windows\system\OGVUAAV.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LMTKHKX.exe.bat" "76⤵PID:5752
-
C:\windows\system\LMTKHKX.exeC:\windows\system\LMTKHKX.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GZYB.exe.bat" "78⤵PID:1248
-
C:\windows\GZYB.exeC:\windows\GZYB.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AMDKC.exe.bat" "80⤵
- Executes a command shell one-liner
PID:4552 -
C:\windows\system\AMDKC.exeC:\windows\system\AMDKC.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ECJ.exe.bat" "82⤵PID:4992
-
C:\windows\SysWOW64\ECJ.exeC:\windows\system32\ECJ.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZPOUQ.exe.bat" "84⤵PID:4624
-
C:\windows\SysWOW64\ZPOUQ.exeC:\windows\system32\ZPOUQ.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QQQ.exe.bat" "86⤵PID:2144
-
C:\windows\system\QQQ.exeC:\windows\system\QQQ.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WQY.exe.bat" "88⤵PID:1672
-
C:\windows\WQY.exeC:\windows\WQY.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WEYBMG.exe.bat" "90⤵PID:6020
-
C:\windows\system\WEYBMG.exeC:\windows\system\WEYBMG.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3896 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LZHN.exe.bat" "92⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2868 -
C:\windows\SysWOW64\LZHN.exeC:\windows\system32\LZHN.exe93⤵
- Executes dropped EXE
PID:3368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LEHC.exe.bat" "94⤵
- Executes a command shell one-liner
PID:4800 -
C:\windows\LEHC.exeC:\windows\LEHC.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AZRGSBV.exe.bat" "96⤵
- Executes a command shell one-liner
PID:4348 -
C:\windows\SysWOW64\AZRGSBV.exeC:\windows\system32\AZRGSBV.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3024 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VVWQ.exe.bat" "98⤵
- System Location Discovery: System Language Discovery
PID:1992 -
C:\windows\system\VVWQ.exeC:\windows\system\VVWQ.exe99⤵
- Executes dropped EXE
PID:2968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BIVQZ.exe.bat" "100⤵PID:1124
-
C:\windows\BIVQZ.exeC:\windows\BIVQZ.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZGG.exe.bat" "102⤵PID:2204
-
C:\windows\system\ZGG.exeC:\windows\system\ZGG.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2336 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AJKPZZR.exe.bat" "104⤵PID:3616
-
C:\windows\SysWOW64\AJKPZZR.exeC:\windows\system32\AJKPZZR.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JJMC.exe.bat" "106⤵
- Executes a command shell one-liner
PID:2292 -
C:\windows\system\JJMC.exeC:\windows\system\JJMC.exe107⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EWRMN.exe.bat" "108⤵PID:1244
-
C:\windows\system\EWRMN.exeC:\windows\system\EWRMN.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IMX.exe.bat" "110⤵PID:668
-
C:\windows\IMX.exeC:\windows\IMX.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:684 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZNZR.exe.bat" "112⤵PID:4596
-
C:\windows\SysWOW64\ZNZR.exeC:\windows\system32\ZNZR.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OIJDOGH.exe.bat" "114⤵PID:1928
-
C:\windows\system\OIJDOGH.exeC:\windows\system\OIJDOGH.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NDIES.exe.bat" "116⤵
- System Location Discovery: System Language Discovery
PID:2328 -
C:\windows\NDIES.exeC:\windows\NDIES.exe117⤵
- Executes dropped EXE
PID:4328 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IOY.exe.bat" "118⤵PID:2272
-
C:\windows\IOY.exeC:\windows\IOY.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MWFCT.exe.bat" "120⤵
- Executes a command shell one-liner
PID:1764 -
C:\windows\system\MWFCT.exeC:\windows\system\MWFCT.exe121⤵
- Executes dropped EXE
PID:4100
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-