Analysis
- max time kernel
148s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
17/07/2026, 16:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-17_e703090278de4edd197feadcba9d1270_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-07-17_e703090278de4edd197feadcba9d1270_elex_emotet_stop.exe
- Size 208KB
- Sample260717-txqqbsfv3j
- SHA256 2d1c14b77fa9f62881499343269715a7cb257b948d5006b4fe0808be9be5ec1a
- MD5 e703090278de4edd197feadcba9d1270
- SHA1 3a0f39271486b078b210349db8d293cf3bfc6517
- SHA512 1e5a124a3bbaa8e45324b17388da453abe6cfb708ba0edd4c2d7fb02f5998ac746cd7fd22853a3e7deae260a53c44677aff6376f478229746a1a9d3a5dad58c6
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbclcdL+LOfS4NLthEjQT6j:MlZtbLWIgd1LZ9oECZbclc5+LOKQEj1
- TLSH T157247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2196 NWPZEI.exe 2216 HCQSLA.exe 3272 GMTIU.exe 4852 NHDMNT.exe 1300 VVPTYZ.exe 4280 WQTPD.exe 4068 VBWF.exe 3140 XYJZTD.exe 3360 HWPTBM.exe 5876 BSUDLMZ.exe 4196 RIVCSH.exe 5156 EKLT.exe 6012 IASBSC.exe 3764 MTUDW.exe 4632 ORHXD.exe 3160 URPLUJQ.exe 3420 YCNYU.exe 4332 XSY.exe 2024 MIZBO.exe 1448 WGNN.exe 1612 RTKWGL.exe 1856 TRXRV.exe 4796 FHE.exe 4216 FMEN.exe 5660 JULNNJ.exe 2148 CVSYEK.exe 2652 XIX.exe 348 GIZN.exe 2868 HMD.exe 5008 UWTPMI.exe 1140 OKY.exe 3852 JXDIY.exe 1924 MKARJH.exe 4276 XDD.exe 2428 RYIT.exe 3928 MLMDDO.exe 5324 VMOIPUZ.exe 2464 SRUF.exe 1872 LUYBBU.exe 1844 LXCEH.exe 1312 RYJSY.exe 3688 XYR.exe 2068 GYTL.exe 3532 HBX.exe 5668 AWBKD.exe 2448 SZE.exe 3396 YAMC.exe 2100 JSPVA.exe 4736 VIWVMJH.exe 5056 FJYAQG.exe 6080 JZE.exe 3084 TWKUJH.exe 1912 CXMH.exe 3656 GCEWLIL.exe 1004 BPJG.exe 600 WDOPXI.exe 5828 FLIU.exe 4400 WLKZMC.exe 5900 KWAY.exe 4800 TECDE.exe 3056 ZFKRNNS.exe 5836 QFE.exe 3912 JIQAEIV.exe 2968 YDZEP.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\JIQAEIV.exe.bat QFE.exe File created C:\windows\SysWOW64\HRIDHWE.exe.bat COKI.exe File created C:\windows\SysWOW64\WDIR.exe JSZT.exe File created C:\windows\SysWOW64\VBWF.exe WQTPD.exe File created C:\windows\SysWOW64\VBWF.exe.bat WQTPD.exe File created C:\windows\SysWOW64\MLMDDO.exe RYIT.exe File opened for modification C:\windows\SysWOW64\SRUF.exe VMOIPUZ.exe File created C:\windows\SysWOW64\XSY.exe.bat YCNYU.exe File opened for modification C:\windows\SysWOW64\MLMDDO.exe RYIT.exe File created C:\windows\SysWOW64\VMOIPUZ.exe MLMDDO.exe File created C:\windows\SysWOW64\HBX.exe GYTL.exe File opened for modification C:\windows\SysWOW64\COKI.exe ZGDIVLF.exe File created C:\windows\SysWOW64\SRUF.exe VMOIPUZ.exe File opened for modification C:\windows\SysWOW64\HBX.exe GYTL.exe File created C:\windows\SysWOW64\AWBKD.exe HBX.exe File created C:\windows\SysWOW64\DZG.exe MREH.exe File created C:\windows\SysWOW64\QEVLLQB.exe PBRQX.exe File opened for modification C:\windows\SysWOW64\WGNN.exe MIZBO.exe File opened for modification C:\windows\SysWOW64\LUYBBU.exe SRUF.exe File created C:\windows\SysWOW64\FLIU.exe.bat WDOPXI.exe File created C:\windows\SysWOW64\TECDE.exe KWAY.exe File opened for modification C:\windows\SysWOW64\RFS.exe WCJQM.exe File created C:\windows\SysWOW64\PCKYN.exe.bat YCIT.exe File created C:\windows\SysWOW64\GMTIU.exe HCQSLA.exe File created C:\windows\SysWOW64\GMTIU.exe.bat HCQSLA.exe File created C:\windows\SysWOW64\TWKUJH.exe JZE.exe File opened for modification C:\windows\SysWOW64\FLIU.exe WDOPXI.exe File opened for modification C:\windows\SysWOW64\ZFKRNNS.exe TECDE.exe File created C:\windows\SysWOW64\XAFHD.exe IFOCSWO.exe File created C:\windows\SysWOW64\VMOIPUZ.exe.bat MLMDDO.exe File opened for modification C:\windows\SysWOW64\JSPVA.exe YAMC.exe File opened for modification C:\windows\SysWOW64\HRIDHWE.exe COKI.exe File created C:\windows\SysWOW64\SQOUTZ.exe XGY.exe File opened for modification C:\windows\SysWOW64\SQOUTZ.exe XGY.exe File created C:\windows\SysWOW64\ZFKRNNS.exe.bat TECDE.exe File created C:\windows\SysWOW64\MREH.exe.bat DMTP.exe File opened for modification C:\windows\SysWOW64\XAFHD.exe IFOCSWO.exe File created C:\windows\SysWOW64\XAFHD.exe.bat IFOCSWO.exe File created C:\windows\SysWOW64\VVPTYZ.exe NHDMNT.exe File created C:\windows\SysWOW64\WGNN.exe MIZBO.exe File created C:\windows\SysWOW64\MLMDDO.exe.bat RYIT.exe File created C:\windows\SysWOW64\LUYBBU.exe SRUF.exe File created C:\windows\SysWOW64\JIQAEIV.exe QFE.exe File created C:\windows\SysWOW64\COKI.exe.bat ZGDIVLF.exe File opened for modification C:\windows\SysWOW64\WDIR.exe JSZT.exe File opened for modification C:\windows\SysWOW64\XQUPJZ.exe CDPF.exe File opened for modification C:\windows\SysWOW64\XSY.exe YCNYU.exe File created C:\windows\SysWOW64\JSPVA.exe.bat YAMC.exe File opened for modification C:\windows\SysWOW64\TWKUJH.exe JZE.exe File created C:\windows\SysWOW64\TECDE.exe.bat KWAY.exe File created C:\windows\SysWOW64\XQUPJZ.exe CDPF.exe File created C:\windows\SysWOW64\MREH.exe DMTP.exe File opened for modification C:\windows\SysWOW64\PCKYN.exe YCIT.exe File opened for modification C:\windows\SysWOW64\VBWF.exe WQTPD.exe File created C:\windows\SysWOW64\SRUF.exe.bat VMOIPUZ.exe File created C:\windows\SysWOW64\LUYBBU.exe.bat SRUF.exe File created C:\windows\SysWOW64\HRIDHWE.exe COKI.exe File opened for modification C:\windows\SysWOW64\DZG.exe MREH.exe File created C:\windows\SysWOW64\RFS.exe.bat WCJQM.exe File created C:\windows\SysWOW64\TWKUJH.exe.bat JZE.exe File opened for modification C:\windows\SysWOW64\TECDE.exe KWAY.exe File created C:\windows\SysWOW64\ZFKRNNS.exe TECDE.exe File created C:\windows\SysWOW64\DZG.exe.bat MREH.exe File created C:\windows\SysWOW64\JSPVA.exe YAMC.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\JXDIY.exe.bat OKY.exe File opened for modification C:\windows\system\XYR.exe RYJSY.exe File created C:\windows\CXMH.exe TWKUJH.exe File opened for modification C:\windows\system\ASXOYXM.exe HRIDHWE.exe File created C:\windows\JSZT.exe.bat ASXOYXM.exe File created C:\windows\FZEYW.exe QEVLLQB.exe File created C:\windows\FZEYW.exe.bat QEVLLQB.exe File opened for modification C:\windows\system\YCIT.exe FZEYW.exe File opened for modification C:\windows\system\RIVCSH.exe BSUDLMZ.exe File created C:\windows\system\RIVCSH.exe.bat BSUDLMZ.exe File created C:\windows\system\ORHXD.exe.bat MTUDW.exe File opened for modification C:\windows\YDZEP.exe JIQAEIV.exe File created C:\windows\DMTP.exe.bat XQUPJZ.exe File created C:\windows\system\WQTPD.exe VVPTYZ.exe File created C:\windows\system\IASBSC.exe EKLT.exe File opened for modification C:\windows\MIZBO.exe XSY.exe File opened for modification C:\windows\JZE.exe FJYAQG.exe File created C:\windows\CXMH.exe.bat TWKUJH.exe File created C:\windows\DMTP.exe XQUPJZ.exe File opened for modification C:\windows\system\EKLT.exe RIVCSH.exe File created C:\windows\system\ORHXD.exe MTUDW.exe File opened for modification C:\windows\system\RYIT.exe XDD.exe File created C:\windows\system\CDPF.exe.bat WDIR.exe File opened for modification C:\windows\system\NHDMNT.exe GMTIU.exe File created C:\windows\YCNYU.exe URPLUJQ.exe File created C:\windows\JULNNJ.exe.bat FMEN.exe File created C:\windows\BPJG.exe GCEWLIL.exe File created C:\windows\JSZT.exe ASXOYXM.exe File created C:\windows\system\HWPTBM.exe XYJZTD.exe File created C:\windows\system\XIX.exe CVSYEK.exe File opened for modification C:\windows\QFE.exe ZFKRNNS.exe File created C:\windows\WCJQM.exe.bat DZG.exe File created C:\windows\LXCEH.exe LUYBBU.exe File created C:\windows\FHE.exe.bat TRXRV.exe File opened for modification C:\windows\system\NWPZEI.exe 2026-07-17_e703090278de4edd197feadcba9d1270_elex_emotet_stop.exe File created C:\windows\HCQSLA.exe NWPZEI.exe File created C:\windows\system\NHDMNT.exe GMTIU.exe File created C:\windows\system\RIVCSH.exe BSUDLMZ.exe File opened for modification C:\windows\system\ORHXD.exe MTUDW.exe File created C:\windows\ZGDIVLF.exe.bat YDZEP.exe File created C:\windows\system\XYJZTD.exe VBWF.exe File created C:\windows\JULNNJ.exe FMEN.exe File created C:\windows\system\XIX.exe.bat CVSYEK.exe File created C:\windows\system\OKY.exe UWTPMI.exe File created C:\windows\WDOPXI.exe.bat BPJG.exe File created C:\windows\system\BSUDLMZ.exe HWPTBM.exe File created C:\windows\MIZBO.exe XSY.exe File created C:\windows\MIZBO.exe.bat XSY.exe File created C:\windows\CVSYEK.exe.bat JULNNJ.exe File created C:\windows\UWTPMI.exe HMD.exe File created C:\windows\UWTPMI.exe.bat HMD.exe File opened for modification C:\windows\system\OKY.exe UWTPMI.exe File created C:\windows\YDZEP.exe.bat JIQAEIV.exe File opened for modification C:\windows\system\MKARJH.exe JXDIY.exe File opened for modification C:\windows\FZEYW.exe QEVLLQB.exe File created C:\windows\system\YCIT.exe FZEYW.exe File opened for modification C:\windows\system\IFOCSWO.exe PCKYN.exe File created C:\windows\system\NWPZEI.exe.bat 2026-07-17_e703090278de4edd197feadcba9d1270_elex_emotet_stop.exe File created C:\windows\system\RTKWGL.exe WGNN.exe File opened for modification C:\windows\UWTPMI.exe HMD.exe File created C:\windows\system\XDD.exe MKARJH.exe File created C:\windows\system\XGY.exe XAFHD.exe File opened for modification C:\windows\system\IASBSC.exe EKLT.exe File created C:\windows\HMD.exe.bat GIZN.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3244 cmd.exe 2776 cmd.exe 236 cmd.exe 5636 cmd.exe 3060 cmd.exe 3940 cmd.exe 4312 cmd.exe 4492 cmd.exe 5340 cmd.exe 668 cmd.exe 4136 cmd.exe 5716 cmd.exe 5644 cmd.exe 4880 cmd.exe 5456 cmd.exe 1064 cmd.exe 5752 cmd.exe 3508 cmd.exe 2040 cmd.exe 3188 cmd.exe 3368 cmd.exe 360 cmd.exe 1816 cmd.exe 2580 cmd.exe 3864 cmd.exe 204 cmd.exe 5656 cmd.exe 3716 cmd.exe 2864 cmd.exe 2924 cmd.exe 3304 cmd.exe 5528 cmd.exe 5596 cmd.exe 5700 cmd.exe 5440 cmd.exe 1456 cmd.exe 860 cmd.exe 4240 cmd.exe 5336 cmd.exe 1128 cmd.exe 4560 cmd.exe 5924 cmd.exe 5916 cmd.exe 1256 cmd.exe 1620 cmd.exe 940 cmd.exe 4484 cmd.exe 5712 cmd.exe 3204 cmd.exe 2432 cmd.exe 2544 cmd.exe 2680 cmd.exe 4652 cmd.exe 5780 cmd.exe 3000 cmd.exe 928 cmd.exe 3456 cmd.exe 2780 cmd.exe 1756 cmd.exe 5768 cmd.exe 5744 cmd.exe 2636 cmd.exe 2708 cmd.exe 3024 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 936 4648 WerFault.exe 86 5324 2196 WerFault.exe 91 2308 2216 WerFault.exe 97 3388 3272 WerFault.exe 101 6088 4852 WerFault.exe 107 4332 1300 WerFault.exe 112 3956 4280 WerFault.exe 117 1924 4068 WerFault.exe 122 4252 3140 WerFault.exe 127 2944 3360 WerFault.exe 132 6000 5876 WerFault.exe 137 5500 4196 WerFault.exe 142 4828 5156 WerFault.exe 147 2148 6012 WerFault.exe 152 2120 3764 WerFault.exe 157 2008 4632 WerFault.exe 161 4348 3160 WerFault.exe 167 4676 3420 WerFault.exe 172 5228 4332 WerFault.exe 177 2096 2024 WerFault.exe 182 5036 1448 WerFault.exe 187 3816 1612 WerFault.exe 192 5100 1856 WerFault.exe 197 5496 4796 WerFault.exe 202 4908 4216 WerFault.exe 207 5928 5660 WerFault.exe 212 2556 2148 WerFault.exe 217 4652 2652 WerFault.exe 222 4384 348 WerFault.exe 227 2088 2868 WerFault.exe 232 3348 5008 WerFault.exe 237 2096 1140 WerFault.exe 242 1500 3852 WerFault.exe 247 1028 1924 WerFault.exe 252 3916 4276 WerFault.exe 257 5664 2428 WerFault.exe 262 936 3928 WerFault.exe 267 3560 5324 WerFault.exe 273 2996 2464 WerFault.exe 278 5768 1872 WerFault.exe 283 5616 1844 WerFault.exe 288 4820 1312 WerFault.exe 293 1492 3688 WerFault.exe 298 4056 2068 WerFault.exe 303 5824 3532 WerFault.exe 308 2140 5668 WerFault.exe 313 1196 2448 WerFault.exe 318 5988 3396 WerFault.exe 323 6060 2100 WerFault.exe 328 3576 4736 WerFault.exe 333 264 5056 WerFault.exe 338 4748 6080 WerFault.exe 343 3912 3084 WerFault.exe 348 2820 1912 WerFault.exe 353 5100 3656 WerFault.exe 358 4976 1004 WerFault.exe 363 3568 600 WerFault.exe 368 3260 5828 WerFault.exe 373 2716 4400 WerFault.exe 378 2704 5900 WerFault.exe 383 2960 4800 WerFault.exe 388 1952 3056 WerFault.exe 393 2004 5836 WerFault.exe 398 4324 3912 WerFault.exe 403 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OKY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LXCEH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RYIT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JZE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TECDE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NWPZEI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BSUDLMZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FLIU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QFE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HRIDHWE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FMEN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DMTP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DZG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WCJQM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CVSYEK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language URPLUJQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YDZEP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HCQSLA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AWBKD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XIX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VMOIPUZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WDOPXI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RTKWGL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HBX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CXMH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CDPF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PBRQX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FHE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YCNYU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WGNN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4648 2026-07-17_e703090278de4edd197feadcba9d1270_elex_emotet_stop.exe 4648 2026-07-17_e703090278de4edd197feadcba9d1270_elex_emotet_stop.exe 2196 NWPZEI.exe 2196 NWPZEI.exe 2216 HCQSLA.exe 2216 HCQSLA.exe 3272 GMTIU.exe 3272 GMTIU.exe 4852 NHDMNT.exe 4852 NHDMNT.exe 1300 VVPTYZ.exe 1300 VVPTYZ.exe 4280 WQTPD.exe 4280 WQTPD.exe 4068 VBWF.exe 4068 VBWF.exe 3140 XYJZTD.exe 3140 XYJZTD.exe 3360 HWPTBM.exe 3360 HWPTBM.exe 5876 BSUDLMZ.exe 5876 BSUDLMZ.exe 4196 RIVCSH.exe 4196 RIVCSH.exe 5156 EKLT.exe 5156 EKLT.exe 6012 IASBSC.exe 6012 IASBSC.exe 3764 MTUDW.exe 3764 MTUDW.exe 4632 ORHXD.exe 4632 ORHXD.exe 3160 URPLUJQ.exe 3160 URPLUJQ.exe 3420 YCNYU.exe 3420 YCNYU.exe 4332 XSY.exe 4332 XSY.exe 2024 MIZBO.exe 2024 MIZBO.exe 1448 WGNN.exe 1448 WGNN.exe 1612 RTKWGL.exe 1612 RTKWGL.exe 1856 TRXRV.exe 1856 TRXRV.exe 4796 FHE.exe 4796 FHE.exe 4216 FMEN.exe 4216 FMEN.exe 5660 JULNNJ.exe 5660 JULNNJ.exe 2148 CVSYEK.exe 2148 CVSYEK.exe 2652 XIX.exe 2652 XIX.exe 348 GIZN.exe 348 GIZN.exe 2868 HMD.exe 2868 HMD.exe 5008 UWTPMI.exe 5008 UWTPMI.exe 1140 OKY.exe 1140 OKY.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4648 2026-07-17_e703090278de4edd197feadcba9d1270_elex_emotet_stop.exe 4648 2026-07-17_e703090278de4edd197feadcba9d1270_elex_emotet_stop.exe 2196 NWPZEI.exe 2196 NWPZEI.exe 2216 HCQSLA.exe 2216 HCQSLA.exe 3272 GMTIU.exe 3272 GMTIU.exe 4852 NHDMNT.exe 4852 NHDMNT.exe 1300 VVPTYZ.exe 1300 VVPTYZ.exe 4280 WQTPD.exe 4280 WQTPD.exe 4068 VBWF.exe 4068 VBWF.exe 3140 XYJZTD.exe 3140 XYJZTD.exe 3360 HWPTBM.exe 3360 HWPTBM.exe 5876 BSUDLMZ.exe 5876 BSUDLMZ.exe 4196 RIVCSH.exe 4196 RIVCSH.exe 5156 EKLT.exe 5156 EKLT.exe 6012 IASBSC.exe 6012 IASBSC.exe 3764 MTUDW.exe 3764 MTUDW.exe 4632 ORHXD.exe 4632 ORHXD.exe 3160 URPLUJQ.exe 3160 URPLUJQ.exe 3420 YCNYU.exe 3420 YCNYU.exe 4332 XSY.exe 4332 XSY.exe 2024 MIZBO.exe 2024 MIZBO.exe 1448 WGNN.exe 1448 WGNN.exe 1612 RTKWGL.exe 1612 RTKWGL.exe 1856 TRXRV.exe 1856 TRXRV.exe 4796 FHE.exe 4796 FHE.exe 4216 FMEN.exe 4216 FMEN.exe 5660 JULNNJ.exe 5660 JULNNJ.exe 2148 CVSYEK.exe 2148 CVSYEK.exe 2652 XIX.exe 2652 XIX.exe 348 GIZN.exe 348 GIZN.exe 2868 HMD.exe 2868 HMD.exe 5008 UWTPMI.exe 5008 UWTPMI.exe 1140 OKY.exe 1140 OKY.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4648 wrote to memory of 5924 4648 2026-07-17_e703090278de4edd197feadcba9d1270_elex_emotet_stop.exe 87 PID 5924 wrote to memory of 2196 5924 cmd.exe 91 PID 2196 wrote to memory of 5644 2196 NWPZEI.exe 93 PID 5644 wrote to memory of 2216 5644 cmd.exe 97 PID 2216 wrote to memory of 2612 2216 HCQSLA.exe 98 PID 2612 wrote to memory of 3272 2612 cmd.exe 101 PID 3272 wrote to memory of 5656 3272 GMTIU.exe 103 PID 5656 wrote to memory of 4852 5656 cmd.exe 107 PID 4852 wrote to memory of 3368 4852 NHDMNT.exe 108 PID 3368 wrote to memory of 1300 3368 cmd.exe 112 PID 1300 wrote to memory of 3204 1300 VVPTYZ.exe 113 PID 3204 wrote to memory of 4280 3204 cmd.exe 117 PID 4280 wrote to memory of 5572 4280 WQTPD.exe 118 PID 5572 wrote to memory of 4068 5572 cmd.exe 122 PID 4068 wrote to memory of 360 4068 VBWF.exe 123 PID 360 wrote to memory of 3140 360 cmd.exe 127 PID 3140 wrote to memory of 4060 3140 XYJZTD.exe 128 PID 4060 wrote to memory of 3360 4060 cmd.exe 132 PID 3360 wrote to memory of 5916 3360 HWPTBM.exe 133 PID 5916 wrote to memory of 5876 5916 cmd.exe 137 PID 5876 wrote to memory of 2636 5876 BSUDLMZ.exe 138 PID 2636 wrote to memory of 4196 2636 cmd.exe 142 PID 4196 wrote to memory of 6052 4196 RIVCSH.exe 143 PID 6052 wrote to memory of 5156 6052 cmd.exe 147 PID 5156 wrote to memory of 4628 5156 EKLT.exe 148 PID 4628 wrote to memory of 6012 4628 cmd.exe 152 PID 6012 wrote to memory of 5680 6012 IASBSC.exe 153 PID 5680 wrote to memory of 3764 5680 cmd.exe 157 PID 3764 wrote to memory of 1816 3764 MTUDW.exe 158 PID 1816 wrote to memory of 4632 1816 cmd.exe 161 PID 4632 wrote to memory of 236 4632 ORHXD.exe 163 PID 236 wrote to memory of 3160 236 cmd.exe 167 PID 3160 wrote to memory of 5700 3160 URPLUJQ.exe 168 PID 5700 wrote to memory of 3420 5700 cmd.exe 172 PID 3420 wrote to memory of 4880 3420 YCNYU.exe 173 PID 4880 wrote to memory of 4332 4880 cmd.exe 177 PID 4332 wrote to memory of 2580 4332 XSY.exe 178 PID 2580 wrote to memory of 2024 2580 cmd.exe 182 PID 2024 wrote to memory of 2432 2024 MIZBO.exe 183 PID 2432 wrote to memory of 1448 2432 cmd.exe 187 PID 1448 wrote to memory of 5456 1448 WGNN.exe 188 PID 5456 wrote to memory of 1612 5456 cmd.exe 192 PID 1612 wrote to memory of 3032 1612 RTKWGL.exe 193 PID 3032 wrote to memory of 1856 3032 cmd.exe 197 PID 1856 wrote to memory of 2544 1856 TRXRV.exe 198 PID 2544 wrote to memory of 4796 2544 cmd.exe 202 PID 4796 wrote to memory of 3248 4796 FHE.exe 203 PID 3248 wrote to memory of 4216 3248 cmd.exe 207 PID 4216 wrote to memory of 2924 4216 FMEN.exe 208 PID 2924 wrote to memory of 5660 2924 cmd.exe 212 PID 5660 wrote to memory of 5716 5660 JULNNJ.exe 213 PID 5716 wrote to memory of 2148 5716 cmd.exe 217 PID 2148 wrote to memory of 3000 2148 CVSYEK.exe 218 PID 3000 wrote to memory of 2652 3000 cmd.exe 222 PID 2652 wrote to memory of 3960 2652 XIX.exe 223 PID 3960 wrote to memory of 348 3960 cmd.exe 227 PID 348 wrote to memory of 5636 348 GIZN.exe 228 PID 5636 wrote to memory of 2868 5636 cmd.exe 232 PID 2868 wrote to memory of 3352 2868 HMD.exe 233 PID 3352 wrote to memory of 5008 3352 cmd.exe 237 PID 5008 wrote to memory of 1064 5008 UWTPMI.exe 238 PID 1064 wrote to memory of 1140 1064 cmd.exe 242 PID 1140 wrote to memory of 2680 1140 OKY.exe 243 PID 2680 wrote to memory of 3852 2680 cmd.exe 247
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-17_e703090278de4edd197feadcba9d1270_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-17_e703090278de4edd197feadcba9d1270_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NWPZEI.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5924 -
C:\windows\system\NWPZEI.exeC:\windows\system\NWPZEI.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HCQSLA.exe.bat" "4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5644 -
C:\windows\HCQSLA.exeC:\windows\HCQSLA.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GMTIU.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\windows\SysWOW64\GMTIU.exeC:\windows\system32\GMTIU.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3272 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NHDMNT.exe.bat" "8⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5656 -
C:\windows\system\NHDMNT.exeC:\windows\system\NHDMNT.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VVPTYZ.exe.bat" "10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3368 -
C:\windows\SysWOW64\VVPTYZ.exeC:\windows\system32\VVPTYZ.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WQTPD.exe.bat" "12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3204 -
C:\windows\system\WQTPD.exeC:\windows\system\WQTPD.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VBWF.exe.bat" "14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5572 -
C:\windows\SysWOW64\VBWF.exeC:\windows\system32\VBWF.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XYJZTD.exe.bat" "16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:360 -
C:\windows\system\XYJZTD.exeC:\windows\system\XYJZTD.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HWPTBM.exe.bat" "18⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\windows\system\HWPTBM.exeC:\windows\system\HWPTBM.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BSUDLMZ.exe.bat" "20⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5916 -
C:\windows\system\BSUDLMZ.exeC:\windows\system\BSUDLMZ.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RIVCSH.exe.bat" "22⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\windows\system\RIVCSH.exeC:\windows\system\RIVCSH.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EKLT.exe.bat" "24⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6052 -
C:\windows\system\EKLT.exeC:\windows\system\EKLT.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5156 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IASBSC.exe.bat" "26⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\windows\system\IASBSC.exeC:\windows\system\IASBSC.exe27⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MTUDW.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:5680 -
C:\windows\MTUDW.exeC:\windows\MTUDW.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ORHXD.exe.bat" "30⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\windows\system\ORHXD.exeC:\windows\system\ORHXD.exe31⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\URPLUJQ.exe.bat" "32⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:236 -
C:\windows\URPLUJQ.exeC:\windows\URPLUJQ.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YCNYU.exe.bat" "34⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5700 -
C:\windows\YCNYU.exeC:\windows\YCNYU.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XSY.exe.bat" "36⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\windows\SysWOW64\XSY.exeC:\windows\system32\XSY.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MIZBO.exe.bat" "38⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\windows\MIZBO.exeC:\windows\MIZBO.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WGNN.exe.bat" "40⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\windows\SysWOW64\WGNN.exeC:\windows\system32\WGNN.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RTKWGL.exe.bat" "42⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5456 -
C:\windows\system\RTKWGL.exeC:\windows\system\RTKWGL.exe43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TRXRV.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\windows\system\TRXRV.exeC:\windows\system\TRXRV.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FHE.exe.bat" "46⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\windows\FHE.exeC:\windows\FHE.exe47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FMEN.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\windows\system\FMEN.exeC:\windows\system\FMEN.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JULNNJ.exe.bat" "50⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\windows\JULNNJ.exeC:\windows\JULNNJ.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CVSYEK.exe.bat" "52⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5716 -
C:\windows\CVSYEK.exeC:\windows\CVSYEK.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XIX.exe.bat" "54⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\windows\system\XIX.exeC:\windows\system\XIX.exe55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GIZN.exe.bat" "56⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\windows\GIZN.exeC:\windows\GIZN.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:348 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HMD.exe.bat" "58⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5636 -
C:\windows\HMD.exeC:\windows\HMD.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UWTPMI.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\windows\UWTPMI.exeC:\windows\UWTPMI.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OKY.exe.bat" "62⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\windows\system\OKY.exeC:\windows\system\OKY.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JXDIY.exe.bat" "64⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\windows\JXDIY.exeC:\windows\JXDIY.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MKARJH.exe.bat" "66⤵
- Executes a command shell one-liner
PID:4492 -
C:\windows\system\MKARJH.exeC:\windows\system\MKARJH.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XDD.exe.bat" "68⤵
- Executes a command shell one-liner
PID:3060 -
C:\windows\system\XDD.exeC:\windows\system\XDD.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4276 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RYIT.exe.bat" "70⤵
- Executes a command shell one-liner
PID:3244 -
C:\windows\system\RYIT.exeC:\windows\system\RYIT.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MLMDDO.exe.bat" "72⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5340 -
C:\windows\SysWOW64\MLMDDO.exeC:\windows\system32\MLMDDO.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VMOIPUZ.exe.bat" "74⤵
- Executes a command shell one-liner
PID:1256 -
C:\windows\SysWOW64\VMOIPUZ.exeC:\windows\system32\VMOIPUZ.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SRUF.exe.bat" "76⤵
- Executes a command shell one-liner
PID:928 -
C:\windows\SysWOW64\SRUF.exeC:\windows\system32\SRUF.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LUYBBU.exe.bat" "78⤵
- Executes a command shell one-liner
PID:5752 -
C:\windows\SysWOW64\LUYBBU.exeC:\windows\system32\LUYBBU.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LXCEH.exe.bat" "80⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3940 -
C:\windows\LXCEH.exeC:\windows\LXCEH.exe81⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RYJSY.exe.bat" "82⤵PID:2108
-
C:\windows\system\RYJSY.exeC:\windows\system\RYJSY.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XYR.exe.bat" "84⤵
- Executes a command shell one-liner
PID:3716 -
C:\windows\system\XYR.exeC:\windows\system\XYR.exe85⤵
- Executes dropped EXE
PID:3688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GYTL.exe.bat" "86⤵
- Executes a command shell one-liner
PID:1620 -
C:\windows\GYTL.exeC:\windows\GYTL.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HBX.exe.bat" "88⤵
- Executes a command shell one-liner
PID:3456 -
C:\windows\SysWOW64\HBX.exeC:\windows\system32\HBX.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AWBKD.exe.bat" "90⤵
- Executes a command shell one-liner
PID:4484 -
C:\windows\SysWOW64\AWBKD.exeC:\windows\system32\AWBKD.exe91⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SZE.exe.bat" "92⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2708 -
C:\windows\SysWOW64\SZE.exeC:\windows\system32\SZE.exe93⤵
- Executes dropped EXE
PID:2448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YAMC.exe.bat" "94⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:668 -
C:\windows\system\YAMC.exeC:\windows\system\YAMC.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JSPVA.exe.bat" "96⤵
- Executes a command shell one-liner
PID:3024 -
C:\windows\SysWOW64\JSPVA.exeC:\windows\system32\JSPVA.exe97⤵
- Executes dropped EXE
PID:2100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VIWVMJH.exe.bat" "98⤵
- Executes a command shell one-liner
PID:3864 -
C:\windows\VIWVMJH.exeC:\windows\VIWVMJH.exe99⤵
- Executes dropped EXE
PID:4736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FJYAQG.exe.bat" "100⤵
- Executes a command shell one-liner
PID:3304 -
C:\windows\FJYAQG.exeC:\windows\FJYAQG.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5056 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JZE.exe.bat" "102⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4136 -
C:\windows\JZE.exeC:\windows\JZE.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:6080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TWKUJH.exe.bat" "104⤵
- Executes a command shell one-liner
PID:5528 -
C:\windows\SysWOW64\TWKUJH.exeC:\windows\system32\TWKUJH.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CXMH.exe.bat" "106⤵PID:4820
-
C:\windows\CXMH.exeC:\windows\CXMH.exe107⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GCEWLIL.exe.bat" "108⤵PID:2584
-
C:\windows\system\GCEWLIL.exeC:\windows\system\GCEWLIL.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3656 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BPJG.exe.bat" "110⤵
- Executes a command shell one-liner
PID:5712 -
C:\windows\BPJG.exeC:\windows\BPJG.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WDOPXI.exe.bat" "112⤵
- Executes a command shell one-liner
PID:4240 -
C:\windows\WDOPXI.exeC:\windows\WDOPXI.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FLIU.exe.bat" "114⤵
- Executes a command shell one-liner
PID:4312 -
C:\windows\SysWOW64\FLIU.exeC:\windows\system32\FLIU.exe115⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WLKZMC.exe.bat" "116⤵PID:936
-
C:\windows\WLKZMC.exeC:\windows\WLKZMC.exe117⤵
- Executes dropped EXE
PID:4400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KWAY.exe.bat" "118⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2780 -
C:\windows\system\KWAY.exeC:\windows\system\KWAY.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TECDE.exe.bat" "120⤵
- Executes a command shell one-liner
PID:3508 -
C:\windows\SysWOW64\TECDE.exeC:\windows\system32\TECDE.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4800
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-