Analysis
- max time kernel
148s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
17/07/2026, 17:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-17_2ed2d22f34c94172a33e384c777da354_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-07-17_2ed2d22f34c94172a33e384c777da354_elex_emotet_stop.exe
- Size 208KB
- Sample260717-vth2ract5z
- SHA256 9d7f1469f8c4c367af73651314264cd75cf4b06af961c0a802ac95df2779db03
- MD5 2ed2d22f34c94172a33e384c777da354
- SHA1 bf10490f38d46e642f812e98671d136c58d18631
- SHA512 349ddf1ec15091b858c86697087f9a8e8ffe7648a0155cc3598ed89f048f2c2b36746dda177c09918129a4e54e0344eb5177adbcabd4057cc68df79bfbd54dca
- SSDEEP 3072:cLQaL9tbLkRIgd1Lye9yjE2hWAN5XbslcdL+LOfT4pLthEjQT6j:olZtbLWIgd1LZ9oECZbslc5+LObkEj1
- TLSH T106247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2428 WQB.exe 5716 XEZW.exe 1452 FJMD.exe 5880 IRVRY.exe 4652 MHB.exe 4552 QPIZX.exe 3108 CFOHJDM.exe 4456 LGQMNA.exe 4624 EJU.exe 2832 ZULHGB.exe 5852 SXPD.exe 2260 EFVLYJI.exe 5148 NFX.exe 2252 GFF.exe 1152 OLR.exe 2004 WBSHKB.exe 2044 IRZH.exe 4184 LZFPBE.exe 1828 ECJ.exe 3320 FXVOTSY.exe 5384 JNCO.exe 3592 NQAJGDW.exe 5920 ABIAU.exe 1808 RBK.exe 5044 MXPWI.exe 4500 QFWWUWW.exe 4276 WFDKD.exe 1468 CADLHB.exe 5808 GIJ.exe 3944 VDTXFG.exe 2768 IJBJ.exe 5340 OJIXQMV.exe 1352 EAJWW.exe 2304 BARKF.exe 2080 NIXKS.exe 4480 VYYJYP.exe 432 KTIO.exe 3804 SHICT.exe 5020 HCR.exe 4084 RCTTHH.exe 4988 LXY.exe 580 PFFDE.exe 780 XLFRFE.exe 2128 MOPW.exe 4600 WORJU.exe 4580 BOYWLRC.exe 3508 LXS.exe 3068 CXUHS.exe 2932 IXCUJWH.exe 2492 DLHE.exe 3216 BVR.exe 1628 DTXOBKB.exe 1540 JTF.exe 4780 CXIYYC.exe 3236 TFK.exe 1068 IAUPUU.exe 5740 IFUDVZ.exe 3336 MVBE.exe 2056 HJGNKR.exe 3596 JWKWURJ.exe 1700 VPFP.exe 4340 ECQHSD.exe 1956 VCS.exe 5796 MNDCEHK.exe - Drops file in System32 directory 48 IoCs
description ioc Process File created C:\windows\SysWOW64\RCTTHH.exe.bat HCR.exe File created C:\windows\SysWOW64\LXS.exe BOYWLRC.exe File opened for modification C:\windows\SysWOW64\LXS.exe BOYWLRC.exe File opened for modification C:\windows\SysWOW64\BVR.exe DLHE.exe File created C:\windows\SysWOW64\WQB.exe 2026-07-17_2ed2d22f34c94172a33e384c777da354_elex_emotet_stop.exe File created C:\windows\SysWOW64\NFX.exe.bat EFVLYJI.exe File created C:\windows\SysWOW64\GFF.exe NFX.exe File created C:\windows\SysWOW64\LZFPBE.exe IRZH.exe File opened for modification C:\windows\SysWOW64\LZFPBE.exe IRZH.exe File created C:\windows\SysWOW64\EAJWW.exe.bat OJIXQMV.exe File opened for modification C:\windows\SysWOW64\VYYJYP.exe NIXKS.exe File created C:\windows\SysWOW64\WQB.exe.bat 2026-07-17_2ed2d22f34c94172a33e384c777da354_elex_emotet_stop.exe File created C:\windows\SysWOW64\IRVRY.exe FJMD.exe File created C:\windows\SysWOW64\VYYJYP.exe.bat NIXKS.exe File created C:\windows\SysWOW64\LXS.exe.bat BOYWLRC.exe File opened for modification C:\windows\SysWOW64\MVBE.exe IFUDVZ.exe File created C:\windows\SysWOW64\OLR.exe GFF.exe File created C:\windows\SysWOW64\ECJ.exe.bat LZFPBE.exe File opened for modification C:\windows\SysWOW64\RCTTHH.exe HCR.exe File created C:\windows\SysWOW64\BVR.exe DLHE.exe File opened for modification C:\windows\SysWOW64\WQB.exe 2026-07-17_2ed2d22f34c94172a33e384c777da354_elex_emotet_stop.exe File opened for modification C:\windows\SysWOW64\IRVRY.exe FJMD.exe File created C:\windows\SysWOW64\EJU.exe LGQMNA.exe File created C:\windows\SysWOW64\NFX.exe EFVLYJI.exe File opened for modification C:\windows\SysWOW64\NFX.exe EFVLYJI.exe File created C:\windows\SysWOW64\WBSHKB.exe OLR.exe File opened for modification C:\windows\SysWOW64\ECJ.exe LZFPBE.exe File created C:\windows\SysWOW64\EAJWW.exe OJIXQMV.exe File created C:\windows\SysWOW64\LZFPBE.exe.bat IRZH.exe File opened for modification C:\windows\SysWOW64\EJU.exe LGQMNA.exe File opened for modification C:\windows\SysWOW64\GFF.exe NFX.exe File created C:\windows\SysWOW64\WBSHKB.exe.bat OLR.exe File created C:\windows\SysWOW64\RCTTHH.exe HCR.exe File created C:\windows\SysWOW64\MOPW.exe XLFRFE.exe File opened for modification C:\windows\SysWOW64\MOPW.exe XLFRFE.exe File created C:\windows\SysWOW64\MOPW.exe.bat XLFRFE.exe File created C:\windows\SysWOW64\IRVRY.exe.bat FJMD.exe File opened for modification C:\windows\SysWOW64\OLR.exe GFF.exe File created C:\windows\SysWOW64\OLR.exe.bat GFF.exe File opened for modification C:\windows\SysWOW64\WBSHKB.exe OLR.exe File created C:\windows\SysWOW64\ECJ.exe LZFPBE.exe File created C:\windows\SysWOW64\MVBE.exe IFUDVZ.exe File created C:\windows\SysWOW64\MVBE.exe.bat IFUDVZ.exe File created C:\windows\SysWOW64\EJU.exe.bat LGQMNA.exe File created C:\windows\SysWOW64\GFF.exe.bat NFX.exe File opened for modification C:\windows\SysWOW64\EAJWW.exe OJIXQMV.exe File created C:\windows\SysWOW64\VYYJYP.exe NIXKS.exe File created C:\windows\SysWOW64\BVR.exe.bat DLHE.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\ZULHGB.exe.bat EJU.exe File created C:\windows\system\EFVLYJI.exe.bat SXPD.exe File created C:\windows\NQAJGDW.exe.bat JNCO.exe File opened for modification C:\windows\system\XLFRFE.exe PFFDE.exe File opened for modification C:\windows\JTF.exe DTXOBKB.exe File opened for modification C:\windows\JNCO.exe FXVOTSY.exe File created C:\windows\system\TFK.exe.bat CXIYYC.exe File created C:\windows\system\MNDCEHK.exe.bat VCS.exe File created C:\windows\system\CFOHJDM.exe.bat QPIZX.exe File opened for modification C:\windows\system\VDTXFG.exe GIJ.exe File created C:\windows\system\DLHE.exe IXCUJWH.exe File opened for modification C:\windows\CADLHB.exe WFDKD.exe File created C:\windows\JNCO.exe.bat FXVOTSY.exe File created C:\windows\system\RBK.exe.bat ABIAU.exe File opened for modification C:\windows\HCR.exe SHICT.exe File opened for modification C:\windows\DTXOBKB.exe BVR.exe File created C:\windows\system\TFK.exe CXIYYC.exe File created C:\windows\system\EFVLYJI.exe SXPD.exe File opened for modification C:\windows\system\WORJU.exe MOPW.exe File opened for modification C:\windows\system\IXCUJWH.exe CXUHS.exe File created C:\windows\JTF.exe DTXOBKB.exe File created C:\windows\system\JWKWURJ.exe HJGNKR.exe File opened for modification C:\windows\system\JWKWURJ.exe HJGNKR.exe File opened for modification C:\windows\WDRYAB.exe YDJK.exe File opened for modification C:\windows\NQAJGDW.exe JNCO.exe File created C:\windows\system\BARKF.exe.bat EAJWW.exe File opened for modification C:\windows\system\KTIO.exe VYYJYP.exe File created C:\windows\system\IXCUJWH.exe.bat CXUHS.exe File created C:\windows\JTF.exe.bat DTXOBKB.exe File opened for modification C:\windows\system\IAUPUU.exe TFK.exe File opened for modification C:\windows\HJGNKR.exe MVBE.exe File created C:\windows\CADLHB.exe WFDKD.exe File created C:\windows\system\OJIXQMV.exe IJBJ.exe File created C:\windows\BOYWLRC.exe.bat WORJU.exe File opened for modification C:\windows\YDJK.exe MNDCEHK.exe File opened for modification C:\windows\system\CFOHJDM.exe QPIZX.exe File created C:\windows\QPIZX.exe MHB.exe File created C:\windows\LGQMNA.exe CFOHJDM.exe File created C:\windows\system\SHICT.exe KTIO.exe File opened for modification C:\windows\CXUHS.exe LXS.exe File opened for modification C:\windows\IFUDVZ.exe IAUPUU.exe File created C:\windows\system\ECQHSD.exe.bat VPFP.exe File opened for modification C:\windows\XEZW.exe WQB.exe File created C:\windows\QFWWUWW.exe MXPWI.exe File opened for modification C:\windows\GIJ.exe CADLHB.exe File created C:\windows\system\IJBJ.exe.bat VDTXFG.exe File created C:\windows\system\WORJU.exe MOPW.exe File created C:\windows\DTXOBKB.exe BVR.exe File created C:\windows\IFUDVZ.exe.bat IAUPUU.exe File created C:\windows\HJGNKR.exe MVBE.exe File created C:\windows\FJMD.exe.bat XEZW.exe File created C:\windows\system\MHB.exe IRVRY.exe File opened for modification C:\windows\system\IRZH.exe WBSHKB.exe File created C:\windows\system\FXVOTSY.exe.bat ECJ.exe File created C:\windows\HCR.exe.bat SHICT.exe File opened for modification C:\windows\system\PFFDE.exe LXY.exe File created C:\windows\CXIYYC.exe.bat JTF.exe File created C:\windows\HJGNKR.exe.bat MVBE.exe File created C:\windows\system\KTIO.exe.bat VYYJYP.exe File created C:\windows\LXY.exe.bat RCTTHH.exe File created C:\windows\BOYWLRC.exe WORJU.exe File created C:\windows\IFUDVZ.exe IAUPUU.exe File created C:\windows\system\ECQHSD.exe VPFP.exe File created C:\windows\XEZW.exe WQB.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5768 cmd.exe 5444 cmd.exe 5868 cmd.exe 5744 cmd.exe 2744 cmd.exe 5164 cmd.exe 4572 cmd.exe 6088 cmd.exe 2600 cmd.exe 4240 cmd.exe 4248 cmd.exe 4280 cmd.exe 2980 cmd.exe 3132 cmd.exe 5764 cmd.exe 3720 cmd.exe 2464 cmd.exe 3004 cmd.exe 4924 cmd.exe 3408 cmd.exe 2856 cmd.exe 5224 cmd.exe 1296 cmd.exe 4424 cmd.exe 5084 cmd.exe 1576 cmd.exe 3260 cmd.exe 1588 cmd.exe 4960 cmd.exe 2996 cmd.exe 3116 cmd.exe 1200 cmd.exe 4684 cmd.exe 4420 cmd.exe 1084 cmd.exe 1412 cmd.exe 3424 cmd.exe 1320 cmd.exe 5724 cmd.exe 4632 cmd.exe 3652 cmd.exe 572 cmd.exe 4172 cmd.exe 5132 cmd.exe 6040 cmd.exe 5012 cmd.exe 1772 cmd.exe 3576 cmd.exe 1464 cmd.exe 5508 cmd.exe 5972 cmd.exe 5168 cmd.exe 4328 cmd.exe 5700 cmd.exe 4140 cmd.exe 1692 cmd.exe 1952 cmd.exe 3564 cmd.exe 5592 cmd.exe 6132 cmd.exe 2776 cmd.exe 4792 cmd.exe 5956 cmd.exe 5380 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 1440 5936 WerFault.exe 88 2632 2428 WerFault.exe 93 940 5716 WerFault.exe 99 3116 1452 WerFault.exe 104 5136 5880 WerFault.exe 109 3092 4652 WerFault.exe 114 4212 4552 WerFault.exe 119 4384 3108 WerFault.exe 124 4320 4456 WerFault.exe 129 3420 4624 WerFault.exe 134 5736 2832 WerFault.exe 139 4680 5852 WerFault.exe 144 4872 2260 WerFault.exe 149 4408 5148 WerFault.exe 154 4640 2252 WerFault.exe 159 5484 1152 WerFault.exe 164 3160 2004 WerFault.exe 169 4080 2044 WerFault.exe 174 4084 4184 WerFault.exe 179 2176 1828 WerFault.exe 184 4324 3320 WerFault.exe 189 724 5384 WerFault.exe 194 428 3592 WerFault.exe 199 4112 5920 WerFault.exe 204 4316 1808 WerFault.exe 209 6072 5044 WerFault.exe 214 432 4500 WerFault.exe 219 1644 4276 WerFault.exe 224 524 1468 WerFault.exe 229 5972 5808 WerFault.exe 234 976 3944 WerFault.exe 239 2596 2768 WerFault.exe 244 3732 5340 WerFault.exe 249 1560 1352 WerFault.exe 254 3184 2304 WerFault.exe 259 6040 2080 WerFault.exe 264 3404 4480 WerFault.exe 269 3716 432 WerFault.exe 275 524 3804 WerFault.exe 280 5972 5020 WerFault.exe 285 1552 4084 WerFault.exe 290 5240 4988 WerFault.exe 295 5912 580 WerFault.exe 300 5180 780 WerFault.exe 305 5620 2128 WerFault.exe 310 5684 4600 WerFault.exe 315 2772 4580 WerFault.exe 320 5092 3508 WerFault.exe 325 1840 3068 WerFault.exe 330 3468 2932 WerFault.exe 335 3176 2492 WerFault.exe 340 5872 3216 WerFault.exe 345 1560 1628 WerFault.exe 350 4640 1540 WerFault.exe 355 6072 4780 WerFault.exe 360 5588 3236 WerFault.exe 365 4504 1068 WerFault.exe 370 524 5740 WerFault.exe 375 620 3336 WerFault.exe 380 1252 2056 WerFault.exe 385 2868 3596 WerFault.exe 390 4160 1700 WerFault.exe 395 5372 4340 WerFault.exe 400 2224 1956 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JNCO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KTIO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VCS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FXVOTSY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-17_2ed2d22f34c94172a33e384c777da354_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WQB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LGQMNA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IRVRY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BARKF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MVBE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CXUHS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ECQHSD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VDTXFG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RCTTHH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QFWWUWW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ABIAU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OLR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HCR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IJBJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BVR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZULHGB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YDJK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RBK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IXCUJWH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GIJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5936 2026-07-17_2ed2d22f34c94172a33e384c777da354_elex_emotet_stop.exe 5936 2026-07-17_2ed2d22f34c94172a33e384c777da354_elex_emotet_stop.exe 2428 WQB.exe 2428 WQB.exe 5716 XEZW.exe 5716 XEZW.exe 1452 FJMD.exe 1452 FJMD.exe 5880 IRVRY.exe 5880 IRVRY.exe 4652 MHB.exe 4652 MHB.exe 4552 QPIZX.exe 4552 QPIZX.exe 3108 CFOHJDM.exe 3108 CFOHJDM.exe 4456 LGQMNA.exe 4456 LGQMNA.exe 4624 EJU.exe 4624 EJU.exe 2832 ZULHGB.exe 2832 ZULHGB.exe 5852 SXPD.exe 5852 SXPD.exe 2260 EFVLYJI.exe 2260 EFVLYJI.exe 5148 NFX.exe 5148 NFX.exe 2252 GFF.exe 2252 GFF.exe 1152 OLR.exe 1152 OLR.exe 2004 WBSHKB.exe 2004 WBSHKB.exe 2044 IRZH.exe 2044 IRZH.exe 4184 LZFPBE.exe 4184 LZFPBE.exe 1828 ECJ.exe 1828 ECJ.exe 3320 FXVOTSY.exe 3320 FXVOTSY.exe 5384 JNCO.exe 5384 JNCO.exe 3592 NQAJGDW.exe 3592 NQAJGDW.exe 5920 ABIAU.exe 5920 ABIAU.exe 1808 RBK.exe 1808 RBK.exe 5044 MXPWI.exe 5044 MXPWI.exe 4500 QFWWUWW.exe 4500 QFWWUWW.exe 4276 WFDKD.exe 4276 WFDKD.exe 1468 CADLHB.exe 1468 CADLHB.exe 5808 GIJ.exe 5808 GIJ.exe 3944 VDTXFG.exe 3944 VDTXFG.exe 2768 IJBJ.exe 2768 IJBJ.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 5936 2026-07-17_2ed2d22f34c94172a33e384c777da354_elex_emotet_stop.exe 5936 2026-07-17_2ed2d22f34c94172a33e384c777da354_elex_emotet_stop.exe 2428 WQB.exe 2428 WQB.exe 5716 XEZW.exe 5716 XEZW.exe 1452 FJMD.exe 1452 FJMD.exe 5880 IRVRY.exe 5880 IRVRY.exe 4652 MHB.exe 4652 MHB.exe 4552 QPIZX.exe 4552 QPIZX.exe 3108 CFOHJDM.exe 3108 CFOHJDM.exe 4456 LGQMNA.exe 4456 LGQMNA.exe 4624 EJU.exe 4624 EJU.exe 2832 ZULHGB.exe 2832 ZULHGB.exe 5852 SXPD.exe 5852 SXPD.exe 2260 EFVLYJI.exe 2260 EFVLYJI.exe 5148 NFX.exe 5148 NFX.exe 2252 GFF.exe 2252 GFF.exe 1152 OLR.exe 1152 OLR.exe 2004 WBSHKB.exe 2004 WBSHKB.exe 2044 IRZH.exe 2044 IRZH.exe 4184 LZFPBE.exe 4184 LZFPBE.exe 1828 ECJ.exe 1828 ECJ.exe 3320 FXVOTSY.exe 3320 FXVOTSY.exe 5384 JNCO.exe 5384 JNCO.exe 3592 NQAJGDW.exe 3592 NQAJGDW.exe 5920 ABIAU.exe 5920 ABIAU.exe 1808 RBK.exe 1808 RBK.exe 5044 MXPWI.exe 5044 MXPWI.exe 4500 QFWWUWW.exe 4500 QFWWUWW.exe 4276 WFDKD.exe 4276 WFDKD.exe 1468 CADLHB.exe 1468 CADLHB.exe 5808 GIJ.exe 5808 GIJ.exe 3944 VDTXFG.exe 3944 VDTXFG.exe 2768 IJBJ.exe 2768 IJBJ.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5936 wrote to memory of 1576 5936 2026-07-17_2ed2d22f34c94172a33e384c777da354_elex_emotet_stop.exe 89 PID 1576 wrote to memory of 2428 1576 cmd.exe 93 PID 2428 wrote to memory of 1412 2428 WQB.exe 95 PID 1412 wrote to memory of 5716 1412 cmd.exe 99 PID 5716 wrote to memory of 3260 5716 XEZW.exe 100 PID 3260 wrote to memory of 1452 3260 cmd.exe 104 PID 1452 wrote to memory of 5380 1452 FJMD.exe 105 PID 5380 wrote to memory of 5880 5380 cmd.exe 109 PID 5880 wrote to memory of 2600 5880 IRVRY.exe 110 PID 2600 wrote to memory of 4652 2600 cmd.exe 114 PID 4652 wrote to memory of 2980 4652 MHB.exe 115 PID 2980 wrote to memory of 4552 2980 cmd.exe 119 PID 4552 wrote to memory of 3652 4552 QPIZX.exe 120 PID 3652 wrote to memory of 3108 3652 cmd.exe 124 PID 3108 wrote to memory of 572 3108 CFOHJDM.exe 125 PID 572 wrote to memory of 4456 572 cmd.exe 129 PID 4456 wrote to memory of 4240 4456 LGQMNA.exe 130 PID 4240 wrote to memory of 4624 4240 cmd.exe 134 PID 4624 wrote to memory of 3564 4624 EJU.exe 135 PID 3564 wrote to memory of 2832 3564 cmd.exe 139 PID 2832 wrote to memory of 4840 2832 ZULHGB.exe 140 PID 4840 wrote to memory of 5852 4840 cmd.exe 144 PID 5852 wrote to memory of 4248 5852 SXPD.exe 145 PID 4248 wrote to memory of 2260 4248 cmd.exe 149 PID 2260 wrote to memory of 5592 2260 EFVLYJI.exe 150 PID 5592 wrote to memory of 5148 5592 cmd.exe 154 PID 5148 wrote to memory of 2464 5148 NFX.exe 155 PID 2464 wrote to memory of 2252 2464 cmd.exe 159 PID 2252 wrote to memory of 1772 2252 GFF.exe 160 PID 1772 wrote to memory of 1152 1772 cmd.exe 164 PID 1152 wrote to memory of 3132 1152 OLR.exe 165 PID 3132 wrote to memory of 2004 3132 cmd.exe 169 PID 2004 wrote to memory of 5724 2004 WBSHKB.exe 170 PID 5724 wrote to memory of 2044 5724 cmd.exe 174 PID 2044 wrote to memory of 3576 2044 IRZH.exe 175 PID 3576 wrote to memory of 4184 3576 cmd.exe 179 PID 4184 wrote to memory of 5168 4184 LZFPBE.exe 180 PID 5168 wrote to memory of 1828 5168 cmd.exe 184 PID 1828 wrote to memory of 6132 1828 ECJ.exe 185 PID 6132 wrote to memory of 3320 6132 cmd.exe 189 PID 3320 wrote to memory of 3004 3320 FXVOTSY.exe 190 PID 3004 wrote to memory of 5384 3004 cmd.exe 194 PID 5384 wrote to memory of 1752 5384 JNCO.exe 195 PID 1752 wrote to memory of 3592 1752 cmd.exe 199 PID 3592 wrote to memory of 5768 3592 NQAJGDW.exe 200 PID 5768 wrote to memory of 5920 5768 cmd.exe 204 PID 5920 wrote to memory of 2996 5920 ABIAU.exe 205 PID 2996 wrote to memory of 1808 2996 cmd.exe 209 PID 1808 wrote to memory of 5444 1808 RBK.exe 210 PID 5444 wrote to memory of 5044 5444 cmd.exe 214 PID 5044 wrote to memory of 4328 5044 MXPWI.exe 215 PID 4328 wrote to memory of 4500 4328 cmd.exe 219 PID 4500 wrote to memory of 4172 4500 QFWWUWW.exe 220 PID 4172 wrote to memory of 4276 4172 cmd.exe 224 PID 4276 wrote to memory of 1588 4276 WFDKD.exe 225 PID 1588 wrote to memory of 1468 1588 cmd.exe 229 PID 1468 wrote to memory of 1464 1468 CADLHB.exe 230 PID 1464 wrote to memory of 5808 1464 cmd.exe 234 PID 5808 wrote to memory of 5700 5808 GIJ.exe 235 PID 5700 wrote to memory of 3944 5700 cmd.exe 239 PID 3944 wrote to memory of 5744 3944 VDTXFG.exe 240 PID 5744 wrote to memory of 2768 5744 cmd.exe 244 PID 2768 wrote to memory of 2776 2768 IJBJ.exe 245 PID 2776 wrote to memory of 5340 2776 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-17_2ed2d22f34c94172a33e384c777da354_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-17_2ed2d22f34c94172a33e384c777da354_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WQB.exe.bat" "2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\windows\SysWOW64\WQB.exeC:\windows\system32\WQB.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XEZW.exe.bat" "4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\windows\XEZW.exeC:\windows\XEZW.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FJMD.exe.bat" "6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\windows\FJMD.exeC:\windows\FJMD.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IRVRY.exe.bat" "8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5380 -
C:\windows\SysWOW64\IRVRY.exeC:\windows\system32\IRVRY.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MHB.exe.bat" "10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\windows\system\MHB.exeC:\windows\system\MHB.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QPIZX.exe.bat" "12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\windows\QPIZX.exeC:\windows\QPIZX.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CFOHJDM.exe.bat" "14⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\windows\system\CFOHJDM.exeC:\windows\system\CFOHJDM.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LGQMNA.exe.bat" "16⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:572 -
C:\windows\LGQMNA.exeC:\windows\LGQMNA.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EJU.exe.bat" "18⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\windows\SysWOW64\EJU.exeC:\windows\system32\EJU.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZULHGB.exe.bat" "20⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\windows\system\ZULHGB.exeC:\windows\system\ZULHGB.exe21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SXPD.exe.bat" "22⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\windows\system\SXPD.exeC:\windows\system\SXPD.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EFVLYJI.exe.bat" "24⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\windows\system\EFVLYJI.exeC:\windows\system\EFVLYJI.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NFX.exe.bat" "26⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5592 -
C:\windows\SysWOW64\NFX.exeC:\windows\system32\NFX.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5148 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GFF.exe.bat" "28⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\windows\SysWOW64\GFF.exeC:\windows\system32\GFF.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OLR.exe.bat" "30⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\windows\SysWOW64\OLR.exeC:\windows\system32\OLR.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WBSHKB.exe.bat" "32⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3132 -
C:\windows\SysWOW64\WBSHKB.exeC:\windows\system32\WBSHKB.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IRZH.exe.bat" "34⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5724 -
C:\windows\system\IRZH.exeC:\windows\system\IRZH.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LZFPBE.exe.bat" "36⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\windows\SysWOW64\LZFPBE.exeC:\windows\system32\LZFPBE.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ECJ.exe.bat" "38⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5168 -
C:\windows\SysWOW64\ECJ.exeC:\windows\system32\ECJ.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FXVOTSY.exe.bat" "40⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6132 -
C:\windows\system\FXVOTSY.exeC:\windows\system\FXVOTSY.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JNCO.exe.bat" "42⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\windows\JNCO.exeC:\windows\JNCO.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NQAJGDW.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\windows\NQAJGDW.exeC:\windows\NQAJGDW.exe45⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ABIAU.exe.bat" "46⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5768 -
C:\windows\system\ABIAU.exeC:\windows\system\ABIAU.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RBK.exe.bat" "48⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\windows\system\RBK.exeC:\windows\system\RBK.exe49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MXPWI.exe.bat" "50⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5444 -
C:\windows\system\MXPWI.exeC:\windows\system\MXPWI.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QFWWUWW.exe.bat" "52⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\windows\QFWWUWW.exeC:\windows\QFWWUWW.exe53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WFDKD.exe.bat" "54⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\windows\WFDKD.exeC:\windows\WFDKD.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CADLHB.exe.bat" "56⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\windows\CADLHB.exeC:\windows\CADLHB.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GIJ.exe.bat" "58⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\windows\GIJ.exeC:\windows\GIJ.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VDTXFG.exe.bat" "60⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5700 -
C:\windows\system\VDTXFG.exeC:\windows\system\VDTXFG.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IJBJ.exe.bat" "62⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5744 -
C:\windows\system\IJBJ.exeC:\windows\system\IJBJ.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OJIXQMV.exe.bat" "64⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\windows\system\OJIXQMV.exeC:\windows\system\OJIXQMV.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5340 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EAJWW.exe.bat" "66⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2744 -
C:\windows\SysWOW64\EAJWW.exeC:\windows\system32\EAJWW.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BARKF.exe.bat" "68⤵
- Executes a command shell one-liner
PID:4280 -
C:\windows\system\BARKF.exeC:\windows\system\BARKF.exe69⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NIXKS.exe.bat" "70⤵
- Executes a command shell one-liner
PID:5764 -
C:\windows\system\NIXKS.exeC:\windows\system\NIXKS.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VYYJYP.exe.bat" "72⤵
- Executes a command shell one-liner
PID:3116 -
C:\windows\SysWOW64\VYYJYP.exeC:\windows\system32\VYYJYP.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KTIO.exe.bat" "74⤵
- Executes a command shell one-liner
PID:5132 -
C:\windows\system\KTIO.exeC:\windows\system\KTIO.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SHICT.exe.bat" "76⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4792 -
C:\windows\system\SHICT.exeC:\windows\system\SHICT.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HCR.exe.bat" "78⤵
- Executes a command shell one-liner
PID:1200 -
C:\windows\HCR.exeC:\windows\HCR.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5020 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RCTTHH.exe.bat" "80⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5164 -
C:\windows\SysWOW64\RCTTHH.exeC:\windows\system32\RCTTHH.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LXY.exe.bat" "82⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5224 -
C:\windows\LXY.exeC:\windows\LXY.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PFFDE.exe.bat" "84⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1320 -
C:\windows\system\PFFDE.exeC:\windows\system\PFFDE.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XLFRFE.exe.bat" "86⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5508 -
C:\windows\system\XLFRFE.exeC:\windows\system\XLFRFE.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MOPW.exe.bat" "88⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1296 -
C:\windows\SysWOW64\MOPW.exeC:\windows\system32\MOPW.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WORJU.exe.bat" "90⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4424 -
C:\windows\system\WORJU.exeC:\windows\system\WORJU.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BOYWLRC.exe.bat" "92⤵
- Executes a command shell one-liner
PID:6040 -
C:\windows\BOYWLRC.exeC:\windows\BOYWLRC.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LXS.exe.bat" "94⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4572 -
C:\windows\SysWOW64\LXS.exeC:\windows\system32\LXS.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CXUHS.exe.bat" "96⤵
- Executes a command shell one-liner
PID:5012 -
C:\windows\CXUHS.exeC:\windows\CXUHS.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IXCUJWH.exe.bat" "98⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5868 -
C:\windows\system\IXCUJWH.exeC:\windows\system\IXCUJWH.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DLHE.exe.bat" "100⤵
- Executes a command shell one-liner
PID:5972 -
C:\windows\system\DLHE.exeC:\windows\system\DLHE.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BVR.exe.bat" "102⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4140 -
C:\windows\SysWOW64\BVR.exeC:\windows\system32\BVR.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3216 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DTXOBKB.exe.bat" "104⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4684 -
C:\windows\DTXOBKB.exeC:\windows\DTXOBKB.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1628 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JTF.exe.bat" "106⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3424 -
C:\windows\JTF.exeC:\windows\JTF.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CXIYYC.exe.bat" "108⤵
- Executes a command shell one-liner
PID:5956 -
C:\windows\CXIYYC.exeC:\windows\CXIYYC.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TFK.exe.bat" "110⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4420 -
C:\windows\system\TFK.exeC:\windows\system\TFK.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IAUPUU.exe.bat" "112⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1692 -
C:\windows\system\IAUPUU.exeC:\windows\system\IAUPUU.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IFUDVZ.exe.bat" "114⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:6088 -
C:\windows\IFUDVZ.exeC:\windows\IFUDVZ.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MVBE.exe.bat" "116⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1084 -
C:\windows\SysWOW64\MVBE.exeC:\windows\system32\MVBE.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3336 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HJGNKR.exe.bat" "118⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4960 -
C:\windows\HJGNKR.exeC:\windows\HJGNKR.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2056 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JWKWURJ.exe.bat" "120⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3408 -
C:\windows\system\JWKWURJ.exeC:\windows\system\JWKWURJ.exe121⤵
- Executes dropped EXE
PID:3596
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-