Analysis
- max time kernel
84s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/07/2026, 02:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-17_a3e72fdce9bed046de4139bb6eb3bb3d_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-07-17_a3e72fdce9bed046de4139bb6eb3bb3d_elex_emotet_stop.exe
- Size 448KB
- Sample260718-c6bt4ahs6v
- SHA256 4903896ba90a5e35c4f25e642454e6bb9631d872ea6c24d456a5975e83d95ffc
- MD5 a3e72fdce9bed046de4139bb6eb3bb3d
- SHA1 5c9c183a5ca47cf210c654b9e1cc07766f789096
- SHA512 471ce803f659f4fb13efca19502b96530f2498e06851e785a622100f3dbc45e79d61af7d5729d4b865d0533b0f8023962c9ea04ef2ef39d92874bf25c4ebe0ea
- SSDEEP 6144:TlZtbLWIgd1LZ9oECZbxlUS+LO+kEjiPISUOgW9X+hOGzC/NM:RLWI09QZb6LO+kmZzcukG2/
- TLSH T152A49F20B9D58673E2630135689AF1A4B3BABCA0F765C28B3158B71C2773B90173E75D
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 444 LULU.exe 2544 BCGGO.exe 3924 PXSHCPA.exe 5048 FNFQKWQ.exe 1928 PLLKZE.exe 4680 NWNAI.exe 1412 VKAHK.exe 2228 NKOMX.exe 3372 AQOQ.exe 3256 IVB.exe 6016 JYRT.exe 3156 TWX.exe 704 EJEL.exe 3448 HFN.exe 236 UCV.exe 1876 EABTVR.exe 4704 ZNSCHC.exe 2488 CEB.exe 4200 TEP.exe 1488 MXX.exe 3048 JXGJWKU.exe 2900 TVMEDT.exe 5992 ODVAKN.exe 5020 WRZHV.exe 4160 GONTK.exe 1124 OUSI.exe 2404 WZEP.exe 1852 ENJ.exe 4732 XFYG.exe 4756 LLYSBCH.exe 2676 XTR.exe 2328 EJSJVBK.exe 3984 VSHPISN.exe 1796 EXTVTQ.exe 4608 MLYCDP.exe 5684 KVJSM.exe 5032 LYNORTC.exe 3136 PGTW.exe 2428 ZEZI.exe 5732 GUIHS.exe 5184 LASXIK.exe 1724 JLVNQ.exe 2592 RBEEXM.exe 1168 BYKYFU.exe 4268 OJSX.exe 6068 UERYXA.exe 5264 YNYG.exe 2072 NIPKVFK.exe 5400 BNPWX.exe 1784 DBGYIK.exe 4216 JWGY.exe 1192 CZJCSD.exe 1476 OHQ.exe 4920 SXXKR.exe 3468 KSBG.exe 4156 GDREKGG.exe 3060 EYIFP.exe 3492 OWW.exe 3424 GRAVKH.exe 2292 QPFQ.exe 852 UFMYDI.exe 2820 IAX.exe 5960 KYLLZ.exe 1824 AOMK.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\XOAVBM.exe NRUB.exe File created C:\windows\SysWOW64\QKQK.exe.bat BHZGZK.exe File created C:\windows\SysWOW64\IIVUQE.exe.bat MFM.exe File opened for modification C:\windows\SysWOW64\GONTK.exe WRZHV.exe File created C:\windows\SysWOW64\XOAVBM.exe NRUB.exe File created C:\windows\SysWOW64\ALYYW.exe IIVUQE.exe File created C:\windows\SysWOW64\VKAHK.exe.bat NWNAI.exe File opened for modification C:\windows\SysWOW64\NKOMX.exe VKAHK.exe File opened for modification C:\windows\SysWOW64\GDREKGG.exe KSBG.exe File opened for modification C:\windows\SysWOW64\OWW.exe EYIFP.exe File created C:\windows\SysWOW64\NRUB.exe.bat AOMK.exe File opened for modification C:\windows\SysWOW64\FYWQ.exe UGHF.exe File created C:\windows\SysWOW64\TTKQCAZ.exe BLI.exe File opened for modification C:\windows\SysWOW64\EMF.exe TTKQCAZ.exe File created C:\windows\SysWOW64\FNFQKWQ.exe.bat PXSHCPA.exe File created C:\windows\SysWOW64\GDREKGG.exe KSBG.exe File opened for modification C:\windows\SysWOW64\MROOX.exe BYLV.exe File opened for modification C:\windows\SysWOW64\FNFQKWQ.exe PXSHCPA.exe File created C:\windows\SysWOW64\NKOMX.exe.bat VKAHK.exe File created C:\windows\SysWOW64\TTKQCAZ.exe.bat BLI.exe File created C:\windows\SysWOW64\IULJW.exe.bat EMF.exe File created C:\windows\SysWOW64\QKQK.exe BHZGZK.exe File created C:\windows\SysWOW64\ALYYW.exe.bat IIVUQE.exe File opened for modification C:\windows\SysWOW64\UCV.exe HFN.exe File created C:\windows\SysWOW64\GONTK.exe WRZHV.exe File created C:\windows\SysWOW64\LYNORTC.exe.bat KVJSM.exe File created C:\windows\SysWOW64\GUIHS.exe.bat ZEZI.exe File created C:\windows\SysWOW64\DBGYIK.exe BNPWX.exe File opened for modification C:\windows\SysWOW64\NRUB.exe AOMK.exe File created C:\windows\SysWOW64\CUOEP.exe.bat DKM.exe File created C:\windows\SysWOW64\EMF.exe TTKQCAZ.exe File created C:\windows\SysWOW64\FNFQKWQ.exe PXSHCPA.exe File created C:\windows\SysWOW64\EJSJVBK.exe XTR.exe File created C:\windows\SysWOW64\DBGYIK.exe.bat BNPWX.exe File opened for modification C:\windows\SysWOW64\TTKQCAZ.exe BLI.exe File created C:\windows\SysWOW64\EMF.exe.bat TTKQCAZ.exe File created C:\windows\SysWOW64\IULJW.exe EMF.exe File opened for modification C:\windows\SysWOW64\QKQK.exe BHZGZK.exe File created C:\windows\SysWOW64\MFM.exe XPDEV.exe File opened for modification C:\windows\SysWOW64\JXGJWKU.exe MXX.exe File created C:\windows\SysWOW64\GONTK.exe.bat WRZHV.exe File created C:\windows\SysWOW64\EXTVTQ.exe.bat VSHPISN.exe File opened for modification C:\windows\SysWOW64\SXXKR.exe OHQ.exe File created C:\windows\SysWOW64\IIVUQE.exe MFM.exe File opened for modification C:\windows\SysWOW64\PXSHCPA.exe BCGGO.exe File created C:\windows\SysWOW64\JXGJWKU.exe.bat MXX.exe File opened for modification C:\windows\SysWOW64\EJSJVBK.exe XTR.exe File created C:\windows\SysWOW64\EXTVTQ.exe VSHPISN.exe File created C:\windows\SysWOW64\LYNORTC.exe KVJSM.exe File created C:\windows\SysWOW64\BNPWX.exe.bat NIPKVFK.exe File created C:\windows\SysWOW64\CUOEP.exe DKM.exe File opened for modification C:\windows\SysWOW64\CUOEP.exe DKM.exe File created C:\windows\SysWOW64\PXSHCPA.exe BCGGO.exe File created C:\windows\SysWOW64\PXSHCPA.exe.bat BCGGO.exe File created C:\windows\SysWOW64\GDREKGG.exe.bat KSBG.exe File created C:\windows\SysWOW64\QPFQ.exe GRAVKH.exe File opened for modification C:\windows\SysWOW64\HAJWQI.exe BABIHN.exe File created C:\windows\SysWOW64\EJVFKA.exe WOM.exe File created C:\windows\SysWOW64\MFM.exe.bat XPDEV.exe File opened for modification C:\windows\SysWOW64\IIVUQE.exe MFM.exe File opened for modification C:\windows\SysWOW64\BNPWX.exe NIPKVFK.exe File opened for modification C:\windows\SysWOW64\DBGYIK.exe BNPWX.exe File opened for modification C:\windows\SysWOW64\UFMYDI.exe QPFQ.exe File opened for modification C:\windows\SysWOW64\EJVFKA.exe WOM.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\WRZHV.exe.bat ODVAKN.exe File created C:\windows\IVB.exe.bat AQOQ.exe File created C:\windows\system\JYRT.exe.bat IVB.exe File opened for modification C:\windows\system\TVMEDT.exe JXGJWKU.exe File created C:\windows\XFYG.exe.bat ENJ.exe File opened for modification C:\windows\system\UNOF.exe QKQK.exe File created C:\windows\system\HYLBT.exe.bat SDCXAFX.exe File created C:\windows\WOM.exe.bat HYLBT.exe File opened for modification C:\windows\LLYSBCH.exe XFYG.exe File opened for modification C:\windows\system\XTR.exe LLYSBCH.exe File created C:\windows\system\JLVNQ.exe.bat LASXIK.exe File opened for modification C:\windows\system\RBEEXM.exe JLVNQ.exe File created C:\windows\system\UGHF.exe.bat IQAFVDI.exe File created C:\windows\BABIHN.exe.bat MKA.exe File opened for modification C:\windows\BHZGZK.exe URYGSOI.exe File created C:\windows\system\UNOF.exe.bat QKQK.exe File created C:\windows\AQOQ.exe.bat NKOMX.exe File created C:\windows\EABTVR.exe UCV.exe File opened for modification C:\windows\system\BYKYFU.exe RBEEXM.exe File created C:\windows\CZJCSD.exe.bat JWGY.exe File created C:\windows\KSBG.exe.bat SXXKR.exe File opened for modification C:\windows\EYIFP.exe GDREKGG.exe File created C:\windows\system\AOMK.exe.bat KYLLZ.exe File created C:\windows\GLGMNWB.exe.bat ALYYW.exe File created C:\windows\system\WZEP.exe.bat OUSI.exe File created C:\windows\KSBG.exe SXXKR.exe File opened for modification C:\windows\system\IAX.exe UFMYDI.exe File created C:\windows\system\HFN.exe.bat EJEL.exe File created C:\windows\MXX.exe TEP.exe File opened for modification C:\windows\KVJSM.exe MLYCDP.exe File created C:\windows\system\JWGY.exe DBGYIK.exe File created C:\windows\GRAVKH.exe.bat OWW.exe File created C:\windows\system\BLI.exe.bat MQQYFQ.exe File opened for modification C:\windows\MKA.exe IULJW.exe File created C:\windows\RADBB.exe.bat HAJWQI.exe File created C:\windows\BCGGO.exe LULU.exe File created C:\windows\system\HFN.exe EJEL.exe File opened for modification C:\windows\system\ZEZI.exe PGTW.exe File created C:\windows\system\JWGY.exe.bat DBGYIK.exe File created C:\windows\system\NWNAI.exe.bat PLLKZE.exe File opened for modification C:\windows\OUSI.exe GONTK.exe File created C:\windows\system\WZEP.exe OUSI.exe File created C:\windows\KVJSM.exe.bat MLYCDP.exe File created C:\windows\system\PGTW.exe.bat LYNORTC.exe File created C:\windows\RADBB.exe HAJWQI.exe File created C:\windows\URYGSOI.exe.bat RDTXQ.exe File created C:\windows\ZNSCHC.exe.bat EABTVR.exe File created C:\windows\ENJ.exe WZEP.exe File opened for modification C:\windows\ENJ.exe WZEP.exe File created C:\windows\EYIFP.exe.bat GDREKGG.exe File created C:\windows\GRAVKH.exe OWW.exe File created C:\windows\system\DKM.exe.bat XOAVBM.exe File opened for modification C:\windows\IQAFVDI.exe CUOEP.exe File created C:\windows\BHZGZK.exe URYGSOI.exe File opened for modification C:\windows\system\NWNAI.exe PLLKZE.exe File opened for modification C:\windows\system\TWX.exe JYRT.exe File opened for modification C:\windows\system\WRZHV.exe ODVAKN.exe File opened for modification C:\windows\system\BYLV.exe GLGMNWB.exe File created C:\windows\AQOQ.exe NKOMX.exe File created C:\windows\EJEL.exe TWX.exe File opened for modification C:\windows\ZNSCHC.exe EABTVR.exe File opened for modification C:\windows\system\LASXIK.exe GUIHS.exe File created C:\windows\system\LASXIK.exe.bat GUIHS.exe File created C:\windows\system\UERYXA.exe OJSX.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5072 cmd.exe 1516 cmd.exe 1368 cmd.exe 1704 cmd.exe 3148 cmd.exe 4516 cmd.exe 3956 cmd.exe 4984 cmd.exe 2916 cmd.exe 5600 cmd.exe 3520 cmd.exe 5796 cmd.exe 1088 cmd.exe 1352 cmd.exe 5444 cmd.exe 4876 cmd.exe 5524 cmd.exe 6048 cmd.exe 412 cmd.exe 1148 cmd.exe 4192 cmd.exe 5964 cmd.exe 5188 cmd.exe 4620 cmd.exe 4860 cmd.exe 4284 cmd.exe 5304 cmd.exe 6020 cmd.exe 2012 cmd.exe 4380 cmd.exe 3252 cmd.exe 3240 cmd.exe 4088 cmd.exe 2148 cmd.exe 3276 cmd.exe 2184 cmd.exe 2176 cmd.exe 4848 cmd.exe 3544 cmd.exe 2508 cmd.exe 5688 cmd.exe 1468 cmd.exe 2364 cmd.exe 1176 cmd.exe 1388 cmd.exe 5280 cmd.exe 936 cmd.exe 1952 cmd.exe 2560 cmd.exe 4956 cmd.exe 4272 cmd.exe 1896 cmd.exe 3968 cmd.exe 5068 cmd.exe 4640 cmd.exe 4436 cmd.exe 4908 cmd.exe 3872 cmd.exe 4196 cmd.exe 988 cmd.exe 1552 cmd.exe 3020 cmd.exe 3768 cmd.exe 4664 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 1988 4124 WerFault.exe 87 4876 444 WerFault.exe 93 2884 2544 WerFault.exe 99 3728 3924 WerFault.exe 104 2972 5048 WerFault.exe 109 5988 1928 WerFault.exe 114 4356 4680 WerFault.exe 119 2672 1412 WerFault.exe 124 860 2228 WerFault.exe 129 2844 3372 WerFault.exe 134 5348 3256 WerFault.exe 139 5264 6016 WerFault.exe 144 5796 3156 WerFault.exe 149 3136 704 WerFault.exe 154 4216 3448 WerFault.exe 159 6116 236 WerFault.exe 164 4188 1876 WerFault.exe 169 4756 4704 WerFault.exe 174 2876 2488 WerFault.exe 179 4844 4200 WerFault.exe 184 2712 1488 WerFault.exe 189 2344 3048 WerFault.exe 194 2272 2900 WerFault.exe 199 1896 5992 WerFault.exe 204 5608 5020 WerFault.exe 209 2884 4160 WerFault.exe 214 6084 1124 WerFault.exe 219 5732 2404 WerFault.exe 224 2984 1852 WerFault.exe 229 1712 4732 WerFault.exe 234 5768 4756 WerFault.exe 239 4944 2676 WerFault.exe 244 5524 2328 WerFault.exe 249 5276 3984 WerFault.exe 254 3656 1796 WerFault.exe 259 5736 4608 WerFault.exe 264 4328 5684 WerFault.exe 269 3492 5032 WerFault.exe 274 3648 3136 WerFault.exe 279 204 2428 WerFault.exe 284 1644 5732 WerFault.exe 289 4924 5184 WerFault.exe 294 2696 1724 WerFault.exe 299 2732 2592 WerFault.exe 304 3468 1168 WerFault.exe 309 4832 4268 WerFault.exe 314 5344 6068 WerFault.exe 319 404 5264 WerFault.exe 324 2412 2072 WerFault.exe 329 1156 5400 WerFault.exe 334 4764 1784 WerFault.exe 339 5728 4216 WerFault.exe 344 1984 1192 WerFault.exe 349 5816 1476 WerFault.exe 354 4624 4920 WerFault.exe 359 4552 3468 WerFault.exe 364 408 4156 WerFault.exe 369 2824 3060 WerFault.exe 374 4664 3492 WerFault.exe 379 4760 3424 WerFault.exe 384 6108 2292 WerFault.exe 389 3560 852 WerFault.exe 394 4180 2820 WerFault.exe 399 4940 5960 WerFault.exe 404 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YWEQK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UCV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BYLV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZNSCHC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NKOMX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GONTK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VSHPISN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DPWT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EYIFP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KYLLZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HAJWQI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BCGGO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EABTVR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JXGJWKU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UGHF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HYLBT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LULU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WRZHV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WZEP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LLYSBCH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZEZI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BNPWX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QKQK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MFM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EJEL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KVJSM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UFMYDI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WOM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MXX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OJSX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UERYXA.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4124 2026-07-17_a3e72fdce9bed046de4139bb6eb3bb3d_elex_emotet_stop.exe 4124 2026-07-17_a3e72fdce9bed046de4139bb6eb3bb3d_elex_emotet_stop.exe 444 LULU.exe 444 LULU.exe 2544 BCGGO.exe 2544 BCGGO.exe 3924 PXSHCPA.exe 3924 PXSHCPA.exe 5048 FNFQKWQ.exe 5048 FNFQKWQ.exe 1928 PLLKZE.exe 1928 PLLKZE.exe 4680 NWNAI.exe 4680 NWNAI.exe 1412 VKAHK.exe 1412 VKAHK.exe 2228 NKOMX.exe 2228 NKOMX.exe 3372 AQOQ.exe 3372 AQOQ.exe 3256 IVB.exe 3256 IVB.exe 6016 JYRT.exe 6016 JYRT.exe 3156 TWX.exe 3156 TWX.exe 704 EJEL.exe 704 EJEL.exe 3448 HFN.exe 3448 HFN.exe 236 UCV.exe 236 UCV.exe 1876 EABTVR.exe 1876 EABTVR.exe 4704 ZNSCHC.exe 4704 ZNSCHC.exe 2488 CEB.exe 2488 CEB.exe 4200 TEP.exe 4200 TEP.exe 1488 MXX.exe 1488 MXX.exe 3048 JXGJWKU.exe 3048 JXGJWKU.exe 2900 TVMEDT.exe 2900 TVMEDT.exe 5992 ODVAKN.exe 5992 ODVAKN.exe 5020 WRZHV.exe 5020 WRZHV.exe 4160 GONTK.exe 4160 GONTK.exe 1124 OUSI.exe 1124 OUSI.exe 2404 WZEP.exe 2404 WZEP.exe 1852 ENJ.exe 1852 ENJ.exe 4732 XFYG.exe 4732 XFYG.exe 4756 LLYSBCH.exe 4756 LLYSBCH.exe 2676 XTR.exe 2676 XTR.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4124 2026-07-17_a3e72fdce9bed046de4139bb6eb3bb3d_elex_emotet_stop.exe 4124 2026-07-17_a3e72fdce9bed046de4139bb6eb3bb3d_elex_emotet_stop.exe 444 LULU.exe 444 LULU.exe 2544 BCGGO.exe 2544 BCGGO.exe 3924 PXSHCPA.exe 3924 PXSHCPA.exe 5048 FNFQKWQ.exe 5048 FNFQKWQ.exe 1928 PLLKZE.exe 1928 PLLKZE.exe 4680 NWNAI.exe 4680 NWNAI.exe 1412 VKAHK.exe 1412 VKAHK.exe 2228 NKOMX.exe 2228 NKOMX.exe 3372 AQOQ.exe 3372 AQOQ.exe 3256 IVB.exe 3256 IVB.exe 6016 JYRT.exe 6016 JYRT.exe 3156 TWX.exe 3156 TWX.exe 704 EJEL.exe 704 EJEL.exe 3448 HFN.exe 3448 HFN.exe 236 UCV.exe 236 UCV.exe 1876 EABTVR.exe 1876 EABTVR.exe 4704 ZNSCHC.exe 4704 ZNSCHC.exe 2488 CEB.exe 2488 CEB.exe 4200 TEP.exe 4200 TEP.exe 1488 MXX.exe 1488 MXX.exe 3048 JXGJWKU.exe 3048 JXGJWKU.exe 2900 TVMEDT.exe 2900 TVMEDT.exe 5992 ODVAKN.exe 5992 ODVAKN.exe 5020 WRZHV.exe 5020 WRZHV.exe 4160 GONTK.exe 4160 GONTK.exe 1124 OUSI.exe 1124 OUSI.exe 2404 WZEP.exe 2404 WZEP.exe 1852 ENJ.exe 1852 ENJ.exe 4732 XFYG.exe 4732 XFYG.exe 4756 LLYSBCH.exe 4756 LLYSBCH.exe 2676 XTR.exe 2676 XTR.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4124 wrote to memory of 1176 4124 2026-07-17_a3e72fdce9bed046de4139bb6eb3bb3d_elex_emotet_stop.exe 89 PID 1176 wrote to memory of 444 1176 cmd.exe 93 PID 444 wrote to memory of 3324 444 LULU.exe 95 PID 3324 wrote to memory of 2544 3324 cmd.exe 99 PID 2544 wrote to memory of 3968 2544 BCGGO.exe 100 PID 3968 wrote to memory of 3924 3968 cmd.exe 104 PID 3924 wrote to memory of 52 3924 PXSHCPA.exe 105 PID 52 wrote to memory of 5048 52 cmd.exe 109 PID 5048 wrote to memory of 4484 5048 FNFQKWQ.exe 110 PID 4484 wrote to memory of 1928 4484 cmd.exe 114 PID 1928 wrote to memory of 4164 1928 PLLKZE.exe 115 PID 4164 wrote to memory of 4680 4164 cmd.exe 119 PID 4680 wrote to memory of 5224 4680 NWNAI.exe 120 PID 5224 wrote to memory of 1412 5224 cmd.exe 124 PID 1412 wrote to memory of 4308 1412 VKAHK.exe 125 PID 4308 wrote to memory of 2228 4308 cmd.exe 129 PID 2228 wrote to memory of 2644 2228 NKOMX.exe 130 PID 2644 wrote to memory of 3372 2644 cmd.exe 134 PID 3372 wrote to memory of 1516 3372 AQOQ.exe 135 PID 1516 wrote to memory of 3256 1516 cmd.exe 139 PID 3256 wrote to memory of 3020 3256 IVB.exe 140 PID 3020 wrote to memory of 6016 3020 cmd.exe 144 PID 6016 wrote to memory of 2012 6016 JYRT.exe 145 PID 2012 wrote to memory of 3156 2012 cmd.exe 149 PID 3156 wrote to memory of 4880 3156 TWX.exe 150 PID 4880 wrote to memory of 704 4880 cmd.exe 154 PID 704 wrote to memory of 4984 704 EJEL.exe 155 PID 4984 wrote to memory of 3448 4984 cmd.exe 159 PID 3448 wrote to memory of 3768 3448 HFN.exe 160 PID 3768 wrote to memory of 236 3768 cmd.exe 164 PID 236 wrote to memory of 5068 236 UCV.exe 165 PID 5068 wrote to memory of 1876 5068 cmd.exe 169 PID 1876 wrote to memory of 1388 1876 EABTVR.exe 170 PID 1388 wrote to memory of 4704 1388 cmd.exe 174 PID 4704 wrote to memory of 940 4704 ZNSCHC.exe 175 PID 940 wrote to memory of 2488 940 cmd.exe 179 PID 2488 wrote to memory of 1368 2488 CEB.exe 180 PID 1368 wrote to memory of 4200 1368 cmd.exe 184 PID 4200 wrote to memory of 5548 4200 TEP.exe 185 PID 5548 wrote to memory of 1488 5548 cmd.exe 189 PID 1488 wrote to memory of 5204 1488 MXX.exe 190 PID 5204 wrote to memory of 3048 5204 cmd.exe 194 PID 3048 wrote to memory of 1052 3048 JXGJWKU.exe 195 PID 1052 wrote to memory of 2900 1052 cmd.exe 199 PID 2900 wrote to memory of 5280 2900 TVMEDT.exe 200 PID 5280 wrote to memory of 5992 5280 cmd.exe 204 PID 5992 wrote to memory of 4408 5992 ODVAKN.exe 205 PID 4408 wrote to memory of 5020 4408 cmd.exe 209 PID 5020 wrote to memory of 4580 5020 WRZHV.exe 210 PID 4580 wrote to memory of 4160 4580 cmd.exe 214 PID 4160 wrote to memory of 4620 4160 GONTK.exe 215 PID 4620 wrote to memory of 1124 4620 cmd.exe 219 PID 1124 wrote to memory of 4128 1124 OUSI.exe 220 PID 4128 wrote to memory of 2404 4128 cmd.exe 224 PID 2404 wrote to memory of 4208 2404 WZEP.exe 225 PID 4208 wrote to memory of 1852 4208 cmd.exe 229 PID 1852 wrote to memory of 4640 1852 ENJ.exe 230 PID 4640 wrote to memory of 4732 4640 cmd.exe 234 PID 4732 wrote to memory of 4632 4732 XFYG.exe 235 PID 4632 wrote to memory of 4756 4632 cmd.exe 239 PID 4756 wrote to memory of 1212 4756 LLYSBCH.exe 240 PID 1212 wrote to memory of 2676 1212 cmd.exe 244 PID 2676 wrote to memory of 3208 2676 XTR.exe 245 PID 3208 wrote to memory of 2328 3208 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-17_a3e72fdce9bed046de4139bb6eb3bb3d_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-17_a3e72fdce9bed046de4139bb6eb3bb3d_elex_emotet_stop.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LULU.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\windows\LULU.exeC:\windows\LULU.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BCGGO.exe.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\windows\BCGGO.exeC:\windows\BCGGO.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PXSHCPA.exe.bat" "6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\windows\SysWOW64\PXSHCPA.exeC:\windows\system32\PXSHCPA.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FNFQKWQ.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:52 -
C:\windows\SysWOW64\FNFQKWQ.exeC:\windows\system32\FNFQKWQ.exe9⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PLLKZE.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\windows\SysWOW64\PLLKZE.exeC:\windows\system32\PLLKZE.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NWNAI.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\windows\system\NWNAI.exeC:\windows\system\NWNAI.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VKAHK.exe.bat" "14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5224 -
C:\windows\SysWOW64\VKAHK.exeC:\windows\system32\VKAHK.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NKOMX.exe.bat" "16⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\windows\SysWOW64\NKOMX.exeC:\windows\system32\NKOMX.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AQOQ.exe.bat" "18⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\windows\AQOQ.exeC:\windows\AQOQ.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IVB.exe.bat" "20⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\windows\IVB.exeC:\windows\IVB.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JYRT.exe.bat" "22⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\windows\system\JYRT.exeC:\windows\system\JYRT.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TWX.exe.bat" "24⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\windows\system\TWX.exeC:\windows\system\TWX.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EJEL.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\windows\EJEL.exeC:\windows\EJEL.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HFN.exe.bat" "28⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\windows\system\HFN.exeC:\windows\system\HFN.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UCV.exe.bat" "30⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\windows\SysWOW64\UCV.exeC:\windows\system32\UCV.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EABTVR.exe.bat" "32⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\windows\EABTVR.exeC:\windows\EABTVR.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZNSCHC.exe.bat" "34⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\windows\ZNSCHC.exeC:\windows\ZNSCHC.exe35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CEB.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:940 -
C:\windows\system\CEB.exeC:\windows\system\CEB.exe37⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TEP.exe.bat" "38⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\windows\TEP.exeC:\windows\TEP.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MXX.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:5548 -
C:\windows\MXX.exeC:\windows\MXX.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JXGJWKU.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:5204 -
C:\windows\SysWOW64\JXGJWKU.exeC:\windows\system32\JXGJWKU.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TVMEDT.exe.bat" "44⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\windows\system\TVMEDT.exeC:\windows\system\TVMEDT.exe45⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ODVAKN.exe.bat" "46⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5280 -
C:\windows\ODVAKN.exeC:\windows\ODVAKN.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WRZHV.exe.bat" "48⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\windows\system\WRZHV.exeC:\windows\system\WRZHV.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GONTK.exe.bat" "50⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\windows\SysWOW64\GONTK.exeC:\windows\system32\GONTK.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OUSI.exe.bat" "52⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\windows\OUSI.exeC:\windows\OUSI.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WZEP.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\windows\system\WZEP.exeC:\windows\system\WZEP.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ENJ.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\windows\ENJ.exeC:\windows\ENJ.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XFYG.exe.bat" "58⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\windows\XFYG.exeC:\windows\XFYG.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LLYSBCH.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\windows\LLYSBCH.exeC:\windows\LLYSBCH.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XTR.exe.bat" "62⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\windows\system\XTR.exeC:\windows\system\XTR.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EJSJVBK.exe.bat" "64⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3208 -
C:\windows\SysWOW64\EJSJVBK.exeC:\windows\system32\EJSJVBK.exe65⤵
- Executes dropped EXE
PID:2328 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VSHPISN.exe.bat" "66⤵
- System Location Discovery: System Language Discovery
PID:5800 -
C:\windows\VSHPISN.exeC:\windows\VSHPISN.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EXTVTQ.exe.bat" "68⤵PID:1600
-
C:\windows\SysWOW64\EXTVTQ.exeC:\windows\system32\EXTVTQ.exe69⤵
- Executes dropped EXE
PID:1796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MLYCDP.exe.bat" "70⤵PID:3988
-
C:\windows\system\MLYCDP.exeC:\windows\system\MLYCDP.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4608 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KVJSM.exe.bat" "72⤵
- Executes a command shell one-liner
PID:4380 -
C:\windows\KVJSM.exeC:\windows\KVJSM.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5684 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LYNORTC.exe.bat" "74⤵PID:5396
-
C:\windows\SysWOW64\LYNORTC.exeC:\windows\system32\LYNORTC.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5032 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PGTW.exe.bat" "76⤵
- Executes a command shell one-liner
PID:4876 -
C:\windows\system\PGTW.exeC:\windows\system\PGTW.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3136 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZEZI.exe.bat" "78⤵PID:3016
-
C:\windows\system\ZEZI.exeC:\windows\system\ZEZI.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GUIHS.exe.bat" "80⤵PID:3880
-
C:\windows\SysWOW64\GUIHS.exeC:\windows\system32\GUIHS.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LASXIK.exe.bat" "82⤵PID:3500
-
C:\windows\system\LASXIK.exeC:\windows\system\LASXIK.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5184 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JLVNQ.exe.bat" "84⤵PID:5036
-
C:\windows\system\JLVNQ.exeC:\windows\system\JLVNQ.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RBEEXM.exe.bat" "86⤵
- System Location Discovery: System Language Discovery
PID:4708 -
C:\windows\system\RBEEXM.exeC:\windows\system\RBEEXM.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BYKYFU.exe.bat" "88⤵
- System Location Discovery: System Language Discovery
PID:3188 -
C:\windows\system\BYKYFU.exeC:\windows\system\BYKYFU.exe89⤵
- Executes dropped EXE
PID:1168 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OJSX.exe.bat" "90⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2176 -
C:\windows\OJSX.exeC:\windows\OJSX.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UERYXA.exe.bat" "92⤵
- Executes a command shell one-liner
PID:4848 -
C:\windows\system\UERYXA.exeC:\windows\system\UERYXA.exe93⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YNYG.exe.bat" "94⤵PID:4108
-
C:\windows\system\YNYG.exeC:\windows\system\YNYG.exe95⤵
- Executes dropped EXE
PID:5264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NIPKVFK.exe.bat" "96⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1552 -
C:\windows\NIPKVFK.exeC:\windows\NIPKVFK.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2072 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BNPWX.exe.bat" "98⤵PID:1384
-
C:\windows\SysWOW64\BNPWX.exeC:\windows\system32\BNPWX.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DBGYIK.exe.bat" "100⤵
- System Location Discovery: System Language Discovery
PID:248 -
C:\windows\SysWOW64\DBGYIK.exeC:\windows\system32\DBGYIK.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1784 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JWGY.exe.bat" "102⤵PID:5440
-
C:\windows\system\JWGY.exeC:\windows\system\JWGY.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4216 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CZJCSD.exe.bat" "104⤵
- Executes a command shell one-liner
PID:5072 -
C:\windows\CZJCSD.exeC:\windows\CZJCSD.exe105⤵
- Executes dropped EXE
PID:1192 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OHQ.exe.bat" "106⤵PID:756
-
C:\windows\system\OHQ.exeC:\windows\system\OHQ.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SXXKR.exe.bat" "108⤵
- Executes a command shell one-liner
PID:3544 -
C:\windows\SysWOW64\SXXKR.exeC:\windows\system32\SXXKR.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KSBG.exe.bat" "110⤵
- Executes a command shell one-liner
PID:5524 -
C:\windows\KSBG.exeC:\windows\KSBG.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GDREKGG.exe.bat" "112⤵
- System Location Discovery: System Language Discovery
PID:5276 -
C:\windows\SysWOW64\GDREKGG.exeC:\windows\system32\GDREKGG.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4156 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EYIFP.exe.bat" "114⤵PID:5736
-
C:\windows\EYIFP.exeC:\windows\EYIFP.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OWW.exe.bat" "116⤵
- System Location Discovery: System Language Discovery
PID:5968 -
C:\windows\SysWOW64\OWW.exeC:\windows\system32\OWW.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GRAVKH.exe.bat" "118⤵PID:4808
-
C:\windows\GRAVKH.exeC:\windows\GRAVKH.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QPFQ.exe.bat" "120⤵
- System Location Discovery: System Language Discovery
PID:3648 -
C:\windows\SysWOW64\QPFQ.exeC:\windows\system32\QPFQ.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2292
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-