Analysis
- max time kernel
82s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/07/2026, 02:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-17_bb67f3ce38962de9f8eb6345b6d203d7_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-07-17_bb67f3ce38962de9f8eb6345b6d203d7_elex_emotet_stop.exe
- Size 208KB
- Sample260718-csp5kagy3v
- SHA256 87c31acaebab533347fa02a200f00363ecb6a1ec9269507abc588c67da81f4c4
- MD5 bb67f3ce38962de9f8eb6345b6d203d7
- SHA1 039b2e8959fabcaf5f056d3cbacf344aebc1dbff
- SHA512 734369d41470d29b0cea62c47e073981fd1f18a574e2a296f4d0edf6e99c1c16f021178ce8f4ea0a2be8934df483a437c1d300cd195041e1dd5461636dae5511
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbclcdL+LOfX4NLthEjQT6j:MlZtbLWIgd1LZ9oECZbclc5+LOPQEj1
- TLSH T1C3247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5988 JKQP.exe 108 SIKQ.exe 5012 UGYK.exe 4272 EEEWRY.exe 5928 XHIAX.exe 1444 QZXLG.exe 1708 AAZQRNG.exe 5620 PQAQQ.exe 3396 TGHQCBR.exe 5596 FONYP.exe 4252 XRRTUJP.exe 1604 BZYBGT.exe 4452 NPE.exe 2888 LKDC.exe 624 PSKKBHC.exe 5424 QVWGP.exe 4412 JQAKUNN.exe 1616 LMET.exe 2084 YONK.exe 460 IMTEAGG.exe 3384 BPWIGW.exe 3408 QFFZMJE.exe 3468 EQOYBUS.exe 960 IYUY.exe 4756 OTUHR.exe 1796 OXXC.exe 2480 NMRFKKN.exe 5636 UCSXRG.exe 5284 EAX.exe 948 XDBVLEU.exe 2868 DDJ.exe 3780 JRIJZ.exe 4580 YUR.exe 256 THWXU.exe 5600 TNWLWB.exe 3904 YNE.exe 5244 ILKTU.exe 1208 STMZYJP.exe 2272 WBSHKB.exe 1964 IRZH.exe 5432 IXZV.exe 3860 LFGDCRQ.exe 2540 KIRNZJ.exe 2688 NVW.exe 1484 HJBF.exe 5396 LZHN.exe 4652 GMMXIB.exe 1116 GPQTNRQ.exe 5156 GVQ.exe 1160 KLXPBO.exe 5080 OTD.exe 2220 JGIYX.exe 3368 AOK.exe 2216 VCPVL.exe 5004 BCXJU.exe 5144 GCEWLIL.exe 4292 FYDXI.exe 1216 ZLAHSDP.exe 5340 QYL.exe 1932 QEL.exe 4628 CWOGS.exe 4064 NEUGEMK.exe 4752 IAZP.exe 3648 TSCIO.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\IAZP.exe NEUGEMK.exe File opened for modification C:\windows\SysWOW64\HHWT.exe HMTXHDU.exe File created C:\windows\SysWOW64\JQAKUNN.exe.bat QVWGP.exe File created C:\windows\SysWOW64\GVQ.exe.bat GPQTNRQ.exe File created C:\windows\SysWOW64\LXDBZL.exe.bat HHWT.exe File created C:\windows\SysWOW64\UYF.exe LXDBZL.exe File created C:\windows\SysWOW64\IXZV.exe.bat IRZH.exe File created C:\windows\SysWOW64\AOK.exe JGIYX.exe File opened for modification C:\windows\SysWOW64\MJTJNL.exe BQQQNEQ.exe File created C:\windows\SysWOW64\VDOY.exe DAK.exe File created C:\windows\SysWOW64\YQVG.exe.bat GITBPK.exe File opened for modification C:\windows\SysWOW64\SDOPJQ.exe FSY.exe File created C:\windows\SysWOW64\TCCYTAY.exe NGDYOX.exe File opened for modification C:\windows\SysWOW64\TCCYTAY.exe NGDYOX.exe File created C:\windows\SysWOW64\IXZV.exe IRZH.exe File created C:\windows\SysWOW64\GITBPK.exe AHLOG.exe File created C:\windows\SysWOW64\HMTXHDU.exe TCCYTAY.exe File created C:\windows\SysWOW64\LXDBZL.exe HHWT.exe File created C:\windows\SysWOW64\XHIAX.exe EEEWRY.exe File created C:\windows\SysWOW64\VDOY.exe.bat DAK.exe File opened for modification C:\windows\SysWOW64\WNOZ.exe FNM.exe File opened for modification C:\windows\SysWOW64\UYF.exe LXDBZL.exe File created C:\windows\SysWOW64\TGHQCBR.exe PQAQQ.exe File opened for modification C:\windows\SysWOW64\XRRTUJP.exe FONYP.exe File opened for modification C:\windows\SysWOW64\LMET.exe JQAKUNN.exe File created C:\windows\SysWOW64\QEL.exe.bat QYL.exe File created C:\windows\SysWOW64\MJTJNL.exe BQQQNEQ.exe File created C:\windows\SysWOW64\RGFXAEF.exe.bat VDOY.exe File created C:\windows\SysWOW64\IMTEAGG.exe.bat YONK.exe File created C:\windows\SysWOW64\GITBPK.exe.bat AHLOG.exe File created C:\windows\SysWOW64\FONYP.exe TGHQCBR.exe File opened for modification C:\windows\SysWOW64\AOK.exe JGIYX.exe File created C:\windows\SysWOW64\QYL.exe ZLAHSDP.exe File opened for modification C:\windows\SysWOW64\XHIAX.exe EEEWRY.exe File opened for modification C:\windows\SysWOW64\NPE.exe BZYBGT.exe File opened for modification C:\windows\SysWOW64\WBSHKB.exe STMZYJP.exe File created C:\windows\SysWOW64\NVW.exe KIRNZJ.exe File created C:\windows\SysWOW64\IAZP.exe NEUGEMK.exe File created C:\windows\SysWOW64\AHLOG.exe RHJJDLY.exe File opened for modification C:\windows\SysWOW64\YQVG.exe GITBPK.exe File opened for modification C:\windows\SysWOW64\NEUGEMK.exe CWOGS.exe File opened for modification C:\windows\SysWOW64\IGBLJG.exe VEL.exe File opened for modification C:\windows\SysWOW64\QYL.exe ZLAHSDP.exe File created C:\windows\SysWOW64\WNOZ.exe.bat FNM.exe File created C:\windows\SysWOW64\CWOGS.exe.bat QEL.exe File created C:\windows\SysWOW64\IGBLJG.exe.bat VEL.exe File opened for modification C:\windows\SysWOW64\KSHDAX.exe ZZESA.exe File created C:\windows\SysWOW64\KSHDAX.exe.bat ZZESA.exe File created C:\windows\SysWOW64\XRRTUJP.exe.bat FONYP.exe File created C:\windows\SysWOW64\SDOPJQ.exe FSY.exe File created C:\windows\SysWOW64\AAZQRNG.exe.bat QZXLG.exe File created C:\windows\SysWOW64\AOK.exe.bat JGIYX.exe File opened for modification C:\windows\SysWOW64\GITBPK.exe AHLOG.exe File created C:\windows\SysWOW64\WNOZ.exe FNM.exe File created C:\windows\SysWOW64\QZXLG.exe.bat XHIAX.exe File opened for modification C:\windows\SysWOW64\NMRFKKN.exe OXXC.exe File created C:\windows\SysWOW64\QTZKGG.exe.bat YQVG.exe File created C:\windows\SysWOW64\HHWT.exe HMTXHDU.exe File created C:\windows\SysWOW64\XRRTUJP.exe FONYP.exe File created C:\windows\SysWOW64\JQAKUNN.exe QVWGP.exe File created C:\windows\SysWOW64\UYF.exe.bat LXDBZL.exe File created C:\windows\SysWOW64\NPE.exe.bat BZYBGT.exe File opened for modification C:\windows\SysWOW64\RGFXAEF.exe VDOY.exe File created C:\windows\SysWOW64\TZWWRVS.exe IGBLJG.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\XDBVLEU.exe EAX.exe File opened for modification C:\windows\system\OXXC.exe OTUHR.exe File opened for modification C:\windows\STMZYJP.exe ILKTU.exe File created C:\windows\system\HJBF.exe.bat NVW.exe File created C:\windows\system\QPC.exe.bat HKCPRNK.exe File created C:\windows\DAK.exe QPC.exe File created C:\windows\NGDYOX.exe.bat JYWQ.exe File created C:\windows\system\UEUTEZ.exe QOO.exe File created C:\windows\EAX.exe.bat UCSXRG.exe File created C:\windows\XDBVLEU.exe EAX.exe File opened for modification C:\windows\YUR.exe JRIJZ.exe File created C:\windows\system\YNE.exe.bat TNWLWB.exe File opened for modification C:\windows\NGDYOX.exe JYWQ.exe File created C:\windows\system\JRIJZ.exe DDJ.exe File opened for modification C:\windows\THWXU.exe YUR.exe File created C:\windows\KLXPBO.exe GVQ.exe File created C:\windows\VCPVL.exe AOK.exe File opened for modification C:\windows\system\BCXJU.exe VCPVL.exe File created C:\windows\system\BCXJU.exe.bat VCPVL.exe File created C:\windows\system\SIKQ.exe.bat JKQP.exe File created C:\windows\system\LKDC.exe.bat NPE.exe File created C:\windows\BZYBGT.exe XRRTUJP.exe File opened for modification C:\windows\system\YONK.exe LMET.exe File opened for modification C:\windows\system\QFFZMJE.exe BPWIGW.exe File opened for modification C:\windows\PQAQQ.exe AAZQRNG.exe File opened for modification C:\windows\JKQP.exe 2026-07-17_bb67f3ce38962de9f8eb6345b6d203d7_elex_emotet_stop.exe File created C:\windows\system\SIKQ.exe JKQP.exe File created C:\windows\system\NWXGG.exe SJS.exe File created C:\windows\HKCPRNK.exe NWXGG.exe File opened for modification C:\windows\system\IRZH.exe WBSHKB.exe File opened for modification C:\windows\system\GMMXIB.exe LZHN.exe File opened for modification C:\windows\system\RHJJDLY.exe CMAE.exe File created C:\windows\system\UBF.exe.bat QTZKGG.exe File created C:\windows\system\GXMHGV.exe VEROYOC.exe File opened for modification C:\windows\ZZESA.exe TZWWRVS.exe File opened for modification C:\windows\system\GOMGPJH.exe UYF.exe File created C:\windows\PQAQQ.exe AAZQRNG.exe File opened for modification C:\windows\system\PSKKBHC.exe LKDC.exe File created C:\windows\UCSXRG.exe.bat NMRFKKN.exe File created C:\windows\system\RHJJDLY.exe CMAE.exe File opened for modification C:\windows\VEL.exe DVJIRXF.exe File created C:\windows\system\IRZH.exe.bat WBSHKB.exe File created C:\windows\LFGDCRQ.exe IXZV.exe File opened for modification C:\windows\LFGDCRQ.exe IXZV.exe File opened for modification C:\windows\system\UBF.exe QTZKGG.exe File created C:\windows\VEL.exe.bat DVJIRXF.exe File opened for modification C:\windows\BZYBGT.exe XRRTUJP.exe File created C:\windows\system\LKDC.exe NPE.exe File opened for modification C:\windows\system\BPWIGW.exe IMTEAGG.exe File created C:\windows\EAX.exe UCSXRG.exe File created C:\windows\system\SJS.exe.bat MJTJNL.exe File opened for modification C:\windows\system\VSWL.exe GXMHGV.exe File opened for modification C:\windows\system\LKDC.exe NPE.exe File created C:\windows\EQOYBUS.exe QFFZMJE.exe File created C:\windows\LFGDCRQ.exe.bat IXZV.exe File created C:\windows\system\RHJJDLY.exe.bat CMAE.exe File created C:\windows\ZZESA.exe TZWWRVS.exe File created C:\windows\ZZESA.exe.bat TZWWRVS.exe File opened for modification C:\windows\system\JYWQ.exe WNOZ.exe File created C:\windows\system\GOMGPJH.exe.bat UYF.exe File opened for modification C:\windows\IYUY.exe EQOYBUS.exe File created C:\windows\UCSXRG.exe NMRFKKN.exe File opened for modification C:\windows\system\JRIJZ.exe DDJ.exe File created C:\windows\system\YNE.exe TNWLWB.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1132 cmd.exe 4696 cmd.exe 5648 cmd.exe 1144 cmd.exe 4384 cmd.exe 5632 cmd.exe 3152 cmd.exe 2768 cmd.exe 1416 cmd.exe 4100 cmd.exe 716 cmd.exe 3824 cmd.exe 5680 cmd.exe 4360 cmd.exe 3104 cmd.exe 2732 cmd.exe 4124 cmd.exe 6008 cmd.exe 2340 cmd.exe 252 cmd.exe 2072 cmd.exe 692 cmd.exe 1420 cmd.exe 4300 cmd.exe 1464 cmd.exe 3920 cmd.exe 6012 cmd.exe 1644 cmd.exe 4188 cmd.exe 5456 cmd.exe 4972 cmd.exe 2036 cmd.exe 2620 cmd.exe 5924 cmd.exe 1248 cmd.exe 3752 cmd.exe 5064 cmd.exe 5076 cmd.exe 4804 cmd.exe 2032 cmd.exe 2652 cmd.exe 4108 cmd.exe 5124 cmd.exe 4296 cmd.exe 888 cmd.exe 2056 cmd.exe 6032 cmd.exe 2140 cmd.exe 4516 cmd.exe 1840 cmd.exe 4676 cmd.exe 2792 cmd.exe 3892 cmd.exe 5360 cmd.exe 4436 cmd.exe 4560 cmd.exe 3604 cmd.exe 3504 cmd.exe 2660 cmd.exe 5204 cmd.exe 3540 cmd.exe 1328 cmd.exe 6092 cmd.exe 1672 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 5380 4132 WerFault.exe 87 2404 5988 WerFault.exe 93 5512 108 WerFault.exe 99 4212 5012 WerFault.exe 104 2960 4272 WerFault.exe 109 4952 5928 WerFault.exe 114 1384 1444 WerFault.exe 119 4492 1708 WerFault.exe 124 2060 5620 WerFault.exe 129 1232 3396 WerFault.exe 134 3408 5596 WerFault.exe 139 4256 4252 WerFault.exe 144 3512 1604 WerFault.exe 149 4616 4452 WerFault.exe 154 3752 2888 WerFault.exe 159 3196 624 WerFault.exe 164 4280 5424 WerFault.exe 169 4292 4412 WerFault.exe 174 5084 1616 WerFault.exe 179 5788 2084 WerFault.exe 184 1912 460 WerFault.exe 189 4720 3384 WerFault.exe 194 5232 3408 WerFault.exe 199 4696 3468 WerFault.exe 204 2668 960 WerFault.exe 209 5980 4756 WerFault.exe 214 4240 1796 WerFault.exe 219 1360 2480 WerFault.exe 224 4972 5636 WerFault.exe 229 5084 5284 WerFault.exe 234 5788 948 WerFault.exe 239 5248 2868 WerFault.exe 244 5564 3780 WerFault.exe 249 4064 4580 WerFault.exe 254 2588 256 WerFault.exe 259 4708 5600 WerFault.exe 264 2056 3904 WerFault.exe 269 1360 5244 WerFault.exe 274 3236 1208 WerFault.exe 280 5740 2272 WerFault.exe 285 4732 1964 WerFault.exe 290 1932 5432 WerFault.exe 295 5096 3860 WerFault.exe 300 4644 4284 WerFault.exe 305 252 2540 WerFault.exe 310 360 2688 WerFault.exe 315 2560 1484 WerFault.exe 320 1204 5396 WerFault.exe 325 2000 4652 WerFault.exe 330 2516 1116 WerFault.exe 335 2900 5156 WerFault.exe 340 1932 1160 WerFault.exe 345 2580 5080 WerFault.exe 350 4372 2220 WerFault.exe 355 824 3368 WerFault.exe 360 616 2216 WerFault.exe 365 2368 5004 WerFault.exe 370 4808 5144 WerFault.exe 375 4376 4292 WerFault.exe 380 1248 1216 WerFault.exe 385 5052 5340 WerFault.exe 390 1088 1932 WerFault.exe 395 1104 4628 WerFault.exe 400 692 4064 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XHIAX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YONK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SJS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ILKTU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LFGDCRQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMAE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YUR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VEROYOC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QVWGP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UCSXRG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RGFXAEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAZQRNG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NMRFKKN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GITBPK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LXDBZL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WBSHKB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JYWQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PSKKBHC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OTUHR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XXJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MJTJNL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IRZH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FYDXI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VDOY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HMTXHDU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EQOYBUS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IYUY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SIKQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4132 2026-07-17_bb67f3ce38962de9f8eb6345b6d203d7_elex_emotet_stop.exe 4132 2026-07-17_bb67f3ce38962de9f8eb6345b6d203d7_elex_emotet_stop.exe 5988 JKQP.exe 5988 JKQP.exe 108 SIKQ.exe 108 SIKQ.exe 5012 UGYK.exe 5012 UGYK.exe 4272 EEEWRY.exe 4272 EEEWRY.exe 5928 XHIAX.exe 5928 XHIAX.exe 1444 QZXLG.exe 1444 QZXLG.exe 1708 AAZQRNG.exe 1708 AAZQRNG.exe 5620 PQAQQ.exe 5620 PQAQQ.exe 3396 TGHQCBR.exe 3396 TGHQCBR.exe 5596 FONYP.exe 5596 FONYP.exe 4252 XRRTUJP.exe 4252 XRRTUJP.exe 1604 BZYBGT.exe 1604 BZYBGT.exe 4452 NPE.exe 4452 NPE.exe 2888 LKDC.exe 2888 LKDC.exe 624 PSKKBHC.exe 624 PSKKBHC.exe 5424 QVWGP.exe 5424 QVWGP.exe 4412 JQAKUNN.exe 4412 JQAKUNN.exe 1616 LMET.exe 1616 LMET.exe 2084 YONK.exe 2084 YONK.exe 460 IMTEAGG.exe 460 IMTEAGG.exe 3384 BPWIGW.exe 3384 BPWIGW.exe 3408 QFFZMJE.exe 3408 QFFZMJE.exe 3468 EQOYBUS.exe 3468 EQOYBUS.exe 960 IYUY.exe 960 IYUY.exe 4756 OTUHR.exe 4756 OTUHR.exe 1796 OXXC.exe 1796 OXXC.exe 2480 NMRFKKN.exe 2480 NMRFKKN.exe 5636 UCSXRG.exe 5636 UCSXRG.exe 5284 EAX.exe 5284 EAX.exe 948 XDBVLEU.exe 948 XDBVLEU.exe 2868 DDJ.exe 2868 DDJ.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4132 2026-07-17_bb67f3ce38962de9f8eb6345b6d203d7_elex_emotet_stop.exe 4132 2026-07-17_bb67f3ce38962de9f8eb6345b6d203d7_elex_emotet_stop.exe 5988 JKQP.exe 5988 JKQP.exe 108 SIKQ.exe 108 SIKQ.exe 5012 UGYK.exe 5012 UGYK.exe 4272 EEEWRY.exe 4272 EEEWRY.exe 5928 XHIAX.exe 5928 XHIAX.exe 1444 QZXLG.exe 1444 QZXLG.exe 1708 AAZQRNG.exe 1708 AAZQRNG.exe 5620 PQAQQ.exe 5620 PQAQQ.exe 3396 TGHQCBR.exe 3396 TGHQCBR.exe 5596 FONYP.exe 5596 FONYP.exe 4252 XRRTUJP.exe 4252 XRRTUJP.exe 1604 BZYBGT.exe 1604 BZYBGT.exe 4452 NPE.exe 4452 NPE.exe 2888 LKDC.exe 2888 LKDC.exe 624 PSKKBHC.exe 624 PSKKBHC.exe 5424 QVWGP.exe 5424 QVWGP.exe 4412 JQAKUNN.exe 4412 JQAKUNN.exe 1616 LMET.exe 1616 LMET.exe 2084 YONK.exe 2084 YONK.exe 460 IMTEAGG.exe 460 IMTEAGG.exe 3384 BPWIGW.exe 3384 BPWIGW.exe 3408 QFFZMJE.exe 3408 QFFZMJE.exe 3468 EQOYBUS.exe 3468 EQOYBUS.exe 960 IYUY.exe 960 IYUY.exe 4756 OTUHR.exe 4756 OTUHR.exe 1796 OXXC.exe 1796 OXXC.exe 2480 NMRFKKN.exe 2480 NMRFKKN.exe 5636 UCSXRG.exe 5636 UCSXRG.exe 5284 EAX.exe 5284 EAX.exe 948 XDBVLEU.exe 948 XDBVLEU.exe 2868 DDJ.exe 2868 DDJ.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4132 wrote to memory of 2400 4132 2026-07-17_bb67f3ce38962de9f8eb6345b6d203d7_elex_emotet_stop.exe 89 PID 2400 wrote to memory of 5988 2400 cmd.exe 93 PID 5988 wrote to memory of 1936 5988 JKQP.exe 95 PID 1936 wrote to memory of 108 1936 cmd.exe 99 PID 108 wrote to memory of 4436 108 SIKQ.exe 100 PID 4436 wrote to memory of 5012 4436 cmd.exe 104 PID 5012 wrote to memory of 6012 5012 UGYK.exe 105 PID 6012 wrote to memory of 4272 6012 cmd.exe 109 PID 4272 wrote to memory of 2140 4272 EEEWRY.exe 110 PID 2140 wrote to memory of 5928 2140 cmd.exe 114 PID 5928 wrote to memory of 4804 5928 XHIAX.exe 115 PID 4804 wrote to memory of 1444 4804 cmd.exe 119 PID 1444 wrote to memory of 2828 1444 QZXLG.exe 120 PID 2828 wrote to memory of 1708 2828 cmd.exe 124 PID 1708 wrote to memory of 3600 1708 AAZQRNG.exe 125 PID 3600 wrote to memory of 5620 3600 cmd.exe 129 PID 5620 wrote to memory of 2032 5620 PQAQQ.exe 130 PID 2032 wrote to memory of 3396 2032 cmd.exe 134 PID 3396 wrote to memory of 4560 3396 TGHQCBR.exe 135 PID 4560 wrote to memory of 5596 4560 cmd.exe 139 PID 5596 wrote to memory of 2228 5596 FONYP.exe 140 PID 2228 wrote to memory of 4252 2228 cmd.exe 144 PID 4252 wrote to memory of 2340 4252 XRRTUJP.exe 145 PID 2340 wrote to memory of 1604 2340 cmd.exe 149 PID 1604 wrote to memory of 4624 1604 BZYBGT.exe 150 PID 4624 wrote to memory of 4452 4624 cmd.exe 154 PID 4452 wrote to memory of 4824 4452 NPE.exe 155 PID 4824 wrote to memory of 2888 4824 cmd.exe 159 PID 2888 wrote to memory of 4988 2888 LKDC.exe 160 PID 4988 wrote to memory of 624 4988 cmd.exe 164 PID 624 wrote to memory of 2416 624 PSKKBHC.exe 165 PID 2416 wrote to memory of 5424 2416 cmd.exe 169 PID 5424 wrote to memory of 6092 5424 QVWGP.exe 170 PID 6092 wrote to memory of 4412 6092 cmd.exe 174 PID 4412 wrote to memory of 888 4412 JQAKUNN.exe 175 PID 888 wrote to memory of 1616 888 cmd.exe 179 PID 1616 wrote to memory of 4596 1616 LMET.exe 180 PID 4596 wrote to memory of 2084 4596 cmd.exe 184 PID 2084 wrote to memory of 3068 2084 YONK.exe 185 PID 3068 wrote to memory of 460 3068 cmd.exe 189 PID 460 wrote to memory of 2760 460 IMTEAGG.exe 190 PID 2760 wrote to memory of 3384 2760 cmd.exe 194 PID 3384 wrote to memory of 2148 3384 BPWIGW.exe 195 PID 2148 wrote to memory of 3408 2148 cmd.exe 199 PID 3408 wrote to memory of 4360 3408 QFFZMJE.exe 200 PID 4360 wrote to memory of 3468 4360 cmd.exe 204 PID 3468 wrote to memory of 4244 3468 EQOYBUS.exe 205 PID 4244 wrote to memory of 960 4244 cmd.exe 209 PID 960 wrote to memory of 2620 960 IYUY.exe 210 PID 2620 wrote to memory of 4756 2620 cmd.exe 214 PID 4756 wrote to memory of 1288 4756 OTUHR.exe 215 PID 1288 wrote to memory of 1796 1288 cmd.exe 219 PID 1796 wrote to memory of 4964 1796 OXXC.exe 220 PID 4964 wrote to memory of 2480 4964 cmd.exe 224 PID 2480 wrote to memory of 3104 2480 NMRFKKN.exe 225 PID 3104 wrote to memory of 5636 3104 cmd.exe 229 PID 5636 wrote to memory of 5632 5636 UCSXRG.exe 230 PID 5632 wrote to memory of 5284 5632 cmd.exe 234 PID 5284 wrote to memory of 3664 5284 EAX.exe 235 PID 3664 wrote to memory of 948 3664 cmd.exe 239 PID 948 wrote to memory of 5924 948 XDBVLEU.exe 240 PID 5924 wrote to memory of 2868 5924 cmd.exe 244 PID 2868 wrote to memory of 1100 2868 DDJ.exe 245 PID 1100 wrote to memory of 3780 1100 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-17_bb67f3ce38962de9f8eb6345b6d203d7_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-17_bb67f3ce38962de9f8eb6345b6d203d7_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JKQP.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\windows\JKQP.exeC:\windows\JKQP.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SIKQ.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\windows\system\SIKQ.exeC:\windows\system\SIKQ.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UGYK.exe.bat" "6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\windows\system\UGYK.exeC:\windows\system\UGYK.exe7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EEEWRY.exe.bat" "8⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6012 -
C:\windows\EEEWRY.exeC:\windows\EEEWRY.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XHIAX.exe.bat" "10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\windows\SysWOW64\XHIAX.exeC:\windows\system32\XHIAX.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QZXLG.exe.bat" "12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\windows\SysWOW64\QZXLG.exeC:\windows\system32\QZXLG.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AAZQRNG.exe.bat" "14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\windows\SysWOW64\AAZQRNG.exeC:\windows\system32\AAZQRNG.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PQAQQ.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:3600 -
C:\windows\PQAQQ.exeC:\windows\PQAQQ.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5620 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TGHQCBR.exe.bat" "18⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\windows\SysWOW64\TGHQCBR.exeC:\windows\system32\TGHQCBR.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FONYP.exe.bat" "20⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\windows\SysWOW64\FONYP.exeC:\windows\system32\FONYP.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XRRTUJP.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\windows\SysWOW64\XRRTUJP.exeC:\windows\system32\XRRTUJP.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BZYBGT.exe.bat" "24⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\windows\BZYBGT.exeC:\windows\BZYBGT.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NPE.exe.bat" "26⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\windows\SysWOW64\NPE.exeC:\windows\system32\NPE.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LKDC.exe.bat" "28⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\windows\system\LKDC.exeC:\windows\system\LKDC.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PSKKBHC.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\windows\system\PSKKBHC.exeC:\windows\system\PSKKBHC.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QVWGP.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\windows\SysWOW64\QVWGP.exeC:\windows\system32\QVWGP.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JQAKUNN.exe.bat" "34⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6092 -
C:\windows\SysWOW64\JQAKUNN.exeC:\windows\system32\JQAKUNN.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LMET.exe.bat" "36⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:888 -
C:\windows\SysWOW64\LMET.exeC:\windows\system32\LMET.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YONK.exe.bat" "38⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\windows\system\YONK.exeC:\windows\system\YONK.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IMTEAGG.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\windows\SysWOW64\IMTEAGG.exeC:\windows\system32\IMTEAGG.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BPWIGW.exe.bat" "42⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\windows\system\BPWIGW.exeC:\windows\system\BPWIGW.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QFFZMJE.exe.bat" "44⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\windows\system\QFFZMJE.exeC:\windows\system\QFFZMJE.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EQOYBUS.exe.bat" "46⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\windows\EQOYBUS.exeC:\windows\EQOYBUS.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IYUY.exe.bat" "48⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\windows\IYUY.exeC:\windows\IYUY.exe49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OTUHR.exe.bat" "50⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\windows\OTUHR.exeC:\windows\OTUHR.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OXXC.exe.bat" "52⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\windows\system\OXXC.exeC:\windows\system\OXXC.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NMRFKKN.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\windows\SysWOW64\NMRFKKN.exeC:\windows\system32\NMRFKKN.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UCSXRG.exe.bat" "56⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\windows\UCSXRG.exeC:\windows\UCSXRG.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5636 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EAX.exe.bat" "58⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5632 -
C:\windows\EAX.exeC:\windows\EAX.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XDBVLEU.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:3664 -
C:\windows\XDBVLEU.exeC:\windows\XDBVLEU.exe61⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DDJ.exe.bat" "62⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5924 -
C:\windows\DDJ.exeC:\windows\DDJ.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JRIJZ.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\windows\system\JRIJZ.exeC:\windows\system\JRIJZ.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YUR.exe.bat" "66⤵PID:5024
-
C:\windows\YUR.exeC:\windows\YUR.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\THWXU.exe.bat" "68⤵PID:5568
-
C:\windows\THWXU.exeC:\windows\THWXU.exe69⤵
- Executes dropped EXE
PID:256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TNWLWB.exe.bat" "70⤵
- System Location Discovery: System Language Discovery
PID:1700 -
C:\windows\system\TNWLWB.exeC:\windows\system\TNWLWB.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YNE.exe.bat" "72⤵PID:4428
-
C:\windows\system\YNE.exeC:\windows\system\YNE.exe73⤵
- Executes dropped EXE
PID:3904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ILKTU.exe.bat" "74⤵
- Executes a command shell one-liner
PID:1644 -
C:\windows\system\ILKTU.exeC:\windows\system\ILKTU.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\STMZYJP.exe.bat" "76⤵
- Executes a command shell one-liner
PID:2652 -
C:\windows\STMZYJP.exeC:\windows\STMZYJP.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WBSHKB.exe.bat" "78⤵PID:5604
-
C:\windows\SysWOW64\WBSHKB.exeC:\windows\system32\WBSHKB.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2272 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IRZH.exe.bat" "80⤵PID:5084
-
C:\windows\system\IRZH.exeC:\windows\system\IRZH.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IXZV.exe.bat" "82⤵PID:1832
-
C:\windows\SysWOW64\IXZV.exeC:\windows\system32\IXZV.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LFGDCRQ.exe.bat" "84⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2732 -
C:\windows\LFGDCRQ.exeC:\windows\LFGDCRQ.exe85⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XXJ.exe.bat" "86⤵PID:1792
-
C:\windows\system\XXJ.exeC:\windows\system\XXJ.exe87⤵
- System Location Discovery: System Language Discovery
PID:4284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KIRNZJ.exe.bat" "88⤵PID:296
-
C:\windows\SysWOW64\KIRNZJ.exeC:\windows\system32\KIRNZJ.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NVW.exe.bat" "90⤵
- System Location Discovery: System Language Discovery
PID:2744 -
C:\windows\SysWOW64\NVW.exeC:\windows\system32\NVW.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HJBF.exe.bat" "92⤵PID:3188
-
C:\windows\system\HJBF.exeC:\windows\system\HJBF.exe93⤵
- Executes dropped EXE
PID:1484 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LZHN.exe.bat" "94⤵
- System Location Discovery: System Language Discovery
PID:4240 -
C:\windows\SysWOW64\LZHN.exeC:\windows\system32\LZHN.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GMMXIB.exe.bat" "96⤵
- Executes a command shell one-liner
PID:3152 -
C:\windows\system\GMMXIB.exeC:\windows\system\GMMXIB.exe97⤵
- Executes dropped EXE
PID:4652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GPQTNRQ.exe.bat" "98⤵
- System Location Discovery: System Language Discovery
PID:1196 -
C:\windows\system\GPQTNRQ.exeC:\windows\system\GPQTNRQ.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GVQ.exe.bat" "100⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4516 -
C:\windows\SysWOW64\GVQ.exeC:\windows\system32\GVQ.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5156 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KLXPBO.exe.bat" "102⤵
- Executes a command shell one-liner
PID:1672 -
C:\windows\KLXPBO.exeC:\windows\KLXPBO.exe103⤵
- Executes dropped EXE
PID:1160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OTD.exe.bat" "104⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2768 -
C:\windows\OTD.exeC:\windows\OTD.exe105⤵
- Executes dropped EXE
PID:5080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JGIYX.exe.bat" "106⤵PID:756
-
C:\windows\system\JGIYX.exeC:\windows\system\JGIYX.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2220 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AOK.exe.bat" "108⤵PID:2884
-
C:\windows\SysWOW64\AOK.exeC:\windows\system32\AOK.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VCPVL.exe.bat" "110⤵PID:4716
-
C:\windows\VCPVL.exeC:\windows\VCPVL.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2216 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BCXJU.exe.bat" "112⤵PID:4212
-
C:\windows\system\BCXJU.exeC:\windows\system\BCXJU.exe113⤵
- Executes dropped EXE
PID:5004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GCEWLIL.exe.bat" "114⤵
- Executes a command shell one-liner
PID:5648 -
C:\windows\system\GCEWLIL.exeC:\windows\system\GCEWLIL.exe115⤵
- Executes dropped EXE
PID:5144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FYDXI.exe.bat" "116⤵
- System Location Discovery: System Language Discovery
PID:3300 -
C:\windows\FYDXI.exeC:\windows\FYDXI.exe117⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4292 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZLAHSDP.exe.bat" "118⤵
- System Location Discovery: System Language Discovery
PID:3392 -
C:\windows\ZLAHSDP.exeC:\windows\ZLAHSDP.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1216 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QYL.exe.bat" "120⤵
- System Location Discovery: System Language Discovery
PID:2080 -
C:\windows\SysWOW64\QYL.exeC:\windows\system32\QYL.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5340
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-