Analysis
- max time kernel
79s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/07/2026, 02:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-17_97018bfdb8ba9b098849ad674028984a_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-07-17_97018bfdb8ba9b098849ad674028984a_elex_emotet_stop.exe
- Size 448KB
- Sample260718-db8e9ahv41
- SHA256 3c239e5b643614d347a82a1ba582424a754af1df6d80ed99fb7d568a3b16944c
- MD5 97018bfdb8ba9b098849ad674028984a
- SHA1 7f6edb1cd30ecb49b08558407ee5e88b3a71682f
- SHA512 497aa7cdcee61e34194fcda3c4239df03825c2cb1c0636f48fbd17fe34c27d6cb878969d79753ec18d581e22fec6ba8db788f5780ec67e42401fd3ed5336a23d
- SSDEEP 6144:TlZtbLWIgd1LZ9oECZbxlUS+LOzkEjiPISUOgW9X+hOGzC/NM:RLWI09QZb6LOzkmZzcukG2/
- TLSH T136A49F20B9D58673E2630135689AF1A4B3BABCA0F765C28B3158B71C2773B90173E75D
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5704 TETYY.exe 3220 WKYIOCL.exe 4280 ONCEBS.exe 1212 EVLDAFK.exe 3556 YQIN.exe 1448 MTYM.exe 1872 FUGW.exe 5720 OUICT.exe 5288 YSV.exe 4084 QACTN.exe 5248 ATTBZQX.exe 4404 RTV.exe 1936 KWZCI.exe 5936 ZRJ.exe 1128 YCLWCEF.exe 1372 AAZQRNG.exe 1296 BNKO.exe 2592 LGU.exe 560 BWH.exe 556 FBAV.exe 6072 WUC.exe 4176 GSQXY.exe 4760 DLSH.exe 5668 NIXU.exe 1796 WRZHV.exe 2232 RTQYJ.exe 756 TRW.exe 5416 UUZWEUA.exe 1548 WSNI.exe 3384 QFSZVD.exe 5980 IOMEZAZ.exe 3668 OOTS.exe 5064 XOV.exe 5876 KZMWAK.exe 3416 APNN.exe 3720 KNSIWOW.exe 2940 CQWLB.exe 3140 DLAHHUG.exe 3312 FJOBWDP.exe 4364 ETQR.exe 5492 ZEZI.exe 1256 DUOQXM.exe 4496 OINOC.exe 1592 JVRXMNG.exe 5024 LIW.exe 52 ELALCDW.exe 2528 KMIYL.exe 2780 TMKDPD.exe 1336 OZO.exe 2188 UXAQMI.exe 4076 LIKGV.exe 4800 OVHPFNH.exe 944 EGSFNB.exe 5912 FJW.exe 2444 YMAFYHO.exe 816 SZE.exe 2556 HUOSCU.exe 5836 TNRLCJ.exe 708 VIWVMJH.exe 4196 FJYAQG.exe 716 XMC.exe 4732 EBNYQC.exe 4900 WERCW.exe 5760 IXUV.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\CQWLB.exe KNSIWOW.exe File created C:\windows\SysWOW64\DUOQXM.exe.bat ZEZI.exe File created C:\windows\SysWOW64\SZE.exe YMAFYHO.exe File created C:\windows\SysWOW64\MXKOO.exe SKF.exe File created C:\windows\SysWOW64\AAHXLBO.exe.bat CHF.exe File opened for modification C:\windows\SysWOW64\EVLDAFK.exe ONCEBS.exe File opened for modification C:\windows\SysWOW64\ZRJ.exe KWZCI.exe File opened for modification C:\windows\SysWOW64\AAZQRNG.exe YCLWCEF.exe File opened for modification C:\windows\SysWOW64\SZE.exe YMAFYHO.exe File created C:\windows\SysWOW64\OIZ.exe.bat MNDCEHK.exe File created C:\windows\SysWOW64\APNN.exe KZMWAK.exe File opened for modification C:\windows\SysWOW64\AAHXLBO.exe CHF.exe File created C:\windows\SysWOW64\MTYM.exe.bat YQIN.exe File created C:\windows\SysWOW64\YSV.exe.bat OUICT.exe File created C:\windows\SysWOW64\UUZWEUA.exe.bat TRW.exe File created C:\windows\SysWOW64\OINOC.exe.bat DUOQXM.exe File created C:\windows\SysWOW64\HWSKD.exe UMCTXJP.exe File opened for modification C:\windows\SysWOW64\PCKYN.exe HWSKD.exe File created C:\windows\SysWOW64\EVLDAFK.exe ONCEBS.exe File created C:\windows\SysWOW64\FUGW.exe.bat MTYM.exe File opened for modification C:\windows\SysWOW64\LGU.exe BNKO.exe File created C:\windows\SysWOW64\XOV.exe.bat OOTS.exe File created C:\windows\SysWOW64\ETQR.exe FJOBWDP.exe File created C:\windows\SysWOW64\DUOQXM.exe ZEZI.exe File created C:\windows\SysWOW64\TNRLCJ.exe HUOSCU.exe File created C:\windows\SysWOW64\WERCW.exe.bat EBNYQC.exe File created C:\windows\SysWOW64\OOTS.exe.bat IOMEZAZ.exe File created C:\windows\SysWOW64\ETQR.exe.bat FJOBWDP.exe File created C:\windows\SysWOW64\IXUV.exe.bat WERCW.exe File created C:\windows\SysWOW64\NNCO.exe SCTP.exe File created C:\windows\SysWOW64\SEMGKO.exe JYM.exe File created C:\windows\SysWOW64\SEMGKO.exe.bat JYM.exe File created C:\windows\SysWOW64\NIXU.exe.bat DLSH.exe File created C:\windows\SysWOW64\KZMWAK.exe.bat XOV.exe File opened for modification C:\windows\SysWOW64\APNN.exe KZMWAK.exe File opened for modification C:\windows\SysWOW64\DUOQXM.exe ZEZI.exe File created C:\windows\SysWOW64\OINOC.exe DUOQXM.exe File created C:\windows\SysWOW64\MTYM.exe YQIN.exe File created C:\windows\SysWOW64\OUICT.exe FUGW.exe File created C:\windows\SysWOW64\ATTBZQX.exe.bat QACTN.exe File created C:\windows\SysWOW64\NIXU.exe DLSH.exe File created C:\windows\SysWOW64\XOV.exe OOTS.exe File created C:\windows\SysWOW64\CQWLB.exe.bat KNSIWOW.exe File created C:\windows\SysWOW64\TNRLCJ.exe.bat HUOSCU.exe File created C:\windows\SysWOW64\MXKOO.exe.bat SKF.exe File created C:\windows\SysWOW64\FUGW.exe MTYM.exe File opened for modification C:\windows\SysWOW64\FUGW.exe MTYM.exe File created C:\windows\SysWOW64\IXUV.exe WERCW.exe File created C:\windows\SysWOW64\NNCO.exe.bat SCTP.exe File created C:\windows\SysWOW64\HWSKD.exe.bat UMCTXJP.exe File created C:\windows\SysWOW64\PCKYN.exe HWSKD.exe File opened for modification C:\windows\SysWOW64\OUICT.exe FUGW.exe File created C:\windows\SysWOW64\LGU.exe.bat BNKO.exe File created C:\windows\SysWOW64\DLAHHUG.exe CQWLB.exe File opened for modification C:\windows\SysWOW64\WERCW.exe EBNYQC.exe File opened for modification C:\windows\SysWOW64\HWSKD.exe UMCTXJP.exe File created C:\windows\SysWOW64\AAZQRNG.exe YCLWCEF.exe File created C:\windows\SysWOW64\KNSIWOW.exe.bat APNN.exe File opened for modification C:\windows\SysWOW64\DLAHHUG.exe CQWLB.exe File created C:\windows\SysWOW64\DLAHHUG.exe.bat CQWLB.exe File created C:\windows\SysWOW64\ZRJ.exe.bat KWZCI.exe File created C:\windows\SysWOW64\OUICT.exe.bat FUGW.exe File opened for modification C:\windows\SysWOW64\UUZWEUA.exe TRW.exe File opened for modification C:\windows\SysWOW64\KNSIWOW.exe APNN.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\OZO.exe.bat TMKDPD.exe File created C:\windows\system\UXAQMI.exe OZO.exe File created C:\windows\system\KWZCI.exe RTV.exe File created C:\windows\system\QFSZVD.exe.bat WSNI.exe File opened for modification C:\windows\FJOBWDP.exe DLAHHUG.exe File created C:\windows\system\JDUV.exe PQPMZYQ.exe File created C:\windows\system\JDUV.exe.bat PQPMZYQ.exe File created C:\windows\system\QYVXJLY.exe.bat PVRBW.exe File created C:\windows\system\BWH.exe.bat LGU.exe File created C:\windows\system\ONCEBS.exe.bat WKYIOCL.exe File created C:\windows\system\DLSH.exe GSQXY.exe File created C:\windows\system\WRZHV.exe NIXU.exe File created C:\windows\system\IOMEZAZ.exe QFSZVD.exe File opened for modification C:\windows\EBNYQC.exe XMC.exe File created C:\windows\system\PQPMZYQ.exe.bat XQNHWT.exe File opened for modification C:\windows\SCTP.exe SXT.exe File created C:\windows\system\RTQYJ.exe WRZHV.exe File opened for modification C:\windows\system\RTQYJ.exe WRZHV.exe File created C:\windows\system\IOMEZAZ.exe.bat QFSZVD.exe File created C:\windows\FJYAQG.exe VIWVMJH.exe File opened for modification C:\windows\DNCAU.exe CKYEOH.exe File opened for modification C:\windows\system\IAHXTS.exe NNCO.exe File opened for modification C:\windows\system\ZYXKN.exe QYVXJLY.exe File created C:\windows\system\TSR.exe.bat PCKYN.exe File opened for modification C:\windows\TRW.exe RTQYJ.exe File opened for modification C:\windows\system\UXAQMI.exe OZO.exe File opened for modification C:\windows\system\OVHPFNH.exe LIKGV.exe File created C:\windows\VIWVMJH.exe TNRLCJ.exe File opened for modification C:\windows\XMC.exe FJYAQG.exe File opened for modification C:\windows\CKYEOH.exe IXUV.exe File created C:\windows\system\SKF.exe.bat IMZKWD.exe File opened for modification C:\windows\system\ZMD.exe ZGDIVLF.exe File created C:\windows\system\QFSZVD.exe WSNI.exe File created C:\windows\FJOBWDP.exe.bat DLAHHUG.exe File created C:\windows\system\LIW.exe JVRXMNG.exe File created C:\windows\FJYAQG.exe.bat VIWVMJH.exe File created C:\windows\CKYEOH.exe IXUV.exe File created C:\windows\XQNHWT.exe.bat MXKOO.exe File opened for modification C:\windows\system\JDUV.exe PQPMZYQ.exe File opened for modification C:\windows\system\JYM.exe IAHXTS.exe File opened for modification C:\windows\system\KWZCI.exe RTV.exe File created C:\windows\system\YCLWCEF.exe ZRJ.exe File opened for modification C:\windows\BNKO.exe AAZQRNG.exe File created C:\windows\system\RTQYJ.exe.bat WRZHV.exe File opened for modification C:\windows\system\IOMEZAZ.exe QFSZVD.exe File created C:\windows\system\LIW.exe.bat JVRXMNG.exe File opened for modification C:\windows\TMKDPD.exe KMIYL.exe File created C:\windows\EGSFNB.exe.bat OVHPFNH.exe File created C:\windows\TMKDPD.exe KMIYL.exe File created C:\windows\LIKGV.exe UXAQMI.exe File created C:\windows\ZGDIVLF.exe JDUV.exe File created C:\windows\system\JYM.exe IAHXTS.exe File opened for modification C:\windows\system\AJRMV.exe SEMGKO.exe File opened for modification C:\windows\system\CHF.exe AJRMV.exe File created C:\windows\system\ZYXKN.exe QYVXJLY.exe File created C:\windows\system\ZYXKN.exe.bat QYVXJLY.exe File created C:\windows\system\YCLWCEF.exe.bat ZRJ.exe File created C:\windows\system\BWH.exe LGU.exe File opened for modification C:\windows\GSQXY.exe WUC.exe File created C:\windows\system\WRZHV.exe.bat NIXU.exe File created C:\windows\KMIYL.exe ELALCDW.exe File created C:\windows\FJW.exe EGSFNB.exe File created C:\windows\XMC.exe.bat FJYAQG.exe File created C:\windows\DNCAU.exe CKYEOH.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2360 cmd.exe 4972 cmd.exe 2224 cmd.exe 6020 cmd.exe 3676 cmd.exe 1772 cmd.exe 5872 cmd.exe 2376 cmd.exe 4028 cmd.exe 2548 cmd.exe 5740 cmd.exe 2876 cmd.exe 2680 cmd.exe 5700 cmd.exe 2036 cmd.exe 4128 cmd.exe 2400 cmd.exe 3812 cmd.exe 4540 cmd.exe 4728 cmd.exe 5984 cmd.exe 5472 cmd.exe 5068 cmd.exe 3592 cmd.exe 5944 cmd.exe 2216 cmd.exe 1300 cmd.exe 5016 cmd.exe 3348 cmd.exe 1456 cmd.exe 4748 cmd.exe 1540 cmd.exe 1552 cmd.exe 2024 cmd.exe 5316 cmd.exe 5696 cmd.exe 5476 cmd.exe 4764 cmd.exe 6068 cmd.exe 4556 cmd.exe 3256 cmd.exe 5884 cmd.exe 760 cmd.exe 4104 cmd.exe 564 cmd.exe 2864 cmd.exe 5848 cmd.exe 2856 cmd.exe 6056 cmd.exe 2228 cmd.exe 4812 cmd.exe 4576 cmd.exe 4136 cmd.exe 5804 cmd.exe 4020 cmd.exe 3488 cmd.exe 3320 cmd.exe 4436 cmd.exe 3168 cmd.exe 1856 cmd.exe 3204 cmd.exe 5508 cmd.exe 1880 cmd.exe 5744 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 2764 1312 WerFault.exe 87 4320 5704 WerFault.exe 93 1696 3220 WerFault.exe 99 2736 4280 WerFault.exe 104 3480 1212 WerFault.exe 109 2744 3556 WerFault.exe 114 4200 1448 WerFault.exe 119 2332 1872 WerFault.exe 124 3768 5720 WerFault.exe 129 3744 5288 WerFault.exe 134 4120 4084 WerFault.exe 139 1732 5248 WerFault.exe 144 4100 4404 WerFault.exe 149 4440 1936 WerFault.exe 154 3568 5936 WerFault.exe 159 4136 1128 WerFault.exe 164 3348 1372 WerFault.exe 169 6012 1296 WerFault.exe 174 4916 2592 WerFault.exe 179 3724 560 WerFault.exe 184 4872 556 WerFault.exe 189 4392 6072 WerFault.exe 194 2916 4176 WerFault.exe 199 5772 4760 WerFault.exe 204 4300 5668 WerFault.exe 209 4124 1796 WerFault.exe 214 472 2232 WerFault.exe 219 1960 756 WerFault.exe 224 4576 5416 WerFault.exe 229 4048 1548 WerFault.exe 234 4956 3384 WerFault.exe 239 2156 5980 WerFault.exe 244 2640 3668 WerFault.exe 249 4308 5064 WerFault.exe 254 5660 5876 WerFault.exe 259 5528 3416 WerFault.exe 265 1552 3720 WerFault.exe 270 5116 2940 WerFault.exe 275 5276 3140 WerFault.exe 280 2960 3312 WerFault.exe 285 2332 4364 WerFault.exe 290 3864 5492 WerFault.exe 295 6096 1256 WerFault.exe 300 2172 4496 WerFault.exe 305 868 1592 WerFault.exe 310 3660 5024 WerFault.exe 315 4516 52 WerFault.exe 320 2492 2528 WerFault.exe 325 2328 2780 WerFault.exe 330 2400 1336 WerFault.exe 335 3732 2188 WerFault.exe 340 2228 4076 WerFault.exe 345 1628 4800 WerFault.exe 350 3616 944 WerFault.exe 355 204 5912 WerFault.exe 360 3260 2444 WerFault.exe 365 4844 816 WerFault.exe 370 3348 2556 WerFault.exe 375 4160 5836 WerFault.exe 380 4028 708 WerFault.exe 385 1676 4196 WerFault.exe 390 4944 716 WerFault.exe 395 4716 4732 WerFault.exe 400 5848 4900 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YCLWCEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZEZI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XOV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OIZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WSNI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ETQR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LIW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IMZKWD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WUC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MTYM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BWH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBAV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DUOQXM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TSR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FUGW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KNSIWOW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JVRXMNG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XCORRD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAHXLBO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UMCTXJP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TETYY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language APNN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CKYEOH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZMD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WKYIOCL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QFSZVD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PQPMZYQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DLSH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SXT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GSQXY.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1312 2026-07-17_97018bfdb8ba9b098849ad674028984a_elex_emotet_stop.exe 1312 2026-07-17_97018bfdb8ba9b098849ad674028984a_elex_emotet_stop.exe 5704 TETYY.exe 5704 TETYY.exe 3220 WKYIOCL.exe 3220 WKYIOCL.exe 4280 ONCEBS.exe 4280 ONCEBS.exe 1212 EVLDAFK.exe 1212 EVLDAFK.exe 3556 YQIN.exe 3556 YQIN.exe 1448 MTYM.exe 1448 MTYM.exe 1872 FUGW.exe 1872 FUGW.exe 5720 OUICT.exe 5720 OUICT.exe 5288 YSV.exe 5288 YSV.exe 4084 QACTN.exe 4084 QACTN.exe 5248 ATTBZQX.exe 5248 ATTBZQX.exe 4404 RTV.exe 4404 RTV.exe 1936 KWZCI.exe 1936 KWZCI.exe 5936 ZRJ.exe 5936 ZRJ.exe 1128 YCLWCEF.exe 1128 YCLWCEF.exe 1372 AAZQRNG.exe 1372 AAZQRNG.exe 1296 BNKO.exe 1296 BNKO.exe 2592 LGU.exe 2592 LGU.exe 560 BWH.exe 560 BWH.exe 556 FBAV.exe 556 FBAV.exe 6072 WUC.exe 6072 WUC.exe 4176 GSQXY.exe 4176 GSQXY.exe 4760 DLSH.exe 4760 DLSH.exe 5668 NIXU.exe 5668 NIXU.exe 1796 WRZHV.exe 1796 WRZHV.exe 2232 RTQYJ.exe 2232 RTQYJ.exe 756 TRW.exe 756 TRW.exe 5416 UUZWEUA.exe 5416 UUZWEUA.exe 1548 WSNI.exe 1548 WSNI.exe 3384 QFSZVD.exe 3384 QFSZVD.exe 5980 IOMEZAZ.exe 5980 IOMEZAZ.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1312 2026-07-17_97018bfdb8ba9b098849ad674028984a_elex_emotet_stop.exe 1312 2026-07-17_97018bfdb8ba9b098849ad674028984a_elex_emotet_stop.exe 5704 TETYY.exe 5704 TETYY.exe 3220 WKYIOCL.exe 3220 WKYIOCL.exe 4280 ONCEBS.exe 4280 ONCEBS.exe 1212 EVLDAFK.exe 1212 EVLDAFK.exe 3556 YQIN.exe 3556 YQIN.exe 1448 MTYM.exe 1448 MTYM.exe 1872 FUGW.exe 1872 FUGW.exe 5720 OUICT.exe 5720 OUICT.exe 5288 YSV.exe 5288 YSV.exe 4084 QACTN.exe 4084 QACTN.exe 5248 ATTBZQX.exe 5248 ATTBZQX.exe 4404 RTV.exe 4404 RTV.exe 1936 KWZCI.exe 1936 KWZCI.exe 5936 ZRJ.exe 5936 ZRJ.exe 1128 YCLWCEF.exe 1128 YCLWCEF.exe 1372 AAZQRNG.exe 1372 AAZQRNG.exe 1296 BNKO.exe 1296 BNKO.exe 2592 LGU.exe 2592 LGU.exe 560 BWH.exe 560 BWH.exe 556 FBAV.exe 556 FBAV.exe 6072 WUC.exe 6072 WUC.exe 4176 GSQXY.exe 4176 GSQXY.exe 4760 DLSH.exe 4760 DLSH.exe 5668 NIXU.exe 5668 NIXU.exe 1796 WRZHV.exe 1796 WRZHV.exe 2232 RTQYJ.exe 2232 RTQYJ.exe 756 TRW.exe 756 TRW.exe 5416 UUZWEUA.exe 5416 UUZWEUA.exe 1548 WSNI.exe 1548 WSNI.exe 3384 QFSZVD.exe 3384 QFSZVD.exe 5980 IOMEZAZ.exe 5980 IOMEZAZ.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1312 wrote to memory of 3256 1312 2026-07-17_97018bfdb8ba9b098849ad674028984a_elex_emotet_stop.exe 89 PID 3256 wrote to memory of 5704 3256 cmd.exe 93 PID 5704 wrote to memory of 2548 5704 TETYY.exe 95 PID 2548 wrote to memory of 3220 2548 cmd.exe 99 PID 3220 wrote to memory of 4292 3220 WKYIOCL.exe 100 PID 4292 wrote to memory of 4280 4292 cmd.exe 104 PID 4280 wrote to memory of 4520 4280 ONCEBS.exe 105 PID 4520 wrote to memory of 1212 4520 cmd.exe 109 PID 1212 wrote to memory of 1880 1212 EVLDAFK.exe 110 PID 1880 wrote to memory of 3556 1880 cmd.exe 114 PID 3556 wrote to memory of 5884 3556 YQIN.exe 115 PID 5884 wrote to memory of 1448 5884 cmd.exe 119 PID 1448 wrote to memory of 760 1448 MTYM.exe 120 PID 760 wrote to memory of 1872 760 cmd.exe 124 PID 1872 wrote to memory of 2140 1872 FUGW.exe 125 PID 2140 wrote to memory of 5720 2140 cmd.exe 129 PID 5720 wrote to memory of 3612 5720 OUICT.exe 130 PID 3612 wrote to memory of 5288 3612 cmd.exe 134 PID 5288 wrote to memory of 3812 5288 YSV.exe 135 PID 3812 wrote to memory of 4084 3812 cmd.exe 139 PID 4084 wrote to memory of 2856 4084 QACTN.exe 140 PID 2856 wrote to memory of 5248 2856 cmd.exe 144 PID 5248 wrote to memory of 4540 5248 ATTBZQX.exe 145 PID 4540 wrote to memory of 4404 4540 cmd.exe 149 PID 4404 wrote to memory of 4536 4404 RTV.exe 150 PID 4536 wrote to memory of 1936 4536 cmd.exe 154 PID 1936 wrote to memory of 5540 1936 KWZCI.exe 155 PID 5540 wrote to memory of 5936 5540 cmd.exe 159 PID 5936 wrote to memory of 2216 5936 ZRJ.exe 160 PID 2216 wrote to memory of 1128 2216 cmd.exe 164 PID 1128 wrote to memory of 3480 1128 YCLWCEF.exe 165 PID 3480 wrote to memory of 1372 3480 cmd.exe 169 PID 1372 wrote to memory of 3476 1372 AAZQRNG.exe 170 PID 3476 wrote to memory of 1296 3476 cmd.exe 174 PID 1296 wrote to memory of 3400 1296 BNKO.exe 175 PID 3400 wrote to memory of 2592 3400 cmd.exe 179 PID 2592 wrote to memory of 576 2592 LGU.exe 180 PID 576 wrote to memory of 560 576 cmd.exe 184 PID 560 wrote to memory of 5740 560 BWH.exe 185 PID 5740 wrote to memory of 556 5740 cmd.exe 189 PID 556 wrote to memory of 2500 556 FBAV.exe 190 PID 2500 wrote to memory of 6072 2500 cmd.exe 194 PID 6072 wrote to memory of 4508 6072 WUC.exe 195 PID 4508 wrote to memory of 4176 4508 cmd.exe 199 PID 4176 wrote to memory of 4020 4176 GSQXY.exe 200 PID 4020 wrote to memory of 4760 4020 cmd.exe 204 PID 4760 wrote to memory of 3488 4760 DLSH.exe 205 PID 3488 wrote to memory of 5668 3488 cmd.exe 209 PID 5668 wrote to memory of 2060 5668 NIXU.exe 210 PID 2060 wrote to memory of 1796 2060 cmd.exe 214 PID 1796 wrote to memory of 5748 1796 WRZHV.exe 215 PID 5748 wrote to memory of 2232 5748 cmd.exe 219 PID 2232 wrote to memory of 1220 2232 RTQYJ.exe 220 PID 1220 wrote to memory of 756 1220 cmd.exe 224 PID 756 wrote to memory of 2876 756 TRW.exe 225 PID 2876 wrote to memory of 5416 2876 cmd.exe 229 PID 5416 wrote to memory of 4464 5416 UUZWEUA.exe 230 PID 4464 wrote to memory of 1548 4464 cmd.exe 234 PID 1548 wrote to memory of 3320 1548 WSNI.exe 235 PID 3320 wrote to memory of 3384 3320 cmd.exe 239 PID 3384 wrote to memory of 2256 3384 QFSZVD.exe 240 PID 2256 wrote to memory of 5980 2256 cmd.exe 244 PID 5980 wrote to memory of 2360 5980 IOMEZAZ.exe 245 PID 2360 wrote to memory of 3668 2360 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-17_97018bfdb8ba9b098849ad674028984a_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-17_97018bfdb8ba9b098849ad674028984a_elex_emotet_stop.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TETYY.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\windows\SysWOW64\TETYY.exeC:\windows\system32\TETYY.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WKYIOCL.exe.bat" "4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\windows\system\WKYIOCL.exeC:\windows\system\WKYIOCL.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ONCEBS.exe.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\windows\system\ONCEBS.exeC:\windows\system\ONCEBS.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EVLDAFK.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\windows\SysWOW64\EVLDAFK.exeC:\windows\system32\EVLDAFK.exe9⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YQIN.exe.bat" "10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\windows\YQIN.exeC:\windows\YQIN.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MTYM.exe.bat" "12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5884 -
C:\windows\SysWOW64\MTYM.exeC:\windows\system32\MTYM.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FUGW.exe.bat" "14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:760 -
C:\windows\SysWOW64\FUGW.exeC:\windows\system32\FUGW.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OUICT.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\windows\SysWOW64\OUICT.exeC:\windows\system32\OUICT.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YSV.exe.bat" "18⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\windows\SysWOW64\YSV.exeC:\windows\system32\YSV.exe19⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5288 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QACTN.exe.bat" "20⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3812 -
C:\windows\QACTN.exeC:\windows\QACTN.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ATTBZQX.exe.bat" "22⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\windows\SysWOW64\ATTBZQX.exeC:\windows\system32\ATTBZQX.exe23⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RTV.exe.bat" "24⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\windows\system\RTV.exeC:\windows\system\RTV.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KWZCI.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\windows\system\KWZCI.exeC:\windows\system\KWZCI.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZRJ.exe.bat" "28⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5540 -
C:\windows\SysWOW64\ZRJ.exeC:\windows\system32\ZRJ.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YCLWCEF.exe.bat" "30⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\windows\system\YCLWCEF.exeC:\windows\system\YCLWCEF.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AAZQRNG.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:3480 -
C:\windows\SysWOW64\AAZQRNG.exeC:\windows\system32\AAZQRNG.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BNKO.exe.bat" "34⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\windows\BNKO.exeC:\windows\BNKO.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LGU.exe.bat" "36⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\windows\SysWOW64\LGU.exeC:\windows\system32\LGU.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BWH.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:576 -
C:\windows\system\BWH.exeC:\windows\system\BWH.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FBAV.exe.bat" "40⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5740 -
C:\windows\FBAV.exeC:\windows\FBAV.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WUC.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\windows\WUC.exeC:\windows\WUC.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6072 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GSQXY.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\windows\GSQXY.exeC:\windows\GSQXY.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DLSH.exe.bat" "46⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4020 -
C:\windows\system\DLSH.exeC:\windows\system\DLSH.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NIXU.exe.bat" "48⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\windows\SysWOW64\NIXU.exeC:\windows\system32\NIXU.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WRZHV.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\windows\system\WRZHV.exeC:\windows\system\WRZHV.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RTQYJ.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:5748 -
C:\windows\system\RTQYJ.exeC:\windows\system\RTQYJ.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TRW.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\windows\TRW.exeC:\windows\TRW.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UUZWEUA.exe.bat" "56⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\windows\SysWOW64\UUZWEUA.exeC:\windows\system32\UUZWEUA.exe57⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WSNI.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\windows\system\WSNI.exeC:\windows\system\WSNI.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QFSZVD.exe.bat" "60⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\windows\system\QFSZVD.exeC:\windows\system\QFSZVD.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IOMEZAZ.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\windows\system\IOMEZAZ.exeC:\windows\system\IOMEZAZ.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OOTS.exe.bat" "64⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\windows\SysWOW64\OOTS.exeC:\windows\system32\OOTS.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XOV.exe.bat" "66⤵
- Executes a command shell one-liner
PID:2680 -
C:\windows\SysWOW64\XOV.exeC:\windows\system32\XOV.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KZMWAK.exe.bat" "68⤵
- Executes a command shell one-liner
PID:4436 -
C:\windows\SysWOW64\KZMWAK.exeC:\windows\system32\KZMWAK.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\APNN.exe.bat" "70⤵
- System Location Discovery: System Language Discovery
PID:2032 -
C:\windows\SysWOW64\APNN.exeC:\windows\system32\APNN.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KNSIWOW.exe.bat" "72⤵PID:4268
-
C:\windows\SysWOW64\KNSIWOW.exeC:\windows\system32\KNSIWOW.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CQWLB.exe.bat" "74⤵PID:1888
-
C:\windows\SysWOW64\CQWLB.exeC:\windows\system32\CQWLB.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DLAHHUG.exe.bat" "76⤵
- Executes a command shell one-liner
PID:3168 -
C:\windows\SysWOW64\DLAHHUG.exeC:\windows\system32\DLAHHUG.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FJOBWDP.exe.bat" "78⤵
- System Location Discovery: System Language Discovery
PID:4040 -
C:\windows\FJOBWDP.exeC:\windows\FJOBWDP.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ETQR.exe.bat" "80⤵
- Executes a command shell one-liner
PID:1856 -
C:\windows\SysWOW64\ETQR.exeC:\windows\system32\ETQR.exe81⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZEZI.exe.bat" "82⤵PID:4768
-
C:\windows\system\ZEZI.exeC:\windows\system\ZEZI.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DUOQXM.exe.bat" "84⤵
- System Location Discovery: System Language Discovery
PID:5728 -
C:\windows\SysWOW64\DUOQXM.exeC:\windows\system32\DUOQXM.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OINOC.exe.bat" "86⤵
- System Location Discovery: System Language Discovery
PID:3724 -
C:\windows\SysWOW64\OINOC.exeC:\windows\system32\OINOC.exe87⤵
- Executes dropped EXE
PID:4496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JVRXMNG.exe.bat" "88⤵PID:2512
-
C:\windows\system\JVRXMNG.exeC:\windows\system\JVRXMNG.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LIW.exe.bat" "90⤵
- Executes a command shell one-liner
PID:4972 -
C:\windows\system\LIW.exeC:\windows\system\LIW.exe91⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5024 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ELALCDW.exe.bat" "92⤵
- System Location Discovery: System Language Discovery
PID:3492 -
C:\windows\system\ELALCDW.exeC:\windows\system\ELALCDW.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:52 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KMIYL.exe.bat" "94⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5696 -
C:\windows\KMIYL.exeC:\windows\KMIYL.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2528 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TMKDPD.exe.bat" "96⤵PID:1696
-
C:\windows\TMKDPD.exeC:\windows\TMKDPD.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OZO.exe.bat" "98⤵
- System Location Discovery: System Language Discovery
PID:6100 -
C:\windows\OZO.exeC:\windows\OZO.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1336 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UXAQMI.exe.bat" "100⤵PID:6060
-
C:\windows\system\UXAQMI.exeC:\windows\system\UXAQMI.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LIKGV.exe.bat" "102⤵
- Executes a command shell one-liner
PID:5744 -
C:\windows\LIKGV.exeC:\windows\LIKGV.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OVHPFNH.exe.bat" "104⤵
- Executes a command shell one-liner
PID:5476 -
C:\windows\system\OVHPFNH.exeC:\windows\system\OVHPFNH.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EGSFNB.exe.bat" "106⤵
- System Location Discovery: System Language Discovery
PID:2180 -
C:\windows\EGSFNB.exeC:\windows\EGSFNB.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FJW.exe.bat" "108⤵PID:4896
-
C:\windows\FJW.exeC:\windows\FJW.exe109⤵
- Executes dropped EXE
PID:5912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YMAFYHO.exe.bat" "110⤵PID:5264
-
C:\windows\system\YMAFYHO.exeC:\windows\system\YMAFYHO.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SZE.exe.bat" "112⤵
- System Location Discovery: System Language Discovery
PID:800 -
C:\windows\SysWOW64\SZE.exeC:\windows\system32\SZE.exe113⤵
- Executes dropped EXE
PID:816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HUOSCU.exe.bat" "114⤵
- System Location Discovery: System Language Discovery
PID:5828 -
C:\windows\system\HUOSCU.exeC:\windows\system\HUOSCU.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TNRLCJ.exe.bat" "116⤵PID:3536
-
C:\windows\SysWOW64\TNRLCJ.exeC:\windows\system32\TNRLCJ.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VIWVMJH.exe.bat" "118⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4728 -
C:\windows\VIWVMJH.exeC:\windows\VIWVMJH.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FJYAQG.exe.bat" "120⤵PID:2452
-
C:\windows\FJYAQG.exeC:\windows\FJYAQG.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4196
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-