Analysis
- max time kernel
83s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/07/2026, 10:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-18_83463cb23dff4bab541849ddaf2db94a_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-07-18_83463cb23dff4bab541849ddaf2db94a_elex_emotet_stop.exe
- Size 208KB
- Sample260718-m2ncfag13l
- SHA256 9434021c20011316ca4a9a9a5b46a34e0342e8c39dd05613dc232cfa2c73cd26
- MD5 83463cb23dff4bab541849ddaf2db94a
- SHA1 a6f0df70650c8f2213d29d2e5484ead716af8ff7
- SHA512 af90cf874ba3b87b4a66b065c4ab2d9e1cf861f577c78c2e67ac019a7d9f90195127c416179b06a17ef28402dc4033d12105dd6627b6a51d83b8525859aa8753
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbclcdL+LOf94NLthEjQT6E:MlZtbLWIgd1LZ9oECZbclc5+LOVQEj6
- TLSH T149247D2235D2C073E4B7023188F6C7787BB6BD919B36928B7BC03B4D6E715A68A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5084 MSNCO.exe 1584 WIPYII.exe 1548 JLYWWL.exe 2284 YBZODGC.exe 4452 XMJEDM.exe 5256 BCQE.exe 4316 UFU.exe 5580 UAYD.exe 5000 YQELVDT.exe 3056 GWRSXB.exe 2824 FHUIG.exe 4644 GKYE.exe 5804 JAMMYXB.exe 4144 NITM.exe 3808 RYZUWA.exe 4992 QICCF.exe 5180 FZDB.exe 4388 EOWEZHE.exe 2276 NXYJ.exe 1212 MHB.exe 1252 MLUKUDM.exe 5124 OIZWJ.exe 5632 DDJ.exe 4904 UELOYE.exe 4732 NHO.exe 5808 RPVRQ.exe 4432 GFW.exe 5740 KVDRJS.exe 4564 ZQUV.exe 5272 UDZEEE.exe 616 LMTKHKX.exe 4704 NJHEXS.exe 2024 EKJ.exe 2100 XNMNGGJ.exe 1536 MIWRRAS.exe 4188 NLAVEQ.exe 1020 PJNPMZ.exe 1144 EZOGSUR.exe 2380 TUYLD.exe 204 OHDCNHO.exe 4336 JUHM.exe 1084 JXL.exe 2672 ELQR.exe 5076 YGVAYW.exe 4152 ETMJUZG.exe 5720 IJBJ.exe 6116 DXFSRR.exe 424 GSPCCDY.exe 4328 KVNPK.exe 4472 QVUDTYB.exe 4352 KIZM.exe 5512 QJHAMS.exe 3452 QOHOOFU.exe 2432 NUNLVP.exe 4960 AFVKJS.exe 6008 USA.exe 964 PFFDE.exe 4512 VBEEAU.exe 3712 KWOQ.exe 5520 MTHK.exe 4760 JZZ.exe 2796 YPAZPV.exe 2428 JIDSXCA.exe 1920 ZDMWI.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\MLUKUDM.exe.bat MHB.exe File created C:\windows\SysWOW64\GFW.exe RPVRQ.exe File opened for modification C:\windows\SysWOW64\EXU.exe ECQHSD.exe File created C:\windows\SysWOW64\QWY.exe JGXD.exe File created C:\windows\SysWOW64\QVUDTYB.exe KVNPK.exe File opened for modification C:\windows\SysWOW64\GFDFB.exe ARDFWYJ.exe File created C:\windows\SysWOW64\EXU.exe.bat ECQHSD.exe File created C:\windows\SysWOW64\XLEOKFF.exe.bat FKCJGI.exe File opened for modification C:\windows\SysWOW64\QWY.exe JGXD.exe File created C:\windows\SysWOW64\GKYE.exe FHUIG.exe File created C:\windows\SysWOW64\GFW.exe.bat RPVRQ.exe File created C:\windows\SysWOW64\MTHK.exe.bat KWOQ.exe File opened for modification C:\windows\SysWOW64\JIDSXCA.exe YPAZPV.exe File created C:\windows\SysWOW64\BCQE.exe.bat XMJEDM.exe File opened for modification C:\windows\SysWOW64\KWOQ.exe VBEEAU.exe File created C:\windows\SysWOW64\BZXGA.exe WOYSAYN.exe File created C:\windows\SysWOW64\FHDONKL.exe BZXGA.exe File created C:\windows\SysWOW64\WIPYII.exe.bat MSNCO.exe File opened for modification C:\windows\SysWOW64\QICCF.exe RYZUWA.exe File created C:\windows\SysWOW64\KIZM.exe QVUDTYB.exe File opened for modification C:\windows\SysWOW64\KIZM.exe QVUDTYB.exe File created C:\windows\SysWOW64\USA.exe.bat AFVKJS.exe File created C:\windows\SysWOW64\BZXGA.exe.bat WOYSAYN.exe File opened for modification C:\windows\SysWOW64\MLUKUDM.exe MHB.exe File created C:\windows\SysWOW64\AFVKJS.exe NUNLVP.exe File created C:\windows\SysWOW64\JIDSXCA.exe YPAZPV.exe File created C:\windows\SysWOW64\JGXD.exe ILTZTGV.exe File created C:\windows\SysWOW64\WOYSAYN.exe JLQUMWS.exe File opened for modification C:\windows\SysWOW64\NTFBDVD.exe BLYTR.exe File created C:\windows\SysWOW64\JUHM.exe OHDCNHO.exe File created C:\windows\SysWOW64\ILTZTGV.exe XLEOKFF.exe File opened for modification C:\windows\SysWOW64\VHIYFAJ.exe XURXAX.exe File created C:\windows\SysWOW64\GWRSXB.exe YQELVDT.exe File created C:\windows\SysWOW64\LLA.exe QYVXJLY.exe File opened for modification C:\windows\SysWOW64\KVZNS.exe YFL.exe File created C:\windows\SysWOW64\BCQE.exe XMJEDM.exe File created C:\windows\SysWOW64\QICCF.exe.bat RYZUWA.exe File created C:\windows\SysWOW64\ZQUV.exe KVDRJS.exe File opened for modification C:\windows\SysWOW64\GWRSXB.exe YQELVDT.exe File created C:\windows\SysWOW64\LLA.exe.bat QYVXJLY.exe File created C:\windows\SysWOW64\JPLYI.exe UMCTXJP.exe File opened for modification C:\windows\SysWOW64\BCQE.exe XMJEDM.exe File created C:\windows\SysWOW64\NTFBDVD.exe BLYTR.exe File created C:\windows\SysWOW64\MSNCO.exe 2026-07-18_83463cb23dff4bab541849ddaf2db94a_elex_emotet_stop.exe File opened for modification C:\windows\SysWOW64\LLA.exe QYVXJLY.exe File created C:\windows\SysWOW64\KVZNS.exe.bat YFL.exe File opened for modification C:\windows\SysWOW64\XLEOKFF.exe FKCJGI.exe File created C:\windows\SysWOW64\JGXD.exe.bat ILTZTGV.exe File created C:\windows\SysWOW64\VHIYFAJ.exe XURXAX.exe File created C:\windows\SysWOW64\ZQUV.exe.bat KVDRJS.exe File created C:\windows\SysWOW64\KWOQ.exe VBEEAU.exe File created C:\windows\SysWOW64\WOYSAYN.exe.bat JLQUMWS.exe File created C:\windows\SysWOW64\MSNCO.exe.bat 2026-07-18_83463cb23dff4bab541849ddaf2db94a_elex_emotet_stop.exe File opened for modification C:\windows\SysWOW64\ETMJUZG.exe YGVAYW.exe File opened for modification C:\windows\SysWOW64\MSNCO.exe 2026-07-18_83463cb23dff4bab541849ddaf2db94a_elex_emotet_stop.exe File created C:\windows\SysWOW64\QICCF.exe RYZUWA.exe File created C:\windows\SysWOW64\JIDSXCA.exe.bat YPAZPV.exe File created C:\windows\SysWOW64\GFDFB.exe.bat ARDFWYJ.exe File opened for modification C:\windows\SysWOW64\JPLYI.exe UMCTXJP.exe File opened for modification C:\windows\SysWOW64\BZXGA.exe WOYSAYN.exe File opened for modification C:\windows\SysWOW64\WIPYII.exe MSNCO.exe File opened for modification C:\windows\SysWOW64\UELOYE.exe DDJ.exe File opened for modification C:\windows\SysWOW64\FHDONKL.exe BZXGA.exe File opened for modification C:\windows\SysWOW64\ILTZTGV.exe XLEOKFF.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\RYZUWA.exe NITM.exe File created C:\windows\system\RPVRQ.exe NHO.exe File opened for modification C:\windows\system\MIWRRAS.exe XNMNGGJ.exe File created C:\windows\system\YPAZPV.exe.bat JZZ.exe File created C:\windows\JLQUMWS.exe MNDCEHK.exe File created C:\windows\system\YFL.exe FKHJ.exe File created C:\windows\system\CRSPY.exe YBMHLJP.exe File created C:\windows\NHYFTKC.exe NTFBDVD.exe File created C:\windows\NHO.exe.bat UELOYE.exe File created C:\windows\DXFSRR.exe IJBJ.exe File opened for modification C:\windows\DXFSRR.exe IJBJ.exe File created C:\windows\DXFSRR.exe.bat IJBJ.exe File created C:\windows\system\QOHOOFU.exe.bat QJHAMS.exe File created C:\windows\OVQO.exe.bat NSMLOXQ.exe File opened for modification C:\windows\NHYFTKC.exe NTFBDVD.exe File created C:\windows\FKCJGI.exe.bat NHYFTKC.exe File created C:\windows\system\XMJEDM.exe.bat YBZODGC.exe File opened for modification C:\windows\system\UAYD.exe UFU.exe File opened for modification C:\windows\system\YQELVDT.exe UAYD.exe File created C:\windows\DDJ.exe OIZWJ.exe File opened for modification C:\windows\XNMNGGJ.exe EKJ.exe File created C:\windows\system\NLAVEQ.exe MIWRRAS.exe File created C:\windows\system\PJNPMZ.exe NLAVEQ.exe File created C:\windows\system\FKHJ.exe FHDONKL.exe File opened for modification C:\windows\EOWEZHE.exe FZDB.exe File opened for modification C:\windows\DDJ.exe OIZWJ.exe File opened for modification C:\windows\EKJ.exe NJHEXS.exe File created C:\windows\system\LYT.exe IDOBLUD.exe File opened for modification C:\windows\system\YFL.exe FKHJ.exe File created C:\windows\system\PPA.exe.bat CRSPY.exe File opened for modification C:\windows\system\EKKFKZ.exe PPA.exe File created C:\windows\BLYTR.exe UVXCKP.exe File opened for modification C:\windows\system\YBZODGC.exe JLYWWL.exe File created C:\windows\UFU.exe.bat BCQE.exe File opened for modification C:\windows\FHUIG.exe GWRSXB.exe File opened for modification C:\windows\system\UDZEEE.exe ZQUV.exe File created C:\windows\system\PFFDE.exe.bat USA.exe File created C:\windows\system\QYVXJLY.exe FFAMB.exe File created C:\windows\system\RYZUWA.exe.bat NITM.exe File created C:\windows\FZDB.exe.bat QICCF.exe File opened for modification C:\windows\KVNPK.exe GSPCCDY.exe File created C:\windows\system\QJHAMS.exe KIZM.exe File opened for modification C:\windows\system\QOHOOFU.exe QJHAMS.exe File opened for modification C:\windows\system\ZDMWI.exe JIDSXCA.exe File created C:\windows\system\ARDFWYJ.exe AZDLQUV.exe File created C:\windows\system\VIM.exe GFDFB.exe File created C:\windows\system\NITM.exe JAMMYXB.exe File created C:\windows\OIZWJ.exe.bat MLUKUDM.exe File created C:\windows\system\TUYLD.exe.bat EZOGSUR.exe File created C:\windows\system\ECQHSD.exe JPLYI.exe File opened for modification C:\windows\JLQUMWS.exe MNDCEHK.exe File created C:\windows\JAMMYXB.exe GKYE.exe File opened for modification C:\windows\system\MHB.exe NXYJ.exe File opened for modification C:\windows\OIZWJ.exe MLUKUDM.exe File created C:\windows\KVNPK.exe.bat GSPCCDY.exe File created C:\windows\system\FFAMB.exe VIM.exe File opened for modification C:\windows\NSMLOXQ.exe EKKFKZ.exe File opened for modification C:\windows\system\NUNLVP.exe QOHOOFU.exe File created C:\windows\system\FFAMB.exe.bat VIM.exe File created C:\windows\system\MNDCEHK.exe.bat EXU.exe File created C:\windows\JLQUMWS.exe.bat MNDCEHK.exe File created C:\windows\system\YQELVDT.exe.bat UAYD.exe File created C:\windows\FHUIG.exe.bat GWRSXB.exe File created C:\windows\system\LMTKHKX.exe.bat UDZEEE.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5464 cmd.exe 1492 cmd.exe 2004 cmd.exe 4120 cmd.exe 1772 cmd.exe 4108 cmd.exe 3504 cmd.exe 4700 cmd.exe 912 cmd.exe 3128 cmd.exe 2800 cmd.exe 4900 cmd.exe 5228 cmd.exe 1648 cmd.exe 4220 cmd.exe 2268 cmd.exe 3200 cmd.exe 3368 cmd.exe 5792 cmd.exe 2624 cmd.exe 2556 cmd.exe 5992 cmd.exe 3380 cmd.exe 5736 cmd.exe 1756 cmd.exe 2972 cmd.exe 3292 cmd.exe 4404 cmd.exe 5568 cmd.exe 5016 cmd.exe 2552 cmd.exe 2132 cmd.exe 2388 cmd.exe 1936 cmd.exe 3248 cmd.exe 1856 cmd.exe 2748 cmd.exe 5660 cmd.exe 3132 cmd.exe 1976 cmd.exe 5300 cmd.exe 4772 cmd.exe 3228 cmd.exe 4600 cmd.exe 1168 cmd.exe 5604 cmd.exe 2528 cmd.exe 4092 cmd.exe 3532 cmd.exe 5324 cmd.exe 2832 cmd.exe 4272 cmd.exe 3172 cmd.exe 1876 cmd.exe 3852 cmd.exe 1432 cmd.exe 2476 cmd.exe 3272 cmd.exe 2404 cmd.exe 3980 cmd.exe 2264 cmd.exe 5668 cmd.exe 5968 cmd.exe 5352 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 2912 4864 WerFault.exe 87 5852 5084 WerFault.exe 93 2404 1584 WerFault.exe 99 4908 1548 WerFault.exe 104 4600 2284 WerFault.exe 109 2176 4452 WerFault.exe 114 1180 5256 WerFault.exe 119 4760 4316 WerFault.exe 124 4288 5580 WerFault.exe 129 2944 5000 WerFault.exe 134 5784 3056 WerFault.exe 139 4828 2824 WerFault.exe 144 1780 4644 WerFault.exe 149 2864 5804 WerFault.exe 154 3852 4144 WerFault.exe 159 2120 3808 WerFault.exe 164 1088 4992 WerFault.exe 169 1600 5180 WerFault.exe 174 4784 4388 WerFault.exe 179 4976 2276 WerFault.exe 184 4488 1212 WerFault.exe 189 4440 1252 WerFault.exe 194 5328 5124 WerFault.exe 199 3136 5632 WerFault.exe 204 1804 4904 WerFault.exe 209 2588 4732 WerFault.exe 214 5856 5808 WerFault.exe 219 1936 4432 WerFault.exe 224 1180 5740 WerFault.exe 229 3192 4564 WerFault.exe 234 1388 5272 WerFault.exe 239 1800 616 WerFault.exe 244 6140 4704 WerFault.exe 249 1324 2024 WerFault.exe 254 1332 2100 WerFault.exe 259 2060 1536 WerFault.exe 264 3424 4188 WerFault.exe 269 4268 1020 WerFault.exe 274 1056 1144 WerFault.exe 279 3272 2380 WerFault.exe 284 4688 204 WerFault.exe 289 2832 4336 WerFault.exe 294 200 1084 WerFault.exe 299 4868 2672 WerFault.exe 304 1552 5076 WerFault.exe 309 1208 4152 WerFault.exe 314 620 5720 WerFault.exe 319 5892 6116 WerFault.exe 324 1600 424 WerFault.exe 329 4784 4328 WerFault.exe 334 3900 4472 WerFault.exe 339 5500 4352 WerFault.exe 344 5312 5512 WerFault.exe 349 3236 3452 WerFault.exe 353 3668 2432 WerFault.exe 359 4080 4960 WerFault.exe 364 4656 6008 WerFault.exe 369 5940 964 WerFault.exe 374 5856 4512 WerFault.exe 379 3692 3712 WerFault.exe 384 1224 5520 WerFault.exe 389 2848 4760 WerFault.exe 394 2132 2796 WerFault.exe 399 4808 2428 WerFault.exe 404 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JLYWWL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JUHM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ECQHSD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JLQUMWS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XLEOKFF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XURXAX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TUYLD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ILTZTGV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ARDFWYJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UMCTXJP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JPLYI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UVXCKP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UFU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GWRSXB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KIZM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZDMWI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UELOYE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LMTKHKX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AZDLQUV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NSMLOXQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZQUV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NJHEXS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MHB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IJBJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QVUDTYB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AFVKJS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JZZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NLAVEQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ETMJUZG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-18_83463cb23dff4bab541849ddaf2db94a_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QJHAMS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OIZWJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4864 2026-07-18_83463cb23dff4bab541849ddaf2db94a_elex_emotet_stop.exe 4864 2026-07-18_83463cb23dff4bab541849ddaf2db94a_elex_emotet_stop.exe 5084 MSNCO.exe 5084 MSNCO.exe 1584 WIPYII.exe 1584 WIPYII.exe 1548 JLYWWL.exe 1548 JLYWWL.exe 2284 YBZODGC.exe 2284 YBZODGC.exe 4452 XMJEDM.exe 4452 XMJEDM.exe 5256 BCQE.exe 5256 BCQE.exe 4316 UFU.exe 4316 UFU.exe 5580 UAYD.exe 5580 UAYD.exe 5000 YQELVDT.exe 5000 YQELVDT.exe 3056 GWRSXB.exe 3056 GWRSXB.exe 2824 FHUIG.exe 2824 FHUIG.exe 4644 GKYE.exe 4644 GKYE.exe 5804 JAMMYXB.exe 5804 JAMMYXB.exe 4144 NITM.exe 4144 NITM.exe 3808 RYZUWA.exe 3808 RYZUWA.exe 4992 QICCF.exe 4992 QICCF.exe 5180 FZDB.exe 5180 FZDB.exe 4388 EOWEZHE.exe 4388 EOWEZHE.exe 2276 NXYJ.exe 2276 NXYJ.exe 1212 MHB.exe 1212 MHB.exe 1252 MLUKUDM.exe 1252 MLUKUDM.exe 5124 OIZWJ.exe 5124 OIZWJ.exe 5632 DDJ.exe 5632 DDJ.exe 4904 UELOYE.exe 4904 UELOYE.exe 4732 NHO.exe 4732 NHO.exe 5808 RPVRQ.exe 5808 RPVRQ.exe 4432 GFW.exe 4432 GFW.exe 5740 KVDRJS.exe 5740 KVDRJS.exe 4564 ZQUV.exe 4564 ZQUV.exe 5272 UDZEEE.exe 5272 UDZEEE.exe 616 LMTKHKX.exe 616 LMTKHKX.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4864 2026-07-18_83463cb23dff4bab541849ddaf2db94a_elex_emotet_stop.exe 4864 2026-07-18_83463cb23dff4bab541849ddaf2db94a_elex_emotet_stop.exe 5084 MSNCO.exe 5084 MSNCO.exe 1584 WIPYII.exe 1584 WIPYII.exe 1548 JLYWWL.exe 1548 JLYWWL.exe 2284 YBZODGC.exe 2284 YBZODGC.exe 4452 XMJEDM.exe 4452 XMJEDM.exe 5256 BCQE.exe 5256 BCQE.exe 4316 UFU.exe 4316 UFU.exe 5580 UAYD.exe 5580 UAYD.exe 5000 YQELVDT.exe 5000 YQELVDT.exe 3056 GWRSXB.exe 3056 GWRSXB.exe 2824 FHUIG.exe 2824 FHUIG.exe 4644 GKYE.exe 4644 GKYE.exe 5804 JAMMYXB.exe 5804 JAMMYXB.exe 4144 NITM.exe 4144 NITM.exe 3808 RYZUWA.exe 3808 RYZUWA.exe 4992 QICCF.exe 4992 QICCF.exe 5180 FZDB.exe 5180 FZDB.exe 4388 EOWEZHE.exe 4388 EOWEZHE.exe 2276 NXYJ.exe 2276 NXYJ.exe 1212 MHB.exe 1212 MHB.exe 1252 MLUKUDM.exe 1252 MLUKUDM.exe 5124 OIZWJ.exe 5124 OIZWJ.exe 5632 DDJ.exe 5632 DDJ.exe 4904 UELOYE.exe 4904 UELOYE.exe 4732 NHO.exe 4732 NHO.exe 5808 RPVRQ.exe 5808 RPVRQ.exe 4432 GFW.exe 4432 GFW.exe 5740 KVDRJS.exe 5740 KVDRJS.exe 4564 ZQUV.exe 4564 ZQUV.exe 5272 UDZEEE.exe 5272 UDZEEE.exe 616 LMTKHKX.exe 616 LMTKHKX.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4864 wrote to memory of 2292 4864 2026-07-18_83463cb23dff4bab541849ddaf2db94a_elex_emotet_stop.exe 89 PID 2292 wrote to memory of 5084 2292 cmd.exe 93 PID 5084 wrote to memory of 4692 5084 MSNCO.exe 95 PID 4692 wrote to memory of 1584 4692 cmd.exe 99 PID 1584 wrote to memory of 2592 1584 WIPYII.exe 100 PID 2592 wrote to memory of 1548 2592 cmd.exe 104 PID 1548 wrote to memory of 2636 1548 JLYWWL.exe 105 PID 2636 wrote to memory of 2284 2636 cmd.exe 109 PID 2284 wrote to memory of 1572 2284 YBZODGC.exe 110 PID 1572 wrote to memory of 4452 1572 cmd.exe 114 PID 4452 wrote to memory of 5176 4452 XMJEDM.exe 115 PID 5176 wrote to memory of 5256 5176 cmd.exe 119 PID 5256 wrote to memory of 6128 5256 BCQE.exe 120 PID 6128 wrote to memory of 4316 6128 cmd.exe 124 PID 4316 wrote to memory of 1856 4316 UFU.exe 125 PID 1856 wrote to memory of 5580 1856 cmd.exe 129 PID 5580 wrote to memory of 2264 5580 UAYD.exe 130 PID 2264 wrote to memory of 5000 2264 cmd.exe 134 PID 5000 wrote to memory of 2748 5000 YQELVDT.exe 135 PID 2748 wrote to memory of 3056 2748 cmd.exe 139 PID 3056 wrote to memory of 4204 3056 GWRSXB.exe 140 PID 4204 wrote to memory of 2824 4204 cmd.exe 144 PID 2824 wrote to memory of 3436 2824 FHUIG.exe 145 PID 3436 wrote to memory of 4644 3436 cmd.exe 149 PID 4644 wrote to memory of 4728 4644 GKYE.exe 150 PID 4728 wrote to memory of 5804 4728 cmd.exe 154 PID 5804 wrote to memory of 4556 5804 JAMMYXB.exe 155 PID 4556 wrote to memory of 4144 4556 cmd.exe 159 PID 4144 wrote to memory of 5992 4144 NITM.exe 160 PID 5992 wrote to memory of 3808 5992 cmd.exe 164 PID 3808 wrote to memory of 1812 3808 RYZUWA.exe 165 PID 1812 wrote to memory of 4992 1812 cmd.exe 169 PID 4992 wrote to memory of 3380 4992 QICCF.exe 170 PID 3380 wrote to memory of 5180 3380 cmd.exe 174 PID 5180 wrote to memory of 3532 5180 FZDB.exe 175 PID 3532 wrote to memory of 4388 3532 cmd.exe 179 PID 4388 wrote to memory of 4592 4388 EOWEZHE.exe 180 PID 4592 wrote to memory of 2276 4592 cmd.exe 184 PID 2276 wrote to memory of 5996 2276 NXYJ.exe 185 PID 5996 wrote to memory of 1212 5996 cmd.exe 189 PID 1212 wrote to memory of 2916 1212 MHB.exe 190 PID 2916 wrote to memory of 1252 2916 cmd.exe 194 PID 1252 wrote to memory of 3880 1252 MLUKUDM.exe 195 PID 3880 wrote to memory of 5124 3880 cmd.exe 199 PID 5124 wrote to memory of 5324 5124 OIZWJ.exe 200 PID 5324 wrote to memory of 5632 5324 cmd.exe 204 PID 5632 wrote to memory of 3128 5632 DDJ.exe 205 PID 3128 wrote to memory of 4904 3128 cmd.exe 209 PID 4904 wrote to memory of 1860 4904 UELOYE.exe 210 PID 1860 wrote to memory of 4732 1860 cmd.exe 214 PID 4732 wrote to memory of 3472 4732 NHO.exe 215 PID 3472 wrote to memory of 5808 3472 cmd.exe 219 PID 5808 wrote to memory of 5744 5808 RPVRQ.exe 220 PID 5744 wrote to memory of 4432 5744 cmd.exe 224 PID 4432 wrote to memory of 1088 4432 GFW.exe 225 PID 1088 wrote to memory of 5740 1088 cmd.exe 229 PID 5740 wrote to memory of 5660 5740 KVDRJS.exe 230 PID 5660 wrote to memory of 4564 5660 cmd.exe 234 PID 4564 wrote to memory of 2172 4564 ZQUV.exe 235 PID 2172 wrote to memory of 5272 2172 cmd.exe 239 PID 5272 wrote to memory of 5628 5272 UDZEEE.exe 240 PID 5628 wrote to memory of 616 5628 cmd.exe 244 PID 616 wrote to memory of 1692 616 LMTKHKX.exe 245 PID 1692 wrote to memory of 4704 1692 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-18_83463cb23dff4bab541849ddaf2db94a_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-18_83463cb23dff4bab541849ddaf2db94a_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MSNCO.exe.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\windows\SysWOW64\MSNCO.exeC:\windows\system32\MSNCO.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WIPYII.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\windows\SysWOW64\WIPYII.exeC:\windows\system32\WIPYII.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JLYWWL.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\windows\system\JLYWWL.exeC:\windows\system\JLYWWL.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YBZODGC.exe.bat" "8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\windows\system\YBZODGC.exeC:\windows\system\YBZODGC.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XMJEDM.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\windows\system\XMJEDM.exeC:\windows\system\XMJEDM.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BCQE.exe.bat" "12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5176 -
C:\windows\SysWOW64\BCQE.exeC:\windows\system32\BCQE.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UFU.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:6128 -
C:\windows\UFU.exeC:\windows\UFU.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UAYD.exe.bat" "16⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\windows\system\UAYD.exeC:\windows\system\UAYD.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YQELVDT.exe.bat" "18⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\windows\system\YQELVDT.exeC:\windows\system\YQELVDT.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GWRSXB.exe.bat" "20⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\windows\SysWOW64\GWRSXB.exeC:\windows\system32\GWRSXB.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FHUIG.exe.bat" "22⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\windows\FHUIG.exeC:\windows\FHUIG.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GKYE.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\windows\SysWOW64\GKYE.exeC:\windows\system32\GKYE.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JAMMYXB.exe.bat" "26⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\windows\JAMMYXB.exeC:\windows\JAMMYXB.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NITM.exe.bat" "28⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\windows\system\NITM.exeC:\windows\system\NITM.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RYZUWA.exe.bat" "30⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5992 -
C:\windows\system\RYZUWA.exeC:\windows\system\RYZUWA.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QICCF.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\windows\SysWOW64\QICCF.exeC:\windows\system32\QICCF.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FZDB.exe.bat" "34⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\windows\FZDB.exeC:\windows\FZDB.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5180 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EOWEZHE.exe.bat" "36⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3532 -
C:\windows\EOWEZHE.exeC:\windows\EOWEZHE.exe37⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NXYJ.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\windows\NXYJ.exeC:\windows\NXYJ.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MHB.exe.bat" "40⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5996 -
C:\windows\system\MHB.exeC:\windows\system\MHB.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MLUKUDM.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\windows\SysWOW64\MLUKUDM.exeC:\windows\system32\MLUKUDM.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OIZWJ.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\windows\OIZWJ.exeC:\windows\OIZWJ.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DDJ.exe.bat" "46⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5324 -
C:\windows\DDJ.exeC:\windows\DDJ.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5632 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UELOYE.exe.bat" "48⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\windows\SysWOW64\UELOYE.exeC:\windows\system32\UELOYE.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NHO.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\windows\NHO.exeC:\windows\NHO.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RPVRQ.exe.bat" "52⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\windows\system\RPVRQ.exeC:\windows\system\RPVRQ.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GFW.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:5744 -
C:\windows\SysWOW64\GFW.exeC:\windows\system32\GFW.exe55⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KVDRJS.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\windows\SysWOW64\KVDRJS.exeC:\windows\system32\KVDRJS.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZQUV.exe.bat" "58⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5660 -
C:\windows\SysWOW64\ZQUV.exeC:\windows\system32\ZQUV.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UDZEEE.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\windows\system\UDZEEE.exeC:\windows\system\UDZEEE.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5272 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LMTKHKX.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:5628 -
C:\windows\system\LMTKHKX.exeC:\windows\system\LMTKHKX.exe63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NJHEXS.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\windows\system\NJHEXS.exeC:\windows\system\NJHEXS.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EKJ.exe.bat" "66⤵
- System Location Discovery: System Language Discovery
PID:5432 -
C:\windows\EKJ.exeC:\windows\EKJ.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2024 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XNMNGGJ.exe.bat" "68⤵
- Executes a command shell one-liner
PID:2268 -
C:\windows\XNMNGGJ.exeC:\windows\XNMNGGJ.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MIWRRAS.exe.bat" "70⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3132 -
C:\windows\system\MIWRRAS.exeC:\windows\system\MIWRRAS.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NLAVEQ.exe.bat" "72⤵
- Executes a command shell one-liner
PID:3200 -
C:\windows\system\NLAVEQ.exeC:\windows\system\NLAVEQ.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PJNPMZ.exe.bat" "74⤵
- Executes a command shell one-liner
PID:5016 -
C:\windows\system\PJNPMZ.exeC:\windows\system\PJNPMZ.exe75⤵
- Executes dropped EXE
PID:1020 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EZOGSUR.exe.bat" "76⤵
- System Location Discovery: System Language Discovery
PID:2792 -
C:\windows\system\EZOGSUR.exeC:\windows\system\EZOGSUR.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TUYLD.exe.bat" "78⤵PID:5216
-
C:\windows\system\TUYLD.exeC:\windows\system\TUYLD.exe79⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OHDCNHO.exe.bat" "80⤵PID:5488
-
C:\windows\OHDCNHO.exeC:\windows\OHDCNHO.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:204 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JUHM.exe.bat" "82⤵PID:916
-
C:\windows\SysWOW64\JUHM.exeC:\windows\system32\JUHM.exe83⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4336 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JXL.exe.bat" "84⤵PID:5020
-
C:\windows\JXL.exeC:\windows\JXL.exe85⤵
- Executes dropped EXE
PID:1084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ELQR.exe.bat" "86⤵
- System Location Discovery: System Language Discovery
PID:728 -
C:\windows\SysWOW64\ELQR.exeC:\windows\system32\ELQR.exe87⤵
- Executes dropped EXE
PID:2672 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YGVAYW.exe.bat" "88⤵PID:5592
-
C:\windows\SysWOW64\YGVAYW.exeC:\windows\system32\YGVAYW.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ETMJUZG.exe.bat" "90⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5668 -
C:\windows\SysWOW64\ETMJUZG.exeC:\windows\system32\ETMJUZG.exe91⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4152 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IJBJ.exe.bat" "92⤵PID:2576
-
C:\windows\system\IJBJ.exeC:\windows\system\IJBJ.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DXFSRR.exe.bat" "94⤵PID:5452
-
C:\windows\DXFSRR.exeC:\windows\DXFSRR.exe95⤵
- Executes dropped EXE
PID:6116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GSPCCDY.exe.bat" "96⤵
- Executes a command shell one-liner
PID:4600 -
C:\windows\SysWOW64\GSPCCDY.exeC:\windows\system32\GSPCCDY.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KVNPK.exe.bat" "98⤵
- System Location Discovery: System Language Discovery
PID:4504 -
C:\windows\KVNPK.exeC:\windows\KVNPK.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4328 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QVUDTYB.exe.bat" "100⤵PID:4912
-
C:\windows\SysWOW64\QVUDTYB.exeC:\windows\system32\QVUDTYB.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KIZM.exe.bat" "102⤵
- System Location Discovery: System Language Discovery
PID:2784 -
C:\windows\SysWOW64\KIZM.exeC:\windows\system32\KIZM.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QJHAMS.exe.bat" "104⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2800 -
C:\windows\system\QJHAMS.exeC:\windows\system\QJHAMS.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QOHOOFU.exe.bat" "106⤵
- Executes a command shell one-liner
PID:5464 -
C:\windows\system\QOHOOFU.exeC:\windows\system\QOHOOFU.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NUNLVP.exe.bat" "108⤵PID:4520
-
C:\windows\system\NUNLVP.exeC:\windows\system\NUNLVP.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AFVKJS.exe.bat" "110⤵
- Executes a command shell one-liner
PID:5300 -
C:\windows\SysWOW64\AFVKJS.exeC:\windows\system32\AFVKJS.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\USA.exe.bat" "112⤵PID:4628
-
C:\windows\SysWOW64\USA.exeC:\windows\system32\USA.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6008 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PFFDE.exe.bat" "114⤵
- Executes a command shell one-liner
PID:4900 -
C:\windows\system\PFFDE.exeC:\windows\system\PFFDE.exe115⤵
- Executes dropped EXE
PID:964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VBEEAU.exe.bat" "116⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5968 -
C:\windows\system\VBEEAU.exeC:\windows\system\VBEEAU.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KWOQ.exe.bat" "118⤵PID:624
-
C:\windows\SysWOW64\KWOQ.exeC:\windows\system32\KWOQ.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MTHK.exe.bat" "120⤵PID:4792
-
C:\windows\SysWOW64\MTHK.exeC:\windows\system32\MTHK.exe121⤵
- Executes dropped EXE
PID:5520
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-