Analysis
- max time kernel
85s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
19/07/2026, 22:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-19_605ccee3afc8ff602aa0224a0f45e6e5_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-07-19_605ccee3afc8ff602aa0224a0f45e6e5_elex_emotet_stop.exe
- Size 208KB
- Sample260719-2c978sd17q
- SHA256 d8d20c472e0283017b7b5101836f853afce1befd64b85f534da5b05b31c9727c
- MD5 605ccee3afc8ff602aa0224a0f45e6e5
- SHA1 1f8e7d8add606aa99d96ec5cc4e65529fa850404
- SHA512 9a524dfd858c057dff55f65f3f3cb1eb8237cf193e38f3beb8e56eba086f63b7ae8fceca6c65e4d1053678c6734284a5b5a70d380fa8d97c5f66efd0b07dbe0b
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbclcdL+LOfn4NLthEjQT6j:MlZtbLWIgd1LZ9oECZbclc5+LOPQEj1
- TLSH T191247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4324 EHI.exe 5924 HMHT.exe 700 NITM.exe 1196 XQVRV.exe 2472 MLE.exe 2024 NOIZMQJ.exe 3984 LZLPVE.exe 5800 EUP.exe 3268 ZPTCK.exe 4924 KXACWMJ.exe 1516 UGC.exe 1680 EDQ.exe 5488 UOSSQFQ.exe 3880 TEEUL.exe 5816 UHQQQBA.exe 2260 MKTUWQ.exe 3116 EKVZHWD.exe 4880 GIBTPEM.exe 2712 XQD.exe 3068 MLMDDO.exe 3952 HZR.exe 1052 JWXHD.exe 1956 AFZM.exe 776 ZQC.exe 2064 DYQCT.exe 5420 XLVTEAV.exe 1764 DLDH.exe 5752 JHUIR.exe 2884 NXIIEQA.exe 5996 TXIVN.exe 3828 MSUZAIL.exe 5032 DAOEE.exe 4952 YNTNOFC.exe 3468 DOABXID.exe 2460 PGD.exe 3476 HJHYLFU.exe 5132 LROY.exe 2072 XHUYJPE.exe 4364 XNVMKUH.exe 5720 MIEZW.exe 4948 WQGEZNJ.exe 5764 CROR.exe 3352 YOTOXY.exe 5424 JHWZFGC.exe 5464 CKAD.exe 2588 TSCIO.exe 3084 HVLHC.exe 3312 KLRHPWX.exe 2284 ABSG.exe 5940 KZG.exe 3780 EMDKN.exe 2312 BNNM.exe 4388 ACY.exe 1720 YNJXNHW.exe 2140 CDPF.exe 1564 UDRKCFN.exe 4844 DMTP.exe 3632 QPCOUNK.exe 1264 IXETF.exe 3292 AAHXLBO.exe 2160 NDYNZ.exe 5884 OGCR.exe 1032 XOEWI.exe 2448 TRM.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\CROR.exe WQGEZNJ.exe File created C:\windows\SysWOW64\EJVFKA.exe QGNGWP.exe File created C:\windows\SysWOW64\EJVFKA.exe.bat QGNGWP.exe File created C:\windows\SysWOW64\CUQT.exe IGMKKSX.exe File created C:\windows\SysWOW64\VYNGH.exe DYLA.exe File created C:\windows\SysWOW64\JUSJOJQ.exe OHNAE.exe File created C:\windows\SysWOW64\MIEZW.exe.bat XNVMKUH.exe File created C:\windows\SysWOW64\OGCR.exe.bat NDYNZ.exe File opened for modification C:\windows\SysWOW64\VYNGH.exe DYLA.exe File created C:\windows\SysWOW64\ABSG.exe.bat KLRHPWX.exe File created C:\windows\SysWOW64\XQVRV.exe NITM.exe File opened for modification C:\windows\SysWOW64\MIEZW.exe XNVMKUH.exe File opened for modification C:\windows\SysWOW64\ABSG.exe KLRHPWX.exe File created C:\windows\SysWOW64\ACY.exe.bat BNNM.exe File opened for modification C:\windows\SysWOW64\ULYK.exe ZYT.exe File created C:\windows\SysWOW64\JUSJOJQ.exe.bat OHNAE.exe File created C:\windows\SysWOW64\HJHYLFU.exe.bat PGD.exe File created C:\windows\SysWOW64\KZG.exe.bat ABSG.exe File created C:\windows\SysWOW64\FXENNGF.exe FUAJH.exe File created C:\windows\SysWOW64\AYV.exe.bat VYNGH.exe File created C:\windows\SysWOW64\EDQ.exe UGC.exe File created C:\windows\SysWOW64\HJHYLFU.exe PGD.exe File opened for modification C:\windows\SysWOW64\HJHYLFU.exe PGD.exe File opened for modification C:\windows\SysWOW64\XNVMKUH.exe XHUYJPE.exe File created C:\windows\SysWOW64\ACY.exe BNNM.exe File created C:\windows\SysWOW64\IXETF.exe QPCOUNK.exe File opened for modification C:\windows\SysWOW64\OGCR.exe NDYNZ.exe File created C:\windows\SysWOW64\FXENNGF.exe.bat FUAJH.exe File opened for modification C:\windows\SysWOW64\XQVRV.exe NITM.exe File created C:\windows\SysWOW64\MKTUWQ.exe UHQQQBA.exe File opened for modification C:\windows\SysWOW64\KZG.exe ABSG.exe File created C:\windows\SysWOW64\IXETF.exe.bat QPCOUNK.exe File created C:\windows\SysWOW64\AAHXLBO.exe IXETF.exe File opened for modification C:\windows\SysWOW64\EJVFKA.exe QGNGWP.exe File opened for modification C:\windows\SysWOW64\IFKBV.exe PCH.exe File created C:\windows\SysWOW64\IKI.exe CKBCHV.exe File opened for modification C:\windows\SysWOW64\HMHT.exe EHI.exe File opened for modification C:\windows\SysWOW64\MKTUWQ.exe UHQQQBA.exe File created C:\windows\SysWOW64\MKTUWQ.exe.bat UHQQQBA.exe File created C:\windows\SysWOW64\XLVTEAV.exe.bat DYQCT.exe File opened for modification C:\windows\SysWOW64\RKYR.exe BHPFEZU.exe File created C:\windows\SysWOW64\HMHT.exe EHI.exe File opened for modification C:\windows\SysWOW64\EDQ.exe UGC.exe File created C:\windows\SysWOW64\YOTOXY.exe CROR.exe File created C:\windows\SysWOW64\EMDKN.exe KZG.exe File created C:\windows\SysWOW64\OGCR.exe NDYNZ.exe File opened for modification C:\windows\SysWOW64\YSPA.exe ESZ.exe File created C:\windows\SysWOW64\IFKBV.exe PCH.exe File created C:\windows\SysWOW64\VYNGH.exe.bat DYLA.exe File created C:\windows\SysWOW64\MIEZW.exe XNVMKUH.exe File created C:\windows\SysWOW64\YOTOXY.exe.bat CROR.exe File created C:\windows\SysWOW64\JHWZFGC.exe YOTOXY.exe File opened for modification C:\windows\SysWOW64\AAHXLBO.exe IXETF.exe File opened for modification C:\windows\SysWOW64\AKKVU.exe IKI.exe File created C:\windows\SysWOW64\TXIVN.exe NXIIEQA.exe File created C:\windows\SysWOW64\CROR.exe WQGEZNJ.exe File created C:\windows\SysWOW64\CROR.exe.bat WQGEZNJ.exe File opened for modification C:\windows\SysWOW64\YOTOXY.exe CROR.exe File created C:\windows\SysWOW64\JHWZFGC.exe.bat YOTOXY.exe File opened for modification C:\windows\SysWOW64\EMDKN.exe KZG.exe File opened for modification C:\windows\SysWOW64\ACY.exe BNNM.exe File created C:\windows\SysWOW64\YNJXNHW.exe ACY.exe File created C:\windows\SysWOW64\KZG.exe ABSG.exe File opened for modification C:\windows\SysWOW64\TXIVN.exe NXIIEQA.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\CKAD.exe JHWZFGC.exe File created C:\windows\BNNM.exe EMDKN.exe File created C:\windows\system\HUKWU.exe.bat ZOXPJ.exe File opened for modification C:\windows\system\DYLA.exe FXENNGF.exe File created C:\windows\EVHRV.exe LDSGD.exe File opened for modification C:\windows\ZRMAFWE.exe EVHRV.exe File opened for modification C:\windows\HZR.exe MLMDDO.exe File created C:\windows\HVLHC.exe TSCIO.exe File created C:\windows\DMTP.exe UDRKCFN.exe File created C:\windows\system\QGNGWP.exe LGFSNV.exe File opened for modification C:\windows\ZOXPJ.exe TTYO.exe File created C:\windows\system\DLDH.exe.bat XLVTEAV.exe File created C:\windows\CKAD.exe JHWZFGC.exe File created C:\windows\system\PCXZ.exe.bat XHTVICE.exe File created C:\windows\system\NCYR.exe JUSJOJQ.exe File opened for modification C:\windows\system\NCYR.exe JUSJOJQ.exe File created C:\windows\system\LZLPVE.exe NOIZMQJ.exe File created C:\windows\TEEUL.exe UOSSQFQ.exe File created C:\windows\UHQQQBA.exe TEEUL.exe File created C:\windows\system\XHUYJPE.exe.bat LROY.exe File created C:\windows\CKAD.exe.bat JHWZFGC.exe File created C:\windows\system\QLBJDVK.exe.bat SXBIYS.exe File created C:\windows\system\YGT.exe SFUJL.exe File created C:\windows\system\OHNAE.exe.bat ZRMAFWE.exe File created C:\windows\system\GIBTPEM.exe EKVZHWD.exe File created C:\windows\system\CDPF.exe YNJXNHW.exe File opened for modification C:\windows\system\PCXZ.exe XHTVICE.exe File created C:\windows\NXIIEQA.exe JHUIR.exe File opened for modification C:\windows\system\KLRHPWX.exe HVLHC.exe File created C:\windows\system\CDPF.exe.bat YNJXNHW.exe File created C:\windows\system\UDRKCFN.exe CDPF.exe File opened for modification C:\windows\system\XOEWI.exe OGCR.exe File created C:\windows\system\YGT.exe.bat SFUJL.exe File created C:\windows\system\TTYO.exe YGT.exe File created C:\windows\BLAAOZ.exe.bat UVRB.exe File created C:\windows\system\WQGEZNJ.exe MIEZW.exe File created C:\windows\system\SXBIYS.exe.bat PCXZ.exe File created C:\windows\CZYYB.exe ULYK.exe File created C:\windows\system\WOJRCC.exe.bat BLAAOZ.exe File created C:\windows\system\FUAJH.exe VXUXAH.exe File opened for modification C:\windows\EHI.exe 2026-07-19_605ccee3afc8ff602aa0224a0f45e6e5_elex_emotet_stop.exe File created C:\windows\system\UGC.exe.bat KXACWMJ.exe File opened for modification C:\windows\system\DAOEE.exe MSUZAIL.exe File created C:\windows\CZYYB.exe.bat ULYK.exe File created C:\windows\system\PCH.exe.bat CZYYB.exe File opened for modification C:\windows\system\OHNAE.exe ZRMAFWE.exe File created C:\windows\system\GIBTPEM.exe.bat EKVZHWD.exe File created C:\windows\HZR.exe.bat MLMDDO.exe File created C:\windows\system\JWXHD.exe.bat HZR.exe File opened for modification C:\windows\LROY.exe HJHYLFU.exe File created C:\windows\XHTVICE.exe TRM.exe File created C:\windows\system\QLBJDVK.exe SXBIYS.exe File created C:\windows\system\HUKWU.exe ZOXPJ.exe File created C:\windows\system\EOBBD.exe AYV.exe File created C:\windows\system\UOSSQFQ.exe EDQ.exe File created C:\windows\system\DOABXID.exe.bat YNTNOFC.exe File created C:\windows\system\WQGEZNJ.exe.bat MIEZW.exe File created C:\windows\system\TRM.exe.bat XOEWI.exe File created C:\windows\system\EOBBD.exe.bat AYV.exe File created C:\windows\ZRMAFWE.exe EVHRV.exe File created C:\windows\AFZM.exe JWXHD.exe File created C:\windows\DYQCT.exe.bat ZQC.exe File created C:\windows\LROY.exe.bat HJHYLFU.exe File opened for modification C:\windows\TSCIO.exe CKAD.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4180 cmd.exe 2264 cmd.exe 4348 cmd.exe 4792 cmd.exe 464 cmd.exe 5320 cmd.exe 668 cmd.exe 4200 cmd.exe 2120 cmd.exe 5704 cmd.exe 2732 cmd.exe 5312 cmd.exe 1600 cmd.exe 5136 cmd.exe 4972 cmd.exe 5932 cmd.exe 3044 cmd.exe 3260 cmd.exe 3868 cmd.exe 5852 cmd.exe 248 cmd.exe 968 cmd.exe 5808 cmd.exe 1004 cmd.exe 2392 cmd.exe 1260 cmd.exe 1116 cmd.exe 5820 cmd.exe 5352 cmd.exe 1472 cmd.exe 3448 cmd.exe 5336 cmd.exe 3412 cmd.exe 5060 cmd.exe 4652 cmd.exe 4752 cmd.exe 2148 cmd.exe 2456 cmd.exe 5340 cmd.exe 5260 cmd.exe 2868 cmd.exe 5592 cmd.exe 1504 cmd.exe 5252 cmd.exe 2376 cmd.exe 4484 cmd.exe 1684 cmd.exe 5792 cmd.exe 1856 cmd.exe 4856 cmd.exe 5012 cmd.exe 5784 cmd.exe 4904 cmd.exe 4352 cmd.exe 5724 cmd.exe 5732 cmd.exe 5296 cmd.exe 5728 cmd.exe 2124 cmd.exe 2808 cmd.exe 3368 cmd.exe 4412 cmd.exe 3612 cmd.exe 2788 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 4720 476 WerFault.exe 88 2924 4324 WerFault.exe 94 1260 5924 WerFault.exe 100 4524 700 WerFault.exe 105 4736 1196 WerFault.exe 110 5240 2472 WerFault.exe 115 2100 2024 WerFault.exe 120 3420 3984 WerFault.exe 125 2392 5800 WerFault.exe 130 4168 3268 WerFault.exe 135 2180 4924 WerFault.exe 140 5080 1516 WerFault.exe 145 768 1680 WerFault.exe 150 4548 5488 WerFault.exe 155 4736 3880 WerFault.exe 160 3436 5816 WerFault.exe 165 2100 2260 WerFault.exe 170 1604 3116 WerFault.exe 175 5912 4880 WerFault.exe 180 6024 2712 WerFault.exe 185 5348 3068 WerFault.exe 190 4568 3952 WerFault.exe 195 1688 1052 WerFault.exe 200 3464 1956 WerFault.exe 205 4856 776 WerFault.exe 210 2476 2064 WerFault.exe 215 4936 5420 WerFault.exe 220 2528 1764 WerFault.exe 225 5580 5752 WerFault.exe 230 4756 2884 WerFault.exe 235 2464 5996 WerFault.exe 240 4440 3828 WerFault.exe 245 3044 5032 WerFault.exe 250 3696 4952 WerFault.exe 255 3424 3468 WerFault.exe 259 4528 2460 WerFault.exe 265 2808 3476 WerFault.exe 270 3836 5132 WerFault.exe 275 4460 2072 WerFault.exe 281 1424 4364 WerFault.exe 286 2576 5720 WerFault.exe 291 1892 4948 WerFault.exe 296 4524 5764 WerFault.exe 301 2496 3352 WerFault.exe 306 2056 5424 WerFault.exe 311 5788 5464 WerFault.exe 316 4676 2588 WerFault.exe 321 5580 3084 WerFault.exe 326 4116 3312 WerFault.exe 331 1788 2284 WerFault.exe 336 2780 5940 WerFault.exe 341 4548 3780 WerFault.exe 346 4860 2312 WerFault.exe 351 2424 4388 WerFault.exe 356 612 1720 WerFault.exe 361 5252 2140 WerFault.exe 366 4732 1564 WerFault.exe 371 2704 4844 WerFault.exe 376 4128 3632 WerFault.exe 381 5008 1264 WerFault.exe 386 2580 3292 WerFault.exe 391 2716 2160 WerFault.exe 396 4288 5884 WerFault.exe 401 5060 1032 WerFault.exe 406 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EKVZHWD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSUZAIL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DYLA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CKBCHV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LZLPVE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VRXKOXX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YSPA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CUQT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DAOEE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PCH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WQGEZNJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CKAD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XOEWI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NOIZMQJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ACY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IXETF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TTYO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BLAAOZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TEEUL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZQC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAHXLBO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TRM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UGC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TXIVN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TSCIO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YGT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YOTOXY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OGCR.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 476 2026-07-19_605ccee3afc8ff602aa0224a0f45e6e5_elex_emotet_stop.exe 476 2026-07-19_605ccee3afc8ff602aa0224a0f45e6e5_elex_emotet_stop.exe 4324 EHI.exe 4324 EHI.exe 5924 HMHT.exe 5924 HMHT.exe 700 NITM.exe 700 NITM.exe 1196 XQVRV.exe 1196 XQVRV.exe 2472 MLE.exe 2472 MLE.exe 2024 NOIZMQJ.exe 2024 NOIZMQJ.exe 3984 LZLPVE.exe 3984 LZLPVE.exe 5800 EUP.exe 5800 EUP.exe 3268 ZPTCK.exe 3268 ZPTCK.exe 4924 KXACWMJ.exe 4924 KXACWMJ.exe 1516 UGC.exe 1516 UGC.exe 1680 EDQ.exe 1680 EDQ.exe 5488 UOSSQFQ.exe 5488 UOSSQFQ.exe 3880 TEEUL.exe 3880 TEEUL.exe 5816 UHQQQBA.exe 5816 UHQQQBA.exe 2260 MKTUWQ.exe 2260 MKTUWQ.exe 3116 EKVZHWD.exe 3116 EKVZHWD.exe 4880 GIBTPEM.exe 4880 GIBTPEM.exe 2712 XQD.exe 2712 XQD.exe 3068 MLMDDO.exe 3068 MLMDDO.exe 3952 HZR.exe 3952 HZR.exe 1052 JWXHD.exe 1052 JWXHD.exe 1956 AFZM.exe 1956 AFZM.exe 776 ZQC.exe 776 ZQC.exe 2064 DYQCT.exe 2064 DYQCT.exe 5420 XLVTEAV.exe 5420 XLVTEAV.exe 1764 DLDH.exe 1764 DLDH.exe 5752 JHUIR.exe 5752 JHUIR.exe 2884 NXIIEQA.exe 2884 NXIIEQA.exe 5996 TXIVN.exe 5996 TXIVN.exe 3828 MSUZAIL.exe 3828 MSUZAIL.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 476 2026-07-19_605ccee3afc8ff602aa0224a0f45e6e5_elex_emotet_stop.exe 476 2026-07-19_605ccee3afc8ff602aa0224a0f45e6e5_elex_emotet_stop.exe 4324 EHI.exe 4324 EHI.exe 5924 HMHT.exe 5924 HMHT.exe 700 NITM.exe 700 NITM.exe 1196 XQVRV.exe 1196 XQVRV.exe 2472 MLE.exe 2472 MLE.exe 2024 NOIZMQJ.exe 2024 NOIZMQJ.exe 3984 LZLPVE.exe 3984 LZLPVE.exe 5800 EUP.exe 5800 EUP.exe 3268 ZPTCK.exe 3268 ZPTCK.exe 4924 KXACWMJ.exe 4924 KXACWMJ.exe 1516 UGC.exe 1516 UGC.exe 1680 EDQ.exe 1680 EDQ.exe 5488 UOSSQFQ.exe 5488 UOSSQFQ.exe 3880 TEEUL.exe 3880 TEEUL.exe 5816 UHQQQBA.exe 5816 UHQQQBA.exe 2260 MKTUWQ.exe 2260 MKTUWQ.exe 3116 EKVZHWD.exe 3116 EKVZHWD.exe 4880 GIBTPEM.exe 4880 GIBTPEM.exe 2712 XQD.exe 2712 XQD.exe 3068 MLMDDO.exe 3068 MLMDDO.exe 3952 HZR.exe 3952 HZR.exe 1052 JWXHD.exe 1052 JWXHD.exe 1956 AFZM.exe 1956 AFZM.exe 776 ZQC.exe 776 ZQC.exe 2064 DYQCT.exe 2064 DYQCT.exe 5420 XLVTEAV.exe 5420 XLVTEAV.exe 1764 DLDH.exe 1764 DLDH.exe 5752 JHUIR.exe 5752 JHUIR.exe 2884 NXIIEQA.exe 2884 NXIIEQA.exe 5996 TXIVN.exe 5996 TXIVN.exe 3828 MSUZAIL.exe 3828 MSUZAIL.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 476 wrote to memory of 2032 476 2026-07-19_605ccee3afc8ff602aa0224a0f45e6e5_elex_emotet_stop.exe 90 PID 2032 wrote to memory of 4324 2032 cmd.exe 94 PID 4324 wrote to memory of 2376 4324 EHI.exe 96 PID 2376 wrote to memory of 5924 2376 cmd.exe 100 PID 5924 wrote to memory of 1352 5924 HMHT.exe 101 PID 1352 wrote to memory of 700 1352 cmd.exe 105 PID 700 wrote to memory of 5148 700 NITM.exe 106 PID 5148 wrote to memory of 1196 5148 cmd.exe 110 PID 1196 wrote to memory of 2976 1196 XQVRV.exe 111 PID 2976 wrote to memory of 2472 2976 cmd.exe 115 PID 2472 wrote to memory of 3868 2472 MLE.exe 116 PID 3868 wrote to memory of 2024 3868 cmd.exe 120 PID 2024 wrote to memory of 3612 2024 NOIZMQJ.exe 121 PID 3612 wrote to memory of 3984 3612 cmd.exe 125 PID 3984 wrote to memory of 3208 3984 LZLPVE.exe 126 PID 3208 wrote to memory of 5800 3208 cmd.exe 130 PID 5800 wrote to memory of 5404 5800 EUP.exe 131 PID 5404 wrote to memory of 3268 5404 cmd.exe 135 PID 3268 wrote to memory of 6028 3268 ZPTCK.exe 136 PID 6028 wrote to memory of 4924 6028 cmd.exe 140 PID 4924 wrote to memory of 3980 4924 KXACWMJ.exe 141 PID 3980 wrote to memory of 1516 3980 cmd.exe 145 PID 1516 wrote to memory of 2296 1516 UGC.exe 146 PID 2296 wrote to memory of 1680 2296 cmd.exe 150 PID 1680 wrote to memory of 2856 1680 EDQ.exe 151 PID 2856 wrote to memory of 5488 2856 cmd.exe 155 PID 5488 wrote to memory of 3832 5488 UOSSQFQ.exe 156 PID 3832 wrote to memory of 3880 3832 cmd.exe 160 PID 3880 wrote to memory of 4960 3880 TEEUL.exe 161 PID 4960 wrote to memory of 5816 4960 cmd.exe 165 PID 5816 wrote to memory of 4484 5816 UHQQQBA.exe 166 PID 4484 wrote to memory of 2260 4484 cmd.exe 170 PID 2260 wrote to memory of 2120 2260 MKTUWQ.exe 171 PID 2120 wrote to memory of 3116 2120 cmd.exe 175 PID 3116 wrote to memory of 2788 3116 EKVZHWD.exe 176 PID 2788 wrote to memory of 4880 2788 cmd.exe 180 PID 4880 wrote to memory of 4492 4880 GIBTPEM.exe 181 PID 4492 wrote to memory of 2712 4492 cmd.exe 185 PID 2712 wrote to memory of 1228 2712 XQD.exe 186 PID 1228 wrote to memory of 3068 1228 cmd.exe 190 PID 3068 wrote to memory of 2664 3068 MLMDDO.exe 191 PID 2664 wrote to memory of 3952 2664 cmd.exe 195 PID 3952 wrote to memory of 4400 3952 HZR.exe 196 PID 4400 wrote to memory of 1052 4400 cmd.exe 200 PID 1052 wrote to memory of 4904 1052 JWXHD.exe 201 PID 4904 wrote to memory of 1956 4904 cmd.exe 205 PID 1956 wrote to memory of 2004 1956 AFZM.exe 206 PID 2004 wrote to memory of 776 2004 cmd.exe 210 PID 776 wrote to memory of 4224 776 ZQC.exe 211 PID 4224 wrote to memory of 2064 4224 cmd.exe 215 PID 2064 wrote to memory of 1452 2064 DYQCT.exe 216 PID 1452 wrote to memory of 5420 1452 cmd.exe 220 PID 5420 wrote to memory of 716 5420 XLVTEAV.exe 221 PID 716 wrote to memory of 1764 716 cmd.exe 225 PID 1764 wrote to memory of 5732 1764 DLDH.exe 226 PID 5732 wrote to memory of 5752 5732 cmd.exe 230 PID 5752 wrote to memory of 5512 5752 JHUIR.exe 231 PID 5512 wrote to memory of 2884 5512 cmd.exe 235 PID 2884 wrote to memory of 3128 2884 NXIIEQA.exe 236 PID 3128 wrote to memory of 5996 3128 cmd.exe 240 PID 5996 wrote to memory of 696 5996 TXIVN.exe 241 PID 696 wrote to memory of 3828 696 cmd.exe 245 PID 3828 wrote to memory of 5704 3828 MSUZAIL.exe 246 PID 5704 wrote to memory of 5032 5704 cmd.exe 250
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-19_605ccee3afc8ff602aa0224a0f45e6e5_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-19_605ccee3afc8ff602aa0224a0f45e6e5_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EHI.exe.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\windows\EHI.exeC:\windows\EHI.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HMHT.exe.bat" "4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\windows\SysWOW64\HMHT.exeC:\windows\system32\HMHT.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NITM.exe.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\windows\system\NITM.exeC:\windows\system\NITM.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XQVRV.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:5148 -
C:\windows\SysWOW64\XQVRV.exeC:\windows\system32\XQVRV.exe9⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MLE.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\windows\system\MLE.exeC:\windows\system\MLE.exe11⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NOIZMQJ.exe.bat" "12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3868 -
C:\windows\SysWOW64\NOIZMQJ.exeC:\windows\system32\NOIZMQJ.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LZLPVE.exe.bat" "14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\windows\system\LZLPVE.exeC:\windows\system\LZLPVE.exe15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EUP.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:3208 -
C:\windows\system\EUP.exeC:\windows\system\EUP.exe17⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZPTCK.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:5404 -
C:\windows\ZPTCK.exeC:\windows\ZPTCK.exe19⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KXACWMJ.exe.bat" "20⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6028 -
C:\windows\system\KXACWMJ.exeC:\windows\system\KXACWMJ.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UGC.exe.bat" "22⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\windows\system\UGC.exeC:\windows\system\UGC.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EDQ.exe.bat" "24⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\windows\SysWOW64\EDQ.exeC:\windows\system32\EDQ.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UOSSQFQ.exe.bat" "26⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\windows\system\UOSSQFQ.exeC:\windows\system\UOSSQFQ.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TEEUL.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:3832 -
C:\windows\TEEUL.exeC:\windows\TEEUL.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UHQQQBA.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\windows\UHQQQBA.exeC:\windows\UHQQQBA.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MKTUWQ.exe.bat" "32⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\windows\SysWOW64\MKTUWQ.exeC:\windows\system32\MKTUWQ.exe33⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EKVZHWD.exe.bat" "34⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\windows\EKVZHWD.exeC:\windows\EKVZHWD.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GIBTPEM.exe.bat" "36⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\windows\system\GIBTPEM.exeC:\windows\system\GIBTPEM.exe37⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XQD.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\windows\system\XQD.exeC:\windows\system\XQD.exe39⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MLMDDO.exe.bat" "40⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\windows\SysWOW64\MLMDDO.exeC:\windows\system32\MLMDDO.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HZR.exe.bat" "42⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\windows\HZR.exeC:\windows\HZR.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JWXHD.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\windows\system\JWXHD.exeC:\windows\system\JWXHD.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AFZM.exe.bat" "46⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\windows\AFZM.exeC:\windows\AFZM.exe47⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZQC.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\windows\ZQC.exeC:\windows\ZQC.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DYQCT.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\windows\DYQCT.exeC:\windows\DYQCT.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XLVTEAV.exe.bat" "52⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\windows\SysWOW64\XLVTEAV.exeC:\windows\system32\XLVTEAV.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DLDH.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:716 -
C:\windows\system\DLDH.exeC:\windows\system\DLDH.exe55⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JHUIR.exe.bat" "56⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5732 -
C:\windows\system\JHUIR.exeC:\windows\system\JHUIR.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NXIIEQA.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:5512 -
C:\windows\NXIIEQA.exeC:\windows\NXIIEQA.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TXIVN.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\windows\SysWOW64\TXIVN.exeC:\windows\system32\TXIVN.exe61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MSUZAIL.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:696 -
C:\windows\SysWOW64\MSUZAIL.exeC:\windows\system32\MSUZAIL.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DAOEE.exe.bat" "64⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5704 -
C:\windows\system\DAOEE.exeC:\windows\system\DAOEE.exe65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5032 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YNTNOFC.exe.bat" "66⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1684 -
C:\windows\YNTNOFC.exeC:\windows\YNTNOFC.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DOABXID.exe.bat" "68⤵PID:1136
-
C:\windows\system\DOABXID.exeC:\windows\system\DOABXID.exe69⤵
- Executes dropped EXE
PID:3468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PGD.exe.bat" "70⤵PID:2544
-
C:\windows\system\PGD.exeC:\windows\system\PGD.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HJHYLFU.exe.bat" "72⤵
- Executes a command shell one-liner
PID:2456 -
C:\windows\SysWOW64\HJHYLFU.exeC:\windows\system32\HJHYLFU.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LROY.exe.bat" "74⤵
- System Location Discovery: System Language Discovery
PID:1572 -
C:\windows\LROY.exeC:\windows\LROY.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XHUYJPE.exe.bat" "76⤵
- System Location Discovery: System Language Discovery
PID:4572 -
C:\windows\system\XHUYJPE.exeC:\windows\system\XHUYJPE.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2072 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XNVMKUH.exe.bat" "78⤵PID:4556
-
C:\windows\SysWOW64\XNVMKUH.exeC:\windows\system32\XNVMKUH.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MIEZW.exe.bat" "80⤵
- Executes a command shell one-liner
PID:1004 -
C:\windows\SysWOW64\MIEZW.exeC:\windows\system32\MIEZW.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WQGEZNJ.exe.bat" "82⤵
- System Location Discovery: System Language Discovery
PID:1836 -
C:\windows\system\WQGEZNJ.exeC:\windows\system\WQGEZNJ.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CROR.exe.bat" "84⤵
- System Location Discovery: System Language Discovery
PID:1508 -
C:\windows\SysWOW64\CROR.exeC:\windows\system32\CROR.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YOTOXY.exe.bat" "86⤵PID:940
-
C:\windows\SysWOW64\YOTOXY.exeC:\windows\system32\YOTOXY.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JHWZFGC.exe.bat" "88⤵
- Executes a command shell one-liner
PID:5336 -
C:\windows\SysWOW64\JHWZFGC.exeC:\windows\system32\JHWZFGC.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CKAD.exe.bat" "90⤵
- System Location Discovery: System Language Discovery
PID:6064 -
C:\windows\CKAD.exeC:\windows\CKAD.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TSCIO.exe.bat" "92⤵
- Executes a command shell one-liner
PID:5792 -
C:\windows\TSCIO.exeC:\windows\TSCIO.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2588 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HVLHC.exe.bat" "94⤵PID:3420
-
C:\windows\HVLHC.exeC:\windows\HVLHC.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KLRHPWX.exe.bat" "96⤵
- System Location Discovery: System Language Discovery
PID:5476 -
C:\windows\system\KLRHPWX.exeC:\windows\system\KLRHPWX.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ABSG.exe.bat" "98⤵
- System Location Discovery: System Language Discovery
PID:5912 -
C:\windows\SysWOW64\ABSG.exeC:\windows\system32\ABSG.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KZG.exe.bat" "100⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5296 -
C:\windows\SysWOW64\KZG.exeC:\windows\system32\KZG.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EMDKN.exe.bat" "102⤵PID:3388
-
C:\windows\SysWOW64\EMDKN.exeC:\windows\system32\EMDKN.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BNNM.exe.bat" "104⤵
- Executes a command shell one-liner
PID:5728 -
C:\windows\BNNM.exeC:\windows\BNNM.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ACY.exe.bat" "106⤵
- System Location Discovery: System Language Discovery
PID:4176 -
C:\windows\SysWOW64\ACY.exeC:\windows\system32\ACY.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4388 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YNJXNHW.exe.bat" "108⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2732 -
C:\windows\SysWOW64\YNJXNHW.exeC:\windows\system32\YNJXNHW.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CDPF.exe.bat" "110⤵
- System Location Discovery: System Language Discovery
PID:2108 -
C:\windows\system\CDPF.exeC:\windows\system\CDPF.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UDRKCFN.exe.bat" "112⤵PID:4632
-
C:\windows\system\UDRKCFN.exeC:\windows\system\UDRKCFN.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DMTP.exe.bat" "114⤵PID:2516
-
C:\windows\DMTP.exeC:\windows\DMTP.exe115⤵
- Executes dropped EXE
PID:4844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QPCOUNK.exe.bat" "116⤵
- System Location Discovery: System Language Discovery
PID:4600 -
C:\windows\SysWOW64\QPCOUNK.exeC:\windows\system32\QPCOUNK.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3632 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IXETF.exe.bat" "118⤵PID:1788
-
C:\windows\SysWOW64\IXETF.exeC:\windows\system32\IXETF.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AAHXLBO.exe.bat" "120⤵PID:4216
-
C:\windows\SysWOW64\AAHXLBO.exeC:\windows\system32\AAHXLBO.exe121⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3292
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-