Analysis
- max time kernel
148s - max time network
133s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
19/07/2026, 19:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-19_770396b266dd1169be39cf89b6d0eeb2_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-07-19_770396b266dd1169be39cf89b6d0eeb2_elex_emotet_stop.exe
- Size 208KB
- Sample260719-xt65pacv7s
- SHA256 3a77bc671bb3781a8152273e6cb3c60ca27ff1e36bcb5bb43aa21ac5556459cc
- MD5 770396b266dd1169be39cf89b6d0eeb2
- SHA1 ca51057b434a344ea4a0c21f3ff398a24c65aac3
- SHA512 6febf4b804139b377267765f8093b891b70e5526502d556d1593f80feef61d731ff36131c193fb656596f705ea30414f214ab1b9133dc06f032dd0797cdd06bb
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbclcdL+LOfn4NLthEjQT6j:MlZtbLWIgd1LZ9oECZbclc5+LOvQEj1
- TLSH T1E3247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1920 CZE.exe 2544 ZXRMR.exe 5552 JIBMEOL.exe 3088 PIIIN.exe 2180 NEIIR.exe 2492 ERS.exe 2836 ZEPKR.exe 4540 USUTUPT.exe 5764 KCSRTCP.exe 3424 ZFBVM.exe 1568 HLCKO.exe 6024 XGL.exe 5512 GONTK.exe 2344 KWUBOMR.exe 4552 LZYX.exe 1764 FNCGEC.exe 3480 AAH.exe 552 EQOYBUS.exe 2392 OOTS.exe 5968 KGDUU.exe 2488 QHLIDB.exe 692 ENLU.exe 2440 ASDJV.exe 2800 BNHFIXY.exe 5028 XTN.exe 5324 SGRLA.exe 2520 NBOVCHE.exe 5804 NHO.exe 3124 NKSNR.exe 2760 TKABAMJ.exe 4312 XSHB.exe 1444 ZQIDS.exe 4984 FQPRBNP.exe 4888 QJK.exe 2648 AJMON.exe 3568 DZTOZSU.exe 3300 YNYG.exe 4128 TADPMS.exe 2672 IVMU.exe 3396 CQRDH.exe 5016 UQTILKX.exe 5264 JHUIR.exe 3528 YCL.exe 3092 HUOSCU.exe 2084 KQT.exe 4488 ZNZ.exe 4680 QWBE.exe 3924 WWISFD.exe 5756 OZMVL.exe 1200 OEEKUG.exe 3888 JSJ.exe 1424 YNAYQT.exe 3008 QVUDTYB.exe 4756 VVCQ.exe 5112 VBCFE.exe 4288 QOHOOFU.exe 4296 WPPC.exe 4428 RCTTHH.exe 2424 WCBHQB.exe 5304 WQTOAOO.exe 2384 EACP.exe 4572 TGIM.exe 3584 ZBHNRF.exe 5700 TOM.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\UDFCDZR.exe IVYUR.exe File created C:\windows\SysWOW64\XSHB.exe TKABAMJ.exe File opened for modification C:\windows\SysWOW64\VVCQ.exe QVUDTYB.exe File created C:\windows\SysWOW64\FPBYCB.exe.bat QUK.exe File created C:\windows\SysWOW64\ACY.exe FPBYCB.exe File created C:\windows\SysWOW64\IVYUR.exe UPS.exe File created C:\windows\SysWOW64\QUK.exe TOM.exe File opened for modification C:\windows\SysWOW64\USUTUPT.exe ZEPKR.exe File created C:\windows\SysWOW64\GONTK.exe.bat XGL.exe File created C:\windows\SysWOW64\NBOVCHE.exe.bat SGRLA.exe File created C:\windows\SysWOW64\ZNZ.exe.bat KQT.exe File opened for modification C:\windows\SysWOW64\WWISFD.exe QWBE.exe File opened for modification C:\windows\SysWOW64\RCTTHH.exe WPPC.exe File created C:\windows\SysWOW64\ACY.exe.bat FPBYCB.exe File created C:\windows\SysWOW64\USUTUPT.exe.bat ZEPKR.exe File opened for modification C:\windows\SysWOW64\AAH.exe FNCGEC.exe File opened for modification C:\windows\SysWOW64\OZMVL.exe WWISFD.exe File created C:\windows\SysWOW64\QVUDTYB.exe YNAYQT.exe File created C:\windows\SysWOW64\IJL.exe GWGYYV.exe File created C:\windows\SysWOW64\IVYUR.exe.bat UPS.exe File created C:\windows\SysWOW64\BYDNCPW.exe.bat QFAUBI.exe File opened for modification C:\windows\SysWOW64\NBOVCHE.exe SGRLA.exe File created C:\windows\SysWOW64\TKABAMJ.exe.bat NKSNR.exe File created C:\windows\SysWOW64\ZNZ.exe KQT.exe File opened for modification C:\windows\SysWOW64\ACY.exe FPBYCB.exe File created C:\windows\SysWOW64\IJL.exe.bat GWGYYV.exe File created C:\windows\SysWOW64\BYDNCPW.exe QFAUBI.exe File opened for modification C:\windows\SysWOW64\BYDNCPW.exe QFAUBI.exe File created C:\windows\SysWOW64\OOTS.exe EQOYBUS.exe File opened for modification C:\windows\SysWOW64\TKABAMJ.exe NKSNR.exe File opened for modification C:\windows\SysWOW64\AJMON.exe QJK.exe File created C:\windows\SysWOW64\WWISFD.exe QWBE.exe File opened for modification C:\windows\SysWOW64\XSHB.exe TKABAMJ.exe File created C:\windows\SysWOW64\AJMON.exe QJK.exe File created C:\windows\SysWOW64\RCTTHH.exe.bat WPPC.exe File opened for modification C:\windows\SysWOW64\QUK.exe TOM.exe File opened for modification C:\windows\SysWOW64\FPBYCB.exe QUK.exe File opened for modification C:\windows\SysWOW64\IJL.exe GWGYYV.exe File opened for modification C:\windows\SysWOW64\UDFCDZR.exe IVYUR.exe File created C:\windows\SysWOW64\OOTS.exe.bat EQOYBUS.exe File created C:\windows\SysWOW64\IVMU.exe.bat TADPMS.exe File opened for modification C:\windows\SysWOW64\QVUDTYB.exe YNAYQT.exe File created C:\windows\SysWOW64\AAH.exe.bat FNCGEC.exe File created C:\windows\SysWOW64\NBOVCHE.exe SGRLA.exe File opened for modification C:\windows\SysWOW64\NKSNR.exe NHO.exe File created C:\windows\SysWOW64\TKABAMJ.exe NKSNR.exe File opened for modification C:\windows\SysWOW64\IVYUR.exe UPS.exe File created C:\windows\SysWOW64\ZEPKR.exe ERS.exe File created C:\windows\SysWOW64\GONTK.exe XGL.exe File created C:\windows\SysWOW64\NKSNR.exe NHO.exe File opened for modification C:\windows\SysWOW64\ZEPKR.exe ERS.exe File opened for modification C:\windows\SysWOW64\IVMU.exe TADPMS.exe File created C:\windows\SysWOW64\OZMVL.exe WWISFD.exe File created C:\windows\SysWOW64\QUK.exe.bat TOM.exe File created C:\windows\SysWOW64\USUTUPT.exe ZEPKR.exe File created C:\windows\SysWOW64\IVMU.exe TADPMS.exe File created C:\windows\SysWOW64\QVUDTYB.exe.bat YNAYQT.exe File created C:\windows\SysWOW64\XSHB.exe.bat TKABAMJ.exe File created C:\windows\SysWOW64\AJMON.exe.bat QJK.exe File created C:\windows\SysWOW64\OZMVL.exe.bat WWISFD.exe File created C:\windows\SysWOW64\UDFCDZR.exe.bat IVYUR.exe File created C:\windows\SysWOW64\AAH.exe FNCGEC.exe File created C:\windows\SysWOW64\VVCQ.exe.bat QVUDTYB.exe File opened for modification C:\windows\SysWOW64\WCBHQB.exe RCTTHH.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\OEEKUG.exe.bat OZMVL.exe File created C:\windows\system\ASDJV.exe ENLU.exe File created C:\windows\ROD.exe JIKRKJL.exe File opened for modification C:\windows\ZXRMR.exe CZE.exe File opened for modification C:\windows\system\ERS.exe NEIIR.exe File created C:\windows\KCSRTCP.exe USUTUPT.exe File created C:\windows\KCSRTCP.exe.bat USUTUPT.exe File opened for modification C:\windows\system\KWUBOMR.exe GONTK.exe File created C:\windows\system\VBCFE.exe VVCQ.exe File opened for modification C:\windows\system\XEUUTI.exe IJL.exe File created C:\windows\ZFBVM.exe KCSRTCP.exe File created C:\windows\system\KWUBOMR.exe.bat GONTK.exe File opened for modification C:\windows\NHO.exe NBOVCHE.exe File opened for modification C:\windows\system\YNYG.exe DZTOZSU.exe File created C:\windows\system\QWBE.exe ZNZ.exe File created C:\windows\UPS.exe JXPMBXM.exe File opened for modification C:\windows\JIKRKJL.exe UDFCDZR.exe File created C:\windows\QFAUBI.exe BKR.exe File created C:\windows\ZXRMR.exe.bat CZE.exe File opened for modification C:\windows\JIBMEOL.exe ZXRMR.exe File created C:\windows\KGDUU.exe OOTS.exe File created C:\windows\NHO.exe.bat NBOVCHE.exe File opened for modification C:\windows\system\JSJ.exe OEEKUG.exe File created C:\windows\QFAUBI.exe.bat BKR.exe File opened for modification C:\windows\EQOYBUS.exe AAH.exe File created C:\windows\system\SGRLA.exe.bat XTN.exe File created C:\windows\system\JSJ.exe OEEKUG.exe File opened for modification C:\windows\system\ZBHNRF.exe TGIM.exe File created C:\windows\system\FNCGEC.exe LZYX.exe File created C:\windows\QHLIDB.exe.bat KGDUU.exe File created C:\windows\system\OEEKUG.exe OZMVL.exe File created C:\windows\system\QOHOOFU.exe VBCFE.exe File created C:\windows\BKR.exe BER.exe File opened for modification C:\windows\ENLU.exe QHLIDB.exe File created C:\windows\ZQIDS.exe XSHB.exe File opened for modification C:\windows\CQRDH.exe IVMU.exe File created C:\windows\system\HUOSCU.exe TXIVN.exe File created C:\windows\system\JSJ.exe.bat OEEKUG.exe File created C:\windows\system\EACP.exe.bat WQTOAOO.exe File created C:\windows\system\XEUUTI.exe.bat IJL.exe File created C:\windows\CLQKVR.exe.bat HYLBT.exe File opened for modification C:\windows\system\FNCGEC.exe LZYX.exe File created C:\windows\ENLU.exe.bat QHLIDB.exe File opened for modification C:\windows\system\QJK.exe FQPRBNP.exe File created C:\windows\system\YNYG.exe DZTOZSU.exe File created C:\windows\system\QWBE.exe.bat ZNZ.exe File created C:\windows\ZFBVM.exe.bat KCSRTCP.exe File created C:\windows\system\JHUIR.exe UQTILKX.exe File created C:\windows\JXPMBXM.exe XEUUTI.exe File created C:\windows\system\POKUV.exe.bat ROD.exe File opened for modification C:\windows\system\PIIIN.exe JIBMEOL.exe File created C:\windows\EQOYBUS.exe AAH.exe File created C:\windows\system\YNYG.exe.bat DZTOZSU.exe File opened for modification C:\windows\system\OEEKUG.exe OZMVL.exe File created C:\windows\YNAYQT.exe.bat JSJ.exe File created C:\windows\system\VBCFE.exe.bat VVCQ.exe File opened for modification C:\windows\WQTOAOO.exe WCBHQB.exe File created C:\windows\system\TOM.exe ZBHNRF.exe File created C:\windows\EQOYBUS.exe.bat AAH.exe File opened for modification C:\windows\XTN.exe BNHFIXY.exe File created C:\windows\TADPMS.exe YNYG.exe File created C:\windows\system\QOHOOFU.exe.bat VBCFE.exe File created C:\windows\system\GIGRWJ.exe.bat AIY.exe File opened for modification C:\windows\QFAUBI.exe BKR.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2268 cmd.exe 5400 cmd.exe 5388 cmd.exe 3624 cmd.exe 3108 cmd.exe 2168 cmd.exe 3820 cmd.exe 1244 cmd.exe 4220 cmd.exe 5456 cmd.exe 4684 cmd.exe 968 cmd.exe 1296 cmd.exe 3908 cmd.exe 1480 cmd.exe 4660 cmd.exe 4808 cmd.exe 3852 cmd.exe 4796 cmd.exe 3288 cmd.exe 5100 cmd.exe 4392 cmd.exe 2968 cmd.exe 2788 cmd.exe 1448 cmd.exe 1880 cmd.exe 3312 cmd.exe 4612 cmd.exe 4196 cmd.exe 1680 cmd.exe 3044 cmd.exe 4524 cmd.exe 4216 cmd.exe 4140 cmd.exe 3784 cmd.exe 2784 cmd.exe 1924 cmd.exe 4292 cmd.exe 5784 cmd.exe 4628 cmd.exe 2944 cmd.exe 5572 cmd.exe 3032 cmd.exe 1936 cmd.exe 5548 cmd.exe 5848 cmd.exe 3144 cmd.exe 5468 cmd.exe 5588 cmd.exe 4816 cmd.exe 716 cmd.exe 2708 cmd.exe 1096 cmd.exe 5920 cmd.exe 2864 cmd.exe 4940 cmd.exe 1772 cmd.exe 5240 cmd.exe 4948 cmd.exe 2176 cmd.exe 1972 cmd.exe 3296 cmd.exe 848 cmd.exe 1040 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 2844 3200 WerFault.exe 88 3832 1920 WerFault.exe 92 1232 2544 WerFault.exe 99 2364 5552 WerFault.exe 104 956 3088 WerFault.exe 109 3480 2180 WerFault.exe 114 1816 2492 WerFault.exe 119 5676 2836 WerFault.exe 124 4076 4540 WerFault.exe 129 1200 5764 WerFault.exe 134 1480 3424 WerFault.exe 139 1108 1568 WerFault.exe 144 2012 6024 WerFault.exe 149 1040 5512 WerFault.exe 154 5740 2344 WerFault.exe 159 3220 4552 WerFault.exe 164 932 1764 WerFault.exe 169 4492 3480 WerFault.exe 174 5388 552 WerFault.exe 179 3556 2392 WerFault.exe 184 2980 5968 WerFault.exe 189 2932 2488 WerFault.exe 194 2384 692 WerFault.exe 199 1680 2440 WerFault.exe 204 2476 2800 WerFault.exe 209 3620 5028 WerFault.exe 214 4680 5324 WerFault.exe 219 6080 2520 WerFault.exe 224 4412 5804 WerFault.exe 229 1676 3124 WerFault.exe 234 4308 2760 WerFault.exe 239 1648 4312 WerFault.exe 244 4340 1444 WerFault.exe 249 4776 4984 WerFault.exe 254 2632 4888 WerFault.exe 259 4880 2648 WerFault.exe 264 1992 3568 WerFault.exe 269 3596 3300 WerFault.exe 274 2596 4128 WerFault.exe 279 1988 2672 WerFault.exe 285 2864 3396 WerFault.exe 290 5304 5016 WerFault.exe 295 3600 5264 WerFault.exe 300 696 3528 WerFault.exe 305 5168 4776 WerFault.exe 310 888 3092 WerFault.exe 315 4436 2084 WerFault.exe 320 5928 4488 WerFault.exe 325 936 4680 WerFault.exe 330 4512 3924 WerFault.exe 335 5640 5756 WerFault.exe 340 2448 1200 WerFault.exe 345 2936 3888 WerFault.exe 350 4068 1424 WerFault.exe 355 2208 3008 WerFault.exe 360 3784 4756 WerFault.exe 365 124 5112 WerFault.exe 370 4176 4288 WerFault.exe 375 6036 4296 WerFault.exe 380 5956 4428 WerFault.exe 385 1932 2424 WerFault.exe 390 4876 5304 WerFault.exe 395 4944 2384 WerFault.exe 400 2172 4572 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NHO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JSJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QUK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BYDNCPW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZXRMR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EQOYBUS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TGIM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IJL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NEIIR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZEPKR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HLCKO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XSHB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NKSNR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JIBMEOL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language USUTUPT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FNCGEC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KQT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XGL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QHLIDB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZQIDS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GONTK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QFAUBI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UPS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KCSRTCP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RCTTHH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZBHNRF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KGDUU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XTN.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3200 2026-07-19_770396b266dd1169be39cf89b6d0eeb2_elex_emotet_stop.exe 3200 2026-07-19_770396b266dd1169be39cf89b6d0eeb2_elex_emotet_stop.exe 1920 CZE.exe 1920 CZE.exe 2544 ZXRMR.exe 2544 ZXRMR.exe 5552 JIBMEOL.exe 5552 JIBMEOL.exe 3088 PIIIN.exe 3088 PIIIN.exe 2180 NEIIR.exe 2180 NEIIR.exe 2492 ERS.exe 2492 ERS.exe 2836 ZEPKR.exe 2836 ZEPKR.exe 4540 USUTUPT.exe 4540 USUTUPT.exe 5764 KCSRTCP.exe 5764 KCSRTCP.exe 3424 ZFBVM.exe 3424 ZFBVM.exe 1568 HLCKO.exe 1568 HLCKO.exe 6024 XGL.exe 6024 XGL.exe 5512 GONTK.exe 5512 GONTK.exe 2344 KWUBOMR.exe 2344 KWUBOMR.exe 4552 LZYX.exe 4552 LZYX.exe 1764 FNCGEC.exe 1764 FNCGEC.exe 3480 AAH.exe 3480 AAH.exe 552 EQOYBUS.exe 552 EQOYBUS.exe 2392 OOTS.exe 2392 OOTS.exe 5968 KGDUU.exe 5968 KGDUU.exe 2488 QHLIDB.exe 2488 QHLIDB.exe 692 ENLU.exe 692 ENLU.exe 2440 ASDJV.exe 2440 ASDJV.exe 2800 BNHFIXY.exe 2800 BNHFIXY.exe 5028 XTN.exe 5028 XTN.exe 5324 SGRLA.exe 5324 SGRLA.exe 2520 NBOVCHE.exe 2520 NBOVCHE.exe 5804 NHO.exe 5804 NHO.exe 3124 NKSNR.exe 3124 NKSNR.exe 2760 TKABAMJ.exe 2760 TKABAMJ.exe 4312 XSHB.exe 4312 XSHB.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 3200 2026-07-19_770396b266dd1169be39cf89b6d0eeb2_elex_emotet_stop.exe 3200 2026-07-19_770396b266dd1169be39cf89b6d0eeb2_elex_emotet_stop.exe 1920 CZE.exe 1920 CZE.exe 2544 ZXRMR.exe 2544 ZXRMR.exe 5552 JIBMEOL.exe 5552 JIBMEOL.exe 3088 PIIIN.exe 3088 PIIIN.exe 2180 NEIIR.exe 2180 NEIIR.exe 2492 ERS.exe 2492 ERS.exe 2836 ZEPKR.exe 2836 ZEPKR.exe 4540 USUTUPT.exe 4540 USUTUPT.exe 5764 KCSRTCP.exe 5764 KCSRTCP.exe 3424 ZFBVM.exe 3424 ZFBVM.exe 1568 HLCKO.exe 1568 HLCKO.exe 6024 XGL.exe 6024 XGL.exe 5512 GONTK.exe 5512 GONTK.exe 2344 KWUBOMR.exe 2344 KWUBOMR.exe 4552 LZYX.exe 4552 LZYX.exe 1764 FNCGEC.exe 1764 FNCGEC.exe 3480 AAH.exe 3480 AAH.exe 552 EQOYBUS.exe 552 EQOYBUS.exe 2392 OOTS.exe 2392 OOTS.exe 5968 KGDUU.exe 5968 KGDUU.exe 2488 QHLIDB.exe 2488 QHLIDB.exe 692 ENLU.exe 692 ENLU.exe 2440 ASDJV.exe 2440 ASDJV.exe 2800 BNHFIXY.exe 2800 BNHFIXY.exe 5028 XTN.exe 5028 XTN.exe 5324 SGRLA.exe 5324 SGRLA.exe 2520 NBOVCHE.exe 2520 NBOVCHE.exe 5804 NHO.exe 5804 NHO.exe 3124 NKSNR.exe 3124 NKSNR.exe 2760 TKABAMJ.exe 2760 TKABAMJ.exe 4312 XSHB.exe 4312 XSHB.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3200 wrote to memory of 3108 3200 2026-07-19_770396b266dd1169be39cf89b6d0eeb2_elex_emotet_stop.exe 89 PID 3108 wrote to memory of 1920 3108 cmd.exe 92 PID 1920 wrote to memory of 5100 1920 CZE.exe 95 PID 5100 wrote to memory of 2544 5100 cmd.exe 99 PID 2544 wrote to memory of 2268 2544 ZXRMR.exe 100 PID 2268 wrote to memory of 5552 2268 cmd.exe 104 PID 5552 wrote to memory of 1060 5552 JIBMEOL.exe 105 PID 1060 wrote to memory of 3088 1060 cmd.exe 109 PID 3088 wrote to memory of 2944 3088 PIIIN.exe 110 PID 2944 wrote to memory of 2180 2944 cmd.exe 114 PID 2180 wrote to memory of 5572 2180 NEIIR.exe 115 PID 5572 wrote to memory of 2492 5572 cmd.exe 119 PID 2492 wrote to memory of 4948 2492 ERS.exe 120 PID 4948 wrote to memory of 2836 4948 cmd.exe 124 PID 2836 wrote to memory of 1296 2836 ZEPKR.exe 125 PID 1296 wrote to memory of 4540 1296 cmd.exe 129 PID 4540 wrote to memory of 1956 4540 USUTUPT.exe 130 PID 1956 wrote to memory of 5764 1956 cmd.exe 134 PID 5764 wrote to memory of 4196 5764 KCSRTCP.exe 135 PID 4196 wrote to memory of 3424 4196 cmd.exe 139 PID 3424 wrote to memory of 5900 3424 ZFBVM.exe 140 PID 5900 wrote to memory of 1568 5900 cmd.exe 144 PID 1568 wrote to memory of 4392 1568 HLCKO.exe 145 PID 4392 wrote to memory of 6024 4392 cmd.exe 149 PID 6024 wrote to memory of 1928 6024 XGL.exe 150 PID 1928 wrote to memory of 5512 1928 cmd.exe 154 PID 5512 wrote to memory of 4524 5512 GONTK.exe 155 PID 4524 wrote to memory of 2344 4524 cmd.exe 159 PID 2344 wrote to memory of 2480 2344 KWUBOMR.exe 160 PID 2480 wrote to memory of 4552 2480 cmd.exe 164 PID 4552 wrote to memory of 2176 4552 LZYX.exe 165 PID 2176 wrote to memory of 1764 2176 cmd.exe 169 PID 1764 wrote to memory of 2168 1764 FNCGEC.exe 170 PID 2168 wrote to memory of 3480 2168 cmd.exe 174 PID 3480 wrote to memory of 3820 3480 AAH.exe 175 PID 3820 wrote to memory of 552 3820 cmd.exe 179 PID 552 wrote to memory of 1912 552 EQOYBUS.exe 180 PID 1912 wrote to memory of 2392 1912 cmd.exe 184 PID 2392 wrote to memory of 3864 2392 OOTS.exe 185 PID 3864 wrote to memory of 5968 3864 cmd.exe 189 PID 5968 wrote to memory of 1244 5968 KGDUU.exe 190 PID 1244 wrote to memory of 2488 1244 cmd.exe 194 PID 2488 wrote to memory of 1356 2488 QHLIDB.exe 195 PID 1356 wrote to memory of 692 1356 cmd.exe 199 PID 692 wrote to memory of 1332 692 ENLU.exe 200 PID 1332 wrote to memory of 2440 1332 cmd.exe 204 PID 2440 wrote to memory of 4220 2440 ASDJV.exe 205 PID 4220 wrote to memory of 2800 4220 cmd.exe 209 PID 2800 wrote to memory of 5416 2800 BNHFIXY.exe 210 PID 5416 wrote to memory of 5028 5416 cmd.exe 214 PID 5028 wrote to memory of 4612 5028 XTN.exe 215 PID 4612 wrote to memory of 5324 4612 cmd.exe 219 PID 5324 wrote to memory of 5456 5324 SGRLA.exe 220 PID 5456 wrote to memory of 2520 5456 cmd.exe 224 PID 2520 wrote to memory of 3908 2520 NBOVCHE.exe 225 PID 3908 wrote to memory of 5804 3908 cmd.exe 229 PID 5804 wrote to memory of 4684 5804 NHO.exe 230 PID 4684 wrote to memory of 3124 4684 cmd.exe 234 PID 3124 wrote to memory of 1972 3124 NKSNR.exe 235 PID 1972 wrote to memory of 2760 1972 cmd.exe 239 PID 2760 wrote to memory of 2032 2760 TKABAMJ.exe 240 PID 2032 wrote to memory of 4312 2032 cmd.exe 244 PID 4312 wrote to memory of 1480 4312 XSHB.exe 245 PID 1480 wrote to memory of 1444 1480 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-19_770396b266dd1169be39cf89b6d0eeb2_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-19_770396b266dd1169be39cf89b6d0eeb2_elex_emotet_stop.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CZE.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3108 -
C:\windows\system\CZE.exeC:\windows\system\CZE.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZXRMR.exe.bat" "4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\windows\ZXRMR.exeC:\windows\ZXRMR.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JIBMEOL.exe.bat" "6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\windows\JIBMEOL.exeC:\windows\JIBMEOL.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PIIIN.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\windows\system\PIIIN.exeC:\windows\system\PIIIN.exe9⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NEIIR.exe.bat" "10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\windows\system\NEIIR.exeC:\windows\system\NEIIR.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ERS.exe.bat" "12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5572 -
C:\windows\system\ERS.exeC:\windows\system\ERS.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZEPKR.exe.bat" "14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\windows\SysWOW64\ZEPKR.exeC:\windows\system32\ZEPKR.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\USUTUPT.exe.bat" "16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1296 -
C:\windows\SysWOW64\USUTUPT.exeC:\windows\system32\USUTUPT.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KCSRTCP.exe.bat" "18⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\windows\KCSRTCP.exeC:\windows\KCSRTCP.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZFBVM.exe.bat" "20⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\windows\ZFBVM.exeC:\windows\ZFBVM.exe21⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HLCKO.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:5900 -
C:\windows\system\HLCKO.exeC:\windows\system\HLCKO.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XGL.exe.bat" "24⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\windows\XGL.exeC:\windows\XGL.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6024 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GONTK.exe.bat" "26⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\windows\SysWOW64\GONTK.exeC:\windows\system32\GONTK.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KWUBOMR.exe.bat" "28⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\windows\system\KWUBOMR.exeC:\windows\system\KWUBOMR.exe29⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LZYX.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\windows\LZYX.exeC:\windows\LZYX.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FNCGEC.exe.bat" "32⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\windows\system\FNCGEC.exeC:\windows\system\FNCGEC.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AAH.exe.bat" "34⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\windows\SysWOW64\AAH.exeC:\windows\system32\AAH.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EQOYBUS.exe.bat" "36⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\windows\EQOYBUS.exeC:\windows\EQOYBUS.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OOTS.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\windows\SysWOW64\OOTS.exeC:\windows\system32\OOTS.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KGDUU.exe.bat" "40⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3864 -
C:\windows\KGDUU.exeC:\windows\KGDUU.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QHLIDB.exe.bat" "42⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\windows\QHLIDB.exeC:\windows\QHLIDB.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ENLU.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\windows\ENLU.exeC:\windows\ENLU.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ASDJV.exe.bat" "46⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\windows\system\ASDJV.exeC:\windows\system\ASDJV.exe47⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BNHFIXY.exe.bat" "48⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\windows\BNHFIXY.exeC:\windows\BNHFIXY.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XTN.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:5416 -
C:\windows\XTN.exeC:\windows\XTN.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SGRLA.exe.bat" "52⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\windows\system\SGRLA.exeC:\windows\system\SGRLA.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NBOVCHE.exe.bat" "54⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5456 -
C:\windows\SysWOW64\NBOVCHE.exeC:\windows\system32\NBOVCHE.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NHO.exe.bat" "56⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\windows\NHO.exeC:\windows\NHO.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NKSNR.exe.bat" "58⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\windows\SysWOW64\NKSNR.exeC:\windows\system32\NKSNR.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TKABAMJ.exe.bat" "60⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\windows\SysWOW64\TKABAMJ.exeC:\windows\system32\TKABAMJ.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XSHB.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\windows\SysWOW64\XSHB.exeC:\windows\system32\XSHB.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZQIDS.exe.bat" "64⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\windows\ZQIDS.exeC:\windows\ZQIDS.exe65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FQPRBNP.exe.bat" "66⤵
- Executes a command shell one-liner
PID:3032 -
C:\windows\system\FQPRBNP.exeC:\windows\system\FQPRBNP.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QJK.exe.bat" "68⤵
- Executes a command shell one-liner
PID:5848 -
C:\windows\system\QJK.exeC:\windows\system\QJK.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AJMON.exe.bat" "70⤵
- System Location Discovery: System Language Discovery
PID:3644 -
C:\windows\SysWOW64\AJMON.exeC:\windows\system32\AJMON.exe71⤵
- Executes dropped EXE
PID:2648 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DZTOZSU.exe.bat" "72⤵PID:2464
-
C:\windows\DZTOZSU.exeC:\windows\DZTOZSU.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YNYG.exe.bat" "74⤵PID:4688
-
C:\windows\system\YNYG.exeC:\windows\system\YNYG.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TADPMS.exe.bat" "76⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:968 -
C:\windows\TADPMS.exeC:\windows\TADPMS.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IVMU.exe.bat" "78⤵
- Executes a command shell one-liner
PID:4660 -
C:\windows\SysWOW64\IVMU.exeC:\windows\system32\IVMU.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2672 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CQRDH.exe.bat" "80⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5920 -
C:\windows\CQRDH.exeC:\windows\CQRDH.exe81⤵
- Executes dropped EXE
PID:3396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UQTILKX.exe.bat" "82⤵
- System Location Discovery: System Language Discovery
PID:5796 -
C:\windows\UQTILKX.exeC:\windows\UQTILKX.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JHUIR.exe.bat" "84⤵
- Executes a command shell one-liner
PID:4216 -
C:\windows\system\JHUIR.exeC:\windows\system\JHUIR.exe85⤵
- Executes dropped EXE
PID:5264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YCL.exe.bat" "86⤵
- Executes a command shell one-liner
PID:2968 -
C:\windows\YCL.exeC:\windows\YCL.exe87⤵
- Executes dropped EXE
PID:3528 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TXIVN.exe.bat" "88⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3296 -
C:\windows\SysWOW64\TXIVN.exeC:\windows\system32\TXIVN.exe89⤵
- Drops file in Windows directory
PID:4776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HUOSCU.exe.bat" "90⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1936 -
C:\windows\system\HUOSCU.exeC:\windows\system\HUOSCU.exe91⤵
- Executes dropped EXE
PID:3092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KQT.exe.bat" "92⤵
- Executes a command shell one-liner
PID:1924 -
C:\windows\system\KQT.exeC:\windows\system\KQT.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZNZ.exe.bat" "94⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3144 -
C:\windows\SysWOW64\ZNZ.exeC:\windows\system32\ZNZ.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QWBE.exe.bat" "96⤵
- Executes a command shell one-liner
PID:4292 -
C:\windows\system\QWBE.exeC:\windows\system\QWBE.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4680 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WWISFD.exe.bat" "98⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2788 -
C:\windows\SysWOW64\WWISFD.exeC:\windows\system32\WWISFD.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OZMVL.exe.bat" "100⤵
- Executes a command shell one-liner
PID:5468 -
C:\windows\SysWOW64\OZMVL.exeC:\windows\system32\OZMVL.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OEEKUG.exe.bat" "102⤵
- Executes a command shell one-liner
PID:5548 -
C:\windows\system\OEEKUG.exeC:\windows\system\OEEKUG.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JSJ.exe.bat" "104⤵PID:3020
-
C:\windows\system\JSJ.exeC:\windows\system\JSJ.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YNAYQT.exe.bat" "106⤵PID:5068
-
C:\windows\YNAYQT.exeC:\windows\YNAYQT.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QVUDTYB.exe.bat" "108⤵
- Executes a command shell one-liner
PID:4808 -
C:\windows\SysWOW64\QVUDTYB.exeC:\windows\system32\QVUDTYB.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3008 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VVCQ.exe.bat" "110⤵
- Executes a command shell one-liner
PID:5400 -
C:\windows\SysWOW64\VVCQ.exeC:\windows\system32\VVCQ.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VBCFE.exe.bat" "112⤵
- Executes a command shell one-liner
PID:1448 -
C:\windows\system\VBCFE.exeC:\windows\system\VBCFE.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QOHOOFU.exe.bat" "114⤵
- System Location Discovery: System Language Discovery
PID:3348 -
C:\windows\system\QOHOOFU.exeC:\windows\system\QOHOOFU.exe115⤵
- Executes dropped EXE
PID:4288 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WPPC.exe.bat" "116⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4140 -
C:\windows\WPPC.exeC:\windows\WPPC.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RCTTHH.exe.bat" "118⤵
- Executes a command shell one-liner
PID:5784 -
C:\windows\SysWOW64\RCTTHH.exeC:\windows\system32\RCTTHH.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WCBHQB.exe.bat" "120⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3852 -
C:\windows\SysWOW64\WCBHQB.exeC:\windows\system32\WCBHQB.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2424
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-