Analysis
- max time kernel
80s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/07/2026, 11:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-20_238cbbd6461c63d9c595cba45aeb3c4a_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-07-20_238cbbd6461c63d9c595cba45aeb3c4a_elex_emotet_stop.exe
- Size 208KB
- Sample260720-n5c7babv61
- SHA256 33bd1424df9176d307fc3f365d4a9c79b890dd40abb674dce29050d1a830d423
- MD5 238cbbd6461c63d9c595cba45aeb3c4a
- SHA1 628a4225661b9550dc5ace8c52c2d5cddccf39ca
- SHA512 b301adcb07459902274fe216b87232dcee5739b0d72759538a7a9a43a8de2556e970a7786534788f1df8b9bc9ae09996cfecd9ea063f379c3bbcc1dc7ca84f17
- SSDEEP 3072:jLQaL9tbLkRIgd1Lye9yjE2hWAN5Xb5lcdL+LOfE4pLthEjQT6j:vlZtbLWIgd1LZ9oECZb5lc5+LO8kEj1
- TLSH T1B5247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4584 SYRQ.exe 4220 GPH.exe 3544 HKKAL.exe 4380 SCALV.exe 1944 TFEHAZG.exe 1004 MIHLOX.exe 3592 GWM.exe 4600 SMTUC.exe 4836 LHXYPFU.exe 4236 FCBH.exe 3292 RVEAA.exe 1296 ZAJHL.exe 724 DIQHXDI.exe 2304 FDUY.exe 3624 DECMQX.exe 2784 PMJ.exe 4964 WCKLBLI.exe 4400 OKM.exe 5832 DFDVYV.exe 3660 SVEU.exe 1216 NIJDOQ.exe 5144 CDSI.exe 5100 LMUND.exe 4456 IJSKKSJ.exe 4428 MZHK.exe 5652 ECLOCB.exe 2280 HQP.exe 4828 CDMGW.exe 4092 UGYK.exe 1348 MGSPN.exe 1144 KHADWQP.exe 5272 PHHRF.exe 5228 FXIQMG.exe 2412 JNX.exe 4976 DACAA.exe 6088 LGU.exe 2512 GTZXM.exe 308 KJFFYVW.exe 3468 ZEPKR.exe 1960 INRPVN.exe 4268 UFU.exe 1060 JADMO.exe 2060 JDHQUFG.exe 4612 ZTIHAS.exe 5904 THNQKSK.exe 4496 OUSI.exe 2456 UUZWEUA.exe 1168 OHE.exe 4728 YQGKR.exe 3684 NLQ.exe 4656 TGP.exe 4944 XOV.exe 1132 SBAH.exe 5920 SFEKJX.exe 5240 EXH.exe 3528 CVSYEK.exe 248 CASNGXT.exe 1344 IBAA.exe 5464 IGAPQ.exe 4212 OHICHYY.exe 1596 OKMY.exe 3500 MKTUWQ.exe 5796 EKVZHWD.exe 5696 JLVNQ.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\VYYJYP.exe KFVQQ.exe File opened for modification C:\windows\SysWOW64\GWM.exe MIHLOX.exe File created C:\windows\SysWOW64\LGU.exe DACAA.exe File created C:\windows\SysWOW64\THNQKSK.exe ZTIHAS.exe File created C:\windows\SysWOW64\TGP.exe NLQ.exe File opened for modification C:\windows\SysWOW64\OHICHYY.exe IGAPQ.exe File created C:\windows\SysWOW64\IAPRM.exe MUJUX.exe File opened for modification C:\windows\SysWOW64\IAPRM.exe MUJUX.exe File created C:\windows\SysWOW64\HBDGWCQ.exe MNYWTC.exe File created C:\windows\SysWOW64\PMJ.exe DECMQX.exe File created C:\windows\SysWOW64\ZEPKR.exe.bat KJFFYVW.exe File created C:\windows\SysWOW64\TGP.exe.bat NLQ.exe File created C:\windows\SysWOW64\XOV.exe TGP.exe File opened for modification C:\windows\SysWOW64\ANT.exe YXS.exe File created C:\windows\SysWOW64\KFVQQ.exe.bat YNAYQT.exe File created C:\windows\SysWOW64\GRBCGXL.exe.bat VYYJYP.exe File created C:\windows\SysWOW64\ENQSM.exe.bat YMI.exe File opened for modification C:\windows\SysWOW64\DIQHXDI.exe ZAJHL.exe File created C:\windows\SysWOW64\JADMO.exe UFU.exe File created C:\windows\SysWOW64\JDHQUFG.exe JADMO.exe File created C:\windows\SysWOW64\OHICHYY.exe.bat IGAPQ.exe File opened for modification C:\windows\SysWOW64\WMABLZR.exe JJEVGH.exe File opened for modification C:\windows\SysWOW64\JNZ.exe JJVJNS.exe File opened for modification C:\windows\SysWOW64\PSHHLX.exe JSZT.exe File created C:\windows\SysWOW64\MIHLOX.exe.bat TFEHAZG.exe File opened for modification C:\windows\SysWOW64\SMTUC.exe GWM.exe File created C:\windows\SysWOW64\NIJDOQ.exe.bat SVEU.exe File created C:\windows\SysWOW64\CDSI.exe NIJDOQ.exe File opened for modification C:\windows\SysWOW64\UUZWEUA.exe OUSI.exe File opened for modification C:\windows\SysWOW64\KFVQQ.exe YNAYQT.exe File created C:\windows\SysWOW64\PSHHLX.exe.bat JSZT.exe File created C:\windows\SysWOW64\MIHLOX.exe TFEHAZG.exe File created C:\windows\SysWOW64\DACAA.exe JNX.exe File created C:\windows\SysWOW64\ZEPKR.exe KJFFYVW.exe File opened for modification C:\windows\SysWOW64\TGP.exe NLQ.exe File created C:\windows\SysWOW64\KFVQQ.exe YNAYQT.exe File created C:\windows\SysWOW64\JEYL.exe.bat GRBCGXL.exe File created C:\windows\SysWOW64\FXIQMG.exe PHHRF.exe File opened for modification C:\windows\SysWOW64\PMJ.exe DECMQX.exe File created C:\windows\SysWOW64\PMJ.exe.bat DECMQX.exe File opened for modification C:\windows\SysWOW64\CDSI.exe NIJDOQ.exe File opened for modification C:\windows\SysWOW64\DACAA.exe JNX.exe File opened for modification C:\windows\SysWOW64\JADMO.exe UFU.exe File created C:\windows\SysWOW64\XOV.exe.bat TGP.exe File created C:\windows\SysWOW64\WMABLZR.exe.bat JJEVGH.exe File created C:\windows\SysWOW64\GWM.exe.bat MIHLOX.exe File opened for modification C:\windows\SysWOW64\NIJDOQ.exe SVEU.exe File created C:\windows\SysWOW64\FXIQMG.exe.bat PHHRF.exe File created C:\windows\SysWOW64\MKTUWQ.exe.bat OKMY.exe File created C:\windows\SysWOW64\MUJUX.exe GUC.exe File created C:\windows\SysWOW64\ANT.exe.bat YXS.exe File created C:\windows\SysWOW64\VYYJYP.exe.bat KFVQQ.exe File opened for modification C:\windows\SysWOW64\ENQSM.exe YMI.exe File opened for modification C:\windows\SysWOW64\FXIQMG.exe PHHRF.exe File created C:\windows\SysWOW64\OHE.exe.bat UUZWEUA.exe File opened for modification C:\windows\SysWOW64\SFEKJX.exe SBAH.exe File created C:\windows\SysWOW64\MNYWTC.exe.bat DAOEE.exe File created C:\windows\SysWOW64\HBDGWCQ.exe.bat MNYWTC.exe File created C:\windows\SysWOW64\JJVJNS.exe FBPB.exe File created C:\windows\SysWOW64\JJVJNS.exe.bat FBPB.exe File created C:\windows\SysWOW64\JNZ.exe.bat JJVJNS.exe File created C:\windows\SysWOW64\GWM.exe MIHLOX.exe File created C:\windows\SysWOW64\LGU.exe.bat DACAA.exe File created C:\windows\SysWOW64\UUZWEUA.exe OUSI.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\YAUBXYB.exe.bat ENQSM.exe File created C:\windows\system\WCKLBLI.exe.bat PMJ.exe File opened for modification C:\windows\DFDVYV.exe OKM.exe File opened for modification C:\windows\system\PHHRF.exe KHADWQP.exe File opened for modification C:\windows\GTZXM.exe LGU.exe File created C:\windows\NQAJGDW.exe UNWFA.exe File opened for modification C:\windows\system\EEKBV.exe NQAJGDW.exe File created C:\windows\system\EEKBV.exe.bat NQAJGDW.exe File opened for modification C:\windows\system\MYF.exe PSHHLX.exe File opened for modification C:\windows\ZAJHL.exe RVEAA.exe File created C:\windows\HQP.exe.bat ECLOCB.exe File opened for modification C:\windows\system\BZOWMG.exe QGLEE.exe File opened for modification C:\windows\HKKAL.exe GPH.exe File created C:\windows\DFDVYV.exe OKM.exe File opened for modification C:\windows\system\ECLOCB.exe MZHK.exe File opened for modification C:\windows\system\UGYK.exe CDMGW.exe File opened for modification C:\windows\system\JLVNQ.exe EKVZHWD.exe File created C:\windows\system\UNWFA.exe.bat JVTN.exe File created C:\windows\system\MYF.exe.bat PSHHLX.exe File opened for modification C:\windows\system\QGLEE.exe MYF.exe File opened for modification C:\windows\system\WCKLBLI.exe PMJ.exe File created C:\windows\IJSKKSJ.exe LMUND.exe File created C:\windows\system\LIW.exe.bat JLVNQ.exe File created C:\windows\JVTN.exe IAPRM.exe File opened for modification C:\windows\HZWKVAW.exe BZOWMG.exe File created C:\windows\system\KHADWQP.exe.bat MGSPN.exe File created C:\windows\IBAA.exe CASNGXT.exe File opened for modification C:\windows\IBAA.exe CASNGXT.exe File created C:\windows\system\OKMY.exe.bat OHICHYY.exe File created C:\windows\system\LIW.exe JLVNQ.exe File opened for modification C:\windows\JVTN.exe IAPRM.exe File created C:\windows\system\EGCEP.exe.bat KTX.exe File created C:\windows\system\GPH.exe SYRQ.exe File created C:\windows\SCALV.exe.bat HKKAL.exe File created C:\windows\HQP.exe ECLOCB.exe File created C:\windows\CVSYEK.exe EXH.exe File opened for modification C:\windows\SCALV.exe HKKAL.exe File created C:\windows\LHXYPFU.exe SMTUC.exe File created C:\windows\DFDVYV.exe.bat OKM.exe File created C:\windows\system\DAOEE.exe.bat SITL.exe File created C:\windows\system\STGY.exe HBDGWCQ.exe File opened for modification C:\windows\YNAYQT.exe ANT.exe File created C:\windows\system\EGCEP.exe KTX.exe File created C:\windows\FCBH.exe.bat LHXYPFU.exe File created C:\windows\UFU.exe INRPVN.exe File opened for modification C:\windows\system\OKMY.exe OHICHYY.exe File created C:\windows\MHLYMW.exe VWNINJ.exe File created C:\windows\system\DAOEE.exe SITL.exe File created C:\windows\system\NUNLVP.exe JEYL.exe File created C:\windows\system\YMI.exe.bat NUNLVP.exe File opened for modification C:\windows\system\EGCEP.exe KTX.exe File created C:\windows\ZAJHL.exe.bat RVEAA.exe File created C:\windows\system\UGYK.exe.bat CDMGW.exe File created C:\windows\system\IGAPQ.exe.bat IBAA.exe File opened for modification C:\windows\system\YAUBXYB.exe ENQSM.exe File created C:\windows\system\QGLEE.exe.bat MYF.exe File created C:\windows\system\MGSPN.exe.bat UGYK.exe File created C:\windows\JJEVGH.exe LIW.exe File created C:\windows\YNAYQT.exe.bat ANT.exe File created C:\windows\system\UGYK.exe CDMGW.exe File opened for modification C:\windows\system\KHADWQP.exe MGSPN.exe File opened for modification C:\windows\EKVZHWD.exe MKTUWQ.exe File opened for modification C:\windows\system\FBPB.exe VTNWX.exe File created C:\windows\CDMGW.exe HQP.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5752 cmd.exe 2584 cmd.exe 4312 cmd.exe 1420 cmd.exe 1680 cmd.exe 1172 cmd.exe 3164 cmd.exe 1400 cmd.exe 1640 cmd.exe 4788 cmd.exe 5344 cmd.exe 2712 cmd.exe 5088 cmd.exe 1504 cmd.exe 6008 cmd.exe 5544 cmd.exe 4724 cmd.exe 4692 cmd.exe 5092 cmd.exe 5792 cmd.exe 440 cmd.exe 4500 cmd.exe 5880 cmd.exe 4200 cmd.exe 5916 cmd.exe 5656 cmd.exe 3908 cmd.exe 2400 cmd.exe 4484 cmd.exe 5928 cmd.exe 4868 cmd.exe 844 cmd.exe 720 cmd.exe 2376 cmd.exe 2092 cmd.exe 4508 cmd.exe 816 cmd.exe 264 cmd.exe 1780 cmd.exe 952 cmd.exe 864 cmd.exe 644 cmd.exe 3768 cmd.exe 5932 cmd.exe 2752 cmd.exe 2388 cmd.exe 4084 cmd.exe 1100 cmd.exe 2948 cmd.exe 5760 cmd.exe 2328 cmd.exe 4156 cmd.exe 2472 cmd.exe 5224 cmd.exe 1864 cmd.exe 5244 cmd.exe 4640 cmd.exe 6072 cmd.exe 2608 cmd.exe 4636 cmd.exe 2740 cmd.exe 3064 cmd.exe 3884 cmd.exe 2940 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 848 2164 WerFault.exe 88 3300 4584 WerFault.exe 93 1344 4220 WerFault.exe 99 5616 3544 WerFault.exe 104 1776 4380 WerFault.exe 109 3640 1944 WerFault.exe 114 3796 1004 WerFault.exe 119 864 3592 WerFault.exe 124 6072 4600 WerFault.exe 129 3100 4836 WerFault.exe 134 4912 4236 WerFault.exe 139 1380 3292 WerFault.exe 144 4536 1296 WerFault.exe 149 4156 724 WerFault.exe 154 5652 2304 WerFault.exe 159 2024 3624 WerFault.exe 164 4508 2784 WerFault.exe 169 2660 4964 WerFault.exe 174 1556 4400 WerFault.exe 179 4724 5832 WerFault.exe 184 3948 3660 WerFault.exe 189 2708 1216 WerFault.exe 194 2460 5144 WerFault.exe 199 4792 5100 WerFault.exe 204 3068 4456 WerFault.exe 209 5408 4428 WerFault.exe 214 3876 5652 WerFault.exe 219 4900 2280 WerFault.exe 224 1848 4828 WerFault.exe 229 3928 4092 WerFault.exe 234 4500 1348 WerFault.exe 239 1500 1144 WerFault.exe 244 4604 5272 WerFault.exe 249 5092 5228 WerFault.exe 254 3904 2412 WerFault.exe 259 4708 4976 WerFault.exe 264 5496 6088 WerFault.exe 269 4376 2512 WerFault.exe 274 2296 308 WerFault.exe 279 3888 3468 WerFault.exe 285 5600 1960 WerFault.exe 290 1868 4268 WerFault.exe 295 4724 1060 WerFault.exe 300 3260 2060 WerFault.exe 305 5572 4612 WerFault.exe 310 3652 5904 WerFault.exe 315 4708 4496 WerFault.exe 320 3688 2456 WerFault.exe 325 2480 1168 WerFault.exe 330 6020 4728 WerFault.exe 335 3888 3684 WerFault.exe 340 1848 4656 WerFault.exe 345 2604 4944 WerFault.exe 350 5880 1132 WerFault.exe 355 5524 5920 WerFault.exe 360 1108 5240 WerFault.exe 365 3648 3528 WerFault.exe 370 6060 248 WerFault.exe 375 2564 1344 WerFault.exe 380 436 5464 WerFault.exe 385 2296 4212 WerFault.exe 390 3948 1596 WerFault.exe 395 2104 3500 WerFault.exe 400 4112 5796 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OKMY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YMI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CDMGW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IBAA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GUC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JVTN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SITL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MNYWTC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RVEAA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LMUND.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YNAYQT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JEYL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JSZT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MZHK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FXIQMG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EGCEP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MYF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QGLEE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PHHRF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JNX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KJFFYVW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MUJUX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZEPKR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EEKBV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FDUY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZTIHAS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EKVZHWD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YAUBXYB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ECLOCB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SBAH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CASNGXT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ENQSM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SCALV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZAJHL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2164 2026-07-20_238cbbd6461c63d9c595cba45aeb3c4a_elex_emotet_stop.exe 2164 2026-07-20_238cbbd6461c63d9c595cba45aeb3c4a_elex_emotet_stop.exe 4584 SYRQ.exe 4584 SYRQ.exe 4220 GPH.exe 4220 GPH.exe 3544 HKKAL.exe 3544 HKKAL.exe 4380 SCALV.exe 4380 SCALV.exe 1944 TFEHAZG.exe 1944 TFEHAZG.exe 1004 MIHLOX.exe 1004 MIHLOX.exe 3592 GWM.exe 3592 GWM.exe 4600 SMTUC.exe 4600 SMTUC.exe 4836 LHXYPFU.exe 4836 LHXYPFU.exe 4236 FCBH.exe 4236 FCBH.exe 3292 RVEAA.exe 3292 RVEAA.exe 1296 ZAJHL.exe 1296 ZAJHL.exe 724 DIQHXDI.exe 724 DIQHXDI.exe 2304 FDUY.exe 2304 FDUY.exe 3624 DECMQX.exe 3624 DECMQX.exe 2784 PMJ.exe 2784 PMJ.exe 4964 WCKLBLI.exe 4964 WCKLBLI.exe 4400 OKM.exe 4400 OKM.exe 5832 DFDVYV.exe 5832 DFDVYV.exe 3660 SVEU.exe 3660 SVEU.exe 1216 NIJDOQ.exe 1216 NIJDOQ.exe 5144 CDSI.exe 5144 CDSI.exe 5100 LMUND.exe 5100 LMUND.exe 4456 IJSKKSJ.exe 4456 IJSKKSJ.exe 4428 MZHK.exe 4428 MZHK.exe 5652 ECLOCB.exe 5652 ECLOCB.exe 2280 HQP.exe 2280 HQP.exe 4828 CDMGW.exe 4828 CDMGW.exe 4092 UGYK.exe 4092 UGYK.exe 1348 MGSPN.exe 1348 MGSPN.exe 1144 KHADWQP.exe 1144 KHADWQP.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2164 2026-07-20_238cbbd6461c63d9c595cba45aeb3c4a_elex_emotet_stop.exe 2164 2026-07-20_238cbbd6461c63d9c595cba45aeb3c4a_elex_emotet_stop.exe 4584 SYRQ.exe 4584 SYRQ.exe 4220 GPH.exe 4220 GPH.exe 3544 HKKAL.exe 3544 HKKAL.exe 4380 SCALV.exe 4380 SCALV.exe 1944 TFEHAZG.exe 1944 TFEHAZG.exe 1004 MIHLOX.exe 1004 MIHLOX.exe 3592 GWM.exe 3592 GWM.exe 4600 SMTUC.exe 4600 SMTUC.exe 4836 LHXYPFU.exe 4836 LHXYPFU.exe 4236 FCBH.exe 4236 FCBH.exe 3292 RVEAA.exe 3292 RVEAA.exe 1296 ZAJHL.exe 1296 ZAJHL.exe 724 DIQHXDI.exe 724 DIQHXDI.exe 2304 FDUY.exe 2304 FDUY.exe 3624 DECMQX.exe 3624 DECMQX.exe 2784 PMJ.exe 2784 PMJ.exe 4964 WCKLBLI.exe 4964 WCKLBLI.exe 4400 OKM.exe 4400 OKM.exe 5832 DFDVYV.exe 5832 DFDVYV.exe 3660 SVEU.exe 3660 SVEU.exe 1216 NIJDOQ.exe 1216 NIJDOQ.exe 5144 CDSI.exe 5144 CDSI.exe 5100 LMUND.exe 5100 LMUND.exe 4456 IJSKKSJ.exe 4456 IJSKKSJ.exe 4428 MZHK.exe 4428 MZHK.exe 5652 ECLOCB.exe 5652 ECLOCB.exe 2280 HQP.exe 2280 HQP.exe 4828 CDMGW.exe 4828 CDMGW.exe 4092 UGYK.exe 4092 UGYK.exe 1348 MGSPN.exe 1348 MGSPN.exe 1144 KHADWQP.exe 1144 KHADWQP.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2164 wrote to memory of 3352 2164 2026-07-20_238cbbd6461c63d9c595cba45aeb3c4a_elex_emotet_stop.exe 89 PID 3352 wrote to memory of 4584 3352 cmd.exe 93 PID 4584 wrote to memory of 4680 4584 SYRQ.exe 95 PID 4680 wrote to memory of 4220 4680 cmd.exe 99 PID 4220 wrote to memory of 4144 4220 GPH.exe 100 PID 4144 wrote to memory of 3544 4144 cmd.exe 104 PID 3544 wrote to memory of 2596 3544 HKKAL.exe 105 PID 2596 wrote to memory of 4380 2596 cmd.exe 109 PID 4380 wrote to memory of 5052 4380 SCALV.exe 110 PID 5052 wrote to memory of 1944 5052 cmd.exe 114 PID 1944 wrote to memory of 2328 1944 TFEHAZG.exe 115 PID 2328 wrote to memory of 1004 2328 cmd.exe 119 PID 1004 wrote to memory of 2244 1004 MIHLOX.exe 120 PID 2244 wrote to memory of 3592 2244 cmd.exe 124 PID 3592 wrote to memory of 3884 3592 GWM.exe 125 PID 3884 wrote to memory of 4600 3884 cmd.exe 129 PID 4600 wrote to memory of 1952 4600 SMTUC.exe 130 PID 1952 wrote to memory of 4836 1952 cmd.exe 134 PID 4836 wrote to memory of 592 4836 LHXYPFU.exe 135 PID 592 wrote to memory of 4236 592 cmd.exe 139 PID 4236 wrote to memory of 5752 4236 FCBH.exe 140 PID 5752 wrote to memory of 3292 5752 cmd.exe 144 PID 3292 wrote to memory of 4776 3292 RVEAA.exe 145 PID 4776 wrote to memory of 1296 4776 cmd.exe 149 PID 1296 wrote to memory of 2608 1296 ZAJHL.exe 150 PID 2608 wrote to memory of 724 2608 cmd.exe 154 PID 724 wrote to memory of 732 724 DIQHXDI.exe 155 PID 732 wrote to memory of 2304 732 cmd.exe 159 PID 2304 wrote to memory of 3304 2304 FDUY.exe 160 PID 3304 wrote to memory of 3624 3304 cmd.exe 164 PID 3624 wrote to memory of 1176 3624 DECMQX.exe 165 PID 1176 wrote to memory of 2784 1176 cmd.exe 169 PID 2784 wrote to memory of 1508 2784 PMJ.exe 170 PID 1508 wrote to memory of 4964 1508 cmd.exe 174 PID 4964 wrote to memory of 3640 4964 WCKLBLI.exe 175 PID 3640 wrote to memory of 4400 3640 cmd.exe 179 PID 4400 wrote to memory of 2016 4400 OKM.exe 180 PID 2016 wrote to memory of 5832 2016 cmd.exe 184 PID 5832 wrote to memory of 3768 5832 DFDVYV.exe 185 PID 3768 wrote to memory of 3660 3768 cmd.exe 189 PID 3660 wrote to memory of 5916 3660 SVEU.exe 190 PID 5916 wrote to memory of 1216 5916 cmd.exe 194 PID 1216 wrote to memory of 1112 1216 NIJDOQ.exe 195 PID 1112 wrote to memory of 5144 1112 cmd.exe 199 PID 5144 wrote to memory of 1388 5144 CDSI.exe 200 PID 1388 wrote to memory of 5100 1388 cmd.exe 204 PID 5100 wrote to memory of 4136 5100 LMUND.exe 205 PID 4136 wrote to memory of 4456 4136 cmd.exe 209 PID 4456 wrote to memory of 5932 4456 IJSKKSJ.exe 210 PID 5932 wrote to memory of 4428 5932 cmd.exe 214 PID 4428 wrote to memory of 5616 4428 MZHK.exe 215 PID 5616 wrote to memory of 5652 5616 cmd.exe 219 PID 5652 wrote to memory of 5748 5652 ECLOCB.exe 220 PID 5748 wrote to memory of 2280 5748 cmd.exe 224 PID 2280 wrote to memory of 1640 2280 HQP.exe 225 PID 1640 wrote to memory of 4828 1640 cmd.exe 229 PID 4828 wrote to memory of 1528 4828 CDMGW.exe 230 PID 1528 wrote to memory of 4092 1528 cmd.exe 234 PID 4092 wrote to memory of 1284 4092 UGYK.exe 235 PID 1284 wrote to memory of 1348 1284 cmd.exe 239 PID 1348 wrote to memory of 2092 1348 MGSPN.exe 240 PID 2092 wrote to memory of 1144 2092 cmd.exe 244 PID 1144 wrote to memory of 2640 1144 KHADWQP.exe 245 PID 2640 wrote to memory of 5272 2640 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_238cbbd6461c63d9c595cba45aeb3c4a_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-20_238cbbd6461c63d9c595cba45aeb3c4a_elex_emotet_stop.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SYRQ.exe.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\windows\system\SYRQ.exeC:\windows\system\SYRQ.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GPH.exe.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\windows\system\GPH.exeC:\windows\system\GPH.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HKKAL.exe.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\windows\HKKAL.exeC:\windows\HKKAL.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SCALV.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\windows\SCALV.exeC:\windows\SCALV.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TFEHAZG.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\windows\TFEHAZG.exeC:\windows\TFEHAZG.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MIHLOX.exe.bat" "12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\windows\SysWOW64\MIHLOX.exeC:\windows\system32\MIHLOX.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GWM.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\windows\SysWOW64\GWM.exeC:\windows\system32\GWM.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SMTUC.exe.bat" "16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\windows\SysWOW64\SMTUC.exeC:\windows\system32\SMTUC.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LHXYPFU.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\windows\LHXYPFU.exeC:\windows\LHXYPFU.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FCBH.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:592 -
C:\windows\FCBH.exeC:\windows\FCBH.exe21⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RVEAA.exe.bat" "22⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5752 -
C:\windows\SysWOW64\RVEAA.exeC:\windows\system32\RVEAA.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZAJHL.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\windows\ZAJHL.exeC:\windows\ZAJHL.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DIQHXDI.exe.bat" "26⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\windows\SysWOW64\DIQHXDI.exeC:\windows\system32\DIQHXDI.exe27⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FDUY.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:732 -
C:\windows\FDUY.exeC:\windows\FDUY.exe29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DECMQX.exe.bat" "30⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\windows\system\DECMQX.exeC:\windows\system\DECMQX.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PMJ.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\windows\SysWOW64\PMJ.exeC:\windows\system32\PMJ.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WCKLBLI.exe.bat" "34⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\windows\system\WCKLBLI.exeC:\windows\system\WCKLBLI.exe35⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OKM.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:3640 -
C:\windows\OKM.exeC:\windows\OKM.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DFDVYV.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\windows\DFDVYV.exeC:\windows\DFDVYV.exe39⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SVEU.exe.bat" "40⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\windows\system\SVEU.exeC:\windows\system\SVEU.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NIJDOQ.exe.bat" "42⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5916 -
C:\windows\SysWOW64\NIJDOQ.exeC:\windows\system32\NIJDOQ.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CDSI.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\windows\SysWOW64\CDSI.exeC:\windows\system32\CDSI.exe45⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LMUND.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\windows\LMUND.exeC:\windows\LMUND.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IJSKKSJ.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\windows\IJSKKSJ.exeC:\windows\IJSKKSJ.exe49⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MZHK.exe.bat" "50⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5932 -
C:\windows\MZHK.exeC:\windows\MZHK.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ECLOCB.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:5616 -
C:\windows\system\ECLOCB.exeC:\windows\system\ECLOCB.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HQP.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:5748 -
C:\windows\HQP.exeC:\windows\HQP.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CDMGW.exe.bat" "56⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\windows\CDMGW.exeC:\windows\CDMGW.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UGYK.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\windows\system\UGYK.exeC:\windows\system\UGYK.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MGSPN.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\windows\system\MGSPN.exeC:\windows\system\MGSPN.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KHADWQP.exe.bat" "62⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\windows\system\KHADWQP.exeC:\windows\system\KHADWQP.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PHHRF.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\windows\system\PHHRF.exeC:\windows\system\PHHRF.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5272 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FXIQMG.exe.bat" "66⤵PID:3828
-
C:\windows\SysWOW64\FXIQMG.exeC:\windows\system32\FXIQMG.exe67⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5228 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JNX.exe.bat" "68⤵PID:5568
-
C:\windows\system\JNX.exeC:\windows\system\JNX.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DACAA.exe.bat" "70⤵
- System Location Discovery: System Language Discovery
PID:4228 -
C:\windows\SysWOW64\DACAA.exeC:\windows\system32\DACAA.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LGU.exe.bat" "72⤵PID:3388
-
C:\windows\SysWOW64\LGU.exeC:\windows\system32\LGU.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GTZXM.exe.bat" "74⤵
- System Location Discovery: System Language Discovery
PID:416 -
C:\windows\GTZXM.exeC:\windows\GTZXM.exe75⤵
- Executes dropped EXE
PID:2512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KJFFYVW.exe.bat" "76⤵PID:3612
-
C:\windows\system\KJFFYVW.exeC:\windows\system\KJFFYVW.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZEPKR.exe.bat" "78⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4508 -
C:\windows\SysWOW64\ZEPKR.exeC:\windows\system32\ZEPKR.exe79⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\INRPVN.exe.bat" "80⤵PID:3436
-
C:\windows\system\INRPVN.exeC:\windows\system\INRPVN.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UFU.exe.bat" "82⤵PID:1836
-
C:\windows\UFU.exeC:\windows\UFU.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JADMO.exe.bat" "84⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4788 -
C:\windows\SysWOW64\JADMO.exeC:\windows\system32\JADMO.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JDHQUFG.exe.bat" "86⤵PID:4232
-
C:\windows\SysWOW64\JDHQUFG.exeC:\windows\system32\JDHQUFG.exe87⤵
- Executes dropped EXE
PID:2060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZTIHAS.exe.bat" "88⤵
- Executes a command shell one-liner
PID:2584 -
C:\windows\ZTIHAS.exeC:\windows\ZTIHAS.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\THNQKSK.exe.bat" "90⤵
- System Location Discovery: System Language Discovery
PID:2356 -
C:\windows\SysWOW64\THNQKSK.exeC:\windows\system32\THNQKSK.exe91⤵
- Executes dropped EXE
PID:5904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OUSI.exe.bat" "92⤵
- System Location Discovery: System Language Discovery
PID:6040 -
C:\windows\OUSI.exeC:\windows\OUSI.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UUZWEUA.exe.bat" "94⤵PID:2000
-
C:\windows\SysWOW64\UUZWEUA.exeC:\windows\system32\UUZWEUA.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OHE.exe.bat" "96⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4156 -
C:\windows\SysWOW64\OHE.exeC:\windows\system32\OHE.exe97⤵
- Executes dropped EXE
PID:1168 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YQGKR.exe.bat" "98⤵
- Executes a command shell one-liner
PID:2752 -
C:\windows\system\YQGKR.exeC:\windows\system\YQGKR.exe99⤵
- Executes dropped EXE
PID:4728 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NLQ.exe.bat" "100⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4312 -
C:\windows\system\NLQ.exeC:\windows\system\NLQ.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3684 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TGP.exe.bat" "102⤵
- Executes a command shell one-liner
PID:816 -
C:\windows\SysWOW64\TGP.exeC:\windows\system32\TGP.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4656 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XOV.exe.bat" "104⤵PID:2476
-
C:\windows\SysWOW64\XOV.exeC:\windows\system32\XOV.exe105⤵
- Executes dropped EXE
PID:4944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SBAH.exe.bat" "106⤵
- Executes a command shell one-liner
PID:2472 -
C:\windows\system\SBAH.exeC:\windows\system\SBAH.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SFEKJX.exe.bat" "108⤵PID:3036
-
C:\windows\SysWOW64\SFEKJX.exeC:\windows\system32\SFEKJX.exe109⤵
- Executes dropped EXE
PID:5920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EXH.exe.bat" "110⤵PID:3560
-
C:\windows\EXH.exeC:\windows\EXH.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CVSYEK.exe.bat" "112⤵PID:5236
-
C:\windows\CVSYEK.exeC:\windows\CVSYEK.exe113⤵
- Executes dropped EXE
PID:3528 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CASNGXT.exe.bat" "114⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2388 -
C:\windows\CASNGXT.exeC:\windows\CASNGXT.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IBAA.exe.bat" "116⤵PID:3708
-
C:\windows\IBAA.exeC:\windows\IBAA.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IGAPQ.exe.bat" "118⤵PID:3320
-
C:\windows\system\IGAPQ.exeC:\windows\system\IGAPQ.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OHICHYY.exe.bat" "120⤵
- Executes a command shell one-liner
PID:2940 -
C:\windows\SysWOW64\OHICHYY.exeC:\windows\system32\OHICHYY.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4212
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-