Analysis
- max time kernel
148s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/07/2026, 11:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-20_b63b6b6e1a3874c7047797f5345cc95e_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-07-20_b63b6b6e1a3874c7047797f5345cc95e_elex_emotet_stop.exe
- Size 208KB
- Sample260720-netflsav4v
- SHA256 9819678507ca0c721cad7bb42b41897c1882e95c92a86b291004148ae8b7a486
- MD5 b63b6b6e1a3874c7047797f5345cc95e
- SHA1 2d33702df7669f3dd99337711d1545a0505123c6
- SHA512 ae4b9751ce8cc1cbc1fdaefcf19f2aeeb51c627e66862e767e1c12ceffb9b294ee341aebb3e19f9c03f3411772ccad2f9a6e29af9991a51c93bfc2cd27102db3
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlldL+LOff4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFll5+LO3kEj1
- TLSH T12C247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2848 YETXJ.exe 208 VUTH.exe 5148 NXD.exe 4252 EYFWN.exe 1704 XBJA.exe 2368 CBRO.exe 3784 GJX.exe 6064 BECXY.exe 2728 CZOBLIA.exe 5220 EXTVTQ.exe 5176 GSY.exe 3876 ZNCAI.exe 4328 IWEGML.exe 2140 JRIJZ.exe 4208 YUR.exe 3824 THWXU.exe 2148 TKABAMJ.exe 5172 EDPMJFR.exe 5964 WDR.exe 3936 FLTWY.exe 1508 UGDIJCW.exe 4300 PUIS.exe 1208 KHMBEC.exe 4764 IAPRM.exe 2252 SAR.exe 5240 HVBA.exe 4308 HYE.exe 696 CLJOR.exe 416 XHOXBQM.exe 3524 TEU.exe 5688 DCAOXI.exe 5496 DQADZNZ.exe 4928 JQHR.exe 1856 JVAFJ.exe 200 AJKPZZR.exe 476 AOK.exe 4980 TJOHO.exe 2388 NFTRQBK.exe 4756 FKDJ.exe 5304 FYDXI.exe 3004 KYLLZ.exe 1832 OGSLD.exe 2764 AYNELF.exe 3328 RHPJPCI.exe 2016 XHWWG.exe 1532 BPDFKXX.exe 4644 VCIO.exe 884 VQICW.exe 5208 BQQQNEQ.exe 4564 HQXEWGZ.exe 5484 CECN.exe 4808 CZG.exe 5828 ORJC.exe 5992 RHPKGV.exe 6020 RNIYHAW.exe 4380 MAMI.exe 3968 QQTIWT.exe 2640 WRBV.exe 588 SWG.exe 3660 YKGTZA.exe 5900 ONPG.exe 984 XNRLN.exe 4652 GVTQRX.exe 204 SDAYDI.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\DCAOXI.exe TEU.exe File created C:\windows\SysWOW64\AJKPZZR.exe JVAFJ.exe File opened for modification C:\windows\SysWOW64\AOK.exe AJKPZZR.exe File created C:\windows\SysWOW64\XNRLN.exe.bat ONPG.exe File opened for modification C:\windows\SysWOW64\CBRO.exe XBJA.exe File created C:\windows\SysWOW64\IAPRM.exe KHMBEC.exe File opened for modification C:\windows\SysWOW64\AJKPZZR.exe JVAFJ.exe File created C:\windows\SysWOW64\AJKPZZR.exe.bat JVAFJ.exe File created C:\windows\SysWOW64\XNRLN.exe ONPG.exe File created C:\windows\SysWOW64\MKG.exe CNB.exe File created C:\windows\SysWOW64\MKG.exe.bat CNB.exe File opened for modification C:\windows\SysWOW64\EXTVTQ.exe CZOBLIA.exe File created C:\windows\SysWOW64\GSY.exe.bat EXTVTQ.exe File created C:\windows\SysWOW64\KYLLZ.exe.bat FYDXI.exe File opened for modification C:\windows\SysWOW64\BPDFKXX.exe XHWWG.exe File created C:\windows\SysWOW64\SWG.exe WRBV.exe File created C:\windows\SysWOW64\YETXJ.exe.bat 2026-07-20_b63b6b6e1a3874c7047797f5345cc95e_elex_emotet_stop.exe File opened for modification C:\windows\SysWOW64\GSY.exe EXTVTQ.exe File created C:\windows\SysWOW64\HVBA.exe SAR.exe File opened for modification C:\windows\SysWOW64\KYLLZ.exe FYDXI.exe File created C:\windows\SysWOW64\EYFWN.exe NXD.exe File created C:\windows\SysWOW64\CBRO.exe XBJA.exe File created C:\windows\SysWOW64\AYNELF.exe OGSLD.exe File created C:\windows\SysWOW64\CECN.exe HQXEWGZ.exe File created C:\windows\SysWOW64\CECN.exe.bat HQXEWGZ.exe File opened for modification C:\windows\SysWOW64\EYFWN.exe NXD.exe File created C:\windows\SysWOW64\GSY.exe EXTVTQ.exe File opened for modification C:\windows\SysWOW64\TKABAMJ.exe THWXU.exe File opened for modification C:\windows\SysWOW64\RHPJPCI.exe AYNELF.exe File opened for modification C:\windows\SysWOW64\GVTQRX.exe XNRLN.exe File opened for modification C:\windows\SysWOW64\YETXJ.exe 2026-07-20_b63b6b6e1a3874c7047797f5345cc95e_elex_emotet_stop.exe File created C:\windows\SysWOW64\EYFWN.exe.bat NXD.exe File created C:\windows\SysWOW64\ZNCAI.exe GSY.exe File opened for modification C:\windows\SysWOW64\ZNCAI.exe GSY.exe File created C:\windows\SysWOW64\TKABAMJ.exe.bat THWXU.exe File created C:\windows\SysWOW64\SAR.exe IAPRM.exe File created C:\windows\SysWOW64\CBRO.exe.bat XBJA.exe File opened for modification C:\windows\SysWOW64\BECXY.exe GJX.exe File created C:\windows\SysWOW64\EXTVTQ.exe CZOBLIA.exe File opened for modification C:\windows\SysWOW64\IAPRM.exe KHMBEC.exe File created C:\windows\SysWOW64\HVBA.exe.bat SAR.exe File opened for modification C:\windows\SysWOW64\DCAOXI.exe TEU.exe File created C:\windows\SysWOW64\DCAOXI.exe.bat TEU.exe File opened for modification C:\windows\SysWOW64\AYNELF.exe OGSLD.exe File created C:\windows\SysWOW64\RHPJPCI.exe.bat AYNELF.exe File created C:\windows\SysWOW64\AYNELF.exe.bat OGSLD.exe File created C:\windows\SysWOW64\BPDFKXX.exe XHWWG.exe File opened for modification C:\windows\SysWOW64\XNRLN.exe ONPG.exe File created C:\windows\SysWOW64\GVTQRX.exe XNRLN.exe File opened for modification C:\windows\SysWOW64\MKG.exe CNB.exe File created C:\windows\SysWOW64\BECXY.exe.bat GJX.exe File created C:\windows\SysWOW64\ZNCAI.exe.bat GSY.exe File created C:\windows\SysWOW64\SWG.exe.bat WRBV.exe File opened for modification C:\windows\SysWOW64\HVBA.exe SAR.exe File created C:\windows\SysWOW64\BECXY.exe GJX.exe File created C:\windows\SysWOW64\AOK.exe AJKPZZR.exe File created C:\windows\SysWOW64\KYLLZ.exe FYDXI.exe File opened for modification C:\windows\SysWOW64\CECN.exe HQXEWGZ.exe File created C:\windows\SysWOW64\GVTQRX.exe.bat XNRLN.exe File opened for modification C:\windows\SysWOW64\SAR.exe IAPRM.exe File created C:\windows\SysWOW64\BPDFKXX.exe.bat XHWWG.exe File created C:\windows\SysWOW64\YKGTZA.exe SWG.exe File created C:\windows\SysWOW64\YETXJ.exe 2026-07-20_b63b6b6e1a3874c7047797f5345cc95e_elex_emotet_stop.exe File created C:\windows\SysWOW64\IAPRM.exe.bat KHMBEC.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\DQADZNZ.exe.bat DCAOXI.exe File created C:\windows\system\ONPG.exe.bat YKGTZA.exe File created C:\windows\GJX.exe CBRO.exe File created C:\windows\system\HQXEWGZ.exe.bat BQQQNEQ.exe File created C:\windows\SDAYDI.exe GVTQRX.exe File opened for modification C:\windows\system\JWKWURJ.exe YEHMMK.exe File opened for modification C:\windows\system\FKDJ.exe NFTRQBK.exe File created C:\windows\system\JWKWURJ.exe.bat YEHMMK.exe File created C:\windows\IWEGML.exe.bat ZNCAI.exe File created C:\windows\EDPMJFR.exe.bat TKABAMJ.exe File opened for modification C:\windows\system\BQQQNEQ.exe VQICW.exe File created C:\windows\system\HQXEWGZ.exe BQQQNEQ.exe File created C:\windows\system\ORJC.exe.bat CZG.exe File opened for modification C:\windows\RNIYHAW.exe RHPKGV.exe File created C:\windows\IWEGML.exe ZNCAI.exe File created C:\windows\system\OGSLD.exe.bat KYLLZ.exe File created C:\windows\XHWWG.exe.bat RHPJPCI.exe File created C:\windows\system\XMT.exe EJPO.exe File opened for modification C:\windows\YUR.exe JRIJZ.exe File opened for modification C:\windows\system\TJOHO.exe AOK.exe File created C:\windows\system\JRIJZ.exe IWEGML.exe File created C:\windows\WDR.exe EDPMJFR.exe File created C:\windows\system\OGSLD.exe KYLLZ.exe File opened for modification C:\windows\system\HQXEWGZ.exe BQQQNEQ.exe File created C:\windows\system\ORJC.exe CZG.exe File opened for modification C:\windows\WRBV.exe QQTIWT.exe File opened for modification C:\windows\NXD.exe VUTH.exe File created C:\windows\PUIS.exe UGDIJCW.exe File opened for modification C:\windows\PUIS.exe UGDIJCW.exe File opened for modification C:\windows\system\MAMI.exe RNIYHAW.exe File created C:\windows\CNB.exe.bat XMT.exe File created C:\windows\system\TEU.exe XHOXBQM.exe File created C:\windows\THWXU.exe.bat YUR.exe File created C:\windows\JVAFJ.exe JQHR.exe File opened for modification C:\windows\system\VQICW.exe VCIO.exe File created C:\windows\system\QQTIWT.exe MAMI.exe File opened for modification C:\windows\GJX.exe CBRO.exe File created C:\windows\YUR.exe.bat JRIJZ.exe File created C:\windows\system\VCIO.exe BPDFKXX.exe File created C:\windows\system\MAMI.exe.bat RNIYHAW.exe File opened for modification C:\windows\WDR.exe EDPMJFR.exe File created C:\windows\system\BQQQNEQ.exe.bat VQICW.exe File created C:\windows\system\ONPG.exe YKGTZA.exe File created C:\windows\CLQKVR.exe MQG.exe File opened for modification C:\windows\CLQKVR.exe MQG.exe File opened for modification C:\windows\FYDXI.exe FKDJ.exe File created C:\windows\XHWWG.exe RHPJPCI.exe File opened for modification C:\windows\CZG.exe CECN.exe File created C:\windows\system\RHPKGV.exe ORJC.exe File created C:\windows\system\JWKWURJ.exe YEHMMK.exe File opened for modification C:\windows\system\MQG.exe MKG.exe File opened for modification C:\windows\XBJA.exe EYFWN.exe File created C:\windows\system\CZOBLIA.exe BECXY.exe File created C:\windows\system\FLTWY.exe WDR.exe File created C:\windows\HYE.exe HVBA.exe File opened for modification C:\windows\system\VCIO.exe BPDFKXX.exe File created C:\windows\system\MQG.exe MKG.exe File created C:\windows\system\DQADZNZ.exe DCAOXI.exe File created C:\windows\system\NFTRQBK.exe.bat TJOHO.exe File created C:\windows\WRBV.exe.bat QQTIWT.exe File created C:\windows\SDAYDI.exe.bat GVTQRX.exe File opened for modification C:\windows\JQHR.exe DQADZNZ.exe File created C:\windows\system\VQICW.exe VCIO.exe File created C:\windows\system\MAMI.exe RNIYHAW.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2364 cmd.exe 3168 cmd.exe 2508 cmd.exe 2280 cmd.exe 1292 cmd.exe 2664 cmd.exe 3924 cmd.exe 2972 cmd.exe 1712 cmd.exe 4492 cmd.exe 3668 cmd.exe 2732 cmd.exe 2892 cmd.exe 3836 cmd.exe 2756 cmd.exe 4360 cmd.exe 4216 cmd.exe 3844 cmd.exe 5356 cmd.exe 784 cmd.exe 4060 cmd.exe 2632 cmd.exe 2276 cmd.exe 5584 cmd.exe 1388 cmd.exe 6028 cmd.exe 5696 cmd.exe 5364 cmd.exe 2956 cmd.exe 2724 cmd.exe 4740 cmd.exe 5004 cmd.exe 1868 cmd.exe 2696 cmd.exe 5500 cmd.exe 4976 cmd.exe 1432 cmd.exe 2716 cmd.exe 5660 cmd.exe 4344 cmd.exe 3688 cmd.exe 3388 cmd.exe 3880 cmd.exe 2080 cmd.exe 252 cmd.exe 2548 cmd.exe 1484 cmd.exe 5756 cmd.exe 4568 cmd.exe 5180 cmd.exe 3216 cmd.exe 3424 cmd.exe 4128 cmd.exe 5892 cmd.exe 1600 cmd.exe 5552 cmd.exe 5888 cmd.exe 500 cmd.exe 5620 cmd.exe 5040 cmd.exe 6124 cmd.exe 4076 cmd.exe 6132 cmd.exe 5700 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 5040 4828 WerFault.exe 87 4620 2848 WerFault.exe 93 2016 208 WerFault.exe 99 3860 5148 WerFault.exe 104 2952 4252 WerFault.exe 109 2148 1704 WerFault.exe 114 3968 2368 WerFault.exe 119 2640 3784 WerFault.exe 124 3936 6064 WerFault.exe 129 3660 2728 WerFault.exe 134 4204 5220 WerFault.exe 139 3652 5176 WerFault.exe 144 4248 3876 WerFault.exe 149 4480 4328 WerFault.exe 154 2888 2140 WerFault.exe 159 3272 4208 WerFault.exe 164 5904 3824 WerFault.exe 169 2792 2148 WerFault.exe 174 2704 5172 WerFault.exe 179 4760 5964 WerFault.exe 184 4820 3936 WerFault.exe 189 5560 1508 WerFault.exe 194 1216 4300 WerFault.exe 199 5080 1208 WerFault.exe 204 5796 4764 WerFault.exe 209 476 2252 WerFault.exe 214 2584 5240 WerFault.exe 219 5660 4308 WerFault.exe 224 4900 696 WerFault.exe 229 5952 416 WerFault.exe 234 3628 3524 WerFault.exe 239 5644 5688 WerFault.exe 244 2908 5496 WerFault.exe 249 5912 4928 WerFault.exe 254 2572 1856 WerFault.exe 259 1568 200 WerFault.exe 264 4104 476 WerFault.exe 269 748 4980 WerFault.exe 274 992 2388 WerFault.exe 280 2256 4756 WerFault.exe 285 1044 5304 WerFault.exe 290 1184 3004 WerFault.exe 295 3664 1832 WerFault.exe 300 1152 2764 WerFault.exe 305 4076 3328 WerFault.exe 310 5056 2016 WerFault.exe 315 3736 1532 WerFault.exe 320 3724 4644 WerFault.exe 325 5848 884 WerFault.exe 330 1440 5208 WerFault.exe 335 5396 4564 WerFault.exe 340 4320 5484 WerFault.exe 345 2852 4808 WerFault.exe 350 1848 5828 WerFault.exe 355 1568 5992 WerFault.exe 360 3960 6020 WerFault.exe 365 4776 4380 WerFault.exe 370 5784 3968 WerFault.exe 375 5084 2640 WerFault.exe 380 5372 588 WerFault.exe 385 2904 3660 WerFault.exe 390 5912 5900 WerFault.exe 395 2808 984 WerFault.exe 400 1488 4652 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GJX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IAPRM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HVBA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XHOXBQM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CLJOR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RNIYHAW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JVAFJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FYDXI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VQICW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CBRO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FLTWY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AJKPZZR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AYNELF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BQQQNEQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EJPO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XMT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VUTH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ONPG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NFTRQBK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KYLLZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MAMI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZNCAI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language THWXU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DCAOXI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JQHR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YEHMMK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HYE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MQG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EYFWN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TJOHO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4828 2026-07-20_b63b6b6e1a3874c7047797f5345cc95e_elex_emotet_stop.exe 4828 2026-07-20_b63b6b6e1a3874c7047797f5345cc95e_elex_emotet_stop.exe 2848 YETXJ.exe 2848 YETXJ.exe 208 VUTH.exe 208 VUTH.exe 5148 NXD.exe 5148 NXD.exe 4252 EYFWN.exe 4252 EYFWN.exe 1704 XBJA.exe 1704 XBJA.exe 2368 CBRO.exe 2368 CBRO.exe 3784 GJX.exe 3784 GJX.exe 6064 BECXY.exe 6064 BECXY.exe 2728 CZOBLIA.exe 2728 CZOBLIA.exe 5220 EXTVTQ.exe 5220 EXTVTQ.exe 5176 GSY.exe 5176 GSY.exe 3876 ZNCAI.exe 3876 ZNCAI.exe 4328 IWEGML.exe 4328 IWEGML.exe 2140 JRIJZ.exe 2140 JRIJZ.exe 4208 YUR.exe 4208 YUR.exe 3824 THWXU.exe 3824 THWXU.exe 2148 TKABAMJ.exe 2148 TKABAMJ.exe 5172 EDPMJFR.exe 5172 EDPMJFR.exe 5964 WDR.exe 5964 WDR.exe 3936 FLTWY.exe 3936 FLTWY.exe 1508 UGDIJCW.exe 1508 UGDIJCW.exe 4300 PUIS.exe 4300 PUIS.exe 1208 KHMBEC.exe 1208 KHMBEC.exe 4764 IAPRM.exe 4764 IAPRM.exe 2252 SAR.exe 2252 SAR.exe 5240 HVBA.exe 5240 HVBA.exe 4308 HYE.exe 4308 HYE.exe 696 CLJOR.exe 696 CLJOR.exe 416 XHOXBQM.exe 416 XHOXBQM.exe 3524 TEU.exe 3524 TEU.exe 5688 DCAOXI.exe 5688 DCAOXI.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4828 2026-07-20_b63b6b6e1a3874c7047797f5345cc95e_elex_emotet_stop.exe 4828 2026-07-20_b63b6b6e1a3874c7047797f5345cc95e_elex_emotet_stop.exe 2848 YETXJ.exe 2848 YETXJ.exe 208 VUTH.exe 208 VUTH.exe 5148 NXD.exe 5148 NXD.exe 4252 EYFWN.exe 4252 EYFWN.exe 1704 XBJA.exe 1704 XBJA.exe 2368 CBRO.exe 2368 CBRO.exe 3784 GJX.exe 3784 GJX.exe 6064 BECXY.exe 6064 BECXY.exe 2728 CZOBLIA.exe 2728 CZOBLIA.exe 5220 EXTVTQ.exe 5220 EXTVTQ.exe 5176 GSY.exe 5176 GSY.exe 3876 ZNCAI.exe 3876 ZNCAI.exe 4328 IWEGML.exe 4328 IWEGML.exe 2140 JRIJZ.exe 2140 JRIJZ.exe 4208 YUR.exe 4208 YUR.exe 3824 THWXU.exe 3824 THWXU.exe 2148 TKABAMJ.exe 2148 TKABAMJ.exe 5172 EDPMJFR.exe 5172 EDPMJFR.exe 5964 WDR.exe 5964 WDR.exe 3936 FLTWY.exe 3936 FLTWY.exe 1508 UGDIJCW.exe 1508 UGDIJCW.exe 4300 PUIS.exe 4300 PUIS.exe 1208 KHMBEC.exe 1208 KHMBEC.exe 4764 IAPRM.exe 4764 IAPRM.exe 2252 SAR.exe 2252 SAR.exe 5240 HVBA.exe 5240 HVBA.exe 4308 HYE.exe 4308 HYE.exe 696 CLJOR.exe 696 CLJOR.exe 416 XHOXBQM.exe 416 XHOXBQM.exe 3524 TEU.exe 3524 TEU.exe 5688 DCAOXI.exe 5688 DCAOXI.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4828 wrote to memory of 3924 4828 2026-07-20_b63b6b6e1a3874c7047797f5345cc95e_elex_emotet_stop.exe 89 PID 3924 wrote to memory of 2848 3924 cmd.exe 93 PID 2848 wrote to memory of 4344 2848 YETXJ.exe 95 PID 4344 wrote to memory of 208 4344 cmd.exe 99 PID 208 wrote to memory of 5892 208 VUTH.exe 100 PID 5892 wrote to memory of 5148 5892 cmd.exe 104 PID 5148 wrote to memory of 2508 5148 NXD.exe 105 PID 2508 wrote to memory of 4252 2508 cmd.exe 109 PID 4252 wrote to memory of 4976 4252 EYFWN.exe 110 PID 4976 wrote to memory of 1704 4976 cmd.exe 114 PID 1704 wrote to memory of 1388 1704 XBJA.exe 115 PID 1388 wrote to memory of 2368 1388 cmd.exe 119 PID 2368 wrote to memory of 2724 2368 CBRO.exe 120 PID 2724 wrote to memory of 3784 2724 cmd.exe 124 PID 3784 wrote to memory of 2892 3784 GJX.exe 125 PID 2892 wrote to memory of 6064 2892 cmd.exe 129 PID 6064 wrote to memory of 2364 6064 BECXY.exe 130 PID 2364 wrote to memory of 2728 2364 cmd.exe 134 PID 2728 wrote to memory of 3688 2728 CZOBLIA.exe 135 PID 3688 wrote to memory of 5220 3688 cmd.exe 139 PID 5220 wrote to memory of 2972 5220 EXTVTQ.exe 140 PID 2972 wrote to memory of 5176 2972 cmd.exe 144 PID 5176 wrote to memory of 6028 5176 GSY.exe 145 PID 6028 wrote to memory of 3876 6028 cmd.exe 149 PID 3876 wrote to memory of 5040 3876 ZNCAI.exe 150 PID 5040 wrote to memory of 4328 5040 cmd.exe 154 PID 4328 wrote to memory of 784 4328 IWEGML.exe 155 PID 784 wrote to memory of 2140 784 cmd.exe 159 PID 2140 wrote to memory of 1484 2140 JRIJZ.exe 160 PID 1484 wrote to memory of 4208 1484 cmd.exe 164 PID 4208 wrote to memory of 4060 4208 YUR.exe 165 PID 4060 wrote to memory of 3824 4060 cmd.exe 169 PID 3824 wrote to memory of 3388 3824 THWXU.exe 170 PID 3388 wrote to memory of 2148 3388 cmd.exe 174 PID 2148 wrote to memory of 568 2148 TKABAMJ.exe 175 PID 568 wrote to memory of 5172 568 cmd.exe 179 PID 5172 wrote to memory of 4740 5172 EDPMJFR.exe 180 PID 4740 wrote to memory of 5964 4740 cmd.exe 184 PID 5964 wrote to memory of 5540 5964 WDR.exe 185 PID 5540 wrote to memory of 3936 5540 cmd.exe 189 PID 3936 wrote to memory of 3372 3936 FLTWY.exe 190 PID 3372 wrote to memory of 1508 3372 cmd.exe 194 PID 1508 wrote to memory of 1600 1508 UGDIJCW.exe 195 PID 1600 wrote to memory of 4300 1600 cmd.exe 199 PID 4300 wrote to memory of 5756 4300 PUIS.exe 200 PID 5756 wrote to memory of 1208 5756 cmd.exe 204 PID 1208 wrote to memory of 4824 1208 KHMBEC.exe 205 PID 4824 wrote to memory of 4764 4824 cmd.exe 209 PID 4764 wrote to memory of 5004 4764 IAPRM.exe 210 PID 5004 wrote to memory of 2252 5004 cmd.exe 214 PID 2252 wrote to memory of 2664 2252 SAR.exe 215 PID 2664 wrote to memory of 5240 2664 cmd.exe 219 PID 5240 wrote to memory of 3668 5240 HVBA.exe 220 PID 3668 wrote to memory of 4308 3668 cmd.exe 224 PID 4308 wrote to memory of 1432 4308 HYE.exe 225 PID 1432 wrote to memory of 696 1432 cmd.exe 229 PID 696 wrote to memory of 2632 696 CLJOR.exe 230 PID 2632 wrote to memory of 416 2632 cmd.exe 234 PID 416 wrote to memory of 3836 416 XHOXBQM.exe 235 PID 3836 wrote to memory of 3524 3836 cmd.exe 239 PID 3524 wrote to memory of 3880 3524 TEU.exe 240 PID 3880 wrote to memory of 5688 3880 cmd.exe 244 PID 5688 wrote to memory of 2756 5688 DCAOXI.exe 245 PID 2756 wrote to memory of 5496 2756 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_b63b6b6e1a3874c7047797f5345cc95e_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-20_b63b6b6e1a3874c7047797f5345cc95e_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YETXJ.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\windows\SysWOW64\YETXJ.exeC:\windows\system32\YETXJ.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VUTH.exe.bat" "4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\windows\VUTH.exeC:\windows\VUTH.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NXD.exe.bat" "6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5892 -
C:\windows\NXD.exeC:\windows\NXD.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5148 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EYFWN.exe.bat" "8⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\windows\SysWOW64\EYFWN.exeC:\windows\system32\EYFWN.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XBJA.exe.bat" "10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\windows\XBJA.exeC:\windows\XBJA.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CBRO.exe.bat" "12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\windows\SysWOW64\CBRO.exeC:\windows\system32\CBRO.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GJX.exe.bat" "14⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\windows\GJX.exeC:\windows\GJX.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3784 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BECXY.exe.bat" "16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\windows\SysWOW64\BECXY.exeC:\windows\system32\BECXY.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CZOBLIA.exe.bat" "18⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\windows\system\CZOBLIA.exeC:\windows\system\CZOBLIA.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EXTVTQ.exe.bat" "20⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3688 -
C:\windows\SysWOW64\EXTVTQ.exeC:\windows\system32\EXTVTQ.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5220 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GSY.exe.bat" "22⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\windows\SysWOW64\GSY.exeC:\windows\system32\GSY.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5176 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZNCAI.exe.bat" "24⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6028 -
C:\windows\SysWOW64\ZNCAI.exeC:\windows\system32\ZNCAI.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IWEGML.exe.bat" "26⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\windows\IWEGML.exeC:\windows\IWEGML.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JRIJZ.exe.bat" "28⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:784 -
C:\windows\system\JRIJZ.exeC:\windows\system\JRIJZ.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YUR.exe.bat" "30⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\windows\YUR.exeC:\windows\YUR.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\THWXU.exe.bat" "32⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\windows\THWXU.exeC:\windows\THWXU.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TKABAMJ.exe.bat" "34⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\windows\SysWOW64\TKABAMJ.exeC:\windows\system32\TKABAMJ.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EDPMJFR.exe.bat" "36⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:568 -
C:\windows\EDPMJFR.exeC:\windows\EDPMJFR.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5172 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WDR.exe.bat" "38⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\windows\WDR.exeC:\windows\WDR.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FLTWY.exe.bat" "40⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5540 -
C:\windows\system\FLTWY.exeC:\windows\system\FLTWY.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UGDIJCW.exe.bat" "42⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\windows\system\UGDIJCW.exeC:\windows\system\UGDIJCW.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PUIS.exe.bat" "44⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\windows\PUIS.exeC:\windows\PUIS.exe45⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KHMBEC.exe.bat" "46⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5756 -
C:\windows\system\KHMBEC.exeC:\windows\system\KHMBEC.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IAPRM.exe.bat" "48⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\windows\SysWOW64\IAPRM.exeC:\windows\system32\IAPRM.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SAR.exe.bat" "50⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\windows\SysWOW64\SAR.exeC:\windows\system32\SAR.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HVBA.exe.bat" "52⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\windows\SysWOW64\HVBA.exeC:\windows\system32\HVBA.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HYE.exe.bat" "54⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\windows\HYE.exeC:\windows\HYE.exe55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CLJOR.exe.bat" "56⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\windows\system\CLJOR.exeC:\windows\system\CLJOR.exe57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XHOXBQM.exe.bat" "58⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\windows\XHOXBQM.exeC:\windows\XHOXBQM.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TEU.exe.bat" "60⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3836 -
C:\windows\system\TEU.exeC:\windows\system\TEU.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DCAOXI.exe.bat" "62⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\windows\SysWOW64\DCAOXI.exeC:\windows\system32\DCAOXI.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DQADZNZ.exe.bat" "64⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\windows\system\DQADZNZ.exeC:\windows\system\DQADZNZ.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JQHR.exe.bat" "66⤵
- Executes a command shell one-liner
PID:4568 -
C:\windows\JQHR.exeC:\windows\JQHR.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JVAFJ.exe.bat" "68⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5696 -
C:\windows\JVAFJ.exeC:\windows\JVAFJ.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AJKPZZR.exe.bat" "70⤵
- Executes a command shell one-liner
PID:1712 -
C:\windows\SysWOW64\AJKPZZR.exeC:\windows\system32\AJKPZZR.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AOK.exe.bat" "72⤵
- Executes a command shell one-liner
PID:5180 -
C:\windows\SysWOW64\AOK.exeC:\windows\system32\AOK.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TJOHO.exe.bat" "74⤵
- Executes a command shell one-liner
PID:6132 -
C:\windows\system\TJOHO.exeC:\windows\system\TJOHO.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NFTRQBK.exe.bat" "76⤵
- Executes a command shell one-liner
PID:5700 -
C:\windows\system\NFTRQBK.exeC:\windows\system\NFTRQBK.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2388 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FKDJ.exe.bat" "78⤵
- Executes a command shell one-liner
PID:2276 -
C:\windows\system\FKDJ.exeC:\windows\system\FKDJ.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FYDXI.exe.bat" "80⤵
- Executes a command shell one-liner
PID:2080 -
C:\windows\FYDXI.exeC:\windows\FYDXI.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KYLLZ.exe.bat" "82⤵
- Executes a command shell one-liner
PID:5584 -
C:\windows\SysWOW64\KYLLZ.exeC:\windows\system32\KYLLZ.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OGSLD.exe.bat" "84⤵
- Executes a command shell one-liner
PID:2716 -
C:\windows\system\OGSLD.exeC:\windows\system\OGSLD.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AYNELF.exe.bat" "86⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2548 -
C:\windows\SysWOW64\AYNELF.exeC:\windows\system32\AYNELF.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RHPJPCI.exe.bat" "88⤵PID:5272
-
C:\windows\SysWOW64\RHPJPCI.exeC:\windows\system32\RHPJPCI.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3328 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XHWWG.exe.bat" "90⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2732 -
C:\windows\XHWWG.exeC:\windows\XHWWG.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BPDFKXX.exe.bat" "92⤵
- System Location Discovery: System Language Discovery
PID:4884 -
C:\windows\SysWOW64\BPDFKXX.exeC:\windows\system32\BPDFKXX.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VCIO.exe.bat" "94⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5552 -
C:\windows\system\VCIO.exeC:\windows\system\VCIO.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VQICW.exe.bat" "96⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5660 -
C:\windows\system\VQICW.exeC:\windows\system\VQICW.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BQQQNEQ.exe.bat" "98⤵
- Executes a command shell one-liner
PID:1868 -
C:\windows\system\BQQQNEQ.exeC:\windows\system\BQQQNEQ.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HQXEWGZ.exe.bat" "100⤵
- Executes a command shell one-liner
PID:1292 -
C:\windows\system\HQXEWGZ.exeC:\windows\system\HQXEWGZ.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CECN.exe.bat" "102⤵
- Executes a command shell one-liner
PID:6124 -
C:\windows\SysWOW64\CECN.exeC:\windows\system32\CECN.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5484 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CZG.exe.bat" "104⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4360 -
C:\windows\CZG.exeC:\windows\CZG.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ORJC.exe.bat" "106⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2280 -
C:\windows\system\ORJC.exeC:\windows\system\ORJC.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RHPKGV.exe.bat" "108⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2696 -
C:\windows\system\RHPKGV.exeC:\windows\system\RHPKGV.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RNIYHAW.exe.bat" "110⤵
- Executes a command shell one-liner
PID:4076 -
C:\windows\RNIYHAW.exeC:\windows\RNIYHAW.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6020 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MAMI.exe.bat" "112⤵
- Executes a command shell one-liner
PID:3168 -
C:\windows\system\MAMI.exeC:\windows\system\MAMI.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QQTIWT.exe.bat" "114⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4216 -
C:\windows\system\QQTIWT.exeC:\windows\system\QQTIWT.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WRBV.exe.bat" "116⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3216 -
C:\windows\WRBV.exeC:\windows\WRBV.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SWG.exe.bat" "118⤵
- Executes a command shell one-liner
PID:3844 -
C:\windows\SysWOW64\SWG.exeC:\windows\system32\SWG.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:588 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YKGTZA.exe.bat" "120⤵
- Executes a command shell one-liner
PID:5356 -
C:\windows\SysWOW64\YKGTZA.exeC:\windows\system32\YKGTZA.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3660
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-