Analysis
- max time kernel
88s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/07/2026, 15:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-20_64d1f94fed09d1ecb21887579fc00585_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-07-20_64d1f94fed09d1ecb21887579fc00585_elex_emotet_stop.exe
- Size 208KB
- Sample260720-tclwmsft3j
- SHA256 0485e555867b4d44e36dc65da9ef4d6a96f95e0c16e1ca564443c2be0ce23bf9
- MD5 64d1f94fed09d1ecb21887579fc00585
- SHA1 c403f3fa1684b859d788a80db6986608ba7f7b84
- SHA512 71844323cf069529c0db66a4855379ba45b169a427062311c8e2e402796170c1f012d93e69f26d980efac319ec4599a86f7d2bd8fdf667c6198ce2bb483b6ebb
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbclcdL+LOfi4NLthEjQT6j:MlZtbLWIgd1LZ9oECZbclc5+LO6QEj1
- TLSH T12A247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4080 XRRTUJP.exe 2008 REKSIW.exe 6132 SHO.exe 4088 FKX.exe 5136 GNAIH.exe 5080 PWCVTK.exe 2632 JJH.exe 996 FUQ.exe 1240 ZHVMU.exe 3708 JHXRXS.exe 2380 NXD.exe 5672 CNERQGY.exe 4584 XBJA.exe 4672 KLZZGII.exe 1376 BMB.exe 5116 WZGNU.exe 4128 LCQ.exe 1504 ASRRUW.exe 4180 EAX.exe 1300 OIZWJ.exe 4372 FJOBWDP.exe 4844 GMRX.exe 1100 VHBJNFZ.exe 5276 GZE.exe 4836 PIGH.exe 1812 BABAH.exe 5832 GAJ.exe 4772 YBLT.exe 1804 CRRTFR.exe 1252 YOX.exe 5956 RRBMA.exe 6096 ECJ.exe 4944 ZPOUQ.exe 5500 FLNDVXB.exe 5744 JTUDH.exe 1860 ULXVPW.exe 5888 AME.exe 1384 GMMXIB.exe 5736 GSMLJG.exe 4488 ANR.exe 4872 DAOEE.exe 5988 BAWSN.exe 3960 SBY.exe 6028 LBNIHGY.exe 5756 EWRMN.exe 4800 ZKWVXWX.exe 1736 DACVJ.exe 2160 SQD.exe 3804 HLNZBW.exe 2496 XBOYISX.exe 5076 PEZUNI.exe 1120 VEH.exe 764 MEBVA.exe 2164 QUQVMAY.exe 2940 PFTLVG.exe 2640 EACP.exe 1492 OJEUR.exe 1192 OEIYXOG.exe 1136 HHMUCE.exe 2372 YUWMSAE.exe 820 FKXLY.exe 2456 CQDIFGU.exe 3488 TQF.exe 1872 CDPF.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\CLKNNPP.exe TDIIKS.exe File created C:\windows\SysWOW64\REKSIW.exe XRRTUJP.exe File created C:\windows\SysWOW64\VHBJNFZ.exe GMRX.exe File opened for modification C:\windows\SysWOW64\PIGH.exe GZE.exe File opened for modification C:\windows\SysWOW64\XQUPJZ.exe CDPF.exe File created C:\windows\SysWOW64\IKSPV.exe.bat WRPE.exe File created C:\windows\SysWOW64\ECJ.exe.bat RRBMA.exe File created C:\windows\SysWOW64\SQD.exe.bat DACVJ.exe File opened for modification C:\windows\SysWOW64\CYDRXYU.exe TQBMUA.exe File created C:\windows\SysWOW64\VALANWA.exe.bat DSJVBY.exe File opened for modification C:\windows\SysWOW64\UAFHJ.exe ANA.exe File opened for modification C:\windows\SysWOW64\GSBI.exe ORZDPYU.exe File opened for modification C:\windows\SysWOW64\KLZZGII.exe XBJA.exe File created C:\windows\SysWOW64\SQD.exe DACVJ.exe File opened for modification C:\windows\SysWOW64\SQD.exe DACVJ.exe File opened for modification C:\windows\SysWOW64\TDNIWJ.exe IKSPV.exe File created C:\windows\SysWOW64\TDNIWJ.exe.bat IKSPV.exe File created C:\windows\SysWOW64\FUQ.exe JJH.exe File created C:\windows\SysWOW64\ECJ.exe RRBMA.exe File opened for modification C:\windows\SysWOW64\OJEUR.exe EACP.exe File created C:\windows\SysWOW64\NJVIYI.exe YOM.exe File created C:\windows\SysWOW64\DSJVBY.exe.bat GSBI.exe File created C:\windows\SysWOW64\BAWSN.exe.bat DAOEE.exe File created C:\windows\SysWOW64\ZKWVXWX.exe.bat EWRMN.exe File created C:\windows\SysWOW64\XQUPJZ.exe.bat CDPF.exe File created C:\windows\SysWOW64\SULW.exe.bat MTDJCBO.exe File opened for modification C:\windows\SysWOW64\CLKNNPP.exe TDIIKS.exe File created C:\windows\SysWOW64\REKSIW.exe.bat XRRTUJP.exe File opened for modification C:\windows\SysWOW64\RRBMA.exe YOX.exe File created C:\windows\SysWOW64\BAWSN.exe DAOEE.exe File created C:\windows\SysWOW64\EVQBE.exe TDNIWJ.exe File created C:\windows\SysWOW64\OEN.exe.bat CLKNNPP.exe File created C:\windows\SysWOW64\HLNZBW.exe.bat SQD.exe File created C:\windows\SysWOW64\OFRIC.exe DMO.exe File opened for modification C:\windows\SysWOW64\OFRIC.exe DMO.exe File created C:\windows\SysWOW64\RRBMA.exe.bat YOX.exe File created C:\windows\SysWOW64\BWDC.exe.bat KOB.exe File created C:\windows\SysWOW64\ULXVPW.exe JTUDH.exe File created C:\windows\SysWOW64\CYDRXYU.exe.bat TQBMUA.exe File opened for modification C:\windows\SysWOW64\YOM.exe STNVI.exe File created C:\windows\SysWOW64\NJVIYI.exe.bat YOM.exe File created C:\windows\SysWOW64\GSBI.exe ORZDPYU.exe File created C:\windows\SysWOW64\KVUNY.exe VALANWA.exe File created C:\windows\SysWOW64\KVUNY.exe.bat VALANWA.exe File created C:\windows\SysWOW64\OJEUR.exe.bat EACP.exe File opened for modification C:\windows\SysWOW64\BWDC.exe KOB.exe File opened for modification C:\windows\SysWOW64\ECJ.exe RRBMA.exe File created C:\windows\SysWOW64\ZPOUQ.exe ECJ.exe File opened for modification C:\windows\SysWOW64\ZPOUQ.exe ECJ.exe File created C:\windows\SysWOW64\CLKNNPP.exe.bat TDIIKS.exe File created C:\windows\SysWOW64\RRBMA.exe YOX.exe File created C:\windows\SysWOW64\XQUPJZ.exe CDPF.exe File created C:\windows\SysWOW64\YOM.exe STNVI.exe File created C:\windows\SysWOW64\VHBJNFZ.exe.bat GMRX.exe File created C:\windows\SysWOW64\CYDRXYU.exe TQBMUA.exe File opened for modification C:\windows\SysWOW64\KVUNY.exe VALANWA.exe File created C:\windows\SysWOW64\XRRTUJP.exe 2026-07-20_64d1f94fed09d1ecb21887579fc00585_elex_emotet_stop.exe File created C:\windows\SysWOW64\ZKWVXWX.exe EWRMN.exe File created C:\windows\SysWOW64\MEBVA.exe VEH.exe File created C:\windows\SysWOW64\CQDIFGU.exe FKXLY.exe File created C:\windows\SysWOW64\IKSPV.exe WRPE.exe File created C:\windows\SysWOW64\VALANWA.exe DSJVBY.exe File opened for modification C:\windows\SysWOW64\SHO.exe REKSIW.exe File opened for modification C:\windows\SysWOW64\VHBJNFZ.exe GMRX.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\WRPE.exe HWGSCA.exe File created C:\windows\system\CKP.exe.bat KKNUJ.exe File opened for modification C:\windows\system\GAJ.exe BABAH.exe File created C:\windows\DACVJ.exe.bat ZKWVXWX.exe File created C:\windows\system\PEZUNI.exe.bat XBOYISX.exe File created C:\windows\HHMUCE.exe.bat OEIYXOG.exe File created C:\windows\system\DYVA.exe.bat IKQQZNC.exe File created C:\windows\QOEN.exe DLNO.exe File created C:\windows\XBJA.exe CNERQGY.exe File opened for modification C:\windows\GMRX.exe FJOBWDP.exe File created C:\windows\system\ANR.exe GSMLJG.exe File created C:\windows\QUQVMAY.exe.bat MEBVA.exe File opened for modification C:\windows\DMO.exe SULW.exe File created C:\windows\TDIIKS.exe.bat ZQDY.exe File created C:\windows\system\KAOA.exe AAMVSNG.exe File created C:\windows\system\KAOA.exe.bat AAMVSNG.exe File created C:\windows\system\BOZS.exe KAOA.exe File created C:\windows\system\JJH.exe.bat PWCVTK.exe File opened for modification C:\windows\system\GSMLJG.exe GMMXIB.exe File created C:\windows\BABAH.exe PIGH.exe File opened for modification C:\windows\YBLT.exe GAJ.exe File opened for modification C:\windows\system\FKXLY.exe YUWMSAE.exe File created C:\windows\TQF.exe.bat CQDIFGU.exe File created C:\windows\system\TQBMUA.exe.bat CPZZI.exe File created C:\windows\system\BOZS.exe.bat KAOA.exe File created C:\windows\system\SHDCZP.exe DMTP.exe File created C:\windows\DLNO.exe.bat DYVA.exe File created C:\windows\HWGSCA.exe.bat QOEN.exe File opened for modification C:\windows\system\ANA.exe ZKWU.exe File created C:\windows\LCQ.exe WZGNU.exe File created C:\windows\system\ASRRUW.exe LCQ.exe File created C:\windows\YBLT.exe GAJ.exe File opened for modification C:\windows\QUQVMAY.exe MEBVA.exe File created C:\windows\system\FKXLY.exe YUWMSAE.exe File created C:\windows\system\YCCCDSN.exe SHDCZP.exe File created C:\windows\QOEN.exe.bat DLNO.exe File created C:\windows\system\PEZUNI.exe XBOYISX.exe File opened for modification C:\windows\system\YCCCDSN.exe SHDCZP.exe File created C:\windows\HWGSCA.exe QOEN.exe File opened for modification C:\windows\system\WRPE.exe HWGSCA.exe File opened for modification C:\windows\system\AAMVSNG.exe UAFHJ.exe File created C:\windows\PFTLVG.exe QUQVMAY.exe File opened for modification C:\windows\system\NCWKDN.exe CKP.exe File opened for modification C:\windows\system\PEZUNI.exe XBOYISX.exe File created C:\windows\system\BMB.exe KLZZGII.exe File created C:\windows\GZE.exe.bat VHBJNFZ.exe File created C:\windows\system\LBNIHGY.exe.bat SBY.exe File created C:\windows\system\EWRMN.exe.bat LBNIHGY.exe File created C:\windows\system\YUWMSAE.exe HHMUCE.exe File created C:\windows\system\ZEEG.exe FJZWIQP.exe File opened for modification C:\windows\LCQ.exe WZGNU.exe File created C:\windows\FLNDVXB.exe.bat ZPOUQ.exe File created C:\windows\VEH.exe.bat PEZUNI.exe File created C:\windows\IKQQZNC.exe TPHM.exe File opened for modification C:\windows\system\CPZZI.exe OFRIC.exe File created C:\windows\XBJA.exe.bat CNERQGY.exe File opened for modification C:\windows\system\CRRTFR.exe YBLT.exe File created C:\windows\system\YCCCDSN.exe.bat SHDCZP.exe File opened for modification C:\windows\system\DZWKGR.exe OEN.exe File created C:\windows\system\KKNUJ.exe BWDC.exe File created C:\windows\ZHVMU.exe.bat FUQ.exe File created C:\windows\SBY.exe BAWSN.exe File opened for modification C:\windows\XBOYISX.exe HLNZBW.exe File opened for modification C:\windows\DLNO.exe DYVA.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3484 cmd.exe 5968 cmd.exe 5652 cmd.exe 4416 cmd.exe 2072 cmd.exe 3884 cmd.exe 4304 cmd.exe 2796 cmd.exe 2808 cmd.exe 960 cmd.exe 1592 cmd.exe 5940 cmd.exe 3876 cmd.exe 5272 cmd.exe 1272 cmd.exe 4480 cmd.exe 3904 cmd.exe 5316 cmd.exe 5664 cmd.exe 3476 cmd.exe 4356 cmd.exe 5264 cmd.exe 4236 cmd.exe 2376 cmd.exe 1128 cmd.exe 5000 cmd.exe 4552 cmd.exe 5156 cmd.exe 5368 cmd.exe 2400 cmd.exe 4092 cmd.exe 3112 cmd.exe 604 cmd.exe 2644 cmd.exe 1520 cmd.exe 1080 cmd.exe 4616 cmd.exe 4556 cmd.exe 2680 cmd.exe 4892 cmd.exe 3916 cmd.exe 4628 cmd.exe 5464 cmd.exe 3592 cmd.exe 4172 cmd.exe 2108 cmd.exe 3164 cmd.exe 5152 cmd.exe 5512 cmd.exe 4512 cmd.exe 5824 cmd.exe 2392 cmd.exe 4632 cmd.exe 4760 cmd.exe 4880 cmd.exe 1220 cmd.exe 4636 cmd.exe 2568 cmd.exe 2856 cmd.exe 5604 cmd.exe 3860 cmd.exe 4124 cmd.exe 2788 cmd.exe 2936 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 5480 4900 WerFault.exe 88 3028 4080 WerFault.exe 94 4964 2008 WerFault.exe 100 5936 6132 WerFault.exe 105 1812 4088 WerFault.exe 110 1200 5136 WerFault.exe 115 3408 5080 WerFault.exe 120 3060 2632 WerFault.exe 125 4488 996 WerFault.exe 130 1488 1240 WerFault.exe 135 5668 3708 WerFault.exe 140 4428 2380 WerFault.exe 145 1748 5672 WerFault.exe 149 4964 4584 WerFault.exe 155 4492 4672 WerFault.exe 160 4620 1376 WerFault.exe 165 2768 5116 WerFault.exe 170 2864 4128 WerFault.exe 175 1972 1504 WerFault.exe 180 4184 4180 WerFault.exe 185 4548 1300 WerFault.exe 190 3016 4372 WerFault.exe 195 2252 4844 WerFault.exe 200 5920 1100 WerFault.exe 205 1940 5276 WerFault.exe 210 3328 4836 WerFault.exe 215 3772 1812 WerFault.exe 220 4196 5832 WerFault.exe 225 3976 4772 WerFault.exe 230 4184 1804 WerFault.exe 235 4132 1252 WerFault.exe 240 4188 5956 WerFault.exe 245 4416 6096 WerFault.exe 250 5920 4944 WerFault.exe 255 2724 5500 WerFault.exe 260 2944 5744 WerFault.exe 265 4304 1860 WerFault.exe 270 4276 5888 WerFault.exe 275 5456 1384 WerFault.exe 280 1900 5736 WerFault.exe 285 5244 4488 WerFault.exe 290 5368 4872 WerFault.exe 295 5884 5988 WerFault.exe 300 2232 3960 WerFault.exe 305 5924 6028 WerFault.exe 310 1232 5756 WerFault.exe 315 2808 4800 WerFault.exe 320 624 1736 WerFault.exe 325 200 2160 WerFault.exe 330 5124 3804 WerFault.exe 335 2984 2496 WerFault.exe 340 1724 5076 WerFault.exe 345 2456 1120 WerFault.exe 350 708 764 WerFault.exe 355 2748 2164 WerFault.exe 360 4780 2940 WerFault.exe 365 4732 2640 WerFault.exe 370 4156 1492 WerFault.exe 375 5752 1192 WerFault.exe 380 4324 1136 WerFault.exe 385 1268 2372 WerFault.exe 390 5132 820 WerFault.exe 395 2580 2456 WerFault.exe 400 3632 3488 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TQBMUA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SQD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ORZDPYU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EWRMN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XQUPJZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REKSIW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NXD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VALANWA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CYDRXYU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RRBMA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZQDY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XBJA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QUQVMAY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FJOBWDP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GAJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YOM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EACP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language STNVI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XBOYISX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SULW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CLKNNPP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YBLT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OEIYXOG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IKQQZNC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4900 2026-07-20_64d1f94fed09d1ecb21887579fc00585_elex_emotet_stop.exe 4900 2026-07-20_64d1f94fed09d1ecb21887579fc00585_elex_emotet_stop.exe 4080 XRRTUJP.exe 4080 XRRTUJP.exe 2008 REKSIW.exe 2008 REKSIW.exe 6132 SHO.exe 6132 SHO.exe 4088 FKX.exe 4088 FKX.exe 5136 GNAIH.exe 5136 GNAIH.exe 5080 PWCVTK.exe 5080 PWCVTK.exe 2632 JJH.exe 2632 JJH.exe 996 FUQ.exe 996 FUQ.exe 1240 ZHVMU.exe 1240 ZHVMU.exe 3708 JHXRXS.exe 3708 JHXRXS.exe 2380 NXD.exe 2380 NXD.exe 5672 CNERQGY.exe 5672 CNERQGY.exe 4584 XBJA.exe 4584 XBJA.exe 4672 KLZZGII.exe 4672 KLZZGII.exe 1376 BMB.exe 1376 BMB.exe 5116 WZGNU.exe 5116 WZGNU.exe 4128 LCQ.exe 4128 LCQ.exe 1504 ASRRUW.exe 1504 ASRRUW.exe 4180 EAX.exe 4180 EAX.exe 1300 OIZWJ.exe 1300 OIZWJ.exe 4372 FJOBWDP.exe 4372 FJOBWDP.exe 4844 GMRX.exe 4844 GMRX.exe 1100 VHBJNFZ.exe 1100 VHBJNFZ.exe 5276 GZE.exe 5276 GZE.exe 4836 PIGH.exe 4836 PIGH.exe 1812 BABAH.exe 1812 BABAH.exe 5832 GAJ.exe 5832 GAJ.exe 4772 YBLT.exe 4772 YBLT.exe 1804 CRRTFR.exe 1804 CRRTFR.exe 1252 YOX.exe 1252 YOX.exe 5956 RRBMA.exe 5956 RRBMA.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4900 2026-07-20_64d1f94fed09d1ecb21887579fc00585_elex_emotet_stop.exe 4900 2026-07-20_64d1f94fed09d1ecb21887579fc00585_elex_emotet_stop.exe 4080 XRRTUJP.exe 4080 XRRTUJP.exe 2008 REKSIW.exe 2008 REKSIW.exe 6132 SHO.exe 6132 SHO.exe 4088 FKX.exe 4088 FKX.exe 5136 GNAIH.exe 5136 GNAIH.exe 5080 PWCVTK.exe 5080 PWCVTK.exe 2632 JJH.exe 2632 JJH.exe 996 FUQ.exe 996 FUQ.exe 1240 ZHVMU.exe 1240 ZHVMU.exe 3708 JHXRXS.exe 3708 JHXRXS.exe 2380 NXD.exe 2380 NXD.exe 5672 CNERQGY.exe 5672 CNERQGY.exe 4584 XBJA.exe 4584 XBJA.exe 4672 KLZZGII.exe 4672 KLZZGII.exe 1376 BMB.exe 1376 BMB.exe 5116 WZGNU.exe 5116 WZGNU.exe 4128 LCQ.exe 4128 LCQ.exe 1504 ASRRUW.exe 1504 ASRRUW.exe 4180 EAX.exe 4180 EAX.exe 1300 OIZWJ.exe 1300 OIZWJ.exe 4372 FJOBWDP.exe 4372 FJOBWDP.exe 4844 GMRX.exe 4844 GMRX.exe 1100 VHBJNFZ.exe 1100 VHBJNFZ.exe 5276 GZE.exe 5276 GZE.exe 4836 PIGH.exe 4836 PIGH.exe 1812 BABAH.exe 1812 BABAH.exe 5832 GAJ.exe 5832 GAJ.exe 4772 YBLT.exe 4772 YBLT.exe 1804 CRRTFR.exe 1804 CRRTFR.exe 1252 YOX.exe 1252 YOX.exe 5956 RRBMA.exe 5956 RRBMA.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4900 wrote to memory of 960 4900 2026-07-20_64d1f94fed09d1ecb21887579fc00585_elex_emotet_stop.exe 90 PID 960 wrote to memory of 4080 960 cmd.exe 94 PID 4080 wrote to memory of 4952 4080 XRRTUJP.exe 96 PID 4952 wrote to memory of 2008 4952 cmd.exe 100 PID 2008 wrote to memory of 4124 2008 REKSIW.exe 101 PID 4124 wrote to memory of 6132 4124 cmd.exe 105 PID 6132 wrote to memory of 1892 6132 SHO.exe 106 PID 1892 wrote to memory of 4088 1892 cmd.exe 110 PID 4088 wrote to memory of 5220 4088 FKX.exe 111 PID 5220 wrote to memory of 5136 5220 cmd.exe 115 PID 5136 wrote to memory of 1592 5136 GNAIH.exe 116 PID 1592 wrote to memory of 5080 1592 cmd.exe 120 PID 5080 wrote to memory of 4760 5080 PWCVTK.exe 121 PID 4760 wrote to memory of 2632 4760 cmd.exe 125 PID 2632 wrote to memory of 3704 2632 JJH.exe 126 PID 3704 wrote to memory of 996 3704 cmd.exe 130 PID 996 wrote to memory of 4312 996 FUQ.exe 131 PID 4312 wrote to memory of 1240 4312 cmd.exe 135 PID 1240 wrote to memory of 4880 1240 ZHVMU.exe 136 PID 4880 wrote to memory of 3708 4880 cmd.exe 140 PID 3708 wrote to memory of 5268 3708 JHXRXS.exe 141 PID 5268 wrote to memory of 2380 5268 cmd.exe 145 PID 2380 wrote to memory of 4512 2380 NXD.exe 146 PID 4512 wrote to memory of 5672 4512 cmd.exe 149 PID 5672 wrote to memory of 2732 5672 CNERQGY.exe 151 PID 2732 wrote to memory of 4584 2732 cmd.exe 155 PID 4584 wrote to memory of 3264 4584 XBJA.exe 156 PID 3264 wrote to memory of 4672 3264 cmd.exe 160 PID 4672 wrote to memory of 5476 4672 KLZZGII.exe 161 PID 5476 wrote to memory of 1376 5476 cmd.exe 165 PID 1376 wrote to memory of 4144 1376 BMB.exe 166 PID 4144 wrote to memory of 5116 4144 cmd.exe 170 PID 5116 wrote to memory of 5264 5116 WZGNU.exe 171 PID 5264 wrote to memory of 4128 5264 cmd.exe 175 PID 4128 wrote to memory of 4992 4128 LCQ.exe 176 PID 4992 wrote to memory of 1504 4992 cmd.exe 180 PID 1504 wrote to memory of 4552 1504 ASRRUW.exe 181 PID 4552 wrote to memory of 4180 4552 cmd.exe 185 PID 4180 wrote to memory of 5364 4180 EAX.exe 186 PID 5364 wrote to memory of 1300 5364 cmd.exe 190 PID 1300 wrote to memory of 1488 1300 OIZWJ.exe 191 PID 1488 wrote to memory of 4372 1488 cmd.exe 195 PID 4372 wrote to memory of 3440 4372 FJOBWDP.exe 196 PID 3440 wrote to memory of 4844 3440 cmd.exe 200 PID 4844 wrote to memory of 5656 4844 GMRX.exe 201 PID 5656 wrote to memory of 1100 5656 cmd.exe 205 PID 1100 wrote to memory of 2328 1100 VHBJNFZ.exe 206 PID 2328 wrote to memory of 5276 2328 cmd.exe 210 PID 5276 wrote to memory of 1744 5276 GZE.exe 211 PID 1744 wrote to memory of 4836 1744 cmd.exe 215 PID 4836 wrote to memory of 2300 4836 PIGH.exe 216 PID 2300 wrote to memory of 1812 2300 cmd.exe 220 PID 1812 wrote to memory of 5060 1812 BABAH.exe 221 PID 5060 wrote to memory of 5832 5060 cmd.exe 225 PID 5832 wrote to memory of 4616 5832 GAJ.exe 226 PID 4616 wrote to memory of 4772 4616 cmd.exe 230 PID 4772 wrote to memory of 1720 4772 YBLT.exe 231 PID 1720 wrote to memory of 1804 1720 cmd.exe 235 PID 1804 wrote to memory of 3516 1804 CRRTFR.exe 236 PID 3516 wrote to memory of 1252 3516 cmd.exe 240 PID 1252 wrote to memory of 3644 1252 YOX.exe 241 PID 3644 wrote to memory of 5956 3644 cmd.exe 245 PID 5956 wrote to memory of 5464 5956 RRBMA.exe 246 PID 5464 wrote to memory of 6096 5464 cmd.exe 250
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_64d1f94fed09d1ecb21887579fc00585_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-20_64d1f94fed09d1ecb21887579fc00585_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XRRTUJP.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:960 -
C:\windows\SysWOW64\XRRTUJP.exeC:\windows\system32\XRRTUJP.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\REKSIW.exe.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\windows\SysWOW64\REKSIW.exeC:\windows\system32\REKSIW.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SHO.exe.bat" "6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\windows\SysWOW64\SHO.exeC:\windows\system32\SHO.exe7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FKX.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\windows\system\FKX.exeC:\windows\system\FKX.exe9⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GNAIH.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:5220 -
C:\windows\GNAIH.exeC:\windows\GNAIH.exe11⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5136 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PWCVTK.exe.bat" "12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\windows\PWCVTK.exeC:\windows\PWCVTK.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JJH.exe.bat" "14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\windows\system\JJH.exeC:\windows\system\JJH.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FUQ.exe.bat" "16⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\windows\SysWOW64\FUQ.exeC:\windows\system32\FUQ.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZHVMU.exe.bat" "18⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\windows\ZHVMU.exeC:\windows\ZHVMU.exe19⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JHXRXS.exe.bat" "20⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\windows\system\JHXRXS.exeC:\windows\system\JHXRXS.exe21⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NXD.exe.bat" "22⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5268 -
C:\windows\NXD.exeC:\windows\NXD.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CNERQGY.exe.bat" "24⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\windows\system\CNERQGY.exeC:\windows\system\CNERQGY.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5672 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XBJA.exe.bat" "26⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\windows\XBJA.exeC:\windows\XBJA.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KLZZGII.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\windows\SysWOW64\KLZZGII.exeC:\windows\system32\KLZZGII.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BMB.exe.bat" "30⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5476 -
C:\windows\system\BMB.exeC:\windows\system\BMB.exe31⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WZGNU.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\windows\system\WZGNU.exeC:\windows\system\WZGNU.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LCQ.exe.bat" "34⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5264 -
C:\windows\LCQ.exeC:\windows\LCQ.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ASRRUW.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\windows\system\ASRRUW.exeC:\windows\system\ASRRUW.exe37⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EAX.exe.bat" "38⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\windows\EAX.exeC:\windows\EAX.exe39⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OIZWJ.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:5364 -
C:\windows\OIZWJ.exeC:\windows\OIZWJ.exe41⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FJOBWDP.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\windows\FJOBWDP.exeC:\windows\FJOBWDP.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GMRX.exe.bat" "44⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\windows\GMRX.exeC:\windows\GMRX.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VHBJNFZ.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:5656 -
C:\windows\SysWOW64\VHBJNFZ.exeC:\windows\system32\VHBJNFZ.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GZE.exe.bat" "48⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\windows\GZE.exeC:\windows\GZE.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5276 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PIGH.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\windows\SysWOW64\PIGH.exeC:\windows\system32\PIGH.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BABAH.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\windows\BABAH.exeC:\windows\BABAH.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GAJ.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\windows\system\GAJ.exeC:\windows\system\GAJ.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YBLT.exe.bat" "56⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\windows\YBLT.exeC:\windows\YBLT.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CRRTFR.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\windows\system\CRRTFR.exeC:\windows\system\CRRTFR.exe59⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YOX.exe.bat" "60⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3516 -
C:\windows\YOX.exeC:\windows\YOX.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RRBMA.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:3644 -
C:\windows\SysWOW64\RRBMA.exeC:\windows\system32\RRBMA.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ECJ.exe.bat" "64⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5464 -
C:\windows\SysWOW64\ECJ.exeC:\windows\system32\ECJ.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6096 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZPOUQ.exe.bat" "66⤵
- Executes a command shell one-liner
PID:4556 -
C:\windows\SysWOW64\ZPOUQ.exeC:\windows\system32\ZPOUQ.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FLNDVXB.exe.bat" "68⤵PID:1852
-
C:\windows\FLNDVXB.exeC:\windows\FLNDVXB.exe69⤵
- Executes dropped EXE
PID:5500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JTUDH.exe.bat" "70⤵
- Executes a command shell one-liner
PID:5940 -
C:\windows\system\JTUDH.exeC:\windows\system\JTUDH.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5744 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ULXVPW.exe.bat" "72⤵PID:4748
-
C:\windows\SysWOW64\ULXVPW.exeC:\windows\system32\ULXVPW.exe73⤵
- Executes dropped EXE
PID:1860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AME.exe.bat" "74⤵PID:1632
-
C:\windows\system\AME.exeC:\windows\system\AME.exe75⤵
- Executes dropped EXE
PID:5888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GMMXIB.exe.bat" "76⤵PID:3408
-
C:\windows\system\GMMXIB.exeC:\windows\system\GMMXIB.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GSMLJG.exe.bat" "78⤵PID:5104
-
C:\windows\system\GSMLJG.exeC:\windows\system\GSMLJG.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ANR.exe.bat" "80⤵
- System Location Discovery: System Language Discovery
PID:4696 -
C:\windows\system\ANR.exeC:\windows\system\ANR.exe81⤵
- Executes dropped EXE
PID:4488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DAOEE.exe.bat" "82⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5156 -
C:\windows\system\DAOEE.exeC:\windows\system\DAOEE.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BAWSN.exe.bat" "84⤵PID:6140
-
C:\windows\SysWOW64\BAWSN.exeC:\windows\system32\BAWSN.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SBY.exe.bat" "86⤵PID:3116
-
C:\windows\SBY.exeC:\windows\SBY.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LBNIHGY.exe.bat" "88⤵
- Executes a command shell one-liner
PID:3876 -
C:\windows\system\LBNIHGY.exeC:\windows\system\LBNIHGY.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6028 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EWRMN.exe.bat" "90⤵PID:1132
-
C:\windows\system\EWRMN.exeC:\windows\system\EWRMN.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZKWVXWX.exe.bat" "92⤵
- Executes a command shell one-liner
PID:1220 -
C:\windows\SysWOW64\ZKWVXWX.exeC:\windows\system32\ZKWVXWX.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DACVJ.exe.bat" "94⤵
- System Location Discovery: System Language Discovery
PID:836 -
C:\windows\DACVJ.exeC:\windows\DACVJ.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SQD.exe.bat" "96⤵PID:4804
-
C:\windows\SysWOW64\SQD.exeC:\windows\system32\SQD.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HLNZBW.exe.bat" "98⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3592 -
C:\windows\SysWOW64\HLNZBW.exeC:\windows\system32\HLNZBW.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XBOYISX.exe.bat" "100⤵
- System Location Discovery: System Language Discovery
PID:5740 -
C:\windows\XBOYISX.exeC:\windows\XBOYISX.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PEZUNI.exe.bat" "102⤵PID:1692
-
C:\windows\system\PEZUNI.exeC:\windows\system\PEZUNI.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VEH.exe.bat" "104⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5368 -
C:\windows\VEH.exeC:\windows\VEH.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1120 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MEBVA.exe.bat" "106⤵
- System Location Discovery: System Language Discovery
PID:3304 -
C:\windows\SysWOW64\MEBVA.exeC:\windows\system32\MEBVA.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QUQVMAY.exe.bat" "108⤵PID:4200
-
C:\windows\QUQVMAY.exeC:\windows\QUQVMAY.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2164 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PFTLVG.exe.bat" "110⤵
- System Location Discovery: System Language Discovery
PID:4972 -
C:\windows\PFTLVG.exeC:\windows\PFTLVG.exe111⤵
- Executes dropped EXE
PID:2940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EACP.exe.bat" "112⤵PID:2620
-
C:\windows\system\EACP.exeC:\windows\system\EACP.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OJEUR.exe.bat" "114⤵PID:5520
-
C:\windows\SysWOW64\OJEUR.exeC:\windows\system32\OJEUR.exe115⤵
- Executes dropped EXE
PID:1492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OEIYXOG.exe.bat" "116⤵PID:4340
-
C:\windows\system\OEIYXOG.exeC:\windows\system\OEIYXOG.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1192 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HHMUCE.exe.bat" "118⤵PID:4720
-
C:\windows\HHMUCE.exeC:\windows\HHMUCE.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1136 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YUWMSAE.exe.bat" "120⤵
- Executes a command shell one-liner
PID:5316 -
C:\windows\system\YUWMSAE.exeC:\windows\system\YUWMSAE.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2372
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-