Analysis
- max time kernel
81s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/07/2026, 16:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-20_1114d203d6ed543fcd807d94e3c4398c_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-07-20_1114d203d6ed543fcd807d94e3c4398c_elex_emotet_stop.exe
- Size 208KB
- Sample260720-trkbcshx3t
- SHA256 cb655f63158a7798eba61eb34f1031d06c2b63d2aa2e0efdd43c10e1da47c070
- MD5 1114d203d6ed543fcd807d94e3c4398c
- SHA1 0b94f4dbb812b636befb5911e6b6926b8e5e42ad
- SHA512 5e51929ed4c4147c48980e6fe72f9edc6cbdbd47ab01621feef62dd2794008e2f66e604edfeedbfbe7c2c4e5d47476f043d18698cef09d34e512557d5c59988a
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbclcdL+LOfr4NLthEjQT6j:MlZtbLWIgd1LZ9oECZbclc5+LOTQEj1
- TLSH T1A6247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5980 KMB.exe 248 TCV.exe 2816 MFZYY.exe 4300 MIDCLFC.exe 4640 QQJCPY.exe 2280 UGYK.exe 5624 VJCGPG.exe 3380 ZRJ.exe 5616 JPO.exe 1636 SXQN.exe 2204 FAHE.exe 1936 VQIDH.exe 816 ZGO.exe 5840 OWPDSQ.exe 4612 HPXOJR.exe 4424 JMKIRS.exe 4324 IXN.exe 1596 ZYPDDD.exe 2392 YVAY.exe 3324 HWCLBO.exe 2040 LMR.exe 1312 RHIMKB.exe 3028 EKZL.exe 3624 OHE.exe 4864 YQGKR.exe 4428 IOMEZAZ.exe 4220 MWAELSV.exe 1984 ZBAQN.exe 2676 YRM.exe 5648 SEQDK.exe 4524 IVRU.exe 2960 IYVYWU.exe 2808 MGK.exe 5228 WOEL.exe 5936 PGTW.exe 2016 AZWGMS.exe 3512 BCAKRIP.exe 3108 ZCIYA.exe 5144 EDPMJFR.exe 904 FGTH.exe 3628 ATYZHC.exe 6004 UGDIJCW.exe 3468 IED.exe 3708 IHHQZ.exe 3252 MXNYLOD.exe 1176 QFUYX.exe 5728 UVIYBZN.exe 2984 KLJXI.exe 2976 DERIZ.exe 2360 SUSH.exe 4776 FXIYMLD.exe 5388 TCIKO.exe 1552 MVYVG.exe 3160 WDAIJVO.exe 2516 UTLDE.exe 4912 VWPG.exe 2424 XUCTRHH.exe 2568 BXBO.exe 4276 SKLGHXF.exe 1884 DDGZPE.exe 5928 FTHTVBC.exe 1872 SDQSBEY.exe 264 TGTV.exe 2844 GRKMDEU.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\FAHE.exe SXQN.exe File created C:\windows\SysWOW64\IXN.exe.bat JMKIRS.exe File created C:\windows\SysWOW64\IVRU.exe.bat SEQDK.exe File opened for modification C:\windows\SysWOW64\SEQDK.exe YRM.exe File created C:\windows\SysWOW64\ATYZHC.exe FGTH.exe File opened for modification C:\windows\SysWOW64\SUSH.exe DERIZ.exe File created C:\windows\SysWOW64\OWPDSQ.exe.bat ZGO.exe File opened for modification C:\windows\SysWOW64\IXN.exe JMKIRS.exe File created C:\windows\SysWOW64\KLJXI.exe.bat UVIYBZN.exe File created C:\windows\SysWOW64\SSHMSB.exe.bat IJFHO.exe File created C:\windows\SysWOW64\FAHE.exe.bat SXQN.exe File created C:\windows\SysWOW64\IYVYWU.exe.bat IVRU.exe File created C:\windows\SysWOW64\SDQSBEY.exe FTHTVBC.exe File created C:\windows\SysWOW64\SEQDK.exe YRM.exe File created C:\windows\SysWOW64\RUYE.exe HWSKD.exe File created C:\windows\SysWOW64\OHE.exe EKZL.exe File created C:\windows\SysWOW64\KLJXI.exe UVIYBZN.exe File created C:\windows\SysWOW64\UFWWFMF.exe QPP.exe File created C:\windows\SysWOW64\QEVLLQB.exe PBRQX.exe File created C:\windows\SysWOW64\QQJCPY.exe.bat MIDCLFC.exe File created C:\windows\SysWOW64\JMKIRS.exe.bat HPXOJR.exe File created C:\windows\SysWOW64\WOEL.exe.bat MGK.exe File created C:\windows\SysWOW64\FGTH.exe.bat EDPMJFR.exe File created C:\windows\SysWOW64\TGTV.exe.bat SDQSBEY.exe File created C:\windows\SysWOW64\QEVLLQB.exe.bat PBRQX.exe File created C:\windows\SysWOW64\IXN.exe JMKIRS.exe File created C:\windows\SysWOW64\YRM.exe.bat ZBAQN.exe File created C:\windows\SysWOW64\HWSKD.exe DODKZBW.exe File opened for modification C:\windows\SysWOW64\SSHMSB.exe IJFHO.exe File opened for modification C:\windows\SysWOW64\IYVYWU.exe IVRU.exe File created C:\windows\SysWOW64\KTX.exe.bat CNL.exe File created C:\windows\SysWOW64\NDMVQS.exe.bat JAN.exe File created C:\windows\SysWOW64\YRM.exe ZBAQN.exe File created C:\windows\SysWOW64\MGK.exe.bat IYVYWU.exe File created C:\windows\SysWOW64\AZWGMS.exe PGTW.exe File created C:\windows\SysWOW64\FXIYMLD.exe SUSH.exe File created C:\windows\SysWOW64\TCIKO.exe FXIYMLD.exe File opened for modification C:\windows\SysWOW64\UFWWFMF.exe QPP.exe File created C:\windows\SysWOW64\ZRJ.exe.bat VJCGPG.exe File opened for modification C:\windows\SysWOW64\JMKIRS.exe HPXOJR.exe File opened for modification C:\windows\SysWOW64\WOEL.exe MGK.exe File opened for modification C:\windows\SysWOW64\TCIKO.exe FXIYMLD.exe File created C:\windows\SysWOW64\HWSKD.exe.bat DODKZBW.exe File opened for modification C:\windows\SysWOW64\RUYE.exe HWSKD.exe File created C:\windows\SysWOW64\SSHMSB.exe IJFHO.exe File created C:\windows\SysWOW64\SUSH.exe.bat DERIZ.exe File created C:\windows\SysWOW64\RUYE.exe.bat HWSKD.exe File created C:\windows\SysWOW64\JMKIRS.exe HPXOJR.exe File created C:\windows\SysWOW64\TGTV.exe SDQSBEY.exe File opened for modification C:\windows\SysWOW64\HPXOJR.exe OWPDSQ.exe File opened for modification C:\windows\SysWOW64\YVAY.exe ZYPDDD.exe File created C:\windows\SysWOW64\SDQSBEY.exe.bat FTHTVBC.exe File opened for modification C:\windows\SysWOW64\TGTV.exe SDQSBEY.exe File created C:\windows\SysWOW64\MXKOO.exe.bat SKF.exe File created C:\windows\SysWOW64\WOEL.exe MGK.exe File created C:\windows\SysWOW64\KTX.exe CNL.exe File created C:\windows\SysWOW64\JAN.exe UFWWFMF.exe File created C:\windows\SysWOW64\HWCLBO.exe YVAY.exe File created C:\windows\SysWOW64\INGTWD.exe EXZLSL.exe File created C:\windows\SysWOW64\MFZYY.exe.bat TCV.exe File opened for modification C:\windows\SysWOW64\ZRJ.exe VJCGPG.exe File created C:\windows\SysWOW64\OWPDSQ.exe ZGO.exe File opened for modification C:\windows\SysWOW64\MGK.exe IYVYWU.exe File created C:\windows\SysWOW64\UTLDE.exe.bat WDAIJVO.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\DERIZ.exe KLJXI.exe File created C:\windows\system\QPP.exe.bat LWNM.exe File created C:\windows\system\QLBJDVK.exe XPXNX.exe File opened for modification C:\windows\WZBE.exe UBWSPF.exe File created C:\windows\system\VQIDH.exe.bat FAHE.exe File created C:\windows\system\DDGZPE.exe SKLGHXF.exe File created C:\windows\EXZLSL.exe GMWV.exe File opened for modification C:\windows\RHIMKB.exe LMR.exe File opened for modification C:\windows\IED.exe UGDIJCW.exe File created C:\windows\system\UVIYBZN.exe.bat QFUYX.exe File created C:\windows\KMB.exe 2026-07-20_1114d203d6ed543fcd807d94e3c4398c_elex_emotet_stop.exe File created C:\windows\system\TCV.exe.bat KMB.exe File created C:\windows\system\UGYK.exe.bat QQJCPY.exe File created C:\windows\system\VQIDH.exe FAHE.exe File opened for modification C:\windows\ZGO.exe VQIDH.exe File opened for modification C:\windows\system\MWAELSV.exe IOMEZAZ.exe File created C:\windows\XUCTRHH.exe.bat VWPG.exe File created C:\windows\GRKMDEU.exe TGTV.exe File created C:\windows\system\MWAELSV.exe.bat IOMEZAZ.exe File created C:\windows\system\SKF.exe.bat GRKMDEU.exe File opened for modification C:\windows\system\SGCBPEE.exe KTX.exe File created C:\windows\system\SGCBPEE.exe.bat KTX.exe File created C:\windows\system\XPXNX.exe.bat RUYE.exe File opened for modification C:\windows\system\QLBJDVK.exe XPXNX.exe File created C:\windows\VEL.exe FOKNO.exe File created C:\windows\IJFHO.exe.bat NZPIATR.exe File opened for modification C:\windows\MIDCLFC.exe MFZYY.exe File created C:\windows\MIDCLFC.exe.bat MFZYY.exe File created C:\windows\system\UGYK.exe QQJCPY.exe File opened for modification C:\windows\system\VQIDH.exe FAHE.exe File created C:\windows\ZCIYA.exe BCAKRIP.exe File opened for modification C:\windows\IJFHO.exe NZPIATR.exe File opened for modification C:\windows\PSVF.exe WPSBIWJ.exe File created C:\windows\VJCGPG.exe UGYK.exe File created C:\windows\system\IOMEZAZ.exe YQGKR.exe File opened for modification C:\windows\EXZLSL.exe GMWV.exe File created C:\windows\system\DODKZBW.exe.bat QEVLLQB.exe File created C:\windows\system\XPXNX.exe RUYE.exe File opened for modification C:\windows\system\UGDIJCW.exe ATYZHC.exe File opened for modification C:\windows\system\UVIYBZN.exe QFUYX.exe File created C:\windows\system\NZPIATR.exe.bat VEL.exe File created C:\windows\UBWSPF.exe YBMHLJP.exe File opened for modification C:\windows\VJCGPG.exe UGYK.exe File opened for modification C:\windows\system\YQGKR.exe OHE.exe File created C:\windows\ZCIYA.exe.bat BCAKRIP.exe File created C:\windows\system\UGDIJCW.exe ATYZHC.exe File created C:\windows\system\IHHQZ.exe.bat IED.exe File created C:\windows\GRKMDEU.exe.bat TGTV.exe File created C:\windows\IJFHO.exe NZPIATR.exe File created C:\windows\ZQJ.exe PSVF.exe File created C:\windows\system\MWAELSV.exe IOMEZAZ.exe File created C:\windows\EDPMJFR.exe ZCIYA.exe File created C:\windows\system\QFUYX.exe MXNYLOD.exe File created C:\windows\system\UEQVX.exe.bat SGCBPEE.exe File created C:\windows\system\GMWV.exe UEQVX.exe File created C:\windows\system\FOKNO.exe QLBJDVK.exe File created C:\windows\PSVF.exe WPSBIWJ.exe File opened for modification C:\windows\system\TCV.exe KMB.exe File opened for modification C:\windows\system\UGYK.exe QQJCPY.exe File created C:\windows\JPO.exe ZRJ.exe File created C:\windows\XUCTRHH.exe VWPG.exe File created C:\windows\CNL.exe.bat MXKOO.exe File opened for modification C:\windows\system\UEQVX.exe SGCBPEE.exe File created C:\windows\WZBE.exe UBWSPF.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1352 cmd.exe 5580 cmd.exe 3488 cmd.exe 6112 cmd.exe 2888 cmd.exe 4860 cmd.exe 5336 cmd.exe 2104 cmd.exe 3244 cmd.exe 1540 cmd.exe 2520 cmd.exe 1992 cmd.exe 4260 cmd.exe 5428 cmd.exe 1528 cmd.exe 5572 cmd.exe 4816 cmd.exe 3364 cmd.exe 3656 cmd.exe 3924 cmd.exe 860 cmd.exe 3552 cmd.exe 5832 cmd.exe 948 cmd.exe 5596 cmd.exe 1188 cmd.exe 1412 cmd.exe 3100 cmd.exe 1004 cmd.exe 1896 cmd.exe 1364 cmd.exe 5152 cmd.exe 3536 cmd.exe 2856 cmd.exe 5056 cmd.exe 2956 cmd.exe 3240 cmd.exe 3740 cmd.exe 3724 cmd.exe 5844 cmd.exe 2884 cmd.exe 3988 cmd.exe 3096 cmd.exe 2640 cmd.exe 4152 cmd.exe 4328 cmd.exe 2344 cmd.exe 3432 cmd.exe 4180 cmd.exe 1324 cmd.exe 3024 cmd.exe 3836 cmd.exe 2596 cmd.exe 5400 cmd.exe 4736 cmd.exe 2152 cmd.exe 5604 cmd.exe 1076 cmd.exe 200 cmd.exe 3372 cmd.exe 4312 cmd.exe 3760 cmd.exe 2060 cmd.exe 5324 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 632 4956 WerFault.exe 87 4364 5980 WerFault.exe 93 4504 248 WerFault.exe 99 3272 2816 WerFault.exe 104 5680 4300 WerFault.exe 109 5708 4640 WerFault.exe 114 2976 2280 WerFault.exe 119 2408 5624 WerFault.exe 124 1124 3380 WerFault.exe 129 4732 5616 WerFault.exe 134 3328 1636 WerFault.exe 139 1472 2204 WerFault.exe 144 6036 1936 WerFault.exe 148 1856 816 WerFault.exe 154 3516 5840 WerFault.exe 159 4764 4612 WerFault.exe 164 5728 4424 WerFault.exe 169 2940 4324 WerFault.exe 174 4276 1596 WerFault.exe 179 4128 2392 WerFault.exe 184 2316 3324 WerFault.exe 189 4356 2040 WerFault.exe 194 992 1312 WerFault.exe 199 5704 3028 WerFault.exe 204 2288 3624 WerFault.exe 209 4952 4864 WerFault.exe 214 2332 4428 WerFault.exe 219 4608 4220 WerFault.exe 224 3940 1984 WerFault.exe 229 3832 2676 WerFault.exe 234 2360 5648 WerFault.exe 239 1276 4524 WerFault.exe 244 1556 2960 WerFault.exe 249 2596 2808 WerFault.exe 254 2036 5228 WerFault.exe 259 4800 5936 WerFault.exe 264 1776 2016 WerFault.exe 269 2224 3512 WerFault.exe 275 1148 3108 WerFault.exe 280 1124 5144 WerFault.exe 285 4632 904 WerFault.exe 290 5416 3628 WerFault.exe 295 1668 6004 WerFault.exe 300 1484 3468 WerFault.exe 305 5824 3708 WerFault.exe 310 4088 3252 WerFault.exe 315 1200 1176 WerFault.exe 320 2920 5728 WerFault.exe 325 4920 2984 WerFault.exe 330 6112 2976 WerFault.exe 335 1036 2360 WerFault.exe 340 4868 4776 WerFault.exe 345 1448 5388 WerFault.exe 350 632 1552 WerFault.exe 355 1476 3160 WerFault.exe 360 5680 2516 WerFault.exe 365 2224 4912 WerFault.exe 370 2180 2424 WerFault.exe 375 3712 2568 WerFault.exe 380 4636 4276 WerFault.exe 385 5532 1884 WerFault.exe 390 4860 5928 WerFault.exe 395 1856 1872 WerFault.exe 400 1332 264 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BXBO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XPXNX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IJFHO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-20_1114d203d6ed543fcd807d94e3c4398c_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HWCLBO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SKLGHXF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TGTV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BCAKRIP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EDPMJFR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXZLSL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OHE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QFUYX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WZBE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KMB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VJCGPG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LMR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VWPG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GRKMDEU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FYYPW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IOMEZAZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KTX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QPP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DODKZBW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HPXOJR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JYAZAP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HWSKD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YVAY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IYVYWU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FGTH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FXIYMLD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TCIKO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CNL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YQGKR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PGTW.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4956 2026-07-20_1114d203d6ed543fcd807d94e3c4398c_elex_emotet_stop.exe 4956 2026-07-20_1114d203d6ed543fcd807d94e3c4398c_elex_emotet_stop.exe 5980 KMB.exe 5980 KMB.exe 248 TCV.exe 248 TCV.exe 2816 MFZYY.exe 2816 MFZYY.exe 4300 MIDCLFC.exe 4300 MIDCLFC.exe 4640 QQJCPY.exe 4640 QQJCPY.exe 2280 UGYK.exe 2280 UGYK.exe 5624 VJCGPG.exe 5624 VJCGPG.exe 3380 ZRJ.exe 3380 ZRJ.exe 5616 JPO.exe 5616 JPO.exe 1636 SXQN.exe 1636 SXQN.exe 2204 FAHE.exe 2204 FAHE.exe 1936 VQIDH.exe 1936 VQIDH.exe 816 ZGO.exe 816 ZGO.exe 5840 OWPDSQ.exe 5840 OWPDSQ.exe 4612 HPXOJR.exe 4612 HPXOJR.exe 4424 JMKIRS.exe 4424 JMKIRS.exe 4324 IXN.exe 4324 IXN.exe 1596 ZYPDDD.exe 1596 ZYPDDD.exe 2392 YVAY.exe 2392 YVAY.exe 3324 HWCLBO.exe 3324 HWCLBO.exe 2040 LMR.exe 2040 LMR.exe 1312 RHIMKB.exe 1312 RHIMKB.exe 3028 EKZL.exe 3028 EKZL.exe 3624 OHE.exe 3624 OHE.exe 4864 YQGKR.exe 4864 YQGKR.exe 4428 IOMEZAZ.exe 4428 IOMEZAZ.exe 4220 MWAELSV.exe 4220 MWAELSV.exe 1984 ZBAQN.exe 1984 ZBAQN.exe 2676 YRM.exe 2676 YRM.exe 5648 SEQDK.exe 5648 SEQDK.exe 4524 IVRU.exe 4524 IVRU.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4956 2026-07-20_1114d203d6ed543fcd807d94e3c4398c_elex_emotet_stop.exe 4956 2026-07-20_1114d203d6ed543fcd807d94e3c4398c_elex_emotet_stop.exe 5980 KMB.exe 5980 KMB.exe 248 TCV.exe 248 TCV.exe 2816 MFZYY.exe 2816 MFZYY.exe 4300 MIDCLFC.exe 4300 MIDCLFC.exe 4640 QQJCPY.exe 4640 QQJCPY.exe 2280 UGYK.exe 2280 UGYK.exe 5624 VJCGPG.exe 5624 VJCGPG.exe 3380 ZRJ.exe 3380 ZRJ.exe 5616 JPO.exe 5616 JPO.exe 1636 SXQN.exe 1636 SXQN.exe 2204 FAHE.exe 2204 FAHE.exe 1936 VQIDH.exe 1936 VQIDH.exe 816 ZGO.exe 816 ZGO.exe 5840 OWPDSQ.exe 5840 OWPDSQ.exe 4612 HPXOJR.exe 4612 HPXOJR.exe 4424 JMKIRS.exe 4424 JMKIRS.exe 4324 IXN.exe 4324 IXN.exe 1596 ZYPDDD.exe 1596 ZYPDDD.exe 2392 YVAY.exe 2392 YVAY.exe 3324 HWCLBO.exe 3324 HWCLBO.exe 2040 LMR.exe 2040 LMR.exe 1312 RHIMKB.exe 1312 RHIMKB.exe 3028 EKZL.exe 3028 EKZL.exe 3624 OHE.exe 3624 OHE.exe 4864 YQGKR.exe 4864 YQGKR.exe 4428 IOMEZAZ.exe 4428 IOMEZAZ.exe 4220 MWAELSV.exe 4220 MWAELSV.exe 1984 ZBAQN.exe 1984 ZBAQN.exe 2676 YRM.exe 2676 YRM.exe 5648 SEQDK.exe 5648 SEQDK.exe 4524 IVRU.exe 4524 IVRU.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4956 wrote to memory of 4144 4956 2026-07-20_1114d203d6ed543fcd807d94e3c4398c_elex_emotet_stop.exe 89 PID 4144 wrote to memory of 5980 4144 cmd.exe 93 PID 5980 wrote to memory of 5428 5980 KMB.exe 95 PID 5428 wrote to memory of 248 5428 cmd.exe 99 PID 248 wrote to memory of 3404 248 TCV.exe 100 PID 3404 wrote to memory of 2816 3404 cmd.exe 104 PID 2816 wrote to memory of 1352 2816 MFZYY.exe 105 PID 1352 wrote to memory of 4300 1352 cmd.exe 109 PID 4300 wrote to memory of 3756 4300 MIDCLFC.exe 110 PID 3756 wrote to memory of 4640 3756 cmd.exe 114 PID 4640 wrote to memory of 3760 4640 QQJCPY.exe 115 PID 3760 wrote to memory of 2280 3760 cmd.exe 119 PID 2280 wrote to memory of 5336 2280 UGYK.exe 120 PID 5336 wrote to memory of 5624 5336 cmd.exe 124 PID 5624 wrote to memory of 1744 5624 VJCGPG.exe 125 PID 1744 wrote to memory of 3380 1744 cmd.exe 129 PID 3380 wrote to memory of 3724 3380 ZRJ.exe 130 PID 3724 wrote to memory of 5616 3724 cmd.exe 134 PID 5616 wrote to memory of 5844 5616 JPO.exe 135 PID 5844 wrote to memory of 1636 5844 cmd.exe 139 PID 1636 wrote to memory of 2884 1636 SXQN.exe 140 PID 2884 wrote to memory of 2204 2884 cmd.exe 144 PID 2204 wrote to memory of 4872 2204 FAHE.exe 145 PID 4872 wrote to memory of 1936 4872 cmd.exe 148 PID 1936 wrote to memory of 1528 1936 VQIDH.exe 150 PID 1528 wrote to memory of 816 1528 cmd.exe 154 PID 816 wrote to memory of 2952 816 ZGO.exe 155 PID 2952 wrote to memory of 5840 2952 cmd.exe 159 PID 5840 wrote to memory of 1996 5840 OWPDSQ.exe 160 PID 1996 wrote to memory of 4612 1996 cmd.exe 164 PID 4612 wrote to memory of 2060 4612 HPXOJR.exe 165 PID 2060 wrote to memory of 4424 2060 cmd.exe 169 PID 4424 wrote to memory of 5652 4424 JMKIRS.exe 170 PID 5652 wrote to memory of 4324 5652 cmd.exe 174 PID 4324 wrote to memory of 4272 4324 IXN.exe 175 PID 4272 wrote to memory of 1596 4272 cmd.exe 179 PID 1596 wrote to memory of 3492 1596 ZYPDDD.exe 180 PID 3492 wrote to memory of 2392 3492 cmd.exe 184 PID 2392 wrote to memory of 2044 2392 YVAY.exe 185 PID 2044 wrote to memory of 3324 2044 cmd.exe 189 PID 3324 wrote to memory of 5968 3324 HWCLBO.exe 190 PID 5968 wrote to memory of 2040 5968 cmd.exe 194 PID 2040 wrote to memory of 3024 2040 LMR.exe 195 PID 3024 wrote to memory of 1312 3024 cmd.exe 199 PID 1312 wrote to memory of 3800 1312 RHIMKB.exe 200 PID 3800 wrote to memory of 3028 3800 cmd.exe 204 PID 3028 wrote to memory of 1952 3028 EKZL.exe 205 PID 1952 wrote to memory of 3624 1952 cmd.exe 209 PID 3624 wrote to memory of 1412 3624 OHE.exe 210 PID 1412 wrote to memory of 4864 1412 cmd.exe 214 PID 4864 wrote to memory of 4180 4864 YQGKR.exe 215 PID 4180 wrote to memory of 4428 4180 cmd.exe 219 PID 4428 wrote to memory of 5168 4428 IOMEZAZ.exe 220 PID 5168 wrote to memory of 4220 5168 cmd.exe 224 PID 4220 wrote to memory of 4968 4220 MWAELSV.exe 225 PID 4968 wrote to memory of 1984 4968 cmd.exe 229 PID 1984 wrote to memory of 2284 1984 ZBAQN.exe 230 PID 2284 wrote to memory of 2676 2284 cmd.exe 234 PID 2676 wrote to memory of 5892 2676 YRM.exe 235 PID 5892 wrote to memory of 5648 5892 cmd.exe 239 PID 5648 wrote to memory of 2528 5648 SEQDK.exe 240 PID 2528 wrote to memory of 4524 2528 cmd.exe 244 PID 4524 wrote to memory of 4772 4524 IVRU.exe 245 PID 4772 wrote to memory of 2960 4772 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1114d203d6ed543fcd807d94e3c4398c_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-20_1114d203d6ed543fcd807d94e3c4398c_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KMB.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\windows\KMB.exeC:\windows\KMB.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TCV.exe.bat" "4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5428 -
C:\windows\system\TCV.exeC:\windows\system\TCV.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MFZYY.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\windows\SysWOW64\MFZYY.exeC:\windows\system32\MFZYY.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MIDCLFC.exe.bat" "8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\windows\MIDCLFC.exeC:\windows\MIDCLFC.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QQJCPY.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:3756 -
C:\windows\SysWOW64\QQJCPY.exeC:\windows\system32\QQJCPY.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UGYK.exe.bat" "12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3760 -
C:\windows\system\UGYK.exeC:\windows\system\UGYK.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VJCGPG.exe.bat" "14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5336 -
C:\windows\VJCGPG.exeC:\windows\VJCGPG.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZRJ.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\windows\SysWOW64\ZRJ.exeC:\windows\system32\ZRJ.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JPO.exe.bat" "18⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3724 -
C:\windows\JPO.exeC:\windows\JPO.exe19⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SXQN.exe.bat" "20⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5844 -
C:\windows\SXQN.exeC:\windows\SXQN.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FAHE.exe.bat" "22⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\windows\SysWOW64\FAHE.exeC:\windows\system32\FAHE.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VQIDH.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\windows\system\VQIDH.exeC:\windows\system\VQIDH.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZGO.exe.bat" "26⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\windows\ZGO.exeC:\windows\ZGO.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OWPDSQ.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\windows\SysWOW64\OWPDSQ.exeC:\windows\system32\OWPDSQ.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HPXOJR.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\windows\SysWOW64\HPXOJR.exeC:\windows\system32\HPXOJR.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JMKIRS.exe.bat" "32⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\windows\SysWOW64\JMKIRS.exeC:\windows\system32\JMKIRS.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IXN.exe.bat" "34⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5652 -
C:\windows\SysWOW64\IXN.exeC:\windows\system32\IXN.exe35⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZYPDDD.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\windows\SysWOW64\ZYPDDD.exeC:\windows\system32\ZYPDDD.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YVAY.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\windows\SysWOW64\YVAY.exeC:\windows\system32\YVAY.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HWCLBO.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\windows\SysWOW64\HWCLBO.exeC:\windows\system32\HWCLBO.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LMR.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:5968 -
C:\windows\system\LMR.exeC:\windows\system\LMR.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RHIMKB.exe.bat" "44⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\windows\RHIMKB.exeC:\windows\RHIMKB.exe45⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EKZL.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:3800 -
C:\windows\EKZL.exeC:\windows\EKZL.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OHE.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\windows\SysWOW64\OHE.exeC:\windows\system32\OHE.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YQGKR.exe.bat" "50⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\windows\system\YQGKR.exeC:\windows\system\YQGKR.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IOMEZAZ.exe.bat" "52⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\windows\system\IOMEZAZ.exeC:\windows\system\IOMEZAZ.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MWAELSV.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:5168 -
C:\windows\system\MWAELSV.exeC:\windows\system\MWAELSV.exe55⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZBAQN.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\windows\system\ZBAQN.exeC:\windows\system\ZBAQN.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YRM.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\windows\SysWOW64\YRM.exeC:\windows\system32\YRM.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SEQDK.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:5892 -
C:\windows\SysWOW64\SEQDK.exeC:\windows\system32\SEQDK.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5648 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IVRU.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\windows\SysWOW64\IVRU.exeC:\windows\system32\IVRU.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IYVYWU.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\windows\SysWOW64\IYVYWU.exeC:\windows\system32\IYVYWU.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MGK.exe.bat" "66⤵PID:3060
-
C:\windows\SysWOW64\MGK.exeC:\windows\system32\MGK.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WOEL.exe.bat" "68⤵PID:5808
-
C:\windows\SysWOW64\WOEL.exeC:\windows\system32\WOEL.exe69⤵
- Executes dropped EXE
PID:5228 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PGTW.exe.bat" "70⤵PID:1164
-
C:\windows\system\PGTW.exeC:\windows\system\PGTW.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AZWGMS.exe.bat" "72⤵PID:2476
-
C:\windows\SysWOW64\AZWGMS.exeC:\windows\system32\AZWGMS.exe73⤵
- Executes dropped EXE
PID:2016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BCAKRIP.exe.bat" "74⤵PID:2696
-
C:\windows\BCAKRIP.exeC:\windows\BCAKRIP.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZCIYA.exe.bat" "76⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4152 -
C:\windows\ZCIYA.exeC:\windows\ZCIYA.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EDPMJFR.exe.bat" "78⤵
- Executes a command shell one-liner
PID:5324 -
C:\windows\EDPMJFR.exeC:\windows\EDPMJFR.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FGTH.exe.bat" "80⤵
- System Location Discovery: System Language Discovery
PID:3896 -
C:\windows\SysWOW64\FGTH.exeC:\windows\system32\FGTH.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ATYZHC.exe.bat" "82⤵
- Executes a command shell one-liner
PID:3656 -
C:\windows\SysWOW64\ATYZHC.exeC:\windows\system32\ATYZHC.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3628 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UGDIJCW.exe.bat" "84⤵PID:1904
-
C:\windows\system\UGDIJCW.exeC:\windows\system\UGDIJCW.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IED.exe.bat" "86⤵PID:1472
-
C:\windows\IED.exeC:\windows\IED.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IHHQZ.exe.bat" "88⤵
- Executes a command shell one-liner
PID:3988 -
C:\windows\system\IHHQZ.exeC:\windows\system\IHHQZ.exe89⤵
- Executes dropped EXE
PID:3708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MXNYLOD.exe.bat" "90⤵
- System Location Discovery: System Language Discovery
PID:4616 -
C:\windows\SysWOW64\MXNYLOD.exeC:\windows\system32\MXNYLOD.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QFUYX.exe.bat" "92⤵PID:5036
-
C:\windows\system\QFUYX.exeC:\windows\system\QFUYX.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1176 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UVIYBZN.exe.bat" "94⤵
- System Location Discovery: System Language Discovery
PID:1980 -
C:\windows\system\UVIYBZN.exeC:\windows\system\UVIYBZN.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5728 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KLJXI.exe.bat" "96⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4328 -
C:\windows\SysWOW64\KLJXI.exeC:\windows\system32\KLJXI.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DERIZ.exe.bat" "98⤵PID:5732
-
C:\windows\system\DERIZ.exeC:\windows\system\DERIZ.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SUSH.exe.bat" "100⤵
- System Location Discovery: System Language Discovery
PID:3900 -
C:\windows\SysWOW64\SUSH.exeC:\windows\system32\SUSH.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FXIYMLD.exe.bat" "102⤵PID:4148
-
C:\windows\SysWOW64\FXIYMLD.exeC:\windows\system32\FXIYMLD.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TCIKO.exe.bat" "104⤵
- Executes a command shell one-liner
PID:3924 -
C:\windows\SysWOW64\TCIKO.exeC:\windows\system32\TCIKO.exe105⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5388 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MVYVG.exe.bat" "106⤵
- Executes a command shell one-liner
PID:5580 -
C:\windows\SysWOW64\MVYVG.exeC:\windows\system32\MVYVG.exe107⤵
- Executes dropped EXE
PID:1552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WDAIJVO.exe.bat" "108⤵PID:2672
-
C:\windows\WDAIJVO.exeC:\windows\WDAIJVO.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UTLDE.exe.bat" "110⤵
- System Location Discovery: System Language Discovery
PID:5164 -
C:\windows\SysWOW64\UTLDE.exeC:\windows\system32\UTLDE.exe111⤵
- Executes dropped EXE
PID:2516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VWPG.exe.bat" "112⤵
- System Location Discovery: System Language Discovery
PID:2460 -
C:\windows\VWPG.exeC:\windows\VWPG.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XUCTRHH.exe.bat" "114⤵PID:1436
-
C:\windows\XUCTRHH.exeC:\windows\XUCTRHH.exe115⤵
- Executes dropped EXE
PID:2424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BXBO.exe.bat" "116⤵
- Executes a command shell one-liner
PID:3836 -
C:\windows\SysWOW64\BXBO.exeC:\windows\system32\BXBO.exe117⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SKLGHXF.exe.bat" "118⤵PID:1780
-
C:\windows\SKLGHXF.exeC:\windows\SKLGHXF.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4276 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DDGZPE.exe.bat" "120⤵PID:4724
-
C:\windows\system\DDGZPE.exeC:\windows\system\DDGZPE.exe121⤵
- Executes dropped EXE
PID:1884
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-