Analysis
- max time kernel
79s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
21/07/2026, 15:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-21_1e5a77edad8876eaff28a0e33ec7e432_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-07-21_1e5a77edad8876eaff28a0e33ec7e432_elex_emotet_stop.exe
- Size 208KB
- Sample260721-s4fchaxtbv
- SHA256 f51cafa63907afcf70e353ae31b03cd7fb45a1339013bee54c309330d3d27312
- MD5 1e5a77edad8876eaff28a0e33ec7e432
- SHA1 e9664ed2797a0cd0b66438acbcfac58632d796db
- SHA512 d35a450992622ea12cf6df553e5bacd51963263c1011bdccc2d323630d579a6654daae1d28f5042aac64cbee75a52d4187d2d7f5bc5771d0f1e0f5c456c5dd30
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbclcdL+LOfU4NLthEjQT6E:MlZtbLWIgd1LZ9oECZbclc5+LOcQEj6
- TLSH T1E0247D2236D2C073E4B7023188F6C7787BB6BD919B36928B77C03B4D6E715A68A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2764 UPFAXEM.exe 5224 LNMBST.exe 5900 CVSYEK.exe 2556 BGDON.exe 3324 ODDA.exe 2384 DYMEAO.exe 4980 LMZLLV.exe 5876 GZE.exe 5616 KPLCH.exe 4168 QDKDEI.exe 4876 SAPXT.exe 2864 NLY.exe 4780 GOKSNRY.exe 4848 KWQAZ.exe 3360 SCIGB.exe 4644 FNZ.exe 5332 AAEOZ.exe 3404 KYJJG.exe 5668 OJH.exe 4756 SROET.exe 2604 HMX.exe 5872 NHXRII.exe 3468 YAMC.exe 204 XKP.exe 3672 BAWSN.exe 5788 BEHW.exe 5844 FMOWEQ.exe 4288 NRTCPO.exe 1016 NFTRQBK.exe 4124 SKLGHXF.exe 6044 HAMF.exe 1716 LITFZC.exe 4964 PYZFM.exe 1056 ZZBSPAG.exe 5824 BMGC.exe 1408 DKM.exe 5240 ENQSM.exe 244 GKDM.exe 4944 QIJHJPW.exe 4468 ILNCPF.exe 2376 AMPHACA.exe 1776 CJUCI.exe 5676 REMGTGR.exe 3216 XADPX.exe 2680 QDPLDZI.exe 5180 BLVTP.exe 1848 UOZ.exe 5104 YWGOHR.exe 2928 IULJW.exe 6008 JXPMBXM.exe 2780 BABIHN.exe 364 NSWBP.exe 4408 RADBB.exe 2188 RDOFHDA.exe 756 EOXDV.exe 2532 UEY.exe 3916 QKQK.exe 4240 RFUOX.exe 4584 KIYJDKQ.exe 5108 BIAOGI.exe 5828 OTIN.exe 1300 WGV.exe 2820 CUUCKU.exe 2280 QFCT.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\KWQAZ.exe GOKSNRY.exe File created C:\windows\SysWOW64\SCIGB.exe KWQAZ.exe File created C:\windows\SysWOW64\CWOVXW.exe.bat SYIB.exe File created C:\windows\SysWOW64\OJH.exe KYJJG.exe File opened for modification C:\windows\SysWOW64\GKDM.exe ENQSM.exe File created C:\windows\SysWOW64\YWGOHR.exe UOZ.exe File created C:\windows\SysWOW64\YOM.exe BOCUJSB.exe File opened for modification C:\windows\SysWOW64\NDPESL.exe TIKV.exe File created C:\windows\SysWOW64\DYMEAO.exe ODDA.exe File opened for modification C:\windows\SysWOW64\YOM.exe BOCUJSB.exe File created C:\windows\SysWOW64\XNO.exe PHB.exe File opened for modification C:\windows\SysWOW64\SYIB.exe SVFFC.exe File created C:\windows\SysWOW64\LNMBST.exe UPFAXEM.exe File created C:\windows\SysWOW64\KWQAZ.exe.bat GOKSNRY.exe File created C:\windows\SysWOW64\TVSPV.exe HHTRQQQ.exe File created C:\windows\SysWOW64\NDPESL.exe TIKV.exe File created C:\windows\SysWOW64\NLY.exe SAPXT.exe File created C:\windows\SysWOW64\CJUCI.exe.bat AMPHACA.exe File opened for modification C:\windows\SysWOW64\CUUCKU.exe WGV.exe File created C:\windows\SysWOW64\QFCT.exe CUUCKU.exe File created C:\windows\SysWOW64\WEXZAB.exe YOM.exe File opened for modification C:\windows\SysWOW64\WEXZAB.exe YOM.exe File created C:\windows\SysWOW64\WEXZAB.exe.bat YOM.exe File opened for modification C:\windows\SysWOW64\XNO.exe PHB.exe File opened for modification C:\windows\SysWOW64\CWOVXW.exe SYIB.exe File created C:\windows\SysWOW64\GKDM.exe ENQSM.exe File created C:\windows\SysWOW64\LNMBST.exe.bat UPFAXEM.exe File created C:\windows\SysWOW64\LITFZC.exe HAMF.exe File opened for modification C:\windows\SysWOW64\ENQSM.exe DKM.exe File created C:\windows\SysWOW64\TVJBKP.exe.bat QFCT.exe File opened for modification C:\windows\SysWOW64\SVFFC.exe KFEG.exe File created C:\windows\SysWOW64\NLY.exe.bat SAPXT.exe File opened for modification C:\windows\SysWOW64\BUVBUQ.exe REPP.exe File created C:\windows\SysWOW64\SCIGB.exe.bat KWQAZ.exe File created C:\windows\SysWOW64\QKQK.exe.bat UEY.exe File opened for modification C:\windows\SysWOW64\QFCT.exe CUUCKU.exe File opened for modification C:\windows\SysWOW64\TVJBKP.exe QFCT.exe File created C:\windows\SysWOW64\DINKVS.exe XNO.exe File created C:\windows\SysWOW64\FMOWEQ.exe BEHW.exe File created C:\windows\SysWOW64\CWOVXW.exe SYIB.exe File created C:\windows\SysWOW64\SVFFC.exe KFEG.exe File opened for modification C:\windows\SysWOW64\QDKDEI.exe KPLCH.exe File created C:\windows\SysWOW64\KWQAZ.exe GOKSNRY.exe File created C:\windows\SysWOW64\OJH.exe.bat KYJJG.exe File opened for modification C:\windows\SysWOW64\LITFZC.exe HAMF.exe File created C:\windows\SysWOW64\QDPLDZI.exe XADPX.exe File created C:\windows\SysWOW64\IULJW.exe.bat YWGOHR.exe File created C:\windows\SysWOW64\QFCT.exe.bat CUUCKU.exe File created C:\windows\SysWOW64\TVJBKP.exe QFCT.exe File opened for modification C:\windows\SysWOW64\TVSPV.exe HHTRQQQ.exe File opened for modification C:\windows\SysWOW64\CJUCI.exe AMPHACA.exe File opened for modification C:\windows\SysWOW64\EOXDV.exe RDOFHDA.exe File created C:\windows\SysWOW64\XKP.exe.bat YAMC.exe File opened for modification C:\windows\SysWOW64\XKP.exe YAMC.exe File created C:\windows\SysWOW64\BAWSN.exe XKP.exe File created C:\windows\SysWOW64\FMOWEQ.exe.bat BEHW.exe File created C:\windows\SysWOW64\XADPX.exe.bat REMGTGR.exe File opened for modification C:\windows\SysWOW64\OTIN.exe BIAOGI.exe File created C:\windows\SysWOW64\XNO.exe.bat PHB.exe File created C:\windows\SysWOW64\JRDI.exe ROZEOT.exe File created C:\windows\SysWOW64\QWY.exe MTAHF.exe File opened for modification C:\windows\SysWOW64\BAWSN.exe XKP.exe File created C:\windows\SysWOW64\XADPX.exe REMGTGR.exe File opened for modification C:\windows\SysWOW64\XADPX.exe REMGTGR.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\KYJJG.exe.bat AAEOZ.exe File created C:\windows\HMX.exe SROET.exe File created C:\windows\system\ROZEOT.exe.bat QTVJ.exe File created C:\windows\MTAHF.exe NDPESL.exe File opened for modification C:\windows\CVSYEK.exe LNMBST.exe File created C:\windows\BABIHN.exe JXPMBXM.exe File created C:\windows\QTVJ.exe.bat DINKVS.exe File created C:\windows\QHEMLZ.exe CWOVXW.exe File created C:\windows\system\YAMC.exe NHXRII.exe File created C:\windows\system\NFTRQBK.exe.bat NRTCPO.exe File opened for modification C:\windows\SKLGHXF.exe NFTRQBK.exe File created C:\windows\HAMF.exe SKLGHXF.exe File opened for modification C:\windows\UEY.exe EOXDV.exe File opened for modification C:\windows\system\CDZEA.exe UQN.exe File created C:\windows\system\BOCUJSB.exe.bat CDZEA.exe File created C:\windows\system\UXZFZ.exe BUVBUQ.exe File opened for modification C:\windows\system\YAMC.exe NHXRII.exe File created C:\windows\WGV.exe OTIN.exe File created C:\windows\system\HHTRQQQ.exe QHEMLZ.exe File opened for modification C:\windows\LMZLLV.exe DYMEAO.exe File opened for modification C:\windows\FNZ.exe SCIGB.exe File created C:\windows\system\BLVTP.exe.bat QDPLDZI.exe File created C:\windows\FHIMUW.exe.bat GWFWMII.exe File created C:\windows\system\BGDON.exe CVSYEK.exe File created C:\windows\ODDA.exe.bat BGDON.exe File opened for modification C:\windows\HMX.exe SROET.exe File created C:\windows\system\NFTRQBK.exe NRTCPO.exe File created C:\windows\HAMF.exe.bat SKLGHXF.exe File created C:\windows\REMGTGR.exe CJUCI.exe File opened for modification C:\windows\system\UOZ.exe BLVTP.exe File created C:\windows\UEY.exe.bat EOXDV.exe File created C:\windows\LMZLLV.exe.bat DYMEAO.exe File created C:\windows\system\ZZBSPAG.exe PYZFM.exe File created C:\windows\BMGC.exe.bat ZZBSPAG.exe File created C:\windows\UQN.exe.bat TVJBKP.exe File created C:\windows\system\ROZEOT.exe QTVJ.exe File created C:\windows\system\TIKV.exe.bat UXZFZ.exe File created C:\windows\system\KFEG.exe.bat QSZXLDE.exe File created C:\windows\system\GWFWMII.exe YRTPBJM.exe File created C:\windows\system\ZZBSPAG.exe.bat PYZFM.exe File created C:\windows\UPFAXEM.exe.bat 2026-07-21_1e5a77edad8876eaff28a0e33ec7e432_elex_emotet_stop.exe File opened for modification C:\windows\system\BEHW.exe BAWSN.exe File created C:\windows\system\NRTCPO.exe.bat FMOWEQ.exe File created C:\windows\RADBB.exe NSWBP.exe File created C:\windows\UEY.exe EOXDV.exe File opened for modification C:\windows\KIYJDKQ.exe RFUOX.exe File opened for modification C:\windows\UQN.exe TVJBKP.exe File opened for modification C:\windows\system\FZHHY.exe QWY.exe File opened for modification C:\windows\system\PHB.exe WEXZAB.exe File created C:\windows\BIEWFYI.exe TVSPV.exe File created C:\windows\CVSYEK.exe LNMBST.exe File created C:\windows\FNZ.exe.bat SCIGB.exe File created C:\windows\system\YAMC.exe.bat NHXRII.exe File created C:\windows\SKLGHXF.exe NFTRQBK.exe File created C:\windows\system\DKM.exe.bat BMGC.exe File created C:\windows\system\UOZ.exe BLVTP.exe File opened for modification C:\windows\WGV.exe OTIN.exe File opened for modification C:\windows\system\BOCUJSB.exe CDZEA.exe File opened for modification C:\windows\HAMF.exe SKLGHXF.exe File created C:\windows\WGV.exe.bat OTIN.exe File created C:\windows\UQN.exe TVJBKP.exe File created C:\windows\system\CDZEA.exe UQN.exe File created C:\windows\MTAHF.exe.bat NDPESL.exe File opened for modification C:\windows\system\QSZXLDE.exe EKSP.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3080 cmd.exe 2196 cmd.exe 4604 cmd.exe 3088 cmd.exe 4728 cmd.exe 1764 cmd.exe 2640 cmd.exe 2272 cmd.exe 4656 cmd.exe 2244 cmd.exe 3712 cmd.exe 4180 cmd.exe 4568 cmd.exe 4596 cmd.exe 3472 cmd.exe 864 cmd.exe 6080 cmd.exe 4384 cmd.exe 1564 cmd.exe 2628 cmd.exe 2336 cmd.exe 1756 cmd.exe 1012 cmd.exe 1680 cmd.exe 5812 cmd.exe 5644 cmd.exe 6068 cmd.exe 4860 cmd.exe 2404 cmd.exe 4252 cmd.exe 5276 cmd.exe 3648 cmd.exe 2364 cmd.exe 1980 cmd.exe 1620 cmd.exe 3244 cmd.exe 1668 cmd.exe 5580 cmd.exe 1368 cmd.exe 828 cmd.exe 5532 cmd.exe 4960 cmd.exe 5520 cmd.exe 5624 cmd.exe 3148 cmd.exe 4184 cmd.exe 2732 cmd.exe 3688 cmd.exe 5792 cmd.exe 4556 cmd.exe 3904 cmd.exe 4668 cmd.exe 2608 cmd.exe 2008 cmd.exe 3636 cmd.exe 3240 cmd.exe 4308 cmd.exe 2192 cmd.exe 4792 cmd.exe 5768 cmd.exe 6032 cmd.exe 4324 cmd.exe 3164 cmd.exe 3900 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 2784 2776 WerFault.exe 87 2404 2764 WerFault.exe 93 1620 5224 WerFault.exe 99 1380 5900 WerFault.exe 104 1408 2556 WerFault.exe 109 2328 3324 WerFault.exe 114 3748 2384 WerFault.exe 119 2528 4980 WerFault.exe 124 5632 5876 WerFault.exe 129 4704 5616 WerFault.exe 134 3420 4168 WerFault.exe 139 4512 4876 WerFault.exe 144 3648 2864 WerFault.exe 149 5188 4780 WerFault.exe 154 6064 4848 WerFault.exe 159 1012 3360 WerFault.exe 164 5844 4644 WerFault.exe 169 4288 5332 WerFault.exe 174 5324 3404 WerFault.exe 179 3120 5668 WerFault.exe 184 3340 4756 WerFault.exe 189 5952 2604 WerFault.exe 194 2944 5872 WerFault.exe 199 3904 3468 WerFault.exe 204 3484 204 WerFault.exe 209 4600 3672 WerFault.exe 214 3124 5788 WerFault.exe 219 2008 5844 WerFault.exe 224 996 4288 WerFault.exe 229 1984 1016 WerFault.exe 234 4324 4124 WerFault.exe 239 5628 6044 WerFault.exe 244 2812 1716 WerFault.exe 249 2056 4964 WerFault.exe 254 3228 1056 WerFault.exe 259 5688 5824 WerFault.exe 264 4624 1408 WerFault.exe 269 5936 5240 WerFault.exe 275 1480 244 WerFault.exe 280 2968 4944 WerFault.exe 285 3136 4468 WerFault.exe 290 4056 2376 WerFault.exe 295 2564 1776 WerFault.exe 300 2408 5676 WerFault.exe 305 6012 3216 WerFault.exe 310 4148 2680 WerFault.exe 315 3676 5180 WerFault.exe 320 4556 1848 WerFault.exe 325 4040 5104 WerFault.exe 330 4340 2928 WerFault.exe 335 5348 6008 WerFault.exe 340 2904 2780 WerFault.exe 345 3100 364 WerFault.exe 350 3740 4408 WerFault.exe 355 4196 2188 WerFault.exe 360 2364 756 WerFault.exe 365 2180 2532 WerFault.exe 370 5724 3916 WerFault.exe 375 3420 4240 WerFault.exe 380 1944 4584 WerFault.exe 385 1080 5108 WerFault.exe 390 2288 5828 WerFault.exe 395 5260 1300 WerFault.exe 400 2276 2820 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HAMF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GKDM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PHB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QTVJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SROET.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CWOVXW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HHTRQQQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YRTPBJM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BAWSN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QDPLDZI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BIAOGI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FZHHY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KWQAZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NSWBP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YWGOHR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BGDON.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BLVTP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XNO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BIEWFYI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KYJJG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OJH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ENQSM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UXZFZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NFTRQBK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OTIN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JRDI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QWY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QSZXLDE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FMOWEQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FNZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2776 2026-07-21_1e5a77edad8876eaff28a0e33ec7e432_elex_emotet_stop.exe 2776 2026-07-21_1e5a77edad8876eaff28a0e33ec7e432_elex_emotet_stop.exe 2764 UPFAXEM.exe 2764 UPFAXEM.exe 5224 LNMBST.exe 5224 LNMBST.exe 5900 CVSYEK.exe 5900 CVSYEK.exe 2556 BGDON.exe 2556 BGDON.exe 3324 ODDA.exe 3324 ODDA.exe 2384 DYMEAO.exe 2384 DYMEAO.exe 4980 LMZLLV.exe 4980 LMZLLV.exe 5876 GZE.exe 5876 GZE.exe 5616 KPLCH.exe 5616 KPLCH.exe 4168 QDKDEI.exe 4168 QDKDEI.exe 4876 SAPXT.exe 4876 SAPXT.exe 2864 NLY.exe 2864 NLY.exe 4780 GOKSNRY.exe 4780 GOKSNRY.exe 4848 KWQAZ.exe 4848 KWQAZ.exe 3360 SCIGB.exe 3360 SCIGB.exe 4644 FNZ.exe 4644 FNZ.exe 5332 AAEOZ.exe 5332 AAEOZ.exe 3404 KYJJG.exe 3404 KYJJG.exe 5668 OJH.exe 5668 OJH.exe 4756 SROET.exe 4756 SROET.exe 2604 HMX.exe 2604 HMX.exe 5872 NHXRII.exe 5872 NHXRII.exe 3468 YAMC.exe 3468 YAMC.exe 204 XKP.exe 204 XKP.exe 3672 BAWSN.exe 3672 BAWSN.exe 5788 BEHW.exe 5788 BEHW.exe 5844 FMOWEQ.exe 5844 FMOWEQ.exe 4288 NRTCPO.exe 4288 NRTCPO.exe 1016 NFTRQBK.exe 1016 NFTRQBK.exe 4124 SKLGHXF.exe 4124 SKLGHXF.exe 6044 HAMF.exe 6044 HAMF.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2776 2026-07-21_1e5a77edad8876eaff28a0e33ec7e432_elex_emotet_stop.exe 2776 2026-07-21_1e5a77edad8876eaff28a0e33ec7e432_elex_emotet_stop.exe 2764 UPFAXEM.exe 2764 UPFAXEM.exe 5224 LNMBST.exe 5224 LNMBST.exe 5900 CVSYEK.exe 5900 CVSYEK.exe 2556 BGDON.exe 2556 BGDON.exe 3324 ODDA.exe 3324 ODDA.exe 2384 DYMEAO.exe 2384 DYMEAO.exe 4980 LMZLLV.exe 4980 LMZLLV.exe 5876 GZE.exe 5876 GZE.exe 5616 KPLCH.exe 5616 KPLCH.exe 4168 QDKDEI.exe 4168 QDKDEI.exe 4876 SAPXT.exe 4876 SAPXT.exe 2864 NLY.exe 2864 NLY.exe 4780 GOKSNRY.exe 4780 GOKSNRY.exe 4848 KWQAZ.exe 4848 KWQAZ.exe 3360 SCIGB.exe 3360 SCIGB.exe 4644 FNZ.exe 4644 FNZ.exe 5332 AAEOZ.exe 5332 AAEOZ.exe 3404 KYJJG.exe 3404 KYJJG.exe 5668 OJH.exe 5668 OJH.exe 4756 SROET.exe 4756 SROET.exe 2604 HMX.exe 2604 HMX.exe 5872 NHXRII.exe 5872 NHXRII.exe 3468 YAMC.exe 3468 YAMC.exe 204 XKP.exe 204 XKP.exe 3672 BAWSN.exe 3672 BAWSN.exe 5788 BEHW.exe 5788 BEHW.exe 5844 FMOWEQ.exe 5844 FMOWEQ.exe 4288 NRTCPO.exe 4288 NRTCPO.exe 1016 NFTRQBK.exe 1016 NFTRQBK.exe 4124 SKLGHXF.exe 4124 SKLGHXF.exe 6044 HAMF.exe 6044 HAMF.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2776 wrote to memory of 4676 2776 2026-07-21_1e5a77edad8876eaff28a0e33ec7e432_elex_emotet_stop.exe 89 PID 4676 wrote to memory of 2764 4676 cmd.exe 93 PID 2764 wrote to memory of 5172 2764 UPFAXEM.exe 95 PID 5172 wrote to memory of 5224 5172 cmd.exe 99 PID 5224 wrote to memory of 1456 5224 LNMBST.exe 100 PID 1456 wrote to memory of 5900 1456 cmd.exe 104 PID 5900 wrote to memory of 2732 5900 CVSYEK.exe 105 PID 2732 wrote to memory of 2556 2732 cmd.exe 109 PID 2556 wrote to memory of 3244 2556 BGDON.exe 110 PID 3244 wrote to memory of 3324 3244 cmd.exe 114 PID 3324 wrote to memory of 4088 3324 ODDA.exe 115 PID 4088 wrote to memory of 2384 4088 cmd.exe 119 PID 2384 wrote to memory of 2516 2384 DYMEAO.exe 120 PID 2516 wrote to memory of 4980 2516 cmd.exe 124 PID 4980 wrote to memory of 6100 4980 LMZLLV.exe 125 PID 6100 wrote to memory of 5876 6100 cmd.exe 129 PID 5876 wrote to memory of 3164 5876 GZE.exe 130 PID 3164 wrote to memory of 5616 3164 cmd.exe 134 PID 5616 wrote to memory of 5840 5616 KPLCH.exe 135 PID 5840 wrote to memory of 4168 5840 cmd.exe 139 PID 4168 wrote to memory of 832 4168 QDKDEI.exe 140 PID 832 wrote to memory of 4876 832 cmd.exe 144 PID 4876 wrote to memory of 920 4876 SAPXT.exe 145 PID 920 wrote to memory of 2864 920 cmd.exe 149 PID 2864 wrote to memory of 1668 2864 NLY.exe 150 PID 1668 wrote to memory of 4780 1668 cmd.exe 154 PID 4780 wrote to memory of 5520 4780 GOKSNRY.exe 155 PID 5520 wrote to memory of 4848 5520 cmd.exe 159 PID 4848 wrote to memory of 5664 4848 KWQAZ.exe 160 PID 5664 wrote to memory of 3360 5664 cmd.exe 164 PID 3360 wrote to memory of 1968 3360 SCIGB.exe 165 PID 1968 wrote to memory of 4644 1968 cmd.exe 169 PID 4644 wrote to memory of 3076 4644 FNZ.exe 170 PID 3076 wrote to memory of 5332 3076 cmd.exe 174 PID 5332 wrote to memory of 5580 5332 AAEOZ.exe 175 PID 5580 wrote to memory of 3404 5580 cmd.exe 179 PID 3404 wrote to memory of 2608 3404 KYJJG.exe 180 PID 2608 wrote to memory of 5668 2608 cmd.exe 184 PID 5668 wrote to memory of 3688 5668 OJH.exe 185 PID 3688 wrote to memory of 4756 3688 cmd.exe 189 PID 4756 wrote to memory of 864 4756 SROET.exe 190 PID 864 wrote to memory of 2604 864 cmd.exe 194 PID 2604 wrote to memory of 1224 2604 HMX.exe 195 PID 1224 wrote to memory of 5872 1224 cmd.exe 199 PID 5872 wrote to memory of 2404 5872 NHXRII.exe 200 PID 2404 wrote to memory of 3468 2404 cmd.exe 204 PID 3468 wrote to memory of 460 3468 YAMC.exe 205 PID 460 wrote to memory of 204 460 cmd.exe 209 PID 204 wrote to memory of 1368 204 XKP.exe 210 PID 1368 wrote to memory of 3672 1368 cmd.exe 214 PID 3672 wrote to memory of 5780 3672 BAWSN.exe 215 PID 5780 wrote to memory of 5788 5780 cmd.exe 219 PID 5788 wrote to memory of 5792 5788 BEHW.exe 220 PID 5792 wrote to memory of 5844 5792 cmd.exe 224 PID 5844 wrote to memory of 3472 5844 FMOWEQ.exe 225 PID 3472 wrote to memory of 4288 3472 cmd.exe 229 PID 4288 wrote to memory of 2824 4288 NRTCPO.exe 230 PID 2824 wrote to memory of 1016 2824 cmd.exe 234 PID 1016 wrote to memory of 1796 1016 NFTRQBK.exe 235 PID 1796 wrote to memory of 4124 1796 cmd.exe 239 PID 4124 wrote to memory of 2896 4124 SKLGHXF.exe 240 PID 2896 wrote to memory of 6044 2896 cmd.exe 244 PID 6044 wrote to memory of 5892 6044 HAMF.exe 245 PID 5892 wrote to memory of 1716 5892 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_1e5a77edad8876eaff28a0e33ec7e432_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-21_1e5a77edad8876eaff28a0e33ec7e432_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UPFAXEM.exe.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\windows\UPFAXEM.exeC:\windows\UPFAXEM.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LNMBST.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:5172 -
C:\windows\SysWOW64\LNMBST.exeC:\windows\system32\LNMBST.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5224 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CVSYEK.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\windows\CVSYEK.exeC:\windows\CVSYEK.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BGDON.exe.bat" "8⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\windows\system\BGDON.exeC:\windows\system\BGDON.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ODDA.exe.bat" "10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3244 -
C:\windows\ODDA.exeC:\windows\ODDA.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DYMEAO.exe.bat" "12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\windows\SysWOW64\DYMEAO.exeC:\windows\system32\DYMEAO.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LMZLLV.exe.bat" "14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\windows\LMZLLV.exeC:\windows\LMZLLV.exe15⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GZE.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:6100 -
C:\windows\GZE.exeC:\windows\GZE.exe17⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KPLCH.exe.bat" "18⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\windows\KPLCH.exeC:\windows\KPLCH.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QDKDEI.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:5840 -
C:\windows\SysWOW64\QDKDEI.exeC:\windows\system32\QDKDEI.exe21⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SAPXT.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:832 -
C:\windows\SAPXT.exeC:\windows\SAPXT.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NLY.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:920 -
C:\windows\SysWOW64\NLY.exeC:\windows\system32\NLY.exe25⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GOKSNRY.exe.bat" "26⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\windows\SysWOW64\GOKSNRY.exeC:\windows\system32\GOKSNRY.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KWQAZ.exe.bat" "28⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5520 -
C:\windows\SysWOW64\KWQAZ.exeC:\windows\system32\KWQAZ.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SCIGB.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:5664 -
C:\windows\SysWOW64\SCIGB.exeC:\windows\system32\SCIGB.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FNZ.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\windows\FNZ.exeC:\windows\FNZ.exe33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AAEOZ.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:3076 -
C:\windows\SysWOW64\AAEOZ.exeC:\windows\system32\AAEOZ.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5332 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KYJJG.exe.bat" "36⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5580 -
C:\windows\system\KYJJG.exeC:\windows\system\KYJJG.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OJH.exe.bat" "38⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\windows\SysWOW64\OJH.exeC:\windows\system32\OJH.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SROET.exe.bat" "40⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3688 -
C:\windows\SROET.exeC:\windows\SROET.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HMX.exe.bat" "42⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:864 -
C:\windows\HMX.exeC:\windows\HMX.exe43⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NHXRII.exe.bat" "44⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\windows\system\NHXRII.exeC:\windows\system\NHXRII.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YAMC.exe.bat" "46⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\windows\system\YAMC.exeC:\windows\system\YAMC.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XKP.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:460 -
C:\windows\SysWOW64\XKP.exeC:\windows\system32\XKP.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:204 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BAWSN.exe.bat" "50⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\windows\SysWOW64\BAWSN.exeC:\windows\system32\BAWSN.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BEHW.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:5780 -
C:\windows\system\BEHW.exeC:\windows\system\BEHW.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FMOWEQ.exe.bat" "54⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5792 -
C:\windows\SysWOW64\FMOWEQ.exeC:\windows\system32\FMOWEQ.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NRTCPO.exe.bat" "56⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\windows\system\NRTCPO.exeC:\windows\system\NRTCPO.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NFTRQBK.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\windows\system\NFTRQBK.exeC:\windows\system\NFTRQBK.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SKLGHXF.exe.bat" "60⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\windows\SKLGHXF.exeC:\windows\SKLGHXF.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HAMF.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\windows\HAMF.exeC:\windows\HAMF.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LITFZC.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:5892 -
C:\windows\SysWOW64\LITFZC.exeC:\windows\system32\LITFZC.exe65⤵
- Executes dropped EXE
PID:1716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PYZFM.exe.bat" "66⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:6080 -
C:\windows\PYZFM.exeC:\windows\PYZFM.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZZBSPAG.exe.bat" "68⤵PID:1900
-
C:\windows\system\ZZBSPAG.exeC:\windows\system\ZZBSPAG.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1056 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BMGC.exe.bat" "70⤵
- System Location Discovery: System Language Discovery
PID:2908 -
C:\windows\BMGC.exeC:\windows\BMGC.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DKM.exe.bat" "72⤵PID:4276
-
C:\windows\system\DKM.exeC:\windows\system\DKM.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ENQSM.exe.bat" "74⤵
- Executes a command shell one-liner
PID:828 -
C:\windows\SysWOW64\ENQSM.exeC:\windows\system32\ENQSM.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GKDM.exe.bat" "76⤵PID:1360
-
C:\windows\SysWOW64\GKDM.exeC:\windows\system32\GKDM.exe77⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QIJHJPW.exe.bat" "78⤵
- System Location Discovery: System Language Discovery
PID:2400 -
C:\windows\system\QIJHJPW.exeC:\windows\system\QIJHJPW.exe79⤵
- Executes dropped EXE
PID:4944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ILNCPF.exe.bat" "80⤵PID:1248
-
C:\windows\system\ILNCPF.exeC:\windows\system\ILNCPF.exe81⤵
- Executes dropped EXE
PID:4468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AMPHACA.exe.bat" "82⤵PID:5608
-
C:\windows\system\AMPHACA.exeC:\windows\system\AMPHACA.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CJUCI.exe.bat" "84⤵
- System Location Discovery: System Language Discovery
PID:5512 -
C:\windows\SysWOW64\CJUCI.exeC:\windows\system32\CJUCI.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\REMGTGR.exe.bat" "86⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3648 -
C:\windows\REMGTGR.exeC:\windows\REMGTGR.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5676 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XADPX.exe.bat" "88⤵PID:2056
-
C:\windows\SysWOW64\XADPX.exeC:\windows\system32\XADPX.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3216 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QDPLDZI.exe.bat" "90⤵PID:5964
-
C:\windows\SysWOW64\QDPLDZI.exeC:\windows\system32\QDPLDZI.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2680 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BLVTP.exe.bat" "92⤵PID:2592
-
C:\windows\system\BLVTP.exeC:\windows\system\BLVTP.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5180 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UOZ.exe.bat" "94⤵PID:5116
-
C:\windows\system\UOZ.exeC:\windows\system\UOZ.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YWGOHR.exe.bat" "96⤵
- Executes a command shell one-liner
PID:2008 -
C:\windows\SysWOW64\YWGOHR.exeC:\windows\system32\YWGOHR.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5104 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IULJW.exe.bat" "98⤵
- Executes a command shell one-liner
PID:3900 -
C:\windows\SysWOW64\IULJW.exeC:\windows\system32\IULJW.exe99⤵
- Executes dropped EXE
PID:2928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JXPMBXM.exe.bat" "100⤵
- System Location Discovery: System Language Discovery
PID:3644 -
C:\windows\JXPMBXM.exeC:\windows\JXPMBXM.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6008 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BABIHN.exe.bat" "102⤵
- System Location Discovery: System Language Discovery
PID:5160 -
C:\windows\BABIHN.exeC:\windows\BABIHN.exe103⤵
- Executes dropped EXE
PID:2780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NSWBP.exe.bat" "104⤵
- Executes a command shell one-liner
PID:4604 -
C:\windows\system\NSWBP.exeC:\windows\system\NSWBP.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RADBB.exe.bat" "106⤵PID:4204
-
C:\windows\RADBB.exeC:\windows\RADBB.exe107⤵
- Executes dropped EXE
PID:4408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RDOFHDA.exe.bat" "108⤵
- System Location Discovery: System Language Discovery
PID:2408 -
C:\windows\system\RDOFHDA.exeC:\windows\system\RDOFHDA.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EOXDV.exe.bat" "110⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4184 -
C:\windows\SysWOW64\EOXDV.exeC:\windows\system32\EOXDV.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UEY.exe.bat" "112⤵
- System Location Discovery: System Language Discovery
PID:1072 -
C:\windows\UEY.exeC:\windows\UEY.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QKQK.exe.bat" "114⤵
- System Location Discovery: System Language Discovery
PID:1544 -
C:\windows\SysWOW64\QKQK.exeC:\windows\system32\QKQK.exe115⤵
- Executes dropped EXE
PID:3916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RFUOX.exe.bat" "116⤵PID:1244
-
C:\windows\system\RFUOX.exeC:\windows\system\RFUOX.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KIYJDKQ.exe.bat" "118⤵
- System Location Discovery: System Language Discovery
PID:5476 -
C:\windows\KIYJDKQ.exeC:\windows\KIYJDKQ.exe119⤵
- Executes dropped EXE
PID:4584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BIAOGI.exe.bat" "120⤵
- Executes a command shell one-liner
PID:5532 -
C:\windows\system\BIAOGI.exeC:\windows\system\BIAOGI.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5108
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-