Analysis
- max time kernel
67s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
23/07/2026, 12:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-23_230b8efcb8e13809baf2dd4c9562e2ee_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-07-23_230b8efcb8e13809baf2dd4c9562e2ee_elex_emotet_stop.exe
- Size 208KB
- Sample260723-pfcd6awvc1
- SHA256 e078274a54080ada774afd37405c0d06413b36577b54ae03712bc962b5612f72
- MD5 230b8efcb8e13809baf2dd4c9562e2ee
- SHA1 4db7cd3d426430612f4c69f27e42823d5a03e97e
- SHA512 9beb2a57c1dfec2f8ac8282cb6494a2e0eae55cb0deccf4470ecd4d62ccec403f4056806ba48213d00a2da07194f641e03c78515527a9fbee0cf565435bb7b8c
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbclcdL+LOfU4NLthEjQT6j:MlZtbLWIgd1LZ9oECZbclc5+LO8QEj1
- TLSH T1ED247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5852 EKLT.exe 3864 DOW.exe 2436 IOSGCL.exe 1236 YETXJ.exe 4716 BMAFVZF.exe 244 EHR.exe 4424 IKPCGD.exe 1028 XFYG.exe 4256 FWZFY.exe 2120 YOPQP.exe 4288 CEVQCFQ.exe 1456 FMEN.exe 4220 WVLK.exe 4732 GSY.exe 464 KAFFPI.exe 1868 BLVDPD.exe 2972 XRBAW.exe 6000 KUJQK.exe 4704 AKSQQLB.exe 4528 NUBOFOP.exe 4520 RKIO.exe 880 VNGJRZN.exe 416 ATYZHC.exe 5548 YEBHI.exe 4904 IED.exe 4864 QSP.exe 1988 HFA.exe 5616 OVBKSXM.exe 5792 RIGT.exe 5036 PJNPMZ.exe 4648 RWK.exe 5476 OWUBACA.exe 1220 BZCZO.exe 3692 HUOSCU.exe 1924 XKP.exe 5208 BAWSN.exe 4488 GBFUQE.exe 4180 JJMC.exe 3048 NRTCPO.exe 3196 DHUC.exe 2232 HXICIUS.exe 1616 YXC.exe 4196 XVVKYFC.exe 2040 BYUF.exe 4200 JEYL.exe 2940 DZDVTW.exe 1164 YMI.exe 3616 RFX.exe 4872 EQGOBA.exe 5720 KLF.exe 1652 FYKYQ.exe 3968 CECN.exe 3544 LEESJDQ.exe 5744 CMY.exe 832 RHPKGV.exe 2968 FFPVI.exe 4692 ABUFSHR.exe 1356 AWYB.exe 1752 VRDSI.exe 4144 KMM.exe 760 OUTWFC.exe 2272 UPS.exe 4140 WNG.exe 5704 JYOQFQ.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\VNGJRZN.exe RKIO.exe File created C:\windows\SysWOW64\LHMTNU.exe STNVI.exe File opened for modification C:\windows\SysWOW64\NEZ.exe LHMTNU.exe File created C:\windows\SysWOW64\BMAFVZF.exe.bat YETXJ.exe File created C:\windows\SysWOW64\BYUF.exe XVVKYFC.exe File created C:\windows\SysWOW64\WQQM.exe ENM.exe File opened for modification C:\windows\SysWOW64\STNVI.exe LYBCC.exe File created C:\windows\SysWOW64\STNVI.exe.bat LYBCC.exe File opened for modification C:\windows\SysWOW64\LHMTNU.exe STNVI.exe File opened for modification C:\windows\SysWOW64\GXH.exe NEZ.exe File created C:\windows\SysWOW64\BAWSN.exe XKP.exe File created C:\windows\SysWOW64\CECN.exe.bat FYKYQ.exe File created C:\windows\SysWOW64\OUTWFC.exe.bat KMM.exe File created C:\windows\SysWOW64\BLVDPD.exe KAFFPI.exe File created C:\windows\SysWOW64\CEVQCFQ.exe YOPQP.exe File created C:\windows\SysWOW64\XRBAW.exe BLVDPD.exe File opened for modification C:\windows\SysWOW64\OWUBACA.exe RWK.exe File created C:\windows\SysWOW64\YXC.exe HXICIUS.exe File created C:\windows\SysWOW64\JEYL.exe.bat BYUF.exe File opened for modification C:\windows\SysWOW64\CECN.exe FYKYQ.exe File created C:\windows\SysWOW64\LHMTNU.exe.bat STNVI.exe File created C:\windows\SysWOW64\OWUBACA.exe.bat RWK.exe File created C:\windows\SysWOW64\JEYL.exe BYUF.exe File opened for modification C:\windows\SysWOW64\JEYL.exe BYUF.exe File created C:\windows\SysWOW64\FFPVI.exe RHPKGV.exe File created C:\windows\SysWOW64\JZHHNO.exe.bat FJB.exe File opened for modification C:\windows\SysWOW64\SCVVW.exe TSTFWG.exe File created C:\windows\SysWOW64\YXC.exe.bat HXICIUS.exe File created C:\windows\SysWOW64\ATYZHC.exe VNGJRZN.exe File opened for modification C:\windows\SysWOW64\BLVDPD.exe KAFFPI.exe File opened for modification C:\windows\SysWOW64\YEBHI.exe ATYZHC.exe File created C:\windows\SysWOW64\XKP.exe.bat HUOSCU.exe File created C:\windows\SysWOW64\NEZ.exe LHMTNU.exe File created C:\windows\SysWOW64\GXH.exe.bat NEZ.exe File created C:\windows\SysWOW64\BMAFVZF.exe YETXJ.exe File opened for modification C:\windows\SysWOW64\GSY.exe WVLK.exe File created C:\windows\SysWOW64\RKIO.exe NUBOFOP.exe File created C:\windows\SysWOW64\ATYZHC.exe.bat VNGJRZN.exe File created C:\windows\SysWOW64\RWK.exe PJNPMZ.exe File opened for modification C:\windows\SysWOW64\RWK.exe PJNPMZ.exe File created C:\windows\SysWOW64\LEESJDQ.exe.bat CECN.exe File created C:\windows\SysWOW64\KMM.exe VRDSI.exe File created C:\windows\SysWOW64\YETXJ.exe.bat IOSGCL.exe File created C:\windows\SysWOW64\HFA.exe.bat QSP.exe File opened for modification C:\windows\SysWOW64\BAWSN.exe XKP.exe File opened for modification C:\windows\SysWOW64\OUTWFC.exe KMM.exe File created C:\windows\SysWOW64\EOXDV.exe PLNRCTN.exe File created C:\windows\SysWOW64\WQQM.exe.bat ENM.exe File created C:\windows\SysWOW64\YETXJ.exe IOSGCL.exe File created C:\windows\SysWOW64\KUJQK.exe XRBAW.exe File created C:\windows\SysWOW64\VNGJRZN.exe RKIO.exe File created C:\windows\SysWOW64\HFA.exe QSP.exe File created C:\windows\SysWOW64\CECN.exe FYKYQ.exe File opened for modification C:\windows\SysWOW64\JZHHNO.exe FJB.exe File created C:\windows\SysWOW64\RKIO.exe.bat NUBOFOP.exe File opened for modification C:\windows\SysWOW64\YXC.exe HXICIUS.exe File created C:\windows\SysWOW64\BYUF.exe.bat XVVKYFC.exe File opened for modification C:\windows\SysWOW64\FFPVI.exe RHPKGV.exe File opened for modification C:\windows\SysWOW64\WQQM.exe ENM.exe File created C:\windows\SysWOW64\SCVVW.exe.bat TSTFWG.exe File created C:\windows\SysWOW64\HSJNM.exe SCVVW.exe File opened for modification C:\windows\SysWOW64\HSJNM.exe SCVVW.exe File created C:\windows\SysWOW64\YEBHI.exe.bat ATYZHC.exe File created C:\windows\SysWOW64\XKP.exe HUOSCU.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\FMEN.exe CEVQCFQ.exe File created C:\windows\BZCZO.exe OWUBACA.exe File created C:\windows\NWHE.exe XGGNBWB.exe File opened for modification C:\windows\QSP.exe IED.exe File created C:\windows\system\ABUFSHR.exe.bat FFPVI.exe File created C:\windows\system\ILXBQ.exe OQS.exe File created C:\windows\system\YOPQP.exe.bat FWZFY.exe File opened for modification C:\windows\DHUC.exe NRTCPO.exe File opened for modification C:\windows\NWHE.exe XGGNBWB.exe File opened for modification C:\windows\IKPCGD.exe EHR.exe File created C:\windows\EHR.exe BMAFVZF.exe File opened for modification C:\windows\KLF.exe EQGOBA.exe File created C:\windows\system\RIGT.exe.bat OVBKSXM.exe File created C:\windows\system\NRTCPO.exe JJMC.exe File created C:\windows\system\RFX.exe YMI.exe File created C:\windows\system\RHPKGV.exe CMY.exe File created C:\windows\UPS.exe.bat OUTWFC.exe File created C:\windows\system\EKLT.exe 2026-07-23_230b8efcb8e13809baf2dd4c9562e2ee_elex_emotet_stop.exe File created C:\windows\DOW.exe.bat EKLT.exe File opened for modification C:\windows\EHR.exe BMAFVZF.exe File created C:\windows\QSP.exe.bat IED.exe File created C:\windows\system\HUOSCU.exe.bat BZCZO.exe File created C:\windows\DHUC.exe NRTCPO.exe File opened for modification C:\windows\system\AWYB.exe ABUFSHR.exe File opened for modification C:\windows\UPS.exe OUTWFC.exe File opened for modification C:\windows\system\KAFFPI.exe GSY.exe File created C:\windows\KLF.exe EQGOBA.exe File opened for modification C:\windows\CMY.exe LEESJDQ.exe File created C:\windows\system\ABUFSHR.exe FFPVI.exe File created C:\windows\system\ENM.exe.bat JZHHNO.exe File opened for modification C:\windows\system\OQS.exe WQQM.exe File created C:\windows\IKPCGD.exe EHR.exe File created C:\windows\FYKYQ.exe.bat KLF.exe File opened for modification C:\windows\system\ENM.exe JZHHNO.exe File opened for modification C:\windows\system\EKLT.exe 2026-07-23_230b8efcb8e13809baf2dd4c9562e2ee_elex_emotet_stop.exe File created C:\windows\EHR.exe.bat BMAFVZF.exe File opened for modification C:\windows\system\AKSQQLB.exe KUJQK.exe File created C:\windows\system\PJNPMZ.exe RIGT.exe File opened for modification C:\windows\DZDVTW.exe JEYL.exe File opened for modification C:\windows\JYOQFQ.exe WNG.exe File created C:\windows\system\FJB.exe.bat EOXDV.exe File opened for modification C:\windows\NUBOFOP.exe AKSQQLB.exe File opened for modification C:\windows\system\XVVKYFC.exe YXC.exe File created C:\windows\system\YMI.exe.bat DZDVTW.exe File created C:\windows\system\WNG.exe.bat UPS.exe File created C:\windows\system\WVLK.exe.bat FMEN.exe File created C:\windows\system\GBFUQE.exe BAWSN.exe File opened for modification C:\windows\system\NRTCPO.exe JJMC.exe File created C:\windows\JYOQFQ.exe.bat WNG.exe File created C:\windows\DOW.exe EKLT.exe File created C:\windows\system\JJMC.exe.bat GBFUQE.exe File created C:\windows\NUBOFOP.exe AKSQQLB.exe File created C:\windows\IED.exe YEBHI.exe File created C:\windows\system\XVVKYFC.exe YXC.exe File created C:\windows\FYKYQ.exe KLF.exe File opened for modification C:\windows\LYBCC.exe HSJNM.exe File created C:\windows\XFYG.exe.bat IKPCGD.exe File created C:\windows\system\KAFFPI.exe.bat GSY.exe File created C:\windows\LYBCC.exe.bat HSJNM.exe File opened for modification C:\windows\XFYG.exe IKPCGD.exe File created C:\windows\system\AKSQQLB.exe KUJQK.exe File created C:\windows\OVBKSXM.exe HFA.exe File created C:\windows\system\AWYB.exe.bat ABUFSHR.exe File created C:\windows\TSTFWG.exe.bat NWHE.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4800 cmd.exe 4124 cmd.exe 4700 cmd.exe 2852 cmd.exe 1628 cmd.exe 4148 cmd.exe 2172 cmd.exe 3180 cmd.exe 5736 cmd.exe 6040 cmd.exe 3356 cmd.exe 4924 cmd.exe 5048 cmd.exe 5564 cmd.exe 5872 cmd.exe 3808 cmd.exe 4216 cmd.exe 3944 cmd.exe 2344 cmd.exe 3708 cmd.exe 4524 cmd.exe 4560 cmd.exe 6016 cmd.exe 3120 cmd.exe 4232 cmd.exe 2052 cmd.exe 1632 cmd.exe 4632 cmd.exe 1324 cmd.exe 5940 cmd.exe 712 cmd.exe 5372 cmd.exe 4152 cmd.exe 1080 cmd.exe 3052 cmd.exe 2652 cmd.exe 3316 cmd.exe 2716 cmd.exe 3704 cmd.exe 5248 cmd.exe 5020 cmd.exe 2236 cmd.exe 4856 cmd.exe 4896 cmd.exe 5260 cmd.exe 2564 cmd.exe 1428 cmd.exe 6076 cmd.exe 5356 cmd.exe 2408 cmd.exe 1444 cmd.exe 2856 cmd.exe 1976 cmd.exe 4164 cmd.exe 6064 cmd.exe 2740 cmd.exe 4712 cmd.exe 4516 cmd.exe 3332 cmd.exe 4592 cmd.exe 3908 cmd.exe 5044 cmd.exe 2128 cmd.exe 2224 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 6096 4168 WerFault.exe 87 4320 5852 WerFault.exe 93 4236 3864 WerFault.exe 99 4904 2436 WerFault.exe 104 1664 1236 WerFault.exe 109 2516 4716 WerFault.exe 114 5564 244 WerFault.exe 119 3816 4424 WerFault.exe 124 3348 1028 WerFault.exe 129 4080 4256 WerFault.exe 134 4984 2120 WerFault.exe 139 4084 4288 WerFault.exe 144 5912 1456 WerFault.exe 149 1148 4220 WerFault.exe 154 4376 4732 WerFault.exe 159 2568 464 WerFault.exe 163 3364 1868 WerFault.exe 169 4960 2972 WerFault.exe 174 4664 6000 WerFault.exe 179 5036 4704 WerFault.exe 184 4984 4528 WerFault.exe 189 5076 4520 WerFault.exe 194 1140 880 WerFault.exe 199 1148 416 WerFault.exe 204 4376 5548 WerFault.exe 209 2568 4904 WerFault.exe 214 4212 4864 WerFault.exe 219 3640 1988 WerFault.exe 224 2708 5616 WerFault.exe 229 4700 5792 WerFault.exe 234 2044 5036 WerFault.exe 239 4972 4648 WerFault.exe 244 240 5476 WerFault.exe 249 2276 1220 WerFault.exe 254 3944 3692 WerFault.exe 259 2568 1924 WerFault.exe 264 1992 5208 WerFault.exe 270 2816 4488 WerFault.exe 275 4312 4180 WerFault.exe 280 1112 3048 WerFault.exe 285 1940 3196 WerFault.exe 290 4860 2232 WerFault.exe 295 2684 1616 WerFault.exe 300 2076 4196 WerFault.exe 305 1288 2040 WerFault.exe 310 2760 4200 WerFault.exe 315 2480 2940 WerFault.exe 320 4348 1164 WerFault.exe 325 1736 3616 WerFault.exe 330 2428 4872 WerFault.exe 335 2796 5720 WerFault.exe 340 1240 1652 WerFault.exe 345 2840 3968 WerFault.exe 350 2988 3544 WerFault.exe 355 4160 5744 WerFault.exe 360 5016 832 WerFault.exe 365 1200 2968 WerFault.exe 370 2344 4692 WerFault.exe 375 5380 1356 WerFault.exe 380 5000 1752 WerFault.exe 385 596 4144 WerFault.exe 390 6116 760 WerFault.exe 395 4560 2272 WerFault.exe 400 4212 4140 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RHPKGV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BLVDPD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AKSQQLB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PLNRCTN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JZHHNO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XRBAW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BYUF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YMI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UPS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FJB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SCVVW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HSJNM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NEZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KUJQK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VRDSI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KMM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WVLK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EKLT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FMEN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GXH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEVQCFQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DOW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IOSGCL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XFYG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FWZFY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RIGT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LEESJDQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ATYZHC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FYKYQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OQS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ILXBQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HFA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JYOQFQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CECN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TSTFWG.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4168 2026-07-23_230b8efcb8e13809baf2dd4c9562e2ee_elex_emotet_stop.exe 4168 2026-07-23_230b8efcb8e13809baf2dd4c9562e2ee_elex_emotet_stop.exe 5852 EKLT.exe 5852 EKLT.exe 3864 DOW.exe 3864 DOW.exe 2436 IOSGCL.exe 2436 IOSGCL.exe 1236 YETXJ.exe 1236 YETXJ.exe 4716 BMAFVZF.exe 4716 BMAFVZF.exe 244 EHR.exe 244 EHR.exe 4424 IKPCGD.exe 4424 IKPCGD.exe 1028 XFYG.exe 1028 XFYG.exe 4256 FWZFY.exe 4256 FWZFY.exe 2120 YOPQP.exe 2120 YOPQP.exe 4288 CEVQCFQ.exe 4288 CEVQCFQ.exe 1456 FMEN.exe 1456 FMEN.exe 4220 WVLK.exe 4220 WVLK.exe 4732 GSY.exe 4732 GSY.exe 464 KAFFPI.exe 464 KAFFPI.exe 1868 BLVDPD.exe 1868 BLVDPD.exe 2972 XRBAW.exe 2972 XRBAW.exe 6000 KUJQK.exe 6000 KUJQK.exe 4704 AKSQQLB.exe 4704 AKSQQLB.exe 4528 NUBOFOP.exe 4528 NUBOFOP.exe 4520 RKIO.exe 4520 RKIO.exe 880 VNGJRZN.exe 880 VNGJRZN.exe 416 ATYZHC.exe 416 ATYZHC.exe 5548 YEBHI.exe 5548 YEBHI.exe 4904 IED.exe 4904 IED.exe 4864 QSP.exe 4864 QSP.exe 1988 HFA.exe 1988 HFA.exe 5616 OVBKSXM.exe 5616 OVBKSXM.exe 5792 RIGT.exe 5792 RIGT.exe 5036 PJNPMZ.exe 5036 PJNPMZ.exe 4648 RWK.exe 4648 RWK.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4168 2026-07-23_230b8efcb8e13809baf2dd4c9562e2ee_elex_emotet_stop.exe 4168 2026-07-23_230b8efcb8e13809baf2dd4c9562e2ee_elex_emotet_stop.exe 5852 EKLT.exe 5852 EKLT.exe 3864 DOW.exe 3864 DOW.exe 2436 IOSGCL.exe 2436 IOSGCL.exe 1236 YETXJ.exe 1236 YETXJ.exe 4716 BMAFVZF.exe 4716 BMAFVZF.exe 244 EHR.exe 244 EHR.exe 4424 IKPCGD.exe 4424 IKPCGD.exe 1028 XFYG.exe 1028 XFYG.exe 4256 FWZFY.exe 4256 FWZFY.exe 2120 YOPQP.exe 2120 YOPQP.exe 4288 CEVQCFQ.exe 4288 CEVQCFQ.exe 1456 FMEN.exe 1456 FMEN.exe 4220 WVLK.exe 4220 WVLK.exe 4732 GSY.exe 4732 GSY.exe 464 KAFFPI.exe 464 KAFFPI.exe 1868 BLVDPD.exe 1868 BLVDPD.exe 2972 XRBAW.exe 2972 XRBAW.exe 6000 KUJQK.exe 6000 KUJQK.exe 4704 AKSQQLB.exe 4704 AKSQQLB.exe 4528 NUBOFOP.exe 4528 NUBOFOP.exe 4520 RKIO.exe 4520 RKIO.exe 880 VNGJRZN.exe 880 VNGJRZN.exe 416 ATYZHC.exe 416 ATYZHC.exe 5548 YEBHI.exe 5548 YEBHI.exe 4904 IED.exe 4904 IED.exe 4864 QSP.exe 4864 QSP.exe 1988 HFA.exe 1988 HFA.exe 5616 OVBKSXM.exe 5616 OVBKSXM.exe 5792 RIGT.exe 5792 RIGT.exe 5036 PJNPMZ.exe 5036 PJNPMZ.exe 4648 RWK.exe 4648 RWK.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4168 wrote to memory of 4812 4168 2026-07-23_230b8efcb8e13809baf2dd4c9562e2ee_elex_emotet_stop.exe 89 PID 4812 wrote to memory of 5852 4812 cmd.exe 93 PID 5852 wrote to memory of 3808 5852 EKLT.exe 95 PID 3808 wrote to memory of 3864 3808 cmd.exe 99 PID 3864 wrote to memory of 3088 3864 DOW.exe 100 PID 3088 wrote to memory of 2436 3088 cmd.exe 104 PID 2436 wrote to memory of 3716 2436 IOSGCL.exe 105 PID 3716 wrote to memory of 1236 3716 cmd.exe 109 PID 1236 wrote to memory of 3604 1236 YETXJ.exe 110 PID 3604 wrote to memory of 4716 3604 cmd.exe 114 PID 4716 wrote to memory of 4252 4716 BMAFVZF.exe 115 PID 4252 wrote to memory of 244 4252 cmd.exe 119 PID 244 wrote to memory of 3120 244 EHR.exe 120 PID 3120 wrote to memory of 4424 3120 cmd.exe 124 PID 4424 wrote to memory of 2408 4424 IKPCGD.exe 125 PID 2408 wrote to memory of 1028 2408 cmd.exe 129 PID 1028 wrote to memory of 3708 1028 XFYG.exe 130 PID 3708 wrote to memory of 4256 3708 cmd.exe 134 PID 4256 wrote to memory of 5688 4256 FWZFY.exe 135 PID 5688 wrote to memory of 2120 5688 cmd.exe 139 PID 2120 wrote to memory of 5372 2120 YOPQP.exe 140 PID 5372 wrote to memory of 4288 5372 cmd.exe 144 PID 4288 wrote to memory of 3316 4288 CEVQCFQ.exe 145 PID 3316 wrote to memory of 1456 3316 cmd.exe 149 PID 1456 wrote to memory of 4800 1456 FMEN.exe 150 PID 4800 wrote to memory of 4220 4800 cmd.exe 154 PID 4220 wrote to memory of 5344 4220 WVLK.exe 155 PID 5344 wrote to memory of 4732 5344 cmd.exe 159 PID 4732 wrote to memory of 5736 4732 GSY.exe 160 PID 5736 wrote to memory of 464 5736 cmd.exe 163 PID 464 wrote to memory of 4124 464 KAFFPI.exe 165 PID 4124 wrote to memory of 1868 4124 cmd.exe 169 PID 1868 wrote to memory of 5080 1868 BLVDPD.exe 170 PID 5080 wrote to memory of 2972 5080 cmd.exe 174 PID 2972 wrote to memory of 4656 2972 XRBAW.exe 175 PID 4656 wrote to memory of 6000 4656 cmd.exe 179 PID 6000 wrote to memory of 4516 6000 KUJQK.exe 180 PID 4516 wrote to memory of 4704 4516 cmd.exe 184 PID 4704 wrote to memory of 4524 4704 AKSQQLB.exe 185 PID 4524 wrote to memory of 4528 4524 cmd.exe 189 PID 4528 wrote to memory of 3472 4528 NUBOFOP.exe 190 PID 3472 wrote to memory of 4520 3472 cmd.exe 194 PID 4520 wrote to memory of 1500 4520 RKIO.exe 195 PID 1500 wrote to memory of 880 1500 cmd.exe 199 PID 880 wrote to memory of 3312 880 VNGJRZN.exe 200 PID 3312 wrote to memory of 416 3312 cmd.exe 204 PID 416 wrote to memory of 1660 416 ATYZHC.exe 205 PID 1660 wrote to memory of 5548 1660 cmd.exe 209 PID 5548 wrote to memory of 3740 5548 YEBHI.exe 210 PID 3740 wrote to memory of 4904 3740 cmd.exe 214 PID 4904 wrote to memory of 2236 4904 IED.exe 215 PID 2236 wrote to memory of 4864 2236 cmd.exe 219 PID 4864 wrote to memory of 3332 4864 QSP.exe 220 PID 3332 wrote to memory of 1988 3332 cmd.exe 224 PID 1988 wrote to memory of 4592 1988 HFA.exe 225 PID 4592 wrote to memory of 5616 4592 cmd.exe 229 PID 5616 wrote to memory of 3348 5616 OVBKSXM.exe 230 PID 3348 wrote to memory of 5792 3348 cmd.exe 234 PID 5792 wrote to memory of 2204 5792 RIGT.exe 235 PID 2204 wrote to memory of 5036 2204 cmd.exe 239 PID 5036 wrote to memory of 4232 5036 PJNPMZ.exe 240 PID 4232 wrote to memory of 4648 4232 cmd.exe 244 PID 4648 wrote to memory of 4856 4648 RWK.exe 245 PID 4856 wrote to memory of 5476 4856 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-23_230b8efcb8e13809baf2dd4c9562e2ee_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-23_230b8efcb8e13809baf2dd4c9562e2ee_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EKLT.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\windows\system\EKLT.exeC:\windows\system\EKLT.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DOW.exe.bat" "4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3808 -
C:\windows\DOW.exeC:\windows\DOW.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IOSGCL.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:3088 -
C:\windows\IOSGCL.exeC:\windows\IOSGCL.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YETXJ.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\windows\SysWOW64\YETXJ.exeC:\windows\system32\YETXJ.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BMAFVZF.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\windows\SysWOW64\BMAFVZF.exeC:\windows\system32\BMAFVZF.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EHR.exe.bat" "12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\windows\EHR.exeC:\windows\EHR.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IKPCGD.exe.bat" "14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\windows\IKPCGD.exeC:\windows\IKPCGD.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XFYG.exe.bat" "16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\windows\XFYG.exeC:\windows\XFYG.exe17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FWZFY.exe.bat" "18⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\windows\system\FWZFY.exeC:\windows\system\FWZFY.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YOPQP.exe.bat" "20⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5688 -
C:\windows\system\YOPQP.exeC:\windows\system\YOPQP.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CEVQCFQ.exe.bat" "22⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5372 -
C:\windows\SysWOW64\CEVQCFQ.exeC:\windows\system32\CEVQCFQ.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FMEN.exe.bat" "24⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\windows\system\FMEN.exeC:\windows\system\FMEN.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WVLK.exe.bat" "26⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\windows\system\WVLK.exeC:\windows\system\WVLK.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GSY.exe.bat" "28⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5344 -
C:\windows\SysWOW64\GSY.exeC:\windows\system32\GSY.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KAFFPI.exe.bat" "30⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5736 -
C:\windows\system\KAFFPI.exeC:\windows\system\KAFFPI.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BLVDPD.exe.bat" "32⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\windows\SysWOW64\BLVDPD.exeC:\windows\system32\BLVDPD.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XRBAW.exe.bat" "34⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\windows\SysWOW64\XRBAW.exeC:\windows\system32\XRBAW.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KUJQK.exe.bat" "36⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\windows\SysWOW64\KUJQK.exeC:\windows\system32\KUJQK.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AKSQQLB.exe.bat" "38⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\windows\system\AKSQQLB.exeC:\windows\system\AKSQQLB.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NUBOFOP.exe.bat" "40⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\windows\NUBOFOP.exeC:\windows\NUBOFOP.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RKIO.exe.bat" "42⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\windows\SysWOW64\RKIO.exeC:\windows\system32\RKIO.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VNGJRZN.exe.bat" "44⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\windows\SysWOW64\VNGJRZN.exeC:\windows\system32\VNGJRZN.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ATYZHC.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\windows\SysWOW64\ATYZHC.exeC:\windows\system32\ATYZHC.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YEBHI.exe.bat" "48⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\windows\SysWOW64\YEBHI.exeC:\windows\system32\YEBHI.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IED.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\windows\IED.exeC:\windows\IED.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QSP.exe.bat" "52⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\windows\QSP.exeC:\windows\QSP.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HFA.exe.bat" "54⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\windows\SysWOW64\HFA.exeC:\windows\system32\HFA.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OVBKSXM.exe.bat" "56⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\windows\OVBKSXM.exeC:\windows\OVBKSXM.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RIGT.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:3348 -
C:\windows\system\RIGT.exeC:\windows\system\RIGT.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5792 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PJNPMZ.exe.bat" "60⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\windows\system\PJNPMZ.exeC:\windows\system\PJNPMZ.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RWK.exe.bat" "62⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\windows\SysWOW64\RWK.exeC:\windows\system32\RWK.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OWUBACA.exe.bat" "64⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\windows\SysWOW64\OWUBACA.exeC:\windows\system32\OWUBACA.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BZCZO.exe.bat" "66⤵PID:4108
-
C:\windows\BZCZO.exeC:\windows\BZCZO.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1220 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HUOSCU.exe.bat" "68⤵PID:1860
-
C:\windows\system\HUOSCU.exeC:\windows\system\HUOSCU.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XKP.exe.bat" "70⤵PID:3468
-
C:\windows\SysWOW64\XKP.exeC:\windows\system32\XKP.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BAWSN.exe.bat" "72⤵PID:940
-
C:\windows\SysWOW64\BAWSN.exeC:\windows\system32\BAWSN.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GBFUQE.exe.bat" "74⤵PID:2460
-
C:\windows\system\GBFUQE.exeC:\windows\system\GBFUQE.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JJMC.exe.bat" "76⤵PID:2012
-
C:\windows\system\JJMC.exeC:\windows\system\JJMC.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4180 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NRTCPO.exe.bat" "78⤵
- System Location Discovery: System Language Discovery
PID:5756 -
C:\windows\system\NRTCPO.exeC:\windows\system\NRTCPO.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3048 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DHUC.exe.bat" "80⤵
- Executes a command shell one-liner
PID:4700 -
C:\windows\DHUC.exeC:\windows\DHUC.exe81⤵
- Executes dropped EXE
PID:3196 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HXICIUS.exe.bat" "82⤵
- Executes a command shell one-liner
PID:2852 -
C:\windows\SysWOW64\HXICIUS.exeC:\windows\system32\HXICIUS.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2232 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YXC.exe.bat" "84⤵
- System Location Discovery: System Language Discovery
PID:3436 -
C:\windows\SysWOW64\YXC.exeC:\windows\system32\YXC.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XVVKYFC.exe.bat" "86⤵
- Executes a command shell one-liner
PID:4896 -
C:\windows\system\XVVKYFC.exeC:\windows\system\XVVKYFC.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4196 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BYUF.exe.bat" "88⤵
- System Location Discovery: System Language Discovery
PID:4420 -
C:\windows\SysWOW64\BYUF.exeC:\windows\system32\BYUF.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2040 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JEYL.exe.bat" "90⤵PID:5840
-
C:\windows\SysWOW64\JEYL.exeC:\windows\system32\JEYL.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DZDVTW.exe.bat" "92⤵
- System Location Discovery: System Language Discovery
PID:1664 -
C:\windows\DZDVTW.exeC:\windows\DZDVTW.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YMI.exe.bat" "94⤵PID:5444
-
C:\windows\system\YMI.exeC:\windows\system\YMI.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1164 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RFX.exe.bat" "96⤵
- System Location Discovery: System Language Discovery
PID:3032 -
C:\windows\system\RFX.exeC:\windows\system\RFX.exe97⤵
- Executes dropped EXE
PID:3616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EQGOBA.exe.bat" "98⤵PID:5796
-
C:\windows\EQGOBA.exeC:\windows\EQGOBA.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KLF.exe.bat" "100⤵
- Executes a command shell one-liner
PID:2856 -
C:\windows\KLF.exeC:\windows\KLF.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FYKYQ.exe.bat" "102⤵
- Executes a command shell one-liner
PID:1628 -
C:\windows\FYKYQ.exeC:\windows\FYKYQ.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CECN.exe.bat" "104⤵
- Executes a command shell one-liner
PID:5260 -
C:\windows\SysWOW64\CECN.exeC:\windows\system32\CECN.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LEESJDQ.exe.bat" "106⤵PID:4772
-
C:\windows\SysWOW64\LEESJDQ.exeC:\windows\system32\LEESJDQ.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CMY.exe.bat" "108⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2564 -
C:\windows\CMY.exeC:\windows\CMY.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5744 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RHPKGV.exe.bat" "110⤵
- Executes a command shell one-liner
PID:1976 -
C:\windows\system\RHPKGV.exeC:\windows\system\RHPKGV.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FFPVI.exe.bat" "112⤵PID:3248
-
C:\windows\SysWOW64\FFPVI.exeC:\windows\system32\FFPVI.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ABUFSHR.exe.bat" "114⤵
- Executes a command shell one-liner
PID:1428 -
C:\windows\system\ABUFSHR.exeC:\windows\system\ABUFSHR.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AWYB.exe.bat" "116⤵PID:5908
-
C:\windows\system\AWYB.exeC:\windows\system\AWYB.exe117⤵
- Executes dropped EXE
PID:1356 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VRDSI.exe.bat" "118⤵
- System Location Discovery: System Language Discovery
PID:1984 -
C:\windows\SysWOW64\VRDSI.exeC:\windows\system32\VRDSI.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KMM.exe.bat" "120⤵PID:2796
-
C:\windows\SysWOW64\KMM.exeC:\windows\system32\KMM.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4144
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-