Analysis
- max time kernel
89s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
23/07/2026, 14:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-23_96e1b302b0e3c55fb103bb5c5319c679_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-07-23_96e1b302b0e3c55fb103bb5c5319c679_elex_emotet_stop.exe
- Size 208KB
- Sample260723-rw2ebsel2z
- SHA256 e15ba33a96ade23f2c565543792d49ed6ad6ca7b58466395c6cdffa4a576533b
- MD5 96e1b302b0e3c55fb103bb5c5319c679
- SHA1 c9a56a8676d8f4fe425d74aaf0f61527bcf581ef
- SHA512 9779e3a34f640a55fbc5ed597610066be2c5a79dd0cc1d42671fc01f42d0a23229b4c0c04bc1a018e9e78ed3abbac9dce798aa7a3e0ba63bb3a82f5d4bfb9b9a
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlldL+LOfK4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFll5+LOykEj1
- TLSH T1E6247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5208 HVGJ.exe 264 VQE.exe 4184 KGFTRV.exe 1172 JRIJZ.exe 2392 TPN.exe 4724 LSRZMAV.exe 6048 KPLCH.exe 3968 JANS.exe 1260 DNSCST.exe 1084 EQW.exe 3040 NRYKJG.exe 3324 GUC.exe 5996 VPLLZR.exe 4636 UAWBI.exe 3264 OVBKSXM.exe 1956 UVIYBZN.exe 5640 PJNPMZ.exe 2652 KGNT.exe 832 XRWRCNZ.exe 5632 BZCZO.exe 5484 WUHJYF.exe 620 RIM.exe 4720 RLQOOVI.exe 3332 KGUS.exe 3124 LJFNHJ.exe 2956 FWK.exe 1436 YZOAWYJ.exe 3464 EZWO.exe 1108 YNAYQT.exe 1212 BIXHSSO.exe 5508 BOX.exe 5296 VBCFE.exe 3596 OEGJRVH.exe 4376 AMNJ.exe 1748 PHWNOAD.exe 5504 PVW.exe 5012 TDDJCFU.exe 3828 OQIT.exe 5384 OTMPSV.exe 5052 SJS.exe 5192 WRHXIG.exe 2760 XULAW.exe 5864 GUNFZT.exe 4260 TFVE.exe 400 BLVTP.exe 4440 WYA.exe 4308 LBJG.exe 720 LHCVMIW.exe 2812 GUGE.exe 2684 MUOS.exe 2312 VDQXQIP.exe 5372 HLXFV.exe 4584 JIKRKJL.exe 4476 TGQMSRU.exe 4140 IWRLY.exe 1232 DKWUIMY.exe 3200 QUMTX.exe 1204 WQDUTS.exe 2160 LLV.exe 4400 VLPDQKT.exe 1168 ZBDL.exe 4236 LJKLOND.exe 4344 URM.exe 5416 OFRIC.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\YMJBOG.exe.bat BHLE.exe File opened for modification C:\windows\SysWOW64\LQED.exe IIYDSF.exe File opened for modification C:\windows\SysWOW64\RGFWWDP.exe QDBSR.exe File opened for modification C:\windows\SysWOW64\WUHJYF.exe BZCZO.exe File created C:\windows\SysWOW64\XRWRCNZ.exe.bat KGNT.exe File created C:\windows\SysWOW64\PHWNOAD.exe AMNJ.exe File created C:\windows\SysWOW64\PVW.exe PHWNOAD.exe File created C:\windows\SysWOW64\RKYR.exe QHU.exe File created C:\windows\SysWOW64\JFC.exe.bat RKYR.exe File created C:\windows\SysWOW64\CMFCR.exe.bat HZA.exe File created C:\windows\SysWOW64\QQA.exe MATEW.exe File created C:\windows\SysWOW64\WUHJYF.exe.bat BZCZO.exe File created C:\windows\SysWOW64\AMNJ.exe OEGJRVH.exe File created C:\windows\SysWOW64\PHWNOAD.exe.bat AMNJ.exe File created C:\windows\SysWOW64\OFRIC.exe.bat URM.exe File opened for modification C:\windows\SysWOW64\BHLE.exe JMZABGG.exe File created C:\windows\SysWOW64\RGFWWDP.exe.bat QDBSR.exe File opened for modification C:\windows\SysWOW64\EXPSU.exe NPNN.exe File created C:\windows\SysWOW64\KTADHZ.exe.bat YBXKZ.exe File created C:\windows\SysWOW64\OEGJRVH.exe VBCFE.exe File created C:\windows\SysWOW64\OEGJRVH.exe.bat VBCFE.exe File opened for modification C:\windows\SysWOW64\LBJG.exe WYA.exe File created C:\windows\SysWOW64\LBJG.exe.bat WYA.exe File opened for modification C:\windows\SysWOW64\OFRIC.exe URM.exe File opened for modification C:\windows\SysWOW64\OQM.exe ZVDNB.exe File created C:\windows\SysWOW64\MJRG.exe.bat GIJSIST.exe File created C:\windows\SysWOW64\HVGJ.exe.bat 2026-07-23_96e1b302b0e3c55fb103bb5c5319c679_elex_emotet_stop.exe File created C:\windows\SysWOW64\KGFTRV.exe.bat VQE.exe File opened for modification C:\windows\SysWOW64\PHWNOAD.exe AMNJ.exe File created C:\windows\SysWOW64\OFRIC.exe URM.exe File opened for modification C:\windows\SysWOW64\QQA.exe MATEW.exe File created C:\windows\SysWOW64\ORJBIC.exe.bat DZGQI.exe File created C:\windows\SysWOW64\BCSZ.exe.bat ORJBIC.exe File created C:\windows\SysWOW64\QDBSR.exe TCUFILM.exe File created C:\windows\SysWOW64\HVLGZDT.exe YMJBOG.exe File opened for modification C:\windows\SysWOW64\YBXKZ.exe PSVF.exe File created C:\windows\SysWOW64\RLQOOVI.exe.bat RIM.exe File created C:\windows\SysWOW64\LBJG.exe WYA.exe File opened for modification C:\windows\SysWOW64\VDQXQIP.exe MUOS.exe File created C:\windows\SysWOW64\VDQXQIP.exe.bat MUOS.exe File opened for modification C:\windows\SysWOW64\CMFCR.exe HZA.exe File created C:\windows\SysWOW64\BHLE.exe.bat JMZABGG.exe File created C:\windows\SysWOW64\ORJBIC.exe DZGQI.exe File opened for modification C:\windows\SysWOW64\QHU.exe KHNAA.exe File created C:\windows\SysWOW64\HVGJ.exe 2026-07-23_96e1b302b0e3c55fb103bb5c5319c679_elex_emotet_stop.exe File opened for modification C:\windows\SysWOW64\HVGJ.exe 2026-07-23_96e1b302b0e3c55fb103bb5c5319c679_elex_emotet_stop.exe File created C:\windows\SysWOW64\KGNT.exe PJNPMZ.exe File created C:\windows\SysWOW64\KGNT.exe.bat PJNPMZ.exe File opened for modification C:\windows\SysWOW64\AMNJ.exe OEGJRVH.exe File created C:\windows\SysWOW64\RKYR.exe.bat QHU.exe File opened for modification C:\windows\SysWOW64\JFC.exe RKYR.exe File created C:\windows\SysWOW64\XULAW.exe.bat WRHXIG.exe File created C:\windows\SysWOW64\URM.exe.bat LJKLOND.exe File created C:\windows\SysWOW64\YBXKZ.exe.bat PSVF.exe File created C:\windows\SysWOW64\CMFCR.exe HZA.exe File opened for modification C:\windows\SysWOW64\MATEW.exe RNOV.exe File created C:\windows\SysWOW64\LQED.exe.bat IIYDSF.exe File opened for modification C:\windows\SysWOW64\BCSZ.exe ORJBIC.exe File created C:\windows\SysWOW64\RGFWWDP.exe QDBSR.exe File created C:\windows\SysWOW64\AMNJ.exe.bat OEGJRVH.exe File opened for modification C:\windows\SysWOW64\MJRG.exe GIJSIST.exe File created C:\windows\SysWOW64\MATEW.exe.bat RNOV.exe File created C:\windows\SysWOW64\QQA.exe.bat MATEW.exe File created C:\windows\SysWOW64\BHLE.exe JMZABGG.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\FWK.exe.bat LJFNHJ.exe File created C:\windows\system\AXMTCA.exe.bat OFRIC.exe File created C:\windows\BIXHSSO.exe YNAYQT.exe File opened for modification C:\windows\MUOS.exe GUGE.exe File created C:\windows\system\HZA.exe SJZTI.exe File created C:\windows\system\ZRKRJON.exe.bat VOMW.exe File created C:\windows\NRYKJG.exe.bat EQW.exe File opened for modification C:\windows\VPLLZR.exe GUC.exe File created C:\windows\WYA.exe.bat BLVTP.exe File opened for modification C:\windows\LHCVMIW.exe LBJG.exe File created C:\windows\system\BYLV.exe KTADHZ.exe File created C:\windows\VQE.exe.bat HVGJ.exe File created C:\windows\system\HLXFV.exe.bat VDQXQIP.exe File created C:\windows\system\WXEJZXQ.exe LEJQRQ.exe File created C:\windows\OFG.exe WXEJZXQ.exe File opened for modification C:\windows\UMPA.exe ZRKRJON.exe File opened for modification C:\windows\BOX.exe BIXHSSO.exe File created C:\windows\ZVDNB.exe JFC.exe File opened for modification C:\windows\ZVDNB.exe JFC.exe File opened for modification C:\windows\OFG.exe WXEJZXQ.exe File created C:\windows\system\JMZABGG.exe WQHSR.exe File created C:\windows\UMPA.exe.bat ZRKRJON.exe File created C:\windows\system\OZTKDO.exe UMPA.exe File created C:\windows\system\JRIJZ.exe KGFTRV.exe File created C:\windows\system\VBCFE.exe BOX.exe File created C:\windows\system\TFVE.exe.bat GUNFZT.exe File created C:\windows\PSVF.exe AXMTCA.exe File created C:\windows\EQW.exe.bat DNSCST.exe File opened for modification C:\windows\YZOAWYJ.exe FWK.exe File created C:\windows\RNOV.exe RHW.exe File created C:\windows\VPLLZR.exe GUC.exe File created C:\windows\JIKRKJL.exe.bat HLXFV.exe File created C:\windows\system\BLVTP.exe.bat TFVE.exe File opened for modification C:\windows\PSVF.exe AXMTCA.exe File created C:\windows\OFG.exe.bat WXEJZXQ.exe File created C:\windows\system\HZA.exe.bat SJZTI.exe File created C:\windows\system\TCUFILM.exe.bat BCSZ.exe File created C:\windows\FUK.exe BMD.exe File created C:\windows\FUK.exe.bat BMD.exe File opened for modification C:\windows\system\LSRZMAV.exe TPN.exe File created C:\windows\LJFNHJ.exe.bat KGUS.exe File created C:\windows\RHW.exe.bat CMFCR.exe File created C:\windows\UMPA.exe ZRKRJON.exe File created C:\windows\system\XZOW.exe.bat OQM.exe File created C:\windows\system\TPN.exe.bat JRIJZ.exe File opened for modification C:\windows\system\HLXFV.exe VDQXQIP.exe File created C:\windows\OZQBBMG.exe.bat XZOW.exe File created C:\windows\DZGQI.exe LQED.exe File created C:\windows\XBSW.exe EXPSU.exe File opened for modification C:\windows\QUMTX.exe DKWUIMY.exe File created C:\windows\GUNFZT.exe.bat XULAW.exe File created C:\windows\system\ZBDL.exe VLPDQKT.exe File created C:\windows\system\AXMTCA.exe OFRIC.exe File opened for modification C:\windows\BZCZO.exe XRWRCNZ.exe File created C:\windows\system\TPN.exe JRIJZ.exe File created C:\windows\UAWBI.exe VPLLZR.exe File opened for modification C:\windows\system\BLVTP.exe TFVE.exe File created C:\windows\WQHSR.exe QQA.exe File opened for modification C:\windows\system\CIQP.exe HVLGZDT.exe File opened for modification C:\windows\VKLR.exe FUK.exe File created C:\windows\system\TCUFILM.exe BCSZ.exe File opened for modification C:\windows\UAWBI.exe VPLLZR.exe File created C:\windows\BOX.exe BIXHSSO.exe File opened for modification C:\windows\system\OTMPSV.exe OQIT.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2372 cmd.exe 5920 cmd.exe 1528 cmd.exe 6088 cmd.exe 5588 cmd.exe 1132 cmd.exe 3788 cmd.exe 5076 cmd.exe 1684 cmd.exe 3012 cmd.exe 3588 cmd.exe 1268 cmd.exe 248 cmd.exe 4936 cmd.exe 1296 cmd.exe 5224 cmd.exe 2588 cmd.exe 796 cmd.exe 4784 cmd.exe 4112 cmd.exe 1468 cmd.exe 5828 cmd.exe 1696 cmd.exe 5556 cmd.exe 1264 cmd.exe 5096 cmd.exe 6000 cmd.exe 2672 cmd.exe 5532 cmd.exe 4632 cmd.exe 1872 cmd.exe 3300 cmd.exe 5968 cmd.exe 476 cmd.exe 5104 cmd.exe 5548 cmd.exe 5660 cmd.exe 1404 cmd.exe 5800 cmd.exe 3236 cmd.exe 6080 cmd.exe 4328 cmd.exe 2932 cmd.exe 1636 cmd.exe 1352 cmd.exe 6064 cmd.exe 3920 cmd.exe 3048 cmd.exe 1052 cmd.exe 4592 cmd.exe 5472 cmd.exe 544 cmd.exe 1928 cmd.exe 4788 cmd.exe 5252 cmd.exe 2752 cmd.exe 756 cmd.exe 4824 cmd.exe 2764 cmd.exe 4864 cmd.exe 2040 cmd.exe 712 cmd.exe 1224 cmd.exe 2964 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 3384 4216 WerFault.exe 87 4232 5208 WerFault.exe 93 3376 264 WerFault.exe 99 5776 4184 WerFault.exe 104 4356 1172 WerFault.exe 109 1252 2392 WerFault.exe 114 5300 4724 WerFault.exe 119 5528 6048 WerFault.exe 124 3336 3968 WerFault.exe 129 592 1260 WerFault.exe 134 5372 1084 WerFault.exe 139 2260 3040 WerFault.exe 144 2492 3324 WerFault.exe 149 2472 5996 WerFault.exe 154 3440 4636 WerFault.exe 159 4356 3264 WerFault.exe 164 3764 1956 WerFault.exe 169 2420 5640 WerFault.exe 174 1888 2652 WerFault.exe 179 708 832 WerFault.exe 184 568 5632 WerFault.exe 189 4336 5484 WerFault.exe 194 3016 620 WerFault.exe 199 5024 4720 WerFault.exe 204 1132 3332 WerFault.exe 209 5548 3124 WerFault.exe 214 2764 2956 WerFault.exe 219 2028 1436 WerFault.exe 224 4112 3464 WerFault.exe 229 4708 1108 WerFault.exe 234 2132 1212 WerFault.exe 239 4504 5508 WerFault.exe 244 4340 5296 WerFault.exe 249 4908 3596 WerFault.exe 254 4648 4376 WerFault.exe 259 5736 1748 WerFault.exe 264 2380 5504 WerFault.exe 269 2040 5012 WerFault.exe 274 3020 3828 WerFault.exe 279 1144 5384 WerFault.exe 284 4124 5052 WerFault.exe 289 5372 5192 WerFault.exe 294 1432 2760 WerFault.exe 299 2624 5864 WerFault.exe 304 4140 4260 WerFault.exe 309 3444 400 WerFault.exe 314 1224 4440 WerFault.exe 319 868 4308 WerFault.exe 324 460 720 WerFault.exe 329 5076 2812 WerFault.exe 334 5160 2684 WerFault.exe 339 2252 2312 WerFault.exe 344 4148 5372 WerFault.exe 349 2680 4584 WerFault.exe 354 2720 4476 WerFault.exe 359 3616 4140 WerFault.exe 364 3560 1232 WerFault.exe 369 1960 3200 WerFault.exe 374 3716 1204 WerFault.exe 379 708 2160 WerFault.exe 384 4496 4400 WerFault.exe 389 712 1168 WerFault.exe 394 2624 4236 WerFault.exe 399 4872 4344 WerFault.exe 404 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-23_96e1b302b0e3c55fb103bb5c5319c679_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HVGJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YBXKZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZVDNB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TCUFILM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QDBSR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JRIJZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QQA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WQHSR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KGUS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JIKRKJL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XBSW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IWRLY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JANS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KGFTRV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YNAYQT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RHW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GUGE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OQIT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HVLGZDT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BYLV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ORJBIC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OVBKSXM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BIXHSSO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KTADHZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PJNPMZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OZTKDO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KPLCH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QUMTX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXPSU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FUK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TFVE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BCSZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EQW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LJKLOND.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SJZTI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RIM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XULAW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language URM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DZGQI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NPNN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TGQMSRU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BLVTP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FWK.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4216 2026-07-23_96e1b302b0e3c55fb103bb5c5319c679_elex_emotet_stop.exe 4216 2026-07-23_96e1b302b0e3c55fb103bb5c5319c679_elex_emotet_stop.exe 5208 HVGJ.exe 5208 HVGJ.exe 264 VQE.exe 264 VQE.exe 4184 KGFTRV.exe 4184 KGFTRV.exe 1172 JRIJZ.exe 1172 JRIJZ.exe 2392 TPN.exe 2392 TPN.exe 4724 LSRZMAV.exe 4724 LSRZMAV.exe 6048 KPLCH.exe 6048 KPLCH.exe 3968 JANS.exe 3968 JANS.exe 1260 DNSCST.exe 1260 DNSCST.exe 1084 EQW.exe 1084 EQW.exe 3040 NRYKJG.exe 3040 NRYKJG.exe 3324 GUC.exe 3324 GUC.exe 5996 VPLLZR.exe 5996 VPLLZR.exe 4636 UAWBI.exe 4636 UAWBI.exe 3264 OVBKSXM.exe 3264 OVBKSXM.exe 1956 UVIYBZN.exe 1956 UVIYBZN.exe 5640 PJNPMZ.exe 5640 PJNPMZ.exe 2652 KGNT.exe 2652 KGNT.exe 832 XRWRCNZ.exe 832 XRWRCNZ.exe 5632 BZCZO.exe 5632 BZCZO.exe 5484 WUHJYF.exe 5484 WUHJYF.exe 620 RIM.exe 620 RIM.exe 4720 RLQOOVI.exe 4720 RLQOOVI.exe 3332 KGUS.exe 3332 KGUS.exe 3124 LJFNHJ.exe 3124 LJFNHJ.exe 2956 FWK.exe 2956 FWK.exe 1436 YZOAWYJ.exe 1436 YZOAWYJ.exe 3464 EZWO.exe 3464 EZWO.exe 1108 YNAYQT.exe 1108 YNAYQT.exe 1212 BIXHSSO.exe 1212 BIXHSSO.exe 5508 BOX.exe 5508 BOX.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4216 2026-07-23_96e1b302b0e3c55fb103bb5c5319c679_elex_emotet_stop.exe 4216 2026-07-23_96e1b302b0e3c55fb103bb5c5319c679_elex_emotet_stop.exe 5208 HVGJ.exe 5208 HVGJ.exe 264 VQE.exe 264 VQE.exe 4184 KGFTRV.exe 4184 KGFTRV.exe 1172 JRIJZ.exe 1172 JRIJZ.exe 2392 TPN.exe 2392 TPN.exe 4724 LSRZMAV.exe 4724 LSRZMAV.exe 6048 KPLCH.exe 6048 KPLCH.exe 3968 JANS.exe 3968 JANS.exe 1260 DNSCST.exe 1260 DNSCST.exe 1084 EQW.exe 1084 EQW.exe 3040 NRYKJG.exe 3040 NRYKJG.exe 3324 GUC.exe 3324 GUC.exe 5996 VPLLZR.exe 5996 VPLLZR.exe 4636 UAWBI.exe 4636 UAWBI.exe 3264 OVBKSXM.exe 3264 OVBKSXM.exe 1956 UVIYBZN.exe 1956 UVIYBZN.exe 5640 PJNPMZ.exe 5640 PJNPMZ.exe 2652 KGNT.exe 2652 KGNT.exe 832 XRWRCNZ.exe 832 XRWRCNZ.exe 5632 BZCZO.exe 5632 BZCZO.exe 5484 WUHJYF.exe 5484 WUHJYF.exe 620 RIM.exe 620 RIM.exe 4720 RLQOOVI.exe 4720 RLQOOVI.exe 3332 KGUS.exe 3332 KGUS.exe 3124 LJFNHJ.exe 3124 LJFNHJ.exe 2956 FWK.exe 2956 FWK.exe 1436 YZOAWYJ.exe 1436 YZOAWYJ.exe 3464 EZWO.exe 3464 EZWO.exe 1108 YNAYQT.exe 1108 YNAYQT.exe 1212 BIXHSSO.exe 1212 BIXHSSO.exe 5508 BOX.exe 5508 BOX.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4216 wrote to memory of 4968 4216 2026-07-23_96e1b302b0e3c55fb103bb5c5319c679_elex_emotet_stop.exe 89 PID 4968 wrote to memory of 5208 4968 cmd.exe 93 PID 5208 wrote to memory of 5588 5208 HVGJ.exe 95 PID 5588 wrote to memory of 264 5588 cmd.exe 99 PID 264 wrote to memory of 6000 264 VQE.exe 100 PID 6000 wrote to memory of 4184 6000 cmd.exe 104 PID 4184 wrote to memory of 4304 4184 KGFTRV.exe 105 PID 4304 wrote to memory of 1172 4304 cmd.exe 109 PID 1172 wrote to memory of 1952 1172 JRIJZ.exe 110 PID 1952 wrote to memory of 2392 1952 cmd.exe 114 PID 2392 wrote to memory of 756 2392 TPN.exe 115 PID 756 wrote to memory of 4724 756 cmd.exe 119 PID 4724 wrote to memory of 3140 4724 LSRZMAV.exe 120 PID 3140 wrote to memory of 6048 3140 cmd.exe 124 PID 6048 wrote to memory of 5104 6048 KPLCH.exe 125 PID 5104 wrote to memory of 3968 5104 cmd.exe 129 PID 3968 wrote to memory of 3628 3968 JANS.exe 130 PID 3628 wrote to memory of 1260 3628 cmd.exe 134 PID 1260 wrote to memory of 1268 1260 DNSCST.exe 135 PID 1268 wrote to memory of 1084 1268 cmd.exe 139 PID 1084 wrote to memory of 3864 1084 EQW.exe 140 PID 3864 wrote to memory of 3040 3864 cmd.exe 144 PID 3040 wrote to memory of 2584 3040 NRYKJG.exe 145 PID 2584 wrote to memory of 3324 2584 cmd.exe 149 PID 3324 wrote to memory of 244 3324 GUC.exe 150 PID 244 wrote to memory of 5996 244 cmd.exe 154 PID 5996 wrote to memory of 2388 5996 VPLLZR.exe 155 PID 2388 wrote to memory of 4636 2388 cmd.exe 159 PID 4636 wrote to memory of 2672 4636 UAWBI.exe 160 PID 2672 wrote to memory of 3264 2672 cmd.exe 164 PID 3264 wrote to memory of 3920 3264 OVBKSXM.exe 165 PID 3920 wrote to memory of 1956 3920 cmd.exe 169 PID 1956 wrote to memory of 3000 1956 UVIYBZN.exe 170 PID 3000 wrote to memory of 5640 3000 cmd.exe 174 PID 5640 wrote to memory of 5064 5640 PJNPMZ.exe 175 PID 5064 wrote to memory of 2652 5064 cmd.exe 179 PID 2652 wrote to memory of 3960 2652 KGNT.exe 180 PID 3960 wrote to memory of 832 3960 cmd.exe 184 PID 832 wrote to memory of 5964 832 XRWRCNZ.exe 185 PID 5964 wrote to memory of 5632 5964 cmd.exe 189 PID 5632 wrote to memory of 5544 5632 BZCZO.exe 190 PID 5544 wrote to memory of 5484 5544 cmd.exe 194 PID 5484 wrote to memory of 4824 5484 WUHJYF.exe 195 PID 4824 wrote to memory of 620 4824 cmd.exe 199 PID 620 wrote to memory of 752 620 RIM.exe 200 PID 752 wrote to memory of 4720 752 cmd.exe 204 PID 4720 wrote to memory of 4192 4720 RLQOOVI.exe 205 PID 4192 wrote to memory of 3332 4192 cmd.exe 209 PID 3332 wrote to memory of 6108 3332 KGUS.exe 210 PID 6108 wrote to memory of 3124 6108 cmd.exe 214 PID 3124 wrote to memory of 3372 3124 LJFNHJ.exe 215 PID 3372 wrote to memory of 2956 3372 cmd.exe 219 PID 2956 wrote to memory of 1976 2956 FWK.exe 220 PID 1976 wrote to memory of 1436 1976 cmd.exe 224 PID 1436 wrote to memory of 5044 1436 YZOAWYJ.exe 225 PID 5044 wrote to memory of 3464 5044 cmd.exe 229 PID 3464 wrote to memory of 5032 3464 EZWO.exe 230 PID 5032 wrote to memory of 1108 5032 cmd.exe 234 PID 1108 wrote to memory of 2124 1108 YNAYQT.exe 235 PID 2124 wrote to memory of 1212 2124 cmd.exe 239 PID 1212 wrote to memory of 2432 1212 BIXHSSO.exe 240 PID 2432 wrote to memory of 5508 2432 cmd.exe 244 PID 5508 wrote to memory of 592 5508 BOX.exe 245 PID 592 wrote to memory of 5296 592 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-23_96e1b302b0e3c55fb103bb5c5319c679_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-23_96e1b302b0e3c55fb103bb5c5319c679_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HVGJ.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\windows\SysWOW64\HVGJ.exeC:\windows\system32\HVGJ.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VQE.exe.bat" "4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5588 -
C:\windows\VQE.exeC:\windows\VQE.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KGFTRV.exe.bat" "6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6000 -
C:\windows\SysWOW64\KGFTRV.exeC:\windows\system32\KGFTRV.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JRIJZ.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\windows\system\JRIJZ.exeC:\windows\system\JRIJZ.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TPN.exe.bat" "10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\windows\system\TPN.exeC:\windows\system\TPN.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LSRZMAV.exe.bat" "12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:756 -
C:\windows\system\LSRZMAV.exeC:\windows\system\LSRZMAV.exe13⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KPLCH.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\windows\KPLCH.exeC:\windows\KPLCH.exe15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6048 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JANS.exe.bat" "16⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\windows\JANS.exeC:\windows\JANS.exe17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DNSCST.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\windows\DNSCST.exeC:\windows\DNSCST.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EQW.exe.bat" "20⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\windows\EQW.exeC:\windows\EQW.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NRYKJG.exe.bat" "22⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3864 -
C:\windows\NRYKJG.exeC:\windows\NRYKJG.exe23⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GUC.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\windows\system\GUC.exeC:\windows\system\GUC.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VPLLZR.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:244 -
C:\windows\VPLLZR.exeC:\windows\VPLLZR.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UAWBI.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\windows\UAWBI.exeC:\windows\UAWBI.exe29⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OVBKSXM.exe.bat" "30⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\windows\OVBKSXM.exeC:\windows\OVBKSXM.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UVIYBZN.exe.bat" "32⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\windows\system\UVIYBZN.exeC:\windows\system\UVIYBZN.exe33⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PJNPMZ.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\windows\system\PJNPMZ.exeC:\windows\system\PJNPMZ.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KGNT.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\windows\SysWOW64\KGNT.exeC:\windows\system32\KGNT.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XRWRCNZ.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\windows\SysWOW64\XRWRCNZ.exeC:\windows\system32\XRWRCNZ.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BZCZO.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:5964 -
C:\windows\BZCZO.exeC:\windows\BZCZO.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5632 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WUHJYF.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:5544 -
C:\windows\SysWOW64\WUHJYF.exeC:\windows\system32\WUHJYF.exe43⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5484 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RIM.exe.bat" "44⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\windows\RIM.exeC:\windows\RIM.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:620 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RLQOOVI.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:752 -
C:\windows\SysWOW64\RLQOOVI.exeC:\windows\system32\RLQOOVI.exe47⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KGUS.exe.bat" "48⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\windows\system\KGUS.exeC:\windows\system\KGUS.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LJFNHJ.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:6108 -
C:\windows\LJFNHJ.exeC:\windows\LJFNHJ.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FWK.exe.bat" "52⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\windows\FWK.exeC:\windows\FWK.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YZOAWYJ.exe.bat" "54⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\windows\YZOAWYJ.exeC:\windows\YZOAWYJ.exe55⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EZWO.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\windows\system\EZWO.exeC:\windows\system\EZWO.exe57⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YNAYQT.exe.bat" "58⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\windows\YNAYQT.exeC:\windows\YNAYQT.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BIXHSSO.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\windows\BIXHSSO.exeC:\windows\BIXHSSO.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BOX.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\windows\BOX.exeC:\windows\BOX.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VBCFE.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:592 -
C:\windows\system\VBCFE.exeC:\windows\system\VBCFE.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OEGJRVH.exe.bat" "66⤵PID:5628
-
C:\windows\SysWOW64\OEGJRVH.exeC:\windows\system32\OEGJRVH.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AMNJ.exe.bat" "68⤵PID:5868
-
C:\windows\SysWOW64\AMNJ.exeC:\windows\system32\AMNJ.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PHWNOAD.exe.bat" "70⤵PID:5024
-
C:\windows\SysWOW64\PHWNOAD.exeC:\windows\system32\PHWNOAD.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PVW.exe.bat" "72⤵
- Executes a command shell one-liner
PID:1132 -
C:\windows\SysWOW64\PVW.exeC:\windows\system32\PVW.exe73⤵
- Executes dropped EXE
PID:5504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TDDJCFU.exe.bat" "74⤵
- Executes a command shell one-liner
PID:5548 -
C:\windows\system\TDDJCFU.exeC:\windows\system\TDDJCFU.exe75⤵
- Executes dropped EXE
PID:5012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OQIT.exe.bat" "76⤵
- Executes a command shell one-liner
PID:2764 -
C:\windows\OQIT.exeC:\windows\OQIT.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OTMPSV.exe.bat" "78⤵
- Executes a command shell one-liner
PID:2964 -
C:\windows\system\OTMPSV.exeC:\windows\system\OTMPSV.exe79⤵
- Executes dropped EXE
PID:5384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SJS.exe.bat" "80⤵
- Executes a command shell one-liner
PID:4864 -
C:\windows\system\SJS.exeC:\windows\system\SJS.exe81⤵
- Executes dropped EXE
PID:5052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WRHXIG.exe.bat" "82⤵
- Executes a command shell one-liner
PID:3236 -
C:\windows\system\WRHXIG.exeC:\windows\system\WRHXIG.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5192 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XULAW.exe.bat" "84⤵PID:1700
-
C:\windows\SysWOW64\XULAW.exeC:\windows\system32\XULAW.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GUNFZT.exe.bat" "86⤵
- System Location Discovery: System Language Discovery
PID:3416 -
C:\windows\GUNFZT.exeC:\windows\GUNFZT.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TFVE.exe.bat" "88⤵
- Executes a command shell one-liner
PID:6080 -
C:\windows\system\TFVE.exeC:\windows\system\TFVE.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BLVTP.exe.bat" "90⤵PID:1136
-
C:\windows\system\BLVTP.exeC:\windows\system\BLVTP.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WYA.exe.bat" "92⤵PID:1812
-
C:\windows\WYA.exeC:\windows\WYA.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LBJG.exe.bat" "94⤵PID:4544
-
C:\windows\SysWOW64\LBJG.exeC:\windows\system32\LBJG.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LHCVMIW.exe.bat" "96⤵
- Executes a command shell one-liner
PID:3048 -
C:\windows\LHCVMIW.exeC:\windows\LHCVMIW.exe97⤵
- Executes dropped EXE
PID:720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GUGE.exe.bat" "98⤵PID:1116
-
C:\windows\system\GUGE.exeC:\windows\system\GUGE.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MUOS.exe.bat" "100⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4112 -
C:\windows\MUOS.exeC:\windows\MUOS.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2684 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VDQXQIP.exe.bat" "102⤵PID:3608
-
C:\windows\SysWOW64\VDQXQIP.exeC:\windows\system32\VDQXQIP.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HLXFV.exe.bat" "104⤵
- System Location Discovery: System Language Discovery
PID:2324 -
C:\windows\system\HLXFV.exeC:\windows\system\HLXFV.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5372 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JIKRKJL.exe.bat" "106⤵
- Executes a command shell one-liner
PID:248 -
C:\windows\JIKRKJL.exeC:\windows\JIKRKJL.exe107⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TGQMSRU.exe.bat" "108⤵PID:4888
-
C:\windows\system\TGQMSRU.exeC:\windows\system\TGQMSRU.exe109⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IWRLY.exe.bat" "110⤵PID:1804
-
C:\windows\system\IWRLY.exeC:\windows\system\IWRLY.exe111⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DKWUIMY.exe.bat" "112⤵PID:4120
-
C:\windows\DKWUIMY.exeC:\windows\DKWUIMY.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1232 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QUMTX.exe.bat" "114⤵PID:5172
-
C:\windows\QUMTX.exeC:\windows\QUMTX.exe115⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WQDUTS.exe.bat" "116⤵
- System Location Discovery: System Language Discovery
PID:868 -
C:\windows\system\WQDUTS.exeC:\windows\system\WQDUTS.exe117⤵
- Executes dropped EXE
PID:1204 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LLV.exe.bat" "118⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2040 -
C:\windows\system\LLV.exeC:\windows\system\LLV.exe119⤵
- Executes dropped EXE
PID:2160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VLPDQKT.exe.bat" "120⤵PID:944
-
C:\windows\VLPDQKT.exeC:\windows\VLPDQKT.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4400
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-