Analysis
- max time kernel
87s - max time network
135s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/07/2026, 23:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-24_492009940bafe664597c3bd2817e2b4b_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-07-24_492009940bafe664597c3bd2817e2b4b_elex_emotet_stop.exe
- Size 208KB
- Sample260724-2za2navth1
- SHA256 3d2067ef55d497e4cb9dfe85f25dfbb8944c8659933fc613a6617d4c1417c78e
- MD5 492009940bafe664597c3bd2817e2b4b
- SHA1 607cc296eb57dc131d822da32d5e78f85a4e56e4
- SHA512 856b326833a8f7aa8f4052c978a8634f8e3c7582d735a36b34f7940ce520b69e0beb680c56919aafef79f908c4aae737b7e3e655db89c94a7085d342fbb91a2a
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlcdL+LOfA4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFlc5+LOYkEj1
- TLSH T15D247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4884 CSV.exe 2864 WFHMAAL.exe 248 JQXKG.exe 1924 EDCURLN.exe 4388 TTDTX.exe 1944 EMYM.exe 4544 IUFM.exe 1320 SSSGZH.exe 4836 LVWCF.exe 4280 GFF.exe 5968 BTJKD.exe 6116 MLMDDO.exe 2920 HZR.exe 5004 LPYUA.exe 3484 WHBFIOP.exe 3408 QVG.exe 1896 LIKGV.exe 5016 MLOCIMC.exe 560 QTVKMW.exe 5592 KGA.exe 5992 SUSH.exe 2584 QUZV.exe 5564 LHEFRL.exe 3928 RIM.exe 1088 LVRCL.exe 4760 OIWLVFC.exe 5660 IEAU.exe 4324 UWDNN.exe 5780 DXFSRR.exe 2148 HNM.exe 5496 RKS.exe 4972 VSYVX.exe 3344 VYYJYP.exe 4892 HOFJK.exe 4448 BBKTVHH.exe 5964 LCMY.exe 200 AFVKJS.exe 1444 RFX.exe 5760 GKDM.exe 2292 AYIWEH.exe 1292 MQDOM.exe 2672 HBTFA.exe 4956 BOYWLRC.exe 1012 BUQ.exe 2964 PFHCAO.exe 5920 XKZQCTV.exe 6016 DLHE.exe 1764 ODKXT.exe 2224 UDRKCFN.exe 732 SEZ.exe 2112 DWUR.exe 5704 XKZAEG.exe 5916 NAAA.exe 2096 JFGPSM.exe 5052 NVM.exe 1240 IJRGO.exe 3208 OJZUXYV.exe 4456 ZBCNFF.exe 260 DJINKY.exe 3512 FFNWUYN.exe 4360 RXQPCFC.exe 2748 LLV.exe 572 EOZCSDT.exe 4964 KOGQB.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\MIP.exe TFMZTJ.exe File opened for modification C:\windows\SysWOW64\AFVKJS.exe LCMY.exe File opened for modification C:\windows\SysWOW64\BOXT.exe VOPGGY.exe File created C:\windows\SysWOW64\GULCEUW.exe BOXT.exe File opened for modification C:\windows\SysWOW64\PEOY.exe FGBEHP.exe File opened for modification C:\windows\SysWOW64\LVWCF.exe SSSGZH.exe File opened for modification C:\windows\SysWOW64\SUSH.exe KGA.exe File created C:\windows\SysWOW64\ZBCNFF.exe.bat OJZUXYV.exe File opened for modification C:\windows\SysWOW64\JMXC.exe OZTSPUW.exe File created C:\windows\SysWOW64\GKDM.exe.bat RFX.exe File created C:\windows\SysWOW64\VYYJYP.exe VSYVX.exe File created C:\windows\SysWOW64\ASUMB.exe.bat WCF.exe File created C:\windows\SysWOW64\NDPESL.exe.bat EVMZP.exe File opened for modification C:\windows\SysWOW64\BYI.exe VXAXAH.exe File created C:\windows\SysWOW64\WHBFIOP.exe LPYUA.exe File created C:\windows\SysWOW64\WHBFIOP.exe.bat LPYUA.exe File created C:\windows\SysWOW64\NAAA.exe.bat XKZAEG.exe File opened for modification C:\windows\SysWOW64\ZXOZ.exe JMXC.exe File opened for modification C:\windows\SysWOW64\RQYYQ.exe RKYR.exe File created C:\windows\SysWOW64\GXRFOHC.exe.bat YRZQEU.exe File created C:\windows\SysWOW64\GFF.exe.bat LVWCF.exe File opened for modification C:\windows\SysWOW64\VYYJYP.exe VSYVX.exe File created C:\windows\SysWOW64\AFVKJS.exe.bat LCMY.exe File created C:\windows\SysWOW64\FFNWUYN.exe DJINKY.exe File created C:\windows\SysWOW64\CYDRXYU.exe.bat AAQWQ.exe File created C:\windows\SysWOW64\FOPLV.exe.bat BYI.exe File opened for modification C:\windows\SysWOW64\TTDTX.exe EDCURLN.exe File created C:\windows\SysWOW64\SUSH.exe KGA.exe File created C:\windows\SysWOW64\QUZV.exe.bat SUSH.exe File opened for modification C:\windows\SysWOW64\MQDOM.exe AYIWEH.exe File created C:\windows\SysWOW64\PFHCAO.exe.bat BUQ.exe File created C:\windows\SysWOW64\DWUR.exe.bat SEZ.exe File created C:\windows\SysWOW64\ZXOZ.exe JMXC.exe File created C:\windows\SysWOW64\PDNH.exe.bat GULCEUW.exe File created C:\windows\SysWOW64\ZBCNFF.exe OJZUXYV.exe File created C:\windows\SysWOW64\EBLZLX.exe KOGQB.exe File created C:\windows\SysWOW64\RKYR.exe ZXOZ.exe File opened for modification C:\windows\SysWOW64\NDPESL.exe EVMZP.exe File opened for modification C:\windows\SysWOW64\FOPLV.exe BYI.exe File created C:\windows\SysWOW64\WATS.exe.bat TNBJ.exe File opened for modification C:\windows\SysWOW64\GULCEUW.exe BOXT.exe File created C:\windows\SysWOW64\BBKTVHH.exe.bat HOFJK.exe File created C:\windows\SysWOW64\MQDOM.exe.bat AYIWEH.exe File opened for modification C:\windows\SysWOW64\FFNWUYN.exe DJINKY.exe File opened for modification C:\windows\SysWOW64\KOGQB.exe EOZCSDT.exe File opened for modification C:\windows\SysWOW64\CYDRXYU.exe AAQWQ.exe File opened for modification C:\windows\SysWOW64\TDOJN.exe CYDRXYU.exe File created C:\windows\SysWOW64\BOXT.exe.bat VOPGGY.exe File opened for modification C:\windows\SysWOW64\PDNH.exe GULCEUW.exe File opened for modification C:\windows\SysWOW64\WHBFIOP.exe LPYUA.exe File created C:\windows\SysWOW64\HOFJK.exe.bat VYYJYP.exe File created C:\windows\SysWOW64\GKDM.exe RFX.exe File created C:\windows\SysWOW64\MIP.exe.bat TFMZTJ.exe File created C:\windows\SysWOW64\SUSH.exe.bat KGA.exe File created C:\windows\SysWOW64\GULCEUW.exe.bat BOXT.exe File created C:\windows\SysWOW64\HOFJK.exe VYYJYP.exe File created C:\windows\SysWOW64\TDOJN.exe.bat CYDRXYU.exe File opened for modification C:\windows\SysWOW64\ZBCNFF.exe OJZUXYV.exe File created C:\windows\SysWOW64\CYDRXYU.exe AAQWQ.exe File created C:\windows\SysWOW64\PDNH.exe GULCEUW.exe File opened for modification C:\windows\SysWOW64\BLC.exe PDNH.exe File created C:\windows\SysWOW64\GUVJFY.exe KWV.exe File created C:\windows\SysWOW64\PFHCAO.exe BUQ.exe File created C:\windows\SysWOW64\NVM.exe.bat JFGPSM.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\LCMY.exe BBKTVHH.exe File opened for modification C:\windows\system\RFX.exe AFVKJS.exe File created C:\windows\BOYWLRC.exe.bat HBTFA.exe File created C:\windows\system\SGPZXQ.exe GOMGPJH.exe File created C:\windows\HZR.exe MLMDDO.exe File created C:\windows\HZR.exe.bat MLMDDO.exe File created C:\windows\BOYWLRC.exe HBTFA.exe File opened for modification C:\windows\EJJUCU.exe GYYM.exe File opened for modification C:\windows\system\LHEFRL.exe QUZV.exe File opened for modification C:\windows\ODKXT.exe DLHE.exe File opened for modification C:\windows\system\RXQPCFC.exe FFNWUYN.exe File opened for modification C:\windows\system\AAQWQ.exe SNXIGKI.exe File created C:\windows\YRZQEU.exe PEOY.exe File created C:\windows\LCMY.exe.bat BBKTVHH.exe File opened for modification C:\windows\WCF.exe EBLZLX.exe File opened for modification C:\windows\system\QGSEEBS.exe FOPLV.exe File created C:\windows\KWV.exe.bat IZQCO.exe File opened for modification C:\windows\TFMZTJ.exe GUVJFY.exe File created C:\windows\system\QTAH.exe.bat WGVPGHE.exe File opened for modification C:\windows\HZR.exe MLMDDO.exe File created C:\windows\system\EMYM.exe TTDTX.exe File created C:\windows\QVG.exe.bat WHBFIOP.exe File created C:\windows\LIKGV.exe.bat QVG.exe File opened for modification C:\windows\MLOCIMC.exe LIKGV.exe File opened for modification C:\windows\LCMY.exe BBKTVHH.exe File opened for modification C:\windows\system\GOMGPJH.exe RTCC.exe File created C:\windows\WGVPGHE.exe.bat MIP.exe File created C:\windows\system\RFX.exe AFVKJS.exe File created C:\windows\XKZQCTV.exe.bat PFHCAO.exe File opened for modification C:\windows\system\LLV.exe RXQPCFC.exe File created C:\windows\system\OZTSPUW.exe.bat TDOJN.exe File created C:\windows\system\KBSCC.exe SGPZXQ.exe File created C:\windows\VOPGGY.exe NDPESL.exe File opened for modification C:\windows\YRZQEU.exe PEOY.exe File created C:\windows\GYYM.exe WATS.exe File opened for modification C:\windows\AYIWEH.exe GKDM.exe File created C:\windows\system\UDRKCFN.exe.bat ODKXT.exe File created C:\windows\SNXIGKI.exe ASUMB.exe File created C:\windows\system\LUX.exe QGSEEBS.exe File opened for modification C:\windows\system\QTAH.exe WGVPGHE.exe File opened for modification C:\windows\system\IUFM.exe EMYM.exe File created C:\windows\system\IUFM.exe.bat EMYM.exe File created C:\windows\system\QTVKMW.exe MLOCIMC.exe File created C:\windows\system\IEAU.exe.bat OIWLVFC.exe File opened for modification C:\windows\DXFSRR.exe UWDNN.exe File created C:\windows\AYIWEH.exe GKDM.exe File opened for modification C:\windows\system\DJINKY.exe ZBCNFF.exe File created C:\windows\system\GOMGPJH.exe.bat RTCC.exe File created C:\windows\system\EMYM.exe.bat TTDTX.exe File opened for modification C:\windows\system\SSSGZH.exe IUFM.exe File created C:\windows\LVRCL.exe RIM.exe File created C:\windows\system\HBTFA.exe.bat MQDOM.exe File opened for modification C:\windows\BOYWLRC.exe HBTFA.exe File opened for modification C:\windows\BUQ.exe BOYWLRC.exe File opened for modification C:\windows\system\SGPZXQ.exe GOMGPJH.exe File created C:\windows\system\SGPZXQ.exe.bat GOMGPJH.exe File created C:\windows\system\LHEFRL.exe QUZV.exe File created C:\windows\system\OZTSPUW.exe TDOJN.exe File created C:\windows\system\RTCC.exe.bat RQYYQ.exe File created C:\windows\system\KBSCC.exe.bat SGPZXQ.exe File created C:\windows\ZEC.exe KBSCC.exe File opened for modification C:\windows\EVMZP.exe UXZFZ.exe File created C:\windows\RPU.exe.bat GXRFOHC.exe File created C:\windows\VXAXAH.exe RPU.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4712 cmd.exe 3472 cmd.exe 3956 cmd.exe 4608 cmd.exe 4708 cmd.exe 1204 cmd.exe 6112 cmd.exe 4092 cmd.exe 4640 cmd.exe 5124 cmd.exe 5832 cmd.exe 4888 cmd.exe 4164 cmd.exe 3176 cmd.exe 1800 cmd.exe 1936 cmd.exe 1868 cmd.exe 1236 cmd.exe 120 cmd.exe 3924 cmd.exe 4932 cmd.exe 4900 cmd.exe 5328 cmd.exe 5244 cmd.exe 5756 cmd.exe 4496 cmd.exe 376 cmd.exe 5184 cmd.exe 1016 cmd.exe 4336 cmd.exe 3460 cmd.exe 5664 cmd.exe 1180 cmd.exe 5904 cmd.exe 2164 cmd.exe 1196 cmd.exe 768 cmd.exe 5336 cmd.exe 2832 cmd.exe 2620 cmd.exe 2036 cmd.exe 2532 cmd.exe 3336 cmd.exe 2256 cmd.exe 3364 cmd.exe 1992 cmd.exe 4372 cmd.exe 5444 cmd.exe 4992 cmd.exe 2056 cmd.exe 4476 cmd.exe 3440 cmd.exe 5000 cmd.exe 2636 cmd.exe 3880 cmd.exe 5348 cmd.exe 3184 cmd.exe 636 cmd.exe 5428 cmd.exe 4968 cmd.exe 6008 cmd.exe 1760 cmd.exe 2488 cmd.exe 2888 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 4632 764 WerFault.exe 88 4852 4884 WerFault.exe 94 4212 2864 WerFault.exe 100 3928 248 WerFault.exe 105 608 1924 WerFault.exe 110 5088 4388 WerFault.exe 115 4072 1944 WerFault.exe 120 3216 4544 WerFault.exe 125 3100 1320 WerFault.exe 130 3876 4836 WerFault.exe 135 4668 4280 WerFault.exe 140 5972 5968 WerFault.exe 145 4992 6116 WerFault.exe 150 5864 2920 WerFault.exe 155 5560 5004 WerFault.exe 160 3304 3484 WerFault.exe 165 3956 3408 WerFault.exe 170 4768 1896 WerFault.exe 175 2700 5016 WerFault.exe 180 4936 560 WerFault.exe 185 5584 5592 WerFault.exe 190 3740 5992 WerFault.exe 195 2668 2584 WerFault.exe 200 3340 5564 WerFault.exe 205 1776 3928 WerFault.exe 210 5296 1088 WerFault.exe 215 5752 4760 WerFault.exe 220 1240 5660 WerFault.exe 225 3240 4324 WerFault.exe 230 4624 5780 WerFault.exe 235 4580 2148 WerFault.exe 240 5480 5496 WerFault.exe 245 4104 4972 WerFault.exe 250 3148 3344 WerFault.exe 255 4272 4892 WerFault.exe 260 3016 4448 WerFault.exe 265 3332 5964 WerFault.exe 270 2364 200 WerFault.exe 275 4300 1444 WerFault.exe 280 52 5760 WerFault.exe 286 1408 2292 WerFault.exe 291 1172 1292 WerFault.exe 296 4080 2672 WerFault.exe 301 4164 4956 WerFault.exe 306 2168 1012 WerFault.exe 311 4208 2964 WerFault.exe 316 6096 5920 WerFault.exe 321 3208 6016 WerFault.exe 326 1860 1764 WerFault.exe 331 4668 2224 WerFault.exe 336 5972 732 WerFault.exe 341 680 2112 WerFault.exe 346 4756 5704 WerFault.exe 351 3924 5916 WerFault.exe 356 2892 2096 WerFault.exe 361 4652 5052 WerFault.exe 366 1260 1240 WerFault.exe 371 3820 3208 WerFault.exe 376 3948 4456 WerFault.exe 381 3740 260 WerFault.exe 386 4620 3512 WerFault.exe 391 2164 4360 WerFault.exe 396 2168 2748 WerFault.exe 401 832 572 WerFault.exe 406 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LPYUA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BBKTVHH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GXRFOHC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RPU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VSYVX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EVMZP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FOPLV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GYYM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AYIWEH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SNXIGKI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PDNH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AKYNNWW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WHBFIOP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DWUR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RXQPCFC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DXFSRR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KBSCC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FGBEHP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UWDNN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SUSH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RFX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RQYYQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KWV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QUZV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HZR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HBTFA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EDCURLN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EBLZLX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-24_492009940bafe664597c3bd2817e2b4b_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAQWQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LXFA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LHEFRL.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 764 2026-07-24_492009940bafe664597c3bd2817e2b4b_elex_emotet_stop.exe 764 2026-07-24_492009940bafe664597c3bd2817e2b4b_elex_emotet_stop.exe 4884 CSV.exe 4884 CSV.exe 2864 WFHMAAL.exe 2864 WFHMAAL.exe 248 JQXKG.exe 248 JQXKG.exe 1924 EDCURLN.exe 1924 EDCURLN.exe 4388 TTDTX.exe 4388 TTDTX.exe 1944 EMYM.exe 1944 EMYM.exe 4544 IUFM.exe 4544 IUFM.exe 1320 SSSGZH.exe 1320 SSSGZH.exe 4836 LVWCF.exe 4836 LVWCF.exe 4280 GFF.exe 4280 GFF.exe 5968 BTJKD.exe 5968 BTJKD.exe 6116 MLMDDO.exe 6116 MLMDDO.exe 2920 HZR.exe 2920 HZR.exe 5004 LPYUA.exe 5004 LPYUA.exe 3484 WHBFIOP.exe 3484 WHBFIOP.exe 3408 QVG.exe 3408 QVG.exe 1896 LIKGV.exe 1896 LIKGV.exe 5016 MLOCIMC.exe 5016 MLOCIMC.exe 560 QTVKMW.exe 560 QTVKMW.exe 5592 KGA.exe 5592 KGA.exe 5992 SUSH.exe 5992 SUSH.exe 2584 QUZV.exe 2584 QUZV.exe 5564 LHEFRL.exe 5564 LHEFRL.exe 3928 RIM.exe 3928 RIM.exe 1088 LVRCL.exe 1088 LVRCL.exe 4760 OIWLVFC.exe 4760 OIWLVFC.exe 5660 IEAU.exe 5660 IEAU.exe 4324 UWDNN.exe 4324 UWDNN.exe 5780 DXFSRR.exe 5780 DXFSRR.exe 2148 HNM.exe 2148 HNM.exe 5496 RKS.exe 5496 RKS.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 764 2026-07-24_492009940bafe664597c3bd2817e2b4b_elex_emotet_stop.exe 764 2026-07-24_492009940bafe664597c3bd2817e2b4b_elex_emotet_stop.exe 4884 CSV.exe 4884 CSV.exe 2864 WFHMAAL.exe 2864 WFHMAAL.exe 248 JQXKG.exe 248 JQXKG.exe 1924 EDCURLN.exe 1924 EDCURLN.exe 4388 TTDTX.exe 4388 TTDTX.exe 1944 EMYM.exe 1944 EMYM.exe 4544 IUFM.exe 4544 IUFM.exe 1320 SSSGZH.exe 1320 SSSGZH.exe 4836 LVWCF.exe 4836 LVWCF.exe 4280 GFF.exe 4280 GFF.exe 5968 BTJKD.exe 5968 BTJKD.exe 6116 MLMDDO.exe 6116 MLMDDO.exe 2920 HZR.exe 2920 HZR.exe 5004 LPYUA.exe 5004 LPYUA.exe 3484 WHBFIOP.exe 3484 WHBFIOP.exe 3408 QVG.exe 3408 QVG.exe 1896 LIKGV.exe 1896 LIKGV.exe 5016 MLOCIMC.exe 5016 MLOCIMC.exe 560 QTVKMW.exe 560 QTVKMW.exe 5592 KGA.exe 5592 KGA.exe 5992 SUSH.exe 5992 SUSH.exe 2584 QUZV.exe 2584 QUZV.exe 5564 LHEFRL.exe 5564 LHEFRL.exe 3928 RIM.exe 3928 RIM.exe 1088 LVRCL.exe 1088 LVRCL.exe 4760 OIWLVFC.exe 4760 OIWLVFC.exe 5660 IEAU.exe 5660 IEAU.exe 4324 UWDNN.exe 4324 UWDNN.exe 5780 DXFSRR.exe 5780 DXFSRR.exe 2148 HNM.exe 2148 HNM.exe 5496 RKS.exe 5496 RKS.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 764 wrote to memory of 1204 764 2026-07-24_492009940bafe664597c3bd2817e2b4b_elex_emotet_stop.exe 90 PID 1204 wrote to memory of 4884 1204 cmd.exe 94 PID 4884 wrote to memory of 5756 4884 CSV.exe 96 PID 5756 wrote to memory of 2864 5756 cmd.exe 100 PID 2864 wrote to memory of 2908 2864 WFHMAAL.exe 101 PID 2908 wrote to memory of 248 2908 cmd.exe 105 PID 248 wrote to memory of 4372 248 JQXKG.exe 106 PID 4372 wrote to memory of 1924 4372 cmd.exe 110 PID 1924 wrote to memory of 1284 1924 EDCURLN.exe 111 PID 1284 wrote to memory of 4388 1284 cmd.exe 115 PID 4388 wrote to memory of 4496 4388 TTDTX.exe 116 PID 4496 wrote to memory of 1944 4496 cmd.exe 120 PID 1944 wrote to memory of 952 1944 EMYM.exe 121 PID 952 wrote to memory of 4544 952 cmd.exe 125 PID 4544 wrote to memory of 2020 4544 IUFM.exe 126 PID 2020 wrote to memory of 1320 2020 cmd.exe 130 PID 1320 wrote to memory of 3676 1320 SSSGZH.exe 131 PID 3676 wrote to memory of 4836 3676 cmd.exe 135 PID 4836 wrote to memory of 5428 4836 LVWCF.exe 136 PID 5428 wrote to memory of 4280 5428 cmd.exe 140 PID 4280 wrote to memory of 1340 4280 GFF.exe 141 PID 1340 wrote to memory of 5968 1340 cmd.exe 145 PID 5968 wrote to memory of 2600 5968 BTJKD.exe 146 PID 2600 wrote to memory of 6116 2600 cmd.exe 150 PID 6116 wrote to memory of 4744 6116 MLMDDO.exe 151 PID 4744 wrote to memory of 2920 4744 cmd.exe 155 PID 2920 wrote to memory of 1452 2920 HZR.exe 156 PID 1452 wrote to memory of 5004 1452 cmd.exe 160 PID 5004 wrote to memory of 3440 5004 LPYUA.exe 161 PID 3440 wrote to memory of 3484 3440 cmd.exe 165 PID 3484 wrote to memory of 376 3484 WHBFIOP.exe 166 PID 376 wrote to memory of 3408 376 cmd.exe 170 PID 3408 wrote to memory of 2772 3408 QVG.exe 171 PID 2772 wrote to memory of 1896 2772 cmd.exe 175 PID 1896 wrote to memory of 4400 1896 LIKGV.exe 176 PID 4400 wrote to memory of 5016 4400 cmd.exe 180 PID 5016 wrote to memory of 1180 5016 MLOCIMC.exe 181 PID 1180 wrote to memory of 560 1180 cmd.exe 185 PID 560 wrote to memory of 5184 560 QTVKMW.exe 186 PID 5184 wrote to memory of 5592 5184 cmd.exe 190 PID 5592 wrote to memory of 1800 5592 KGA.exe 191 PID 1800 wrote to memory of 5992 1800 cmd.exe 195 PID 5992 wrote to memory of 4088 5992 SUSH.exe 196 PID 4088 wrote to memory of 2584 4088 cmd.exe 200 PID 2584 wrote to memory of 4212 2584 QUZV.exe 201 PID 4212 wrote to memory of 5564 4212 cmd.exe 205 PID 5564 wrote to memory of 5720 5564 LHEFRL.exe 206 PID 5720 wrote to memory of 3928 5720 cmd.exe 210 PID 3928 wrote to memory of 1344 3928 RIM.exe 211 PID 1344 wrote to memory of 1088 1344 cmd.exe 215 PID 1088 wrote to memory of 4124 1088 LVRCL.exe 216 PID 4124 wrote to memory of 4760 4124 cmd.exe 220 PID 4760 wrote to memory of 4968 4760 OIWLVFC.exe 221 PID 4968 wrote to memory of 5660 4968 cmd.exe 225 PID 5660 wrote to memory of 4180 5660 IEAU.exe 226 PID 4180 wrote to memory of 4324 4180 cmd.exe 230 PID 4324 wrote to memory of 2684 4324 UWDNN.exe 231 PID 2684 wrote to memory of 5780 2684 cmd.exe 235 PID 5780 wrote to memory of 1016 5780 DXFSRR.exe 236 PID 1016 wrote to memory of 2148 1016 cmd.exe 240 PID 2148 wrote to memory of 2036 2148 HNM.exe 241 PID 2036 wrote to memory of 5496 2036 cmd.exe 245 PID 5496 wrote to memory of 4256 5496 RKS.exe 246 PID 4256 wrote to memory of 4972 4256 cmd.exe 250
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-24_492009940bafe664597c3bd2817e2b4b_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-24_492009940bafe664597c3bd2817e2b4b_elex_emotet_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CSV.exe.bat" "2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\windows\system\CSV.exeC:\windows\system\CSV.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WFHMAAL.exe.bat" "4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5756 -
C:\windows\system\WFHMAAL.exeC:\windows\system\WFHMAAL.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JQXKG.exe.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\windows\JQXKG.exeC:\windows\JQXKG.exe7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EDCURLN.exe.bat" "8⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\windows\EDCURLN.exeC:\windows\EDCURLN.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TTDTX.exe.bat" "10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\windows\SysWOW64\TTDTX.exeC:\windows\system32\TTDTX.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EMYM.exe.bat" "12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\windows\system\EMYM.exeC:\windows\system\EMYM.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IUFM.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:952 -
C:\windows\system\IUFM.exeC:\windows\system\IUFM.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SSSGZH.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\windows\system\SSSGZH.exeC:\windows\system\SSSGZH.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LVWCF.exe.bat" "18⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3676 -
C:\windows\SysWOW64\LVWCF.exeC:\windows\system32\LVWCF.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GFF.exe.bat" "20⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5428 -
C:\windows\SysWOW64\GFF.exeC:\windows\system32\GFF.exe21⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BTJKD.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\windows\system\BTJKD.exeC:\windows\system\BTJKD.exe23⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MLMDDO.exe.bat" "24⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\windows\SysWOW64\MLMDDO.exeC:\windows\system32\MLMDDO.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HZR.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\windows\HZR.exeC:\windows\HZR.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LPYUA.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\windows\system\LPYUA.exeC:\windows\system\LPYUA.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WHBFIOP.exe.bat" "30⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\windows\SysWOW64\WHBFIOP.exeC:\windows\system32\WHBFIOP.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QVG.exe.bat" "32⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:376 -
C:\windows\QVG.exeC:\windows\QVG.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LIKGV.exe.bat" "34⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\windows\LIKGV.exeC:\windows\LIKGV.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MLOCIMC.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\windows\MLOCIMC.exeC:\windows\MLOCIMC.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QTVKMW.exe.bat" "38⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\windows\system\QTVKMW.exeC:\windows\system\QTVKMW.exe39⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KGA.exe.bat" "40⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5184 -
C:\windows\KGA.exeC:\windows\KGA.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SUSH.exe.bat" "42⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\windows\SysWOW64\SUSH.exeC:\windows\system32\SUSH.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QUZV.exe.bat" "44⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\windows\SysWOW64\QUZV.exeC:\windows\system32\QUZV.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LHEFRL.exe.bat" "46⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\windows\system\LHEFRL.exeC:\windows\system\LHEFRL.exe47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RIM.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:5720 -
C:\windows\RIM.exeC:\windows\RIM.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LVRCL.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\windows\LVRCL.exeC:\windows\LVRCL.exe51⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OIWLVFC.exe.bat" "52⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\windows\OIWLVFC.exeC:\windows\OIWLVFC.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IEAU.exe.bat" "54⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\windows\system\IEAU.exeC:\windows\system\IEAU.exe55⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UWDNN.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\windows\SysWOW64\UWDNN.exeC:\windows\system32\UWDNN.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DXFSRR.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\windows\DXFSRR.exeC:\windows\DXFSRR.exe59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HNM.exe.bat" "60⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\windows\system\HNM.exeC:\windows\system\HNM.exe61⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RKS.exe.bat" "62⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\windows\system\RKS.exeC:\windows\system\RKS.exe63⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VSYVX.exe.bat" "64⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\windows\VSYVX.exeC:\windows\VSYVX.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VYYJYP.exe.bat" "66⤵
- Executes a command shell one-liner
PID:1936 -
C:\windows\SysWOW64\VYYJYP.exeC:\windows\system32\VYYJYP.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HOFJK.exe.bat" "68⤵PID:1560
-
C:\windows\SysWOW64\HOFJK.exeC:\windows\system32\HOFJK.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4892 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BBKTVHH.exe.bat" "70⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5904 -
C:\windows\SysWOW64\BBKTVHH.exeC:\windows\system32\BBKTVHH.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LCMY.exe.bat" "72⤵
- System Location Discovery: System Language Discovery
PID:4108 -
C:\windows\LCMY.exeC:\windows\LCMY.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AFVKJS.exe.bat" "74⤵PID:2032
-
C:\windows\SysWOW64\AFVKJS.exeC:\windows\system32\AFVKJS.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RFX.exe.bat" "76⤵
- Executes a command shell one-liner
PID:6112 -
C:\windows\system\RFX.exeC:\windows\system\RFX.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GKDM.exe.bat" "78⤵PID:4664
-
C:\windows\SysWOW64\GKDM.exeC:\windows\system32\GKDM.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AYIWEH.exe.bat" "80⤵
- Executes a command shell one-liner
PID:5000 -
C:\windows\AYIWEH.exeC:\windows\AYIWEH.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2292 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MQDOM.exe.bat" "82⤵PID:5092
-
C:\windows\SysWOW64\MQDOM.exeC:\windows\system32\MQDOM.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1292 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HBTFA.exe.bat" "84⤵
- System Location Discovery: System Language Discovery
PID:4416 -
C:\windows\system\HBTFA.exeC:\windows\system\HBTFA.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2672 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BOYWLRC.exe.bat" "86⤵
- Executes a command shell one-liner
PID:2636 -
C:\windows\BOYWLRC.exeC:\windows\BOYWLRC.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BUQ.exe.bat" "88⤵
- System Location Discovery: System Language Discovery
PID:1524 -
C:\windows\BUQ.exeC:\windows\BUQ.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PFHCAO.exe.bat" "90⤵
- System Location Discovery: System Language Discovery
PID:4508 -
C:\windows\SysWOW64\PFHCAO.exeC:\windows\system32\PFHCAO.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XKZQCTV.exe.bat" "92⤵PID:3116
-
C:\windows\XKZQCTV.exeC:\windows\XKZQCTV.exe93⤵
- Executes dropped EXE
PID:5920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DLHE.exe.bat" "94⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3880 -
C:\windows\system\DLHE.exeC:\windows\system\DLHE.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ODKXT.exe.bat" "96⤵PID:4076
-
C:\windows\ODKXT.exeC:\windows\ODKXT.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UDRKCFN.exe.bat" "98⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2532 -
C:\windows\system\UDRKCFN.exeC:\windows\system\UDRKCFN.exe99⤵
- Executes dropped EXE
PID:2224 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SEZ.exe.bat" "100⤵
- Executes a command shell one-liner
PID:5444 -
C:\windows\SEZ.exeC:\windows\SEZ.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DWUR.exe.bat" "102⤵PID:4396
-
C:\windows\SysWOW64\DWUR.exeC:\windows\system32\DWUR.exe103⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XKZAEG.exe.bat" "104⤵PID:5340
-
C:\windows\XKZAEG.exeC:\windows\XKZAEG.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NAAA.exe.bat" "106⤵PID:4952
-
C:\windows\SysWOW64\NAAA.exeC:\windows\system32\NAAA.exe107⤵
- Executes dropped EXE
PID:5916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JFGPSM.exe.bat" "108⤵PID:6004
-
C:\windows\system\JFGPSM.exeC:\windows\system\JFGPSM.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2096 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NVM.exe.bat" "110⤵PID:5928
-
C:\windows\SysWOW64\NVM.exeC:\windows\system32\NVM.exe111⤵
- Executes dropped EXE
PID:5052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IJRGO.exe.bat" "112⤵
- System Location Discovery: System Language Discovery
PID:6128 -
C:\windows\IJRGO.exeC:\windows\IJRGO.exe113⤵
- Executes dropped EXE
PID:1240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OJZUXYV.exe.bat" "114⤵PID:2812
-
C:\windows\OJZUXYV.exeC:\windows\OJZUXYV.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZBCNFF.exe.bat" "116⤵PID:5604
-
C:\windows\SysWOW64\ZBCNFF.exeC:\windows\system32\ZBCNFF.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DJINKY.exe.bat" "118⤵PID:1096
-
C:\windows\system\DJINKY.exeC:\windows\system\DJINKY.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FFNWUYN.exe.bat" "120⤵
- System Location Discovery: System Language Discovery
PID:3508 -
C:\windows\SysWOW64\FFNWUYN.exeC:\windows\system32\FFNWUYN.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3512
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-