Analysis
- max time kernel
90s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/07/2026, 07:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-27_cda300c465c6517631851f13c4969c5c_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-07-27_cda300c465c6517631851f13c4969c5c_elex_emotet_stop.exe
- Size 208KB
- Sample260727-jr2wasaa22
- SHA256 c44e3813d7e6435eff1628fbe53ef12e41115d4873f8699b41daf2cc35c4932c
- MD5 cda300c465c6517631851f13c4969c5c
- SHA1 59facc40cf7d3d0f6044ff435a47140f4c3b8ae2
- SHA512 473d6801ae9468ff8b2caebc054e7d536c0ca04712e4d2f067d17e3caf43f8ad5ecc652353b1090b0847ce853deec7cab464bb9789e7534b5b68b620a89f6236
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbclcdL+LOfw4NLthEjQT6E:MlZtbLWIgd1LZ9oECZbclc5+LO4QEj6
- TLSH T188247D2236D2C073E4B7023188F6C7787BB6BD919B36928B77C03B4D6E715A68A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4244 MBTTNFQ.exe 4492 VZNUYBZ.exe 1240 SPA.exe 5184 FAJ.exe 5936 VQSC.exe 1928 IBAA.exe 5908 VZA.exe 5812 JJQLFO.exe 2720 HUTBO.exe 2080 TKABAMJ.exe 3924 OXFK.exe 5948 VNGJRZN.exe 5572 UDZEEE.exe 1792 SWCUM.exe 3012 EEIDZLF.exe 2868 IHHQZ.exe 4172 MXNYLOD.exe 2688 AAEOZ.exe 3852 ADHS.exe 5988 ZOK.exe 4044 BMYUVL.exe 236 WZVMFLU.exe 4544 LPEDLZ.exe 3248 JNPG.exe 3236 KQT.exe 3040 BAWSN.exe 3400 DOABXID.exe 3164 WREFCX.exe 4124 AZT.exe 4080 MPZFBI.exe 712 VPBSEFZ.exe 3156 LFCJL.exe 2696 AAM.exe 1148 EQSWIG.exe 3000 TGTV.exe 2428 GRKMDEU.exe 1960 MEBVA.exe 2392 CZT.exe 5864 LIVE.exe 4852 YTDDKCI.exe 6080 GYD.exe 912 TJM.exe 5820 VHRCI.exe 3008 WCVG.exe 5148 FKXLY.exe 5532 IXCUJWH.exe 3124 BAGY.exe 2016 VOK.exe 1256 QBPRB.exe 3292 KOUALL.exe 5284 FKZ.exe 2880 UFIO.exe 3648 AAHXLBO.exe 1640 VNMG.exe 5276 MBXYDX.exe 4104 FWB.exe 5588 DODKZBW.exe 2864 HWSKD.exe 4424 ZXUXPR.exe 4652 MHCODC.exe 4504 SDCXAFX.exe 5728 HYLBT.exe 1140 CLQKVR.exe 3044 LTS.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\GZJRZY.exe.bat GWFWMII.exe File created C:\windows\SysWOW64\KHQ.exe GZJRZY.exe File created C:\windows\SysWOW64\KWXWA.exe PBSM.exe File opened for modification C:\windows\SysWOW64\BAWSN.exe KQT.exe File created C:\windows\SysWOW64\QHIW.exe IUI.exe File created C:\windows\SysWOW64\VZNUYBZ.exe.bat MBTTNFQ.exe File created C:\windows\SysWOW64\TKABAMJ.exe.bat HUTBO.exe File created C:\windows\SysWOW64\MEBVA.exe GRKMDEU.exe File created C:\windows\SysWOW64\HWSKD.exe.bat DODKZBW.exe File opened for modification C:\windows\SysWOW64\LVL.exe MKIQ.exe File created C:\windows\SysWOW64\BQUOU.exe.bat WNUQUD.exe File opened for modification C:\windows\SysWOW64\PDNH.exe EKSP.exe File created C:\windows\SysWOW64\XZZV.exe.bat KWJX.exe File created C:\windows\SysWOW64\JJQLFO.exe VZA.exe File opened for modification C:\windows\SysWOW64\XZZV.exe KWJX.exe File created C:\windows\SysWOW64\MJCFCKI.exe KWXWA.exe File opened for modification C:\windows\SysWOW64\VZA.exe IBAA.exe File created C:\windows\SysWOW64\LPEDLZ.exe WZVMFLU.exe File created C:\windows\SysWOW64\AONZQCW.exe OVKGHV.exe File created C:\windows\SysWOW64\OXFK.exe TKABAMJ.exe File created C:\windows\SysWOW64\DVOGZ.exe JIRW.exe File created C:\windows\SysWOW64\MEBVA.exe.bat GRKMDEU.exe File opened for modification C:\windows\SysWOW64\QHIW.exe IUI.exe File created C:\windows\SysWOW64\ZAB.exe PDNH.exe File created C:\windows\SysWOW64\OVKGHV.exe ZAB.exe File created C:\windows\SysWOW64\VZA.exe IBAA.exe File opened for modification C:\windows\SysWOW64\LPEDLZ.exe WZVMFLU.exe File created C:\windows\SysWOW64\YTDDKCI.exe LIVE.exe File created C:\windows\SysWOW64\KOUALL.exe QBPRB.exe File created C:\windows\SysWOW64\VNMG.exe.bat AAHXLBO.exe File created C:\windows\SysWOW64\ZAB.exe.bat PDNH.exe File opened for modification C:\windows\SysWOW64\OXFK.exe TKABAMJ.exe File opened for modification C:\windows\SysWOW64\MEBVA.exe GRKMDEU.exe File created C:\windows\SysWOW64\VHRCI.exe TJM.exe File created C:\windows\SysWOW64\QBPRB.exe VOK.exe File opened for modification C:\windows\SysWOW64\KOUALL.exe QBPRB.exe File opened for modification C:\windows\SysWOW64\TKABAMJ.exe HUTBO.exe File created C:\windows\SysWOW64\PDSGAFY.exe.bat LVL.exe File created C:\windows\SysWOW64\DVOGZ.exe.bat JIRW.exe File opened for modification C:\windows\SysWOW64\IUBQTO.exe RUZDP.exe File created C:\windows\SysWOW64\IUBQTO.exe.bat RUZDP.exe File opened for modification C:\windows\SysWOW64\MXNYLOD.exe IHHQZ.exe File created C:\windows\SysWOW64\LVL.exe.bat MKIQ.exe File created C:\windows\SysWOW64\QBENKBZ.exe.bat YBCIGE.exe File opened for modification C:\windows\SysWOW64\VHRCI.exe TJM.exe File created C:\windows\SysWOW64\YTDDKCI.exe.bat LIVE.exe File created C:\windows\SysWOW64\PDNH.exe EKSP.exe File opened for modification C:\windows\SysWOW64\JJQLFO.exe VZA.exe File created C:\windows\SysWOW64\SWCUM.exe UDZEEE.exe File created C:\windows\SysWOW64\BAWSN.exe.bat KQT.exe File created C:\windows\SysWOW64\EQSWIG.exe AAM.exe File created C:\windows\SysWOW64\TKABAMJ.exe HUTBO.exe File created C:\windows\SysWOW64\OXFK.exe.bat TKABAMJ.exe File created C:\windows\SysWOW64\GZJRZY.exe GWFWMII.exe File opened for modification C:\windows\SysWOW64\QBENKBZ.exe YBCIGE.exe File opened for modification C:\windows\SysWOW64\MJCFCKI.exe KWXWA.exe File opened for modification C:\windows\SysWOW64\YTDDKCI.exe LIVE.exe File created C:\windows\SysWOW64\KHQ.exe.bat GZJRZY.exe File created C:\windows\SysWOW64\SWCUM.exe.bat UDZEEE.exe File created C:\windows\SysWOW64\EQSWIG.exe.bat AAM.exe File opened for modification C:\windows\SysWOW64\AAHXLBO.exe UFIO.exe File opened for modification C:\windows\SysWOW64\MBXYDX.exe VNMG.exe File opened for modification C:\windows\SysWOW64\ZAB.exe PDNH.exe File opened for modification C:\windows\SysWOW64\XGOIK.exe TQIIYCH.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\system\LIVE.exe CZT.exe File created C:\windows\ELBZNF.exe JYWQ.exe File created C:\windows\EVQWF.exe.bat XZZV.exe File created C:\windows\CZT.exe.bat MEBVA.exe File opened for modification C:\windows\system\IXCUJWH.exe FKXLY.exe File created C:\windows\SDCXAFX.exe MHCODC.exe File created C:\windows\system\KQT.exe.bat JNPG.exe File created C:\windows\IBAA.exe VQSC.exe File created C:\windows\BMYUVL.exe.bat ZOK.exe File created C:\windows\LTS.exe CLQKVR.exe File created C:\windows\system\JIRW.exe OVMFEKM.exe File opened for modification C:\windows\system\WCVG.exe VHRCI.exe File opened for modification C:\windows\system\WZVMFLU.exe BMYUVL.exe File created C:\windows\system\AZT.exe WREFCX.exe File created C:\windows\ZOK.exe.bat ADHS.exe File opened for modification C:\windows\EEIDZLF.exe SWCUM.exe File created C:\windows\AAM.exe LFCJL.exe File created C:\windows\ELBZNF.exe.bat JYWQ.exe File created C:\windows\system\JIRW.exe.bat OVMFEKM.exe File created C:\windows\system\SPA.exe.bat VZNUYBZ.exe File created C:\windows\system\WZVMFLU.exe.bat BMYUVL.exe File created C:\windows\system\LIVE.exe CZT.exe File created C:\windows\system\LIVE.exe.bat CZT.exe File opened for modification C:\windows\system\BAGY.exe IXCUJWH.exe File created C:\windows\system\BAGY.exe.bat IXCUJWH.exe File created C:\windows\SDCXAFX.exe.bat MHCODC.exe File created C:\windows\LTS.exe.bat CLQKVR.exe File opened for modification C:\windows\MPZFBI.exe AZT.exe File created C:\windows\CZT.exe MEBVA.exe File opened for modification C:\windows\UFIO.exe FKZ.exe File opened for modification C:\windows\CLQKVR.exe HYLBT.exe File opened for modification C:\windows\LTS.exe CLQKVR.exe File created C:\windows\system\RUZDP.exe LTS.exe File created C:\windows\WNUQUD.exe SFOQIS.exe File created C:\windows\HET.exe.bat BQUOU.exe File created C:\windows\MPZFBI.exe AZT.exe File created C:\windows\MPZFBI.exe.bat AZT.exe File created C:\windows\system\FKXLY.exe.bat WCVG.exe File created C:\windows\FKZ.exe KOUALL.exe File created C:\windows\system\JYWQ.exe PDSGAFY.exe File opened for modification C:\windows\QXTUJYY.exe YKJC.exe File created C:\windows\system\VCQJVN.exe.bat AOLA.exe File opened for modification C:\windows\system\GWFWMII.exe JRN.exe File opened for modification C:\windows\system\ZXUXPR.exe HWSKD.exe File created C:\windows\system\MKIQ.exe IUBQTO.exe File created C:\windows\system\JRN.exe.bat DVOGZ.exe File created C:\windows\ULV.exe.bat LKTVRGH.exe File opened for modification C:\windows\system\LFCJL.exe VPBSEFZ.exe File created C:\windows\GYD.exe YTDDKCI.exe File opened for modification C:\windows\system\MKIQ.exe IUBQTO.exe File created C:\windows\system\FEDBFC.exe TLARW.exe File created C:\windows\system\WZL.exe.bat WTLWXMY.exe File created C:\windows\system\YBCIGE.exe.bat ULV.exe File created C:\windows\TQIIYCH.exe EVQWF.exe File created C:\windows\TQIIYCH.exe.bat EVQWF.exe File created C:\windows\system\VQSC.exe FAJ.exe File opened for modification C:\windows\system\AZT.exe WREFCX.exe File opened for modification C:\windows\LKTVRGH.exe KHQ.exe File opened for modification C:\windows\TQIIYCH.exe EVQWF.exe File opened for modification C:\windows\PBSM.exe XGOIK.exe File created C:\windows\VPBSEFZ.exe MPZFBI.exe File opened for modification C:\windows\system\VQSC.exe FAJ.exe File opened for modification C:\windows\JNPG.exe LPEDLZ.exe File opened for modification C:\windows\WTLWXMY.exe AONZQCW.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2976 cmd.exe 2668 cmd.exe 2024 cmd.exe 5200 cmd.exe 4420 cmd.exe 1884 cmd.exe 3700 cmd.exe 4668 cmd.exe 3900 cmd.exe 1924 cmd.exe 4468 cmd.exe 2488 cmd.exe 2616 cmd.exe 2652 cmd.exe 2312 cmd.exe 852 cmd.exe 1224 cmd.exe 3752 cmd.exe 4736 cmd.exe 5912 cmd.exe 4896 cmd.exe 2800 cmd.exe 2480 cmd.exe 3488 cmd.exe 2044 cmd.exe 4240 cmd.exe 6104 cmd.exe 4460 cmd.exe 5460 cmd.exe 5500 cmd.exe 2168 cmd.exe 1696 cmd.exe 1660 cmd.exe 548 cmd.exe 4864 cmd.exe 4444 cmd.exe 1804 cmd.exe 2820 cmd.exe 1000 cmd.exe 5476 cmd.exe 4184 cmd.exe 3368 cmd.exe 5060 cmd.exe 4068 cmd.exe 1096 cmd.exe 4220 cmd.exe 1864 cmd.exe 4052 cmd.exe 1328 cmd.exe 3132 cmd.exe 612 cmd.exe 1840 cmd.exe 4588 cmd.exe 2708 cmd.exe 2384 cmd.exe 1188 cmd.exe 5376 cmd.exe 2572 cmd.exe 2860 cmd.exe 2316 cmd.exe 1264 cmd.exe 3380 cmd.exe 1848 cmd.exe 3736 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 912 3444 WerFault.exe 88 1684 4244 WerFault.exe 93 2696 4492 WerFault.exe 99 5524 1240 WerFault.exe 104 1996 5184 WerFault.exe 109 5252 5936 WerFault.exe 114 2736 1928 WerFault.exe 119 5972 5908 WerFault.exe 124 1860 5812 WerFault.exe 129 4748 2720 WerFault.exe 134 1244 2080 WerFault.exe 139 4736 3924 WerFault.exe 144 5912 5948 WerFault.exe 149 3008 5572 WerFault.exe 154 5800 1792 WerFault.exe 159 1960 3012 WerFault.exe 164 3712 2868 WerFault.exe 169 4540 4172 WerFault.exe 174 3380 2688 WerFault.exe 179 3292 3852 WerFault.exe 184 1344 5988 WerFault.exe 189 5644 4044 WerFault.exe 194 3188 236 WerFault.exe 199 1592 4544 WerFault.exe 204 4460 3248 WerFault.exe 209 4984 3236 WerFault.exe 214 2092 3040 WerFault.exe 219 3764 3400 WerFault.exe 224 3368 3164 WerFault.exe 229 2296 4124 WerFault.exe 234 3212 4080 WerFault.exe 239 2820 712 WerFault.exe 244 2880 3156 WerFault.exe 249 2984 2696 WerFault.exe 254 2828 1148 WerFault.exe 259 5276 3000 WerFault.exe 264 4104 2428 WerFault.exe 269 4820 1960 WerFault.exe 275 2268 2392 WerFault.exe 280 2296 5864 WerFault.exe 285 2480 4852 WerFault.exe 290 1344 6080 WerFault.exe 295 4648 912 WerFault.exe 300 1592 5820 WerFault.exe 305 2320 3008 WerFault.exe 310 4368 5148 WerFault.exe 315 1144 5532 WerFault.exe 320 2912 3124 WerFault.exe 325 2204 2016 WerFault.exe 330 3512 1256 WerFault.exe 335 4436 3292 WerFault.exe 340 4088 5284 WerFault.exe 345 2980 2880 WerFault.exe 350 4808 3648 WerFault.exe 355 5524 1640 WerFault.exe 360 2092 5276 WerFault.exe 365 2840 4104 WerFault.exe 370 5652 5588 WerFault.exe 375 5032 2864 WerFault.exe 380 5024 4424 WerFault.exe 385 5828 4652 WerFault.exe 390 1684 4504 WerFault.exe 395 1816 5728 WerFault.exe 400 5792 1140 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DVOGZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ULV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XGOIK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GWFWMII.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FKXLY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GYD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LIVE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZXUXPR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZAB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SFOQIS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VZA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IHHQZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JYWQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QXTUJYY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EEIDZLF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JKU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LFCJL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OVMFEKM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LKTVRGH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MKIQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GZJRZY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KWXWA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MHCODC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CLQKVR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VPBSEFZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AONZQCW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VNGJRZN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JNPG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VOK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YTDDKCI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MBXYDX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AOLA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XZZV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3444 2026-07-27_cda300c465c6517631851f13c4969c5c_elex_emotet_stop.exe 3444 2026-07-27_cda300c465c6517631851f13c4969c5c_elex_emotet_stop.exe 4244 MBTTNFQ.exe 4244 MBTTNFQ.exe 4492 VZNUYBZ.exe 4492 VZNUYBZ.exe 1240 SPA.exe 1240 SPA.exe 5184 FAJ.exe 5184 FAJ.exe 5936 VQSC.exe 5936 VQSC.exe 1928 IBAA.exe 1928 IBAA.exe 5908 VZA.exe 5908 VZA.exe 5812 JJQLFO.exe 5812 JJQLFO.exe 2720 HUTBO.exe 2720 HUTBO.exe 2080 TKABAMJ.exe 2080 TKABAMJ.exe 3924 OXFK.exe 3924 OXFK.exe 5948 VNGJRZN.exe 5948 VNGJRZN.exe 5572 UDZEEE.exe 5572 UDZEEE.exe 1792 SWCUM.exe 1792 SWCUM.exe 3012 EEIDZLF.exe 3012 EEIDZLF.exe 2868 IHHQZ.exe 2868 IHHQZ.exe 4172 MXNYLOD.exe 4172 MXNYLOD.exe 2688 AAEOZ.exe 2688 AAEOZ.exe 3852 ADHS.exe 3852 ADHS.exe 5988 ZOK.exe 5988 ZOK.exe 4044 BMYUVL.exe 4044 BMYUVL.exe 236 WZVMFLU.exe 236 WZVMFLU.exe 4544 LPEDLZ.exe 4544 LPEDLZ.exe 3248 JNPG.exe 3248 JNPG.exe 3236 KQT.exe 3236 KQT.exe 3040 BAWSN.exe 3040 BAWSN.exe 3400 DOABXID.exe 3400 DOABXID.exe 3164 WREFCX.exe 3164 WREFCX.exe 4124 AZT.exe 4124 AZT.exe 4080 MPZFBI.exe 4080 MPZFBI.exe 712 VPBSEFZ.exe 712 VPBSEFZ.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 3444 2026-07-27_cda300c465c6517631851f13c4969c5c_elex_emotet_stop.exe 3444 2026-07-27_cda300c465c6517631851f13c4969c5c_elex_emotet_stop.exe 4244 MBTTNFQ.exe 4244 MBTTNFQ.exe 4492 VZNUYBZ.exe 4492 VZNUYBZ.exe 1240 SPA.exe 1240 SPA.exe 5184 FAJ.exe 5184 FAJ.exe 5936 VQSC.exe 5936 VQSC.exe 1928 IBAA.exe 1928 IBAA.exe 5908 VZA.exe 5908 VZA.exe 5812 JJQLFO.exe 5812 JJQLFO.exe 2720 HUTBO.exe 2720 HUTBO.exe 2080 TKABAMJ.exe 2080 TKABAMJ.exe 3924 OXFK.exe 3924 OXFK.exe 5948 VNGJRZN.exe 5948 VNGJRZN.exe 5572 UDZEEE.exe 5572 UDZEEE.exe 1792 SWCUM.exe 1792 SWCUM.exe 3012 EEIDZLF.exe 3012 EEIDZLF.exe 2868 IHHQZ.exe 2868 IHHQZ.exe 4172 MXNYLOD.exe 4172 MXNYLOD.exe 2688 AAEOZ.exe 2688 AAEOZ.exe 3852 ADHS.exe 3852 ADHS.exe 5988 ZOK.exe 5988 ZOK.exe 4044 BMYUVL.exe 4044 BMYUVL.exe 236 WZVMFLU.exe 236 WZVMFLU.exe 4544 LPEDLZ.exe 4544 LPEDLZ.exe 3248 JNPG.exe 3248 JNPG.exe 3236 KQT.exe 3236 KQT.exe 3040 BAWSN.exe 3040 BAWSN.exe 3400 DOABXID.exe 3400 DOABXID.exe 3164 WREFCX.exe 3164 WREFCX.exe 4124 AZT.exe 4124 AZT.exe 4080 MPZFBI.exe 4080 MPZFBI.exe 712 VPBSEFZ.exe 712 VPBSEFZ.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3444 wrote to memory of 3736 3444 2026-07-27_cda300c465c6517631851f13c4969c5c_elex_emotet_stop.exe 89 PID 3736 wrote to memory of 4244 3736 cmd.exe 93 PID 4244 wrote to memory of 5376 4244 MBTTNFQ.exe 95 PID 5376 wrote to memory of 4492 5376 cmd.exe 99 PID 4492 wrote to memory of 3700 4492 VZNUYBZ.exe 100 PID 3700 wrote to memory of 1240 3700 cmd.exe 104 PID 1240 wrote to memory of 3376 1240 SPA.exe 105 PID 3376 wrote to memory of 5184 3376 cmd.exe 109 PID 5184 wrote to memory of 3692 5184 FAJ.exe 110 PID 3692 wrote to memory of 5936 3692 cmd.exe 114 PID 5936 wrote to memory of 4804 5936 VQSC.exe 115 PID 4804 wrote to memory of 1928 4804 cmd.exe 119 PID 1928 wrote to memory of 2044 1928 IBAA.exe 120 PID 2044 wrote to memory of 5908 2044 cmd.exe 124 PID 5908 wrote to memory of 5632 5908 VZA.exe 125 PID 5632 wrote to memory of 5812 5632 cmd.exe 129 PID 5812 wrote to memory of 6088 5812 JJQLFO.exe 130 PID 6088 wrote to memory of 2720 6088 cmd.exe 134 PID 2720 wrote to memory of 4788 2720 HUTBO.exe 135 PID 4788 wrote to memory of 2080 4788 cmd.exe 139 PID 2080 wrote to memory of 4468 2080 TKABAMJ.exe 140 PID 4468 wrote to memory of 3924 4468 cmd.exe 144 PID 3924 wrote to memory of 2488 3924 OXFK.exe 145 PID 2488 wrote to memory of 5948 2488 cmd.exe 149 PID 5948 wrote to memory of 4300 5948 VNGJRZN.exe 150 PID 4300 wrote to memory of 5572 4300 cmd.exe 154 PID 5572 wrote to memory of 6024 5572 UDZEEE.exe 155 PID 6024 wrote to memory of 1792 6024 cmd.exe 159 PID 1792 wrote to memory of 544 1792 SWCUM.exe 160 PID 544 wrote to memory of 3012 544 cmd.exe 164 PID 3012 wrote to memory of 3168 3012 EEIDZLF.exe 165 PID 3168 wrote to memory of 2868 3168 cmd.exe 169 PID 2868 wrote to memory of 612 2868 IHHQZ.exe 170 PID 612 wrote to memory of 4172 612 cmd.exe 174 PID 4172 wrote to memory of 1912 4172 MXNYLOD.exe 175 PID 1912 wrote to memory of 2688 1912 cmd.exe 179 PID 2688 wrote to memory of 700 2688 AAEOZ.exe 180 PID 700 wrote to memory of 3852 700 cmd.exe 184 PID 3852 wrote to memory of 120 3852 ADHS.exe 185 PID 120 wrote to memory of 5988 120 cmd.exe 189 PID 5988 wrote to memory of 4628 5988 ZOK.exe 190 PID 4628 wrote to memory of 4044 4628 cmd.exe 194 PID 4044 wrote to memory of 4668 4044 BMYUVL.exe 195 PID 4668 wrote to memory of 236 4668 cmd.exe 199 PID 236 wrote to memory of 2532 236 WZVMFLU.exe 200 PID 2532 wrote to memory of 4544 2532 cmd.exe 204 PID 4544 wrote to memory of 2356 4544 LPEDLZ.exe 205 PID 2356 wrote to memory of 3248 2356 cmd.exe 209 PID 3248 wrote to memory of 5808 3248 JNPG.exe 210 PID 5808 wrote to memory of 3236 5808 cmd.exe 214 PID 3236 wrote to memory of 2412 3236 KQT.exe 215 PID 2412 wrote to memory of 3040 2412 cmd.exe 219 PID 3040 wrote to memory of 1584 3040 BAWSN.exe 220 PID 1584 wrote to memory of 3400 1584 cmd.exe 224 PID 3400 wrote to memory of 6100 3400 DOABXID.exe 225 PID 6100 wrote to memory of 3164 6100 cmd.exe 229 PID 3164 wrote to memory of 4400 3164 WREFCX.exe 230 PID 4400 wrote to memory of 4124 4400 cmd.exe 234 PID 4124 wrote to memory of 1840 4124 AZT.exe 235 PID 1840 wrote to memory of 4080 1840 cmd.exe 239 PID 4080 wrote to memory of 2408 4080 MPZFBI.exe 240 PID 2408 wrote to memory of 712 2408 cmd.exe 244 PID 712 wrote to memory of 3472 712 VPBSEFZ.exe 245 PID 3472 wrote to memory of 3156 3472 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cda300c465c6517631851f13c4969c5c_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-27_cda300c465c6517631851f13c4969c5c_elex_emotet_stop.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MBTTNFQ.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3736 -
C:\windows\SysWOW64\MBTTNFQ.exeC:\windows\system32\MBTTNFQ.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VZNUYBZ.exe.bat" "4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5376 -
C:\windows\SysWOW64\VZNUYBZ.exeC:\windows\system32\VZNUYBZ.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SPA.exe.bat" "6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3700 -
C:\windows\system\SPA.exeC:\windows\system\SPA.exe7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FAJ.exe.bat" "8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\windows\system\FAJ.exeC:\windows\system\FAJ.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5184 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VQSC.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:3692 -
C:\windows\system\VQSC.exeC:\windows\system\VQSC.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IBAA.exe.bat" "12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\windows\IBAA.exeC:\windows\IBAA.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VZA.exe.bat" "14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\windows\SysWOW64\VZA.exeC:\windows\system32\VZA.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JJQLFO.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:5632 -
C:\windows\SysWOW64\JJQLFO.exeC:\windows\system32\JJQLFO.exe17⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HUTBO.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:6088 -
C:\windows\SysWOW64\HUTBO.exeC:\windows\system32\HUTBO.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TKABAMJ.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\windows\SysWOW64\TKABAMJ.exeC:\windows\system32\TKABAMJ.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OXFK.exe.bat" "22⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\windows\SysWOW64\OXFK.exeC:\windows\system32\OXFK.exe23⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VNGJRZN.exe.bat" "24⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\windows\SysWOW64\VNGJRZN.exeC:\windows\system32\VNGJRZN.exe25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UDZEEE.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\windows\system\UDZEEE.exeC:\windows\system\UDZEEE.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SWCUM.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:6024 -
C:\windows\SysWOW64\SWCUM.exeC:\windows\system32\SWCUM.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EEIDZLF.exe.bat" "30⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:544 -
C:\windows\EEIDZLF.exeC:\windows\EEIDZLF.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IHHQZ.exe.bat" "32⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3168 -
C:\windows\system\IHHQZ.exeC:\windows\system\IHHQZ.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MXNYLOD.exe.bat" "34⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:612 -
C:\windows\SysWOW64\MXNYLOD.exeC:\windows\system32\MXNYLOD.exe35⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AAEOZ.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\windows\SysWOW64\AAEOZ.exeC:\windows\system32\AAEOZ.exe37⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ADHS.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:700 -
C:\windows\system\ADHS.exeC:\windows\system\ADHS.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZOK.exe.bat" "40⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:120 -
C:\windows\ZOK.exeC:\windows\ZOK.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BMYUVL.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\windows\BMYUVL.exeC:\windows\BMYUVL.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WZVMFLU.exe.bat" "44⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\windows\system\WZVMFLU.exeC:\windows\system\WZVMFLU.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LPEDLZ.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\windows\SysWOW64\LPEDLZ.exeC:\windows\system32\LPEDLZ.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JNPG.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\windows\JNPG.exeC:\windows\JNPG.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KQT.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:5808 -
C:\windows\system\KQT.exeC:\windows\system\KQT.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BAWSN.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\windows\SysWOW64\BAWSN.exeC:\windows\system32\BAWSN.exe53⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DOABXID.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\windows\system\DOABXID.exeC:\windows\system\DOABXID.exe55⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WREFCX.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:6100 -
C:\windows\WREFCX.exeC:\windows\WREFCX.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AZT.exe.bat" "58⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\windows\system\AZT.exeC:\windows\system\AZT.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MPZFBI.exe.bat" "60⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\windows\MPZFBI.exeC:\windows\MPZFBI.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VPBSEFZ.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\windows\VPBSEFZ.exeC:\windows\VPBSEFZ.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LFCJL.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\windows\system\LFCJL.exeC:\windows\system\LFCJL.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3156 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AAM.exe.bat" "66⤵
- Executes a command shell one-liner
PID:4736 -
C:\windows\AAM.exeC:\windows\AAM.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EQSWIG.exe.bat" "68⤵
- Executes a command shell one-liner
PID:5912 -
C:\windows\SysWOW64\EQSWIG.exeC:\windows\system32\EQSWIG.exe69⤵
- Executes dropped EXE
PID:1148 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TGTV.exe.bat" "70⤵PID:1648
-
C:\windows\SysWOW64\TGTV.exeC:\windows\system32\TGTV.exe71⤵
- Executes dropped EXE
PID:3000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GRKMDEU.exe.bat" "72⤵
- Executes a command shell one-liner
PID:5500 -
C:\windows\GRKMDEU.exeC:\windows\GRKMDEU.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MEBVA.exe.bat" "74⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4068 -
C:\windows\SysWOW64\MEBVA.exeC:\windows\system32\MEBVA.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CZT.exe.bat" "76⤵
- Executes a command shell one-liner
PID:2976 -
C:\windows\CZT.exeC:\windows\CZT.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LIVE.exe.bat" "78⤵PID:1732
-
C:\windows\system\LIVE.exeC:\windows\system\LIVE.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YTDDKCI.exe.bat" "80⤵PID:5272
-
C:\windows\SysWOW64\YTDDKCI.exeC:\windows\system32\YTDDKCI.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GYD.exe.bat" "82⤵
- System Location Discovery: System Language Discovery
PID:4264 -
C:\windows\GYD.exeC:\windows\GYD.exe83⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TJM.exe.bat" "84⤵PID:2484
-
C:\windows\system\TJM.exeC:\windows\system\TJM.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VHRCI.exe.bat" "86⤵
- System Location Discovery: System Language Discovery
PID:5780 -
C:\windows\SysWOW64\VHRCI.exeC:\windows\system32\VHRCI.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WCVG.exe.bat" "88⤵PID:2516
-
C:\windows\system\WCVG.exeC:\windows\system\WCVG.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3008 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FKXLY.exe.bat" "90⤵
- Executes a command shell one-liner
PID:3900 -
C:\windows\system\FKXLY.exeC:\windows\system\FKXLY.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5148 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IXCUJWH.exe.bat" "92⤵PID:3152
-
C:\windows\system\IXCUJWH.exeC:\windows\system\IXCUJWH.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BAGY.exe.bat" "94⤵PID:1300
-
C:\windows\system\BAGY.exeC:\windows\system\BAGY.exe95⤵
- Executes dropped EXE
PID:3124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VOK.exe.bat" "96⤵PID:4832
-
C:\windows\system\VOK.exeC:\windows\system\VOK.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QBPRB.exe.bat" "98⤵PID:5220
-
C:\windows\SysWOW64\QBPRB.exeC:\windows\system32\QBPRB.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KOUALL.exe.bat" "100⤵PID:5396
-
C:\windows\SysWOW64\KOUALL.exeC:\windows\system32\KOUALL.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3292 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FKZ.exe.bat" "102⤵
- Executes a command shell one-liner
PID:4588 -
C:\windows\FKZ.exeC:\windows\FKZ.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UFIO.exe.bat" "104⤵
- System Location Discovery: System Language Discovery
PID:3820 -
C:\windows\UFIO.exeC:\windows\UFIO.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AAHXLBO.exe.bat" "106⤵PID:5768
-
C:\windows\SysWOW64\AAHXLBO.exeC:\windows\system32\AAHXLBO.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3648 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VNMG.exe.bat" "108⤵
- Executes a command shell one-liner
PID:2572 -
C:\windows\SysWOW64\VNMG.exeC:\windows\system32\VNMG.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MBXYDX.exe.bat" "110⤵
- Executes a command shell one-liner
PID:1804 -
C:\windows\SysWOW64\MBXYDX.exeC:\windows\system32\MBXYDX.exe111⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5276 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FWB.exe.bat" "112⤵PID:2348
-
C:\windows\FWB.exeC:\windows\FWB.exe113⤵
- Executes dropped EXE
PID:4104 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DODKZBW.exe.bat" "114⤵
- Executes a command shell one-liner
PID:2860 -
C:\windows\system\DODKZBW.exeC:\windows\system\DODKZBW.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5588 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HWSKD.exe.bat" "116⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1096 -
C:\windows\SysWOW64\HWSKD.exeC:\windows\system32\HWSKD.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZXUXPR.exe.bat" "118⤵
- System Location Discovery: System Language Discovery
PID:2396 -
C:\windows\system\ZXUXPR.exeC:\windows\system\ZXUXPR.exe119⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MHCODC.exe.bat" "120⤵
- Executes a command shell one-liner
PID:4052 -
C:\windows\MHCODC.exeC:\windows\MHCODC.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4652
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-