Analysis
- max time kernel
80s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/07/2026, 20:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-27_8fadbe54fad4ae8ed5d9b4f1879276e4_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-07-27_8fadbe54fad4ae8ed5d9b4f1879276e4_elex_emotet_stop.exe
- Size 208KB
- Sample260727-yq4e3ada35
- SHA256 5fb235c9f2bf6f2b6fddc1c00cddb15842c8da17d46405f38e49165a84708337
- MD5 8fadbe54fad4ae8ed5d9b4f1879276e4
- SHA1 aa097dfb5c0e98161f13ed40816e8a6877aebcfe
- SHA512 8b593168812bdb98550f458e60c3f73b9152190db9b646fe243f4c476d5f8d76485825b6296f6357d769074aae4391b781ce85c39f43e2d51e4b9c6884bb4d5f
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlldL+LOfQ4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFll5+LO4kEj1
- TLSH T138247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5172 LGP.exe 5312 AERMCN.exe 3364 KUWGR.exe 1932 WFHMAAL.exe 3036 YDUGH.exe 3960 IBAA.exe 860 XRBAW.exe 5644 JJQLFO.exe 4380 ASXISW.exe 5712 VPFU.exe 6060 HIMF.exe 5016 FTX.exe 4632 NGC.exe 4936 QTTD.exe 2548 ZCVQT.exe 5760 YNYG.exe 4752 XXJ.exe 4392 FLNDVXB.exe 4856 JQFKLA.exe 3484 RGGJ.exe 2828 RBK.exe 4736 KEOJD.exe 4924 WUV.exe 52 PQHMUK.exe 5400 JDD.exe 5044 OIWLVFC.exe 5656 MEVMA.exe 1712 FWK.exe 4228 ARHO.exe 3156 EZWO.exe 1624 VIQTJ.exe 2584 ODBXOOO.exe 2500 STIXBG.exe 2916 DBPX.exe 3840 LRQWT.exe 256 MUTA.exe 4412 GHYKJC.exe 1732 VCIO.exe 248 QYNXEW.exe 4408 FOOXLKX.exe 3776 EYYNUY.exe 2052 ZMD.exe 708 OHNBPL.exe 1172 XPPGTQL.exe 2212 MKYSE.exe 1764 LVBA.exe 1180 GIGRWJ.exe 1576 AEKBHIT.exe 2304 EMRBL.exe 5596 KHQ.exe 4080 LCUF.exe 2456 JAN.exe 4344 XYN.exe 5720 VQQCB.exe 4912 JTHBP.exe 716 RHLHZ.exe 4952 VPSHMSR.exe 4372 MXUU.exe 4944 OVH.exe 4588 DLIGD.exe 4524 CAUJQ.exe 2340 LJWOCE.exe 6136 DJY.exe 5824 FWP.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\VPSHMSR.exe RHLHZ.exe File opened for modification C:\windows\SysWOW64\FVEMOE.exe CNPLCTG.exe File created C:\windows\SysWOW64\EEIREJ.exe.bat EZPDDW.exe File created C:\windows\SysWOW64\XRBAW.exe IBAA.exe File created C:\windows\SysWOW64\MKYSE.exe XPPGTQL.exe File created C:\windows\SysWOW64\QQN.exe HHTRQQQ.exe File opened for modification C:\windows\SysWOW64\JJQLFO.exe XRBAW.exe File opened for modification C:\windows\SysWOW64\FOOXLKX.exe QYNXEW.exe File opened for modification C:\windows\SysWOW64\VPSHMSR.exe RHLHZ.exe File created C:\windows\SysWOW64\UCDZCL.exe.bat THRW.exe File created C:\windows\SysWOW64\VPFU.exe.bat ASXISW.exe File created C:\windows\SysWOW64\DBPX.exe.bat STIXBG.exe File created C:\windows\SysWOW64\SKKD.exe.bat CHAYAL.exe File opened for modification C:\windows\SysWOW64\HIMF.exe VPFU.exe File opened for modification C:\windows\SysWOW64\SKKD.exe CHAYAL.exe File created C:\windows\SysWOW64\EZPDDW.exe.bat ROZEOT.exe File opened for modification C:\windows\SysWOW64\UCDZCL.exe THRW.exe File created C:\windows\SysWOW64\HPJB.exe.bat YPH.exe File created C:\windows\SysWOW64\JJQLFO.exe XRBAW.exe File created C:\windows\SysWOW64\HIMF.exe VPFU.exe File created C:\windows\SysWOW64\DBPX.exe STIXBG.exe File opened for modification C:\windows\SysWOW64\MKYSE.exe XPPGTQL.exe File created C:\windows\SysWOW64\MKYSE.exe.bat XPPGTQL.exe File opened for modification C:\windows\SysWOW64\LHMTNU.exe UYSOKPP.exe File created C:\windows\SysWOW64\LHMTNU.exe.bat UYSOKPP.exe File created C:\windows\SysWOW64\SKKD.exe CHAYAL.exe File opened for modification C:\windows\SysWOW64\XRBAW.exe IBAA.exe File opened for modification C:\windows\SysWOW64\JDD.exe PQHMUK.exe File opened for modification C:\windows\SysWOW64\KHQ.exe EMRBL.exe File created C:\windows\SysWOW64\XYN.exe JAN.exe File created C:\windows\SysWOW64\HIMF.exe.bat VPFU.exe File created C:\windows\SysWOW64\FOOXLKX.exe.bat QYNXEW.exe File created C:\windows\SysWOW64\IXYTL.exe.bat DSOEVQ.exe File created C:\windows\SysWOW64\EZPDDW.exe ROZEOT.exe File created C:\windows\SysWOW64\KBMBZV.exe WDMQXKU.exe File created C:\windows\SysWOW64\VPFU.exe ASXISW.exe File created C:\windows\SysWOW64\KHQ.exe EMRBL.exe File created C:\windows\SysWOW64\FVEMOE.exe CNPLCTG.exe File opened for modification C:\windows\SysWOW64\EEIREJ.exe EZPDDW.exe File created C:\windows\SysWOW64\ARHO.exe FWK.exe File created C:\windows\SysWOW64\ARHO.exe.bat FWK.exe File created C:\windows\SysWOW64\VIQTJ.exe EZWO.exe File created C:\windows\SysWOW64\VIQTJ.exe.bat EZWO.exe File created C:\windows\SysWOW64\JJQLFO.exe.bat XRBAW.exe File opened for modification C:\windows\SysWOW64\VIQTJ.exe EZWO.exe File created C:\windows\SysWOW64\FVEMOE.exe.bat CNPLCTG.exe File created C:\windows\SysWOW64\EEIREJ.exe EZPDDW.exe File created C:\windows\SysWOW64\YETUTSC.exe QRO.exe File created C:\windows\SysWOW64\FOOXLKX.exe QYNXEW.exe File created C:\windows\SysWOW64\JAN.exe LCUF.exe File opened for modification C:\windows\SysWOW64\XYN.exe JAN.exe File opened for modification C:\windows\SysWOW64\EZPDDW.exe ROZEOT.exe File created C:\windows\SysWOW64\UCDZCL.exe THRW.exe File created C:\windows\SysWOW64\KBMBZV.exe.bat WDMQXKU.exe File opened for modification C:\windows\SysWOW64\QQN.exe HHTRQQQ.exe File opened for modification C:\windows\SysWOW64\ARHO.exe FWK.exe File created C:\windows\SysWOW64\XYN.exe.bat JAN.exe File created C:\windows\SysWOW64\VPSHMSR.exe.bat RHLHZ.exe File opened for modification C:\windows\SysWOW64\IXYTL.exe DSOEVQ.exe File created C:\windows\SysWOW64\HPJB.exe YPH.exe File created C:\windows\SysWOW64\QQN.exe.bat HHTRQQQ.exe File created C:\windows\SysWOW64\JDD.exe.bat PQHMUK.exe File opened for modification C:\windows\SysWOW64\DBPX.exe STIXBG.exe File opened for modification C:\windows\SysWOW64\LJWOCE.exe CAUJQ.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\CNPLCTG.exe.bat SPKR.exe File opened for modification C:\windows\system\WDMQXKU.exe JSER.exe File created C:\windows\QTTD.exe NGC.exe File created C:\windows\system\MEVMA.exe OIWLVFC.exe File created C:\windows\system\ODBXOOO.exe.bat VIQTJ.exe File created C:\windows\AEKBHIT.exe GIGRWJ.exe File created C:\windows\VQQCB.exe XYN.exe File opened for modification C:\windows\system\DSOEVQ.exe FWP.exe File created C:\windows\system\ANARIEB.exe.bat QQN.exe File created C:\windows\NGC.exe FTX.exe File opened for modification C:\windows\DLIGD.exe OVH.exe File created C:\windows\CAUJQ.exe.bat DLIGD.exe File created C:\windows\system\JSER.exe UCDZCL.exe File created C:\windows\LGP.exe 2026-07-27_8fadbe54fad4ae8ed5d9b4f1879276e4_elex_emotet_stop.exe File opened for modification C:\windows\system\RGGJ.exe JQFKLA.exe File created C:\windows\EYYNUY.exe FOOXLKX.exe File created C:\windows\system\LVBA.exe.bat MKYSE.exe File opened for modification C:\windows\system\TBZXW.exe KBX.exe File created C:\windows\system\HHTRQQQ.exe JRA.exe File created C:\windows\system\AERMCN.exe LGP.exe File opened for modification C:\windows\system\WFHMAAL.exe KUWGR.exe File created C:\windows\system\YNYG.exe ZCVQT.exe File created C:\windows\system\JQFKLA.exe.bat FLNDVXB.exe File created C:\windows\system\RGGJ.exe JQFKLA.exe File created C:\windows\system\VCIO.exe GHYKJC.exe File opened for modification C:\windows\system\JRA.exe TBZXW.exe File opened for modification C:\windows\system\MEVMA.exe OIWLVFC.exe File created C:\windows\system\LRQWT.exe.bat DBPX.exe File created C:\windows\system\GIGRWJ.exe LVBA.exe File created C:\windows\system\AERMCN.exe.bat LGP.exe File created C:\windows\STIXBG.exe ODBXOOO.exe File opened for modification C:\windows\system\LVBA.exe MKYSE.exe File created C:\windows\system\GIGRWJ.exe.bat LVBA.exe File opened for modification C:\windows\system\EMRBL.exe AEKBHIT.exe File opened for modification C:\windows\PQHMUK.exe WUV.exe File created C:\windows\PQHMUK.exe.bat WUV.exe File created C:\windows\LCUF.exe KHQ.exe File opened for modification C:\windows\system\ZLNFAP.exe GTX.exe File created C:\windows\UYSOKPP.exe ZLNFAP.exe File opened for modification C:\windows\system\SPKR.exe SKKD.exe File created C:\windows\system\JSER.exe.bat UCDZCL.exe File opened for modification C:\windows\NGC.exe FTX.exe File created C:\windows\system\LRQWT.exe DBPX.exe File created C:\windows\system\ZMD.exe.bat EYYNUY.exe File opened for modification C:\windows\AEKBHIT.exe GIGRWJ.exe File created C:\windows\system\FWP.exe.bat DJY.exe File created C:\windows\XMDSNG.exe KBMBZV.exe File opened for modification C:\windows\XMDSNG.exe KBMBZV.exe File created C:\windows\system\ANARIEB.exe QQN.exe File created C:\windows\FLNDVXB.exe.bat XXJ.exe File created C:\windows\system\RBK.exe RGGJ.exe File created C:\windows\system\RBK.exe.bat RGGJ.exe File created C:\windows\FWK.exe.bat MEVMA.exe File opened for modification C:\windows\system\ODBXOOO.exe VIQTJ.exe File opened for modification C:\windows\LCUF.exe KHQ.exe File created C:\windows\DJY.exe LJWOCE.exe File opened for modification C:\windows\system\CHAYAL.exe LHMTNU.exe File created C:\windows\system\YNYG.exe.bat ZCVQT.exe File created C:\windows\FWK.exe MEVMA.exe File created C:\windows\system\GHYKJC.exe MUTA.exe File created C:\windows\QYNXEW.exe VCIO.exe File created C:\windows\GTX.exe IXYTL.exe File created C:\windows\system\CHAYAL.exe.bat LHMTNU.exe File opened for modification C:\windows\CNPLCTG.exe SPKR.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5144 cmd.exe 5624 cmd.exe 1540 cmd.exe 1276 cmd.exe 2980 cmd.exe 2072 cmd.exe 1272 cmd.exe 5952 cmd.exe 1412 cmd.exe 3124 cmd.exe 5900 cmd.exe 5452 cmd.exe 908 cmd.exe 5996 cmd.exe 5136 cmd.exe 6064 cmd.exe 4056 cmd.exe 2272 cmd.exe 3644 cmd.exe 5380 cmd.exe 3284 cmd.exe 3196 cmd.exe 3676 cmd.exe 5244 cmd.exe 4512 cmd.exe 2092 cmd.exe 1908 cmd.exe 4120 cmd.exe 2800 cmd.exe 5152 cmd.exe 236 cmd.exe 3772 cmd.exe 5572 cmd.exe 5112 cmd.exe 3220 cmd.exe 2428 cmd.exe 3472 cmd.exe 4612 cmd.exe 5472 cmd.exe 3404 cmd.exe 1312 cmd.exe 5908 cmd.exe 2012 cmd.exe 1168 cmd.exe 1252 cmd.exe 5796 cmd.exe 5912 cmd.exe 2488 cmd.exe 2608 cmd.exe 4816 cmd.exe 4956 cmd.exe 5360 cmd.exe 5940 cmd.exe 5832 cmd.exe 4396 cmd.exe 2840 cmd.exe 240 cmd.exe 5276 cmd.exe 5176 cmd.exe 3088 cmd.exe 4604 cmd.exe 2144 cmd.exe 5064 cmd.exe 5104 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 4572 5500 WerFault.exe 87 400 5172 WerFault.exe 93 988 5312 WerFault.exe 99 3880 3364 WerFault.exe 104 4060 1932 WerFault.exe 109 1028 3036 WerFault.exe 114 3804 3960 WerFault.exe 119 4952 860 WerFault.exe 124 3528 5644 WerFault.exe 129 3224 4380 WerFault.exe 134 5216 5712 WerFault.exe 139 1412 6060 WerFault.exe 144 2392 5016 WerFault.exe 149 3836 4632 WerFault.exe 154 2624 4936 WerFault.exe 159 5044 2548 WerFault.exe 164 2136 5760 WerFault.exe 169 3844 4752 WerFault.exe 174 4172 4392 WerFault.exe 179 2672 4856 WerFault.exe 184 5900 3484 WerFault.exe 189 2220 2828 WerFault.exe 194 4572 4736 WerFault.exe 199 2916 4924 WerFault.exe 204 4424 52 WerFault.exe 209 2992 5400 WerFault.exe 214 2628 5044 WerFault.exe 219 2416 5656 WerFault.exe 224 4548 1712 WerFault.exe 229 5108 4228 WerFault.exe 234 4976 3156 WerFault.exe 239 5488 1624 WerFault.exe 244 5984 2584 WerFault.exe 249 2716 2500 WerFault.exe 254 3880 2916 WerFault.exe 259 6084 3840 WerFault.exe 264 5072 256 WerFault.exe 270 5124 4412 WerFault.exe 275 1068 1732 WerFault.exe 280 3564 248 WerFault.exe 285 3656 4408 WerFault.exe 290 3712 3776 WerFault.exe 295 4980 2052 WerFault.exe 300 3548 708 WerFault.exe 305 3172 1172 WerFault.exe 310 2804 2212 WerFault.exe 315 4204 1764 WerFault.exe 320 5388 1180 WerFault.exe 325 3948 1576 WerFault.exe 330 4532 2304 WerFault.exe 335 6080 5596 WerFault.exe 340 4744 4080 WerFault.exe 345 3048 2456 WerFault.exe 350 4900 4344 WerFault.exe 355 2624 5720 WerFault.exe 360 4420 4912 WerFault.exe 365 5124 716 WerFault.exe 370 4172 4952 WerFault.exe 375 6124 4372 WerFault.exe 380 4404 4944 WerFault.exe 385 3496 4588 WerFault.exe 390 1592 4524 WerFault.exe 395 1588 2340 WerFault.exe 400 4424 6136 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ROZEOT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XRBAW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JJQLFO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JDD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EMRBL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IXYTL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VIQTJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DBPX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZMD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VQQCB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LRQWT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XPPGTQL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RGGJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MUTA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LCUF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XYN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DJY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FVEMOE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AERMCN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WFHMAAL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SKKD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EEIREJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KBMBZV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HPJB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language STIXBG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KHQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RNOV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TBZXW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FTX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RHLHZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANARIEB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SPKR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HHTRQQQ.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5500 2026-07-27_8fadbe54fad4ae8ed5d9b4f1879276e4_elex_emotet_stop.exe 5500 2026-07-27_8fadbe54fad4ae8ed5d9b4f1879276e4_elex_emotet_stop.exe 5172 LGP.exe 5172 LGP.exe 5312 AERMCN.exe 5312 AERMCN.exe 3364 KUWGR.exe 3364 KUWGR.exe 1932 WFHMAAL.exe 1932 WFHMAAL.exe 3036 YDUGH.exe 3036 YDUGH.exe 3960 IBAA.exe 3960 IBAA.exe 860 XRBAW.exe 860 XRBAW.exe 5644 JJQLFO.exe 5644 JJQLFO.exe 4380 ASXISW.exe 4380 ASXISW.exe 5712 VPFU.exe 5712 VPFU.exe 6060 HIMF.exe 6060 HIMF.exe 5016 FTX.exe 5016 FTX.exe 4632 NGC.exe 4632 NGC.exe 4936 QTTD.exe 4936 QTTD.exe 2548 ZCVQT.exe 2548 ZCVQT.exe 5760 YNYG.exe 5760 YNYG.exe 4752 XXJ.exe 4752 XXJ.exe 4392 FLNDVXB.exe 4392 FLNDVXB.exe 4856 JQFKLA.exe 4856 JQFKLA.exe 3484 RGGJ.exe 3484 RGGJ.exe 2828 RBK.exe 2828 RBK.exe 4736 KEOJD.exe 4736 KEOJD.exe 4924 WUV.exe 4924 WUV.exe 52 PQHMUK.exe 52 PQHMUK.exe 5400 JDD.exe 5400 JDD.exe 5044 OIWLVFC.exe 5044 OIWLVFC.exe 5656 MEVMA.exe 5656 MEVMA.exe 1712 FWK.exe 1712 FWK.exe 4228 ARHO.exe 4228 ARHO.exe 3156 EZWO.exe 3156 EZWO.exe 1624 VIQTJ.exe 1624 VIQTJ.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 5500 2026-07-27_8fadbe54fad4ae8ed5d9b4f1879276e4_elex_emotet_stop.exe 5500 2026-07-27_8fadbe54fad4ae8ed5d9b4f1879276e4_elex_emotet_stop.exe 5172 LGP.exe 5172 LGP.exe 5312 AERMCN.exe 5312 AERMCN.exe 3364 KUWGR.exe 3364 KUWGR.exe 1932 WFHMAAL.exe 1932 WFHMAAL.exe 3036 YDUGH.exe 3036 YDUGH.exe 3960 IBAA.exe 3960 IBAA.exe 860 XRBAW.exe 860 XRBAW.exe 5644 JJQLFO.exe 5644 JJQLFO.exe 4380 ASXISW.exe 4380 ASXISW.exe 5712 VPFU.exe 5712 VPFU.exe 6060 HIMF.exe 6060 HIMF.exe 5016 FTX.exe 5016 FTX.exe 4632 NGC.exe 4632 NGC.exe 4936 QTTD.exe 4936 QTTD.exe 2548 ZCVQT.exe 2548 ZCVQT.exe 5760 YNYG.exe 5760 YNYG.exe 4752 XXJ.exe 4752 XXJ.exe 4392 FLNDVXB.exe 4392 FLNDVXB.exe 4856 JQFKLA.exe 4856 JQFKLA.exe 3484 RGGJ.exe 3484 RGGJ.exe 2828 RBK.exe 2828 RBK.exe 4736 KEOJD.exe 4736 KEOJD.exe 4924 WUV.exe 4924 WUV.exe 52 PQHMUK.exe 52 PQHMUK.exe 5400 JDD.exe 5400 JDD.exe 5044 OIWLVFC.exe 5044 OIWLVFC.exe 5656 MEVMA.exe 5656 MEVMA.exe 1712 FWK.exe 1712 FWK.exe 4228 ARHO.exe 4228 ARHO.exe 3156 EZWO.exe 3156 EZWO.exe 1624 VIQTJ.exe 1624 VIQTJ.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5500 wrote to memory of 5676 5500 2026-07-27_8fadbe54fad4ae8ed5d9b4f1879276e4_elex_emotet_stop.exe 89 PID 5676 wrote to memory of 5172 5676 cmd.exe 93 PID 5172 wrote to memory of 1984 5172 LGP.exe 95 PID 1984 wrote to memory of 5312 1984 cmd.exe 99 PID 5312 wrote to memory of 1164 5312 AERMCN.exe 100 PID 1164 wrote to memory of 3364 1164 cmd.exe 104 PID 3364 wrote to memory of 3088 3364 KUWGR.exe 105 PID 3088 wrote to memory of 1932 3088 cmd.exe 109 PID 1932 wrote to memory of 1056 1932 WFHMAAL.exe 110 PID 1056 wrote to memory of 3036 1056 cmd.exe 114 PID 3036 wrote to memory of 3544 3036 YDUGH.exe 115 PID 3544 wrote to memory of 3960 3544 cmd.exe 119 PID 3960 wrote to memory of 4604 3960 IBAA.exe 120 PID 4604 wrote to memory of 860 4604 cmd.exe 124 PID 860 wrote to memory of 3040 860 XRBAW.exe 125 PID 3040 wrote to memory of 5644 3040 cmd.exe 129 PID 5644 wrote to memory of 5832 5644 JJQLFO.exe 130 PID 5832 wrote to memory of 4380 5832 cmd.exe 134 PID 4380 wrote to memory of 1380 4380 ASXISW.exe 135 PID 1380 wrote to memory of 5712 1380 cmd.exe 139 PID 5712 wrote to memory of 2076 5712 VPFU.exe 140 PID 2076 wrote to memory of 6060 2076 cmd.exe 144 PID 6060 wrote to memory of 3644 6060 HIMF.exe 145 PID 3644 wrote to memory of 5016 3644 cmd.exe 149 PID 5016 wrote to memory of 1344 5016 FTX.exe 150 PID 1344 wrote to memory of 4632 1344 cmd.exe 154 PID 4632 wrote to memory of 1312 4632 NGC.exe 155 PID 1312 wrote to memory of 4936 1312 cmd.exe 159 PID 4936 wrote to memory of 2912 4936 QTTD.exe 160 PID 2912 wrote to memory of 2548 2912 cmd.exe 164 PID 2548 wrote to memory of 5908 2548 ZCVQT.exe 165 PID 5908 wrote to memory of 5760 5908 cmd.exe 169 PID 5760 wrote to memory of 5452 5760 YNYG.exe 170 PID 5452 wrote to memory of 4752 5452 cmd.exe 174 PID 4752 wrote to memory of 1252 4752 XXJ.exe 175 PID 1252 wrote to memory of 4392 1252 cmd.exe 179 PID 4392 wrote to memory of 4076 4392 FLNDVXB.exe 180 PID 4076 wrote to memory of 4856 4076 cmd.exe 184 PID 4856 wrote to memory of 5144 4856 JQFKLA.exe 185 PID 5144 wrote to memory of 3484 5144 cmd.exe 189 PID 3484 wrote to memory of 1908 3484 RGGJ.exe 190 PID 1908 wrote to memory of 2828 1908 cmd.exe 194 PID 2828 wrote to memory of 5840 2828 RBK.exe 195 PID 5840 wrote to memory of 4736 5840 cmd.exe 199 PID 4736 wrote to memory of 5960 4736 KEOJD.exe 200 PID 5960 wrote to memory of 4924 5960 cmd.exe 204 PID 4924 wrote to memory of 4120 4924 WUV.exe 205 PID 4120 wrote to memory of 52 4120 cmd.exe 209 PID 52 wrote to memory of 3220 52 PQHMUK.exe 210 PID 3220 wrote to memory of 5400 3220 cmd.exe 214 PID 5400 wrote to memory of 2428 5400 JDD.exe 215 PID 2428 wrote to memory of 5044 2428 cmd.exe 219 PID 5044 wrote to memory of 2972 5044 OIWLVFC.exe 220 PID 2972 wrote to memory of 5656 2972 cmd.exe 224 PID 5656 wrote to memory of 2800 5656 MEVMA.exe 225 PID 2800 wrote to memory of 1712 2800 cmd.exe 229 PID 1712 wrote to memory of 5752 1712 FWK.exe 230 PID 5752 wrote to memory of 4228 5752 cmd.exe 234 PID 4228 wrote to memory of 4396 4228 ARHO.exe 235 PID 4396 wrote to memory of 3156 4396 cmd.exe 239 PID 3156 wrote to memory of 2012 3156 EZWO.exe 240 PID 2012 wrote to memory of 1624 2012 cmd.exe 244 PID 1624 wrote to memory of 5224 1624 VIQTJ.exe 245 PID 5224 wrote to memory of 2584 5224 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_8fadbe54fad4ae8ed5d9b4f1879276e4_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-27_8fadbe54fad4ae8ed5d9b4f1879276e4_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LGP.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:5676 -
C:\windows\LGP.exeC:\windows\LGP.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5172 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AERMCN.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\windows\system\AERMCN.exeC:\windows\system\AERMCN.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KUWGR.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\windows\system\KUWGR.exeC:\windows\system\KUWGR.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WFHMAAL.exe.bat" "8⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3088 -
C:\windows\system\WFHMAAL.exeC:\windows\system\WFHMAAL.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YDUGH.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\windows\system\YDUGH.exeC:\windows\system\YDUGH.exe11⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IBAA.exe.bat" "12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\windows\IBAA.exeC:\windows\IBAA.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XRBAW.exe.bat" "14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\windows\SysWOW64\XRBAW.exeC:\windows\system32\XRBAW.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JJQLFO.exe.bat" "16⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\windows\SysWOW64\JJQLFO.exeC:\windows\system32\JJQLFO.exe17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ASXISW.exe.bat" "18⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5832 -
C:\windows\ASXISW.exeC:\windows\ASXISW.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VPFU.exe.bat" "20⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\windows\SysWOW64\VPFU.exeC:\windows\system32\VPFU.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HIMF.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\windows\SysWOW64\HIMF.exeC:\windows\system32\HIMF.exe23⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FTX.exe.bat" "24⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3644 -
C:\windows\FTX.exeC:\windows\FTX.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NGC.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\windows\NGC.exeC:\windows\NGC.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QTTD.exe.bat" "28⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\windows\QTTD.exeC:\windows\QTTD.exe29⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZCVQT.exe.bat" "30⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\windows\system\ZCVQT.exeC:\windows\system\ZCVQT.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YNYG.exe.bat" "32⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5908 -
C:\windows\system\YNYG.exeC:\windows\system\YNYG.exe33⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XXJ.exe.bat" "34⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5452 -
C:\windows\system\XXJ.exeC:\windows\system\XXJ.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FLNDVXB.exe.bat" "36⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\windows\FLNDVXB.exeC:\windows\FLNDVXB.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JQFKLA.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\windows\system\JQFKLA.exeC:\windows\system\JQFKLA.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RGGJ.exe.bat" "40⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5144 -
C:\windows\system\RGGJ.exeC:\windows\system\RGGJ.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RBK.exe.bat" "42⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\windows\system\RBK.exeC:\windows\system\RBK.exe43⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KEOJD.exe.bat" "44⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5840 -
C:\windows\system\KEOJD.exeC:\windows\system\KEOJD.exe45⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WUV.exe.bat" "46⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5960 -
C:\windows\WUV.exeC:\windows\WUV.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PQHMUK.exe.bat" "48⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\windows\PQHMUK.exeC:\windows\PQHMUK.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:52 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JDD.exe.bat" "50⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\windows\SysWOW64\JDD.exeC:\windows\system32\JDD.exe51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OIWLVFC.exe.bat" "52⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\windows\OIWLVFC.exeC:\windows\OIWLVFC.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MEVMA.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\windows\system\MEVMA.exeC:\windows\system\MEVMA.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5656 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FWK.exe.bat" "56⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\windows\FWK.exeC:\windows\FWK.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ARHO.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:5752 -
C:\windows\SysWOW64\ARHO.exeC:\windows\system32\ARHO.exe59⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EZWO.exe.bat" "60⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\windows\system\EZWO.exeC:\windows\system\EZWO.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VIQTJ.exe.bat" "62⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\windows\SysWOW64\VIQTJ.exeC:\windows\system32\VIQTJ.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ODBXOOO.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:5224 -
C:\windows\system\ODBXOOO.exeC:\windows\system\ODBXOOO.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\STIXBG.exe.bat" "66⤵
- System Location Discovery: System Language Discovery
PID:6048 -
C:\windows\STIXBG.exeC:\windows\STIXBG.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DBPX.exe.bat" "68⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5796 -
C:\windows\SysWOW64\DBPX.exeC:\windows\system32\DBPX.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LRQWT.exe.bat" "70⤵
- Executes a command shell one-liner
PID:5624 -
C:\windows\system\LRQWT.exeC:\windows\system\LRQWT.exe71⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MUTA.exe.bat" "72⤵PID:4256
-
C:\windows\MUTA.exeC:\windows\MUTA.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GHYKJC.exe.bat" "74⤵
- Executes a command shell one-liner
PID:3472 -
C:\windows\system\GHYKJC.exeC:\windows\system\GHYKJC.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VCIO.exe.bat" "76⤵
- Executes a command shell one-liner
PID:5380 -
C:\windows\system\VCIO.exeC:\windows\system\VCIO.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QYNXEW.exe.bat" "78⤵
- Executes a command shell one-liner
PID:1540 -
C:\windows\QYNXEW.exeC:\windows\QYNXEW.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FOOXLKX.exe.bat" "80⤵
- System Location Discovery: System Language Discovery
PID:4428 -
C:\windows\SysWOW64\FOOXLKX.exeC:\windows\system32\FOOXLKX.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EYYNUY.exe.bat" "82⤵PID:2740
-
C:\windows\EYYNUY.exeC:\windows\EYYNUY.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZMD.exe.bat" "84⤵PID:5248
-
C:\windows\system\ZMD.exeC:\windows\system\ZMD.exe85⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OHNBPL.exe.bat" "86⤵PID:5668
-
C:\windows\OHNBPL.exeC:\windows\OHNBPL.exe87⤵
- Executes dropped EXE
PID:708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XPPGTQL.exe.bat" "88⤵PID:3716
-
C:\windows\system\XPPGTQL.exeC:\windows\system\XPPGTQL.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1172 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MKYSE.exe.bat" "90⤵PID:4812
-
C:\windows\SysWOW64\MKYSE.exeC:\windows\system32\MKYSE.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2212 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LVBA.exe.bat" "92⤵
- Executes a command shell one-liner
PID:2840 -
C:\windows\system\LVBA.exeC:\windows\system\LVBA.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GIGRWJ.exe.bat" "94⤵
- System Location Discovery: System Language Discovery
PID:4476 -
C:\windows\system\GIGRWJ.exeC:\windows\system\GIGRWJ.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1180 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AEKBHIT.exe.bat" "96⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2144 -
C:\windows\AEKBHIT.exeC:\windows\AEKBHIT.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EMRBL.exe.bat" "98⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1276 -
C:\windows\system\EMRBL.exeC:\windows\system\EMRBL.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KHQ.exe.bat" "100⤵
- Executes a command shell one-liner
PID:5152 -
C:\windows\SysWOW64\KHQ.exeC:\windows\system32\KHQ.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LCUF.exe.bat" "102⤵
- Executes a command shell one-liner
PID:5064 -
C:\windows\LCUF.exeC:\windows\LCUF.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JAN.exe.bat" "104⤵
- System Location Discovery: System Language Discovery
PID:2356 -
C:\windows\SysWOW64\JAN.exeC:\windows\system32\JAN.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XYN.exe.bat" "106⤵PID:4980
-
C:\windows\SysWOW64\XYN.exeC:\windows\system32\XYN.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VQQCB.exe.bat" "108⤵PID:5920
-
C:\windows\VQQCB.exeC:\windows\VQQCB.exe109⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JTHBP.exe.bat" "110⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3284 -
C:\windows\JTHBP.exeC:\windows\JTHBP.exe111⤵
- Executes dropped EXE
PID:4912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RHLHZ.exe.bat" "112⤵
- Executes a command shell one-liner
PID:2980 -
C:\windows\system\RHLHZ.exeC:\windows\system\RHLHZ.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VPSHMSR.exe.bat" "114⤵
- System Location Discovery: System Language Discovery
PID:3504 -
C:\windows\SysWOW64\VPSHMSR.exeC:\windows\system32\VPSHMSR.exe115⤵
- Executes dropped EXE
PID:4952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MXUU.exe.bat" "116⤵
- Executes a command shell one-liner
PID:4612 -
C:\windows\system\MXUU.exeC:\windows\system\MXUU.exe117⤵
- Executes dropped EXE
PID:4372 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OVH.exe.bat" "118⤵
- Executes a command shell one-liner
PID:2072 -
C:\windows\system\OVH.exeC:\windows\system\OVH.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DLIGD.exe.bat" "120⤵
- Executes a command shell one-liner
PID:1272 -
C:\windows\DLIGD.exeC:\windows\DLIGD.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4588
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-