Analysis
- max time kernel
87s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
28/07/2026, 23:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-28_4e44b8d03b695bfdc7176a63f0ac0b6a_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-07-28_4e44b8d03b695bfdc7176a63f0ac0b6a_elex_emotet_stop.exe
- Size 208KB
- Sample260728-21bdtacd49
- SHA256 71e2d6715ea96fc21ebf50c63dbbc8bb7cf9f0af2a79140ab686944b1f06e1c5
- MD5 4e44b8d03b695bfdc7176a63f0ac0b6a
- SHA1 f618415a30ececb493fb0a7f294ec644b2f7896d
- SHA512 86fc7bfb05f1bb59166f48708b10a26a2139a558f34b0e3b2da634727d2315df41e1435fb197ceece3bdcb4372701b0da0b6a98e02891ba5181914675490f6a8
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbclcdL+LOff4NLthEjQT6j:MlZtbLWIgd1LZ9oECZbclc5+LO3QEj1
- TLSH T16B247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5872 OYYNGKJ.exe 3052 JWZGVDL.exe 1800 PRLZBRB.exe 5988 JMQI.exe 5900 KHTMQH.exe 3756 SVYTB.exe 4264 YVG.exe 6092 ATTBZQX.exe 2168 YEWJAW.exe 5640 IBCD.exe 4980 KZP.exe 1948 APQXEJ.exe 3004 KNWJ.exe 3840 OVDRXJ.exe 5416 ZNSCHC.exe 4700 UTSOR.exe 2852 IWIEF.exe 4756 EXKP.exe 1876 INRPVN.exe 4832 QSDVFL.exe 1200 CIK.exe 1584 KYLVQZN.exe 3872 ZTUHJ.exe 5272 YEFP.exe 400 BMMXWK.exe 5112 GXKK.exe 1264 ODP.exe 5984 SIHOXFY.exe 4736 IYIGE.exe 3380 ABMJJJW.exe 2688 PWDOC.exe 5848 HXX.exe 4764 DQQ.exe 3356 YDUGH.exe 1956 EDCURLN.exe 6024 PWX.exe 5524 KJCWJ.exe 2496 KMGAPIA.exe 3020 WFJ.exe 2428 HXMD.exe 3048 NYTROZ.exe 4304 TYBNXBA.exe 5296 HDZ.exe 252 IYDFK.exe 3696 IED.exe 2908 XHMY.exe 5404 SURIOA.exe 3516 MIWRRAS.exe 1180 DQYWCY.exe 2420 FOD.exe 4316 ABIAU.exe 2512 MJPI.exe 4432 VRRNJW.exe 4464 FPF.exe 4672 YKIDECS.exe 5480 CAPL.exe 4624 TBRQUS.exe 1860 ZBZ.exe 5476 IJBJ.exe 4224 DXFSRR.exe 4376 HNM.exe 5332 TVT.exe 1916 CDVF.exe 1664 MBAAAID.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\GXKK.exe.bat BMMXWK.exe File created C:\windows\SysWOW64\ABMJJJW.exe.bat IYIGE.exe File opened for modification C:\windows\SysWOW64\HXMD.exe WFJ.exe File opened for modification C:\windows\SysWOW64\NVOV.exe SAJMQTN.exe File opened for modification C:\windows\SysWOW64\NIA.exe EVQBE.exe File created C:\windows\SysWOW64\NVWVFIZ.exe.bat FISOVJE.exe File created C:\windows\SysWOW64\APQXEJ.exe KZP.exe File created C:\windows\SysWOW64\BMMXWK.exe YEFP.exe File created C:\windows\SysWOW64\ABMJJJW.exe IYIGE.exe File created C:\windows\SysWOW64\BALOI.exe.bat CHAYAL.exe File opened for modification C:\windows\SysWOW64\NVWVFIZ.exe FISOVJE.exe File opened for modification C:\windows\SysWOW64\APQXEJ.exe KZP.exe File created C:\windows\SysWOW64\KJCWJ.exe PWX.exe File opened for modification C:\windows\SysWOW64\AAZ.exe LFQBE.exe File created C:\windows\SysWOW64\WFJ.exe.bat KMGAPIA.exe File created C:\windows\SysWOW64\MBAAAID.exe CDVF.exe File created C:\windows\SysWOW64\JMVCTUV.exe RDTXQ.exe File created C:\windows\SysWOW64\JMVCTUV.exe.bat RDTXQ.exe File created C:\windows\SysWOW64\HXMD.exe.bat WFJ.exe File opened for modification C:\windows\SysWOW64\NYTROZ.exe HXMD.exe File created C:\windows\SysWOW64\NVOV.exe.bat SAJMQTN.exe File created C:\windows\SysWOW64\JMQI.exe.bat PRLZBRB.exe File created C:\windows\SysWOW64\ZTUHJ.exe.bat KYLVQZN.exe File created C:\windows\SysWOW64\AAZ.exe LFQBE.exe File opened for modification C:\windows\SysWOW64\VRDSI.exe UOZ.exe File opened for modification C:\windows\SysWOW64\FISOVJE.exe BALOI.exe File opened for modification C:\windows\SysWOW64\PRLZBRB.exe JWZGVDL.exe File opened for modification C:\windows\SysWOW64\JMQI.exe PRLZBRB.exe File created C:\windows\SysWOW64\SVYTB.exe.bat KHTMQH.exe File created C:\windows\SysWOW64\APQXEJ.exe.bat KZP.exe File opened for modification C:\windows\SysWOW64\ZTUHJ.exe KYLVQZN.exe File created C:\windows\SysWOW64\KJCWJ.exe.bat PWX.exe File opened for modification C:\windows\SysWOW64\TBRQUS.exe CAPL.exe File created C:\windows\SysWOW64\BALOI.exe CHAYAL.exe File created C:\windows\SysWOW64\PRLZBRB.exe.bat JWZGVDL.exe File created C:\windows\SysWOW64\NYTROZ.exe.bat HXMD.exe File opened for modification C:\windows\SysWOW64\MBAAAID.exe CDVF.exe File created C:\windows\SysWOW64\MBAAAID.exe.bat CDVF.exe File opened for modification C:\windows\SysWOW64\INGTWD.exe ORJC.exe File created C:\windows\SysWOW64\NIA.exe EVQBE.exe File created C:\windows\SysWOW64\FISOVJE.exe.bat BALOI.exe File created C:\windows\SysWOW64\TBRQUS.exe.bat CAPL.exe File opened for modification C:\windows\SysWOW64\ATTBZQX.exe YVG.exe File created C:\windows\SysWOW64\IBCD.exe YEWJAW.exe File created C:\windows\SysWOW64\IBCD.exe.bat YEWJAW.exe File opened for modification C:\windows\SysWOW64\GXKK.exe BMMXWK.exe File created C:\windows\SysWOW64\VRDSI.exe.bat UOZ.exe File opened for modification C:\windows\SysWOW64\EVQBE.exe NVOV.exe File created C:\windows\SysWOW64\JWZGVDL.exe.bat OYYNGKJ.exe File created C:\windows\SysWOW64\YVG.exe SVYTB.exe File opened for modification C:\windows\SysWOW64\WFJ.exe KMGAPIA.exe File opened for modification C:\windows\SysWOW64\JHZIA.exe TXPSRT.exe File created C:\windows\SysWOW64\JHZIA.exe.bat TXPSRT.exe File created C:\windows\SysWOW64\QSDVFL.exe.bat INRPVN.exe File created C:\windows\SysWOW64\BMMXWK.exe.bat YEFP.exe File created C:\windows\SysWOW64\NYTROZ.exe HXMD.exe File created C:\windows\SysWOW64\QDPLDZI.exe INGTWD.exe File created C:\windows\SysWOW64\NIA.exe.bat EVQBE.exe File created C:\windows\SysWOW64\SVYTB.exe KHTMQH.exe File opened for modification C:\windows\SysWOW64\KJCWJ.exe PWX.exe File created C:\windows\SysWOW64\HXMD.exe WFJ.exe File created C:\windows\SysWOW64\AAZ.exe.bat LFQBE.exe File opened for modification C:\windows\SysWOW64\QDPLDZI.exe INGTWD.exe File opened for modification C:\windows\SysWOW64\BALOI.exe CHAYAL.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\system\TLFRQ.exe VPG.exe File created C:\windows\system\OYYNGKJ.exe 2026-07-28_4e44b8d03b695bfdc7176a63f0ac0b6a_elex_emotet_stop.exe File created C:\windows\KMGAPIA.exe.bat KJCWJ.exe File created C:\windows\IYDFK.exe HDZ.exe File created C:\windows\CAPL.exe.bat YKIDECS.exe File opened for modification C:\windows\system\PHYUL.exe LZR.exe File created C:\windows\system\VPG.exe JHZIA.exe File opened for modification C:\windows\IYIGE.exe SIHOXFY.exe File created C:\windows\system\IJBJ.exe.bat ZBZ.exe File opened for modification C:\windows\KIBTA.exe AAZ.exe File opened for modification C:\windows\system\ILNCPF.exe ZDLXLAW.exe File created C:\windows\GQAZ.exe NVWVFIZ.exe File created C:\windows\system\QOHOOFU.exe KTIO.exe File opened for modification C:\windows\BABIHN.exe DPQSYZR.exe File opened for modification C:\windows\SURIOA.exe XHMY.exe File created C:\windows\system\FOD.exe.bat DQYWCY.exe File created C:\windows\MJPI.exe.bat ABIAU.exe File created C:\windows\system\UOZ.exe.bat BLVTP.exe File opened for modification C:\windows\system\QVKUSAO.exe BABIHN.exe File created C:\windows\TXPSRT.exe.bat QBKJ.exe File opened for modification C:\windows\system\OVDRXJ.exe KNWJ.exe File opened for modification C:\windows\EDCURLN.exe YDUGH.exe File opened for modification C:\windows\MJPI.exe ABIAU.exe File created C:\windows\system\BLVTP.exe.bat QDPLDZI.exe File created C:\windows\system\MIWRRAS.exe.bat SURIOA.exe File created C:\windows\system\HNM.exe.bat DXFSRR.exe File created C:\windows\EDCURLN.exe.bat YDUGH.exe File opened for modification C:\windows\TYBNXBA.exe NYTROZ.exe File opened for modification C:\windows\IYDFK.exe HDZ.exe File created C:\windows\system\YKIDECS.exe FPF.exe File created C:\windows\MWVDOA.exe PVO.exe File opened for modification C:\windows\system\MIWRRAS.exe SURIOA.exe File opened for modification C:\windows\DXFSRR.exe IJBJ.exe File created C:\windows\FJQBZ.exe.bat QOHOOFU.exe File created C:\windows\IYIGE.exe SIHOXFY.exe File opened for modification C:\windows\system\YDUGH.exe DQQ.exe File created C:\windows\system\TVT.exe HNM.exe File created C:\windows\system\CHAYAL.exe.bat CMWVUNK.exe File created C:\windows\system\OYYNGKJ.exe.bat 2026-07-28_4e44b8d03b695bfdc7176a63f0ac0b6a_elex_emotet_stop.exe File created C:\windows\system\XHMY.exe.bat IED.exe File opened for modification C:\windows\system\QBKJ.exe XGGNBWB.exe File created C:\windows\system\VPG.exe.bat JHZIA.exe File opened for modification C:\windows\EXKP.exe IWIEF.exe File created C:\windows\system\DQQ.exe.bat ZAJXL.exe File created C:\windows\system\DQYWCY.exe MIWRRAS.exe File created C:\windows\TXPSRT.exe QBKJ.exe File created C:\windows\system\UEUTEZ.exe.bat QOO.exe File created C:\windows\system\ABIAU.exe FOD.exe File created C:\windows\system\ORJC.exe PHYUL.exe File created C:\windows\IYIGE.exe.bat SIHOXFY.exe File created C:\windows\system\IWIEF.exe.bat UTSOR.exe File created C:\windows\VRRNJW.exe MJPI.exe File created C:\windows\system\LFQBE.exe FJQBZ.exe File opened for modification C:\windows\KNWJ.exe APQXEJ.exe File created C:\windows\SURIOA.exe.bat XHMY.exe File created C:\windows\system\KTIO.exe MBAAAID.exe File opened for modification C:\windows\system\ZZJSM.exe VRDSI.exe File created C:\windows\VYJHA.exe.bat QVKUSAO.exe File created C:\windows\YEFP.exe.bat ZTUHJ.exe File created C:\windows\PVO.exe.bat TLFRQ.exe File created C:\windows\system\KZP.exe.bat IBCD.exe File opened for modification C:\windows\system\ABIAU.exe FOD.exe File opened for modification C:\windows\system\ZDLXLAW.exe KIBTA.exe File created C:\windows\system\QBKJ.exe.bat XGGNBWB.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2360 cmd.exe 4552 cmd.exe 5808 cmd.exe 2592 cmd.exe 3468 cmd.exe 4404 cmd.exe 820 cmd.exe 1396 cmd.exe 3472 cmd.exe 1152 cmd.exe 956 cmd.exe 2324 cmd.exe 2336 cmd.exe 1040 cmd.exe 5108 cmd.exe 4636 cmd.exe 5280 cmd.exe 3580 cmd.exe 5256 cmd.exe 3152 cmd.exe 4852 cmd.exe 4684 cmd.exe 5556 cmd.exe 3564 cmd.exe 5068 cmd.exe 5544 cmd.exe 2348 cmd.exe 4580 cmd.exe 2720 cmd.exe 3644 cmd.exe 5052 cmd.exe 3684 cmd.exe 244 cmd.exe 1764 cmd.exe 1224 cmd.exe 1216 cmd.exe 3276 cmd.exe 2516 cmd.exe 4516 cmd.exe 2844 cmd.exe 5064 cmd.exe 5972 cmd.exe 2740 cmd.exe 2032 cmd.exe 4740 cmd.exe 2440 cmd.exe 5976 cmd.exe 1272 cmd.exe 6084 cmd.exe 5128 cmd.exe 2728 cmd.exe 2312 cmd.exe 2564 cmd.exe 5776 cmd.exe 4596 cmd.exe 2700 cmd.exe 6032 cmd.exe 4228 cmd.exe 4436 cmd.exe 4484 cmd.exe 476 cmd.exe 4492 cmd.exe 3748 cmd.exe 5220 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 468 5584 WerFault.exe 87 6020 5872 WerFault.exe 93 3100 3052 WerFault.exe 99 3644 1800 WerFault.exe 104 5604 5988 WerFault.exe 109 5388 5900 WerFault.exe 114 1768 3756 WerFault.exe 119 1812 4264 WerFault.exe 124 5188 6092 WerFault.exe 129 4724 2168 WerFault.exe 134 4796 5640 WerFault.exe 139 4876 4980 WerFault.exe 144 700 1948 WerFault.exe 149 5076 3004 WerFault.exe 154 2768 3840 WerFault.exe 159 2908 5416 WerFault.exe 164 3900 4700 WerFault.exe 169 3768 2852 WerFault.exe 174 3380 4756 WerFault.exe 179 3048 1876 WerFault.exe 184 4500 4832 WerFault.exe 189 4192 1200 WerFault.exe 194 5580 1584 WerFault.exe 199 700 3872 WerFault.exe 204 4708 5272 WerFault.exe 209 2768 400 WerFault.exe 214 4732 5112 WerFault.exe 219 3268 1264 WerFault.exe 224 1456 5984 WerFault.exe 229 1812 4736 WerFault.exe 234 744 3380 WerFault.exe 239 664 2688 WerFault.exe 244 4316 5848 WerFault.exe 249 5616 1620 WerFault.exe 254 4352 4764 WerFault.exe 259 4468 3356 WerFault.exe 264 3644 1956 WerFault.exe 270 4240 6024 WerFault.exe 275 3784 5524 WerFault.exe 280 1712 2496 WerFault.exe 285 3384 3020 WerFault.exe 290 664 2428 WerFault.exe 295 1256 3048 WerFault.exe 300 292 4304 WerFault.exe 305 788 5296 WerFault.exe 310 6028 252 WerFault.exe 315 3908 3696 WerFault.exe 320 3008 2908 WerFault.exe 325 5632 5404 WerFault.exe 330 588 3516 WerFault.exe 335 6108 1180 WerFault.exe 340 5824 2420 WerFault.exe 345 1772 4316 WerFault.exe 350 4152 2512 WerFault.exe 355 1296 4432 WerFault.exe 360 1664 4464 WerFault.exe 365 804 4672 WerFault.exe 370 1716 5480 WerFault.exe 375 5896 4624 WerFault.exe 380 5372 1860 WerFault.exe 385 1700 5476 WerFault.exe 390 5576 4224 WerFault.exe 395 4128 4376 WerFault.exe 400 1708 5332 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language APQXEJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MIWRRAS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FPF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TVT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PVO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YEFP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HXX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FISOVJE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FOD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QVKUSAO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QOHOOFU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TXPSRT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KNWJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UTSOR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ABMJJJW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IYDFK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CDVF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IWIEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TBRQUS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IJBJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KIBTA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UOZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OVDRXJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DQQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QOO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WFJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BALOI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KHTMQH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IBCD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DXFSRR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LFQBE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VPG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5584 2026-07-28_4e44b8d03b695bfdc7176a63f0ac0b6a_elex_emotet_stop.exe 5584 2026-07-28_4e44b8d03b695bfdc7176a63f0ac0b6a_elex_emotet_stop.exe 5872 OYYNGKJ.exe 5872 OYYNGKJ.exe 3052 JWZGVDL.exe 3052 JWZGVDL.exe 1800 PRLZBRB.exe 1800 PRLZBRB.exe 5988 JMQI.exe 5988 JMQI.exe 5900 KHTMQH.exe 5900 KHTMQH.exe 3756 SVYTB.exe 3756 SVYTB.exe 4264 YVG.exe 4264 YVG.exe 6092 ATTBZQX.exe 6092 ATTBZQX.exe 2168 YEWJAW.exe 2168 YEWJAW.exe 5640 IBCD.exe 5640 IBCD.exe 4980 KZP.exe 4980 KZP.exe 1948 APQXEJ.exe 1948 APQXEJ.exe 3004 KNWJ.exe 3004 KNWJ.exe 3840 OVDRXJ.exe 3840 OVDRXJ.exe 5416 ZNSCHC.exe 5416 ZNSCHC.exe 4700 UTSOR.exe 4700 UTSOR.exe 2852 IWIEF.exe 2852 IWIEF.exe 4756 EXKP.exe 4756 EXKP.exe 1876 INRPVN.exe 1876 INRPVN.exe 4832 QSDVFL.exe 4832 QSDVFL.exe 1200 CIK.exe 1200 CIK.exe 1584 KYLVQZN.exe 1584 KYLVQZN.exe 3872 ZTUHJ.exe 3872 ZTUHJ.exe 5272 YEFP.exe 5272 YEFP.exe 400 BMMXWK.exe 400 BMMXWK.exe 5112 GXKK.exe 5112 GXKK.exe 1264 ODP.exe 1264 ODP.exe 5984 SIHOXFY.exe 5984 SIHOXFY.exe 4736 IYIGE.exe 4736 IYIGE.exe 3380 ABMJJJW.exe 3380 ABMJJJW.exe 2688 PWDOC.exe 2688 PWDOC.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 5584 2026-07-28_4e44b8d03b695bfdc7176a63f0ac0b6a_elex_emotet_stop.exe 5584 2026-07-28_4e44b8d03b695bfdc7176a63f0ac0b6a_elex_emotet_stop.exe 5872 OYYNGKJ.exe 5872 OYYNGKJ.exe 3052 JWZGVDL.exe 3052 JWZGVDL.exe 1800 PRLZBRB.exe 1800 PRLZBRB.exe 5988 JMQI.exe 5988 JMQI.exe 5900 KHTMQH.exe 5900 KHTMQH.exe 3756 SVYTB.exe 3756 SVYTB.exe 4264 YVG.exe 4264 YVG.exe 6092 ATTBZQX.exe 6092 ATTBZQX.exe 2168 YEWJAW.exe 2168 YEWJAW.exe 5640 IBCD.exe 5640 IBCD.exe 4980 KZP.exe 4980 KZP.exe 1948 APQXEJ.exe 1948 APQXEJ.exe 3004 KNWJ.exe 3004 KNWJ.exe 3840 OVDRXJ.exe 3840 OVDRXJ.exe 5416 ZNSCHC.exe 5416 ZNSCHC.exe 4700 UTSOR.exe 4700 UTSOR.exe 2852 IWIEF.exe 2852 IWIEF.exe 4756 EXKP.exe 4756 EXKP.exe 1876 INRPVN.exe 1876 INRPVN.exe 4832 QSDVFL.exe 4832 QSDVFL.exe 1200 CIK.exe 1200 CIK.exe 1584 KYLVQZN.exe 1584 KYLVQZN.exe 3872 ZTUHJ.exe 3872 ZTUHJ.exe 5272 YEFP.exe 5272 YEFP.exe 400 BMMXWK.exe 400 BMMXWK.exe 5112 GXKK.exe 5112 GXKK.exe 1264 ODP.exe 1264 ODP.exe 5984 SIHOXFY.exe 5984 SIHOXFY.exe 4736 IYIGE.exe 4736 IYIGE.exe 3380 ABMJJJW.exe 3380 ABMJJJW.exe 2688 PWDOC.exe 2688 PWDOC.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5584 wrote to memory of 2892 5584 2026-07-28_4e44b8d03b695bfdc7176a63f0ac0b6a_elex_emotet_stop.exe 89 PID 2892 wrote to memory of 5872 2892 cmd.exe 93 PID 5872 wrote to memory of 4632 5872 OYYNGKJ.exe 95 PID 4632 wrote to memory of 3052 4632 cmd.exe 99 PID 3052 wrote to memory of 240 3052 JWZGVDL.exe 100 PID 240 wrote to memory of 1800 240 cmd.exe 104 PID 1800 wrote to memory of 476 1800 PRLZBRB.exe 105 PID 476 wrote to memory of 5988 476 cmd.exe 109 PID 5988 wrote to memory of 3292 5988 JMQI.exe 110 PID 3292 wrote to memory of 5900 3292 cmd.exe 114 PID 5900 wrote to memory of 2316 5900 KHTMQH.exe 115 PID 2316 wrote to memory of 3756 2316 cmd.exe 119 PID 3756 wrote to memory of 3468 3756 SVYTB.exe 120 PID 3468 wrote to memory of 4264 3468 cmd.exe 124 PID 4264 wrote to memory of 5436 4264 YVG.exe 125 PID 5436 wrote to memory of 6092 5436 cmd.exe 129 PID 6092 wrote to memory of 5288 6092 ATTBZQX.exe 130 PID 5288 wrote to memory of 2168 5288 cmd.exe 134 PID 2168 wrote to memory of 5280 2168 YEWJAW.exe 135 PID 5280 wrote to memory of 5640 5280 cmd.exe 139 PID 5640 wrote to memory of 1936 5640 IBCD.exe 140 PID 1936 wrote to memory of 4980 1936 cmd.exe 144 PID 4980 wrote to memory of 4404 4980 KZP.exe 145 PID 4404 wrote to memory of 1948 4404 cmd.exe 149 PID 1948 wrote to memory of 5736 1948 APQXEJ.exe 150 PID 5736 wrote to memory of 3004 5736 cmd.exe 154 PID 3004 wrote to memory of 820 3004 KNWJ.exe 155 PID 820 wrote to memory of 3840 820 cmd.exe 159 PID 3840 wrote to memory of 5664 3840 OVDRXJ.exe 160 PID 5664 wrote to memory of 5416 5664 cmd.exe 164 PID 5416 wrote to memory of 3648 5416 ZNSCHC.exe 165 PID 3648 wrote to memory of 4700 3648 cmd.exe 169 PID 4700 wrote to memory of 3276 4700 UTSOR.exe 170 PID 3276 wrote to memory of 2852 3276 cmd.exe 174 PID 2852 wrote to memory of 4092 2852 IWIEF.exe 175 PID 4092 wrote to memory of 4756 4092 cmd.exe 179 PID 4756 wrote to memory of 4860 4756 EXKP.exe 180 PID 4860 wrote to memory of 1876 4860 cmd.exe 184 PID 1876 wrote to memory of 4060 1876 INRPVN.exe 185 PID 4060 wrote to memory of 4832 4060 cmd.exe 189 PID 4832 wrote to memory of 4368 4832 QSDVFL.exe 190 PID 4368 wrote to memory of 1200 4368 cmd.exe 194 PID 1200 wrote to memory of 4156 1200 CIK.exe 195 PID 4156 wrote to memory of 1584 4156 cmd.exe 199 PID 1584 wrote to memory of 4344 1584 KYLVQZN.exe 200 PID 4344 wrote to memory of 3872 4344 cmd.exe 204 PID 3872 wrote to memory of 2312 3872 ZTUHJ.exe 205 PID 2312 wrote to memory of 5272 2312 cmd.exe 209 PID 5272 wrote to memory of 5992 5272 YEFP.exe 210 PID 5992 wrote to memory of 400 5992 cmd.exe 214 PID 400 wrote to memory of 4596 400 BMMXWK.exe 215 PID 4596 wrote to memory of 5112 4596 cmd.exe 219 PID 5112 wrote to memory of 1888 5112 GXKK.exe 220 PID 1888 wrote to memory of 1264 1888 cmd.exe 224 PID 1264 wrote to memory of 2948 1264 ODP.exe 225 PID 2948 wrote to memory of 5984 2948 cmd.exe 229 PID 5984 wrote to memory of 3264 5984 SIHOXFY.exe 230 PID 3264 wrote to memory of 4736 3264 cmd.exe 234 PID 4736 wrote to memory of 1340 4736 IYIGE.exe 235 PID 1340 wrote to memory of 3380 1340 cmd.exe 239 PID 3380 wrote to memory of 612 3380 ABMJJJW.exe 240 PID 612 wrote to memory of 2688 612 cmd.exe 244 PID 2688 wrote to memory of 704 2688 PWDOC.exe 245 PID 704 wrote to memory of 5848 704 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-28_4e44b8d03b695bfdc7176a63f0ac0b6a_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-28_4e44b8d03b695bfdc7176a63f0ac0b6a_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OYYNGKJ.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\windows\system\OYYNGKJ.exeC:\windows\system\OYYNGKJ.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JWZGVDL.exe.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\windows\SysWOW64\JWZGVDL.exeC:\windows\system32\JWZGVDL.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PRLZBRB.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:240 -
C:\windows\SysWOW64\PRLZBRB.exeC:\windows\system32\PRLZBRB.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JMQI.exe.bat" "8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:476 -
C:\windows\SysWOW64\JMQI.exeC:\windows\system32\JMQI.exe9⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KHTMQH.exe.bat" "10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\windows\KHTMQH.exeC:\windows\KHTMQH.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SVYTB.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\windows\SysWOW64\SVYTB.exeC:\windows\system32\SVYTB.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YVG.exe.bat" "14⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\windows\SysWOW64\YVG.exeC:\windows\system32\YVG.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ATTBZQX.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:5436 -
C:\windows\SysWOW64\ATTBZQX.exeC:\windows\system32\ATTBZQX.exe17⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YEWJAW.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:5288 -
C:\windows\system\YEWJAW.exeC:\windows\system\YEWJAW.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IBCD.exe.bat" "20⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5280 -
C:\windows\SysWOW64\IBCD.exeC:\windows\system32\IBCD.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KZP.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\windows\system\KZP.exeC:\windows\system\KZP.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\APQXEJ.exe.bat" "24⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\windows\SysWOW64\APQXEJ.exeC:\windows\system32\APQXEJ.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KNWJ.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:5736 -
C:\windows\KNWJ.exeC:\windows\KNWJ.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OVDRXJ.exe.bat" "28⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:820 -
C:\windows\system\OVDRXJ.exeC:\windows\system\OVDRXJ.exe29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZNSCHC.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:5664 -
C:\windows\ZNSCHC.exeC:\windows\ZNSCHC.exe31⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UTSOR.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\windows\system\UTSOR.exeC:\windows\system\UTSOR.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IWIEF.exe.bat" "34⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\windows\system\IWIEF.exeC:\windows\system\IWIEF.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EXKP.exe.bat" "36⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\windows\EXKP.exeC:\windows\EXKP.exe37⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\INRPVN.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\windows\system\INRPVN.exeC:\windows\system\INRPVN.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QSDVFL.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\windows\SysWOW64\QSDVFL.exeC:\windows\system32\QSDVFL.exe41⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CIK.exe.bat" "42⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\windows\CIK.exeC:\windows\CIK.exe43⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KYLVQZN.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\windows\system\KYLVQZN.exeC:\windows\system\KYLVQZN.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZTUHJ.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\windows\SysWOW64\ZTUHJ.exeC:\windows\system32\ZTUHJ.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YEFP.exe.bat" "48⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\windows\YEFP.exeC:\windows\YEFP.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5272 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BMMXWK.exe.bat" "50⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5992 -
C:\windows\SysWOW64\BMMXWK.exeC:\windows\system32\BMMXWK.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GXKK.exe.bat" "52⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\windows\SysWOW64\GXKK.exeC:\windows\system32\GXKK.exe53⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ODP.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\windows\ODP.exeC:\windows\ODP.exe55⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SIHOXFY.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\windows\SIHOXFY.exeC:\windows\SIHOXFY.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IYIGE.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\windows\IYIGE.exeC:\windows\IYIGE.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ABMJJJW.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\windows\SysWOW64\ABMJJJW.exeC:\windows\system32\ABMJJJW.exe61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PWDOC.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:612 -
C:\windows\system\PWDOC.exeC:\windows\system\PWDOC.exe63⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HXX.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:704 -
C:\windows\system\HXX.exeC:\windows\system\HXX.exe65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZAJXL.exe.bat" "66⤵
- Executes a command shell one-liner
PID:5544 -
C:\windows\SysWOW64\ZAJXL.exeC:\windows\system32\ZAJXL.exe67⤵
- Drops file in Windows directory
PID:1620 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DQQ.exe.bat" "68⤵
- Executes a command shell one-liner
PID:4740 -
C:\windows\system\DQQ.exeC:\windows\system\DQQ.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YDUGH.exe.bat" "70⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2348 -
C:\windows\system\YDUGH.exeC:\windows\system\YDUGH.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3356 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EDCURLN.exe.bat" "72⤵PID:1400
-
C:\windows\EDCURLN.exeC:\windows\EDCURLN.exe73⤵
- Executes dropped EXE
PID:1956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PWX.exe.bat" "74⤵
- Executes a command shell one-liner
PID:4580 -
C:\windows\PWX.exeC:\windows\PWX.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6024 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KJCWJ.exe.bat" "76⤵PID:5100
-
C:\windows\SysWOW64\KJCWJ.exeC:\windows\system32\KJCWJ.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KMGAPIA.exe.bat" "78⤵
- System Location Discovery: System Language Discovery
PID:3856 -
C:\windows\KMGAPIA.exeC:\windows\KMGAPIA.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WFJ.exe.bat" "80⤵
- Executes a command shell one-liner
PID:2700 -
C:\windows\SysWOW64\WFJ.exeC:\windows\system32\WFJ.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3020 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HXMD.exe.bat" "82⤵
- System Location Discovery: System Language Discovery
PID:4840 -
C:\windows\SysWOW64\HXMD.exeC:\windows\system32\HXMD.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NYTROZ.exe.bat" "84⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2516 -
C:\windows\SysWOW64\NYTROZ.exeC:\windows\system32\NYTROZ.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3048 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TYBNXBA.exe.bat" "86⤵PID:5644
-
C:\windows\TYBNXBA.exeC:\windows\TYBNXBA.exe87⤵
- Executes dropped EXE
PID:4304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HDZ.exe.bat" "88⤵
- Executes a command shell one-liner
PID:6032 -
C:\windows\HDZ.exeC:\windows\HDZ.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IYDFK.exe.bat" "90⤵PID:3800
-
C:\windows\IYDFK.exeC:\windows\IYDFK.exe91⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IED.exe.bat" "92⤵PID:3352
-
C:\windows\IED.exeC:\windows\IED.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XHMY.exe.bat" "94⤵PID:5980
-
C:\windows\system\XHMY.exeC:\windows\system\XHMY.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SURIOA.exe.bat" "96⤵
- System Location Discovery: System Language Discovery
PID:748 -
C:\windows\SURIOA.exeC:\windows\SURIOA.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MIWRRAS.exe.bat" "98⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4492 -
C:\windows\system\MIWRRAS.exeC:\windows\system\MIWRRAS.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DQYWCY.exe.bat" "100⤵PID:5796
-
C:\windows\system\DQYWCY.exeC:\windows\system\DQYWCY.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1180 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FOD.exe.bat" "102⤵
- System Location Discovery: System Language Discovery
PID:2520 -
C:\windows\system\FOD.exeC:\windows\system\FOD.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ABIAU.exe.bat" "104⤵PID:4720
-
C:\windows\system\ABIAU.exeC:\windows\system\ABIAU.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4316 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MJPI.exe.bat" "106⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1396 -
C:\windows\MJPI.exeC:\windows\MJPI.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VRRNJW.exe.bat" "108⤵
- System Location Discovery: System Language Discovery
PID:4600 -
C:\windows\VRRNJW.exeC:\windows\VRRNJW.exe109⤵
- Executes dropped EXE
PID:4432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FPF.exe.bat" "110⤵
- Executes a command shell one-liner
PID:2440 -
C:\windows\FPF.exeC:\windows\FPF.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YKIDECS.exe.bat" "112⤵
- Executes a command shell one-liner
PID:3472 -
C:\windows\system\YKIDECS.exeC:\windows\system\YKIDECS.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4672 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CAPL.exe.bat" "114⤵
- Executes a command shell one-liner
PID:4516 -
C:\windows\CAPL.exeC:\windows\CAPL.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TBRQUS.exe.bat" "116⤵
- System Location Discovery: System Language Discovery
PID:5060 -
C:\windows\SysWOW64\TBRQUS.exeC:\windows\system32\TBRQUS.exe117⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZBZ.exe.bat" "118⤵
- System Location Discovery: System Language Discovery
PID:816 -
C:\windows\ZBZ.exeC:\windows\ZBZ.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IJBJ.exe.bat" "120⤵PID:2332
-
C:\windows\system\IJBJ.exeC:\windows\system\IJBJ.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5476
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-