Analysis
- max time kernel
83s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
28/07/2026, 22:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-28_895045fef22c4c0623d4fef113dd9b10_elex_icedid.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-07-28_895045fef22c4c0623d4fef113dd9b10_elex_icedid.exe
- Size 282KB
- Sample260728-2jckjsbj5w
- SHA256 4c20ff0a81b07349bc300ecf6e8449e6ed73f38c8d6c741bc26853ae1f4b6c0f
- MD5 895045fef22c4c0623d4fef113dd9b10
- SHA1 2fe5473a4d88d2bfb152b51279ffa301f20876cc
- SHA512 6c18d7c34cb8b64337a1a728cc3fb5a17e03b277f90a32f64db1fd94b7acda9ca6e2f19291aa4df3cb4ea75740a1d6233e1aa3a23862ab7403c56d4b2abc9897
- SSDEEP 6144:GTpcXRhn8GRrEXnjo96kEjiPISUOgW9X+hOGzC/:GTpWh0n096kmZzcukG2/
- TLSH T132548DA7B68D8322D19303B118DF9AD5EF2BBC71677A424A34607F0D1673F688275392
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2560 LGGGL.exe 1564 AWWMWF.exe 3184 EXKP.exe 1964 SSWI.exe 2928 LVA.exe 3776 YGQCQ.exe 2952 IVWWY.exe 2364 AEKCK.exe 4304 JMMHOP.exe 2344 TKSBVX.exe 1496 QCUDH.exe 3348 LNK.exe 3464 YLKGXQA.exe 4428 MWAELSV.exe 5340 KGDUU.exe 5908 OWK.exe 4424 NHNLHFU.exe 4688 VNZRRD.exe 2996 ONPCJ.exe 5772 WTTR.exe 2436 TTDTX.exe 3692 SEGJGMG.exe 4132 URX.exe 552 TNWLWB.exe 3932 IIGY.exe 364 XYHPO.exe 5280 OGVUAAV.exe 4200 IYDFK.exe 1660 RHFK.exe 5948 XHMY.exe 3444 IAPRM.exe 5376 DNUAPIL.exe 5644 NLAVEQ.exe 1720 YDDOEYJ.exe 2832 RWK.exe 5812 KZWU.exe 1076 XXW.exe 4828 SKBPN.exe 6132 RIM.exe 4396 XDLTFI.exe 1700 HBRN.exe 1300 YBFL.exe 3968 XUQ.exe 3936 PPUEVDP.exe 200 ZNZR.exe 5192 YXC.exe 1336 FAUTWM.exe 1992 GWXPK.exe 6072 OJCV.exe 4600 DZDVTW.exe 4616 PSSGKX.exe 4932 NCVWT.exe 2164 IQAFVDI.exe 1312 UGHF.exe 1340 DGJKL.exe 5820 HWP.exe 4328 CJUCI.exe 1520 XULAW.exe 1484 QPOWBM.exe 2564 OIRMK.exe 2328 BLI.exe 932 COLGDSY.exe 3684 IJL.exe 1928 DWPZS.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\XULAW.exe CJUCI.exe File created C:\windows\SysWOW64\PDJH.exe.bat WHGDQ.exe File created C:\windows\SysWOW64\WDEGRIH.exe XTU.exe File created C:\windows\SysWOW64\ZXOZ.exe.bat BMLJY.exe File opened for modification C:\windows\SysWOW64\KIGRI.exe PVB.exe File created C:\windows\SysWOW64\IAPRM.exe.bat XHMY.exe File opened for modification C:\windows\SysWOW64\AEKCK.exe IVWWY.exe File created C:\windows\SysWOW64\TKSBVX.exe.bat JMMHOP.exe File created C:\windows\SysWOW64\NHNLHFU.exe OWK.exe File created C:\windows\SysWOW64\TTDTX.exe WTTR.exe File created C:\windows\SysWOW64\IIGY.exe.bat TNWLWB.exe File opened for modification C:\windows\SysWOW64\RHFK.exe IYDFK.exe File opened for modification C:\windows\SysWOW64\PDJH.exe WHGDQ.exe File created C:\windows\SysWOW64\IVWWY.exe.bat YGQCQ.exe File created C:\windows\SysWOW64\RHFK.exe.bat IYDFK.exe File created C:\windows\SysWOW64\SKBPN.exe XXW.exe File opened for modification C:\windows\SysWOW64\GWXPK.exe FAUTWM.exe File created C:\windows\SysWOW64\WQQM.exe.bat CCL.exe File created C:\windows\SysWOW64\WDEGRIH.exe.bat XTU.exe File opened for modification C:\windows\SysWOW64\FMTUMCW.exe QRJP.exe File opened for modification C:\windows\SysWOW64\ZAB.exe BXPS.exe File created C:\windows\SysWOW64\AEKCK.exe IVWWY.exe File created C:\windows\SysWOW64\PPUEVDP.exe.bat XUQ.exe File created C:\windows\SysWOW64\OIRMK.exe.bat QPOWBM.exe File opened for modification C:\windows\SysWOW64\TKSBVX.exe JMMHOP.exe File created C:\windows\SysWOW64\PPUEVDP.exe XUQ.exe File opened for modification C:\windows\SysWOW64\CJUCI.exe HWP.exe File created C:\windows\SysWOW64\FMTUMCW.exe.bat QRJP.exe File created C:\windows\SysWOW64\PSXESJP.exe ZXOZ.exe File created C:\windows\SysWOW64\RUKJ.exe WGFAHVD.exe File opened for modification C:\windows\SysWOW64\IVWWY.exe YGQCQ.exe File created C:\windows\SysWOW64\IIGY.exe TNWLWB.exe File created C:\windows\SysWOW64\GWXPK.exe FAUTWM.exe File opened for modification C:\windows\SysWOW64\WHGDQ.exe QHYPZ.exe File created C:\windows\SysWOW64\WQQM.exe CCL.exe File created C:\windows\SysWOW64\KIGRI.exe.bat PVB.exe File opened for modification C:\windows\SysWOW64\RUKJ.exe WGFAHVD.exe File opened for modification C:\windows\SysWOW64\JPN.exe RUKJ.exe File created C:\windows\SysWOW64\KZWU.exe.bat RWK.exe File created C:\windows\SysWOW64\SKBPN.exe.bat XXW.exe File created C:\windows\SysWOW64\XDLTFI.exe RIM.exe File created C:\windows\SysWOW64\CJUCI.exe HWP.exe File opened for modification C:\windows\SysWOW64\JZHHNO.exe DZAT.exe File opened for modification C:\windows\SysWOW64\WQQM.exe CCL.exe File created C:\windows\SysWOW64\KIGRI.exe PVB.exe File created C:\windows\SysWOW64\JMMHOP.exe.bat AEKCK.exe File created C:\windows\SysWOW64\TKSBVX.exe JMMHOP.exe File created C:\windows\SysWOW64\RWK.exe.bat YDDOEYJ.exe File opened for modification C:\windows\SysWOW64\SKBPN.exe XXW.exe File opened for modification C:\windows\SysWOW64\XDLTFI.exe RIM.exe File created C:\windows\SysWOW64\IJL.exe.bat COLGDSY.exe File opened for modification C:\windows\SysWOW64\WDEGRIH.exe XTU.exe File opened for modification C:\windows\SysWOW64\PSXESJP.exe ZXOZ.exe File created C:\windows\SysWOW64\XDLTFI.exe.bat RIM.exe File created C:\windows\SysWOW64\ZNZR.exe PPUEVDP.exe File created C:\windows\SysWOW64\ZNZR.exe.bat PPUEVDP.exe File opened for modification C:\windows\SysWOW64\XULAW.exe CJUCI.exe File created C:\windows\SysWOW64\JZHHNO.exe.bat DZAT.exe File created C:\windows\SysWOW64\PSXESJP.exe.bat ZXOZ.exe File created C:\windows\SysWOW64\RUKJ.exe.bat WGFAHVD.exe File created C:\windows\SysWOW64\ZAB.exe BXPS.exe File opened for modification C:\windows\SysWOW64\IAPRM.exe XHMY.exe File opened for modification C:\windows\SysWOW64\YXC.exe ZNZR.exe File opened for modification C:\windows\SysWOW64\NHNLHFU.exe OWK.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\FAUTWM.exe YXC.exe File created C:\windows\system\HWP.exe DGJKL.exe File created C:\windows\QPOWBM.exe.bat XULAW.exe File created C:\windows\system\PGNCBG.exe PDJH.exe File opened for modification C:\windows\system\PGNCBG.exe PDJH.exe File created C:\windows\system\QRJP.exe WDEGRIH.exe File created C:\windows\ZSATFI.exe.bat VCU.exe File created C:\windows\system\OGVUAAV.exe XYHPO.exe File created C:\windows\RIM.exe.bat SKBPN.exe File opened for modification C:\windows\DZDVTW.exe OJCV.exe File created C:\windows\BLSJ.exe.bat RNEPK.exe File created C:\windows\system\WGFAHVD.exe KQYSV.exe File opened for modification C:\windows\OWK.exe KGDUU.exe File opened for modification C:\windows\WTTR.exe ONPCJ.exe File created C:\windows\system\YDDOEYJ.exe NLAVEQ.exe File created C:\windows\system\BLI.exe.bat OIRMK.exe File created C:\windows\KTS.exe PGNCBG.exe File created C:\windows\DZAT.exe.bat URYGSOI.exe File opened for modification C:\windows\system\CCL.exe JZHHNO.exe File created C:\windows\ZSATFI.exe VCU.exe File created C:\windows\WTTR.exe ONPCJ.exe File created C:\windows\system\SEGJGMG.exe TTDTX.exe File created C:\windows\system\DNUAPIL.exe IAPRM.exe File created C:\windows\DGJKL.exe UGHF.exe File created C:\windows\KTS.exe.bat PGNCBG.exe File opened for modification C:\windows\system\XWWBMQW.exe LTMODM.exe File created C:\windows\LNK.exe QCUDH.exe File created C:\windows\system\URX.exe SEGJGMG.exe File opened for modification C:\windows\system\DNUAPIL.exe IAPRM.exe File created C:\windows\system\NLAVEQ.exe.bat DNUAPIL.exe File created C:\windows\PSSGKX.exe DZDVTW.exe File created C:\windows\system\COLGDSY.exe.bat BLI.exe File opened for modification C:\windows\LTMODM.exe BLSJ.exe File created C:\windows\EVLAKZU.exe KIGRI.exe File created C:\windows\QCUDH.exe.bat TKSBVX.exe File created C:\windows\IYDFK.exe.bat OGVUAAV.exe File opened for modification C:\windows\system\HBRN.exe XDLTFI.exe File created C:\windows\system\DWPZS.exe.bat IJL.exe File created C:\windows\system\PGNCBG.exe.bat PDJH.exe File opened for modification C:\windows\ZSATFI.exe VCU.exe File opened for modification C:\windows\system\BMLJY.exe XWWBMQW.exe File created C:\windows\QXTUJYY.exe VCOLZ.exe File created C:\windows\WTTR.exe.bat ONPCJ.exe File opened for modification C:\windows\XUQ.exe YBFL.exe File opened for modification C:\windows\BXPS.exe JPN.exe File created C:\windows\system\MWAELSV.exe.bat YLKGXQA.exe File opened for modification C:\windows\KGDUU.exe MWAELSV.exe File opened for modification C:\windows\ONPCJ.exe VNZRRD.exe File created C:\windows\URYGSOI.exe KTS.exe File created C:\windows\DZAT.exe URYGSOI.exe File created C:\windows\BXPS.exe.bat JPN.exe File created C:\windows\AWWMWF.exe LGGGL.exe File created C:\windows\system\YLKGXQA.exe LNK.exe File opened for modification C:\windows\system\SEGJGMG.exe TTDTX.exe File created C:\windows\NCVWT.exe PSSGKX.exe File created C:\windows\system\COLGDSY.exe BLI.exe File opened for modification C:\windows\system\COLGDSY.exe BLI.exe File created C:\windows\VCU.exe FMTUMCW.exe File created C:\windows\system\WGFAHVD.exe.bat KQYSV.exe File opened for modification C:\windows\SSWI.exe EXKP.exe File created C:\windows\QCUDH.exe TKSBVX.exe File opened for modification C:\windows\system\MWAELSV.exe YLKGXQA.exe File created C:\windows\OWK.exe.bat KGDUU.exe File opened for modification C:\windows\system\URX.exe SEGJGMG.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1704 cmd.exe 1152 cmd.exe 4348 cmd.exe 3012 cmd.exe 1588 cmd.exe 6128 cmd.exe 1968 cmd.exe 5032 cmd.exe 4256 cmd.exe 296 cmd.exe 5856 cmd.exe 2664 cmd.exe 4404 cmd.exe 5960 cmd.exe 3380 cmd.exe 5780 cmd.exe 2828 cmd.exe 2004 cmd.exe 4108 cmd.exe 2808 cmd.exe 5636 cmd.exe 5212 cmd.exe 5936 cmd.exe 2856 cmd.exe 1344 cmd.exe 5828 cmd.exe 4752 cmd.exe 3604 cmd.exe 5736 cmd.exe 2580 cmd.exe 868 cmd.exe 5988 cmd.exe 4608 cmd.exe 5872 cmd.exe 1552 cmd.exe 4656 cmd.exe 5072 cmd.exe 1540 cmd.exe 888 cmd.exe 3300 cmd.exe 2696 cmd.exe 5588 cmd.exe 5368 cmd.exe 3068 cmd.exe 4188 cmd.exe 3388 cmd.exe 672 cmd.exe 5232 cmd.exe 4504 cmd.exe 2812 cmd.exe 2800 cmd.exe 6012 cmd.exe 2964 cmd.exe 5832 cmd.exe 1004 cmd.exe 1056 cmd.exe 5284 cmd.exe 2516 cmd.exe 3900 cmd.exe 1784 cmd.exe 964 cmd.exe 700 cmd.exe 2256 cmd.exe 5396 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 2864 2744 WerFault.exe 87 5816 2560 WerFault.exe 93 4228 1564 WerFault.exe 99 1212 3184 WerFault.exe 104 5000 1964 WerFault.exe 109 920 2928 WerFault.exe 114 2224 3776 WerFault.exe 119 4472 2952 WerFault.exe 124 4468 2364 WerFault.exe 128 4188 4304 WerFault.exe 134 2720 2344 WerFault.exe 139 2164 1496 WerFault.exe 144 3460 3348 WerFault.exe 149 2972 3464 WerFault.exe 154 2636 4428 WerFault.exe 159 1212 5340 WerFault.exe 164 4788 5908 WerFault.exe 169 920 4424 WerFault.exe 174 5004 4688 WerFault.exe 179 3080 2996 WerFault.exe 184 6004 5772 WerFault.exe 189 5640 2436 WerFault.exe 194 2004 3692 WerFault.exe 199 5304 4132 WerFault.exe 204 3460 552 WerFault.exe 209 1232 3932 WerFault.exe 214 3428 364 WerFault.exe 219 3528 5280 WerFault.exe 224 4288 4200 WerFault.exe 229 4268 1660 WerFault.exe 234 4344 5948 WerFault.exe 239 4728 3444 WerFault.exe 244 4128 5376 WerFault.exe 249 4988 5644 WerFault.exe 254 4252 1720 WerFault.exe 259 1784 2832 WerFault.exe 264 4668 5812 WerFault.exe 269 1456 1076 WerFault.exe 274 900 4828 WerFault.exe 279 1896 6132 WerFault.exe 284 4260 4396 WerFault.exe 289 3116 1700 WerFault.exe 294 1848 1300 WerFault.exe 299 6000 3968 WerFault.exe 304 4920 3936 WerFault.exe 309 1588 200 WerFault.exe 314 2332 5192 WerFault.exe 319 4980 1336 WerFault.exe 324 4308 1992 WerFault.exe 329 6088 6072 WerFault.exe 334 1528 4600 WerFault.exe 339 1044 4616 WerFault.exe 344 3228 4932 WerFault.exe 349 4696 2164 WerFault.exe 354 3572 1312 WerFault.exe 359 360 1340 WerFault.exe 364 4692 5820 WerFault.exe 369 2664 4328 WerFault.exe 374 292 1520 WerFault.exe 379 5876 1484 WerFault.exe 384 3744 2564 WerFault.exe 389 4240 2328 WerFault.exe 394 5448 932 WerFault.exe 399 4184 3684 WerFault.exe 404 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UGHF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OIRMK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IVWWY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ONPCJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IIGY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QHYPZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BMLJY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QXTUJYY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PGNCBG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YXC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VCU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DGJKL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KTS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KGDUU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SKBPN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HBRN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XTU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZSATFI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KQYSV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QCUDH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NHNLHFU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LTMODM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NCVWT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LGGGL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SSWI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XULAW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SEGJGMG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZNZR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FMTUMCW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZJPK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VCOLZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-28_895045fef22c4c0623d4fef113dd9b10_elex_icedid.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AWWMWF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VNZRRD.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2744 2026-07-28_895045fef22c4c0623d4fef113dd9b10_elex_icedid.exe 2744 2026-07-28_895045fef22c4c0623d4fef113dd9b10_elex_icedid.exe 2560 LGGGL.exe 2560 LGGGL.exe 1564 AWWMWF.exe 1564 AWWMWF.exe 3184 EXKP.exe 3184 EXKP.exe 1964 SSWI.exe 1964 SSWI.exe 2928 LVA.exe 2928 LVA.exe 3776 YGQCQ.exe 3776 YGQCQ.exe 2952 IVWWY.exe 2952 IVWWY.exe 2364 AEKCK.exe 2364 AEKCK.exe 4304 JMMHOP.exe 4304 JMMHOP.exe 2344 TKSBVX.exe 2344 TKSBVX.exe 1496 QCUDH.exe 1496 QCUDH.exe 3348 LNK.exe 3348 LNK.exe 3464 YLKGXQA.exe 3464 YLKGXQA.exe 4428 MWAELSV.exe 4428 MWAELSV.exe 5340 KGDUU.exe 5340 KGDUU.exe 5908 OWK.exe 5908 OWK.exe 4424 NHNLHFU.exe 4424 NHNLHFU.exe 4688 VNZRRD.exe 4688 VNZRRD.exe 2996 ONPCJ.exe 2996 ONPCJ.exe 5772 WTTR.exe 5772 WTTR.exe 2436 TTDTX.exe 2436 TTDTX.exe 3692 SEGJGMG.exe 3692 SEGJGMG.exe 4132 URX.exe 4132 URX.exe 552 TNWLWB.exe 552 TNWLWB.exe 3932 IIGY.exe 3932 IIGY.exe 364 XYHPO.exe 364 XYHPO.exe 5280 OGVUAAV.exe 5280 OGVUAAV.exe 4200 IYDFK.exe 4200 IYDFK.exe 1660 RHFK.exe 1660 RHFK.exe 5948 XHMY.exe 5948 XHMY.exe 3444 IAPRM.exe 3444 IAPRM.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2744 2026-07-28_895045fef22c4c0623d4fef113dd9b10_elex_icedid.exe 2744 2026-07-28_895045fef22c4c0623d4fef113dd9b10_elex_icedid.exe 2560 LGGGL.exe 2560 LGGGL.exe 1564 AWWMWF.exe 1564 AWWMWF.exe 3184 EXKP.exe 3184 EXKP.exe 1964 SSWI.exe 1964 SSWI.exe 2928 LVA.exe 2928 LVA.exe 3776 YGQCQ.exe 3776 YGQCQ.exe 2952 IVWWY.exe 2952 IVWWY.exe 2364 AEKCK.exe 2364 AEKCK.exe 4304 JMMHOP.exe 4304 JMMHOP.exe 2344 TKSBVX.exe 2344 TKSBVX.exe 1496 QCUDH.exe 1496 QCUDH.exe 3348 LNK.exe 3348 LNK.exe 3464 YLKGXQA.exe 3464 YLKGXQA.exe 4428 MWAELSV.exe 4428 MWAELSV.exe 5340 KGDUU.exe 5340 KGDUU.exe 5908 OWK.exe 5908 OWK.exe 4424 NHNLHFU.exe 4424 NHNLHFU.exe 4688 VNZRRD.exe 4688 VNZRRD.exe 2996 ONPCJ.exe 2996 ONPCJ.exe 5772 WTTR.exe 5772 WTTR.exe 2436 TTDTX.exe 2436 TTDTX.exe 3692 SEGJGMG.exe 3692 SEGJGMG.exe 4132 URX.exe 4132 URX.exe 552 TNWLWB.exe 552 TNWLWB.exe 3932 IIGY.exe 3932 IIGY.exe 364 XYHPO.exe 364 XYHPO.exe 5280 OGVUAAV.exe 5280 OGVUAAV.exe 4200 IYDFK.exe 4200 IYDFK.exe 1660 RHFK.exe 1660 RHFK.exe 5948 XHMY.exe 5948 XHMY.exe 3444 IAPRM.exe 3444 IAPRM.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2744 wrote to memory of 616 2744 2026-07-28_895045fef22c4c0623d4fef113dd9b10_elex_icedid.exe 89 PID 616 wrote to memory of 2560 616 cmd.exe 93 PID 2560 wrote to memory of 5868 2560 LGGGL.exe 95 PID 5868 wrote to memory of 1564 5868 cmd.exe 99 PID 1564 wrote to memory of 4112 1564 AWWMWF.exe 100 PID 4112 wrote to memory of 3184 4112 cmd.exe 104 PID 3184 wrote to memory of 4964 3184 EXKP.exe 105 PID 4964 wrote to memory of 1964 4964 cmd.exe 109 PID 1964 wrote to memory of 2112 1964 SSWI.exe 110 PID 2112 wrote to memory of 2928 2112 cmd.exe 114 PID 2928 wrote to memory of 964 2928 LVA.exe 115 PID 964 wrote to memory of 3776 964 cmd.exe 119 PID 3776 wrote to memory of 2812 3776 YGQCQ.exe 120 PID 2812 wrote to memory of 2952 2812 cmd.exe 124 PID 2952 wrote to memory of 4656 2952 IVWWY.exe 125 PID 4656 wrote to memory of 2364 4656 cmd.exe 128 PID 2364 wrote to memory of 5320 2364 AEKCK.exe 130 PID 5320 wrote to memory of 4304 5320 cmd.exe 134 PID 4304 wrote to memory of 5696 4304 JMMHOP.exe 135 PID 5696 wrote to memory of 2344 5696 cmd.exe 139 PID 2344 wrote to memory of 5764 2344 TKSBVX.exe 140 PID 5764 wrote to memory of 1496 5764 cmd.exe 144 PID 1496 wrote to memory of 3064 1496 QCUDH.exe 145 PID 3064 wrote to memory of 3348 3064 cmd.exe 149 PID 3348 wrote to memory of 3068 3348 LNK.exe 150 PID 3068 wrote to memory of 3464 3068 cmd.exe 154 PID 3464 wrote to memory of 700 3464 YLKGXQA.exe 155 PID 700 wrote to memory of 4428 700 cmd.exe 159 PID 4428 wrote to memory of 1704 4428 MWAELSV.exe 160 PID 1704 wrote to memory of 5340 1704 cmd.exe 164 PID 5340 wrote to memory of 1152 5340 KGDUU.exe 165 PID 1152 wrote to memory of 5908 1152 cmd.exe 169 PID 5908 wrote to memory of 4956 5908 OWK.exe 170 PID 4956 wrote to memory of 4424 4956 cmd.exe 174 PID 4424 wrote to memory of 1560 4424 NHNLHFU.exe 175 PID 1560 wrote to memory of 4688 1560 cmd.exe 179 PID 4688 wrote to memory of 2256 4688 VNZRRD.exe 180 PID 2256 wrote to memory of 2996 2256 cmd.exe 184 PID 2996 wrote to memory of 5856 2996 ONPCJ.exe 185 PID 5856 wrote to memory of 5772 5856 cmd.exe 189 PID 5772 wrote to memory of 1388 5772 WTTR.exe 190 PID 1388 wrote to memory of 2436 1388 cmd.exe 194 PID 2436 wrote to memory of 4532 2436 TTDTX.exe 195 PID 4532 wrote to memory of 3692 4532 cmd.exe 199 PID 3692 wrote to memory of 3604 3692 SEGJGMG.exe 200 PID 3604 wrote to memory of 4132 3604 cmd.exe 204 PID 4132 wrote to memory of 4236 4132 URX.exe 205 PID 4236 wrote to memory of 552 4236 cmd.exe 209 PID 552 wrote to memory of 3768 552 TNWLWB.exe 210 PID 3768 wrote to memory of 3932 3768 cmd.exe 214 PID 3932 wrote to memory of 2856 3932 IIGY.exe 215 PID 2856 wrote to memory of 364 2856 cmd.exe 219 PID 364 wrote to memory of 108 364 XYHPO.exe 220 PID 108 wrote to memory of 5280 108 cmd.exe 224 PID 5280 wrote to memory of 3268 5280 OGVUAAV.exe 225 PID 3268 wrote to memory of 4200 3268 cmd.exe 229 PID 4200 wrote to memory of 4452 4200 IYDFK.exe 230 PID 4452 wrote to memory of 1660 4452 cmd.exe 234 PID 1660 wrote to memory of 5072 1660 RHFK.exe 235 PID 5072 wrote to memory of 5948 5072 cmd.exe 239 PID 5948 wrote to memory of 4700 5948 XHMY.exe 240 PID 4700 wrote to memory of 3444 4700 cmd.exe 244 PID 3444 wrote to memory of 5780 3444 IAPRM.exe 245 PID 5780 wrote to memory of 5376 5780 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-28_895045fef22c4c0623d4fef113dd9b10_elex_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-28_895045fef22c4c0623d4fef113dd9b10_elex_icedid.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LGGGL.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:616 -
C:\windows\system\LGGGL.exeC:\windows\system\LGGGL.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AWWMWF.exe.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5868 -
C:\windows\AWWMWF.exeC:\windows\AWWMWF.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EXKP.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\windows\EXKP.exeC:\windows\EXKP.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SSWI.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\windows\SSWI.exeC:\windows\SSWI.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LVA.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\windows\system\LVA.exeC:\windows\system\LVA.exe11⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YGQCQ.exe.bat" "12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:964 -
C:\windows\YGQCQ.exeC:\windows\YGQCQ.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IVWWY.exe.bat" "14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\windows\SysWOW64\IVWWY.exeC:\windows\system32\IVWWY.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AEKCK.exe.bat" "16⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\windows\SysWOW64\AEKCK.exeC:\windows\system32\AEKCK.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JMMHOP.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:5320 -
C:\windows\SysWOW64\JMMHOP.exeC:\windows\system32\JMMHOP.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TKSBVX.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:5696 -
C:\windows\SysWOW64\TKSBVX.exeC:\windows\system32\TKSBVX.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QCUDH.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:5764 -
C:\windows\QCUDH.exeC:\windows\QCUDH.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LNK.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\windows\LNK.exeC:\windows\LNK.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3348 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YLKGXQA.exe.bat" "26⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\windows\system\YLKGXQA.exeC:\windows\system\YLKGXQA.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MWAELSV.exe.bat" "28⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:700 -
C:\windows\system\MWAELSV.exeC:\windows\system\MWAELSV.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KGDUU.exe.bat" "30⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\windows\KGDUU.exeC:\windows\KGDUU.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5340 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OWK.exe.bat" "32⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\windows\OWK.exeC:\windows\OWK.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NHNLHFU.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\windows\SysWOW64\NHNLHFU.exeC:\windows\system32\NHNLHFU.exe35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VNZRRD.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\windows\VNZRRD.exeC:\windows\VNZRRD.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ONPCJ.exe.bat" "38⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\windows\ONPCJ.exeC:\windows\ONPCJ.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WTTR.exe.bat" "40⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5856 -
C:\windows\WTTR.exeC:\windows\WTTR.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5772 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TTDTX.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\windows\SysWOW64\TTDTX.exeC:\windows\system32\TTDTX.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SEGJGMG.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\windows\system\SEGJGMG.exeC:\windows\system\SEGJGMG.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\URX.exe.bat" "46⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\windows\system\URX.exeC:\windows\system\URX.exe47⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TNWLWB.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\windows\system\TNWLWB.exeC:\windows\system\TNWLWB.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IIGY.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\windows\SysWOW64\IIGY.exeC:\windows\system32\IIGY.exe51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XYHPO.exe.bat" "52⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\windows\XYHPO.exeC:\windows\XYHPO.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OGVUAAV.exe.bat" "54⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:108 -
C:\windows\system\OGVUAAV.exeC:\windows\system\OGVUAAV.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IYDFK.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\windows\IYDFK.exeC:\windows\IYDFK.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RHFK.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\windows\SysWOW64\RHFK.exeC:\windows\system32\RHFK.exe59⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XHMY.exe.bat" "60⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\windows\system\XHMY.exeC:\windows\system\XHMY.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IAPRM.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\windows\SysWOW64\IAPRM.exeC:\windows\system32\IAPRM.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DNUAPIL.exe.bat" "64⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5780 -
C:\windows\system\DNUAPIL.exeC:\windows\system\DNUAPIL.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NLAVEQ.exe.bat" "66⤵PID:3512
-
C:\windows\system\NLAVEQ.exeC:\windows\system\NLAVEQ.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YDDOEYJ.exe.bat" "68⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:6128 -
C:\windows\system\YDDOEYJ.exeC:\windows\system\YDDOEYJ.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RWK.exe.bat" "70⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4188 -
C:\windows\SysWOW64\RWK.exeC:\windows\system32\RWK.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KZWU.exe.bat" "72⤵PID:1536
-
C:\windows\SysWOW64\KZWU.exeC:\windows\system32\KZWU.exe73⤵
- Executes dropped EXE
PID:5812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XXW.exe.bat" "74⤵
- System Location Discovery: System Language Discovery
PID:796 -
C:\windows\system\XXW.exeC:\windows\system\XXW.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SKBPN.exe.bat" "76⤵
- Executes a command shell one-liner
PID:1344 -
C:\windows\SysWOW64\SKBPN.exeC:\windows\system32\SKBPN.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RIM.exe.bat" "78⤵PID:6060
-
C:\windows\RIM.exeC:\windows\RIM.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XDLTFI.exe.bat" "80⤵
- System Location Discovery: System Language Discovery
PID:1408 -
C:\windows\SysWOW64\XDLTFI.exeC:\windows\system32\XDLTFI.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HBRN.exe.bat" "82⤵PID:3200
-
C:\windows\system\HBRN.exeC:\windows\system\HBRN.exe83⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YBFL.exe.bat" "84⤵PID:1020
-
C:\windows\system\YBFL.exeC:\windows\system\YBFL.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XUQ.exe.bat" "86⤵PID:6004
-
C:\windows\XUQ.exeC:\windows\XUQ.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PPUEVDP.exe.bat" "88⤵
- System Location Discovery: System Language Discovery
PID:3888 -
C:\windows\SysWOW64\PPUEVDP.exeC:\windows\system32\PPUEVDP.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZNZR.exe.bat" "90⤵PID:4636
-
C:\windows\SysWOW64\ZNZR.exeC:\windows\system32\ZNZR.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YXC.exe.bat" "92⤵PID:4840
-
C:\windows\SysWOW64\YXC.exeC:\windows\system32\YXC.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5192 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FAUTWM.exe.bat" "94⤵
- System Location Discovery: System Language Discovery
PID:4228 -
C:\windows\FAUTWM.exeC:\windows\FAUTWM.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1336 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GWXPK.exe.bat" "96⤵PID:2636
-
C:\windows\SysWOW64\GWXPK.exeC:\windows\system32\GWXPK.exe97⤵
- Executes dropped EXE
PID:1992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OJCV.exe.bat" "98⤵PID:4312
-
C:\windows\OJCV.exeC:\windows\OJCV.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6072 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DZDVTW.exe.bat" "100⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1968 -
C:\windows\DZDVTW.exeC:\windows\DZDVTW.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PSSGKX.exe.bat" "102⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5828 -
C:\windows\PSSGKX.exeC:\windows\PSSGKX.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NCVWT.exe.bat" "104⤵PID:5852
-
C:\windows\NCVWT.exeC:\windows\NCVWT.exe105⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IQAFVDI.exe.bat" "106⤵
- System Location Discovery: System Language Discovery
PID:2108 -
C:\windows\IQAFVDI.exeC:\windows\IQAFVDI.exe107⤵
- Executes dropped EXE
PID:2164 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UGHF.exe.bat" "108⤵
- Executes a command shell one-liner
PID:5032 -
C:\windows\system\UGHF.exeC:\windows\system\UGHF.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DGJKL.exe.bat" "110⤵
- System Location Discovery: System Language Discovery
PID:2000 -
C:\windows\DGJKL.exeC:\windows\DGJKL.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1340 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HWP.exe.bat" "112⤵PID:4352
-
C:\windows\system\HWP.exeC:\windows\system\HWP.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CJUCI.exe.bat" "114⤵
- Executes a command shell one-liner
PID:5736 -
C:\windows\SysWOW64\CJUCI.exeC:\windows\system32\CJUCI.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4328 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XULAW.exe.bat" "116⤵PID:472
-
C:\windows\SysWOW64\XULAW.exeC:\windows\system32\XULAW.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QPOWBM.exe.bat" "118⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2580 -
C:\windows\QPOWBM.exeC:\windows\QPOWBM.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1484 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OIRMK.exe.bat" "120⤵
- Executes a command shell one-liner
PID:4256 -
C:\windows\SysWOW64\OIRMK.exeC:\windows\system32\OIRMK.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2564
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-