Analysis
- max time kernel
93s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
28/07/2026, 17:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-28_0b485325c7952de186cd1e79e24c82e4_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-07-28_0b485325c7952de186cd1e79e24c82e4_elex_emotet_stop.exe
- Size 208KB
- Sample260728-v778ssaf39
- SHA256 8fa6749d524284d2e60e9a69f7233889d603237a833ce982b882f2a6cc58e2d7
- MD5 0b485325c7952de186cd1e79e24c82e4
- SHA1 ed3d3091cb921d0d671e9284ccacd3ac10ae7eff
- SHA512 b519764ec3874229daa8e1408d23638e8b07994227652c67a726c94723f1d0b53a545ec0c62f9f66a8bf55a3493b12f197f48d3a4599b2d42107cdd5f63f1eca
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbclcdL+LOf44NLthEjQT6j:MlZtbLWIgd1LZ9oECZbclc5+LOQQEj1
- TLSH T142247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 6208 IIH.exe 6096 ABDSVX.exe 2480 QZRKDE.exe 2564 WMQL.exe 1012 UKJOCNH.exe 1348 EKLT.exe 3116 ENPWLI.exe 2512 IVWWY.exe 4872 YLXWEO.exe 1412 GZJCPM.exe 6816 KHQ.exe 6216 CKUGGUO.exe 3376 WDBRQVW.exe 2852 ATQRC.exe 2152 GGHAHJ.exe 4064 VJY.exe 6476 BWQFXG.exe 5892 ZUJIK.exe 4124 JULNNJ.exe 2428 YKMN.exe 628 LVUDIHS.exe 1216 VTIYPQB.exe 4716 JRIJZ.exe 2356 HOTM.exe 4808 RPVRQ.exe 5032 CFCRCWJ.exe 3244 XSHB.exe 1080 VNGJRZN.exe 3316 UDZEEE.exe 5108 WZEOOEK.exe 2348 GZYB.exe 2736 LZFPBE.exe 5136 LFGDCRQ.exe 4680 BAPHV.exe 6540 VVURFD.exe 1952 BITS.exe 1316 WEYBMG.exe 4212 LZHN.exe 2880 UZJSJ.exe 6212 PUOCLYJ.exe 3240 SITL.exe 6940 UFZGDG.exe 5752 YNFGPZ.exe 4292 PWHTAWF.exe 5604 YWJ.exe 6240 EWRMN.exe 200 ZKWVXWX.exe 1812 QSY.exe 3848 DDGZPE.exe 3780 HLNZBW.exe 6800 CYR.exe 2340 WTWA.exe 260 XOAVBM.exe 6032 SKF.exe 7056 MXKOO.exe 5496 MDKDPY.exe 4468 BYT.exe 3492 ROUGHHR.exe 2296 EYLFV.exe 4496 HMIOFJB.exe 4564 ZPTKLH.exe 3224 OPVL.exe 3300 JLAUPH.exe 4740 PLHIYB.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\XSHB.exe CFCRCWJ.exe File created C:\windows\SysWOW64\VNGJRZN.exe XSHB.exe File created C:\windows\SysWOW64\KBQNORU.exe.bat JYM.exe File created C:\windows\SysWOW64\WOLBIXQ.exe HTCW.exe File created C:\windows\SysWOW64\ZKWVXWX.exe EWRMN.exe File opened for modification C:\windows\SysWOW64\KBQNORU.exe JYM.exe File created C:\windows\SysWOW64\WOLBIXQ.exe.bat HTCW.exe File created C:\windows\SysWOW64\ZYZJKY.exe MAZXIUV.exe File created C:\windows\SysWOW64\IUQH.exe DWGRN.exe File opened for modification C:\windows\SysWOW64\YNFGPZ.exe UFZGDG.exe File created C:\windows\SysWOW64\OPVL.exe.bat UCQBVHZ.exe File created C:\windows\SysWOW64\KBQNORU.exe JYM.exe File created C:\windows\SysWOW64\YNCE.exe.bat XKZAEG.exe File created C:\windows\SysWOW64\ZUJIK.exe BWQFXG.exe File created C:\windows\SysWOW64\LZHN.exe.bat WEYBMG.exe File created C:\windows\SysWOW64\ANSR.exe.bat LSBFTU.exe File opened for modification C:\windows\SysWOW64\TPNTM.exe ZBI.exe File created C:\windows\SysWOW64\HLNZBW.exe DDGZPE.exe File created C:\windows\SysWOW64\IUQH.exe.bat DWGRN.exe File opened for modification C:\windows\SysWOW64\IVWWY.exe ENPWLI.exe File created C:\windows\SysWOW64\WZEOOEK.exe UDZEEE.exe File created C:\windows\SysWOW64\MXKOO.exe SKF.exe File created C:\windows\SysWOW64\KRFA.exe.bat MRYM.exe File created C:\windows\SysWOW64\XSHB.exe CFCRCWJ.exe File opened for modification C:\windows\SysWOW64\OTIN.exe ZYZJKY.exe File opened for modification C:\windows\SysWOW64\GGHAHJ.exe ATQRC.exe File created C:\windows\SysWOW64\WTWA.exe CYR.exe File created C:\windows\SysWOW64\EYLFV.exe ROUGHHR.exe File created C:\windows\SysWOW64\DYZIV.exe.bat DVVFHY.exe File created C:\windows\SysWOW64\PQOTE.exe DYZIV.exe File created C:\windows\SysWOW64\CKUGGUO.exe.bat KHQ.exe File created C:\windows\SysWOW64\GGHAHJ.exe.bat ATQRC.exe File created C:\windows\SysWOW64\VNGJRZN.exe.bat XSHB.exe File opened for modification C:\windows\SysWOW64\LZFPBE.exe GZYB.exe File opened for modification C:\windows\SysWOW64\EYLFV.exe ROUGHHR.exe File opened for modification C:\windows\SysWOW64\DYZIV.exe DVVFHY.exe File created C:\windows\SysWOW64\PQOTE.exe.bat DYZIV.exe File opened for modification C:\windows\SysWOW64\WOLBIXQ.exe HTCW.exe File created C:\windows\SysWOW64\ZYZJKY.exe.bat MAZXIUV.exe File opened for modification C:\windows\SysWOW64\ENPWLI.exe EKLT.exe File created C:\windows\SysWOW64\GGHAHJ.exe ATQRC.exe File created C:\windows\SysWOW64\VJY.exe GGHAHJ.exe File created C:\windows\SysWOW64\YLXWEO.exe.bat IVWWY.exe File created C:\windows\SysWOW64\YNFGPZ.exe UFZGDG.exe File created C:\windows\SysWOW64\MXKOO.exe.bat SKF.exe File opened for modification C:\windows\SysWOW64\KUJ.exe KRFA.exe File opened for modification C:\windows\SysWOW64\HLNZBW.exe DDGZPE.exe File created C:\windows\SysWOW64\CFCRCWJ.exe RPVRQ.exe File created C:\windows\SysWOW64\CKUGGUO.exe KHQ.exe File created C:\windows\SysWOW64\YKMN.exe JULNNJ.exe File opened for modification C:\windows\SysWOW64\WTWA.exe CYR.exe File created C:\windows\SysWOW64\XQWN.exe TAHNUE.exe File created C:\windows\SysWOW64\ANSR.exe LSBFTU.exe File created C:\windows\SysWOW64\XSHB.exe.bat CFCRCWJ.exe File created C:\windows\SysWOW64\ZKWVXWX.exe.bat EWRMN.exe File opened for modification C:\windows\SysWOW64\ROUGHHR.exe BYT.exe File created C:\windows\SysWOW64\KUJ.exe KRFA.exe File created C:\windows\SysWOW64\TPNTM.exe ZBI.exe File created C:\windows\SysWOW64\ZUJIK.exe.bat BWQFXG.exe File opened for modification C:\windows\SysWOW64\LZHN.exe WEYBMG.exe File created C:\windows\SysWOW64\QXJDQ.exe ISEXF.exe File created C:\windows\SysWOW64\KUJ.exe.bat KRFA.exe File created C:\windows\SysWOW64\IVWWY.exe ENPWLI.exe File created C:\windows\SysWOW64\KHQ.exe.bat GZJCPM.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\LVUDIHS.exe YKMN.exe File opened for modification C:\windows\system\VVURFD.exe BAPHV.exe File created C:\windows\system\VVURFD.exe.bat BAPHV.exe File created C:\windows\system\PUOCLYJ.exe UZJSJ.exe File created C:\windows\system\JLAUPH.exe.bat OPVL.exe File created C:\windows\QAN.exe QXJDQ.exe File created C:\windows\WLS.exe.bat ANSR.exe File created C:\windows\LVUDIHS.exe.bat YKMN.exe File opened for modification C:\windows\system\PWHTAWF.exe YNFGPZ.exe File opened for modification C:\windows\system\IHQVF.exe IUQH.exe File created C:\windows\KABS.exe KUJ.exe File created C:\windows\GLSJDXA.exe KABS.exe File created C:\windows\GLSJDXA.exe.bat KABS.exe File opened for modification C:\windows\UKJOCNH.exe WMQL.exe File created C:\windows\system\JRIJZ.exe.bat VTIYPQB.exe File created C:\windows\GZYB.exe WZEOOEK.exe File created C:\windows\system\PWHTAWF.exe.bat YNFGPZ.exe File created C:\windows\system\TAHNUE.exe YNCE.exe File created C:\windows\system\IRRPY.exe.bat VTRDWLJ.exe File opened for modification C:\windows\LSBFTU.exe SPXJN.exe File created C:\windows\DWGRN.exe JBBI.exe File created C:\windows\GZJCPM.exe YLXWEO.exe File created C:\windows\system\SKF.exe XOAVBM.exe File opened for modification C:\windows\system\SKF.exe XOAVBM.exe File opened for modification C:\windows\BYT.exe MDKDPY.exe File created C:\windows\YRW.exe OTIN.exe File opened for modification C:\windows\MRYM.exe JETDOPL.exe File created C:\windows\system\MDKDPY.exe MXKOO.exe File created C:\windows\system\GURCXUG.exe SZNKKX.exe File opened for modification C:\windows\system\ISEXF.exe GURCXUG.exe File created C:\windows\ABZDALB.exe WLS.exe File created C:\windows\KABS.exe.bat KUJ.exe File created C:\windows\system\UDZEEE.exe VNGJRZN.exe File created C:\windows\OQQSJ.exe XQWN.exe File opened for modification C:\windows\YRW.exe OTIN.exe File opened for modification C:\windows\system\VTRDWLJ.exe NGFWLMO.exe File created C:\windows\WLS.exe ANSR.exe File opened for modification C:\windows\ABDSVX.exe IIH.exe File opened for modification C:\windows\system\BAPHV.exe LFGDCRQ.exe File created C:\windows\system\VVURFD.exe BAPHV.exe File opened for modification C:\windows\QSY.exe ZKWVXWX.exe File opened for modification C:\windows\XKZAEG.exe AJRMV.exe File opened for modification C:\windows\HTCW.exe OQQSJ.exe File created C:\windows\ABZDALB.exe.bat WLS.exe File created C:\windows\PLUOO.exe GLSJDXA.exe File created C:\windows\ATQRC.exe.bat WDBRQVW.exe File created C:\windows\BWQFXG.exe VJY.exe File created C:\windows\system\DDGZPE.exe QSY.exe File created C:\windows\system\DDGZPE.exe.bat QSY.exe File created C:\windows\XKZAEG.exe.bat AJRMV.exe File created C:\windows\LYBCC.exe AIIC.exe File opened for modification C:\windows\system\IRRPY.exe VTRDWLJ.exe File created C:\windows\system\DVVFHY.exe IHQVF.exe File opened for modification C:\windows\JULNNJ.exe ZUJIK.exe File created C:\windows\system\RPVRQ.exe HOTM.exe File created C:\windows\system\WEYBMG.exe BITS.exe File created C:\windows\ZPTKLH.exe.bat HMIOFJB.exe File opened for modification C:\windows\PLHIYB.exe JLAUPH.exe File created C:\windows\MRYM.exe JETDOPL.exe File opened for modification C:\windows\GLSJDXA.exe KABS.exe File created C:\windows\PLUOO.exe.bat GLSJDXA.exe File opened for modification C:\windows\system\WMQL.exe QZRKDE.exe File created C:\windows\system\EKLT.exe UKJOCNH.exe File opened for modification C:\windows\system\HOTM.exe JRIJZ.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2360 cmd.exe 1428 cmd.exe 2696 cmd.exe 2776 cmd.exe 5688 cmd.exe 6912 cmd.exe 5360 cmd.exe 2868 cmd.exe 2656 cmd.exe 5480 cmd.exe 6088 cmd.exe 928 cmd.exe 2520 cmd.exe 4892 cmd.exe 3916 cmd.exe 3744 cmd.exe 3592 cmd.exe 4620 cmd.exe 4420 cmd.exe 2732 cmd.exe 3760 cmd.exe 6628 cmd.exe 6300 cmd.exe 7088 cmd.exe 5372 cmd.exe 6952 cmd.exe 4368 cmd.exe 6512 cmd.exe 6232 cmd.exe 6956 cmd.exe 5428 cmd.exe 6860 cmd.exe 2196 cmd.exe 5816 cmd.exe 5068 cmd.exe 4804 cmd.exe 700 cmd.exe 2628 cmd.exe 5876 cmd.exe 3456 cmd.exe 2288 cmd.exe 4360 cmd.exe 6392 cmd.exe 4480 cmd.exe 5084 cmd.exe 4384 cmd.exe 3272 cmd.exe 3188 cmd.exe 4536 cmd.exe 5896 cmd.exe 5980 cmd.exe 6936 cmd.exe 6124 cmd.exe 5488 cmd.exe 4544 cmd.exe 6220 cmd.exe 3312 cmd.exe 1692 cmd.exe 1340 cmd.exe 6368 cmd.exe 3036 cmd.exe 5376 cmd.exe 6296 cmd.exe 6104 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 1924 4528 WerFault.exe 88 1692 6208 WerFault.exe 94 4688 6096 WerFault.exe 100 2072 2480 WerFault.exe 105 2984 2564 WerFault.exe 110 6828 1012 WerFault.exe 115 248 1348 WerFault.exe 120 7028 3116 WerFault.exe 125 6104 2512 WerFault.exe 130 6836 4872 WerFault.exe 135 3536 1412 WerFault.exe 140 796 6816 WerFault.exe 145 1104 6216 WerFault.exe 150 3140 3376 WerFault.exe 155 6888 2852 WerFault.exe 160 6280 2152 WerFault.exe 165 6528 4064 WerFault.exe 170 3180 6476 WerFault.exe 175 4688 5892 WerFault.exe 180 3312 4124 WerFault.exe 184 920 2428 WerFault.exe 190 6936 628 WerFault.exe 195 256 1216 WerFault.exe 200 2468 4716 WerFault.exe 205 3152 2356 WerFault.exe 210 6400 4808 WerFault.exe 215 2392 5032 WerFault.exe 220 5744 3244 WerFault.exe 225 2756 1080 WerFault.exe 230 6928 3316 WerFault.exe 235 6620 5108 WerFault.exe 240 4760 2348 WerFault.exe 245 6608 2736 WerFault.exe 250 4580 5136 WerFault.exe 255 904 4680 WerFault.exe 260 5528 6540 WerFault.exe 265 1776 1952 WerFault.exe 270 5200 1316 WerFault.exe 276 6036 4212 WerFault.exe 281 2012 2880 WerFault.exe 286 5668 6212 WerFault.exe 291 4176 3240 WerFault.exe 296 3892 6940 WerFault.exe 301 1708 5752 WerFault.exe 306 6928 4292 WerFault.exe 311 3840 5604 WerFault.exe 316 6824 6240 WerFault.exe 321 6932 200 WerFault.exe 326 7120 1812 WerFault.exe 331 5632 3848 WerFault.exe 336 4592 3780 WerFault.exe 341 4400 6800 WerFault.exe 346 6388 2340 WerFault.exe 351 4892 260 WerFault.exe 356 6848 6032 WerFault.exe 361 2944 7056 WerFault.exe 366 3940 5496 WerFault.exe 371 7024 4468 WerFault.exe 376 7008 3492 WerFault.exe 381 6884 2296 WerFault.exe 386 3640 4496 WerFault.exe 391 6824 4564 WerFault.exe 396 6392 6312 WerFault.exe 401 1692 3224 WerFault.exe 406 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HOTM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BITS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IRRPY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SKF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LHENARM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SPXJN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KRFA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JULNNJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MAZXIUV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QAN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WMQL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GGHAHJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZYZJKY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WEYBMG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HLNZBW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PLHIYB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WOLBIXQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PUOCLYJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DVVFHY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ABDSVX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IIH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANSR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EKLT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WTWA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ENPWLI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZPTKLH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WZEOOEK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UZJSJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XOAVBM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IUQH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EWRMN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CYR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JLAUPH.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4528 2026-07-28_0b485325c7952de186cd1e79e24c82e4_elex_emotet_stop.exe 4528 2026-07-28_0b485325c7952de186cd1e79e24c82e4_elex_emotet_stop.exe 6208 IIH.exe 6208 IIH.exe 6096 ABDSVX.exe 6096 ABDSVX.exe 2480 QZRKDE.exe 2480 QZRKDE.exe 2564 WMQL.exe 2564 WMQL.exe 1012 UKJOCNH.exe 1012 UKJOCNH.exe 1348 EKLT.exe 1348 EKLT.exe 3116 ENPWLI.exe 3116 ENPWLI.exe 2512 IVWWY.exe 2512 IVWWY.exe 4872 YLXWEO.exe 4872 YLXWEO.exe 1412 GZJCPM.exe 1412 GZJCPM.exe 6816 KHQ.exe 6816 KHQ.exe 6216 CKUGGUO.exe 6216 CKUGGUO.exe 3376 WDBRQVW.exe 3376 WDBRQVW.exe 2852 ATQRC.exe 2852 ATQRC.exe 2152 GGHAHJ.exe 2152 GGHAHJ.exe 4064 VJY.exe 4064 VJY.exe 6476 BWQFXG.exe 6476 BWQFXG.exe 5892 ZUJIK.exe 5892 ZUJIK.exe 4124 JULNNJ.exe 4124 JULNNJ.exe 2428 YKMN.exe 2428 YKMN.exe 628 LVUDIHS.exe 628 LVUDIHS.exe 1216 VTIYPQB.exe 1216 VTIYPQB.exe 4716 JRIJZ.exe 4716 JRIJZ.exe 2356 HOTM.exe 2356 HOTM.exe 4808 RPVRQ.exe 4808 RPVRQ.exe 5032 CFCRCWJ.exe 5032 CFCRCWJ.exe 3244 XSHB.exe 3244 XSHB.exe 1080 VNGJRZN.exe 1080 VNGJRZN.exe 3316 UDZEEE.exe 3316 UDZEEE.exe 5108 WZEOOEK.exe 5108 WZEOOEK.exe 2348 GZYB.exe 2348 GZYB.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4528 2026-07-28_0b485325c7952de186cd1e79e24c82e4_elex_emotet_stop.exe 4528 2026-07-28_0b485325c7952de186cd1e79e24c82e4_elex_emotet_stop.exe 6208 IIH.exe 6208 IIH.exe 6096 ABDSVX.exe 6096 ABDSVX.exe 2480 QZRKDE.exe 2480 QZRKDE.exe 2564 WMQL.exe 2564 WMQL.exe 1012 UKJOCNH.exe 1012 UKJOCNH.exe 1348 EKLT.exe 1348 EKLT.exe 3116 ENPWLI.exe 3116 ENPWLI.exe 2512 IVWWY.exe 2512 IVWWY.exe 4872 YLXWEO.exe 4872 YLXWEO.exe 1412 GZJCPM.exe 1412 GZJCPM.exe 6816 KHQ.exe 6816 KHQ.exe 6216 CKUGGUO.exe 6216 CKUGGUO.exe 3376 WDBRQVW.exe 3376 WDBRQVW.exe 2852 ATQRC.exe 2852 ATQRC.exe 2152 GGHAHJ.exe 2152 GGHAHJ.exe 4064 VJY.exe 4064 VJY.exe 6476 BWQFXG.exe 6476 BWQFXG.exe 5892 ZUJIK.exe 5892 ZUJIK.exe 4124 JULNNJ.exe 4124 JULNNJ.exe 2428 YKMN.exe 2428 YKMN.exe 628 LVUDIHS.exe 628 LVUDIHS.exe 1216 VTIYPQB.exe 1216 VTIYPQB.exe 4716 JRIJZ.exe 4716 JRIJZ.exe 2356 HOTM.exe 2356 HOTM.exe 4808 RPVRQ.exe 4808 RPVRQ.exe 5032 CFCRCWJ.exe 5032 CFCRCWJ.exe 3244 XSHB.exe 3244 XSHB.exe 1080 VNGJRZN.exe 1080 VNGJRZN.exe 3316 UDZEEE.exe 3316 UDZEEE.exe 5108 WZEOOEK.exe 5108 WZEOOEK.exe 2348 GZYB.exe 2348 GZYB.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4528 wrote to memory of 4960 4528 2026-07-28_0b485325c7952de186cd1e79e24c82e4_elex_emotet_stop.exe 90 PID 4960 wrote to memory of 6208 4960 cmd.exe 94 PID 6208 wrote to memory of 4368 6208 IIH.exe 96 PID 4368 wrote to memory of 6096 4368 cmd.exe 100 PID 6096 wrote to memory of 3188 6096 ABDSVX.exe 101 PID 3188 wrote to memory of 2480 3188 cmd.exe 105 PID 2480 wrote to memory of 1740 2480 QZRKDE.exe 106 PID 1740 wrote to memory of 2564 1740 cmd.exe 110 PID 2564 wrote to memory of 5516 2564 WMQL.exe 111 PID 5516 wrote to memory of 1012 5516 cmd.exe 115 PID 1012 wrote to memory of 1912 1012 UKJOCNH.exe 116 PID 1912 wrote to memory of 1348 1912 cmd.exe 120 PID 1348 wrote to memory of 1208 1348 EKLT.exe 121 PID 1208 wrote to memory of 3116 1208 cmd.exe 125 PID 3116 wrote to memory of 5016 3116 ENPWLI.exe 126 PID 5016 wrote to memory of 2512 5016 cmd.exe 130 PID 2512 wrote to memory of 4536 2512 IVWWY.exe 131 PID 4536 wrote to memory of 4872 4536 cmd.exe 135 PID 4872 wrote to memory of 3048 4872 YLXWEO.exe 136 PID 3048 wrote to memory of 1412 3048 cmd.exe 140 PID 1412 wrote to memory of 6736 1412 GZJCPM.exe 141 PID 6736 wrote to memory of 6816 6736 cmd.exe 145 PID 6816 wrote to memory of 6976 6816 KHQ.exe 146 PID 6976 wrote to memory of 6216 6976 cmd.exe 150 PID 6216 wrote to memory of 5208 6216 CKUGGUO.exe 151 PID 5208 wrote to memory of 3376 5208 cmd.exe 155 PID 3376 wrote to memory of 4544 3376 WDBRQVW.exe 156 PID 4544 wrote to memory of 2852 4544 cmd.exe 160 PID 2852 wrote to memory of 2420 2852 ATQRC.exe 161 PID 2420 wrote to memory of 2152 2420 cmd.exe 165 PID 2152 wrote to memory of 5896 2152 GGHAHJ.exe 166 PID 5896 wrote to memory of 4064 5896 cmd.exe 170 PID 4064 wrote to memory of 6792 4064 VJY.exe 171 PID 6792 wrote to memory of 6476 6792 cmd.exe 175 PID 6476 wrote to memory of 1096 6476 BWQFXG.exe 176 PID 1096 wrote to memory of 5892 1096 cmd.exe 180 PID 5892 wrote to memory of 6080 5892 ZUJIK.exe 181 PID 6080 wrote to memory of 4124 6080 cmd.exe 184 PID 4124 wrote to memory of 2776 4124 JULNNJ.exe 186 PID 2776 wrote to memory of 2428 2776 cmd.exe 190 PID 2428 wrote to memory of 6268 2428 YKMN.exe 191 PID 6268 wrote to memory of 628 6268 cmd.exe 195 PID 628 wrote to memory of 5068 628 LVUDIHS.exe 196 PID 5068 wrote to memory of 1216 5068 cmd.exe 200 PID 1216 wrote to memory of 1108 1216 VTIYPQB.exe 201 PID 1108 wrote to memory of 4716 1108 cmd.exe 205 PID 4716 wrote to memory of 4188 4716 JRIJZ.exe 206 PID 4188 wrote to memory of 2356 4188 cmd.exe 210 PID 2356 wrote to memory of 5360 2356 HOTM.exe 211 PID 5360 wrote to memory of 4808 5360 cmd.exe 215 PID 4808 wrote to memory of 1452 4808 RPVRQ.exe 216 PID 1452 wrote to memory of 5032 1452 cmd.exe 220 PID 5032 wrote to memory of 6512 5032 CFCRCWJ.exe 221 PID 6512 wrote to memory of 3244 6512 cmd.exe 225 PID 3244 wrote to memory of 7088 3244 XSHB.exe 226 PID 7088 wrote to memory of 1080 7088 cmd.exe 230 PID 1080 wrote to memory of 6572 1080 VNGJRZN.exe 231 PID 6572 wrote to memory of 3316 6572 cmd.exe 235 PID 3316 wrote to memory of 4588 3316 UDZEEE.exe 236 PID 4588 wrote to memory of 5108 4588 cmd.exe 240 PID 5108 wrote to memory of 3096 5108 WZEOOEK.exe 241 PID 3096 wrote to memory of 2348 3096 cmd.exe 245 PID 2348 wrote to memory of 2864 2348 GZYB.exe 246 PID 2864 wrote to memory of 2736 2864 cmd.exe 250
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-28_0b485325c7952de186cd1e79e24c82e4_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-28_0b485325c7952de186cd1e79e24c82e4_elex_emotet_stop.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IIH.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\windows\IIH.exeC:\windows\IIH.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ABDSVX.exe.bat" "4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\windows\ABDSVX.exeC:\windows\ABDSVX.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6096 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QZRKDE.exe.bat" "6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\windows\system\QZRKDE.exeC:\windows\system\QZRKDE.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WMQL.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\windows\system\WMQL.exeC:\windows\system\WMQL.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UKJOCNH.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:5516 -
C:\windows\UKJOCNH.exeC:\windows\UKJOCNH.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EKLT.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\windows\system\EKLT.exeC:\windows\system\EKLT.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ENPWLI.exe.bat" "14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\windows\SysWOW64\ENPWLI.exeC:\windows\system32\ENPWLI.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IVWWY.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\windows\SysWOW64\IVWWY.exeC:\windows\system32\IVWWY.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YLXWEO.exe.bat" "18⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\windows\SysWOW64\YLXWEO.exeC:\windows\system32\YLXWEO.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GZJCPM.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\windows\GZJCPM.exeC:\windows\GZJCPM.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KHQ.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:6736 -
C:\windows\SysWOW64\KHQ.exeC:\windows\system32\KHQ.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CKUGGUO.exe.bat" "24⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6976 -
C:\windows\SysWOW64\CKUGGUO.exeC:\windows\system32\CKUGGUO.exe25⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6216 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WDBRQVW.exe.bat" "26⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5208 -
C:\windows\WDBRQVW.exeC:\windows\WDBRQVW.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ATQRC.exe.bat" "28⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\windows\ATQRC.exeC:\windows\ATQRC.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GGHAHJ.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\windows\SysWOW64\GGHAHJ.exeC:\windows\system32\GGHAHJ.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VJY.exe.bat" "32⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5896 -
C:\windows\SysWOW64\VJY.exeC:\windows\system32\VJY.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BWQFXG.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:6792 -
C:\windows\BWQFXG.exeC:\windows\BWQFXG.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZUJIK.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\windows\SysWOW64\ZUJIK.exeC:\windows\system32\ZUJIK.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5892 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JULNNJ.exe.bat" "38⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6080 -
C:\windows\JULNNJ.exeC:\windows\JULNNJ.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YKMN.exe.bat" "40⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\windows\SysWOW64\YKMN.exeC:\windows\system32\YKMN.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LVUDIHS.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:6268 -
C:\windows\LVUDIHS.exeC:\windows\LVUDIHS.exe43⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:628 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VTIYPQB.exe.bat" "44⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\windows\system\VTIYPQB.exeC:\windows\system\VTIYPQB.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JRIJZ.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\windows\system\JRIJZ.exeC:\windows\system\JRIJZ.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HOTM.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\windows\system\HOTM.exeC:\windows\system\HOTM.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RPVRQ.exe.bat" "50⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5360 -
C:\windows\system\RPVRQ.exeC:\windows\system\RPVRQ.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CFCRCWJ.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\windows\SysWOW64\CFCRCWJ.exeC:\windows\system32\CFCRCWJ.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XSHB.exe.bat" "54⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6512 -
C:\windows\SysWOW64\XSHB.exeC:\windows\system32\XSHB.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VNGJRZN.exe.bat" "56⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:7088 -
C:\windows\SysWOW64\VNGJRZN.exeC:\windows\system32\VNGJRZN.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UDZEEE.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:6572 -
C:\windows\system\UDZEEE.exeC:\windows\system\UDZEEE.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WZEOOEK.exe.bat" "60⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\windows\SysWOW64\WZEOOEK.exeC:\windows\system32\WZEOOEK.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GZYB.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\windows\GZYB.exeC:\windows\GZYB.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LZFPBE.exe.bat" "64⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\windows\SysWOW64\LZFPBE.exeC:\windows\system32\LZFPBE.exe65⤵
- Executes dropped EXE
PID:2736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LFGDCRQ.exe.bat" "66⤵PID:3856
-
C:\windows\LFGDCRQ.exeC:\windows\LFGDCRQ.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5136 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BAPHV.exe.bat" "68⤵PID:4084
-
C:\windows\system\BAPHV.exeC:\windows\system\BAPHV.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4680 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VVURFD.exe.bat" "70⤵
- Executes a command shell one-liner
PID:4804 -
C:\windows\system\VVURFD.exeC:\windows\system\VVURFD.exe71⤵
- Executes dropped EXE
PID:6540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BITS.exe.bat" "72⤵
- System Location Discovery: System Language Discovery
PID:7152 -
C:\windows\system\BITS.exeC:\windows\system\BITS.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WEYBMG.exe.bat" "74⤵PID:4964
-
C:\windows\system\WEYBMG.exeC:\windows\system\WEYBMG.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1316 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LZHN.exe.bat" "76⤵
- Executes a command shell one-liner
PID:6296 -
C:\windows\SysWOW64\LZHN.exeC:\windows\system32\LZHN.exe77⤵
- Executes dropped EXE
PID:4212 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UZJSJ.exe.bat" "78⤵
- Executes a command shell one-liner
PID:5980 -
C:\windows\SysWOW64\UZJSJ.exeC:\windows\system32\UZJSJ.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PUOCLYJ.exe.bat" "80⤵
- Executes a command shell one-liner
PID:5480 -
C:\windows\system\PUOCLYJ.exeC:\windows\system\PUOCLYJ.exe81⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6212 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SITL.exe.bat" "82⤵
- System Location Discovery: System Language Discovery
PID:4628 -
C:\windows\SITL.exeC:\windows\SITL.exe83⤵
- Executes dropped EXE
PID:3240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UFZGDG.exe.bat" "84⤵PID:4156
-
C:\windows\UFZGDG.exeC:\windows\UFZGDG.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YNFGPZ.exe.bat" "86⤵PID:7116
-
C:\windows\SysWOW64\YNFGPZ.exeC:\windows\system32\YNFGPZ.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PWHTAWF.exe.bat" "88⤵
- Executes a command shell one-liner
PID:6220 -
C:\windows\system\PWHTAWF.exeC:\windows\system\PWHTAWF.exe89⤵
- Executes dropped EXE
PID:4292 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YWJ.exe.bat" "90⤵
- Executes a command shell one-liner
PID:5688 -
C:\windows\system\YWJ.exeC:\windows\system\YWJ.exe91⤵
- Executes dropped EXE
PID:5604 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EWRMN.exe.bat" "92⤵
- System Location Discovery: System Language Discovery
PID:2788 -
C:\windows\system\EWRMN.exeC:\windows\system\EWRMN.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:6240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZKWVXWX.exe.bat" "94⤵PID:4380
-
C:\windows\SysWOW64\ZKWVXWX.exeC:\windows\system32\ZKWVXWX.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QSY.exe.bat" "96⤵PID:6608
-
C:\windows\QSY.exeC:\windows\QSY.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DDGZPE.exe.bat" "98⤵PID:5184
-
C:\windows\system\DDGZPE.exeC:\windows\system\DDGZPE.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HLNZBW.exe.bat" "100⤵PID:5472
-
C:\windows\SysWOW64\HLNZBW.exeC:\windows\system32\HLNZBW.exe101⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CYR.exe.bat" "102⤵
- Executes a command shell one-liner
PID:3312 -
C:\windows\system\CYR.exeC:\windows\system\CYR.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:6800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WTWA.exe.bat" "104⤵
- Executes a command shell one-liner
PID:4420 -
C:\windows\SysWOW64\WTWA.exeC:\windows\system32\WTWA.exe105⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2340 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XOAVBM.exe.bat" "106⤵
- Executes a command shell one-liner
PID:6936 -
C:\windows\SysWOW64\XOAVBM.exeC:\windows\system32\XOAVBM.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SKF.exe.bat" "108⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:6124 -
C:\windows\system\SKF.exeC:\windows\system\SKF.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:6032 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MXKOO.exe.bat" "110⤵
- System Location Discovery: System Language Discovery
PID:6732 -
C:\windows\SysWOW64\MXKOO.exeC:\windows\system32\MXKOO.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:7056 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MDKDPY.exe.bat" "112⤵
- System Location Discovery: System Language Discovery
PID:1900 -
C:\windows\system\MDKDPY.exeC:\windows\system\MDKDPY.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BYT.exe.bat" "114⤵
- Executes a command shell one-liner
PID:4360 -
C:\windows\BYT.exeC:\windows\BYT.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ROUGHHR.exe.bat" "116⤵
- System Location Discovery: System Language Discovery
PID:5312 -
C:\windows\SysWOW64\ROUGHHR.exeC:\windows\system32\ROUGHHR.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EYLFV.exe.bat" "118⤵PID:2452
-
C:\windows\SysWOW64\EYLFV.exeC:\windows\system32\EYLFV.exe119⤵
- Executes dropped EXE
PID:2296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HMIOFJB.exe.bat" "120⤵
- Executes a command shell one-liner
PID:5488 -
C:\windows\system\HMIOFJB.exeC:\windows\system\HMIOFJB.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4496
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-