Analysis
- max time kernel
88s - max time network
133s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
28/07/2026, 18:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-28_5a417620948b4d7dacae12a7dca8a7e7_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-07-28_5a417620948b4d7dacae12a7dca8a7e7_elex_emotet_stop.exe
- Size 208KB
- Sample260728-xflltsvvft
- SHA256 e7d3c687c9ec5b36c102ab86d2991ec52c9dad89128005eda717caf9ae59d211
- MD5 5a417620948b4d7dacae12a7dca8a7e7
- SHA1 e72f4c97fe173d958e5297520a6b364f9b1b13b5
- SHA512 8fce27667a4147f37a4004eafa157d7122f546eda9f531a04dcd16bc85080bd4517297864e6f18c2a2488f7c6b84dfef7bc8c416cf97c83918b1124fee966324
- SSDEEP 3072:cLQaL9tbLkRIgd1Lye9yjE2hWAN5XbslcdL+LOfN4pLthEjQT6j:olZtbLWIgd1LZ9oECZbslc5+LO1kEj1
- TLSH T1B9247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1428 IIGY.exe 4576 RGAZ.exe 6412 LTFIDR.exe 4772 VBHNGPL.exe 924 ACOB.exe 1788 QSP.exe 5816 DCYZKP.exe 4600 UDAEVVZ.exe 1064 ADHS.exe 3436 ETOSRH.exe 5944 UJPRP.exe 6624 DJRWBA.exe 6012 XXW.exe 1232 SKBPN.exe 2096 HNK.exe 1244 GYNKHAN.exe 6224 ZQCVYTD.exe 4744 XMC.exe 1376 DMJRM.exe 1632 YXS.exe 4636 GFTHZX.exe 4976 CKYEOH.exe 6592 EISYMW.exe 3780 MBAAAID.exe 4256 KTIO.exe 1892 VMLGS.exe 5084 HEGZAZ.exe 6504 OXPTODQ.exe 6128 QFQWAEM.exe 6204 DQU.exe 5020 RTQBKMK.exe 2992 RGR.exe 3336 HWP.exe 2724 PHYUL.exe 5908 JCDDVXX.exe 6992 TCF.exe 4292 KDHN.exe 6488 MAMI.exe 3812 BDWMDVL.exe 3404 CYIQ.exe 1032 EWN.exe 6540 KSML.exe 6336 OIT.exe 1336 UIBZ.exe 556 UNBN.exe 4344 SDMQM.exe 624 ITNHTX.exe 264 CHS.exe 6324 UPUE.exe 1104 XXBE.exe 1800 BNHEXE.exe 3360 WAM.exe 2576 HTPG.exe 2612 WOYSAYN.exe 2908 WBZ.exe 3192 QUUA.exe 6136 OUBN.exe 3448 TVJBKP.exe 5972 AIIC.exe 4936 UVNLRS.exe 1016 PQS.exe 4628 GWC.exe 7128 ROFGS.exe 5900 ZEG.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\QCDZOC.exe.bat FKAG.exe File opened for modification C:\windows\SysWOW64\CYIQ.exe BDWMDVL.exe File opened for modification C:\windows\SysWOW64\WBZ.exe WOYSAYN.exe File created C:\windows\SysWOW64\QUUA.exe.bat WBZ.exe File opened for modification C:\windows\SysWOW64\TVJBKP.exe OUBN.exe File created C:\windows\SysWOW64\TVJBKP.exe.bat OUBN.exe File created C:\windows\SysWOW64\FCTZQMG.exe.bat EZPDDW.exe File opened for modification C:\windows\SysWOW64\ZVQXC.exe OCVE.exe File opened for modification C:\windows\SysWOW64\HPJB.exe AZTELPL.exe File created C:\windows\SysWOW64\IIGY.exe 2026-07-28_5a417620948b4d7dacae12a7dca8a7e7_elex_emotet_stop.exe File opened for modification C:\windows\SysWOW64\LTFIDR.exe RGAZ.exe File created C:\windows\SysWOW64\TSD.exe NSWRQB.exe File opened for modification C:\windows\SysWOW64\QCDZOC.exe FKAG.exe File opened for modification C:\windows\SysWOW64\DFZXT.exe QCDZOC.exe File created C:\windows\SysWOW64\DRP.exe.bat TRNUTJA.exe File created C:\windows\SysWOW64\HEGZAZ.exe VMLGS.exe File created C:\windows\SysWOW64\LTFIDR.exe.bat RGAZ.exe File created C:\windows\SysWOW64\DQU.exe.bat QFQWAEM.exe File opened for modification C:\windows\SysWOW64\TCF.exe JCDDVXX.exe File opened for modification C:\windows\SysWOW64\FVEMOE.exe AVWY.exe File created C:\windows\SysWOW64\OCVE.exe.bat FCTZQMG.exe File created C:\windows\SysWOW64\ZVQXC.exe.bat OCVE.exe File created C:\windows\SysWOW64\AAHNYVW.exe.bat VAZZP.exe File created C:\windows\SysWOW64\WOYSAYN.exe HTPG.exe File created C:\windows\SysWOW64\WOYSAYN.exe.bat HTPG.exe File created C:\windows\SysWOW64\VAZZP.exe ANC.exe File opened for modification C:\windows\SysWOW64\AAHNYVW.exe VAZZP.exe File created C:\windows\SysWOW64\BNHEXE.exe.bat XXBE.exe File opened for modification C:\windows\SysWOW64\QUUA.exe WBZ.exe File opened for modification C:\windows\SysWOW64\IYSBLB.exe NDNS.exe File created C:\windows\SysWOW64\IYSBLB.exe.bat NDNS.exe File created C:\windows\SysWOW64\UDAEVVZ.exe.bat DCYZKP.exe File created C:\windows\SysWOW64\MBAAAID.exe EISYMW.exe File opened for modification C:\windows\SysWOW64\DQU.exe QFQWAEM.exe File opened for modification C:\windows\SysWOW64\FCTZQMG.exe EZPDDW.exe File opened for modification C:\windows\SysWOW64\YBO.exe VLZKRO.exe File created C:\windows\SysWOW64\HPJB.exe AZTELPL.exe File opened for modification C:\windows\SysWOW64\VAZZP.exe ANC.exe File created C:\windows\SysWOW64\UVNLRS.exe AIIC.exe File opened for modification C:\windows\SysWOW64\UDAEVVZ.exe DCYZKP.exe File opened for modification C:\windows\SysWOW64\MBAAAID.exe EISYMW.exe File created C:\windows\SysWOW64\OCVE.exe FCTZQMG.exe File opened for modification C:\windows\SysWOW64\TYWT.exe TSD.exe File created C:\windows\SysWOW64\QCDZOC.exe FKAG.exe File created C:\windows\SysWOW64\DFZXT.exe.bat QCDZOC.exe File opened for modification C:\windows\SysWOW64\IIGY.exe 2026-07-28_5a417620948b4d7dacae12a7dca8a7e7_elex_emotet_stop.exe File created C:\windows\SysWOW64\SKBPN.exe.bat XXW.exe File created C:\windows\SysWOW64\GYNKHAN.exe.bat HNK.exe File created C:\windows\SysWOW64\HEGZAZ.exe.bat VMLGS.exe File created C:\windows\SysWOW64\BNHEXE.exe XXBE.exe File opened for modification C:\windows\SysWOW64\EZPDDW.exe PEY.exe File created C:\windows\SysWOW64\HPJB.exe.bat AZTELPL.exe File created C:\windows\SysWOW64\DRP.exe TRNUTJA.exe File created C:\windows\SysWOW64\ACOB.exe.bat VBHNGPL.exe File opened for modification C:\windows\SysWOW64\HEGZAZ.exe VMLGS.exe File created C:\windows\SysWOW64\TCF.exe JCDDVXX.exe File created C:\windows\SysWOW64\WBZ.exe WOYSAYN.exe File created C:\windows\SysWOW64\VAZZP.exe.bat ANC.exe File created C:\windows\SysWOW64\CYIQ.exe.bat BDWMDVL.exe File created C:\windows\SysWOW64\WAM.exe BNHEXE.exe File opened for modification C:\windows\SysWOW64\WAM.exe BNHEXE.exe File created C:\windows\SysWOW64\WAM.exe.bat BNHEXE.exe File created C:\windows\SysWOW64\QUUA.exe WBZ.exe File created C:\windows\SysWOW64\FVEMOE.exe.bat AVWY.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\SOB.exe.bat SAB.exe File created C:\windows\SCNEALU.exe.bat XOIUQL.exe File created C:\windows\system\MHD.exe.bat BPICRTK.exe File opened for modification C:\windows\system\DMJRM.exe XMC.exe File created C:\windows\CHS.exe ITNHTX.exe File created C:\windows\ANC.exe UNV.exe File created C:\windows\system\BUTYTCP.exe.bat VTMKK.exe File created C:\windows\NDNS.exe.bat DFZXT.exe File created C:\windows\system\EISYMW.exe.bat CKYEOH.exe File created C:\windows\system\KTIO.exe.bat MBAAAID.exe File opened for modification C:\windows\BWT.exe LGSATJ.exe File opened for modification C:\windows\ETOSRH.exe ADHS.exe File created C:\windows\system\HNK.exe SKBPN.exe File opened for modification C:\windows\system\KDHN.exe TCF.exe File opened for modification C:\windows\system\VLZKRO.exe DLXF.exe File created C:\windows\EWN.exe.bat CYIQ.exe File opened for modification C:\windows\system\SDMQM.exe UNBN.exe File created C:\windows\system\XXBE.exe.bat UPUE.exe File created C:\windows\QVU.exe.bat BALOI.exe File created C:\windows\QSP.exe.bat ACOB.exe File created C:\windows\YXS.exe.bat DMJRM.exe File created C:\windows\system\TRNUTJA.exe IYSBLB.exe File created C:\windows\RTQBKMK.exe DQU.exe File opened for modification C:\windows\RTQBKMK.exe DQU.exe File created C:\windows\system\OIT.exe KSML.exe File created C:\windows\system\CKNKHT.exe.bat HPJB.exe File created C:\windows\system\MAMI.exe.bat KDHN.exe File created C:\windows\UJPRP.exe ETOSRH.exe File opened for modification C:\windows\system\HNK.exe SKBPN.exe File opened for modification C:\windows\system\HTPG.exe WAM.exe File created C:\windows\SCNEALU.exe XOIUQL.exe File opened for modification C:\windows\system\RLFKYIS.exe AAHNYVW.exe File created C:\windows\system\FKAG.exe BUTYTCP.exe File created C:\windows\OSUST.exe.bat CKNKHT.exe File opened for modification C:\windows\system\UNBN.exe UIBZ.exe File created C:\windows\ANC.exe.bat UNV.exe File opened for modification C:\windows\system\VTMKK.exe RLFKYIS.exe File opened for modification C:\windows\system\BUTYTCP.exe VTMKK.exe File created C:\windows\system\HWP.exe.bat RGR.exe File created C:\windows\system\OHNAE.exe DOKH.exe File opened for modification C:\windows\system\QFQWAEM.exe FINQNXL.exe File created C:\windows\system\OUBN.exe.bat QUUA.exe File created C:\windows\system\OLACKQ.exe TYWT.exe File opened for modification C:\windows\EWN.exe CYIQ.exe File opened for modification C:\windows\UIBZ.exe OIT.exe File created C:\windows\DUIWISJ.exe SCNEALU.exe File opened for modification C:\windows\system\XXW.exe DJRWBA.exe File created C:\windows\system\OXPTODQ.exe.bat HEGZAZ.exe File created C:\windows\OSUST.exe CKNKHT.exe File opened for modification C:\windows\SOB.exe SAB.exe File created C:\windows\system\DJRWBA.exe.bat UJPRP.exe File opened for modification C:\windows\system\PHYUL.exe HWP.exe File created C:\windows\AVWY.exe QVU.exe File created C:\windows\system\XXW.exe DJRWBA.exe File created C:\windows\system\SDMQM.exe UNBN.exe File created C:\windows\system\ZEG.exe.bat ROFGS.exe File opened for modification C:\windows\SCNEALU.exe XOIUQL.exe File opened for modification C:\windows\system\OLACKQ.exe TYWT.exe File created C:\windows\system\OXPTODQ.exe HEGZAZ.exe File created C:\windows\XMC.exe ZQCVYTD.exe File created C:\windows\system\PHYUL.exe.bat HWP.exe File opened for modification C:\windows\system\UPUE.exe CHS.exe File created C:\windows\system\PEY.exe FVEMOE.exe File created C:\windows\DUIWISJ.exe.bat SCNEALU.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4716 cmd.exe 3152 cmd.exe 4148 cmd.exe 6004 cmd.exe 6096 cmd.exe 5776 cmd.exe 948 cmd.exe 4900 cmd.exe 6296 cmd.exe 6328 cmd.exe 708 cmd.exe 6236 cmd.exe 4820 cmd.exe 6640 cmd.exe 2848 cmd.exe 3968 cmd.exe 892 cmd.exe 6956 cmd.exe 2332 cmd.exe 5868 cmd.exe 3056 cmd.exe 5152 cmd.exe 5364 cmd.exe 4956 cmd.exe 236 cmd.exe 2832 cmd.exe 2548 cmd.exe 1816 cmd.exe 2236 cmd.exe 2760 cmd.exe 2308 cmd.exe 604 cmd.exe 4844 cmd.exe 4180 cmd.exe 5684 cmd.exe 4444 cmd.exe 1156 cmd.exe 4092 cmd.exe 4364 cmd.exe 568 cmd.exe 4240 cmd.exe 3048 cmd.exe 996 cmd.exe 4268 cmd.exe 3432 cmd.exe 5376 cmd.exe 4832 cmd.exe 7108 cmd.exe 4244 cmd.exe 5808 cmd.exe 4296 cmd.exe 3040 cmd.exe 6152 cmd.exe 4412 cmd.exe 1248 cmd.exe 1300 cmd.exe 3012 cmd.exe 2732 cmd.exe 5336 cmd.exe 5388 cmd.exe 4480 cmd.exe 2328 cmd.exe 6352 cmd.exe 5956 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 6128 1352 WerFault.exe 88 3448 1428 WerFault.exe 94 5972 4576 WerFault.exe 100 4596 6412 WerFault.exe 105 1016 4772 WerFault.exe 110 6344 924 WerFault.exe 115 2420 1788 WerFault.exe 120 6252 5816 WerFault.exe 125 4784 4600 WerFault.exe 130 892 1064 WerFault.exe 135 6268 3436 WerFault.exe 140 5680 5944 WerFault.exe 145 5776 6624 WerFault.exe 150 6568 6012 WerFault.exe 155 5884 1232 WerFault.exe 160 4872 2096 WerFault.exe 165 2780 1244 WerFault.exe 170 4356 6224 WerFault.exe 175 4692 4744 WerFault.exe 180 7136 1376 WerFault.exe 185 4436 1632 WerFault.exe 190 1092 4636 WerFault.exe 195 5044 4976 WerFault.exe 200 6940 6592 WerFault.exe 205 3728 3780 WerFault.exe 210 2676 4256 WerFault.exe 215 4276 1892 WerFault.exe 220 6744 5084 WerFault.exe 225 2852 6504 WerFault.exe 230 6536 1432 WerFault.exe 235 6200 6128 WerFault.exe 240 1312 6204 WerFault.exe 245 2312 5020 WerFault.exe 250 4540 2992 WerFault.exe 255 3188 3336 WerFault.exe 260 2740 2724 WerFault.exe 265 7096 5908 WerFault.exe 270 7144 6992 WerFault.exe 275 6668 4292 WerFault.exe 280 3856 6488 WerFault.exe 285 2616 3812 WerFault.exe 291 6292 3404 WerFault.exe 296 1688 1032 WerFault.exe 301 4224 6540 WerFault.exe 306 6664 6336 WerFault.exe 311 708 1336 WerFault.exe 316 3984 556 WerFault.exe 321 5672 4344 WerFault.exe 326 2572 624 WerFault.exe 331 5160 264 WerFault.exe 336 1948 6324 WerFault.exe 341 6872 1104 WerFault.exe 346 6668 1800 WerFault.exe 351 2148 3360 WerFault.exe 356 6672 2576 WerFault.exe 361 5808 2612 WerFault.exe 366 6460 2908 WerFault.exe 371 2852 3192 WerFault.exe 376 4900 6136 WerFault.exe 381 2252 3448 WerFault.exe 386 4584 5972 WerFault.exe 391 1452 4936 WerFault.exe 396 2508 1016 WerFault.exe 401 2864 4628 WerFault.exe 406 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CKYEOH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZQCVYTD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KSML.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WAM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OSUST.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VBHNGPL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GYNKHAN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QFQWAEM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HWP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PQS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YBO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VAZZP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OIT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HWBNJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TVJBKP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OXPTODQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DLXF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TRNUTJA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DCYZKP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CYIQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BUTYTCP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DOKH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UPUE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-28_5a417620948b4d7dacae12a7dca8a7e7_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ROFGS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FCTZQMG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KTIO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PEY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DRP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RGAZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XXW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1352 2026-07-28_5a417620948b4d7dacae12a7dca8a7e7_elex_emotet_stop.exe 1352 2026-07-28_5a417620948b4d7dacae12a7dca8a7e7_elex_emotet_stop.exe 1428 IIGY.exe 1428 IIGY.exe 4576 RGAZ.exe 4576 RGAZ.exe 6412 LTFIDR.exe 6412 LTFIDR.exe 4772 VBHNGPL.exe 4772 VBHNGPL.exe 924 ACOB.exe 924 ACOB.exe 1788 QSP.exe 1788 QSP.exe 5816 DCYZKP.exe 5816 DCYZKP.exe 4600 UDAEVVZ.exe 4600 UDAEVVZ.exe 1064 ADHS.exe 1064 ADHS.exe 3436 ETOSRH.exe 3436 ETOSRH.exe 5944 UJPRP.exe 5944 UJPRP.exe 6624 DJRWBA.exe 6624 DJRWBA.exe 6012 XXW.exe 6012 XXW.exe 1232 SKBPN.exe 1232 SKBPN.exe 2096 HNK.exe 2096 HNK.exe 1244 GYNKHAN.exe 1244 GYNKHAN.exe 6224 ZQCVYTD.exe 6224 ZQCVYTD.exe 4744 XMC.exe 4744 XMC.exe 1376 DMJRM.exe 1376 DMJRM.exe 1632 YXS.exe 1632 YXS.exe 4636 GFTHZX.exe 4636 GFTHZX.exe 4976 CKYEOH.exe 4976 CKYEOH.exe 6592 EISYMW.exe 6592 EISYMW.exe 3780 MBAAAID.exe 3780 MBAAAID.exe 4256 KTIO.exe 4256 KTIO.exe 1892 VMLGS.exe 1892 VMLGS.exe 5084 HEGZAZ.exe 5084 HEGZAZ.exe 1432 FINQNXL.exe 1432 FINQNXL.exe 6128 QFQWAEM.exe 6128 QFQWAEM.exe 6204 DQU.exe 6204 DQU.exe 5020 RTQBKMK.exe 5020 RTQBKMK.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1352 2026-07-28_5a417620948b4d7dacae12a7dca8a7e7_elex_emotet_stop.exe 1352 2026-07-28_5a417620948b4d7dacae12a7dca8a7e7_elex_emotet_stop.exe 1428 IIGY.exe 1428 IIGY.exe 4576 RGAZ.exe 4576 RGAZ.exe 6412 LTFIDR.exe 6412 LTFIDR.exe 4772 VBHNGPL.exe 4772 VBHNGPL.exe 924 ACOB.exe 924 ACOB.exe 1788 QSP.exe 1788 QSP.exe 5816 DCYZKP.exe 5816 DCYZKP.exe 4600 UDAEVVZ.exe 4600 UDAEVVZ.exe 1064 ADHS.exe 1064 ADHS.exe 3436 ETOSRH.exe 3436 ETOSRH.exe 5944 UJPRP.exe 5944 UJPRP.exe 6624 DJRWBA.exe 6624 DJRWBA.exe 6012 XXW.exe 6012 XXW.exe 1232 SKBPN.exe 1232 SKBPN.exe 2096 HNK.exe 2096 HNK.exe 1244 GYNKHAN.exe 1244 GYNKHAN.exe 6224 ZQCVYTD.exe 6224 ZQCVYTD.exe 4744 XMC.exe 4744 XMC.exe 1376 DMJRM.exe 1376 DMJRM.exe 1632 YXS.exe 1632 YXS.exe 4636 GFTHZX.exe 4636 GFTHZX.exe 4976 CKYEOH.exe 4976 CKYEOH.exe 6592 EISYMW.exe 6592 EISYMW.exe 3780 MBAAAID.exe 3780 MBAAAID.exe 4256 KTIO.exe 4256 KTIO.exe 1892 VMLGS.exe 1892 VMLGS.exe 5084 HEGZAZ.exe 5084 HEGZAZ.exe 1432 FINQNXL.exe 1432 FINQNXL.exe 6128 QFQWAEM.exe 6128 QFQWAEM.exe 6204 DQU.exe 6204 DQU.exe 5020 RTQBKMK.exe 5020 RTQBKMK.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1352 wrote to memory of 3664 1352 2026-07-28_5a417620948b4d7dacae12a7dca8a7e7_elex_emotet_stop.exe 90 PID 3664 wrote to memory of 1428 3664 cmd.exe 94 PID 1428 wrote to memory of 1816 1428 IIGY.exe 96 PID 1816 wrote to memory of 4576 1816 cmd.exe 100 PID 4576 wrote to memory of 2604 4576 RGAZ.exe 101 PID 2604 wrote to memory of 6412 2604 cmd.exe 105 PID 6412 wrote to memory of 6764 6412 LTFIDR.exe 106 PID 6764 wrote to memory of 4772 6764 cmd.exe 110 PID 4772 wrote to memory of 6236 4772 VBHNGPL.exe 111 PID 6236 wrote to memory of 924 6236 cmd.exe 115 PID 924 wrote to memory of 2528 924 ACOB.exe 116 PID 2528 wrote to memory of 1788 2528 cmd.exe 120 PID 1788 wrote to memory of 3784 1788 QSP.exe 121 PID 3784 wrote to memory of 5816 3784 cmd.exe 125 PID 5816 wrote to memory of 4268 5816 DCYZKP.exe 126 PID 4268 wrote to memory of 4600 4268 cmd.exe 130 PID 4600 wrote to memory of 3432 4600 UDAEVVZ.exe 131 PID 3432 wrote to memory of 1064 3432 cmd.exe 135 PID 1064 wrote to memory of 3012 1064 ADHS.exe 136 PID 3012 wrote to memory of 3436 3012 cmd.exe 140 PID 3436 wrote to memory of 5868 3436 ETOSRH.exe 141 PID 5868 wrote to memory of 5944 5868 cmd.exe 145 PID 5944 wrote to memory of 2236 5944 UJPRP.exe 146 PID 2236 wrote to memory of 6624 2236 cmd.exe 150 PID 6624 wrote to memory of 1832 6624 DJRWBA.exe 151 PID 1832 wrote to memory of 6012 1832 cmd.exe 155 PID 6012 wrote to memory of 4148 6012 XXW.exe 156 PID 4148 wrote to memory of 1232 4148 cmd.exe 160 PID 1232 wrote to memory of 4804 1232 SKBPN.exe 161 PID 4804 wrote to memory of 2096 4804 cmd.exe 165 PID 2096 wrote to memory of 4368 2096 HNK.exe 166 PID 4368 wrote to memory of 1244 4368 cmd.exe 170 PID 1244 wrote to memory of 1692 1244 GYNKHAN.exe 171 PID 1692 wrote to memory of 6224 1692 cmd.exe 175 PID 6224 wrote to memory of 4720 6224 ZQCVYTD.exe 176 PID 4720 wrote to memory of 4744 4720 cmd.exe 180 PID 4744 wrote to memory of 7160 4744 XMC.exe 181 PID 7160 wrote to memory of 1376 7160 cmd.exe 185 PID 1376 wrote to memory of 3108 1376 DMJRM.exe 186 PID 3108 wrote to memory of 1632 3108 cmd.exe 190 PID 1632 wrote to memory of 3484 1632 YXS.exe 191 PID 3484 wrote to memory of 4636 3484 cmd.exe 195 PID 4636 wrote to memory of 1804 4636 GFTHZX.exe 196 PID 1804 wrote to memory of 4976 1804 cmd.exe 200 PID 4976 wrote to memory of 5684 4976 CKYEOH.exe 201 PID 5684 wrote to memory of 6592 5684 cmd.exe 205 PID 6592 wrote to memory of 568 6592 EISYMW.exe 206 PID 568 wrote to memory of 3780 568 cmd.exe 210 PID 3780 wrote to memory of 4528 3780 MBAAAID.exe 211 PID 4528 wrote to memory of 4256 4528 cmd.exe 215 PID 4256 wrote to memory of 5644 4256 KTIO.exe 216 PID 5644 wrote to memory of 1892 5644 cmd.exe 220 PID 1892 wrote to memory of 2100 1892 VMLGS.exe 221 PID 2100 wrote to memory of 5084 2100 cmd.exe 225 PID 5084 wrote to memory of 6052 5084 HEGZAZ.exe 226 PID 6052 wrote to memory of 6504 6052 cmd.exe 230 PID 6572 wrote to memory of 1432 6572 cmd.exe 235 PID 1432 wrote to memory of 5104 1432 FINQNXL.exe 236 PID 5104 wrote to memory of 6128 5104 cmd.exe 240 PID 6128 wrote to memory of 3040 6128 QFQWAEM.exe 241 PID 3040 wrote to memory of 6204 3040 cmd.exe 245 PID 6204 wrote to memory of 4348 6204 DQU.exe 246 PID 4348 wrote to memory of 5020 4348 cmd.exe 250 PID 5020 wrote to memory of 3056 5020 RTQBKMK.exe 251
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-28_5a417620948b4d7dacae12a7dca8a7e7_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-28_5a417620948b4d7dacae12a7dca8a7e7_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IIGY.exe.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3664 -
C:\windows\SysWOW64\IIGY.exeC:\windows\system32\IIGY.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RGAZ.exe.bat" "4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\windows\RGAZ.exeC:\windows\RGAZ.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LTFIDR.exe.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\windows\SysWOW64\LTFIDR.exeC:\windows\system32\LTFIDR.exe7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VBHNGPL.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:6764 -
C:\windows\system\VBHNGPL.exeC:\windows\system\VBHNGPL.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ACOB.exe.bat" "10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6236 -
C:\windows\SysWOW64\ACOB.exeC:\windows\system32\ACOB.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QSP.exe.bat" "12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\windows\QSP.exeC:\windows\QSP.exe13⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DCYZKP.exe.bat" "14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3784 -
C:\windows\system\DCYZKP.exeC:\windows\system\DCYZKP.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UDAEVVZ.exe.bat" "16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\windows\SysWOW64\UDAEVVZ.exeC:\windows\system32\UDAEVVZ.exe17⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ADHS.exe.bat" "18⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\windows\system\ADHS.exeC:\windows\system\ADHS.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ETOSRH.exe.bat" "20⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\windows\ETOSRH.exeC:\windows\ETOSRH.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UJPRP.exe.bat" "22⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5868 -
C:\windows\UJPRP.exeC:\windows\UJPRP.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DJRWBA.exe.bat" "24⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\windows\system\DJRWBA.exeC:\windows\system\DJRWBA.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XXW.exe.bat" "26⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\windows\system\XXW.exeC:\windows\system\XXW.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SKBPN.exe.bat" "28⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\windows\SysWOW64\SKBPN.exeC:\windows\system32\SKBPN.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HNK.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\windows\system\HNK.exeC:\windows\system\HNK.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GYNKHAN.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\windows\SysWOW64\GYNKHAN.exeC:\windows\system32\GYNKHAN.exe33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZQCVYTD.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\windows\ZQCVYTD.exeC:\windows\ZQCVYTD.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6224 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XMC.exe.bat" "36⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\windows\XMC.exeC:\windows\XMC.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DMJRM.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:7160 -
C:\windows\system\DMJRM.exeC:\windows\system\DMJRM.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YXS.exe.bat" "40⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3108 -
C:\windows\YXS.exeC:\windows\YXS.exe41⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GFTHZX.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\windows\GFTHZX.exeC:\windows\GFTHZX.exe43⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CKYEOH.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\windows\CKYEOH.exeC:\windows\CKYEOH.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EISYMW.exe.bat" "46⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5684 -
C:\windows\system\EISYMW.exeC:\windows\system\EISYMW.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MBAAAID.exe.bat" "48⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:568 -
C:\windows\SysWOW64\MBAAAID.exeC:\windows\system32\MBAAAID.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KTIO.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\windows\system\KTIO.exeC:\windows\system\KTIO.exe51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VMLGS.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:5644 -
C:\windows\SysWOW64\VMLGS.exeC:\windows\system32\VMLGS.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HEGZAZ.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\windows\SysWOW64\HEGZAZ.exeC:\windows\system32\HEGZAZ.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OXPTODQ.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:6052 -
C:\windows\system\OXPTODQ.exeC:\windows\system\OXPTODQ.exe57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FINQNXL.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:6572 -
C:\windows\FINQNXL.exeC:\windows\FINQNXL.exe59⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QFQWAEM.exe.bat" "60⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\windows\system\QFQWAEM.exeC:\windows\system\QFQWAEM.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DQU.exe.bat" "62⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\windows\SysWOW64\DQU.exeC:\windows\system32\DQU.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6204 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RTQBKMK.exe.bat" "64⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\windows\RTQBKMK.exeC:\windows\RTQBKMK.exe65⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RGR.exe.bat" "66⤵
- Executes a command shell one-liner
PID:3056 -
C:\windows\system\RGR.exeC:\windows\system\RGR.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HWP.exe.bat" "68⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4820 -
C:\windows\system\HWP.exeC:\windows\system\HWP.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3336 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PHYUL.exe.bat" "70⤵
- Executes a command shell one-liner
PID:4240 -
C:\windows\system\PHYUL.exeC:\windows\system\PHYUL.exe71⤵
- Executes dropped EXE
PID:2724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JCDDVXX.exe.bat" "72⤵
- Executes a command shell one-liner
PID:4444 -
C:\windows\system\JCDDVXX.exeC:\windows\system\JCDDVXX.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TCF.exe.bat" "74⤵
- System Location Discovery: System Language Discovery
PID:2952 -
C:\windows\SysWOW64\TCF.exeC:\windows\system32\TCF.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KDHN.exe.bat" "76⤵PID:600
-
C:\windows\system\KDHN.exeC:\windows\system\KDHN.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4292 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MAMI.exe.bat" "78⤵PID:7164
-
C:\windows\system\MAMI.exeC:\windows\system\MAMI.exe79⤵
- Executes dropped EXE
PID:6488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BDWMDVL.exe.bat" "80⤵PID:3344
-
C:\windows\BDWMDVL.exeC:\windows\BDWMDVL.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CYIQ.exe.bat" "82⤵
- System Location Discovery: System Language Discovery
PID:6164 -
C:\windows\SysWOW64\CYIQ.exeC:\windows\system32\CYIQ.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EWN.exe.bat" "84⤵
- Executes a command shell one-liner
PID:6640 -
C:\windows\EWN.exeC:\windows\EWN.exe85⤵
- Executes dropped EXE
PID:1032 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KSML.exe.bat" "86⤵PID:6528
-
C:\windows\KSML.exeC:\windows\KSML.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OIT.exe.bat" "88⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5152 -
C:\windows\system\OIT.exeC:\windows\system\OIT.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6336 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UIBZ.exe.bat" "90⤵PID:2552
-
C:\windows\UIBZ.exeC:\windows\UIBZ.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1336 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UNBN.exe.bat" "92⤵
- Executes a command shell one-liner
PID:2760 -
C:\windows\system\UNBN.exeC:\windows\system\UNBN.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SDMQM.exe.bat" "94⤵PID:5988
-
C:\windows\system\SDMQM.exeC:\windows\system\SDMQM.exe95⤵
- Executes dropped EXE
PID:4344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ITNHTX.exe.bat" "96⤵PID:2784
-
C:\windows\ITNHTX.exeC:\windows\ITNHTX.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CHS.exe.bat" "98⤵PID:2160
-
C:\windows\CHS.exeC:\windows\CHS.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UPUE.exe.bat" "100⤵
- Executes a command shell one-liner
PID:6004 -
C:\windows\system\UPUE.exeC:\windows\system\UPUE.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XXBE.exe.bat" "102⤵
- System Location Discovery: System Language Discovery
PID:4812 -
C:\windows\system\XXBE.exeC:\windows\system\XXBE.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1104 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BNHEXE.exe.bat" "104⤵PID:1724
-
C:\windows\SysWOW64\BNHEXE.exeC:\windows\system32\BNHEXE.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WAM.exe.bat" "106⤵PID:1468
-
C:\windows\SysWOW64\WAM.exeC:\windows\system32\WAM.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HTPG.exe.bat" "108⤵PID:6172
-
C:\windows\system\HTPG.exeC:\windows\system\HTPG.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WOYSAYN.exe.bat" "110⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2732 -
C:\windows\SysWOW64\WOYSAYN.exeC:\windows\system32\WOYSAYN.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WBZ.exe.bat" "112⤵
- Executes a command shell one-liner
PID:3048 -
C:\windows\SysWOW64\WBZ.exeC:\windows\system32\WBZ.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QUUA.exe.bat" "114⤵
- Executes a command shell one-liner
PID:6096 -
C:\windows\SysWOW64\QUUA.exeC:\windows\system32\QUUA.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3192 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OUBN.exe.bat" "116⤵PID:5524
-
C:\windows\system\OUBN.exeC:\windows\system\OUBN.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6136 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TVJBKP.exe.bat" "118⤵PID:5172
-
C:\windows\SysWOW64\TVJBKP.exeC:\windows\system32\TVJBKP.exe119⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AIIC.exe.bat" "120⤵PID:3804
-
C:\windows\AIIC.exeC:\windows\AIIC.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5972
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-