Analysis
- max time kernel
87s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/07/2026, 02:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-29_af496eb3df6254eacfaa011d31f526fc_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-07-29_af496eb3df6254eacfaa011d31f526fc_elex_emotet_stop.exe
- Size 208KB
- Sample260729-c1wmbaserd
- SHA256 3bdaf94ccef509e81fbb9cda6dcb43592ce3c1390d6b138b60551c636017c048
- MD5 af496eb3df6254eacfaa011d31f526fc
- SHA1 d7f6973e74f014beb0ed30b0cc667979cf4a3af9
- SHA512 1c64712f45809ac1818845db25ba7972f66f6ce1883a6d16a0cf1053eda6632c38e9f5bde66d71a6c726d624b21501cb610d04d9ff7d7d9568bd99d5cbded4f1
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbDlUfL+LOfM4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbDlUD+LOEkEj1
- TLSH T1CC247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1048 JUQNHJ.exe 3240 PNFEZIH.exe 2604 MFUYMYQ.exe 3272 LNIVYPL.exe 1044 QRGQY.exe 3148 DBX.exe 4908 MKRU.exe 4948 WZEP.exe 3496 VSH.exe 5408 GLXPXF.exe 2012 JYB.exe 5776 BBFVNVW.exe 4288 PMOTT.exe 628 PHR.exe 3304 KUWGR.exe 3656 OKD.exe 1476 DAMGCC.exe 3348 HIS.exe 440 SBNZW.exe 2948 CZBTEKF.exe 4212 SPCKLF.exe 2284 WFJ.exe 5424 BFQGG.exe 3096 UAUCLIS.exe 5796 LIW.exe 4296 BDGTIA.exe 6040 KMIYL.exe 3748 TMKDPD.exe 2180 OZO.exe 5312 UAWBI.exe 4636 FSRTQM.exe 4260 WFBLGJB.exe 4068 RTGV.exe 1556 TRHX.exe 2156 EJCQX.exe 5004 OHQ.exe 2116 BSZ.exe 4628 DQADZNZ.exe 4888 FFFPGV.exe 1872 WOHCKBC.exe 4956 AWOCW.exe 4800 XBUZDV.exe 4648 GKW.exe 4816 MKDSY.exe 5212 HXICIUS.exe 2908 BKFL.exe 1200 CORPX.exe 5832 BYUF.exe 4576 MRJQQ.exe 3904 YHQQCJJ.exe 5504 HHS.exe 1820 WCBHQB.exe 5616 TDDJCFU.exe 4528 QIJHJPW.exe 720 KWOQ.exe 2532 LZR.exe 4444 GMWV.exe 2176 AZBFTF.exe 676 GZJSCZ.exe 4448 IXCUJWH.exe 5260 DLHE.exe 4292 VOK.exe 5076 STQXFVZ.exe 4672 YUYKO.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\WFJ.exe SPCKLF.exe File opened for modification C:\windows\SysWOW64\HXICIUS.exe MKDSY.exe File opened for modification C:\windows\SysWOW64\BYUF.exe CORPX.exe File created C:\windows\SysWOW64\STQXFVZ.exe VOK.exe File created C:\windows\SysWOW64\PDJH.exe.bat AFEKOGH.exe File created C:\windows\SysWOW64\HSJNM.exe.bat ACINFF.exe File created C:\windows\SysWOW64\YNZUUUP.exe.bat DZULK.exe File created C:\windows\SysWOW64\ESRD.exe JFMLWNY.exe File opened for modification C:\windows\SysWOW64\MZCYH.exe OMCQ.exe File opened for modification C:\windows\SysWOW64\YNZUUUP.exe DZULK.exe File created C:\windows\SysWOW64\SBNZW.exe.bat HIS.exe File opened for modification C:\windows\SysWOW64\SPCKLF.exe CZBTEKF.exe File created C:\windows\SysWOW64\SPCKLF.exe.bat CZBTEKF.exe File created C:\windows\SysWOW64\FSRTQM.exe.bat UAWBI.exe File created C:\windows\SysWOW64\YNZUUUP.exe DZULK.exe File created C:\windows\SysWOW64\LRWTYNK.exe VBVCR.exe File created C:\windows\SysWOW64\WFJ.exe.bat SPCKLF.exe File created C:\windows\SysWOW64\FSRTQM.exe UAWBI.exe File created C:\windows\SysWOW64\HXICIUS.exe.bat MKDSY.exe File created C:\windows\SysWOW64\EHNMOO.exe VZLHL.exe File opened for modification C:\windows\SysWOW64\ESRD.exe JFMLWNY.exe File created C:\windows\SysWOW64\BFQGG.exe WFJ.exe File created C:\windows\SysWOW64\BFQGG.exe.bat WFJ.exe File opened for modification C:\windows\SysWOW64\FSRTQM.exe UAWBI.exe File created C:\windows\SysWOW64\HHS.exe.bat YHQQCJJ.exe File created C:\windows\SysWOW64\PDJH.exe AFEKOGH.exe File created C:\windows\SysWOW64\MZCYH.exe OMCQ.exe File created C:\windows\SysWOW64\MZCYH.exe.bat OMCQ.exe File opened for modification C:\windows\SysWOW64\HSJNM.exe ACINFF.exe File created C:\windows\SysWOW64\WFBLGJB.exe.bat FSRTQM.exe File created C:\windows\SysWOW64\BYUF.exe.bat CORPX.exe File created C:\windows\SysWOW64\KTADHZ.exe ALYYW.exe File created C:\windows\SysWOW64\VBVCR.exe HVPF.exe File opened for modification C:\windows\SysWOW64\LRWTYNK.exe VBVCR.exe File created C:\windows\SysWOW64\BMTJVX.exe.bat EHNMOO.exe File created C:\windows\SysWOW64\ESRD.exe.bat JFMLWNY.exe File created C:\windows\SysWOW64\HXICIUS.exe MKDSY.exe File created C:\windows\SysWOW64\BYUF.exe CORPX.exe File created C:\windows\SysWOW64\WQQM.exe HVGIRRB.exe File created C:\windows\SysWOW64\HSJNM.exe ACINFF.exe File created C:\windows\SysWOW64\ALYYW.exe HSJNM.exe File created C:\windows\SysWOW64\SPCKLF.exe CZBTEKF.exe File created C:\windows\SysWOW64\KWOQ.exe.bat QIJHJPW.exe File opened for modification C:\windows\SysWOW64\PDJH.exe AFEKOGH.exe File created C:\windows\SysWOW64\ALYYW.exe.bat HSJNM.exe File created C:\windows\SysWOW64\HTZ.exe NFUDHQ.exe File created C:\windows\SysWOW64\HHS.exe YHQQCJJ.exe File opened for modification C:\windows\SysWOW64\KWOQ.exe QIJHJPW.exe File created C:\windows\SysWOW64\BMTJVX.exe EHNMOO.exe File opened for modification C:\windows\SysWOW64\BMTJVX.exe EHNMOO.exe File opened for modification C:\windows\SysWOW64\HVGIRRB.exe MZCYH.exe File opened for modification C:\windows\SysWOW64\EHNMOO.exe VZLHL.exe File opened for modification C:\windows\SysWOW64\WFBLGJB.exe FSRTQM.exe File created C:\windows\SysWOW64\HVGIRRB.exe MZCYH.exe File opened for modification C:\windows\SysWOW64\KTADHZ.exe ALYYW.exe File created C:\windows\SysWOW64\VBVCR.exe.bat HVPF.exe File created C:\windows\SysWOW64\LRWTYNK.exe.bat VBVCR.exe File created C:\windows\SysWOW64\HTZ.exe.bat NFUDHQ.exe File opened for modification C:\windows\SysWOW64\JUQNHJ.exe 2026-07-29_af496eb3df6254eacfaa011d31f526fc_elex_emotet_stop.exe File created C:\windows\SysWOW64\JUQNHJ.exe.bat 2026-07-29_af496eb3df6254eacfaa011d31f526fc_elex_emotet_stop.exe File created C:\windows\SysWOW64\WFJ.exe SPCKLF.exe File opened for modification C:\windows\SysWOW64\BFQGG.exe WFJ.exe File opened for modification C:\windows\SysWOW64\STQXFVZ.exe VOK.exe File opened for modification C:\windows\SysWOW64\DZULK.exe HUKWU.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\system\RUZDP.exe UOHOZW.exe File created C:\windows\system\ULDSUYU.exe.bat XTU.exe File created C:\windows\UDILXA.exe.bat HTZ.exe File opened for modification C:\windows\system\VZLHL.exe UDILXA.exe File created C:\windows\GLXPXF.exe VSH.exe File created C:\windows\RAGAZV.exe.bat YNZUUUP.exe File created C:\windows\system\ODCWLN.exe.bat DKZDD.exe File created C:\windows\system\RTGV.exe WFBLGJB.exe File created C:\windows\system\OHQ.exe EJCQX.exe File created C:\windows\NFUDHQ.exe.bat XPT.exe File created C:\windows\system\TBZXW.exe PTSPKFX.exe File created C:\windows\system\ZHG.exe.bat VZSRC.exe File opened for modification C:\windows\system\BBFVNVW.exe JYB.exe File opened for modification C:\windows\system\DAMGCC.exe OKD.exe File created C:\windows\ACINFF.exe.bat RXDHVHZ.exe File created C:\windows\DCOUQU.exe.bat CZYYB.exe File created C:\windows\RQH.exe.bat ODCWLN.exe File created C:\windows\system\DBX.exe.bat QRGQY.exe File created C:\windows\BKFL.exe.bat HXICIUS.exe File opened for modification C:\windows\system\ZHG.exe VZSRC.exe File created C:\windows\system\PNFEZIH.exe.bat JUQNHJ.exe File created C:\windows\XTU.exe.bat WQQM.exe File created C:\windows\RXDHVHZ.exe RUZDP.exe File created C:\windows\system\BBFVNVW.exe.bat JYB.exe File created C:\windows\PMOTT.exe BBFVNVW.exe File created C:\windows\system\GKW.exe XBUZDV.exe File created C:\windows\system\YHQQCJJ.exe MRJQQ.exe File opened for modification C:\windows\ACINFF.exe RXDHVHZ.exe File opened for modification C:\windows\NFUDHQ.exe XPT.exe File opened for modification C:\windows\BKFL.exe HXICIUS.exe File opened for modification C:\windows\CZBTEKF.exe SBNZW.exe File opened for modification C:\windows\system\VOK.exe DLHE.exe File opened for modification C:\windows\system\ULDSUYU.exe XTU.exe File created C:\windows\XPT.exe.bat DCOUQU.exe File created C:\windows\system\BBFVNVW.exe JYB.exe File opened for modification C:\windows\BDGTIA.exe LIW.exe File created C:\windows\XBUZDV.exe.bat AWOCW.exe File opened for modification C:\windows\system\IXCUJWH.exe GZJSCZ.exe File created C:\windows\CZYYB.exe LRWTYNK.exe File opened for modification C:\windows\XQKVX.exe PDJH.exe File created C:\windows\system\RUZDP.exe.bat UOHOZW.exe File created C:\windows\system\HUKWU.exe.bat VBHD.exe File opened for modification C:\windows\system\DKZDD.exe BMTJVX.exe File opened for modification C:\windows\LNIVYPL.exe MFUYMYQ.exe File created C:\windows\UAWBI.exe.bat OZO.exe File created C:\windows\BKFL.exe HXICIUS.exe File opened for modification C:\windows\system\TDDJCFU.exe WCBHQB.exe File created C:\windows\system\DKZDD.exe BMTJVX.exe File opened for modification C:\windows\PTSPKFX.exe PGSAISD.exe File created C:\windows\GZJSCZ.exe AZBFTF.exe File created C:\windows\system\DLHE.exe IXCUJWH.exe File created C:\windows\system\VZLHL.exe.bat UDILXA.exe File created C:\windows\system\PHR.exe PMOTT.exe File created C:\windows\TMKDPD.exe KMIYL.exe File created C:\windows\system\GMWV.exe LZR.exe File created C:\windows\DCOUQU.exe CZYYB.exe File created C:\windows\QRGQY.exe.bat LNIVYPL.exe File opened for modification C:\windows\HIS.exe DAMGCC.exe File opened for modification C:\windows\XBUZDV.exe AWOCW.exe File opened for modification C:\windows\system\YHQQCJJ.exe MRJQQ.exe File created C:\windows\system\GMWV.exe.bat LZR.exe File opened for modification C:\windows\GZJSCZ.exe AZBFTF.exe File created C:\windows\AFEKOGH.exe.bat PMIRGZ.exe File created C:\windows\UAWBI.exe OZO.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3396 cmd.exe 1276 cmd.exe 5324 cmd.exe 3428 cmd.exe 4196 cmd.exe 4492 cmd.exe 1060 cmd.exe 4780 cmd.exe 120 cmd.exe 2356 cmd.exe 1552 cmd.exe 2324 cmd.exe 4208 cmd.exe 2040 cmd.exe 4176 cmd.exe 5996 cmd.exe 4740 cmd.exe 5568 cmd.exe 5992 cmd.exe 5192 cmd.exe 3892 cmd.exe 1436 cmd.exe 5516 cmd.exe 3856 cmd.exe 2540 cmd.exe 4104 cmd.exe 2276 cmd.exe 3088 cmd.exe 2712 cmd.exe 5656 cmd.exe 5728 cmd.exe 3408 cmd.exe 1072 cmd.exe 4304 cmd.exe 5812 cmd.exe 1696 cmd.exe 5856 cmd.exe 3160 cmd.exe 2776 cmd.exe 5844 cmd.exe 4772 cmd.exe 712 cmd.exe 5736 cmd.exe 4156 cmd.exe 4732 cmd.exe 2804 cmd.exe 4884 cmd.exe 4424 cmd.exe 4924 cmd.exe 3356 cmd.exe 760 cmd.exe 1268 cmd.exe 2816 cmd.exe 1508 cmd.exe 2964 cmd.exe 2984 cmd.exe 2096 cmd.exe 5692 cmd.exe 3404 cmd.exe 4580 cmd.exe 4408 cmd.exe 3196 cmd.exe 4700 cmd.exe 1600 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 4484 5988 WerFault.exe 88 3140 1048 WerFault.exe 93 4424 3240 WerFault.exe 99 556 2604 WerFault.exe 104 4692 3272 WerFault.exe 109 676 1044 WerFault.exe 114 1128 3148 WerFault.exe 119 3892 4908 WerFault.exe 124 5896 4948 WerFault.exe 129 4292 3496 WerFault.exe 134 4368 5408 WerFault.exe 139 1116 2012 WerFault.exe 144 2036 5776 WerFault.exe 149 1368 4288 WerFault.exe 154 4296 628 WerFault.exe 159 1928 3304 WerFault.exe 164 4764 3656 WerFault.exe 169 1360 1476 WerFault.exe 174 5108 3348 WerFault.exe 178 3064 440 WerFault.exe 184 3788 2948 WerFault.exe 189 5656 4212 WerFault.exe 194 4996 2284 WerFault.exe 199 4240 5424 WerFault.exe 204 4156 3096 WerFault.exe 209 4424 5796 WerFault.exe 214 4792 4296 WerFault.exe 219 2744 6040 WerFault.exe 224 3548 3748 WerFault.exe 229 1932 2180 WerFault.exe 234 5428 5312 WerFault.exe 239 4660 4636 WerFault.exe 244 4784 4260 WerFault.exe 249 2804 4068 WerFault.exe 254 4240 1556 WerFault.exe 259 3708 2156 WerFault.exe 264 4424 5004 WerFault.exe 269 5856 2116 WerFault.exe 273 5632 4628 WerFault.exe 279 5260 4888 WerFault.exe 284 1268 1872 WerFault.exe 289 3624 4956 WerFault.exe 294 4284 4800 WerFault.exe 299 6008 4648 WerFault.exe 304 2520 4816 WerFault.exe 309 4088 5212 WerFault.exe 314 5460 2908 WerFault.exe 319 5332 1200 WerFault.exe 324 2044 5832 WerFault.exe 329 2944 4576 WerFault.exe 334 1488 3904 WerFault.exe 339 5752 5504 WerFault.exe 344 5076 1820 WerFault.exe 349 3376 5616 WerFault.exe 354 4092 4528 WerFault.exe 359 4088 720 WerFault.exe 364 1976 2532 WerFault.exe 369 1956 4444 WerFault.exe 374 2856 2176 WerFault.exe 379 4052 676 WerFault.exe 384 5328 4448 WerFault.exe 389 4220 5260 WerFault.exe 394 824 4292 WerFault.exe 398 5544 5076 WerFault.exe 404 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language STQXFVZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PMIRGZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SBNZW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DQADZNZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VBHD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NFUDHQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MKRU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JYB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XBUZDV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KWOQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GZJSCZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XTU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JFMLWNY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ESRD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OKD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OHQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DLHE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JUQNHJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PHR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HVPF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LRWTYNK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BYUF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DCOUQU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DKZDD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PNFEZIH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BDGTIA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KMIYL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XQKVX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VZSRC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WFBLGJB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EJCQX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TDDJCFU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PDJH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WFJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YUYKO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MZCYH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HTZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PGSAISD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5988 2026-07-29_af496eb3df6254eacfaa011d31f526fc_elex_emotet_stop.exe 5988 2026-07-29_af496eb3df6254eacfaa011d31f526fc_elex_emotet_stop.exe 1048 JUQNHJ.exe 1048 JUQNHJ.exe 3240 PNFEZIH.exe 3240 PNFEZIH.exe 2604 MFUYMYQ.exe 2604 MFUYMYQ.exe 3272 LNIVYPL.exe 3272 LNIVYPL.exe 1044 QRGQY.exe 1044 QRGQY.exe 3148 DBX.exe 3148 DBX.exe 4908 MKRU.exe 4908 MKRU.exe 4948 WZEP.exe 4948 WZEP.exe 3496 VSH.exe 3496 VSH.exe 5408 GLXPXF.exe 5408 GLXPXF.exe 2012 JYB.exe 2012 JYB.exe 5776 BBFVNVW.exe 5776 BBFVNVW.exe 4288 PMOTT.exe 4288 PMOTT.exe 628 PHR.exe 628 PHR.exe 3304 KUWGR.exe 3304 KUWGR.exe 3656 OKD.exe 3656 OKD.exe 1476 DAMGCC.exe 1476 DAMGCC.exe 3348 HIS.exe 3348 HIS.exe 440 SBNZW.exe 440 SBNZW.exe 2948 CZBTEKF.exe 2948 CZBTEKF.exe 4212 SPCKLF.exe 4212 SPCKLF.exe 2284 WFJ.exe 2284 WFJ.exe 5424 BFQGG.exe 5424 BFQGG.exe 3096 UAUCLIS.exe 3096 UAUCLIS.exe 5796 LIW.exe 5796 LIW.exe 4296 BDGTIA.exe 4296 BDGTIA.exe 6040 KMIYL.exe 6040 KMIYL.exe 3748 TMKDPD.exe 3748 TMKDPD.exe 2180 OZO.exe 2180 OZO.exe 5312 UAWBI.exe 5312 UAWBI.exe 4636 FSRTQM.exe 4636 FSRTQM.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 5988 2026-07-29_af496eb3df6254eacfaa011d31f526fc_elex_emotet_stop.exe 5988 2026-07-29_af496eb3df6254eacfaa011d31f526fc_elex_emotet_stop.exe 1048 JUQNHJ.exe 1048 JUQNHJ.exe 3240 PNFEZIH.exe 3240 PNFEZIH.exe 2604 MFUYMYQ.exe 2604 MFUYMYQ.exe 3272 LNIVYPL.exe 3272 LNIVYPL.exe 1044 QRGQY.exe 1044 QRGQY.exe 3148 DBX.exe 3148 DBX.exe 4908 MKRU.exe 4908 MKRU.exe 4948 WZEP.exe 4948 WZEP.exe 3496 VSH.exe 3496 VSH.exe 5408 GLXPXF.exe 5408 GLXPXF.exe 2012 JYB.exe 2012 JYB.exe 5776 BBFVNVW.exe 5776 BBFVNVW.exe 4288 PMOTT.exe 4288 PMOTT.exe 628 PHR.exe 628 PHR.exe 3304 KUWGR.exe 3304 KUWGR.exe 3656 OKD.exe 3656 OKD.exe 1476 DAMGCC.exe 1476 DAMGCC.exe 3348 HIS.exe 3348 HIS.exe 440 SBNZW.exe 440 SBNZW.exe 2948 CZBTEKF.exe 2948 CZBTEKF.exe 4212 SPCKLF.exe 4212 SPCKLF.exe 2284 WFJ.exe 2284 WFJ.exe 5424 BFQGG.exe 5424 BFQGG.exe 3096 UAUCLIS.exe 3096 UAUCLIS.exe 5796 LIW.exe 5796 LIW.exe 4296 BDGTIA.exe 4296 BDGTIA.exe 6040 KMIYL.exe 6040 KMIYL.exe 3748 TMKDPD.exe 3748 TMKDPD.exe 2180 OZO.exe 2180 OZO.exe 5312 UAWBI.exe 5312 UAWBI.exe 4636 FSRTQM.exe 4636 FSRTQM.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5988 wrote to memory of 4104 5988 2026-07-29_af496eb3df6254eacfaa011d31f526fc_elex_emotet_stop.exe 89 PID 4104 wrote to memory of 1048 4104 cmd.exe 93 PID 1048 wrote to memory of 5520 1048 JUQNHJ.exe 95 PID 5520 wrote to memory of 3240 5520 cmd.exe 99 PID 3240 wrote to memory of 3412 3240 PNFEZIH.exe 100 PID 3412 wrote to memory of 2604 3412 cmd.exe 104 PID 2604 wrote to memory of 5472 2604 MFUYMYQ.exe 105 PID 5472 wrote to memory of 3272 5472 cmd.exe 109 PID 3272 wrote to memory of 3404 3272 LNIVYPL.exe 110 PID 3404 wrote to memory of 1044 3404 cmd.exe 114 PID 1044 wrote to memory of 2400 1044 QRGQY.exe 115 PID 2400 wrote to memory of 3148 2400 cmd.exe 119 PID 3148 wrote to memory of 1312 3148 DBX.exe 120 PID 1312 wrote to memory of 4908 1312 cmd.exe 124 PID 4908 wrote to memory of 3492 4908 MKRU.exe 125 PID 3492 wrote to memory of 4948 3492 cmd.exe 129 PID 4948 wrote to memory of 4524 4948 WZEP.exe 130 PID 4524 wrote to memory of 3496 4524 cmd.exe 134 PID 3496 wrote to memory of 1432 3496 VSH.exe 135 PID 1432 wrote to memory of 5408 1432 cmd.exe 139 PID 5408 wrote to memory of 3588 5408 GLXPXF.exe 140 PID 3588 wrote to memory of 2012 3588 cmd.exe 144 PID 2012 wrote to memory of 1676 2012 JYB.exe 145 PID 5776 wrote to memory of 4580 5776 BBFVNVW.exe 150 PID 4580 wrote to memory of 4288 4580 cmd.exe 154 PID 4288 wrote to memory of 2276 4288 PMOTT.exe 155 PID 2276 wrote to memory of 628 2276 cmd.exe 159 PID 628 wrote to memory of 4408 628 PHR.exe 160 PID 4408 wrote to memory of 3304 4408 cmd.exe 164 PID 3304 wrote to memory of 5676 3304 KUWGR.exe 165 PID 5676 wrote to memory of 3656 5676 cmd.exe 169 PID 3656 wrote to memory of 1876 3656 OKD.exe 170 PID 1876 wrote to memory of 1476 1876 cmd.exe 174 PID 1476 wrote to memory of 1600 1476 DAMGCC.exe 175 PID 1600 wrote to memory of 3348 1600 cmd.exe 178 PID 3348 wrote to memory of 5192 3348 HIS.exe 180 PID 5192 wrote to memory of 440 5192 cmd.exe 184 PID 440 wrote to memory of 5492 440 SBNZW.exe 185 PID 5492 wrote to memory of 2948 5492 cmd.exe 189 PID 2948 wrote to memory of 6076 2948 CZBTEKF.exe 190 PID 6076 wrote to memory of 4212 6076 cmd.exe 194 PID 4212 wrote to memory of 3952 4212 SPCKLF.exe 195 PID 3952 wrote to memory of 2284 3952 cmd.exe 199 PID 2284 wrote to memory of 2632 2284 WFJ.exe 200 PID 2632 wrote to memory of 5424 2632 cmd.exe 204 PID 5424 wrote to memory of 3296 5424 BFQGG.exe 205 PID 3296 wrote to memory of 3096 3296 cmd.exe 209 PID 3096 wrote to memory of 700 3096 UAUCLIS.exe 210 PID 700 wrote to memory of 5796 700 cmd.exe 214 PID 5796 wrote to memory of 6128 5796 LIW.exe 215 PID 6128 wrote to memory of 4296 6128 cmd.exe 219 PID 4296 wrote to memory of 5436 4296 BDGTIA.exe 220 PID 5436 wrote to memory of 6040 5436 cmd.exe 224 PID 6040 wrote to memory of 4952 6040 KMIYL.exe 225 PID 4952 wrote to memory of 3748 4952 cmd.exe 229 PID 3748 wrote to memory of 2248 3748 TMKDPD.exe 230 PID 2248 wrote to memory of 2180 2248 cmd.exe 234 PID 2180 wrote to memory of 3824 2180 OZO.exe 235 PID 3824 wrote to memory of 5312 3824 cmd.exe 239 PID 5312 wrote to memory of 2356 5312 UAWBI.exe 240 PID 2356 wrote to memory of 4636 2356 cmd.exe 244 PID 4636 wrote to memory of 5188 4636 FSRTQM.exe 245 PID 5188 wrote to memory of 4260 5188 cmd.exe 249 PID 4260 wrote to memory of 2776 4260 WFBLGJB.exe 250
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-29_af496eb3df6254eacfaa011d31f526fc_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-29_af496eb3df6254eacfaa011d31f526fc_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JUQNHJ.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\windows\SysWOW64\JUQNHJ.exeC:\windows\system32\JUQNHJ.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PNFEZIH.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:5520 -
C:\windows\system\PNFEZIH.exeC:\windows\system\PNFEZIH.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MFUYMYQ.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\windows\MFUYMYQ.exeC:\windows\MFUYMYQ.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LNIVYPL.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:5472 -
C:\windows\LNIVYPL.exeC:\windows\LNIVYPL.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3272 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QRGQY.exe.bat" "10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\windows\QRGQY.exeC:\windows\QRGQY.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DBX.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\windows\system\DBX.exeC:\windows\system\DBX.exe13⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MKRU.exe.bat" "14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\windows\MKRU.exeC:\windows\MKRU.exe15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WZEP.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\windows\system\WZEP.exeC:\windows\system\WZEP.exe17⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VSH.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\windows\system\VSH.exeC:\windows\system\VSH.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GLXPXF.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\windows\GLXPXF.exeC:\windows\GLXPXF.exe21⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JYB.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:3588 -
C:\windows\JYB.exeC:\windows\JYB.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BBFVNVW.exe.bat" "24⤵
- System Location Discovery: System Language Discovery
PID:1676 -
C:\windows\system\BBFVNVW.exeC:\windows\system\BBFVNVW.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PMOTT.exe.bat" "26⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\windows\PMOTT.exeC:\windows\PMOTT.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PHR.exe.bat" "28⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\windows\system\PHR.exeC:\windows\system\PHR.exe29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:628 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KUWGR.exe.bat" "30⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\windows\system\KUWGR.exeC:\windows\system\KUWGR.exe31⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OKD.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:5676 -
C:\windows\system\OKD.exeC:\windows\system\OKD.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DAMGCC.exe.bat" "34⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\windows\system\DAMGCC.exeC:\windows\system\DAMGCC.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HIS.exe.bat" "36⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\windows\HIS.exeC:\windows\HIS.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3348 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SBNZW.exe.bat" "38⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5192 -
C:\windows\SysWOW64\SBNZW.exeC:\windows\system32\SBNZW.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CZBTEKF.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:5492 -
C:\windows\CZBTEKF.exeC:\windows\CZBTEKF.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SPCKLF.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:6076 -
C:\windows\SysWOW64\SPCKLF.exeC:\windows\system32\SPCKLF.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WFJ.exe.bat" "44⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\windows\SysWOW64\WFJ.exeC:\windows\system32\WFJ.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BFQGG.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\windows\SysWOW64\BFQGG.exeC:\windows\system32\BFQGG.exe47⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UAUCLIS.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:3296 -
C:\windows\system\UAUCLIS.exeC:\windows\system\UAUCLIS.exe49⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LIW.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:700 -
C:\windows\system\LIW.exeC:\windows\system\LIW.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BDGTIA.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:6128 -
C:\windows\BDGTIA.exeC:\windows\BDGTIA.exe53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KMIYL.exe.bat" "54⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5436 -
C:\windows\KMIYL.exeC:\windows\KMIYL.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6040 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TMKDPD.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\windows\TMKDPD.exeC:\windows\TMKDPD.exe57⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OZO.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\windows\OZO.exeC:\windows\OZO.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UAWBI.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\windows\UAWBI.exeC:\windows\UAWBI.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FSRTQM.exe.bat" "62⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\windows\SysWOW64\FSRTQM.exeC:\windows\system32\FSRTQM.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WFBLGJB.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:5188 -
C:\windows\SysWOW64\WFBLGJB.exeC:\windows\system32\WFBLGJB.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RTGV.exe.bat" "66⤵
- Executes a command shell one-liner
PID:2776 -
C:\windows\system\RTGV.exeC:\windows\system\RTGV.exe67⤵
- Executes dropped EXE
PID:4068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TRHX.exe.bat" "68⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1552 -
C:\windows\system\TRHX.exeC:\windows\system\TRHX.exe69⤵
- Executes dropped EXE
PID:1556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EJCQX.exe.bat" "70⤵PID:1688
-
C:\windows\system\EJCQX.exeC:\windows\system\EJCQX.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2156 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OHQ.exe.bat" "72⤵
- Executes a command shell one-liner
PID:4304 -
C:\windows\system\OHQ.exeC:\windows\system\OHQ.exe73⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BSZ.exe.bat" "74⤵PID:576
-
C:\windows\BSZ.exeC:\windows\BSZ.exe75⤵
- Executes dropped EXE
PID:2116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DQADZNZ.exe.bat" "76⤵
- Executes a command shell one-liner
PID:5324 -
C:\windows\system\DQADZNZ.exeC:\windows\system\DQADZNZ.exe77⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4628 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FFFPGV.exe.bat" "78⤵PID:1108
-
C:\windows\system\FFFPGV.exeC:\windows\system\FFFPGV.exe79⤵
- Executes dropped EXE
PID:4888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WOHCKBC.exe.bat" "80⤵PID:3628
-
C:\windows\system\WOHCKBC.exeC:\windows\system\WOHCKBC.exe81⤵
- Executes dropped EXE
PID:1872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AWOCW.exe.bat" "82⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5812 -
C:\windows\AWOCW.exeC:\windows\AWOCW.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XBUZDV.exe.bat" "84⤵PID:2828
-
C:\windows\XBUZDV.exeC:\windows\XBUZDV.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GKW.exe.bat" "86⤵PID:904
-
C:\windows\system\GKW.exeC:\windows\system\GKW.exe87⤵
- Executes dropped EXE
PID:4648 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MKDSY.exe.bat" "88⤵PID:3912
-
C:\windows\MKDSY.exeC:\windows\MKDSY.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HXICIUS.exe.bat" "90⤵PID:3760
-
C:\windows\SysWOW64\HXICIUS.exeC:\windows\system32\HXICIUS.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5212 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BKFL.exe.bat" "92⤵
- Executes a command shell one-liner
PID:3088 -
C:\windows\BKFL.exeC:\windows\BKFL.exe93⤵
- Executes dropped EXE
PID:2908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CORPX.exe.bat" "94⤵PID:912
-
C:\windows\system\CORPX.exeC:\windows\system\CORPX.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BYUF.exe.bat" "96⤵
- System Location Discovery: System Language Discovery
PID:6116 -
C:\windows\SysWOW64\BYUF.exeC:\windows\system32\BYUF.exe97⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MRJQQ.exe.bat" "98⤵PID:5804
-
C:\windows\system\MRJQQ.exeC:\windows\system\MRJQQ.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YHQQCJJ.exe.bat" "100⤵
- System Location Discovery: System Language Discovery
PID:4404 -
C:\windows\system\YHQQCJJ.exeC:\windows\system\YHQQCJJ.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HHS.exe.bat" "102⤵
- Executes a command shell one-liner
PID:3892 -
C:\windows\SysWOW64\HHS.exeC:\windows\system32\HHS.exe103⤵
- Executes dropped EXE
PID:5504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WCBHQB.exe.bat" "104⤵PID:1768
-
C:\windows\SysWOW64\WCBHQB.exeC:\windows\system32\WCBHQB.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TDDJCFU.exe.bat" "106⤵PID:5892
-
C:\windows\system\TDDJCFU.exeC:\windows\system\TDDJCFU.exe107⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QIJHJPW.exe.bat" "108⤵PID:2212
-
C:\windows\system\QIJHJPW.exeC:\windows\system\QIJHJPW.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4528 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KWOQ.exe.bat" "110⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2816 -
C:\windows\SysWOW64\KWOQ.exeC:\windows\system32\KWOQ.exe111⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LZR.exe.bat" "112⤵
- Executes a command shell one-liner
PID:3160 -
C:\windows\system\LZR.exeC:\windows\system\LZR.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GMWV.exe.bat" "114⤵PID:3112
-
C:\windows\system\GMWV.exeC:\windows\system\GMWV.exe115⤵
- Executes dropped EXE
PID:4444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AZBFTF.exe.bat" "116⤵PID:1964
-
C:\windows\AZBFTF.exeC:\windows\AZBFTF.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2176 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GZJSCZ.exe.bat" "118⤵PID:2744
-
C:\windows\GZJSCZ.exeC:\windows\GZJSCZ.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:676 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IXCUJWH.exe.bat" "120⤵PID:828
-
C:\windows\system\IXCUJWH.exeC:\windows\system\IXCUJWH.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4448
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-