Analysis
- max time kernel
85s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/07/2026, 12:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-29_37ad0e62578a8dafe0a65e7f11b47169_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-07-29_37ad0e62578a8dafe0a65e7f11b47169_elex_emotet_stop.exe
- Size 208KB
- Sample260729-pmxzfathph
- SHA256 62fa25669c71c6c10c7635035191d090bf152592cfdcc7e985c8aaf83e87a863
- MD5 37ad0e62578a8dafe0a65e7f11b47169
- SHA1 340dc3743ff86aa840c033e18060e361301d9302
- SHA512 f1d82ce94f939f76df2be206c10afb388e8a9efb30e302270151c162ee02f9fc082e0a2eddeebcc9b172857a2f2485a075a48f72a7c15e8a0d103301d8d0f17c
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlldL+LOfv4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFll5+LOXkEj1
- TLSH T1FE247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5668 NYQ.exe 5504 QHLIDB.exe 5108 ZPTCK.exe 4724 USK.exe 3052 MVOWEUS.exe 1960 CLP.exe 5384 UOSSQFQ.exe 4820 TEEUL.exe 4192 KMGAPIA.exe 4720 DPKVUY.exe 4628 UQMAXDE.exe 5424 YYSI.exe 3700 EYAWBQB.exe 5412 XBM.exe 1140 FOQ.exe 2552 YHG.exe 3816 HHIX.exe 4240 IKL.exe 3852 BNPWX.exe 1252 BITS.exe 4960 ULXVPW.exe 3472 GBD.exe 1608 BPVF.exe 3248 QFWWUWW.exe 1380 JXL.exe 5304 ZNMH.exe 4800 XYP.exe 1516 LJFNHJ.exe 5012 HJHYLFU.exe 1848 ZKWVXWX.exe 4424 WIJNFDM.exe 5016 YFPHULN.exe 4648 MBAAAID.exe 5392 DBPX.exe 1452 YJX.exe 6104 SKF.exe 5500 FINQNXL.exe 612 RXG.exe 2504 VBEEAU.exe 5600 FYKYQ.exe 1244 YBOCVTV.exe 3396 YWEQK.exe 3836 BNNM.exe 4976 JSZT.exe 1864 WDIR.exe 5524 ODWP.exe 1128 NWZ.exe 2660 EWN.exe 4896 MKA.exe 2284 FXZPFT.exe 3924 ENKSA.exe 3688 IQI.exe 5432 UGJFOE.exe 3056 TRM.exe 1312 VPSHMSR.exe 5844 DCEWOQM.exe 3616 BNHEXE.exe 4092 AYSUG.exe 5044 DLBEZW.exe 1344 SBCVYRJ.exe 3224 WRRD.exe 992 LHS.exe 2168 PPYCD.exe 3044 QSP.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\YHG.exe FOQ.exe File opened for modification C:\windows\SysWOW64\BNPWX.exe IKL.exe File created C:\windows\SysWOW64\HJHYLFU.exe.bat LJFNHJ.exe File opened for modification C:\windows\SysWOW64\RXG.exe FINQNXL.exe File opened for modification C:\windows\SysWOW64\NWZ.exe ODWP.exe File created C:\windows\SysWOW64\EZPDDW.exe.bat CBCJVN.exe File created C:\windows\SysWOW64\BPVF.exe.bat GBD.exe File created C:\windows\SysWOW64\ZKWVXWX.exe HJHYLFU.exe File created C:\windows\SysWOW64\NWZ.exe.bat ODWP.exe File created C:\windows\SysWOW64\NYQ.exe 2026-07-29_37ad0e62578a8dafe0a65e7f11b47169_elex_emotet_stop.exe File created C:\windows\SysWOW64\BNPWX.exe IKL.exe File opened for modification C:\windows\SysWOW64\ZKWVXWX.exe HJHYLFU.exe File created C:\windows\SysWOW64\HCA.exe.bat UFSUI.exe File opened for modification C:\windows\SysWOW64\GAMBFAK.exe HCA.exe File created C:\windows\SysWOW64\GAMBFAK.exe.bat HCA.exe File created C:\windows\SysWOW64\VHRIOBH.exe.bat EZPDDW.exe File opened for modification C:\windows\SysWOW64\YHG.exe FOQ.exe File created C:\windows\SysWOW64\DCEWOQM.exe VPSHMSR.exe File created C:\windows\SysWOW64\RCU.exe CMTTX.exe File created C:\windows\SysWOW64\RCU.exe.bat CMTTX.exe File created C:\windows\SysWOW64\MVOWEUS.exe.bat USK.exe File created C:\windows\SysWOW64\DPKVUY.exe.bat KMGAPIA.exe File opened for modification C:\windows\SysWOW64\YWEQK.exe YBOCVTV.exe File created C:\windows\SysWOW64\UFSUI.exe.bat VUQEZV.exe File created C:\windows\SysWOW64\CBCJVN.exe.bat GAMBFAK.exe File created C:\windows\SysWOW64\YYSI.exe UQMAXDE.exe File created C:\windows\SysWOW64\IQI.exe ENKSA.exe File created C:\windows\SysWOW64\DCEWOQM.exe.bat VPSHMSR.exe File opened for modification C:\windows\SysWOW64\KBMBZV.exe VLLC.exe File created C:\windows\SysWOW64\WNEO.exe.bat MPZCO.exe File opened for modification C:\windows\SysWOW64\UFSUI.exe VUQEZV.exe File opened for modification C:\windows\SysWOW64\HJI.exe UZAWH.exe File opened for modification C:\windows\SysWOW64\MATEW.exe CARZ.exe File created C:\windows\SysWOW64\WDIR.exe JSZT.exe File created C:\windows\SysWOW64\WNEO.exe MPZCO.exe File created C:\windows\SysWOW64\RXG.exe.bat FINQNXL.exe File opened for modification C:\windows\SysWOW64\IQI.exe ENKSA.exe File created C:\windows\SysWOW64\PPYCD.exe.bat LHS.exe File opened for modification C:\windows\SysWOW64\HCA.exe UFSUI.exe File created C:\windows\SysWOW64\KBMBZV.exe VLLC.exe File created C:\windows\SysWOW64\SPUAQCP.exe BGFCDLU.exe File created C:\windows\SysWOW64\YHG.exe.bat FOQ.exe File created C:\windows\SysWOW64\BGFCDLU.exe.bat RGDX.exe File opened for modification C:\windows\SysWOW64\SPUAQCP.exe BGFCDLU.exe File created C:\windows\SysWOW64\DPKVUY.exe KMGAPIA.exe File created C:\windows\SysWOW64\BNPWX.exe.bat IKL.exe File created C:\windows\SysWOW64\YWEQK.exe.bat YBOCVTV.exe File opened for modification C:\windows\SysWOW64\CBCJVN.exe GAMBFAK.exe File created C:\windows\SysWOW64\JJP.exe ZLB.exe File created C:\windows\SysWOW64\BPVF.exe GBD.exe File created C:\windows\SysWOW64\GAMBFAK.exe HCA.exe File created C:\windows\SysWOW64\KBMBZV.exe.bat VLLC.exe File opened for modification C:\windows\SysWOW64\YYSI.exe UQMAXDE.exe File opened for modification C:\windows\SysWOW64\HJHYLFU.exe LJFNHJ.exe File created C:\windows\SysWOW64\YWEQK.exe YBOCVTV.exe File created C:\windows\SysWOW64\IQI.exe.bat ENKSA.exe File opened for modification C:\windows\SysWOW64\NFINAR.exe HJI.exe File created C:\windows\SysWOW64\MVOWEUS.exe USK.exe File opened for modification C:\windows\SysWOW64\FOQ.exe XBM.exe File created C:\windows\SysWOW64\IKL.exe HHIX.exe File opened for modification C:\windows\SysWOW64\GBD.exe ULXVPW.exe File created C:\windows\SysWOW64\MBAAAID.exe.bat YFPHULN.exe File created C:\windows\SysWOW64\HJI.exe UZAWH.exe File created C:\windows\SysWOW64\DBPX.exe.bat MBAAAID.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\PFUHFHA.exe WNEO.exe File opened for modification C:\windows\system\EYAWBQB.exe YYSI.exe File created C:\windows\system\XBM.exe EYAWBQB.exe File created C:\windows\system\SKF.exe YJX.exe File created C:\windows\UGJFOE.exe.bat IQI.exe File opened for modification C:\windows\TEEUL.exe UOSSQFQ.exe File created C:\windows\FINQNXL.exe.bat SKF.exe File created C:\windows\YBOCVTV.exe FYKYQ.exe File created C:\windows\system\NNY.exe ZPYI.exe File opened for modification C:\windows\FINQNXL.exe SKF.exe File created C:\windows\QHLIDB.exe.bat NYQ.exe File created C:\windows\XYP.exe ZNMH.exe File opened for modification C:\windows\YBOCVTV.exe FYKYQ.exe File opened for modification C:\windows\MKA.exe EWN.exe File created C:\windows\SBCVYRJ.exe DLBEZW.exe File created C:\windows\system\ZLB.exe MATEW.exe File created C:\windows\TEEUL.exe.bat UOSSQFQ.exe File created C:\windows\system\HHIX.exe.bat YHG.exe File created C:\windows\ZNMH.exe JXL.exe File created C:\windows\UGJFOE.exe IQI.exe File opened for modification C:\windows\UGJFOE.exe IQI.exe File created C:\windows\WRRD.exe.bat SBCVYRJ.exe File created C:\windows\JVTUX.exe QSP.exe File opened for modification C:\windows\HIDD.exe NNY.exe File created C:\windows\BNNM.exe.bat YWEQK.exe File created C:\windows\FXZPFT.exe.bat MKA.exe File opened for modification C:\windows\SBCVYRJ.exe DLBEZW.exe File opened for modification C:\windows\IJZGLT.exe YLU.exe File opened for modification C:\windows\system\ZLB.exe MATEW.exe File opened for modification C:\windows\system\CMTTX.exe JJP.exe File created C:\windows\NBTIK.exe PFUHFHA.exe File opened for modification C:\windows\NBTIK.exe PFUHFHA.exe File opened for modification C:\windows\system\UOSSQFQ.exe CLP.exe File opened for modification C:\windows\system\NNY.exe ZPYI.exe File created C:\windows\system\MPZCO.exe.bat RCU.exe File created C:\windows\system\RGDX.exe.bat NBTIK.exe File opened for modification C:\windows\CLP.exe MVOWEUS.exe File opened for modification C:\windows\system\LHS.exe WRRD.exe File created C:\windows\UZAWH.exe.bat KBMBZV.exe File opened for modification C:\windows\system\FNR.exe CSZIHXS.exe File opened for modification C:\windows\system\PUNP.exe FWHUI.exe File created C:\windows\YFPHULN.exe WIJNFDM.exe File created C:\windows\system\QSP.exe.bat PPYCD.exe File created C:\windows\system\CMTTX.exe.bat JJP.exe File created C:\windows\system\UOSSQFQ.exe CLP.exe File created C:\windows\system\EYAWBQB.exe.bat YYSI.exe File opened for modification C:\windows\EWN.exe NWZ.exe File created C:\windows\system\TRM.exe UGJFOE.exe File created C:\windows\system\LHS.exe WRRD.exe File created C:\windows\system\FNR.exe CSZIHXS.exe File created C:\windows\UQMAXDE.exe.bat DPKVUY.exe File opened for modification C:\windows\YFPHULN.exe WIJNFDM.exe File opened for modification C:\windows\JSZT.exe BNNM.exe File opened for modification C:\windows\FXZPFT.exe MKA.exe File created C:\windows\system\UOSSQFQ.exe.bat CLP.exe File created C:\windows\system\EYAWBQB.exe YYSI.exe File created C:\windows\ODWP.exe.bat WDIR.exe File created C:\windows\IJZGLT.exe YLU.exe File created C:\windows\PFUHFHA.exe.bat WNEO.exe File opened for modification C:\windows\KMGAPIA.exe TEEUL.exe File opened for modification C:\windows\QFWWUWW.exe BPVF.exe File created C:\windows\system\SKF.exe.bat YJX.exe File created C:\windows\system\TRM.exe.bat UGJFOE.exe File opened for modification C:\windows\system\QSP.exe PPYCD.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4988 cmd.exe 2472 cmd.exe 3712 cmd.exe 3628 cmd.exe 1300 cmd.exe 6132 cmd.exe 2596 cmd.exe 3372 cmd.exe 6108 cmd.exe 3188 cmd.exe 4568 cmd.exe 3288 cmd.exe 2988 cmd.exe 2296 cmd.exe 4384 cmd.exe 3000 cmd.exe 2268 cmd.exe 5980 cmd.exe 2724 cmd.exe 6088 cmd.exe 3636 cmd.exe 4852 cmd.exe 5732 cmd.exe 5296 cmd.exe 4324 cmd.exe 1520 cmd.exe 4464 cmd.exe 852 cmd.exe 3332 cmd.exe 2648 cmd.exe 1308 cmd.exe 2424 cmd.exe 704 cmd.exe 4332 cmd.exe 5548 cmd.exe 5836 cmd.exe 2036 cmd.exe 5868 cmd.exe 6084 cmd.exe 2568 cmd.exe 3236 cmd.exe 4176 cmd.exe 3804 cmd.exe 5608 cmd.exe 4924 cmd.exe 1684 cmd.exe 1496 cmd.exe 5268 cmd.exe 3900 cmd.exe 2740 cmd.exe 712 cmd.exe 5612 cmd.exe 4420 cmd.exe 5924 cmd.exe 1084 cmd.exe 3540 cmd.exe 2864 cmd.exe 5540 cmd.exe 4252 cmd.exe 1652 cmd.exe 5436 cmd.exe 5908 cmd.exe 1476 cmd.exe 3068 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 2772 3444 WerFault.exe 88 4856 5668 WerFault.exe 93 5732 5504 WerFault.exe 99 3556 5108 WerFault.exe 104 6028 4724 WerFault.exe 109 5148 3052 WerFault.exe 114 2092 1960 WerFault.exe 119 4624 5384 WerFault.exe 124 5044 4820 WerFault.exe 129 4788 4192 WerFault.exe 134 3184 4720 WerFault.exe 139 4552 4628 WerFault.exe 144 3792 5424 WerFault.exe 149 804 3700 WerFault.exe 154 3048 5412 WerFault.exe 159 5252 1140 WerFault.exe 164 612 2552 WerFault.exe 169 2872 3816 WerFault.exe 174 3372 4240 WerFault.exe 179 6096 3852 WerFault.exe 184 4524 1252 WerFault.exe 189 3484 4960 WerFault.exe 194 4176 3472 WerFault.exe 199 1648 1608 WerFault.exe 204 5184 3248 WerFault.exe 209 4548 1380 WerFault.exe 214 2868 5304 WerFault.exe 219 2852 4800 WerFault.exe 224 5196 1516 WerFault.exe 229 2892 5012 WerFault.exe 234 5352 1848 WerFault.exe 239 3924 4424 WerFault.exe 244 4112 5016 WerFault.exe 249 4740 4648 WerFault.exe 254 4544 5392 WerFault.exe 259 2568 1452 WerFault.exe 264 4068 6104 WerFault.exe 270 4508 5500 WerFault.exe 275 5396 612 WerFault.exe 280 1512 2504 WerFault.exe 285 4684 5600 WerFault.exe 290 4524 1244 WerFault.exe 295 1816 3396 WerFault.exe 300 4948 3836 WerFault.exe 305 3376 4976 WerFault.exe 310 2576 1864 WerFault.exe 315 6132 5524 WerFault.exe 319 5892 1128 WerFault.exe 325 2408 2660 WerFault.exe 330 6096 4896 WerFault.exe 335 5548 2284 WerFault.exe 340 296 3924 WerFault.exe 345 4740 3688 WerFault.exe 350 1236 5432 WerFault.exe 355 2320 3056 WerFault.exe 360 3404 1312 WerFault.exe 365 1584 5844 WerFault.exe 370 5628 3616 WerFault.exe 375 1096 4092 WerFault.exe 380 1684 5044 WerFault.exe 385 4652 1344 WerFault.exe 390 4264 3224 WerFault.exe 395 804 992 WerFault.exe 400 2596 2168 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KMGAPIA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NFINAR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RCU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZPTCK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MVOWEUS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IKL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YFPHULN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ODWP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WRRD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HIDD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FNR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XYP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YJX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FYKYQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZNMH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VBEEAU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YBOCVTV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IJZGLT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CBCJVN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BNNM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LHS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VLLC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PPYCD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VUQEZV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NNY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SPUAQCP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TSXD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ENKSA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UDSJZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MATEW.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3444 2026-07-29_37ad0e62578a8dafe0a65e7f11b47169_elex_emotet_stop.exe 3444 2026-07-29_37ad0e62578a8dafe0a65e7f11b47169_elex_emotet_stop.exe 5668 NYQ.exe 5668 NYQ.exe 5504 QHLIDB.exe 5504 QHLIDB.exe 5108 ZPTCK.exe 5108 ZPTCK.exe 4724 USK.exe 4724 USK.exe 3052 MVOWEUS.exe 3052 MVOWEUS.exe 1960 CLP.exe 1960 CLP.exe 5384 UOSSQFQ.exe 5384 UOSSQFQ.exe 4820 TEEUL.exe 4820 TEEUL.exe 4192 KMGAPIA.exe 4192 KMGAPIA.exe 4720 DPKVUY.exe 4720 DPKVUY.exe 4628 UQMAXDE.exe 4628 UQMAXDE.exe 5424 YYSI.exe 5424 YYSI.exe 3700 EYAWBQB.exe 3700 EYAWBQB.exe 5412 XBM.exe 5412 XBM.exe 1140 FOQ.exe 1140 FOQ.exe 2552 YHG.exe 2552 YHG.exe 3816 HHIX.exe 3816 HHIX.exe 4240 IKL.exe 4240 IKL.exe 3852 BNPWX.exe 3852 BNPWX.exe 1252 BITS.exe 1252 BITS.exe 4960 ULXVPW.exe 4960 ULXVPW.exe 3472 GBD.exe 3472 GBD.exe 1608 BPVF.exe 1608 BPVF.exe 3248 QFWWUWW.exe 3248 QFWWUWW.exe 1380 JXL.exe 1380 JXL.exe 5304 ZNMH.exe 5304 ZNMH.exe 4800 XYP.exe 4800 XYP.exe 1516 LJFNHJ.exe 1516 LJFNHJ.exe 5012 HJHYLFU.exe 5012 HJHYLFU.exe 1848 ZKWVXWX.exe 1848 ZKWVXWX.exe 4424 WIJNFDM.exe 4424 WIJNFDM.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 3444 2026-07-29_37ad0e62578a8dafe0a65e7f11b47169_elex_emotet_stop.exe 3444 2026-07-29_37ad0e62578a8dafe0a65e7f11b47169_elex_emotet_stop.exe 5668 NYQ.exe 5668 NYQ.exe 5504 QHLIDB.exe 5504 QHLIDB.exe 5108 ZPTCK.exe 5108 ZPTCK.exe 4724 USK.exe 4724 USK.exe 3052 MVOWEUS.exe 3052 MVOWEUS.exe 1960 CLP.exe 1960 CLP.exe 5384 UOSSQFQ.exe 5384 UOSSQFQ.exe 4820 TEEUL.exe 4820 TEEUL.exe 4192 KMGAPIA.exe 4192 KMGAPIA.exe 4720 DPKVUY.exe 4720 DPKVUY.exe 4628 UQMAXDE.exe 4628 UQMAXDE.exe 5424 YYSI.exe 5424 YYSI.exe 3700 EYAWBQB.exe 3700 EYAWBQB.exe 5412 XBM.exe 5412 XBM.exe 1140 FOQ.exe 1140 FOQ.exe 2552 YHG.exe 2552 YHG.exe 3816 HHIX.exe 3816 HHIX.exe 4240 IKL.exe 4240 IKL.exe 3852 BNPWX.exe 3852 BNPWX.exe 1252 BITS.exe 1252 BITS.exe 4960 ULXVPW.exe 4960 ULXVPW.exe 3472 GBD.exe 3472 GBD.exe 1608 BPVF.exe 1608 BPVF.exe 3248 QFWWUWW.exe 3248 QFWWUWW.exe 1380 JXL.exe 1380 JXL.exe 5304 ZNMH.exe 5304 ZNMH.exe 4800 XYP.exe 4800 XYP.exe 1516 LJFNHJ.exe 1516 LJFNHJ.exe 5012 HJHYLFU.exe 5012 HJHYLFU.exe 1848 ZKWVXWX.exe 1848 ZKWVXWX.exe 4424 WIJNFDM.exe 4424 WIJNFDM.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3444 wrote to memory of 4568 3444 2026-07-29_37ad0e62578a8dafe0a65e7f11b47169_elex_emotet_stop.exe 89 PID 4568 wrote to memory of 5668 4568 cmd.exe 93 PID 5668 wrote to memory of 5924 5668 NYQ.exe 95 PID 5924 wrote to memory of 5504 5924 cmd.exe 99 PID 5504 wrote to memory of 3332 5504 QHLIDB.exe 100 PID 3332 wrote to memory of 5108 3332 cmd.exe 104 PID 5108 wrote to memory of 3288 5108 ZPTCK.exe 105 PID 3288 wrote to memory of 4724 3288 cmd.exe 109 PID 4724 wrote to memory of 4660 4724 USK.exe 110 PID 4660 wrote to memory of 3052 4660 cmd.exe 114 PID 3052 wrote to memory of 1484 3052 MVOWEUS.exe 115 PID 1484 wrote to memory of 1960 1484 cmd.exe 119 PID 1960 wrote to memory of 2724 1960 CLP.exe 120 PID 2724 wrote to memory of 5384 2724 cmd.exe 124 PID 5384 wrote to memory of 5652 5384 UOSSQFQ.exe 125 PID 5652 wrote to memory of 4820 5652 cmd.exe 129 PID 4820 wrote to memory of 5960 4820 TEEUL.exe 130 PID 5960 wrote to memory of 4192 5960 cmd.exe 134 PID 4192 wrote to memory of 6020 4192 KMGAPIA.exe 135 PID 6020 wrote to memory of 4720 6020 cmd.exe 139 PID 4720 wrote to memory of 4588 4720 DPKVUY.exe 140 PID 4588 wrote to memory of 4628 4588 cmd.exe 144 PID 4628 wrote to memory of 3900 4628 UQMAXDE.exe 145 PID 3900 wrote to memory of 5424 3900 cmd.exe 149 PID 5424 wrote to memory of 5608 5424 YYSI.exe 150 PID 5608 wrote to memory of 3700 5608 cmd.exe 154 PID 3700 wrote to memory of 5620 3700 EYAWBQB.exe 155 PID 5620 wrote to memory of 5412 5620 cmd.exe 159 PID 5412 wrote to memory of 2988 5412 XBM.exe 160 PID 2988 wrote to memory of 1140 2988 cmd.exe 164 PID 1140 wrote to memory of 5944 1140 FOQ.exe 165 PID 5944 wrote to memory of 2552 5944 cmd.exe 169 PID 2552 wrote to memory of 5436 2552 YHG.exe 170 PID 5436 wrote to memory of 3816 5436 cmd.exe 174 PID 3816 wrote to memory of 5836 3816 HHIX.exe 175 PID 5836 wrote to memory of 4240 5836 cmd.exe 179 PID 4240 wrote to memory of 1084 4240 IKL.exe 180 PID 1084 wrote to memory of 3852 1084 cmd.exe 184 PID 3852 wrote to memory of 4852 3852 BNPWX.exe 185 PID 4852 wrote to memory of 1252 4852 cmd.exe 189 PID 1252 wrote to memory of 2296 1252 BITS.exe 190 PID 2296 wrote to memory of 4960 2296 cmd.exe 194 PID 4960 wrote to memory of 2648 4960 ULXVPW.exe 195 PID 2648 wrote to memory of 3472 2648 cmd.exe 199 PID 3472 wrote to memory of 4352 3472 GBD.exe 200 PID 4352 wrote to memory of 1608 4352 cmd.exe 204 PID 1608 wrote to memory of 3148 1608 BPVF.exe 205 PID 3148 wrote to memory of 3248 3148 cmd.exe 209 PID 3248 wrote to memory of 5728 3248 QFWWUWW.exe 210 PID 5728 wrote to memory of 1380 5728 cmd.exe 214 PID 1380 wrote to memory of 260 1380 JXL.exe 215 PID 260 wrote to memory of 5304 260 cmd.exe 219 PID 5304 wrote to memory of 1148 5304 ZNMH.exe 220 PID 1148 wrote to memory of 4800 1148 cmd.exe 224 PID 4800 wrote to memory of 2736 4800 XYP.exe 225 PID 2736 wrote to memory of 1516 2736 cmd.exe 229 PID 1516 wrote to memory of 4384 1516 LJFNHJ.exe 230 PID 4384 wrote to memory of 5012 4384 cmd.exe 234 PID 5012 wrote to memory of 4084 5012 HJHYLFU.exe 235 PID 4084 wrote to memory of 1848 4084 cmd.exe 239 PID 1848 wrote to memory of 4796 1848 ZKWVXWX.exe 240 PID 4796 wrote to memory of 4424 4796 cmd.exe 244 PID 4424 wrote to memory of 4148 4424 WIJNFDM.exe 245 PID 4148 wrote to memory of 5016 4148 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-29_37ad0e62578a8dafe0a65e7f11b47169_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-29_37ad0e62578a8dafe0a65e7f11b47169_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NYQ.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\windows\SysWOW64\NYQ.exeC:\windows\system32\NYQ.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QHLIDB.exe.bat" "4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5924 -
C:\windows\QHLIDB.exeC:\windows\QHLIDB.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZPTCK.exe.bat" "6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\windows\ZPTCK.exeC:\windows\ZPTCK.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\USK.exe.bat" "8⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\windows\system\USK.exeC:\windows\system\USK.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MVOWEUS.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\windows\SysWOW64\MVOWEUS.exeC:\windows\system32\MVOWEUS.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CLP.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\windows\CLP.exeC:\windows\CLP.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UOSSQFQ.exe.bat" "14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\windows\system\UOSSQFQ.exeC:\windows\system\UOSSQFQ.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TEEUL.exe.bat" "16⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5652 -
C:\windows\TEEUL.exeC:\windows\TEEUL.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KMGAPIA.exe.bat" "18⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5960 -
C:\windows\KMGAPIA.exeC:\windows\KMGAPIA.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DPKVUY.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:6020 -
C:\windows\SysWOW64\DPKVUY.exeC:\windows\system32\DPKVUY.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UQMAXDE.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\windows\UQMAXDE.exeC:\windows\UQMAXDE.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YYSI.exe.bat" "24⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3900 -
C:\windows\SysWOW64\YYSI.exeC:\windows\system32\YYSI.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EYAWBQB.exe.bat" "26⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5608 -
C:\windows\system\EYAWBQB.exeC:\windows\system\EYAWBQB.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XBM.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:5620 -
C:\windows\system\XBM.exeC:\windows\system\XBM.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FOQ.exe.bat" "30⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\windows\SysWOW64\FOQ.exeC:\windows\system32\FOQ.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YHG.exe.bat" "32⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5944 -
C:\windows\SysWOW64\YHG.exeC:\windows\system32\YHG.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HHIX.exe.bat" "34⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5436 -
C:\windows\system\HHIX.exeC:\windows\system\HHIX.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IKL.exe.bat" "36⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5836 -
C:\windows\SysWOW64\IKL.exeC:\windows\system32\IKL.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BNPWX.exe.bat" "38⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\windows\SysWOW64\BNPWX.exeC:\windows\system32\BNPWX.exe39⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BITS.exe.bat" "40⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\windows\system\BITS.exeC:\windows\system\BITS.exe41⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ULXVPW.exe.bat" "42⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\windows\SysWOW64\ULXVPW.exeC:\windows\system32\ULXVPW.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GBD.exe.bat" "44⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\windows\SysWOW64\GBD.exeC:\windows\system32\GBD.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BPVF.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\windows\SysWOW64\BPVF.exeC:\windows\system32\BPVF.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QFWWUWW.exe.bat" "48⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\windows\QFWWUWW.exeC:\windows\QFWWUWW.exe49⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JXL.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:5728 -
C:\windows\JXL.exeC:\windows\JXL.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZNMH.exe.bat" "52⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:260 -
C:\windows\ZNMH.exeC:\windows\ZNMH.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XYP.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\windows\XYP.exeC:\windows\XYP.exe55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LJFNHJ.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\windows\LJFNHJ.exeC:\windows\LJFNHJ.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HJHYLFU.exe.bat" "58⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\windows\SysWOW64\HJHYLFU.exeC:\windows\system32\HJHYLFU.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZKWVXWX.exe.bat" "60⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\windows\SysWOW64\ZKWVXWX.exeC:\windows\system32\ZKWVXWX.exe61⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WIJNFDM.exe.bat" "62⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\windows\SysWOW64\WIJNFDM.exeC:\windows\system32\WIJNFDM.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YFPHULN.exe.bat" "64⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\windows\YFPHULN.exeC:\windows\YFPHULN.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MBAAAID.exe.bat" "66⤵PID:5644
-
C:\windows\SysWOW64\MBAAAID.exeC:\windows\system32\MBAAAID.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4648 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DBPX.exe.bat" "68⤵PID:4448
-
C:\windows\SysWOW64\DBPX.exeC:\windows\system32\DBPX.exe69⤵
- Executes dropped EXE
PID:5392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YJX.exe.bat" "70⤵PID:2984
-
C:\windows\system\YJX.exeC:\windows\system\YJX.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SKF.exe.bat" "72⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4988 -
C:\windows\system\SKF.exeC:\windows\system\SKF.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6104 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FINQNXL.exe.bat" "74⤵PID:668
-
C:\windows\FINQNXL.exeC:\windows\FINQNXL.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RXG.exe.bat" "76⤵PID:248
-
C:\windows\SysWOW64\RXG.exeC:\windows\system32\RXG.exe77⤵
- Executes dropped EXE
PID:612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VBEEAU.exe.bat" "78⤵PID:1504
-
C:\windows\system\VBEEAU.exeC:\windows\system\VBEEAU.exe79⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FYKYQ.exe.bat" "80⤵
- Executes a command shell one-liner
PID:3540 -
C:\windows\FYKYQ.exeC:\windows\FYKYQ.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YBOCVTV.exe.bat" "82⤵PID:2480
-
C:\windows\YBOCVTV.exeC:\windows\YBOCVTV.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YWEQK.exe.bat" "84⤵PID:3632
-
C:\windows\SysWOW64\YWEQK.exeC:\windows\system32\YWEQK.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BNNM.exe.bat" "86⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5268 -
C:\windows\BNNM.exeC:\windows\BNNM.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JSZT.exe.bat" "88⤵PID:4972
-
C:\windows\JSZT.exeC:\windows\JSZT.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WDIR.exe.bat" "90⤵PID:4368
-
C:\windows\SysWOW64\WDIR.exeC:\windows\system32\WDIR.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ODWP.exe.bat" "92⤵
- Executes a command shell one-liner
PID:3068 -
C:\windows\ODWP.exeC:\windows\ODWP.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NWZ.exe.bat" "94⤵
- System Location Discovery: System Language Discovery
PID:3040 -
C:\windows\SysWOW64\NWZ.exeC:\windows\system32\NWZ.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EWN.exe.bat" "96⤵PID:1272
-
C:\windows\EWN.exeC:\windows\EWN.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MKA.exe.bat" "98⤵
- System Location Discovery: System Language Discovery
PID:3760 -
C:\windows\MKA.exeC:\windows\MKA.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4896 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FXZPFT.exe.bat" "100⤵
- System Location Discovery: System Language Discovery
PID:3032 -
C:\windows\FXZPFT.exeC:\windows\FXZPFT.exe101⤵
- Executes dropped EXE
PID:2284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ENKSA.exe.bat" "102⤵
- Executes a command shell one-liner
PID:1308 -
C:\windows\ENKSA.exeC:\windows\ENKSA.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IQI.exe.bat" "104⤵
- System Location Discovery: System Language Discovery
PID:4244 -
C:\windows\SysWOW64\IQI.exeC:\windows\system32\IQI.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UGJFOE.exe.bat" "106⤵PID:4676
-
C:\windows\UGJFOE.exeC:\windows\UGJFOE.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TRM.exe.bat" "108⤵PID:4948
-
C:\windows\system\TRM.exeC:\windows\system\TRM.exe109⤵
- Executes dropped EXE
PID:3056 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VPSHMSR.exe.bat" "110⤵PID:5776
-
C:\windows\SysWOW64\VPSHMSR.exeC:\windows\system32\VPSHMSR.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DCEWOQM.exe.bat" "112⤵PID:2576
-
C:\windows\SysWOW64\DCEWOQM.exeC:\windows\system32\DCEWOQM.exe113⤵
- Executes dropped EXE
PID:5844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BNHEXE.exe.bat" "114⤵PID:5724
-
C:\windows\SysWOW64\BNHEXE.exeC:\windows\system32\BNHEXE.exe115⤵
- Executes dropped EXE
PID:3616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AYSUG.exe.bat" "116⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2036 -
C:\windows\AYSUG.exeC:\windows\AYSUG.exe117⤵
- Executes dropped EXE
PID:4092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DLBEZW.exe.bat" "118⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2740 -
C:\windows\DLBEZW.exeC:\windows\DLBEZW.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SBCVYRJ.exe.bat" "120⤵
- Executes a command shell one-liner
PID:3372 -
C:\windows\SBCVYRJ.exeC:\windows\SBCVYRJ.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1344
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-