Analysis
- max time kernel
150s - max time network
133s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/07/2026, 15:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-29_c734fc32c749e48dbd158e7fe889893f_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-07-29_c734fc32c749e48dbd158e7fe889893f_elex_emotet_stop.exe
- Size 208KB
- Sample260729-spms2aam6y
- SHA256 3c8b2b90ea8c448597364cfb64385f6fd67cba756f7a72de8a30d5c10d66d246
- MD5 c734fc32c749e48dbd158e7fe889893f
- SHA1 fce815152d0f2b7383aeddfd23e3f3007e4ada43
- SHA512 72f9470c171b9ad0bcdb2e41ca5c057301a6f0d9844f4b9e57c34cf4771462bed34a638e129d9e00c79e28609819fa7dc4aa923c9e8973d7a603244cfafe65a5
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFleKL+LOfX4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFleS+LO/kEj1
- TLSH T1CC247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1960 DZZMHV.exe 2544 IVRU.exe 936 DFITFHE.exe 1584 DLMZQG.exe 1508 YRULS.exe 3020 EMYM.exe 4768 LHKFLC.exe 3028 EAZQVD.exe 4352 NABVGBR.exe 1504 GAJ.exe 4296 QYWAX.exe 1996 GOX.exe 4652 EEIDZLF.exe 4540 IHHQZ.exe 2140 YCQ.exe 4072 JVTN.exe 760 LSZHZG.exe 5276 HYE.exe 5868 VEEQQCS.exe 3172 FCSKYK.exe 5048 QUZV.exe 4976 HUCATIL.exe 3392 CIGK.exe 4480 XDLTFI.exe 1324 TJDIV.exe 4624 LJFNHJ.exe 3248 FWK.exe 4636 JMRFVTW.exe 4664 TKWZD.exe 3856 CKYEOH.exe 1228 ILG.exe 2992 MOENXU.exe 4216 DBPX.exe 2444 CWOGS.exe 4828 RRX.exe 1696 VHEKP.exe 2024 MIG.exe 2792 QYNXEW.exe 2460 RTQBKMK.exe 52 JWUXXC.exe 1124 TWW.exe 1968 IZOOMU.exe 3816 ZZITPSY.exe 2312 IIK.exe 4120 SFX.exe 2784 WOETU.exe 3752 GWGYYV.exe 2216 SEMGKO.exe 4576 HZWKVAW.exe 688 JAN.exe 5232 HVFJVC.exe 2068 DYVA.exe 1076 HOC.exe 5696 ZRFDB.exe 5340 HWGSCA.exe 1720 CKK.exe 5512 WXPL.exe 3044 CXPGGCW.exe 5264 MGR.exe 5980 HIHCXK.exe 628 OYIC.exe 1776 TESRM.exe 1372 CMUWYY.exe 3848 BXFMY.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\DBPX.exe MOENXU.exe File created C:\windows\SysWOW64\CWOGS.exe.bat DBPX.exe File created C:\windows\SysWOW64\ZZITPSY.exe.bat IZOOMU.exe File opened for modification C:\windows\SysWOW64\SEMGKO.exe GWGYYV.exe File created C:\windows\SysWOW64\JAN.exe.bat XKZAEG.exe File opened for modification C:\windows\SysWOW64\QUZV.exe FCSKYK.exe File opened for modification C:\windows\SysWOW64\NABVGBR.exe EAZQVD.exe File opened for modification C:\windows\SysWOW64\MIG.exe VHEKP.exe File created C:\windows\SysWOW64\MJRG.exe DAPBOP.exe File created C:\windows\SysWOW64\LVHFQ.exe.bat VAYSFXX.exe File created C:\windows\SysWOW64\DLMZQG.exe.bat DFITFHE.exe File created C:\windows\SysWOW64\WOETU.exe.bat SFX.exe File opened for modification C:\windows\SysWOW64\IVRU.exe DZZMHV.exe File opened for modification C:\windows\SysWOW64\XDLTFI.exe CIGK.exe File created C:\windows\SysWOW64\CXPGGCW.exe WXPL.exe File created C:\windows\SysWOW64\QCAQMIA.exe RRP.exe File created C:\windows\SysWOW64\RSIT.exe GSBI.exe File created C:\windows\SysWOW64\QUZV.exe.bat FCSKYK.exe File created C:\windows\SysWOW64\HOC.exe.bat DYVA.exe File created C:\windows\SysWOW64\QCAQMIA.exe.bat RRP.exe File created C:\windows\SysWOW64\DBPX.exe.bat MOENXU.exe File opened for modification C:\windows\SysWOW64\CWOGS.exe DBPX.exe File created C:\windows\SysWOW64\HWWPCM.exe.bat MJRG.exe File created C:\windows\SysWOW64\LVHFQ.exe VAYSFXX.exe File opened for modification C:\windows\SysWOW64\JAN.exe XKZAEG.exe File created C:\windows\SysWOW64\IVRU.exe.bat DZZMHV.exe File created C:\windows\SysWOW64\HUCATIL.exe QUZV.exe File created C:\windows\SysWOW64\MIG.exe.bat VHEKP.exe File opened for modification C:\windows\SysWOW64\IZOOMU.exe TWW.exe File opened for modification C:\windows\SysWOW64\GSBI.exe QCAQMIA.exe File created C:\windows\SysWOW64\HVFJVC.exe JAN.exe File created C:\windows\SysWOW64\HUCATIL.exe.bat QUZV.exe File created C:\windows\SysWOW64\ZZITPSY.exe IZOOMU.exe File created C:\windows\SysWOW64\SEMGKO.exe.bat GWGYYV.exe File created C:\windows\SysWOW64\HVFJVC.exe.bat JAN.exe File created C:\windows\SysWOW64\XNO.exe AHVU.exe File opened for modification C:\windows\SysWOW64\QCAQMIA.exe RRP.exe File created C:\windows\SysWOW64\HWWPCM.exe MJRG.exe File created C:\windows\SysWOW64\IVRU.exe DZZMHV.exe File opened for modification C:\windows\SysWOW64\HOC.exe DYVA.exe File opened for modification C:\windows\SysWOW64\URGXOH.exe GLGMNWB.exe File opened for modification C:\windows\SysWOW64\HWWPCM.exe MJRG.exe File opened for modification C:\windows\SysWOW64\YRULS.exe DLMZQG.exe File created C:\windows\SysWOW64\XDLTFI.exe.bat CIGK.exe File created C:\windows\SysWOW64\TJDIV.exe.bat XDLTFI.exe File created C:\windows\SysWOW64\JWUXXC.exe.bat RTQBKMK.exe File created C:\windows\SysWOW64\IZOOMU.exe.bat TWW.exe File created C:\windows\SysWOW64\HOC.exe DYVA.exe File created C:\windows\SysWOW64\CXPGGCW.exe.bat WXPL.exe File created C:\windows\SysWOW64\URGXOH.exe.bat GLGMNWB.exe File opened for modification C:\windows\SysWOW64\HUCATIL.exe QUZV.exe File created C:\windows\SysWOW64\XDLTFI.exe CIGK.exe File opened for modification C:\windows\SysWOW64\XNO.exe AHVU.exe File opened for modification C:\windows\SysWOW64\LVHFQ.exe VAYSFXX.exe File created C:\windows\SysWOW64\YRULS.exe DLMZQG.exe File created C:\windows\SysWOW64\YRULS.exe.bat DLMZQG.exe File created C:\windows\SysWOW64\JWUXXC.exe RTQBKMK.exe File opened for modification C:\windows\SysWOW64\TWW.exe JWUXXC.exe File created C:\windows\SysWOW64\SEMGKO.exe GWGYYV.exe File created C:\windows\SysWOW64\JAN.exe XKZAEG.exe File opened for modification C:\windows\SysWOW64\MJRG.exe DAPBOP.exe File opened for modification C:\windows\SysWOW64\DBPX.exe MOENXU.exe File created C:\windows\SysWOW64\IZOOMU.exe TWW.exe File opened for modification C:\windows\SysWOW64\WOETU.exe SFX.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\system\RTXB.exe RQTYEHN.exe File created C:\windows\LSZHZG.exe JVTN.exe File created C:\windows\system\CIGK.exe HUCATIL.exe File created C:\windows\RTQBKMK.exe QYNXEW.exe File created C:\windows\EEIDZLF.exe GOX.exe File created C:\windows\system\VHEKP.exe RRX.exe File created C:\windows\ZRFDB.exe HOC.exe File created C:\windows\OYIC.exe HIHCXK.exe File created C:\windows\system\EOH.exe FVEMOE.exe File opened for modification C:\windows\DZZMHV.exe 2026-07-29_c734fc32c749e48dbd158e7fe889893f_elex_emotet_stop.exe File created C:\windows\CKYEOH.exe TKWZD.exe File created C:\windows\TRC.exe RTXB.exe File created C:\windows\QYWAX.exe.bat GAJ.exe File created C:\windows\EEIDZLF.exe.bat GOX.exe File created C:\windows\system\IHHQZ.exe.bat EEIDZLF.exe File opened for modification C:\windows\MOENXU.exe ILG.exe File opened for modification C:\windows\CMUWYY.exe TESRM.exe File created C:\windows\system\BXFMY.exe CMUWYY.exe File opened for modification C:\windows\DFITFHE.exe IVRU.exe File created C:\windows\EAZQVD.exe.bat LHKFLC.exe File created C:\windows\JVTN.exe.bat YCQ.exe File created C:\windows\system\VEEQQCS.exe.bat HYE.exe File opened for modification C:\windows\QYNXEW.exe MIG.exe File created C:\windows\system\WXPL.exe.bat CKK.exe File opened for modification C:\windows\FCSKYK.exe VEEQQCS.exe File created C:\windows\GWGYYV.exe.bat WOETU.exe File opened for modification C:\windows\system\HLTVFYY.exe XNO.exe File opened for modification C:\windows\EAZQVD.exe LHKFLC.exe File opened for modification C:\windows\YCQ.exe IHHQZ.exe File opened for modification C:\windows\LSZHZG.exe JVTN.exe File opened for modification C:\windows\system\JMRFVTW.exe FWK.exe File opened for modification C:\windows\HWGSCA.exe ZRFDB.exe File created C:\windows\OYIC.exe.bat HIHCXK.exe File created C:\windows\system\EOH.exe.bat FVEMOE.exe File created C:\windows\system\RRP.exe.bat EOH.exe File created C:\windows\EAZQVD.exe LHKFLC.exe File opened for modification C:\windows\system\GAJ.exe NABVGBR.exe File created C:\windows\CKK.exe.bat HWGSCA.exe File created C:\windows\AHVU.exe SCRFX.exe File created C:\windows\system\RTXB.exe RQTYEHN.exe File opened for modification C:\windows\system\VEEQQCS.exe HYE.exe File opened for modification C:\windows\system\CIGK.exe HUCATIL.exe File created C:\windows\system\RRP.exe EOH.exe File created C:\windows\DWGRN.exe.bat HWWPCM.exe File created C:\windows\system\GAJ.exe NABVGBR.exe File created C:\windows\RTQBKMK.exe.bat QYNXEW.exe File opened for modification C:\windows\system\SFX.exe IIK.exe File created C:\windows\system\TRP.exe.bat DWGRN.exe File created C:\windows\MOENXU.exe.bat ILG.exe File opened for modification C:\windows\OYIC.exe HIHCXK.exe File created C:\windows\TRC.exe.bat RTXB.exe File opened for modification C:\windows\ZRFDB.exe HOC.exe File created C:\windows\JVTN.exe YCQ.exe File created C:\windows\FCSKYK.exe VEEQQCS.exe File created C:\windows\HZWKVAW.exe.bat SEMGKO.exe File created C:\windows\DAPBOP.exe.bat RSIT.exe File created C:\windows\VAYSFXX.exe TRP.exe File created C:\windows\LSZHZG.exe.bat JVTN.exe File opened for modification C:\windows\system\TKWZD.exe JMRFVTW.exe File created C:\windows\system\DYVA.exe.bat HVFJVC.exe File created C:\windows\system\HIHCXK.exe.bat MGR.exe File created C:\windows\system\BXFMY.exe.bat CMUWYY.exe File created C:\windows\DFITFHE.exe IVRU.exe File opened for modification C:\windows\LHKFLC.exe EMYM.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 8 cmd.exe 5176 cmd.exe 5324 cmd.exe 4356 cmd.exe 1028 cmd.exe 4728 cmd.exe 4892 cmd.exe 4544 cmd.exe 4608 cmd.exe 4592 cmd.exe 3060 cmd.exe 4536 cmd.exe 5412 cmd.exe 2404 cmd.exe 3540 cmd.exe 4556 cmd.exe 4780 cmd.exe 3520 cmd.exe 4316 cmd.exe 264 cmd.exe 200 cmd.exe 1392 cmd.exe 824 cmd.exe 2248 cmd.exe 5932 cmd.exe 5456 cmd.exe 3304 cmd.exe 4476 cmd.exe 1200 cmd.exe 2876 cmd.exe 2148 cmd.exe 4448 cmd.exe 2952 cmd.exe 3688 cmd.exe 2916 cmd.exe 6076 cmd.exe 3116 cmd.exe 4868 cmd.exe 1308 cmd.exe 3040 cmd.exe 2628 cmd.exe 3804 cmd.exe 5488 cmd.exe 2172 cmd.exe 2880 cmd.exe 2512 cmd.exe 5296 cmd.exe 1600 cmd.exe 2796 cmd.exe 3156 cmd.exe 1972 cmd.exe 1940 cmd.exe 2656 cmd.exe 5228 cmd.exe 4056 cmd.exe 3716 cmd.exe 5104 cmd.exe 6140 cmd.exe 1572 cmd.exe 2616 cmd.exe 4716 cmd.exe 1664 cmd.exe 4484 cmd.exe 3676 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 1212 1188 WerFault.exe 87 4244 1960 WerFault.exe 93 6036 2544 WerFault.exe 99 6076 936 WerFault.exe 104 2696 1584 WerFault.exe 109 4288 1508 WerFault.exe 114 2912 3020 WerFault.exe 119 208 4768 WerFault.exe 124 4668 3028 WerFault.exe 129 3156 4352 WerFault.exe 134 908 1504 WerFault.exe 139 5752 4296 WerFault.exe 144 4564 1996 WerFault.exe 149 4724 4652 WerFault.exe 154 4736 4540 WerFault.exe 159 3752 2140 WerFault.exe 163 3940 4072 WerFault.exe 169 2796 760 WerFault.exe 173 5324 5276 WerFault.exe 179 1148 5868 WerFault.exe 184 4656 3172 WerFault.exe 189 5296 5048 WerFault.exe 194 5980 4976 WerFault.exe 199 2564 3392 WerFault.exe 204 3936 4480 WerFault.exe 209 828 1324 WerFault.exe 214 2296 4624 WerFault.exe 219 6032 3248 WerFault.exe 224 1936 4636 WerFault.exe 229 5444 4664 WerFault.exe 234 2980 3856 WerFault.exe 239 4300 1228 WerFault.exe 244 4808 2992 WerFault.exe 249 3740 4216 WerFault.exe 254 5904 2444 WerFault.exe 259 2928 4828 WerFault.exe 264 2148 1696 WerFault.exe 269 5364 2024 WerFault.exe 275 2972 2792 WerFault.exe 280 6020 2460 WerFault.exe 285 2980 52 WerFault.exe 290 2128 1124 WerFault.exe 295 3596 1968 WerFault.exe 300 3564 3816 WerFault.exe 305 2180 2312 WerFault.exe 310 3340 4120 WerFault.exe 315 2976 2784 WerFault.exe 320 2296 3752 WerFault.exe 325 1484 2216 WerFault.exe 330 3716 4576 WerFault.exe 335 436 1224 WerFault.exe 340 3304 688 WerFault.exe 345 2876 5232 WerFault.exe 350 5572 2068 WerFault.exe 355 4836 1076 WerFault.exe 360 2700 5696 WerFault.exe 365 6140 5340 WerFault.exe 370 8 1720 WerFault.exe 375 1276 5512 WerFault.exe 380 2984 3044 WerFault.exe 385 1928 5264 WerFault.exe 390 1032 5980 WerFault.exe 395 4640 628 WerFault.exe 400 3140 1776 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GAJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YCQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DAPBOP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LVHFQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-29_c734fc32c749e48dbd158e7fe889893f_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DBPX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MJRG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QUZV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LJFNHJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HVFJVC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CIGK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RSIT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TRP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DFITFHE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NABVGBR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IHHQZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ILG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BAJQMCL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XDLTFI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZZITPSY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FVEMOE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YRULS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EAZQVD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SFX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZRFDB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RRP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RQTYEHN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IIK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RTQBKMK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BXFMY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GSBI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DLMZQG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1188 2026-07-29_c734fc32c749e48dbd158e7fe889893f_elex_emotet_stop.exe 1188 2026-07-29_c734fc32c749e48dbd158e7fe889893f_elex_emotet_stop.exe 1960 DZZMHV.exe 1960 DZZMHV.exe 2544 IVRU.exe 2544 IVRU.exe 936 DFITFHE.exe 936 DFITFHE.exe 1584 DLMZQG.exe 1584 DLMZQG.exe 1508 YRULS.exe 1508 YRULS.exe 3020 EMYM.exe 3020 EMYM.exe 4768 LHKFLC.exe 4768 LHKFLC.exe 3028 EAZQVD.exe 3028 EAZQVD.exe 4352 NABVGBR.exe 4352 NABVGBR.exe 1504 GAJ.exe 1504 GAJ.exe 4296 QYWAX.exe 4296 QYWAX.exe 1996 GOX.exe 1996 GOX.exe 4652 EEIDZLF.exe 4652 EEIDZLF.exe 4540 IHHQZ.exe 4540 IHHQZ.exe 2140 YCQ.exe 2140 YCQ.exe 4072 JVTN.exe 4072 JVTN.exe 760 LSZHZG.exe 760 LSZHZG.exe 5276 HYE.exe 5276 HYE.exe 5868 VEEQQCS.exe 5868 VEEQQCS.exe 3172 FCSKYK.exe 3172 FCSKYK.exe 5048 QUZV.exe 5048 QUZV.exe 4976 HUCATIL.exe 4976 HUCATIL.exe 3392 CIGK.exe 3392 CIGK.exe 4480 XDLTFI.exe 4480 XDLTFI.exe 1324 TJDIV.exe 1324 TJDIV.exe 4624 LJFNHJ.exe 4624 LJFNHJ.exe 3248 FWK.exe 3248 FWK.exe 4636 JMRFVTW.exe 4636 JMRFVTW.exe 4664 TKWZD.exe 4664 TKWZD.exe 3856 CKYEOH.exe 3856 CKYEOH.exe 1228 ILG.exe 1228 ILG.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1188 2026-07-29_c734fc32c749e48dbd158e7fe889893f_elex_emotet_stop.exe 1188 2026-07-29_c734fc32c749e48dbd158e7fe889893f_elex_emotet_stop.exe 1960 DZZMHV.exe 1960 DZZMHV.exe 2544 IVRU.exe 2544 IVRU.exe 936 DFITFHE.exe 936 DFITFHE.exe 1584 DLMZQG.exe 1584 DLMZQG.exe 1508 YRULS.exe 1508 YRULS.exe 3020 EMYM.exe 3020 EMYM.exe 4768 LHKFLC.exe 4768 LHKFLC.exe 3028 EAZQVD.exe 3028 EAZQVD.exe 4352 NABVGBR.exe 4352 NABVGBR.exe 1504 GAJ.exe 1504 GAJ.exe 4296 QYWAX.exe 4296 QYWAX.exe 1996 GOX.exe 1996 GOX.exe 4652 EEIDZLF.exe 4652 EEIDZLF.exe 4540 IHHQZ.exe 4540 IHHQZ.exe 2140 YCQ.exe 2140 YCQ.exe 4072 JVTN.exe 4072 JVTN.exe 760 LSZHZG.exe 760 LSZHZG.exe 5276 HYE.exe 5276 HYE.exe 5868 VEEQQCS.exe 5868 VEEQQCS.exe 3172 FCSKYK.exe 3172 FCSKYK.exe 5048 QUZV.exe 5048 QUZV.exe 4976 HUCATIL.exe 4976 HUCATIL.exe 3392 CIGK.exe 3392 CIGK.exe 4480 XDLTFI.exe 4480 XDLTFI.exe 1324 TJDIV.exe 1324 TJDIV.exe 4624 LJFNHJ.exe 4624 LJFNHJ.exe 3248 FWK.exe 3248 FWK.exe 4636 JMRFVTW.exe 4636 JMRFVTW.exe 4664 TKWZD.exe 4664 TKWZD.exe 3856 CKYEOH.exe 3856 CKYEOH.exe 1228 ILG.exe 1228 ILG.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1188 wrote to memory of 2816 1188 2026-07-29_c734fc32c749e48dbd158e7fe889893f_elex_emotet_stop.exe 89 PID 2816 wrote to memory of 1960 2816 cmd.exe 93 PID 1960 wrote to memory of 704 1960 DZZMHV.exe 95 PID 704 wrote to memory of 2544 704 cmd.exe 99 PID 2544 wrote to memory of 2828 2544 IVRU.exe 100 PID 2828 wrote to memory of 936 2828 cmd.exe 104 PID 936 wrote to memory of 1308 936 DFITFHE.exe 105 PID 1308 wrote to memory of 1584 1308 cmd.exe 109 PID 1584 wrote to memory of 1940 1584 DLMZQG.exe 110 PID 1940 wrote to memory of 1508 1940 cmd.exe 114 PID 1508 wrote to memory of 3320 1508 YRULS.exe 115 PID 3320 wrote to memory of 3020 3320 cmd.exe 119 PID 3020 wrote to memory of 4908 3020 EMYM.exe 120 PID 4908 wrote to memory of 4768 4908 cmd.exe 124 PID 4768 wrote to memory of 5380 4768 LHKFLC.exe 125 PID 5380 wrote to memory of 3028 5380 cmd.exe 129 PID 3028 wrote to memory of 3620 3028 EAZQVD.exe 130 PID 3620 wrote to memory of 4352 3620 cmd.exe 134 PID 4352 wrote to memory of 4620 4352 NABVGBR.exe 135 PID 4620 wrote to memory of 1504 4620 cmd.exe 139 PID 1504 wrote to memory of 352 1504 GAJ.exe 140 PID 352 wrote to memory of 4296 352 cmd.exe 144 PID 4296 wrote to memory of 3132 4296 QYWAX.exe 145 PID 3132 wrote to memory of 1996 3132 cmd.exe 149 PID 1996 wrote to memory of 552 1996 GOX.exe 150 PID 552 wrote to memory of 4652 552 cmd.exe 154 PID 4652 wrote to memory of 1904 4652 EEIDZLF.exe 155 PID 1904 wrote to memory of 4540 1904 cmd.exe 159 PID 4540 wrote to memory of 3408 4540 IHHQZ.exe 160 PID 3408 wrote to memory of 2140 3408 cmd.exe 163 PID 2140 wrote to memory of 4716 2140 YCQ.exe 165 PID 4716 wrote to memory of 4072 4716 cmd.exe 169 PID 4072 wrote to memory of 3236 4072 JVTN.exe 170 PID 3236 wrote to memory of 760 3236 cmd.exe 173 PID 760 wrote to memory of 2428 760 LSZHZG.exe 175 PID 2428 wrote to memory of 5276 2428 cmd.exe 179 PID 5276 wrote to memory of 2416 5276 HYE.exe 180 PID 2416 wrote to memory of 5868 2416 cmd.exe 184 PID 5868 wrote to memory of 5132 5868 VEEQQCS.exe 185 PID 5132 wrote to memory of 3172 5132 cmd.exe 189 PID 3172 wrote to memory of 2656 3172 FCSKYK.exe 190 PID 2656 wrote to memory of 5048 2656 cmd.exe 194 PID 5048 wrote to memory of 6096 5048 QUZV.exe 195 PID 6096 wrote to memory of 4976 6096 cmd.exe 199 PID 4976 wrote to memory of 960 4976 HUCATIL.exe 200 PID 960 wrote to memory of 3392 960 cmd.exe 204 PID 3392 wrote to memory of 6072 3392 CIGK.exe 205 PID 6072 wrote to memory of 4480 6072 cmd.exe 209 PID 4480 wrote to memory of 4476 4480 XDLTFI.exe 210 PID 4476 wrote to memory of 1324 4476 cmd.exe 214 PID 1324 wrote to memory of 5228 1324 TJDIV.exe 215 PID 5228 wrote to memory of 4624 5228 cmd.exe 219 PID 4624 wrote to memory of 5068 4624 LJFNHJ.exe 220 PID 5068 wrote to memory of 3248 5068 cmd.exe 224 PID 3248 wrote to memory of 4288 3248 FWK.exe 225 PID 4288 wrote to memory of 4636 4288 cmd.exe 229 PID 4636 wrote to memory of 4448 4636 JMRFVTW.exe 230 PID 4448 wrote to memory of 4664 4448 cmd.exe 234 PID 4664 wrote to memory of 5112 4664 TKWZD.exe 235 PID 5112 wrote to memory of 3856 5112 cmd.exe 239 PID 3856 wrote to memory of 6024 3856 CKYEOH.exe 240 PID 6024 wrote to memory of 1228 6024 cmd.exe 244 PID 1228 wrote to memory of 1120 1228 ILG.exe 245 PID 1120 wrote to memory of 2992 1120 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-29_c734fc32c749e48dbd158e7fe889893f_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-29_c734fc32c749e48dbd158e7fe889893f_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DZZMHV.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\windows\DZZMHV.exeC:\windows\DZZMHV.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IVRU.exe.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:704 -
C:\windows\SysWOW64\IVRU.exeC:\windows\system32\IVRU.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DFITFHE.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\windows\DFITFHE.exeC:\windows\DFITFHE.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DLMZQG.exe.bat" "8⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\windows\SysWOW64\DLMZQG.exeC:\windows\system32\DLMZQG.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YRULS.exe.bat" "10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\windows\SysWOW64\YRULS.exeC:\windows\system32\YRULS.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EMYM.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\windows\system\EMYM.exeC:\windows\system\EMYM.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LHKFLC.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\windows\LHKFLC.exeC:\windows\LHKFLC.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EAZQVD.exe.bat" "16⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5380 -
C:\windows\EAZQVD.exeC:\windows\EAZQVD.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NABVGBR.exe.bat" "18⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\windows\SysWOW64\NABVGBR.exeC:\windows\system32\NABVGBR.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GAJ.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\windows\system\GAJ.exeC:\windows\system\GAJ.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QYWAX.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:352 -
C:\windows\QYWAX.exeC:\windows\QYWAX.exe23⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GOX.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:3132 -
C:\windows\system\GOX.exeC:\windows\system\GOX.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EEIDZLF.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:552 -
C:\windows\EEIDZLF.exeC:\windows\EEIDZLF.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IHHQZ.exe.bat" "28⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\windows\system\IHHQZ.exeC:\windows\system\IHHQZ.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YCQ.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\windows\YCQ.exeC:\windows\YCQ.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JVTN.exe.bat" "32⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\windows\JVTN.exeC:\windows\JVTN.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LSZHZG.exe.bat" "34⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3236 -
C:\windows\LSZHZG.exeC:\windows\LSZHZG.exe35⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HYE.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\windows\HYE.exeC:\windows\HYE.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5276 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VEEQQCS.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\windows\system\VEEQQCS.exeC:\windows\system\VEEQQCS.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FCSKYK.exe.bat" "40⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5132 -
C:\windows\FCSKYK.exeC:\windows\FCSKYK.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QUZV.exe.bat" "42⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\windows\SysWOW64\QUZV.exeC:\windows\system32\QUZV.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HUCATIL.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:6096 -
C:\windows\SysWOW64\HUCATIL.exeC:\windows\system32\HUCATIL.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CIGK.exe.bat" "46⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:960 -
C:\windows\system\CIGK.exeC:\windows\system\CIGK.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XDLTFI.exe.bat" "48⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6072 -
C:\windows\SysWOW64\XDLTFI.exeC:\windows\system32\XDLTFI.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TJDIV.exe.bat" "50⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\windows\SysWOW64\TJDIV.exeC:\windows\system32\TJDIV.exe51⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LJFNHJ.exe.bat" "52⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5228 -
C:\windows\LJFNHJ.exeC:\windows\LJFNHJ.exe53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FWK.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\windows\FWK.exeC:\windows\FWK.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JMRFVTW.exe.bat" "56⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\windows\system\JMRFVTW.exeC:\windows\system\JMRFVTW.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TKWZD.exe.bat" "58⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\windows\system\TKWZD.exeC:\windows\system\TKWZD.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CKYEOH.exe.bat" "60⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\windows\CKYEOH.exeC:\windows\CKYEOH.exe61⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ILG.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:6024 -
C:\windows\ILG.exeC:\windows\ILG.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MOENXU.exe.bat" "64⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\windows\MOENXU.exeC:\windows\MOENXU.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DBPX.exe.bat" "66⤵
- Executes a command shell one-liner
PID:1664 -
C:\windows\SysWOW64\DBPX.exeC:\windows\system32\DBPX.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4216 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CWOGS.exe.bat" "68⤵
- System Location Discovery: System Language Discovery
PID:4376 -
C:\windows\SysWOW64\CWOGS.exeC:\windows\system32\CWOGS.exe69⤵
- Executes dropped EXE
PID:2444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RRX.exe.bat" "70⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4056 -
C:\windows\RRX.exeC:\windows\RRX.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VHEKP.exe.bat" "72⤵PID:4736
-
C:\windows\system\VHEKP.exeC:\windows\system\VHEKP.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MIG.exe.bat" "74⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1028 -
C:\windows\SysWOW64\MIG.exeC:\windows\system32\MIG.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2024 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QYNXEW.exe.bat" "76⤵
- Executes a command shell one-liner
PID:2512 -
C:\windows\QYNXEW.exeC:\windows\QYNXEW.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2792 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RTQBKMK.exe.bat" "78⤵
- Executes a command shell one-liner
PID:4728 -
C:\windows\RTQBKMK.exeC:\windows\RTQBKMK.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JWUXXC.exe.bat" "80⤵
- System Location Discovery: System Language Discovery
PID:2824 -
C:\windows\SysWOW64\JWUXXC.exeC:\windows\system32\JWUXXC.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:52 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TWW.exe.bat" "82⤵PID:4668
-
C:\windows\SysWOW64\TWW.exeC:\windows\system32\TWW.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IZOOMU.exe.bat" "84⤵
- Executes a command shell one-liner
PID:5296 -
C:\windows\SysWOW64\IZOOMU.exeC:\windows\system32\IZOOMU.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZZITPSY.exe.bat" "86⤵PID:572
-
C:\windows\SysWOW64\ZZITPSY.exeC:\windows\system32\ZZITPSY.exe87⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IIK.exe.bat" "88⤵
- Executes a command shell one-liner
PID:4608 -
C:\windows\IIK.exeC:\windows\IIK.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SFX.exe.bat" "90⤵PID:4108
-
C:\windows\system\SFX.exeC:\windows\system\SFX.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4120 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WOETU.exe.bat" "92⤵
- Executes a command shell one-liner
PID:4592 -
C:\windows\SysWOW64\WOETU.exeC:\windows\system32\WOETU.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2784 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GWGYYV.exe.bat" "94⤵PID:3456
-
C:\windows\GWGYYV.exeC:\windows\GWGYYV.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SEMGKO.exe.bat" "96⤵PID:2556
-
C:\windows\SysWOW64\SEMGKO.exeC:\windows\system32\SEMGKO.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2216 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HZWKVAW.exe.bat" "98⤵PID:3860
-
C:\windows\HZWKVAW.exeC:\windows\HZWKVAW.exe99⤵
- Executes dropped EXE
PID:4576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XKZAEG.exe.bat" "100⤵
- System Location Discovery: System Language Discovery
PID:4432 -
C:\windows\XKZAEG.exeC:\windows\XKZAEG.exe101⤵
- Drops file in System32 directory
PID:1224 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JAN.exe.bat" "102⤵PID:1068
-
C:\windows\SysWOW64\JAN.exeC:\windows\system32\JAN.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HVFJVC.exe.bat" "104⤵PID:1164
-
C:\windows\SysWOW64\HVFJVC.exeC:\windows\system32\HVFJVC.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5232 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DYVA.exe.bat" "106⤵PID:1344
-
C:\windows\system\DYVA.exeC:\windows\system\DYVA.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HOC.exe.bat" "108⤵PID:2696
-
C:\windows\SysWOW64\HOC.exeC:\windows\system32\HOC.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZRFDB.exe.bat" "110⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2952 -
C:\windows\ZRFDB.exeC:\windows\ZRFDB.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HWGSCA.exe.bat" "112⤵
- Executes a command shell one-liner
PID:2616 -
C:\windows\HWGSCA.exeC:\windows\HWGSCA.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5340 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CKK.exe.bat" "114⤵PID:3584
-
C:\windows\CKK.exeC:\windows\CKK.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WXPL.exe.bat" "116⤵PID:2492
-
C:\windows\system\WXPL.exeC:\windows\system\WXPL.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CXPGGCW.exe.bat" "118⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3060 -
C:\windows\SysWOW64\CXPGGCW.exeC:\windows\system32\CXPGGCW.exe119⤵
- Executes dropped EXE
PID:3044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MGR.exe.bat" "120⤵
- Executes a command shell one-liner
PID:3688 -
C:\windows\MGR.exeC:\windows\MGR.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5264
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-