Analysis
- max time kernel
86s - max time network
145s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/07/2026, 15:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-29_b723080ba7b17d2bfed477cb3f3a41a8_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-07-29_b723080ba7b17d2bfed477cb3f3a41a8_elex_emotet_stop.exe
- Size 208KB
- Sample260729-ssrldsae87
- SHA256 95b9904e02ebe4ce78093137b824a269b764e180e36c327563593ca273d2af02
- MD5 b723080ba7b17d2bfed477cb3f3a41a8
- SHA1 3610be6553d1313cddd3b1acb030fac3b33a8811
- SHA512 e3f15f35d60c78d561a7b20081b21a7138d5e30b7e57ce385627009af27d909137a8acabcf96b90e6a4aed8ad6375e39baa3436122cdc7e1637409a20a36fbc1
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlldL+LOfZ4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFll5+LOhkEj1
- TLSH T1B1247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1848 TQDZ.exe 5420 WWCVB.exe 3152 YUHP.exe 5700 THMZTK.exe 3368 RSPPB.exe 4368 HIYGIMR.exe 1340 UTGFWWM.exe 4932 ERMZ.exe 6000 FUQ.exe 1480 OUSI.exe 5036 SKYIZKU.exe 4872 RVJYIY.exe 5828 PGMOQ.exe 5832 ZDEAHY.exe 4648 NYQ.exe 4228 UUBUAJF.exe 972 SFEKJX.exe 2148 UCSXRG.exe 3568 CQWLB.exe 2336 BBHTKKT.exe 2984 JGMIUJP.exe 1600 AOAF.exe 52 VCFPJA.exe 3656 HSM.exe 4960 QSOCZ.exe 5620 UAUCLIS.exe 1916 TTXSUW.exe 2168 DRLMBE.exe 5384 HZR.exe 1260 QHTR.exe 3092 WHBFIOP.exe 3848 QVG.exe 2488 GLHORJS.exe 6048 AYLX.exe 2392 OJUWPM.exe 6116 OEY.exe 2664 YMAFYHO.exe 5340 SZE.exe 4076 VVWQ.exe 5248 PIBZEA.exe 2476 YNTNOFC.exe 4732 ZLGI.exe 4304 LBNIHGY.exe 2316 JUVW.exe 6128 BCXJU.exe 1004 FKDJ.exe 5592 UAEINL.exe 2196 YQL.exe 4132 CYR.exe 4784 ROSI.exe 5448 VEH.exe 3228 WHLLC.exe 5236 QUQVMAY.exe 2036 WVXI.exe 5884 FVRNGZ.exe 3948 ROUGHHR.exe 5644 GJELA.exe 3400 GWEZB.exe 4196 LCWO.exe 2212 UCQBVHZ.exe 4576 LKSH.exe 2432 PSHHLX.exe 4792 CDPF.exe 3136 BOS.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\ROUGHHR.exe FVRNGZ.exe File opened for modification C:\windows\SysWOW64\SPXJN.exe YCS.exe File opened for modification C:\windows\SysWOW64\GJELA.exe ROUGHHR.exe File created C:\windows\SysWOW64\EUCAE.exe UMIV.exe File created C:\windows\SysWOW64\QQA.exe GIYZXW.exe File created C:\windows\SysWOW64\KRTIZ.exe AUF.exe File opened for modification C:\windows\SysWOW64\SFEKJX.exe UUBUAJF.exe File created C:\windows\SysWOW64\TTXSUW.exe.bat UAUCLIS.exe File created C:\windows\SysWOW64\WHBFIOP.exe QHTR.exe File opened for modification C:\windows\SysWOW64\EUCAE.exe UMIV.exe File created C:\windows\SysWOW64\ERMZ.exe UTGFWWM.exe File created C:\windows\SysWOW64\DRLMBE.exe.bat TTXSUW.exe File created C:\windows\SysWOW64\WHBFIOP.exe.bat QHTR.exe File opened for modification C:\windows\SysWOW64\BRY.exe ZVTGHT.exe File created C:\windows\SysWOW64\JUVW.exe LBNIHGY.exe File created C:\windows\SysWOW64\QUUA.exe.bat AETAE.exe File opened for modification C:\windows\SysWOW64\GIYZXW.exe RNOV.exe File opened for modification C:\windows\SysWOW64\QQA.exe GIYZXW.exe File created C:\windows\SysWOW64\QQA.exe.bat GIYZXW.exe File created C:\windows\SysWOW64\WWCVB.exe.bat TQDZ.exe File created C:\windows\SysWOW64\SZE.exe YMAFYHO.exe File created C:\windows\SysWOW64\SZE.exe.bat YMAFYHO.exe File created C:\windows\SysWOW64\WLIX.exe.bat DQEBGZK.exe File created C:\windows\SysWOW64\RSIT.exe.bat IKGNYZC.exe File opened for modification C:\windows\SysWOW64\WWCVB.exe TQDZ.exe File opened for modification C:\windows\SysWOW64\RSPPB.exe THMZTK.exe File created C:\windows\SysWOW64\JUVW.exe.bat LBNIHGY.exe File created C:\windows\SysWOW64\BRY.exe.bat ZVTGHT.exe File created C:\windows\SysWOW64\JPLYI.exe.bat NJBI.exe File opened for modification C:\windows\SysWOW64\WWGIW.exe SOZIK.exe File opened for modification C:\windows\SysWOW64\THMZTK.exe YUHP.exe File created C:\windows\SysWOW64\TTXSUW.exe UAUCLIS.exe File created C:\windows\SysWOW64\WLIX.exe DQEBGZK.exe File opened for modification C:\windows\SysWOW64\WLIX.exe DQEBGZK.exe File created C:\windows\SysWOW64\ROUGHHR.exe FVRNGZ.exe File created C:\windows\SysWOW64\RSPPB.exe.bat THMZTK.exe File opened for modification C:\windows\SysWOW64\CQWLB.exe UCSXRG.exe File opened for modification C:\windows\SysWOW64\JPLYI.exe NJBI.exe File created C:\windows\SysWOW64\SPXJN.exe YCS.exe File created C:\windows\SysWOW64\GLHORJS.exe QVG.exe File opened for modification C:\windows\SysWOW64\DINKVS.exe XNO.exe File created C:\windows\SysWOW64\FUQ.exe ERMZ.exe File created C:\windows\SysWOW64\PIBZEA.exe VVWQ.exe File opened for modification C:\windows\SysWOW64\IKGNYZC.exe SPXJN.exe File opened for modification C:\windows\SysWOW64\SZE.exe YMAFYHO.exe File created C:\windows\SysWOW64\PSHHLX.exe LKSH.exe File created C:\windows\SysWOW64\KWFW.exe.bat YOYWWHL.exe File opened for modification C:\windows\SysWOW64\XNO.exe ISEXF.exe File created C:\windows\SysWOW64\XNO.exe.bat ISEXF.exe File created C:\windows\SysWOW64\KRTIZ.exe.bat AUF.exe File created C:\windows\SysWOW64\GJELA.exe ROUGHHR.exe File created C:\windows\SysWOW64\EUCAE.exe.bat UMIV.exe File created C:\windows\SysWOW64\DINKVS.exe.bat XNO.exe File created C:\windows\SysWOW64\GIYZXW.exe.bat RNOV.exe File created C:\windows\SysWOW64\ERMZ.exe.bat UTGFWWM.exe File opened for modification C:\windows\SysWOW64\NYQ.exe ZDEAHY.exe File created C:\windows\SysWOW64\GJELA.exe.bat ROUGHHR.exe File created C:\windows\SysWOW64\ZLVE.exe OTSTWWI.exe File created C:\windows\SysWOW64\AOAF.exe JGMIUJP.exe File opened for modification C:\windows\SysWOW64\PSHHLX.exe LKSH.exe File opened for modification C:\windows\SysWOW64\KWFW.exe YOYWWHL.exe File created C:\windows\SysWOW64\SPXJN.exe.bat YCS.exe File opened for modification C:\windows\SysWOW64\ZLVE.exe OTSTWWI.exe File created C:\windows\SysWOW64\ZLVE.exe.bat OTSTWWI.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\FKDJ.exe BCXJU.exe File created C:\windows\LCWO.exe.bat GWEZB.exe File created C:\windows\system\BVLT.exe.bat VIM.exe File created C:\windows\YCS.exe.bat ZOXZ.exe File created C:\windows\system\ZLGI.exe YNTNOFC.exe File created C:\windows\system\YQL.exe UAEINL.exe File opened for modification C:\windows\system\ROSI.exe CYR.exe File opened for modification C:\windows\system\CDPF.exe PSHHLX.exe File created C:\windows\YOYWWHL.exe.bat WRLCHZC.exe File opened for modification C:\windows\system\PGMOQ.exe RVJYIY.exe File created C:\windows\GWEZB.exe.bat GJELA.exe File created C:\windows\system\AXMTCA.exe.bat MZMPAOA.exe File created C:\windows\UTGFWWM.exe.bat HIYGIMR.exe File created C:\windows\system\HSM.exe VCFPJA.exe File created C:\windows\YNTNOFC.exe PIBZEA.exe File created C:\windows\system\BCXJU.exe JUVW.exe File created C:\windows\SOZIK.exe.bat ZLVE.exe File created C:\windows\UCSXRG.exe SFEKJX.exe File opened for modification C:\windows\VEH.exe ROSI.exe File opened for modification C:\windows\system\VIM.exe EUCAE.exe File opened for modification C:\windows\system\DQEBGZK.exe TSR.exe File created C:\windows\system\HIYGIMR.exe.bat RSPPB.exe File created C:\windows\OJUWPM.exe AYLX.exe File opened for modification C:\windows\system\AXMTCA.exe MZMPAOA.exe File created C:\windows\IMMQIEJ.exe.bat WWGIW.exe File created C:\windows\RNOV.exe IMMQIEJ.exe File created C:\windows\system\SKYIZKU.exe OUSI.exe File created C:\windows\system\PGMOQ.exe.bat RVJYIY.exe File created C:\windows\OJUWPM.exe.bat AYLX.exe File created C:\windows\system\CYR.exe.bat YQL.exe File created C:\windows\GWEZB.exe GJELA.exe File created C:\windows\system\LMGIPWP.exe BOS.exe File created C:\windows\system\HSM.exe.bat VCFPJA.exe File created C:\windows\system\QHTR.exe.bat HZR.exe File opened for modification C:\windows\RNOV.exe IMMQIEJ.exe File opened for modification C:\windows\ZDEAHY.exe PGMOQ.exe File created C:\windows\system\BBHTKKT.exe CQWLB.exe File opened for modification C:\windows\QVG.exe WHBFIOP.exe File created C:\windows\QVG.exe.bat WHBFIOP.exe File created C:\windows\system\VVWQ.exe SZE.exe File created C:\windows\VEH.exe.bat ROSI.exe File opened for modification C:\windows\system\LMGIPWP.exe BOS.exe File opened for modification C:\windows\UMIV.exe LMGIPWP.exe File created C:\windows\system\TQDZ.exe 2026-07-29_b723080ba7b17d2bfed477cb3f3a41a8_elex_emotet_stop.exe File created C:\windows\system\TQDZ.exe.bat 2026-07-29_b723080ba7b17d2bfed477cb3f3a41a8_elex_emotet_stop.exe File opened for modification C:\windows\system\QHTR.exe HZR.exe File opened for modification C:\windows\system\ZLGI.exe YNTNOFC.exe File opened for modification C:\windows\system\BVLT.exe VIM.exe File opened for modification C:\windows\NJBI.exe BRY.exe File opened for modification C:\windows\system\FTKCPUN.exe WLIX.exe File created C:\windows\system\AAQWQ.exe.bat AXMTCA.exe File created C:\windows\system\HIYGIMR.exe RSPPB.exe File opened for modification C:\windows\system\UUBUAJF.exe NYQ.exe File created C:\windows\system\VVWQ.exe.bat SZE.exe File created C:\windows\system\BCXJU.exe.bat JUVW.exe File opened for modification C:\windows\system\WVXI.exe QUQVMAY.exe File opened for modification C:\windows\SOZIK.exe ZLVE.exe File created C:\windows\system\BBHTKKT.exe.bat CQWLB.exe File created C:\windows\system\QSOCZ.exe HSM.exe File opened for modification C:\windows\OJUWPM.exe AYLX.exe File opened for modification C:\windows\system\FKDJ.exe BCXJU.exe File opened for modification C:\windows\system\YQL.exe UAEINL.exe File created C:\windows\WHLLC.exe VEH.exe File created C:\windows\UMIV.exe.bat LMGIPWP.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2320 cmd.exe 1080 cmd.exe 5728 cmd.exe 5604 cmd.exe 2900 cmd.exe 5988 cmd.exe 5104 cmd.exe 5960 cmd.exe 2240 cmd.exe 4276 cmd.exe 2076 cmd.exe 2784 cmd.exe 2072 cmd.exe 2716 cmd.exe 4468 cmd.exe 4596 cmd.exe 2580 cmd.exe 4908 cmd.exe 2960 cmd.exe 1768 cmd.exe 6036 cmd.exe 5764 cmd.exe 1824 cmd.exe 5612 cmd.exe 3956 cmd.exe 1968 cmd.exe 912 cmd.exe 2632 cmd.exe 4788 cmd.exe 4524 cmd.exe 2640 cmd.exe 548 cmd.exe 2948 cmd.exe 5056 cmd.exe 1008 cmd.exe 3720 cmd.exe 2452 cmd.exe 5836 cmd.exe 1912 cmd.exe 1484 cmd.exe 1364 cmd.exe 2972 cmd.exe 4428 cmd.exe 4356 cmd.exe 4424 cmd.exe 3744 cmd.exe 6016 cmd.exe 3968 cmd.exe 5096 cmd.exe 4948 cmd.exe 6040 cmd.exe 3340 cmd.exe 3712 cmd.exe 5692 cmd.exe 1344 cmd.exe 4844 cmd.exe 5856 cmd.exe 3572 cmd.exe 796 cmd.exe 5736 cmd.exe 4252 cmd.exe 4088 cmd.exe 3556 cmd.exe 556 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 2324 4928 WerFault.exe 87 932 1848 WerFault.exe 93 5612 5420 WerFault.exe 99 3748 3152 WerFault.exe 104 5484 5700 WerFault.exe 109 4088 3368 WerFault.exe 114 1508 4368 WerFault.exe 119 5136 1340 WerFault.exe 124 2968 4932 WerFault.exe 129 2240 6000 WerFault.exe 134 252 1480 WerFault.exe 139 3332 5036 WerFault.exe 144 4792 4872 WerFault.exe 149 2516 5828 WerFault.exe 154 2756 5832 WerFault.exe 159 6120 4648 WerFault.exe 164 5340 4228 WerFault.exe 169 1508 972 WerFault.exe 174 4908 2148 WerFault.exe 179 5104 3568 WerFault.exe 184 1660 2336 WerFault.exe 189 3524 2984 WerFault.exe 194 4108 1600 WerFault.exe 199 1872 52 WerFault.exe 204 4168 3656 WerFault.exe 208 5436 4960 WerFault.exe 214 6140 5620 WerFault.exe 219 3744 1916 WerFault.exe 224 4852 2168 WerFault.exe 229 4596 5384 WerFault.exe 234 5924 1260 WerFault.exe 239 1376 3092 WerFault.exe 244 4996 3848 WerFault.exe 249 4924 2488 WerFault.exe 254 1708 6048 WerFault.exe 259 1348 2392 WerFault.exe 264 1432 6116 WerFault.exe 270 4672 2664 WerFault.exe 275 4488 5340 WerFault.exe 280 3700 4076 WerFault.exe 285 1868 5248 WerFault.exe 290 4844 2476 WerFault.exe 295 4108 4732 WerFault.exe 300 4380 4304 WerFault.exe 305 5360 2316 WerFault.exe 310 2580 6128 WerFault.exe 315 5648 1004 WerFault.exe 320 5948 5592 WerFault.exe 325 2504 2196 WerFault.exe 330 2872 4132 WerFault.exe 335 5536 4784 WerFault.exe 340 2324 5448 WerFault.exe 345 2432 3228 WerFault.exe 350 3064 5236 WerFault.exe 355 4504 2036 WerFault.exe 360 2004 5884 WerFault.exe 365 928 3948 WerFault.exe 370 6028 5644 WerFault.exe 375 5096 3400 WerFault.exe 380 668 4196 WerFault.exe 385 5488 2212 WerFault.exe 390 5628 4576 WerFault.exe 395 5152 2432 WerFault.exe 400 3132 4792 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GJELA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TSR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OTSTWWI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZDEAHY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UUBUAJF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DINKVS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ERMZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OJUWPM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VEH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WLIX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SKYIZKU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DRLMBE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YUHP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BBHTKKT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RSIT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language THMZTK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RSPPB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OEY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TQDZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QHTR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LBNIHGY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JUVW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BCXJU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QUQVMAY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CYR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AXMTCA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SBEUU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TTXSUW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VIM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YOYWWHL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZLVE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PGMOQ.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4928 2026-07-29_b723080ba7b17d2bfed477cb3f3a41a8_elex_emotet_stop.exe 4928 2026-07-29_b723080ba7b17d2bfed477cb3f3a41a8_elex_emotet_stop.exe 1848 TQDZ.exe 1848 TQDZ.exe 5420 WWCVB.exe 5420 WWCVB.exe 3152 YUHP.exe 3152 YUHP.exe 5700 THMZTK.exe 5700 THMZTK.exe 3368 RSPPB.exe 3368 RSPPB.exe 4368 HIYGIMR.exe 4368 HIYGIMR.exe 1340 UTGFWWM.exe 1340 UTGFWWM.exe 4932 ERMZ.exe 4932 ERMZ.exe 6000 FUQ.exe 6000 FUQ.exe 1480 OUSI.exe 1480 OUSI.exe 5036 SKYIZKU.exe 5036 SKYIZKU.exe 4872 RVJYIY.exe 4872 RVJYIY.exe 5828 PGMOQ.exe 5828 PGMOQ.exe 5832 ZDEAHY.exe 5832 ZDEAHY.exe 4648 NYQ.exe 4648 NYQ.exe 4228 UUBUAJF.exe 4228 UUBUAJF.exe 972 SFEKJX.exe 972 SFEKJX.exe 2148 UCSXRG.exe 2148 UCSXRG.exe 3568 CQWLB.exe 3568 CQWLB.exe 2336 BBHTKKT.exe 2336 BBHTKKT.exe 2984 JGMIUJP.exe 2984 JGMIUJP.exe 1600 AOAF.exe 1600 AOAF.exe 52 VCFPJA.exe 52 VCFPJA.exe 3656 HSM.exe 3656 HSM.exe 4960 QSOCZ.exe 4960 QSOCZ.exe 5620 UAUCLIS.exe 5620 UAUCLIS.exe 1916 TTXSUW.exe 1916 TTXSUW.exe 2168 DRLMBE.exe 2168 DRLMBE.exe 5384 HZR.exe 5384 HZR.exe 1260 QHTR.exe 1260 QHTR.exe 3092 WHBFIOP.exe 3092 WHBFIOP.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4928 2026-07-29_b723080ba7b17d2bfed477cb3f3a41a8_elex_emotet_stop.exe 4928 2026-07-29_b723080ba7b17d2bfed477cb3f3a41a8_elex_emotet_stop.exe 1848 TQDZ.exe 1848 TQDZ.exe 5420 WWCVB.exe 5420 WWCVB.exe 3152 YUHP.exe 3152 YUHP.exe 5700 THMZTK.exe 5700 THMZTK.exe 3368 RSPPB.exe 3368 RSPPB.exe 4368 HIYGIMR.exe 4368 HIYGIMR.exe 1340 UTGFWWM.exe 1340 UTGFWWM.exe 4932 ERMZ.exe 4932 ERMZ.exe 6000 FUQ.exe 6000 FUQ.exe 1480 OUSI.exe 1480 OUSI.exe 5036 SKYIZKU.exe 5036 SKYIZKU.exe 4872 RVJYIY.exe 4872 RVJYIY.exe 5828 PGMOQ.exe 5828 PGMOQ.exe 5832 ZDEAHY.exe 5832 ZDEAHY.exe 4648 NYQ.exe 4648 NYQ.exe 4228 UUBUAJF.exe 4228 UUBUAJF.exe 972 SFEKJX.exe 972 SFEKJX.exe 2148 UCSXRG.exe 2148 UCSXRG.exe 3568 CQWLB.exe 3568 CQWLB.exe 2336 BBHTKKT.exe 2336 BBHTKKT.exe 2984 JGMIUJP.exe 2984 JGMIUJP.exe 1600 AOAF.exe 1600 AOAF.exe 52 VCFPJA.exe 52 VCFPJA.exe 3656 HSM.exe 3656 HSM.exe 4960 QSOCZ.exe 4960 QSOCZ.exe 5620 UAUCLIS.exe 5620 UAUCLIS.exe 1916 TTXSUW.exe 1916 TTXSUW.exe 2168 DRLMBE.exe 2168 DRLMBE.exe 5384 HZR.exe 5384 HZR.exe 1260 QHTR.exe 1260 QHTR.exe 3092 WHBFIOP.exe 3092 WHBFIOP.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4928 wrote to memory of 3668 4928 2026-07-29_b723080ba7b17d2bfed477cb3f3a41a8_elex_emotet_stop.exe 89 PID 3668 wrote to memory of 1848 3668 cmd.exe 93 PID 1848 wrote to memory of 5524 1848 TQDZ.exe 95 PID 5524 wrote to memory of 5420 5524 cmd.exe 99 PID 5420 wrote to memory of 1784 5420 WWCVB.exe 100 PID 1784 wrote to memory of 3152 1784 cmd.exe 104 PID 3152 wrote to memory of 3508 3152 YUHP.exe 105 PID 3508 wrote to memory of 5700 3508 cmd.exe 109 PID 5700 wrote to memory of 796 5700 THMZTK.exe 110 PID 796 wrote to memory of 3368 796 cmd.exe 114 PID 3368 wrote to memory of 5876 3368 RSPPB.exe 115 PID 5876 wrote to memory of 4368 5876 cmd.exe 119 PID 4368 wrote to memory of 4500 4368 HIYGIMR.exe 120 PID 4500 wrote to memory of 1340 4500 cmd.exe 124 PID 1340 wrote to memory of 2960 1340 UTGFWWM.exe 125 PID 2960 wrote to memory of 4932 2960 cmd.exe 129 PID 4932 wrote to memory of 1768 4932 ERMZ.exe 130 PID 1768 wrote to memory of 6000 1768 cmd.exe 134 PID 6000 wrote to memory of 3796 6000 FUQ.exe 135 PID 3796 wrote to memory of 1480 3796 cmd.exe 139 PID 1480 wrote to memory of 5736 1480 OUSI.exe 140 PID 5736 wrote to memory of 5036 5736 cmd.exe 144 PID 5036 wrote to memory of 4524 5036 SKYIZKU.exe 145 PID 4524 wrote to memory of 4872 4524 cmd.exe 149 PID 4872 wrote to memory of 4252 4872 RVJYIY.exe 150 PID 4252 wrote to memory of 5828 4252 cmd.exe 154 PID 5828 wrote to memory of 2924 5828 PGMOQ.exe 155 PID 2924 wrote to memory of 5832 2924 cmd.exe 159 PID 5832 wrote to memory of 3736 5832 ZDEAHY.exe 160 PID 3736 wrote to memory of 4648 3736 cmd.exe 164 PID 4648 wrote to memory of 5364 4648 NYQ.exe 165 PID 5364 wrote to memory of 4228 5364 cmd.exe 169 PID 4228 wrote to memory of 2012 4228 UUBUAJF.exe 170 PID 2012 wrote to memory of 972 2012 cmd.exe 174 PID 972 wrote to memory of 2640 972 SFEKJX.exe 175 PID 2640 wrote to memory of 2148 2640 cmd.exe 179 PID 2148 wrote to memory of 4332 2148 UCSXRG.exe 180 PID 4332 wrote to memory of 3568 4332 cmd.exe 184 PID 3568 wrote to memory of 4356 3568 CQWLB.exe 185 PID 4356 wrote to memory of 2336 4356 cmd.exe 189 PID 2336 wrote to memory of 5676 2336 BBHTKKT.exe 190 PID 5676 wrote to memory of 2984 5676 cmd.exe 194 PID 2984 wrote to memory of 5916 2984 JGMIUJP.exe 195 PID 5916 wrote to memory of 1600 5916 cmd.exe 199 PID 1600 wrote to memory of 4424 1600 AOAF.exe 200 PID 4424 wrote to memory of 52 4424 cmd.exe 204 PID 52 wrote to memory of 4448 52 VCFPJA.exe 205 PID 4448 wrote to memory of 3656 4448 cmd.exe 208 PID 3656 wrote to memory of 5328 3656 HSM.exe 210 PID 5328 wrote to memory of 4960 5328 cmd.exe 214 PID 4960 wrote to memory of 2072 4960 QSOCZ.exe 215 PID 2072 wrote to memory of 5620 2072 cmd.exe 219 PID 5620 wrote to memory of 5716 5620 UAUCLIS.exe 220 PID 5716 wrote to memory of 1916 5716 cmd.exe 224 PID 1916 wrote to memory of 6040 1916 TTXSUW.exe 225 PID 6040 wrote to memory of 2168 6040 cmd.exe 229 PID 2168 wrote to memory of 4812 2168 DRLMBE.exe 230 PID 4812 wrote to memory of 5384 4812 cmd.exe 234 PID 5384 wrote to memory of 3720 5384 HZR.exe 235 PID 3720 wrote to memory of 1260 3720 cmd.exe 239 PID 1260 wrote to memory of 1940 1260 QHTR.exe 240 PID 1940 wrote to memory of 3092 1940 cmd.exe 244 PID 3092 wrote to memory of 5508 3092 WHBFIOP.exe 245 PID 5508 wrote to memory of 3848 5508 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-29_b723080ba7b17d2bfed477cb3f3a41a8_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-29_b723080ba7b17d2bfed477cb3f3a41a8_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TQDZ.exe.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\windows\system\TQDZ.exeC:\windows\system\TQDZ.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WWCVB.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:5524 -
C:\windows\SysWOW64\WWCVB.exeC:\windows\system32\WWCVB.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YUHP.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\windows\YUHP.exeC:\windows\YUHP.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\THMZTK.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:3508 -
C:\windows\SysWOW64\THMZTK.exeC:\windows\system32\THMZTK.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RSPPB.exe.bat" "10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:796 -
C:\windows\SysWOW64\RSPPB.exeC:\windows\system32\RSPPB.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HIYGIMR.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:5876 -
C:\windows\system\HIYGIMR.exeC:\windows\system\HIYGIMR.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UTGFWWM.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\windows\UTGFWWM.exeC:\windows\UTGFWWM.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ERMZ.exe.bat" "16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\windows\SysWOW64\ERMZ.exeC:\windows\system32\ERMZ.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FUQ.exe.bat" "18⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\windows\SysWOW64\FUQ.exeC:\windows\system32\FUQ.exe19⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OUSI.exe.bat" "20⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\windows\OUSI.exeC:\windows\OUSI.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SKYIZKU.exe.bat" "22⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5736 -
C:\windows\system\SKYIZKU.exeC:\windows\system\SKYIZKU.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RVJYIY.exe.bat" "24⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\windows\RVJYIY.exeC:\windows\RVJYIY.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PGMOQ.exe.bat" "26⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\windows\system\PGMOQ.exeC:\windows\system\PGMOQ.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZDEAHY.exe.bat" "28⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\windows\ZDEAHY.exeC:\windows\ZDEAHY.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NYQ.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:3736 -
C:\windows\SysWOW64\NYQ.exeC:\windows\system32\NYQ.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UUBUAJF.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:5364 -
C:\windows\system\UUBUAJF.exeC:\windows\system\UUBUAJF.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SFEKJX.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\windows\SysWOW64\SFEKJX.exeC:\windows\system32\SFEKJX.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UCSXRG.exe.bat" "36⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\windows\UCSXRG.exeC:\windows\UCSXRG.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CQWLB.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\windows\SysWOW64\CQWLB.exeC:\windows\system32\CQWLB.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BBHTKKT.exe.bat" "40⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\windows\system\BBHTKKT.exeC:\windows\system\BBHTKKT.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JGMIUJP.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:5676 -
C:\windows\SysWOW64\JGMIUJP.exeC:\windows\system32\JGMIUJP.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AOAF.exe.bat" "44⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5916 -
C:\windows\SysWOW64\AOAF.exeC:\windows\system32\AOAF.exe45⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VCFPJA.exe.bat" "46⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\windows\system\VCFPJA.exeC:\windows\system\VCFPJA.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:52 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HSM.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\windows\system\HSM.exeC:\windows\system\HSM.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QSOCZ.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:5328 -
C:\windows\system\QSOCZ.exeC:\windows\system\QSOCZ.exe51⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UAUCLIS.exe.bat" "52⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\windows\system\UAUCLIS.exeC:\windows\system\UAUCLIS.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5620 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TTXSUW.exe.bat" "54⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5716 -
C:\windows\SysWOW64\TTXSUW.exeC:\windows\system32\TTXSUW.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DRLMBE.exe.bat" "56⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6040 -
C:\windows\SysWOW64\DRLMBE.exeC:\windows\system32\DRLMBE.exe57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HZR.exe.bat" "58⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\windows\HZR.exeC:\windows\HZR.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QHTR.exe.bat" "60⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\windows\system\QHTR.exeC:\windows\system\QHTR.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WHBFIOP.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\windows\SysWOW64\WHBFIOP.exeC:\windows\system32\WHBFIOP.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QVG.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:5508 -
C:\windows\QVG.exeC:\windows\QVG.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GLHORJS.exe.bat" "66⤵PID:2604
-
C:\windows\SysWOW64\GLHORJS.exeC:\windows\system32\GLHORJS.exe67⤵
- Executes dropped EXE
PID:2488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AYLX.exe.bat" "68⤵
- System Location Discovery: System Language Discovery
PID:3420 -
C:\windows\system\AYLX.exeC:\windows\system\AYLX.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6048 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OJUWPM.exe.bat" "70⤵PID:3472
-
C:\windows\OJUWPM.exeC:\windows\OJUWPM.exe71⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OEY.exe.bat" "72⤵PID:4892
-
C:\windows\system\OEY.exeC:\windows\system\OEY.exe73⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YMAFYHO.exe.bat" "74⤵
- System Location Discovery: System Language Discovery
PID:3840 -
C:\windows\system\YMAFYHO.exeC:\windows\system\YMAFYHO.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2664 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SZE.exe.bat" "76⤵
- Executes a command shell one-liner
PID:2716 -
C:\windows\SysWOW64\SZE.exeC:\windows\system32\SZE.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5340 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VVWQ.exe.bat" "78⤵PID:1056
-
C:\windows\system\VVWQ.exeC:\windows\system\VVWQ.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PIBZEA.exe.bat" "80⤵PID:4616
-
C:\windows\SysWOW64\PIBZEA.exeC:\windows\system32\PIBZEA.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YNTNOFC.exe.bat" "82⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5988 -
C:\windows\YNTNOFC.exeC:\windows\YNTNOFC.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZLGI.exe.bat" "84⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2452 -
C:\windows\system\ZLGI.exeC:\windows\system\ZLGI.exe85⤵
- Executes dropped EXE
PID:4732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LBNIHGY.exe.bat" "86⤵
- Executes a command shell one-liner
PID:3340 -
C:\windows\system\LBNIHGY.exeC:\windows\system\LBNIHGY.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JUVW.exe.bat" "88⤵
- System Location Discovery: System Language Discovery
PID:4144 -
C:\windows\SysWOW64\JUVW.exeC:\windows\system32\JUVW.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2316 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BCXJU.exe.bat" "90⤵
- Executes a command shell one-liner
PID:5612 -
C:\windows\system\BCXJU.exeC:\windows\system\BCXJU.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FKDJ.exe.bat" "92⤵PID:2876
-
C:\windows\system\FKDJ.exeC:\windows\system\FKDJ.exe93⤵
- Executes dropped EXE
PID:1004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UAEINL.exe.bat" "94⤵
- Executes a command shell one-liner
PID:1344 -
C:\windows\UAEINL.exeC:\windows\UAEINL.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YQL.exe.bat" "96⤵
- Executes a command shell one-liner
PID:3744 -
C:\windows\system\YQL.exeC:\windows\system\YQL.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2196 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CYR.exe.bat" "98⤵
- System Location Discovery: System Language Discovery
PID:5108 -
C:\windows\system\CYR.exeC:\windows\system\CYR.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ROSI.exe.bat" "100⤵PID:1740
-
C:\windows\system\ROSI.exeC:\windows\system\ROSI.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4784 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VEH.exe.bat" "102⤵PID:6044
-
C:\windows\VEH.exeC:\windows\VEH.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WHLLC.exe.bat" "104⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4468 -
C:\windows\WHLLC.exeC:\windows\WHLLC.exe105⤵
- Executes dropped EXE
PID:3228 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QUQVMAY.exe.bat" "106⤵
- Executes a command shell one-liner
PID:2320 -
C:\windows\QUQVMAY.exeC:\windows\QUQVMAY.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WVXI.exe.bat" "108⤵
- System Location Discovery: System Language Discovery
PID:3344 -
C:\windows\system\WVXI.exeC:\windows\system\WVXI.exe109⤵
- Executes dropped EXE
PID:2036 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FVRNGZ.exe.bat" "110⤵PID:3492
-
C:\windows\SysWOW64\FVRNGZ.exeC:\windows\system32\FVRNGZ.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ROUGHHR.exe.bat" "112⤵PID:2588
-
C:\windows\SysWOW64\ROUGHHR.exeC:\windows\system32\ROUGHHR.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GJELA.exe.bat" "114⤵PID:2964
-
C:\windows\SysWOW64\GJELA.exeC:\windows\system32\GJELA.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GWEZB.exe.bat" "116⤵
- System Location Discovery: System Language Discovery
PID:2528 -
C:\windows\GWEZB.exeC:\windows\GWEZB.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LCWO.exe.bat" "118⤵
- Executes a command shell one-liner
PID:4596 -
C:\windows\LCWO.exeC:\windows\LCWO.exe119⤵
- Executes dropped EXE
PID:4196 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UCQBVHZ.exe.bat" "120⤵PID:5088
-
C:\windows\system\UCQBVHZ.exeC:\windows\system\UCQBVHZ.exe121⤵
- Executes dropped EXE
PID:2212
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-