Analysis
- max time kernel
94s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/07/2026, 04:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-30_fc835489c19780206ba63c040d7b9f9d_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-07-30_fc835489c19780206ba63c040d7b9f9d_elex_emotet_stop.exe
- Size 208KB
- Sample260730-fa1p5as1ct
- SHA256 57722fdb16496b5799924ee1c0085de43a4c8ab402959c6f265594b291435ed8
- MD5 fc835489c19780206ba63c040d7b9f9d
- SHA1 56bc9853ce405f085c39068b658e398ffb64887d
- SHA512 8073bb940de97dbf3be94d50e951fa9790b26bc0551054de786351e8767cb5ffb458d57cf646d70be91291e3ebb608829492790ac10e4d4cfac5d8405f15f037
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlUWL+LOfd4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFlUu+LOFkEj1
- TLSH T1FC247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1096 WMGMG.exe 1656 KQEF.exe 360 RVLBI.exe 2480 MJQKKMF.exe 3388 BEZWD.exe 2696 WREGGYU.exe 824 WFEUPLX.exe 2020 LANZA.exe 2748 FNSIKYU.exe 3560 VDTHJ.exe 3296 BDB.exe 4132 ETHVM.exe 4788 SRHH.exe 1552 NEMQZ.exe 4360 CZE.exe 5604 NSZN.exe 4424 EABTVR.exe 6036 KBI.exe 4300 IBQCV.exe 3100 ZBSHZLC.exe 2500 JJU.exe 2060 PKCAL.exe 3592 JXGJWKU.exe 876 UQB.exe 3488 YGQCQ.exe 5296 BTNUSKM.exe 4140 WGSD.exe 5432 MRC.exe 1904 ICLKZA.exe 2744 GXKK.exe 4192 SFRSIW.exe 5276 XFYG.exe 3144 XLZV.exe 4672 NOIZMQJ.exe 4592 NUI.exe 1956 JZGKCMG.exe 4952 WCWJJPB.exe 4500 OKYO.exe 3380 GFCKAK.exe 1996 XTN.exe 3264 QWQGV.exe 5392 BOLYDMR.exe 5860 HOTM.exe 1480 ASXISW.exe 4900 TKABAMJ.exe 2948 RKIO.exe 4676 ILKTU.exe 2512 FQPRBNP.exe 1440 HOVLJ.exe 1084 IRZH.exe 5368 CEEQZ.exe 1596 NXHJHBD.exe 3776 GSK.exe 5828 MSSAVT.exe 5496 NVW.exe 2860 KWDKS.exe 5724 SBEYTQ.exe 4284 YCL.exe 1040 GSMLJG.exe 1852 MSUZAIL.exe 2888 GNZ.exe 5376 MNYWTC.exe 5872 XGBPURQ.exe 6096 XMC.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\HUIX.exe VMBXLRM.exe File created C:\windows\SysWOW64\WGSD.exe BTNUSKM.exe File opened for modification C:\windows\SysWOW64\RCTTHH.exe UEOW.exe File created C:\windows\SysWOW64\MNYWTC.exe GNZ.exe File opened for modification C:\windows\SysWOW64\WCBHQB.exe RCTTHH.exe File created C:\windows\SysWOW64\VHRCI.exe MTHK.exe File created C:\windows\SysWOW64\RNJ.exe RHJJDLY.exe File opened for modification C:\windows\SysWOW64\JZGKCMG.exe NUI.exe File created C:\windows\SysWOW64\XGBPURQ.exe MNYWTC.exe File opened for modification C:\windows\SysWOW64\VHRCI.exe MTHK.exe File opened for modification C:\windows\SysWOW64\UQB.exe JXGJWKU.exe File opened for modification C:\windows\SysWOW64\MTHK.exe GYQJVB.exe File created C:\windows\SysWOW64\HUIX.exe.bat VMBXLRM.exe File created C:\windows\SysWOW64\LANZA.exe WFEUPLX.exe File opened for modification C:\windows\SysWOW64\JXGJWKU.exe PKCAL.exe File opened for modification C:\windows\SysWOW64\MAOGO.exe RNJ.exe File created C:\windows\SysWOW64\HOVLJ.exe.bat FQPRBNP.exe File created C:\windows\SysWOW64\LANZA.exe.bat WFEUPLX.exe File created C:\windows\SysWOW64\RKIO.exe.bat TKABAMJ.exe File opened for modification C:\windows\SysWOW64\RVLBI.exe KQEF.exe File created C:\windows\SysWOW64\SRHH.exe ETHVM.exe File created C:\windows\SysWOW64\JZGKCMG.exe NUI.exe File opened for modification C:\windows\SysWOW64\MNYWTC.exe GNZ.exe File created C:\windows\SysWOW64\QTZKGG.exe BDY.exe File created C:\windows\SysWOW64\WGSD.exe.bat BTNUSKM.exe File created C:\windows\SysWOW64\VDTHJ.exe FNSIKYU.exe File opened for modification C:\windows\SysWOW64\BDB.exe VDTHJ.exe File created C:\windows\SysWOW64\UQB.exe JXGJWKU.exe File created C:\windows\SysWOW64\NVW.exe.bat MSSAVT.exe File created C:\windows\SysWOW64\ANT.exe.bat JMRFVTW.exe File opened for modification C:\windows\SysWOW64\RNJ.exe RHJJDLY.exe File opened for modification C:\windows\SysWOW64\YSNBMG.exe XPJF.exe File opened for modification C:\windows\SysWOW64\VDTHJ.exe FNSIKYU.exe File created C:\windows\SysWOW64\GKDM.exe.bat WCBHQB.exe File created C:\windows\SysWOW64\MAOGO.exe RNJ.exe File opened for modification C:\windows\SysWOW64\QTZKGG.exe BDY.exe File opened for modification C:\windows\SysWOW64\DEXFEOI.exe TGSKOGZ.exe File created C:\windows\SysWOW64\BEZWD.exe MJQKKMF.exe File opened for modification C:\windows\SysWOW64\XGBPURQ.exe MNYWTC.exe File created C:\windows\SysWOW64\QTZKGG.exe.bat BDY.exe File opened for modification C:\windows\SysWOW64\HOVLJ.exe FQPRBNP.exe File created C:\windows\SysWOW64\RVLBI.exe KQEF.exe File opened for modification C:\windows\SysWOW64\TKABAMJ.exe ASXISW.exe File created C:\windows\SysWOW64\MNYWTC.exe.bat GNZ.exe File opened for modification C:\windows\SysWOW64\QBPRB.exe XGLNVV.exe File created C:\windows\SysWOW64\YFIO.exe UPCOFW.exe File created C:\windows\SysWOW64\OKYO.exe.bat WCWJJPB.exe File created C:\windows\SysWOW64\NVW.exe MSSAVT.exe File created C:\windows\SysWOW64\GXKK.exe ICLKZA.exe File created C:\windows\SysWOW64\NOIZMQJ.exe.bat XLZV.exe File opened for modification C:\windows\SysWOW64\OKYO.exe WCWJJPB.exe File created C:\windows\SysWOW64\RKIO.exe TKABAMJ.exe File opened for modification C:\windows\SysWOW64\RKIO.exe TKABAMJ.exe File opened for modification C:\windows\SysWOW64\GKDM.exe WCBHQB.exe File created C:\windows\SysWOW64\MTHK.exe.bat GYQJVB.exe File opened for modification C:\windows\SysWOW64\NOIZMQJ.exe XLZV.exe File created C:\windows\SysWOW64\XGBPURQ.exe.bat MNYWTC.exe File created C:\windows\SysWOW64\RNJ.exe.bat RHJJDLY.exe File created C:\windows\SysWOW64\BDB.exe.bat VDTHJ.exe File created C:\windows\SysWOW64\OKYO.exe WCWJJPB.exe File created C:\windows\SysWOW64\BEZWD.exe.bat MJQKKMF.exe File created C:\windows\SysWOW64\JZGKCMG.exe.bat NUI.exe File opened for modification C:\windows\SysWOW64\WCWJJPB.exe JZGKCMG.exe File opened for modification C:\windows\SysWOW64\NVW.exe MSSAVT.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\CEEQZ.exe IRZH.exe File created C:\windows\YCL.exe SBEYTQ.exe File created C:\windows\system\JMRFVTW.exe NHLIO.exe File opened for modification C:\windows\system\RDAEZD.exe RXAPXQ.exe File created C:\windows\XLZV.exe XFYG.exe File created C:\windows\system\GFCKAK.exe OKYO.exe File opened for modification C:\windows\BER.exe MBHXW.exe File created C:\windows\BER.exe.bat MBHXW.exe File created C:\windows\KFTHKN.exe BER.exe File created C:\windows\system\CKFB.exe.bat YCYBG.exe File opened for modification C:\windows\system\YMCT.exe EYXKYZJ.exe File created C:\windows\KQEF.exe.bat WMGMG.exe File created C:\windows\system\WREGGYU.exe BEZWD.exe File created C:\windows\system\RDAEZD.exe RXAPXQ.exe File created C:\windows\FNSIKYU.exe.bat LANZA.exe File opened for modification C:\windows\EABTVR.exe NSZN.exe File created C:\windows\NHLIO.exe XMC.exe File created C:\windows\YNAYQT.exe ANT.exe File created C:\windows\TQF.exe.bat RDAEZD.exe File created C:\windows\WFEUPLX.exe WREGGYU.exe File created C:\windows\system\BTNUSKM.exe YGQCQ.exe File created C:\windows\system\FQPRBNP.exe ILKTU.exe File created C:\windows\MSSAVT.exe GSK.exe File opened for modification C:\windows\YNAYQT.exe ANT.exe File opened for modification C:\windows\system\GFCKAK.exe OKYO.exe File created C:\windows\MSSAVT.exe.bat GSK.exe File opened for modification C:\windows\GSK.exe NXHJHBD.exe File created C:\windows\system\GSMLJG.exe.bat YCL.exe File created C:\windows\XGLNVV.exe TQF.exe File created C:\windows\system\IBQCV.exe KBI.exe File created C:\windows\YCL.exe.bat SBEYTQ.exe File opened for modification C:\windows\LWM.exe UJBZH.exe File created C:\windows\system\HUWO.exe.bat KOEZM.exe File created C:\windows\system\CQBJ.exe GKDM.exe File created C:\windows\system\KOEZM.exe.bat QBZ.exe File created C:\windows\system\QWQGV.exe XTN.exe File created C:\windows\system\BOLYDMR.exe.bat QWQGV.exe File opened for modification C:\windows\system\HOTM.exe BOLYDMR.exe File created C:\windows\system\MBHXW.exe FOIO.exe File created C:\windows\system\VMBXLRM.exe.bat DJY.exe File opened for modification C:\windows\RAGAZV.exe CKFB.exe File opened for modification C:\windows\YGQCQ.exe UQB.exe File opened for modification C:\windows\system\MRC.exe WGSD.exe File opened for modification C:\windows\KQEF.exe WMGMG.exe File created C:\windows\KBI.exe.bat EABTVR.exe File opened for modification C:\windows\system\NEMQZ.exe SRHH.exe File created C:\windows\system\ILKTU.exe.bat RKIO.exe File created C:\windows\system\UJBZH.exe KIZM.exe File opened for modification C:\windows\FOIO.exe QTZKGG.exe File created C:\windows\DJY.exe.bat DEXFEOI.exe File created C:\windows\WFEUPLX.exe.bat WREGGYU.exe File created C:\windows\system\MRC.exe WGSD.exe File created C:\windows\SFRSIW.exe GXKK.exe File opened for modification C:\windows\EFT.exe WPSBIWJ.exe File opened for modification C:\windows\FNSIKYU.exe LANZA.exe File created C:\windows\ZBSHZLC.exe.bat IBQCV.exe File created C:\windows\system\WPSBIWJ.exe HUIX.exe File created C:\windows\XFYG.exe SFRSIW.exe File created C:\windows\system\NHT.exe.bat VHRCI.exe File created C:\windows\XFYG.exe.bat SFRSIW.exe File created C:\windows\system\GFCKAK.exe.bat OKYO.exe File created C:\windows\TQF.exe RDAEZD.exe File created C:\windows\system\NSZN.exe CZE.exe File opened for modification C:\windows\system\GNZ.exe MSUZAIL.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2656 cmd.exe 4548 cmd.exe 1160 cmd.exe 3252 cmd.exe 5560 cmd.exe 4808 cmd.exe 484 cmd.exe 5408 cmd.exe 1136 cmd.exe 5672 cmd.exe 6020 cmd.exe 5668 cmd.exe 5528 cmd.exe 4108 cmd.exe 3180 cmd.exe 1976 cmd.exe 4964 cmd.exe 2276 cmd.exe 828 cmd.exe 3064 cmd.exe 1068 cmd.exe 4568 cmd.exe 3752 cmd.exe 1156 cmd.exe 4876 cmd.exe 5488 cmd.exe 5656 cmd.exe 1892 cmd.exe 616 cmd.exe 4656 cmd.exe 2764 cmd.exe 916 cmd.exe 472 cmd.exe 5612 cmd.exe 2660 cmd.exe 932 cmd.exe 3096 cmd.exe 5880 cmd.exe 2756 cmd.exe 776 cmd.exe 1744 cmd.exe 4216 cmd.exe 1184 cmd.exe 4908 cmd.exe 4544 cmd.exe 4092 cmd.exe 108 cmd.exe 2648 cmd.exe 5532 cmd.exe 3212 cmd.exe 3224 cmd.exe 2964 cmd.exe 3136 cmd.exe 3520 cmd.exe 4484 cmd.exe 1900 cmd.exe 5764 cmd.exe 4852 cmd.exe 5492 cmd.exe 4716 cmd.exe 5884 cmd.exe 6004 cmd.exe 6080 cmd.exe 3664 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 2116 1372 WerFault.exe 88 4680 1096 WerFault.exe 93 4352 1656 WerFault.exe 99 772 360 WerFault.exe 104 4772 2480 WerFault.exe 109 3632 3388 WerFault.exe 114 3052 2696 WerFault.exe 119 2952 824 WerFault.exe 124 5056 2020 WerFault.exe 129 4664 2748 WerFault.exe 134 5496 3560 WerFault.exe 139 2396 3296 WerFault.exe 144 3860 4132 WerFault.exe 149 1856 4788 WerFault.exe 154 460 1552 WerFault.exe 159 5028 4360 WerFault.exe 164 1664 5604 WerFault.exe 169 2428 4424 WerFault.exe 174 1092 6036 WerFault.exe 179 4972 4300 WerFault.exe 184 5532 3100 WerFault.exe 189 5896 2500 WerFault.exe 194 1244 2060 WerFault.exe 199 6092 3592 WerFault.exe 204 5660 876 WerFault.exe 209 5188 3488 WerFault.exe 214 5976 5296 WerFault.exe 219 1212 4140 WerFault.exe 224 3224 5432 WerFault.exe 229 1116 1904 WerFault.exe 234 1788 2744 WerFault.exe 239 2852 4192 WerFault.exe 244 2096 5276 WerFault.exe 249 2460 3144 WerFault.exe 254 4964 4672 WerFault.exe 259 3200 4592 WerFault.exe 264 260 1956 WerFault.exe 269 5912 4952 WerFault.exe 274 4804 4500 WerFault.exe 279 5484 3380 WerFault.exe 284 5132 1996 WerFault.exe 289 5876 3264 WerFault.exe 294 2360 5392 WerFault.exe 299 4608 5860 WerFault.exe 304 4584 1480 WerFault.exe 309 5160 4900 WerFault.exe 314 5776 2948 WerFault.exe 319 1652 4676 WerFault.exe 324 3588 2512 WerFault.exe 329 5484 1440 WerFault.exe 334 5944 1084 WerFault.exe 339 4256 5368 WerFault.exe 344 1928 1596 WerFault.exe 349 5700 3776 WerFault.exe 354 4912 5828 WerFault.exe 359 2660 5496 WerFault.exe 364 5520 2860 WerFault.exe 369 3656 5724 WerFault.exe 374 6004 4284 WerFault.exe 379 476 1040 WerFault.exe 384 900 1852 WerFault.exe 389 480 2888 WerFault.exe 394 6080 5376 WerFault.exe 399 796 5872 WerFault.exe 404 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RAGAZV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UQB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DEXFEOI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RVLBI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RDAEZD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JJU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEEQZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RKIO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LWM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NHT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WREGGYU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WFEUPLX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ILKTU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SBEYTQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WMGMG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WGSD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BTNUSKM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BLAAOZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YNAYQT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TGSKOGZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XTN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XFYG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WCBHQB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VDTHJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSUZAIL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QBPRB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CZE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GXKK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XLZV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NEMQZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KQEF.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1372 2026-07-30_fc835489c19780206ba63c040d7b9f9d_elex_emotet_stop.exe 1372 2026-07-30_fc835489c19780206ba63c040d7b9f9d_elex_emotet_stop.exe 1096 WMGMG.exe 1096 WMGMG.exe 1656 KQEF.exe 1656 KQEF.exe 360 RVLBI.exe 360 RVLBI.exe 2480 MJQKKMF.exe 2480 MJQKKMF.exe 3388 BEZWD.exe 3388 BEZWD.exe 2696 WREGGYU.exe 2696 WREGGYU.exe 824 WFEUPLX.exe 824 WFEUPLX.exe 2020 LANZA.exe 2020 LANZA.exe 2748 FNSIKYU.exe 2748 FNSIKYU.exe 3560 VDTHJ.exe 3560 VDTHJ.exe 3296 BDB.exe 3296 BDB.exe 4132 ETHVM.exe 4132 ETHVM.exe 4788 SRHH.exe 4788 SRHH.exe 1552 NEMQZ.exe 1552 NEMQZ.exe 4360 CZE.exe 4360 CZE.exe 5604 NSZN.exe 5604 NSZN.exe 4424 EABTVR.exe 4424 EABTVR.exe 6036 KBI.exe 6036 KBI.exe 4300 IBQCV.exe 4300 IBQCV.exe 3100 ZBSHZLC.exe 3100 ZBSHZLC.exe 2500 JJU.exe 2500 JJU.exe 2060 PKCAL.exe 2060 PKCAL.exe 3592 JXGJWKU.exe 3592 JXGJWKU.exe 876 UQB.exe 876 UQB.exe 3488 YGQCQ.exe 3488 YGQCQ.exe 5296 BTNUSKM.exe 5296 BTNUSKM.exe 4140 WGSD.exe 4140 WGSD.exe 5432 MRC.exe 5432 MRC.exe 1904 ICLKZA.exe 1904 ICLKZA.exe 2744 GXKK.exe 2744 GXKK.exe 4192 SFRSIW.exe 4192 SFRSIW.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1372 2026-07-30_fc835489c19780206ba63c040d7b9f9d_elex_emotet_stop.exe 1372 2026-07-30_fc835489c19780206ba63c040d7b9f9d_elex_emotet_stop.exe 1096 WMGMG.exe 1096 WMGMG.exe 1656 KQEF.exe 1656 KQEF.exe 360 RVLBI.exe 360 RVLBI.exe 2480 MJQKKMF.exe 2480 MJQKKMF.exe 3388 BEZWD.exe 3388 BEZWD.exe 2696 WREGGYU.exe 2696 WREGGYU.exe 824 WFEUPLX.exe 824 WFEUPLX.exe 2020 LANZA.exe 2020 LANZA.exe 2748 FNSIKYU.exe 2748 FNSIKYU.exe 3560 VDTHJ.exe 3560 VDTHJ.exe 3296 BDB.exe 3296 BDB.exe 4132 ETHVM.exe 4132 ETHVM.exe 4788 SRHH.exe 4788 SRHH.exe 1552 NEMQZ.exe 1552 NEMQZ.exe 4360 CZE.exe 4360 CZE.exe 5604 NSZN.exe 5604 NSZN.exe 4424 EABTVR.exe 4424 EABTVR.exe 6036 KBI.exe 6036 KBI.exe 4300 IBQCV.exe 4300 IBQCV.exe 3100 ZBSHZLC.exe 3100 ZBSHZLC.exe 2500 JJU.exe 2500 JJU.exe 2060 PKCAL.exe 2060 PKCAL.exe 3592 JXGJWKU.exe 3592 JXGJWKU.exe 876 UQB.exe 876 UQB.exe 3488 YGQCQ.exe 3488 YGQCQ.exe 5296 BTNUSKM.exe 5296 BTNUSKM.exe 4140 WGSD.exe 4140 WGSD.exe 5432 MRC.exe 5432 MRC.exe 1904 ICLKZA.exe 1904 ICLKZA.exe 2744 GXKK.exe 2744 GXKK.exe 4192 SFRSIW.exe 4192 SFRSIW.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1372 wrote to memory of 1900 1372 2026-07-30_fc835489c19780206ba63c040d7b9f9d_elex_emotet_stop.exe 89 PID 1900 wrote to memory of 1096 1900 cmd.exe 93 PID 1096 wrote to memory of 4656 1096 WMGMG.exe 95 PID 4656 wrote to memory of 1656 4656 cmd.exe 99 PID 1656 wrote to memory of 4876 1656 KQEF.exe 100 PID 4876 wrote to memory of 360 4876 cmd.exe 104 PID 360 wrote to memory of 1772 360 RVLBI.exe 105 PID 1772 wrote to memory of 2480 1772 cmd.exe 109 PID 2480 wrote to memory of 1264 2480 MJQKKMF.exe 110 PID 1264 wrote to memory of 3388 1264 cmd.exe 114 PID 3388 wrote to memory of 2268 3388 BEZWD.exe 115 PID 2268 wrote to memory of 2696 2268 cmd.exe 119 PID 2696 wrote to memory of 2016 2696 WREGGYU.exe 120 PID 2016 wrote to memory of 824 2016 cmd.exe 124 PID 824 wrote to memory of 3096 824 WFEUPLX.exe 125 PID 3096 wrote to memory of 2020 3096 cmd.exe 129 PID 2020 wrote to memory of 5820 2020 LANZA.exe 130 PID 5820 wrote to memory of 2748 5820 cmd.exe 134 PID 2748 wrote to memory of 2764 2748 FNSIKYU.exe 135 PID 2764 wrote to memory of 3560 2764 cmd.exe 139 PID 3560 wrote to memory of 828 3560 VDTHJ.exe 140 PID 828 wrote to memory of 3296 828 cmd.exe 144 PID 3296 wrote to memory of 4148 3296 BDB.exe 145 PID 4148 wrote to memory of 4132 4148 cmd.exe 149 PID 4132 wrote to memory of 4908 4132 ETHVM.exe 150 PID 4908 wrote to memory of 4788 4908 cmd.exe 154 PID 4788 wrote to memory of 2456 4788 SRHH.exe 155 PID 2456 wrote to memory of 1552 2456 cmd.exe 159 PID 1552 wrote to memory of 2240 1552 NEMQZ.exe 160 PID 2240 wrote to memory of 4360 2240 cmd.exe 164 PID 4360 wrote to memory of 1136 4360 CZE.exe 165 PID 1136 wrote to memory of 5604 1136 cmd.exe 169 PID 5604 wrote to memory of 2592 5604 NSZN.exe 170 PID 2592 wrote to memory of 4424 2592 cmd.exe 174 PID 4424 wrote to memory of 5100 4424 EABTVR.exe 175 PID 5100 wrote to memory of 6036 5100 cmd.exe 179 PID 6036 wrote to memory of 5228 6036 KBI.exe 180 PID 5228 wrote to memory of 4300 5228 cmd.exe 184 PID 4300 wrote to memory of 1884 4300 IBQCV.exe 185 PID 1884 wrote to memory of 3100 1884 cmd.exe 189 PID 3100 wrote to memory of 4564 3100 ZBSHZLC.exe 190 PID 4564 wrote to memory of 2500 4564 cmd.exe 194 PID 2500 wrote to memory of 2892 2500 JJU.exe 195 PID 2892 wrote to memory of 2060 2892 cmd.exe 199 PID 2060 wrote to memory of 2728 2060 PKCAL.exe 200 PID 2728 wrote to memory of 3592 2728 cmd.exe 204 PID 3592 wrote to memory of 1332 3592 JXGJWKU.exe 205 PID 1332 wrote to memory of 876 1332 cmd.exe 209 PID 876 wrote to memory of 5880 876 UQB.exe 210 PID 5880 wrote to memory of 3488 5880 cmd.exe 214 PID 3488 wrote to memory of 5516 3488 YGQCQ.exe 215 PID 5516 wrote to memory of 5296 5516 cmd.exe 219 PID 5296 wrote to memory of 2756 5296 BTNUSKM.exe 220 PID 2756 wrote to memory of 4140 2756 cmd.exe 224 PID 4140 wrote to memory of 916 4140 WGSD.exe 225 PID 916 wrote to memory of 5432 916 cmd.exe 229 PID 5432 wrote to memory of 5488 5432 MRC.exe 230 PID 5488 wrote to memory of 1904 5488 cmd.exe 234 PID 1904 wrote to memory of 5672 1904 ICLKZA.exe 235 PID 5672 wrote to memory of 2744 5672 cmd.exe 239 PID 2744 wrote to memory of 776 2744 GXKK.exe 240 PID 776 wrote to memory of 4192 776 cmd.exe 244 PID 4192 wrote to memory of 5008 4192 SFRSIW.exe 245 PID 5008 wrote to memory of 5276 5008 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_fc835489c19780206ba63c040d7b9f9d_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-30_fc835489c19780206ba63c040d7b9f9d_elex_emotet_stop.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WMGMG.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\windows\system\WMGMG.exeC:\windows\system\WMGMG.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KQEF.exe.bat" "4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\windows\KQEF.exeC:\windows\KQEF.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RVLBI.exe.bat" "6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\windows\SysWOW64\RVLBI.exeC:\windows\system32\RVLBI.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MJQKKMF.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\windows\SysWOW64\MJQKKMF.exeC:\windows\system32\MJQKKMF.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BEZWD.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\windows\SysWOW64\BEZWD.exeC:\windows\system32\BEZWD.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WREGGYU.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\windows\system\WREGGYU.exeC:\windows\system\WREGGYU.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WFEUPLX.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\windows\WFEUPLX.exeC:\windows\WFEUPLX.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LANZA.exe.bat" "16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\windows\SysWOW64\LANZA.exeC:\windows\system32\LANZA.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FNSIKYU.exe.bat" "18⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5820 -
C:\windows\FNSIKYU.exeC:\windows\FNSIKYU.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VDTHJ.exe.bat" "20⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\windows\SysWOW64\VDTHJ.exeC:\windows\system32\VDTHJ.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BDB.exe.bat" "22⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:828 -
C:\windows\SysWOW64\BDB.exeC:\windows\system32\BDB.exe23⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ETHVM.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\windows\system\ETHVM.exeC:\windows\system\ETHVM.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SRHH.exe.bat" "26⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\windows\SysWOW64\SRHH.exeC:\windows\system32\SRHH.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NEMQZ.exe.bat" "28⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\windows\system\NEMQZ.exeC:\windows\system\NEMQZ.exe29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CZE.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\windows\system\CZE.exeC:\windows\system\CZE.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NSZN.exe.bat" "32⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\windows\system\NSZN.exeC:\windows\system\NSZN.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5604 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EABTVR.exe.bat" "34⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\windows\EABTVR.exeC:\windows\EABTVR.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KBI.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\windows\KBI.exeC:\windows\KBI.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6036 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IBQCV.exe.bat" "38⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5228 -
C:\windows\system\IBQCV.exeC:\windows\system\IBQCV.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZBSHZLC.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\windows\ZBSHZLC.exeC:\windows\ZBSHZLC.exe41⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JJU.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\windows\system\JJU.exeC:\windows\system\JJU.exe43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PKCAL.exe.bat" "44⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\windows\PKCAL.exeC:\windows\PKCAL.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JXGJWKU.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\windows\SysWOW64\JXGJWKU.exeC:\windows\system32\JXGJWKU.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UQB.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\windows\SysWOW64\UQB.exeC:\windows\system32\UQB.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YGQCQ.exe.bat" "50⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5880 -
C:\windows\YGQCQ.exeC:\windows\YGQCQ.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BTNUSKM.exe.bat" "52⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5516 -
C:\windows\system\BTNUSKM.exeC:\windows\system\BTNUSKM.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WGSD.exe.bat" "54⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\windows\SysWOW64\WGSD.exeC:\windows\system32\WGSD.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MRC.exe.bat" "56⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:916 -
C:\windows\system\MRC.exeC:\windows\system\MRC.exe57⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ICLKZA.exe.bat" "58⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5488 -
C:\windows\system\ICLKZA.exeC:\windows\system\ICLKZA.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GXKK.exe.bat" "60⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5672 -
C:\windows\SysWOW64\GXKK.exeC:\windows\system32\GXKK.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SFRSIW.exe.bat" "62⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:776 -
C:\windows\SFRSIW.exeC:\windows\SFRSIW.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XFYG.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\windows\XFYG.exeC:\windows\XFYG.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5276 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XLZV.exe.bat" "66⤵
- Executes a command shell one-liner
PID:5532 -
C:\windows\XLZV.exeC:\windows\XLZV.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NOIZMQJ.exe.bat" "68⤵
- Executes a command shell one-liner
PID:4548 -
C:\windows\SysWOW64\NOIZMQJ.exeC:\windows\system32\NOIZMQJ.exe69⤵
- Executes dropped EXE
PID:4672 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NUI.exe.bat" "70⤵
- Executes a command shell one-liner
PID:3064 -
C:\windows\NUI.exeC:\windows\NUI.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JZGKCMG.exe.bat" "72⤵PID:4816
-
C:\windows\SysWOW64\JZGKCMG.exeC:\windows\system32\JZGKCMG.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WCWJJPB.exe.bat" "74⤵PID:6136
-
C:\windows\SysWOW64\WCWJJPB.exeC:\windows\system32\WCWJJPB.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OKYO.exe.bat" "76⤵PID:252
-
C:\windows\SysWOW64\OKYO.exeC:\windows\system32\OKYO.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GFCKAK.exe.bat" "78⤵
- System Location Discovery: System Language Discovery
PID:696 -
C:\windows\system\GFCKAK.exeC:\windows\system\GFCKAK.exe79⤵
- Executes dropped EXE
PID:3380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XTN.exe.bat" "80⤵
- Executes a command shell one-liner
PID:3664 -
C:\windows\XTN.exeC:\windows\XTN.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QWQGV.exe.bat" "82⤵PID:672
-
C:\windows\system\QWQGV.exeC:\windows\system\QWQGV.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BOLYDMR.exe.bat" "84⤵PID:5116
-
C:\windows\system\BOLYDMR.exeC:\windows\system\BOLYDMR.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HOTM.exe.bat" "86⤵PID:3848
-
C:\windows\system\HOTM.exeC:\windows\system\HOTM.exe87⤵
- Executes dropped EXE
PID:5860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ASXISW.exe.bat" "88⤵PID:5592
-
C:\windows\ASXISW.exeC:\windows\ASXISW.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TKABAMJ.exe.bat" "90⤵PID:3292
-
C:\windows\SysWOW64\TKABAMJ.exeC:\windows\system32\TKABAMJ.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RKIO.exe.bat" "92⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3212 -
C:\windows\SysWOW64\RKIO.exeC:\windows\system32\RKIO.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ILKTU.exe.bat" "94⤵
- Executes a command shell one-liner
PID:1160 -
C:\windows\system\ILKTU.exeC:\windows\system\ILKTU.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4676 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FQPRBNP.exe.bat" "96⤵PID:5704
-
C:\windows\system\FQPRBNP.exeC:\windows\system\FQPRBNP.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HOVLJ.exe.bat" "98⤵PID:2612
-
C:\windows\SysWOW64\HOVLJ.exeC:\windows\system32\HOVLJ.exe99⤵
- Executes dropped EXE
PID:1440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IRZH.exe.bat" "100⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3224 -
C:\windows\system\IRZH.exeC:\windows\system\IRZH.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CEEQZ.exe.bat" "102⤵
- Executes a command shell one-liner
PID:3252 -
C:\windows\system\CEEQZ.exeC:\windows\system\CEEQZ.exe103⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NXHJHBD.exe.bat" "104⤵PID:2252
-
C:\windows\system\NXHJHBD.exeC:\windows\system\NXHJHBD.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GSK.exe.bat" "106⤵PID:6140
-
C:\windows\GSK.exeC:\windows\GSK.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MSSAVT.exe.bat" "108⤵PID:5580
-
C:\windows\MSSAVT.exeC:\windows\MSSAVT.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NVW.exe.bat" "110⤵
- Executes a command shell one-liner
PID:472 -
C:\windows\SysWOW64\NVW.exeC:\windows\system32\NVW.exe111⤵
- Executes dropped EXE
PID:5496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KWDKS.exe.bat" "112⤵
- System Location Discovery: System Language Discovery
PID:3184 -
C:\windows\SysWOW64\KWDKS.exeC:\windows\system32\KWDKS.exe113⤵
- Executes dropped EXE
PID:2860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SBEYTQ.exe.bat" "114⤵PID:2560
-
C:\windows\SBEYTQ.exeC:\windows\SBEYTQ.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YCL.exe.bat" "116⤵PID:1588
-
C:\windows\YCL.exeC:\windows\YCL.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GSMLJG.exe.bat" "118⤵
- System Location Discovery: System Language Discovery
PID:2076 -
C:\windows\system\GSMLJG.exeC:\windows\system\GSMLJG.exe119⤵
- Executes dropped EXE
PID:1040 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MSUZAIL.exe.bat" "120⤵
- Executes a command shell one-liner
PID:5560 -
C:\windows\SysWOW64\MSUZAIL.exeC:\windows\system32\MSUZAIL.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1852
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-