Analysis
- max time kernel
86s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/07/2026, 15:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-30_9cc4f54b7dfdb33a3042e75fcf5e2116_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-07-30_9cc4f54b7dfdb33a3042e75fcf5e2116_elex_emotet_stop.exe
- Size 208KB
- Sample260730-sk2fmabe43
- SHA256 8caa09bb3522141e61604e06964f91d0f3b20c1d63517a9a7aed2f1c96f7811c
- MD5 9cc4f54b7dfdb33a3042e75fcf5e2116
- SHA1 dc6891aec7167c2da45eaf189c02d6a6b01bbb66
- SHA512 18fa776ffb5c2872d67a5bdba08f67e1d91c6526b828a90151face8fcc3f5a9aed64d756b4e52decf78e16ea94e50495c56157ab6b55bee63a9b614e0b103d98
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlldL+LOfV4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFll5+LONkEj1
- TLSH T17E247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5928 AXORVPO.exe 3476 KNPMHQL.exe 1444 BNE.exe 4472 WJJB.exe 3356 NJXYQ.exe 4724 HBMJA.exe 3048 BSNGHK.exe 5212 CNR.exe 5892 ELFWCJT.exe 2780 FOIA.exe 1344 WWXX.exe 1380 MMY.exe 2960 NKEJIUV.exe 2236 JMUHW.exe 4120 NCB.exe 1204 NIT.exe 804 ITJ.exe 1932 RTLAB.exe 6060 KWPDHA.exe 4272 WEWDTS.exe 3740 OHZ.exe 840 SXGHL.exe 4636 EFNPXTO.exe 1836 CBMQC.exe 4544 DEQMHMF.exe 5032 SZHYS.exe 2460 LULU.exe 4924 AKMTM.exe 2120 ZIXO.exe 556 ZLB.exe 1684 QVMINTJ.exe 4464 RYQD.exe 2816 JUTHGZU.exe 1868 ZPDLR.exe 2940 DABHRE.exe 2980 PIIHDX.exe 2616 TYO.exe 4848 WGDPC.exe 3880 GDJJJ.exe 1336 BRNSTQB.exe 5564 ZMNTYTQ.exe 5752 UXVSE.exe 6112 KNWJ.exe 5496 VFLU.exe 4264 WIPYII.exe 2640 JLYWWL.exe 2856 EHC.exe 4136 YUHP.exe 2384 OKIHPG.exe 6020 KCSRTCP.exe 2304 UAYD.exe 2000 HLOC.exe 6140 ZTIHAS.exe 4524 DBX.exe 5008 VEBLS.exe 5220 NFD.exe 2324 PCIKLO.exe 3408 BTP.exe 2900 MLE.exe 6044 SGDELD.exe 5252 YHL.exe 3248 CPSSGP.exe 5824 LXUFKVO.exe 3600 MSXB.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\CBMQC.exe EFNPXTO.exe File opened for modification C:\windows\SysWOW64\CBMQC.exe EFNPXTO.exe File created C:\windows\SysWOW64\ZIXO.exe AKMTM.exe File created C:\windows\SysWOW64\ZIXO.exe.bat AKMTM.exe File created C:\windows\SysWOW64\AXORVPO.exe 2026-07-30_9cc4f54b7dfdb33a3042e75fcf5e2116_elex_emotet_stop.exe File created C:\windows\SysWOW64\QVMINTJ.exe.bat ZLB.exe File created C:\windows\SysWOW64\UXVSE.exe ZMNTYTQ.exe File created C:\windows\SysWOW64\QIE.exe.bat MSXB.exe File opened for modification C:\windows\SysWOW64\FKHKDBD.exe ZKZWM.exe File created C:\windows\SysWOW64\FKHKDBD.exe.bat ZKZWM.exe File created C:\windows\SysWOW64\FGTH.exe OSJ.exe File created C:\windows\SysWOW64\CLTM.exe ZYPCIUL.exe File created C:\windows\SysWOW64\AXORVPO.exe.bat 2026-07-30_9cc4f54b7dfdb33a3042e75fcf5e2116_elex_emotet_stop.exe File created C:\windows\SysWOW64\WJJB.exe.bat BNE.exe File created C:\windows\SysWOW64\RTLAB.exe.bat ITJ.exe File opened for modification C:\windows\SysWOW64\SZHYS.exe DEQMHMF.exe File created C:\windows\SysWOW64\ZMNTYTQ.exe.bat BRNSTQB.exe File opened for modification C:\windows\SysWOW64\PCIKLO.exe NFD.exe File created C:\windows\SysWOW64\CLTM.exe.bat ZYPCIUL.exe File opened for modification C:\windows\SysWOW64\TSJZUCL.exe RUDNFTD.exe File created C:\windows\SysWOW64\CBMQC.exe.bat EFNPXTO.exe File opened for modification C:\windows\SysWOW64\ZIXO.exe AKMTM.exe File opened for modification C:\windows\SysWOW64\ZMNTYTQ.exe BRNSTQB.exe File created C:\windows\SysWOW64\EHC.exe JLYWWL.exe File created C:\windows\SysWOW64\VVCQ.exe.bat BIXHSSO.exe File created C:\windows\SysWOW64\TSJZUCL.exe.bat RUDNFTD.exe File created C:\windows\SysWOW64\NJXYQ.exe WJJB.exe File opened for modification C:\windows\SysWOW64\FOIA.exe ELFWCJT.exe File created C:\windows\SysWOW64\UXVSE.exe.bat ZMNTYTQ.exe File created C:\windows\SysWOW64\ATYZHC.exe FGTH.exe File opened for modification C:\windows\SysWOW64\SHGD.exe SECAJ.exe File created C:\windows\SysWOW64\SHGD.exe.bat SECAJ.exe File created C:\windows\SysWOW64\WJJB.exe BNE.exe File created C:\windows\SysWOW64\QVMINTJ.exe ZLB.exe File created C:\windows\SysWOW64\VFLU.exe KNWJ.exe File opened for modification C:\windows\SysWOW64\VVCQ.exe BIXHSSO.exe File opened for modification C:\windows\SysWOW64\NJXYQ.exe WJJB.exe File created C:\windows\SysWOW64\SZHYS.exe DEQMHMF.exe File created C:\windows\SysWOW64\VFLU.exe.bat KNWJ.exe File opened for modification C:\windows\SysWOW64\JDD.exe RIAA.exe File created C:\windows\SysWOW64\WWXX.exe FOIA.exe File created C:\windows\SysWOW64\WIPYII.exe VFLU.exe File created C:\windows\SysWOW64\QIE.exe MSXB.exe File opened for modification C:\windows\SysWOW64\FGTH.exe OSJ.exe File opened for modification C:\windows\SysWOW64\VFLU.exe KNWJ.exe File created C:\windows\SysWOW64\WWXX.exe.bat FOIA.exe File created C:\windows\SysWOW64\NCB.exe JMUHW.exe File opened for modification C:\windows\SysWOW64\RTLAB.exe ITJ.exe File opened for modification C:\windows\SysWOW64\JUTHGZU.exe RYQD.exe File opened for modification C:\windows\SysWOW64\WIPYII.exe VFLU.exe File created C:\windows\SysWOW64\EHC.exe.bat JLYWWL.exe File opened for modification C:\windows\SysWOW64\QIE.exe MSXB.exe File created C:\windows\SysWOW64\JMUHW.exe NKEJIUV.exe File opened for modification C:\windows\SysWOW64\KWPDHA.exe RTLAB.exe File created C:\windows\SysWOW64\ZMNTYTQ.exe BRNSTQB.exe File created C:\windows\SysWOW64\WIPYII.exe.bat VFLU.exe File created C:\windows\SysWOW64\ATYZHC.exe.bat FGTH.exe File created C:\windows\SysWOW64\JDD.exe RIAA.exe File created C:\windows\SysWOW64\VVCQ.exe BIXHSSO.exe File created C:\windows\SysWOW64\DVOID.exe UNMD.exe File created C:\windows\SysWOW64\BNE.exe.bat KNPMHQL.exe File created C:\windows\SysWOW64\FOIA.exe ELFWCJT.exe File created C:\windows\SysWOW64\KWPDHA.exe.bat RTLAB.exe File created C:\windows\SysWOW64\SZHYS.exe.bat DEQMHMF.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\KWEAQQ.exe.bat GOX.exe File created C:\windows\BSZ.exe XCSB.exe File created C:\windows\system\AMBABW.exe.bat CLTM.exe File created C:\windows\system\JLYWWL.exe.bat WIPYII.exe File created C:\windows\system\SGDELD.exe MLE.exe File opened for modification C:\windows\system\RUDNFTD.exe AMBABW.exe File opened for modification C:\windows\system\HBMJA.exe NJXYQ.exe File opened for modification C:\windows\system\CNR.exe BSNGHK.exe File opened for modification C:\windows\system\JLYWWL.exe WIPYII.exe File created C:\windows\LULTCN.exe.bat ABIAU.exe File opened for modification C:\windows\SECAJ.exe IEAU.exe File created C:\windows\WPNDAK.exe SHGD.exe File created C:\windows\system\WEWDTS.exe.bat KWPDHA.exe File created C:\windows\system\DABHRE.exe.bat ZPDLR.exe File created C:\windows\CPSSGP.exe YHL.exe File created C:\windows\system\WIMW.exe.bat QIE.exe File created C:\windows\OSJ.exe FKHKDBD.exe File opened for modification C:\windows\system\FOD.exe NLAVEQ.exe File created C:\windows\system\VHEKP.exe XHWWG.exe File opened for modification C:\windows\FLKTY.exe DNEZQM.exe File created C:\windows\ELFWCJT.exe.bat CNR.exe File opened for modification C:\windows\ITJ.exe NIT.exe File opened for modification C:\windows\system\AKMTM.exe LULU.exe File created C:\windows\system\TYO.exe.bat PIIHDX.exe File created C:\windows\system\MLE.exe BTP.exe File opened for modification C:\windows\system\XCSB.exe LULTCN.exe File opened for modification C:\windows\NIT.exe NCB.exe File created C:\windows\system\OHZ.exe WEWDTS.exe File created C:\windows\system\EFNPXTO.exe SXGHL.exe File created C:\windows\system\DABHRE.exe ZPDLR.exe File created C:\windows\system\UAYD.exe.bat KCSRTCP.exe File created C:\windows\system\LXUFKVO.exe.bat CPSSGP.exe File created C:\windows\system\DNUAPIL.exe ZXNA.exe File created C:\windows\system\DNUAPIL.exe.bat ZXNA.exe File opened for modification C:\windows\RYQD.exe QVMINTJ.exe File created C:\windows\NIT.exe.bat NCB.exe File created C:\windows\system\OHZ.exe.bat WEWDTS.exe File opened for modification C:\windows\WGDPC.exe TYO.exe File created C:\windows\ZTIHAS.exe HLOC.exe File opened for modification C:\windows\system\MLE.exe BTP.exe File created C:\windows\system\ZKZWM.exe.bat CRXUJ.exe File created C:\windows\system\QXL.exe KWEAQQ.exe File created C:\windows\SXGHL.exe.bat OHZ.exe File opened for modification C:\windows\system\DABHRE.exe ZPDLR.exe File created C:\windows\system\BRNSTQB.exe GDJJJ.exe File created C:\windows\ZXNA.exe QXL.exe File created C:\windows\SECAJ.exe IEAU.exe File opened for modification C:\windows\system\DNEZQM.exe VHEKP.exe File created C:\windows\UNMD.exe TSJZUCL.exe File opened for modification C:\windows\UNMD.exe TSJZUCL.exe File created C:\windows\ELFWCJT.exe CNR.exe File created C:\windows\ITJ.exe NIT.exe File created C:\windows\KNWJ.exe.bat UXVSE.exe File created C:\windows\system\JLYWWL.exe WIPYII.exe File created C:\windows\system\WIMW.exe QIE.exe File created C:\windows\system\CRXUJ.exe.bat LJVPFXQ.exe File created C:\windows\system\ABIAU.exe FOD.exe File created C:\windows\RIAA.exe.bat BSZ.exe File created C:\windows\NIT.exe NCB.exe File opened for modification C:\windows\ZPDLR.exe JUTHGZU.exe File created C:\windows\system\OKIHPG.exe YUHP.exe File created C:\windows\system\MSXB.exe.bat LXUFKVO.exe File opened for modification C:\windows\system\ABIAU.exe FOD.exe File created C:\windows\system\NTSWRC.exe JDD.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5648 cmd.exe 5800 cmd.exe 5756 cmd.exe 5512 cmd.exe 4388 cmd.exe 4160 cmd.exe 1816 cmd.exe 3220 cmd.exe 4504 cmd.exe 1880 cmd.exe 1112 cmd.exe 5964 cmd.exe 2032 cmd.exe 3256 cmd.exe 2996 cmd.exe 3844 cmd.exe 1696 cmd.exe 3400 cmd.exe 5592 cmd.exe 4828 cmd.exe 1048 cmd.exe 5336 cmd.exe 4644 cmd.exe 2876 cmd.exe 1516 cmd.exe 4712 cmd.exe 4780 cmd.exe 4448 cmd.exe 2152 cmd.exe 2340 cmd.exe 5208 cmd.exe 252 cmd.exe 4176 cmd.exe 5704 cmd.exe 520 cmd.exe 4088 cmd.exe 1268 cmd.exe 1300 cmd.exe 5616 cmd.exe 1328 cmd.exe 3380 cmd.exe 932 cmd.exe 1404 cmd.exe 912 cmd.exe 4752 cmd.exe 3716 cmd.exe 4840 cmd.exe 1688 cmd.exe 1260 cmd.exe 848 cmd.exe 992 cmd.exe 6128 cmd.exe 1348 cmd.exe 4436 cmd.exe 5860 cmd.exe 4604 cmd.exe 4280 cmd.exe 2648 cmd.exe 3336 cmd.exe 4348 cmd.exe 3300 cmd.exe 868 cmd.exe 4052 cmd.exe 5072 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 1624 4648 WerFault.exe 87 1996 5928 WerFault.exe 93 3928 3476 WerFault.exe 99 5112 1444 WerFault.exe 104 5728 4472 WerFault.exe 109 5460 3356 WerFault.exe 114 4376 4724 WerFault.exe 119 1048 3048 WerFault.exe 124 4980 5212 WerFault.exe 129 2432 5892 WerFault.exe 134 2576 2780 WerFault.exe 139 3232 1344 WerFault.exe 144 4448 1380 WerFault.exe 149 1652 2960 WerFault.exe 154 124 2236 WerFault.exe 159 3596 4120 WerFault.exe 164 2100 1204 WerFault.exe 169 2528 804 WerFault.exe 174 4412 1932 WerFault.exe 179 5224 6060 WerFault.exe 184 5844 4272 WerFault.exe 189 2168 3740 WerFault.exe 194 5792 840 WerFault.exe 199 3512 4636 WerFault.exe 204 696 1836 WerFault.exe 209 248 4544 WerFault.exe 214 1592 5032 WerFault.exe 219 4516 2460 WerFault.exe 224 3024 4924 WerFault.exe 229 1756 2120 WerFault.exe 234 3884 556 WerFault.exe 239 1716 1684 WerFault.exe 244 1296 4464 WerFault.exe 249 6028 2816 WerFault.exe 254 4372 1868 WerFault.exe 259 3852 2940 WerFault.exe 264 5452 2980 WerFault.exe 270 1632 2616 WerFault.exe 275 4436 4848 WerFault.exe 280 5336 3880 WerFault.exe 285 1648 1336 WerFault.exe 290 2740 5564 WerFault.exe 295 4816 5752 WerFault.exe 300 2264 6112 WerFault.exe 305 5476 5496 WerFault.exe 310 692 4264 WerFault.exe 315 1996 2640 WerFault.exe 320 3816 2856 WerFault.exe 325 5112 4136 WerFault.exe 330 5088 2384 WerFault.exe 335 2868 6020 WerFault.exe 340 1620 2304 WerFault.exe 345 3420 2000 WerFault.exe 350 5384 6140 WerFault.exe 355 5488 4524 WerFault.exe 360 3052 5008 WerFault.exe 365 3200 5220 WerFault.exe 370 684 2324 WerFault.exe 375 912 3408 WerFault.exe 380 4516 2900 WerFault.exe 385 4224 6044 WerFault.exe 390 2316 5252 WerFault.exe 395 3304 3248 WerFault.exe 400 4592 5824 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WJJB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RYQD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZMNTYTQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DBX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZKZWM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WPNDAK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GXPIMQS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AXORVPO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JMUHW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JDD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BIXHSSO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XHWWG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WIMW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CPSSGP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LXUFKVO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QIE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WOEL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RUDNFTD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LULU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KCSRTCP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HLOC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BTP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZPDLR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WIPYII.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PCIKLO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OSJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FGTH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BNE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BSNGHK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EHC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QXL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FOD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XCSB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_9cc4f54b7dfdb33a3042e75fcf5e2116_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MMY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RIAA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SXGHL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4648 2026-07-30_9cc4f54b7dfdb33a3042e75fcf5e2116_elex_emotet_stop.exe 4648 2026-07-30_9cc4f54b7dfdb33a3042e75fcf5e2116_elex_emotet_stop.exe 5928 AXORVPO.exe 5928 AXORVPO.exe 3476 KNPMHQL.exe 3476 KNPMHQL.exe 1444 BNE.exe 1444 BNE.exe 4472 WJJB.exe 4472 WJJB.exe 3356 NJXYQ.exe 3356 NJXYQ.exe 4724 HBMJA.exe 4724 HBMJA.exe 3048 BSNGHK.exe 3048 BSNGHK.exe 5212 CNR.exe 5212 CNR.exe 5892 ELFWCJT.exe 5892 ELFWCJT.exe 2780 FOIA.exe 2780 FOIA.exe 1344 WWXX.exe 1344 WWXX.exe 1380 MMY.exe 1380 MMY.exe 2960 NKEJIUV.exe 2960 NKEJIUV.exe 2236 JMUHW.exe 2236 JMUHW.exe 4120 NCB.exe 4120 NCB.exe 1204 NIT.exe 1204 NIT.exe 804 ITJ.exe 804 ITJ.exe 1932 RTLAB.exe 1932 RTLAB.exe 6060 KWPDHA.exe 6060 KWPDHA.exe 4272 WEWDTS.exe 4272 WEWDTS.exe 3740 OHZ.exe 3740 OHZ.exe 840 SXGHL.exe 840 SXGHL.exe 4636 EFNPXTO.exe 4636 EFNPXTO.exe 1836 CBMQC.exe 1836 CBMQC.exe 4544 DEQMHMF.exe 4544 DEQMHMF.exe 5032 SZHYS.exe 5032 SZHYS.exe 2460 LULU.exe 2460 LULU.exe 4924 AKMTM.exe 4924 AKMTM.exe 2120 ZIXO.exe 2120 ZIXO.exe 556 ZLB.exe 556 ZLB.exe 1684 QVMINTJ.exe 1684 QVMINTJ.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4648 2026-07-30_9cc4f54b7dfdb33a3042e75fcf5e2116_elex_emotet_stop.exe 4648 2026-07-30_9cc4f54b7dfdb33a3042e75fcf5e2116_elex_emotet_stop.exe 5928 AXORVPO.exe 5928 AXORVPO.exe 3476 KNPMHQL.exe 3476 KNPMHQL.exe 1444 BNE.exe 1444 BNE.exe 4472 WJJB.exe 4472 WJJB.exe 3356 NJXYQ.exe 3356 NJXYQ.exe 4724 HBMJA.exe 4724 HBMJA.exe 3048 BSNGHK.exe 3048 BSNGHK.exe 5212 CNR.exe 5212 CNR.exe 5892 ELFWCJT.exe 5892 ELFWCJT.exe 2780 FOIA.exe 2780 FOIA.exe 1344 WWXX.exe 1344 WWXX.exe 1380 MMY.exe 1380 MMY.exe 2960 NKEJIUV.exe 2960 NKEJIUV.exe 2236 JMUHW.exe 2236 JMUHW.exe 4120 NCB.exe 4120 NCB.exe 1204 NIT.exe 1204 NIT.exe 804 ITJ.exe 804 ITJ.exe 1932 RTLAB.exe 1932 RTLAB.exe 6060 KWPDHA.exe 6060 KWPDHA.exe 4272 WEWDTS.exe 4272 WEWDTS.exe 3740 OHZ.exe 3740 OHZ.exe 840 SXGHL.exe 840 SXGHL.exe 4636 EFNPXTO.exe 4636 EFNPXTO.exe 1836 CBMQC.exe 1836 CBMQC.exe 4544 DEQMHMF.exe 4544 DEQMHMF.exe 5032 SZHYS.exe 5032 SZHYS.exe 2460 LULU.exe 2460 LULU.exe 4924 AKMTM.exe 4924 AKMTM.exe 2120 ZIXO.exe 2120 ZIXO.exe 556 ZLB.exe 556 ZLB.exe 1684 QVMINTJ.exe 1684 QVMINTJ.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4648 wrote to memory of 4388 4648 2026-07-30_9cc4f54b7dfdb33a3042e75fcf5e2116_elex_emotet_stop.exe 89 PID 4388 wrote to memory of 5928 4388 cmd.exe 93 PID 5928 wrote to memory of 1764 5928 AXORVPO.exe 95 PID 1764 wrote to memory of 3476 1764 cmd.exe 99 PID 3476 wrote to memory of 4584 3476 KNPMHQL.exe 100 PID 4584 wrote to memory of 1444 4584 cmd.exe 104 PID 1444 wrote to memory of 2804 1444 BNE.exe 105 PID 2804 wrote to memory of 4472 2804 cmd.exe 109 PID 4472 wrote to memory of 5616 4472 WJJB.exe 110 PID 5616 wrote to memory of 3356 5616 cmd.exe 114 PID 3356 wrote to memory of 5976 3356 NJXYQ.exe 115 PID 5976 wrote to memory of 4724 5976 cmd.exe 119 PID 4724 wrote to memory of 1328 4724 HBMJA.exe 120 PID 1328 wrote to memory of 3048 1328 cmd.exe 124 PID 3048 wrote to memory of 4160 3048 BSNGHK.exe 125 PID 4160 wrote to memory of 5212 4160 cmd.exe 129 PID 5212 wrote to memory of 2776 5212 CNR.exe 130 PID 2776 wrote to memory of 5892 2776 cmd.exe 134 PID 5892 wrote to memory of 4876 5892 ELFWCJT.exe 135 PID 4876 wrote to memory of 2780 4876 cmd.exe 139 PID 2780 wrote to memory of 2112 2780 FOIA.exe 140 PID 2112 wrote to memory of 1344 2112 cmd.exe 144 PID 1344 wrote to memory of 4780 1344 WWXX.exe 145 PID 4780 wrote to memory of 1380 4780 cmd.exe 149 PID 1380 wrote to memory of 5240 1380 MMY.exe 150 PID 5240 wrote to memory of 2960 5240 cmd.exe 154 PID 2960 wrote to memory of 1628 2960 NKEJIUV.exe 155 PID 1628 wrote to memory of 2236 1628 cmd.exe 159 PID 2236 wrote to memory of 5656 2236 JMUHW.exe 160 PID 5656 wrote to memory of 4120 5656 cmd.exe 164 PID 4120 wrote to memory of 2928 4120 NCB.exe 165 PID 2928 wrote to memory of 1204 2928 cmd.exe 169 PID 1204 wrote to memory of 928 1204 NIT.exe 170 PID 928 wrote to memory of 804 928 cmd.exe 174 PID 804 wrote to memory of 6056 804 ITJ.exe 175 PID 6056 wrote to memory of 1932 6056 cmd.exe 179 PID 1932 wrote to memory of 5208 1932 RTLAB.exe 180 PID 5208 wrote to memory of 6060 5208 cmd.exe 184 PID 6060 wrote to memory of 3468 6060 KWPDHA.exe 185 PID 3468 wrote to memory of 4272 3468 cmd.exe 189 PID 4272 wrote to memory of 4840 4272 WEWDTS.exe 190 PID 4840 wrote to memory of 3740 4840 cmd.exe 194 PID 3740 wrote to memory of 2692 3740 OHZ.exe 195 PID 2692 wrote to memory of 840 2692 cmd.exe 199 PID 840 wrote to memory of 5552 840 SXGHL.exe 200 PID 5552 wrote to memory of 4636 5552 cmd.exe 204 PID 4636 wrote to memory of 4572 4636 EFNPXTO.exe 205 PID 4572 wrote to memory of 1836 4572 cmd.exe 209 PID 1836 wrote to memory of 1212 1836 CBMQC.exe 210 PID 1212 wrote to memory of 4544 1212 cmd.exe 214 PID 4544 wrote to memory of 3928 4544 DEQMHMF.exe 215 PID 3928 wrote to memory of 5032 3928 cmd.exe 219 PID 5032 wrote to memory of 3908 5032 SZHYS.exe 220 PID 3908 wrote to memory of 2460 3908 cmd.exe 224 PID 2460 wrote to memory of 5184 2460 LULU.exe 225 PID 5184 wrote to memory of 4924 5184 cmd.exe 229 PID 4924 wrote to memory of 3564 4924 AKMTM.exe 230 PID 3564 wrote to memory of 2120 3564 cmd.exe 234 PID 2120 wrote to memory of 1688 2120 ZIXO.exe 235 PID 1688 wrote to memory of 556 1688 cmd.exe 239 PID 556 wrote to memory of 3428 556 ZLB.exe 240 PID 3428 wrote to memory of 1684 3428 cmd.exe 244 PID 1684 wrote to memory of 5356 1684 QVMINTJ.exe 245 PID 5356 wrote to memory of 4464 5356 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_9cc4f54b7dfdb33a3042e75fcf5e2116_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-30_9cc4f54b7dfdb33a3042e75fcf5e2116_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AXORVPO.exe.bat" "2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\windows\SysWOW64\AXORVPO.exeC:\windows\system32\AXORVPO.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KNPMHQL.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\windows\KNPMHQL.exeC:\windows\KNPMHQL.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BNE.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\windows\SysWOW64\BNE.exeC:\windows\system32\BNE.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WJJB.exe.bat" "8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\windows\SysWOW64\WJJB.exeC:\windows\system32\WJJB.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NJXYQ.exe.bat" "10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5616 -
C:\windows\SysWOW64\NJXYQ.exeC:\windows\system32\NJXYQ.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HBMJA.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:5976 -
C:\windows\system\HBMJA.exeC:\windows\system\HBMJA.exe13⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BSNGHK.exe.bat" "14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1328 -
C:\windows\system\BSNGHK.exeC:\windows\system\BSNGHK.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CNR.exe.bat" "16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\windows\system\CNR.exeC:\windows\system\CNR.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5212 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ELFWCJT.exe.bat" "18⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\windows\ELFWCJT.exeC:\windows\ELFWCJT.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5892 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FOIA.exe.bat" "20⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\windows\SysWOW64\FOIA.exeC:\windows\system32\FOIA.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WWXX.exe.bat" "22⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\windows\SysWOW64\WWXX.exeC:\windows\system32\WWXX.exe23⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MMY.exe.bat" "24⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\windows\system\MMY.exeC:\windows\system\MMY.exe25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NKEJIUV.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:5240 -
C:\windows\NKEJIUV.exeC:\windows\NKEJIUV.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JMUHW.exe.bat" "28⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\windows\SysWOW64\JMUHW.exeC:\windows\system32\JMUHW.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NCB.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:5656 -
C:\windows\SysWOW64\NCB.exeC:\windows\system32\NCB.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NIT.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\windows\NIT.exeC:\windows\NIT.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ITJ.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:928 -
C:\windows\ITJ.exeC:\windows\ITJ.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RTLAB.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:6056 -
C:\windows\SysWOW64\RTLAB.exeC:\windows\system32\RTLAB.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KWPDHA.exe.bat" "38⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5208 -
C:\windows\SysWOW64\KWPDHA.exeC:\windows\system32\KWPDHA.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WEWDTS.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\windows\system\WEWDTS.exeC:\windows\system\WEWDTS.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OHZ.exe.bat" "42⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\windows\system\OHZ.exeC:\windows\system\OHZ.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SXGHL.exe.bat" "44⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\windows\SXGHL.exeC:\windows\SXGHL.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EFNPXTO.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:5552 -
C:\windows\system\EFNPXTO.exeC:\windows\system\EFNPXTO.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CBMQC.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\windows\SysWOW64\CBMQC.exeC:\windows\system32\CBMQC.exe49⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DEQMHMF.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\windows\DEQMHMF.exeC:\windows\DEQMHMF.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SZHYS.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\windows\SysWOW64\SZHYS.exeC:\windows\system32\SZHYS.exe53⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LULU.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\windows\LULU.exeC:\windows\LULU.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AKMTM.exe.bat" "56⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5184 -
C:\windows\system\AKMTM.exeC:\windows\system\AKMTM.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZIXO.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\windows\SysWOW64\ZIXO.exeC:\windows\system32\ZIXO.exe59⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZLB.exe.bat" "60⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\windows\system\ZLB.exeC:\windows\system\ZLB.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QVMINTJ.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\windows\SysWOW64\QVMINTJ.exeC:\windows\system32\QVMINTJ.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RYQD.exe.bat" "64⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5356 -
C:\windows\RYQD.exeC:\windows\RYQD.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JUTHGZU.exe.bat" "66⤵
- Executes a command shell one-liner
PID:3380 -
C:\windows\SysWOW64\JUTHGZU.exeC:\windows\system32\JUTHGZU.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZPDLR.exe.bat" "68⤵PID:5540
-
C:\windows\ZPDLR.exeC:\windows\ZPDLR.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DABHRE.exe.bat" "70⤵PID:2160
-
C:\windows\system\DABHRE.exeC:\windows\system\DABHRE.exe71⤵
- Executes dropped EXE
PID:2940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PIIHDX.exe.bat" "72⤵PID:1908
-
C:\windows\SysWOW64\PIIHDX.exeC:\windows\system32\PIIHDX.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TYO.exe.bat" "74⤵
- Executes a command shell one-liner
PID:5964 -
C:\windows\system\TYO.exeC:\windows\system\TYO.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WGDPC.exe.bat" "76⤵
- Executes a command shell one-liner
PID:3336 -
C:\windows\WGDPC.exeC:\windows\WGDPC.exe77⤵
- Executes dropped EXE
PID:4848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GDJJJ.exe.bat" "78⤵PID:3092
-
C:\windows\system\GDJJJ.exeC:\windows\system\GDJJJ.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BRNSTQB.exe.bat" "80⤵
- System Location Discovery: System Language Discovery
PID:2468 -
C:\windows\system\BRNSTQB.exeC:\windows\system\BRNSTQB.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1336 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZMNTYTQ.exe.bat" "82⤵PID:3296
-
C:\windows\SysWOW64\ZMNTYTQ.exeC:\windows\system32\ZMNTYTQ.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UXVSE.exe.bat" "84⤵
- System Location Discovery: System Language Discovery
PID:1448 -
C:\windows\SysWOW64\UXVSE.exeC:\windows\system32\UXVSE.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KNWJ.exe.bat" "86⤵PID:2180
-
C:\windows\KNWJ.exeC:\windows\KNWJ.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VFLU.exe.bat" "88⤵
- System Location Discovery: System Language Discovery
PID:2872 -
C:\windows\SysWOW64\VFLU.exeC:\windows\system32\VFLU.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WIPYII.exe.bat" "90⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4828 -
C:\windows\SysWOW64\WIPYII.exeC:\windows\system32\WIPYII.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JLYWWL.exe.bat" "92⤵PID:2064
-
C:\windows\system\JLYWWL.exeC:\windows\system\JLYWWL.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EHC.exe.bat" "94⤵PID:5620
-
C:\windows\SysWOW64\EHC.exeC:\windows\system32\EHC.exe95⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YUHP.exe.bat" "96⤵
- Executes a command shell one-liner
PID:992 -
C:\windows\YUHP.exeC:\windows\YUHP.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4136 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OKIHPG.exe.bat" "98⤵PID:4964
-
C:\windows\system\OKIHPG.exeC:\windows\system\OKIHPG.exe99⤵
- Executes dropped EXE
PID:2384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KCSRTCP.exe.bat" "100⤵
- System Location Discovery: System Language Discovery
PID:4116 -
C:\windows\KCSRTCP.exeC:\windows\KCSRTCP.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6020 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UAYD.exe.bat" "102⤵PID:3752
-
C:\windows\system\UAYD.exeC:\windows\system\UAYD.exe103⤵
- Executes dropped EXE
PID:2304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HLOC.exe.bat" "104⤵PID:2544
-
C:\windows\HLOC.exeC:\windows\HLOC.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZTIHAS.exe.bat" "106⤵PID:1884
-
C:\windows\ZTIHAS.exeC:\windows\ZTIHAS.exe107⤵
- Executes dropped EXE
PID:6140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DBX.exe.bat" "108⤵
- Executes a command shell one-liner
PID:2032 -
C:\windows\system\DBX.exeC:\windows\system\DBX.exe109⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VEBLS.exe.bat" "110⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4348 -
C:\windows\SysWOW64\VEBLS.exeC:\windows\system32\VEBLS.exe111⤵
- Executes dropped EXE
PID:5008 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NFD.exe.bat" "112⤵PID:1504
-
C:\windows\system\NFD.exeC:\windows\system\NFD.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5220 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PCIKLO.exe.bat" "114⤵PID:5884
-
C:\windows\SysWOW64\PCIKLO.exeC:\windows\system32\PCIKLO.exe115⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BTP.exe.bat" "116⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3300 -
C:\windows\system\BTP.exeC:\windows\system\BTP.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MLE.exe.bat" "118⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1260 -
C:\windows\system\MLE.exeC:\windows\system\MLE.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SGDELD.exe.bat" "120⤵
- System Location Discovery: System Language Discovery
PID:3364 -
C:\windows\system\SGDELD.exeC:\windows\system\SGDELD.exe121⤵
- Executes dropped EXE
PID:6044
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-