Analysis
- max time kernel
84s - max time network
134s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/07/2026, 15:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-30_0757602992649f5088cde8d3397f0298_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-07-30_0757602992649f5088cde8d3397f0298_elex_emotet_stop.exe
- Size 208KB
- Sample260730-tel97abh85
- SHA256 04f8028b5f217268611c61176bc8de901dad84a2b62efd4ebb700aa561e9e440
- MD5 0757602992649f5088cde8d3397f0298
- SHA1 e0d9b69643d9fcfc3018190ac2a0cc353d2f67ae
- SHA512 ebca02819dee37f394603eb0fb6fd6b86192b0ff17c803e143873f08fa3bd22cb5283acc660ce3357788ab8660ae11ee6e3fb1d31f0ca195e4ae20bf29503dc1
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbclcdL+LOf+4NLthEjQT6E:MlZtbLWIgd1LZ9oECZbclc5+LOGQEj6
- TLSH T1E5247D2235D2C073E4B7023188F6C7787BB6BD919B36928B77C03B4D6E715A68A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1872 DMM.exe 1060 XSSEDGK.exe 5768 TQAQF.exe 5720 KYGNRJ.exe 3412 JJRDA.exe 2632 LHXYPFU.exe 4652 LKNUE.exe 1364 ZPN.exe 2992 HVZ.exe 5112 ANP.exe 4864 GJS.exe 3568 NBQYYF.exe 2852 MMTOG.exe 2004 BCGGO.exe 3440 XAG.exe 1404 AQN.exe 3356 ZBXHL.exe 3768 DREP.exe 2532 TWV.exe 5488 BMWO.exe 2732 BPI.exe 3588 OAQIRJ.exe 4620 LTAKV.exe 6000 QTCN.exe 5480 DEKL.exe 2600 WXAW.exe 5124 KUA.exe 5080 SIMPRXI.exe 3384 FTVNF.exe 5164 VBWF.exe 5864 ILMDAGO.exe 2528 BZLBXIK.exe 4496 AXEESN.exe 4136 ZIHUB.exe 1600 BFNPIBP.exe 5060 ZQYXRP.exe 5384 DYE.exe 1256 TOFWCVW.exe 2380 NJKN.exe 856 GCAY.exe 4536 WSBQC.exe 4944 OVET.exe 3176 TTP.exe 4504 VQCVNLU.exe 2836 UJFLWR.exe 6076 UEJ.exe 5452 CUKGIC.exe 5404 ASDJV.exe 4676 WQD.exe 1952 AGKVJL.exe 1032 SBNZW.exe 1360 CZBTEKF.exe 3616 KMGAPIA.exe 1368 JXRQXW.exe 5068 CAU.exe 1556 GIBTPEM.exe 5320 BTJKD.exe 3132 FWI.exe 5704 URZJON.exe 4356 YHG.exe 1400 VZHUMJP.exe 5400 VCLPRZ.exe 5332 HVBA.exe 4372 NQAJGDW.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\GCAY.exe NJKN.exe File created C:\windows\SysWOW64\ELQR.exe UNCEY.exe File created C:\windows\SysWOW64\UFMYDI.exe.bat QPFQ.exe File opened for modification C:\windows\SysWOW64\DIDEBOK.exe QKVSRD.exe File created C:\windows\SysWOW64\MJUP.exe.bat TGQMSRU.exe File opened for modification C:\windows\SysWOW64\DREP.exe ZBXHL.exe File created C:\windows\SysWOW64\DEKL.exe QTCN.exe File created C:\windows\SysWOW64\SIMPRXI.exe KUA.exe File created C:\windows\SysWOW64\FTVNF.exe SIMPRXI.exe File created C:\windows\SysWOW64\FTVNF.exe.bat SIMPRXI.exe File opened for modification C:\windows\SysWOW64\VBWF.exe FTVNF.exe File created C:\windows\SysWOW64\CUKGIC.exe UEJ.exe File opened for modification C:\windows\SysWOW64\UFMYDI.exe QPFQ.exe File opened for modification C:\windows\SysWOW64\HVBA.exe VCLPRZ.exe File created C:\windows\SysWOW64\ANP.exe.bat HVZ.exe File created C:\windows\SysWOW64\KIZM.exe ALUA.exe File created C:\windows\SysWOW64\QOJ.exe.bat IIW.exe File opened for modification C:\windows\SysWOW64\QKVSRD.exe EKN.exe File created C:\windows\SysWOW64\OVET.exe WSBQC.exe File created C:\windows\SysWOW64\CAU.exe JXRQXW.exe File opened for modification C:\windows\SysWOW64\CAU.exe JXRQXW.exe File opened for modification C:\windows\SysWOW64\FTVNF.exe SIMPRXI.exe File opened for modification C:\windows\SysWOW64\OVET.exe WSBQC.exe File opened for modification C:\windows\SysWOW64\YHG.exe URZJON.exe File created C:\windows\SysWOW64\YGVAYW.exe ELQR.exe File created C:\windows\SysWOW64\QPFQ.exe QUBUMAO.exe File created C:\windows\SysWOW64\ALCZTEF.exe NNCO.exe File opened for modification C:\windows\SysWOW64\ALCZTEF.exe NNCO.exe File created C:\windows\SysWOW64\TWV.exe.bat DREP.exe File opened for modification C:\windows\SysWOW64\SIMPRXI.exe KUA.exe File created C:\windows\SysWOW64\QPFQ.exe.bat QUBUMAO.exe File created C:\windows\SysWOW64\KIZM.exe.bat ALUA.exe File created C:\windows\SysWOW64\JTK.exe KIZM.exe File created C:\windows\SysWOW64\QKVSRD.exe.bat EKN.exe File opened for modification C:\windows\SysWOW64\TWV.exe DREP.exe File created C:\windows\SysWOW64\GCAY.exe.bat NJKN.exe File created C:\windows\SysWOW64\HVBA.exe.bat VCLPRZ.exe File created C:\windows\SysWOW64\HEURIY.exe.bat MJPI.exe File created C:\windows\SysWOW64\QOJ.exe IIW.exe File created C:\windows\SysWOW64\DREP.exe ZBXHL.exe File created C:\windows\SysWOW64\VBWF.exe FTVNF.exe File created C:\windows\SysWOW64\TTP.exe.bat OVET.exe File opened for modification C:\windows\SysWOW64\CUKGIC.exe UEJ.exe File opened for modification C:\windows\SysWOW64\YGVAYW.exe ELQR.exe File created C:\windows\SysWOW64\YGVAYW.exe.bat ELQR.exe File created C:\windows\SysWOW64\HVZ.exe ZPN.exe File created C:\windows\SysWOW64\DREP.exe.bat ZBXHL.exe File opened for modification C:\windows\SysWOW64\DEKL.exe QTCN.exe File opened for modification C:\windows\SysWOW64\GCAY.exe NJKN.exe File created C:\windows\SysWOW64\SBNZW.exe AGKVJL.exe File opened for modification C:\windows\SysWOW64\ELQR.exe UNCEY.exe File created C:\windows\SysWOW64\UFMYDI.exe QPFQ.exe File created C:\windows\SysWOW64\JTK.exe.bat KIZM.exe File created C:\windows\SysWOW64\VBWF.exe.bat FTVNF.exe File created C:\windows\SysWOW64\SIMPRXI.exe.bat KUA.exe File created C:\windows\SysWOW64\TTP.exe OVET.exe File opened for modification C:\windows\SysWOW64\SBNZW.exe AGKVJL.exe File opened for modification C:\windows\SysWOW64\JTK.exe KIZM.exe File opened for modification C:\windows\SysWOW64\NNCO.exe UNMD.exe File created C:\windows\SysWOW64\ALCZTEF.exe.bat NNCO.exe File created C:\windows\SysWOW64\YHG.exe.bat URZJON.exe File created C:\windows\SysWOW64\ANP.exe HVZ.exe File opened for modification C:\windows\SysWOW64\ANP.exe HVZ.exe File created C:\windows\SysWOW64\GJS.exe.bat ANP.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\WXAW.exe.bat DEKL.exe File created C:\windows\KUA.exe WXAW.exe File opened for modification C:\windows\UNCEY.exe QFWWUWW.exe File created C:\windows\system\XRY.exe YGVAYW.exe File created C:\windows\JGQ.exe QOJ.exe File opened for modification C:\windows\KUA.exe WXAW.exe File created C:\windows\WQD.exe.bat ASDJV.exe File opened for modification C:\windows\system\EXLDT.exe WRHXIG.exe File created C:\windows\system\LKNUE.exe LHXYPFU.exe File created C:\windows\NBQYYF.exe.bat GJS.exe File created C:\windows\BCGGO.exe.bat MMTOG.exe File created C:\windows\WQD.exe ASDJV.exe File created C:\windows\system\GIBTPEM.exe.bat CAU.exe File opened for modification C:\windows\AFTL.exe UFMYDI.exe File created C:\windows\BKHK.exe GCYVI.exe File created C:\windows\system\XSSEDGK.exe DMM.exe File created C:\windows\system\ZBXHL.exe AQN.exe File created C:\windows\BMWO.exe TWV.exe File created C:\windows\BZLBXIK.exe ILMDAGO.exe File created C:\windows\VQCVNLU.exe TTP.exe File created C:\windows\system\EXLDT.exe WRHXIG.exe File created C:\windows\system\TGQMSRU.exe.bat ELHH.exe File opened for modification C:\windows\system\KYGNRJ.exe TQAQF.exe File created C:\windows\system\AXEESN.exe.bat BZLBXIK.exe File created C:\windows\system\ASDJV.exe.bat CUKGIC.exe File created C:\windows\system\JJRDA.exe.bat KYGNRJ.exe File opened for modification C:\windows\ZPN.exe LKNUE.exe File created C:\windows\KUA.exe.bat WXAW.exe File created C:\windows\VQCVNLU.exe.bat TTP.exe File created C:\windows\KMGAPIA.exe.bat CZBTEKF.exe File created C:\windows\AFTL.exe UFMYDI.exe File opened for modification C:\windows\system\GGNSZTN.exe ALCZTEF.exe File created C:\windows\BZVHECS.exe.bat MJUP.exe File created C:\windows\system\QTCN.exe LTAKV.exe File opened for modification C:\windows\system\ASDJV.exe CUKGIC.exe File created C:\windows\system\JXRQXW.exe.bat KMGAPIA.exe File opened for modification C:\windows\system\BTJKD.exe GIBTPEM.exe File created C:\windows\system\ILMDAGO.exe.bat VBWF.exe File opened for modification C:\windows\system\ZQYXRP.exe BFNPIBP.exe File created C:\windows\system\RGGJ.exe NQAJGDW.exe File created C:\windows\UNCEY.exe QFWWUWW.exe File opened for modification C:\windows\ALUA.exe AFTL.exe File created C:\windows\system\TGQMSRU.exe ELHH.exe File created C:\windows\system\XAG.exe BCGGO.exe File opened for modification C:\windows\TOFWCVW.exe DYE.exe File created C:\windows\CZBTEKF.exe.bat SBNZW.exe File created C:\windows\FWI.exe BTJKD.exe File created C:\windows\system\RGGJ.exe.bat NQAJGDW.exe File created C:\windows\QETNOB.exe.bat GGNSZTN.exe File opened for modification C:\windows\system\XAG.exe BCGGO.exe File created C:\windows\system\XAG.exe.bat BCGGO.exe File created C:\windows\system\LTAKV.exe OAQIRJ.exe File created C:\windows\system\ZIHUB.exe.bat AXEESN.exe File created C:\windows\MJPI.exe.bat RGGJ.exe File created C:\windows\QFWWUWW.exe HEURIY.exe File opened for modification C:\windows\system\GCYVI.exe LOB.exe File created C:\windows\BKHK.exe.bat GCYVI.exe File created C:\windows\system\BPI.exe BMWO.exe File created C:\windows\NJKN.exe TOFWCVW.exe File created C:\windows\system\WRHXIG.exe JGQ.exe File created C:\windows\system\GGNSZTN.exe.bat ALCZTEF.exe File opened for modification C:\windows\system\LKNUE.exe LHXYPFU.exe File created C:\windows\system\DYE.exe.bat ZQYXRP.exe File created C:\windows\CZBTEKF.exe SBNZW.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2672 cmd.exe 5532 cmd.exe 1236 cmd.exe 2820 cmd.exe 3912 cmd.exe 812 cmd.exe 2492 cmd.exe 4820 cmd.exe 1584 cmd.exe 2304 cmd.exe 3272 cmd.exe 1876 cmd.exe 4460 cmd.exe 3552 cmd.exe 960 cmd.exe 3324 cmd.exe 4348 cmd.exe 4996 cmd.exe 2956 cmd.exe 4512 cmd.exe 1348 cmd.exe 4900 cmd.exe 5556 cmd.exe 5896 cmd.exe 4328 cmd.exe 3760 cmd.exe 2984 cmd.exe 2624 cmd.exe 5808 cmd.exe 2816 cmd.exe 5000 cmd.exe 5136 cmd.exe 4804 cmd.exe 3184 cmd.exe 952 cmd.exe 1232 cmd.exe 5104 cmd.exe 2384 cmd.exe 4388 cmd.exe 4264 cmd.exe 2232 cmd.exe 4128 cmd.exe 1424 cmd.exe 5596 cmd.exe 4588 cmd.exe 3268 cmd.exe 5932 cmd.exe 2452 cmd.exe 1948 cmd.exe 1512 cmd.exe 1136 cmd.exe 3592 cmd.exe 256 cmd.exe 5832 cmd.exe 5364 cmd.exe 3572 cmd.exe 4484 cmd.exe 5352 cmd.exe 5264 cmd.exe 572 cmd.exe 5460 cmd.exe 2888 cmd.exe 6036 cmd.exe 3540 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 3728 3956 WerFault.exe 87 756 1872 WerFault.exe 93 1712 1060 WerFault.exe 99 5060 5768 WerFault.exe 104 1404 5720 WerFault.exe 109 5020 3412 WerFault.exe 114 4428 2632 WerFault.exe 119 6056 4652 WerFault.exe 124 2888 1364 WerFault.exe 129 1840 2992 WerFault.exe 134 3172 5112 WerFault.exe 139 4136 4864 WerFault.exe 144 3472 3568 WerFault.exe 149 4332 2852 WerFault.exe 154 4756 2004 WerFault.exe 159 1896 3440 WerFault.exe 164 5684 1404 WerFault.exe 169 5556 3356 WerFault.exe 174 5704 3768 WerFault.exe 179 4196 2532 WerFault.exe 184 4896 5488 WerFault.exe 189 2008 2732 WerFault.exe 194 4788 3588 WerFault.exe 199 2932 4620 WerFault.exe 204 2880 6000 WerFault.exe 209 1696 5480 WerFault.exe 214 1140 2600 WerFault.exe 219 6064 5124 WerFault.exe 224 5556 5080 WerFault.exe 229 1044 3384 WerFault.exe 234 956 5164 WerFault.exe 239 5328 5864 WerFault.exe 244 4952 2528 WerFault.exe 249 2936 4496 WerFault.exe 254 4768 4136 WerFault.exe 260 2620 1600 WerFault.exe 265 4820 5060 WerFault.exe 270 1004 5384 WerFault.exe 275 1348 1256 WerFault.exe 280 1988 2380 WerFault.exe 285 3740 856 WerFault.exe 290 4204 4536 WerFault.exe 295 1444 4944 WerFault.exe 300 4592 3176 WerFault.exe 305 4700 4504 WerFault.exe 310 4260 2836 WerFault.exe 315 2432 6076 WerFault.exe 320 2476 5452 WerFault.exe 325 5640 5404 WerFault.exe 330 5704 4676 WerFault.exe 335 3720 1952 WerFault.exe 340 3572 1032 WerFault.exe 345 2560 1360 WerFault.exe 350 4960 3616 WerFault.exe 355 3608 1368 WerFault.exe 360 2788 5068 WerFault.exe 365 1004 1556 WerFault.exe 370 3776 5320 WerFault.exe 375 6008 3132 WerFault.exe 380 4984 5704 WerFault.exe 385 5328 4356 WerFault.exe 390 1320 1400 WerFault.exe 395 2168 5400 WerFault.exe 400 3608 5332 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KYGNRJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MMTOG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YHG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QFWWUWW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXLDT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TGQMSRU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TWV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UEJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TQAQF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LHXYPFU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZPN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VBWF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WSBQC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VCLPRZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UNMD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BFNPIBP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HEURIY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GCYVI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ALCZTEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DIDEBOK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DREP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SIMPRXI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ASDJV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KMGAPIA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language URZJON.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DYE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AFTL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ALUA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JXRQXW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RGGJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BKHK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UJFLWR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UNCEY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EKN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XAG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AQN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AXEESN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QOJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3956 2026-07-30_0757602992649f5088cde8d3397f0298_elex_emotet_stop.exe 3956 2026-07-30_0757602992649f5088cde8d3397f0298_elex_emotet_stop.exe 1872 DMM.exe 1872 DMM.exe 1060 XSSEDGK.exe 1060 XSSEDGK.exe 5768 TQAQF.exe 5768 TQAQF.exe 5720 KYGNRJ.exe 5720 KYGNRJ.exe 3412 JJRDA.exe 3412 JJRDA.exe 2632 LHXYPFU.exe 2632 LHXYPFU.exe 4652 LKNUE.exe 4652 LKNUE.exe 1364 ZPN.exe 1364 ZPN.exe 2992 HVZ.exe 2992 HVZ.exe 5112 ANP.exe 5112 ANP.exe 4864 GJS.exe 4864 GJS.exe 3568 NBQYYF.exe 3568 NBQYYF.exe 2852 MMTOG.exe 2852 MMTOG.exe 2004 BCGGO.exe 2004 BCGGO.exe 3440 XAG.exe 3440 XAG.exe 1404 AQN.exe 1404 AQN.exe 3356 ZBXHL.exe 3356 ZBXHL.exe 3768 DREP.exe 3768 DREP.exe 2532 TWV.exe 2532 TWV.exe 5488 BMWO.exe 5488 BMWO.exe 2732 BPI.exe 2732 BPI.exe 3588 OAQIRJ.exe 3588 OAQIRJ.exe 4620 LTAKV.exe 4620 LTAKV.exe 6000 QTCN.exe 6000 QTCN.exe 5480 DEKL.exe 5480 DEKL.exe 2600 WXAW.exe 2600 WXAW.exe 5124 KUA.exe 5124 KUA.exe 5080 SIMPRXI.exe 5080 SIMPRXI.exe 3384 FTVNF.exe 3384 FTVNF.exe 5164 VBWF.exe 5164 VBWF.exe 5864 ILMDAGO.exe 5864 ILMDAGO.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 3956 2026-07-30_0757602992649f5088cde8d3397f0298_elex_emotet_stop.exe 3956 2026-07-30_0757602992649f5088cde8d3397f0298_elex_emotet_stop.exe 1872 DMM.exe 1872 DMM.exe 1060 XSSEDGK.exe 1060 XSSEDGK.exe 5768 TQAQF.exe 5768 TQAQF.exe 5720 KYGNRJ.exe 5720 KYGNRJ.exe 3412 JJRDA.exe 3412 JJRDA.exe 2632 LHXYPFU.exe 2632 LHXYPFU.exe 4652 LKNUE.exe 4652 LKNUE.exe 1364 ZPN.exe 1364 ZPN.exe 2992 HVZ.exe 2992 HVZ.exe 5112 ANP.exe 5112 ANP.exe 4864 GJS.exe 4864 GJS.exe 3568 NBQYYF.exe 3568 NBQYYF.exe 2852 MMTOG.exe 2852 MMTOG.exe 2004 BCGGO.exe 2004 BCGGO.exe 3440 XAG.exe 3440 XAG.exe 1404 AQN.exe 1404 AQN.exe 3356 ZBXHL.exe 3356 ZBXHL.exe 3768 DREP.exe 3768 DREP.exe 2532 TWV.exe 2532 TWV.exe 5488 BMWO.exe 5488 BMWO.exe 2732 BPI.exe 2732 BPI.exe 3588 OAQIRJ.exe 3588 OAQIRJ.exe 4620 LTAKV.exe 4620 LTAKV.exe 6000 QTCN.exe 6000 QTCN.exe 5480 DEKL.exe 5480 DEKL.exe 2600 WXAW.exe 2600 WXAW.exe 5124 KUA.exe 5124 KUA.exe 5080 SIMPRXI.exe 5080 SIMPRXI.exe 3384 FTVNF.exe 3384 FTVNF.exe 5164 VBWF.exe 5164 VBWF.exe 5864 ILMDAGO.exe 5864 ILMDAGO.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3956 wrote to memory of 2816 3956 2026-07-30_0757602992649f5088cde8d3397f0298_elex_emotet_stop.exe 89 PID 2816 wrote to memory of 1872 2816 cmd.exe 93 PID 1872 wrote to memory of 1484 1872 DMM.exe 95 PID 1484 wrote to memory of 1060 1484 cmd.exe 99 PID 1060 wrote to memory of 2232 1060 XSSEDGK.exe 100 PID 2232 wrote to memory of 5768 2232 cmd.exe 104 PID 5768 wrote to memory of 5724 5768 TQAQF.exe 105 PID 5724 wrote to memory of 5720 5724 cmd.exe 109 PID 5720 wrote to memory of 3816 5720 KYGNRJ.exe 110 PID 3816 wrote to memory of 3412 3816 cmd.exe 114 PID 3412 wrote to memory of 6028 3412 JJRDA.exe 115 PID 6028 wrote to memory of 2632 6028 cmd.exe 119 PID 2632 wrote to memory of 1232 2632 LHXYPFU.exe 120 PID 1232 wrote to memory of 4652 1232 cmd.exe 124 PID 4652 wrote to memory of 1088 4652 LKNUE.exe 125 PID 1088 wrote to memory of 1364 1088 cmd.exe 129 PID 1364 wrote to memory of 2728 1364 ZPN.exe 130 PID 2728 wrote to memory of 2992 2728 cmd.exe 134 PID 2992 wrote to memory of 3552 2992 HVZ.exe 135 PID 3552 wrote to memory of 5112 3552 cmd.exe 139 PID 5112 wrote to memory of 2452 5112 ANP.exe 140 PID 2452 wrote to memory of 4864 2452 cmd.exe 144 PID 4864 wrote to memory of 3084 4864 GJS.exe 145 PID 3084 wrote to memory of 3568 3084 cmd.exe 149 PID 3568 wrote to memory of 5000 3568 NBQYYF.exe 150 PID 5000 wrote to memory of 2852 5000 cmd.exe 154 PID 2852 wrote to memory of 3136 2852 MMTOG.exe 155 PID 3136 wrote to memory of 2004 3136 cmd.exe 159 PID 2004 wrote to memory of 5948 2004 BCGGO.exe 160 PID 5948 wrote to memory of 3440 5948 cmd.exe 164 PID 3440 wrote to memory of 6012 3440 XAG.exe 165 PID 6012 wrote to memory of 1404 6012 cmd.exe 169 PID 1404 wrote to memory of 6120 1404 AQN.exe 170 PID 6120 wrote to memory of 3356 6120 cmd.exe 174 PID 3356 wrote to memory of 5836 3356 ZBXHL.exe 175 PID 5836 wrote to memory of 3768 5836 cmd.exe 179 PID 3768 wrote to memory of 960 3768 DREP.exe 180 PID 960 wrote to memory of 2532 960 cmd.exe 184 PID 2532 wrote to memory of 2888 2532 TWV.exe 185 PID 2888 wrote to memory of 5488 2888 cmd.exe 189 PID 5488 wrote to memory of 4680 5488 BMWO.exe 190 PID 4680 wrote to memory of 2732 4680 cmd.exe 194 PID 2732 wrote to memory of 6036 2732 BPI.exe 195 PID 6036 wrote to memory of 3588 6036 cmd.exe 199 PID 3588 wrote to memory of 4128 3588 OAQIRJ.exe 200 PID 4128 wrote to memory of 4620 4128 cmd.exe 204 PID 4620 wrote to memory of 3328 4620 LTAKV.exe 205 PID 3328 wrote to memory of 6000 3328 cmd.exe 209 PID 6000 wrote to memory of 4072 6000 QTCN.exe 210 PID 4072 wrote to memory of 5480 4072 cmd.exe 214 PID 5480 wrote to memory of 2804 5480 DEKL.exe 215 PID 2804 wrote to memory of 2600 2804 cmd.exe 219 PID 2600 wrote to memory of 5468 2600 WXAW.exe 220 PID 5468 wrote to memory of 5124 5468 cmd.exe 224 PID 5124 wrote to memory of 2672 5124 KUA.exe 225 PID 2672 wrote to memory of 5080 2672 cmd.exe 229 PID 5080 wrote to memory of 5532 5080 SIMPRXI.exe 230 PID 5532 wrote to memory of 3384 5532 cmd.exe 234 PID 3384 wrote to memory of 3324 3384 FTVNF.exe 235 PID 3324 wrote to memory of 5164 3324 cmd.exe 239 PID 5164 wrote to memory of 1904 5164 VBWF.exe 240 PID 1904 wrote to memory of 5864 1904 cmd.exe 244 PID 5864 wrote to memory of 3948 5864 ILMDAGO.exe 245 PID 3948 wrote to memory of 2528 3948 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_0757602992649f5088cde8d3397f0298_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-30_0757602992649f5088cde8d3397f0298_elex_emotet_stop.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DMM.exe.bat" "2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\windows\system\DMM.exeC:\windows\system\DMM.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XSSEDGK.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\windows\system\XSSEDGK.exeC:\windows\system\XSSEDGK.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TQAQF.exe.bat" "6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\windows\TQAQF.exeC:\windows\TQAQF.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KYGNRJ.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:5724 -
C:\windows\system\KYGNRJ.exeC:\windows\system\KYGNRJ.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JJRDA.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\windows\system\JJRDA.exeC:\windows\system\JJRDA.exe11⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LHXYPFU.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:6028 -
C:\windows\LHXYPFU.exeC:\windows\LHXYPFU.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LKNUE.exe.bat" "14⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\windows\system\LKNUE.exeC:\windows\system\LKNUE.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZPN.exe.bat" "16⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\windows\ZPN.exeC:\windows\ZPN.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HVZ.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\windows\SysWOW64\HVZ.exeC:\windows\system32\HVZ.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ANP.exe.bat" "20⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\windows\SysWOW64\ANP.exeC:\windows\system32\ANP.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GJS.exe.bat" "22⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\windows\SysWOW64\GJS.exeC:\windows\system32\GJS.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NBQYYF.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\windows\NBQYYF.exeC:\windows\NBQYYF.exe25⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MMTOG.exe.bat" "26⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\windows\MMTOG.exeC:\windows\MMTOG.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BCGGO.exe.bat" "28⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\windows\BCGGO.exeC:\windows\BCGGO.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XAG.exe.bat" "30⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5948 -
C:\windows\system\XAG.exeC:\windows\system\XAG.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AQN.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:6012 -
C:\windows\system\AQN.exeC:\windows\system\AQN.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZBXHL.exe.bat" "34⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6120 -
C:\windows\system\ZBXHL.exeC:\windows\system\ZBXHL.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DREP.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:5836 -
C:\windows\SysWOW64\DREP.exeC:\windows\system32\DREP.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TWV.exe.bat" "38⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:960 -
C:\windows\SysWOW64\TWV.exeC:\windows\system32\TWV.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BMWO.exe.bat" "40⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\windows\BMWO.exeC:\windows\BMWO.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BPI.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\windows\system\BPI.exeC:\windows\system\BPI.exe43⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OAQIRJ.exe.bat" "44⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6036 -
C:\windows\OAQIRJ.exeC:\windows\OAQIRJ.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3588 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LTAKV.exe.bat" "46⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\windows\system\LTAKV.exeC:\windows\system\LTAKV.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QTCN.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\windows\system\QTCN.exeC:\windows\system\QTCN.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DEKL.exe.bat" "50⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\windows\SysWOW64\DEKL.exeC:\windows\system32\DEKL.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WXAW.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\windows\system\WXAW.exeC:\windows\system\WXAW.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KUA.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:5468 -
C:\windows\KUA.exeC:\windows\KUA.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SIMPRXI.exe.bat" "56⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\windows\SysWOW64\SIMPRXI.exeC:\windows\system32\SIMPRXI.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FTVNF.exe.bat" "58⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5532 -
C:\windows\SysWOW64\FTVNF.exeC:\windows\system32\FTVNF.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VBWF.exe.bat" "60⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\windows\SysWOW64\VBWF.exeC:\windows\system32\VBWF.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5164 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ILMDAGO.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\windows\system\ILMDAGO.exeC:\windows\system\ILMDAGO.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BZLBXIK.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\windows\BZLBXIK.exeC:\windows\BZLBXIK.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2528 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AXEESN.exe.bat" "66⤵
- Executes a command shell one-liner
PID:4900 -
C:\windows\system\AXEESN.exeC:\windows\system\AXEESN.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZIHUB.exe.bat" "68⤵PID:936
-
C:\windows\system\ZIHUB.exeC:\windows\system\ZIHUB.exe69⤵
- Executes dropped EXE
PID:4136 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BFNPIBP.exe.bat" "70⤵
- Executes a command shell one-liner
PID:1236 -
C:\windows\SysWOW64\BFNPIBP.exeC:\windows\system32\BFNPIBP.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZQYXRP.exe.bat" "72⤵PID:2416
-
C:\windows\system\ZQYXRP.exeC:\windows\system\ZQYXRP.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DYE.exe.bat" "74⤵PID:3520
-
C:\windows\system\DYE.exeC:\windows\system\DYE.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TOFWCVW.exe.bat" "76⤵
- Executes a command shell one-liner
PID:5596 -
C:\windows\TOFWCVW.exeC:\windows\TOFWCVW.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NJKN.exe.bat" "78⤵
- System Location Discovery: System Language Discovery
PID:4760 -
C:\windows\NJKN.exeC:\windows\NJKN.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GCAY.exe.bat" "80⤵
- Executes a command shell one-liner
PID:5556 -
C:\windows\SysWOW64\GCAY.exeC:\windows\system32\GCAY.exe81⤵
- Executes dropped EXE
PID:856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WSBQC.exe.bat" "82⤵PID:2868
-
C:\windows\WSBQC.exeC:\windows\WSBQC.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OVET.exe.bat" "84⤵
- System Location Discovery: System Language Discovery
PID:4352 -
C:\windows\SysWOW64\OVET.exeC:\windows\system32\OVET.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TTP.exe.bat" "86⤵PID:5084
-
C:\windows\SysWOW64\TTP.exeC:\windows\system32\TTP.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3176 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VQCVNLU.exe.bat" "88⤵
- Executes a command shell one-liner
PID:1948 -
C:\windows\VQCVNLU.exeC:\windows\VQCVNLU.exe89⤵
- Executes dropped EXE
PID:4504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UJFLWR.exe.bat" "90⤵
- System Location Discovery: System Language Discovery
PID:2072 -
C:\windows\system\UJFLWR.exeC:\windows\system\UJFLWR.exe91⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UEJ.exe.bat" "92⤵PID:5928
-
C:\windows\system\UEJ.exeC:\windows\system\UEJ.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:6076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CUKGIC.exe.bat" "94⤵PID:3304
-
C:\windows\SysWOW64\CUKGIC.exeC:\windows\system32\CUKGIC.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ASDJV.exe.bat" "96⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4588 -
C:\windows\system\ASDJV.exeC:\windows\system\ASDJV.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WQD.exe.bat" "98⤵
- Executes a command shell one-liner
PID:4348 -
C:\windows\WQD.exeC:\windows\WQD.exe99⤵
- Executes dropped EXE
PID:4676 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AGKVJL.exe.bat" "100⤵
- System Location Discovery: System Language Discovery
PID:4476 -
C:\windows\AGKVJL.exeC:\windows\AGKVJL.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SBNZW.exe.bat" "102⤵PID:3016
-
C:\windows\SysWOW64\SBNZW.exeC:\windows\system32\SBNZW.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1032 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CZBTEKF.exe.bat" "104⤵
- Executes a command shell one-liner
PID:1512 -
C:\windows\CZBTEKF.exeC:\windows\CZBTEKF.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KMGAPIA.exe.bat" "106⤵
- Executes a command shell one-liner
PID:5136 -
C:\windows\KMGAPIA.exeC:\windows\KMGAPIA.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JXRQXW.exe.bat" "108⤵PID:200
-
C:\windows\system\JXRQXW.exeC:\windows\system\JXRQXW.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CAU.exe.bat" "110⤵
- Executes a command shell one-liner
PID:1136 -
C:\windows\SysWOW64\CAU.exeC:\windows\system32\CAU.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GIBTPEM.exe.bat" "112⤵PID:4400
-
C:\windows\system\GIBTPEM.exeC:\windows\system\GIBTPEM.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BTJKD.exe.bat" "114⤵
- Executes a command shell one-liner
PID:572 -
C:\windows\system\BTJKD.exeC:\windows\system\BTJKD.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FWI.exe.bat" "116⤵
- Executes a command shell one-liner
PID:4996 -
C:\windows\FWI.exeC:\windows\FWI.exe117⤵
- Executes dropped EXE
PID:3132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\URZJON.exe.bat" "118⤵PID:3476
-
C:\windows\system\URZJON.exeC:\windows\system\URZJON.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YHG.exe.bat" "120⤵PID:5144
-
C:\windows\SysWOW64\YHG.exeC:\windows\system32\YHG.exe121⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4356
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-