Analysis
- max time kernel
84s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
31/07/2026, 14:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-31_57f5e592a961c5a9f14794f601e6b2f4_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-07-31_57f5e592a961c5a9f14794f601e6b2f4_elex_emotet_stop.exe
- Size 208KB
- Sample260731-rtpbzshr2v
- SHA256 e0e28d50fb495b81e46a0cecc4c5a3ebb6b06fee223efc787f893bb1ff3ce3c4
- MD5 57f5e592a961c5a9f14794f601e6b2f4
- SHA1 0a33b10cffd608b1c50db4ddb4018eec744fd670
- SHA512 37038496f82f3c902a1d939a4a123ed41f4f04f5adf062ace9a47aaefa99089d6496a9d14b3f39a1425ee096c0e2cb8fe1ffa839f972b154d44ce96c3f177d19
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlkdL+LOfA4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFlk5+LOokEj1
- TLSH T15C247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5260 GZYB.exe 2808 BAOKZ.exe 2788 GFGZ.exe 4820 YAK.exe 5608 ZDOZI.exe 5092 SGSC.exe 1444 WOGCAS.exe 5804 YCL.exe 6092 RFPQQ.exe 1108 GVQ.exe 3040 UFZGDG.exe 2720 EDMASP.exe 972 TTNR.exe 5380 XBUZDV.exe 2284 UCWCPZ.exe 4432 SSPF.exe 4832 SFHLD.exe 2968 TATP.exe 4492 MBAAAID.exe 632 DLDQJO.exe 248 FZIZTOO.exe 1928 YCMDZD.exe 844 ZXX.exe 2176 VCIO.exe 5752 UVT.exe 3500 YDZEP.exe 3908 NTADWQT.exe 4676 TUIR.exe 2504 MXM.exe 2892 GKQWU.exe 4916 YKSJYG.exe 3048 QNW.exe 6016 UDDNQOS.exe 4996 QGLEE.exe 3144 ORWU.exe 1412 WHXTT.exe 1348 AMHIJW.exe 5184 KVJNNTV.exe 6132 FFAMB.exe 1864 DTZ.exe 2624 YEHMMK.exe 3208 HMJR.exe 3740 NEREG.exe 1992 PCXZ.exe 3968 QFAUBI.exe 3356 JIEYH.exe 3940 UBHJPN.exe 1700 GJOR.exe 3808 PRQWF.exe 3484 QUUA.exe 6096 XPDEV.exe 4884 OPF.exe 5480 DKXNSY.exe 2004 IVVJ.exe 3616 VYDHGBO.exe 2816 SWRZ.exe 1892 UUWLDR.exe 2400 AHVU.exe 5892 UALFRNC.exe 244 LIZCE.exe 5044 PYGKQWT.exe 5188 EOH.exe 1776 RRP.exe 3568 BZRFO.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\BUVBUQ.exe.bat BZRFO.exe File opened for modification C:\windows\SysWOW64\EIFA.exe MHD.exe File created C:\windows\SysWOW64\WLJ.exe.bat EIFA.exe File created C:\windows\SysWOW64\RFPQQ.exe.bat YCL.exe File created C:\windows\SysWOW64\NTADWQT.exe YDZEP.exe File created C:\windows\SysWOW64\MXM.exe.bat TUIR.exe File created C:\windows\SysWOW64\TYWT.exe NCWKDN.exe File created C:\windows\SysWOW64\YJGXA.exe.bat GJMKWTJ.exe File created C:\windows\SysWOW64\EIFA.exe MHD.exe File created C:\windows\SysWOW64\RFPQQ.exe YCL.exe File created C:\windows\SysWOW64\SFHLD.exe.bat SSPF.exe File opened for modification C:\windows\SysWOW64\TUIR.exe NTADWQT.exe File created C:\windows\SysWOW64\AMHIJW.exe WHXTT.exe File created C:\windows\SysWOW64\QUUA.exe PRQWF.exe File created C:\windows\SysWOW64\KVUNY.exe.bat GNN.exe File created C:\windows\SysWOW64\IJMESX.exe NYV.exe File created C:\windows\SysWOW64\MBAAAID.exe.bat TATP.exe File created C:\windows\SysWOW64\YCMDZD.exe.bat FZIZTOO.exe File created C:\windows\SysWOW64\ZXX.exe YCMDZD.exe File created C:\windows\SysWOW64\NTADWQT.exe.bat YDZEP.exe File created C:\windows\SysWOW64\HMJR.exe.bat YEHMMK.exe File created C:\windows\SysWOW64\MBAAAID.exe TATP.exe File opened for modification C:\windows\SysWOW64\MBAAAID.exe TATP.exe File created C:\windows\SysWOW64\FZIZTOO.exe DLDQJO.exe File created C:\windows\SysWOW64\TUIR.exe.bat NTADWQT.exe File created C:\windows\SysWOW64\KVJNNTV.exe.bat AMHIJW.exe File opened for modification C:\windows\SysWOW64\SFHLD.exe SSPF.exe File created C:\windows\SysWOW64\HMJR.exe YEHMMK.exe File created C:\windows\SysWOW64\VYDHGBO.exe.bat IVVJ.exe File created C:\windows\SysWOW64\SWRZ.exe VYDHGBO.exe File opened for modification C:\windows\SysWOW64\TYWT.exe NCWKDN.exe File created C:\windows\SysWOW64\VXC.exe.bat UCZAR.exe File created C:\windows\SysWOW64\ZXX.exe.bat YCMDZD.exe File opened for modification C:\windows\SysWOW64\QNW.exe YKSJYG.exe File created C:\windows\SysWOW64\QNW.exe.bat YKSJYG.exe File opened for modification C:\windows\SysWOW64\HMJR.exe YEHMMK.exe File created C:\windows\SysWOW64\VXC.exe UCZAR.exe File created C:\windows\SysWOW64\YAK.exe.bat GFGZ.exe File created C:\windows\SysWOW64\GVQ.exe RFPQQ.exe File created C:\windows\SysWOW64\SFHLD.exe SSPF.exe File opened for modification C:\windows\SysWOW64\NTADWQT.exe YDZEP.exe File opened for modification C:\windows\SysWOW64\YAK.exe GFGZ.exe File opened for modification C:\windows\SysWOW64\TTNR.exe EDMASP.exe File created C:\windows\SysWOW64\AMHIJW.exe.bat WHXTT.exe File opened for modification C:\windows\SysWOW64\KVJNNTV.exe AMHIJW.exe File created C:\windows\SysWOW64\DKXNSY.exe OPF.exe File opened for modification C:\windows\SysWOW64\PYGKQWT.exe LIZCE.exe File created C:\windows\SysWOW64\EIFA.exe.bat MHD.exe File created C:\windows\SysWOW64\YAK.exe GFGZ.exe File created C:\windows\SysWOW64\KVJNNTV.exe AMHIJW.exe File created C:\windows\SysWOW64\VYDHGBO.exe IVVJ.exe File created C:\windows\SysWOW64\AAO.exe ZXKQKM.exe File opened for modification C:\windows\SysWOW64\WLJ.exe EIFA.exe File opened for modification C:\windows\SysWOW64\GVQ.exe RFPQQ.exe File created C:\windows\SysWOW64\SSPF.exe.bat UCWCPZ.exe File created C:\windows\SysWOW64\YCMDZD.exe FZIZTOO.exe File opened for modification C:\windows\SysWOW64\AMHIJW.exe WHXTT.exe File opened for modification C:\windows\SysWOW64\NEREG.exe HMJR.exe File opened for modification C:\windows\SysWOW64\KVUNY.exe GNN.exe File opened for modification C:\windows\SysWOW64\YJGXA.exe GJMKWTJ.exe File created C:\windows\SysWOW64\IJMESX.exe.bat NYV.exe File created C:\windows\SysWOW64\SSPF.exe UCWCPZ.exe File created C:\windows\SysWOW64\TUIR.exe NTADWQT.exe File created C:\windows\SysWOW64\MXM.exe TUIR.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\UFZGDG.exe GVQ.exe File created C:\windows\XBUZDV.exe.bat TTNR.exe File created C:\windows\PRQWF.exe GJOR.exe File created C:\windows\UUWLDR.exe.bat SWRZ.exe File opened for modification C:\windows\ZOU.exe PGSAISD.exe File created C:\windows\system\RRYJZOG.exe ZOU.exe File opened for modification C:\windows\BMQ.exe IJMESX.exe File created C:\windows\system\GFGZ.exe.bat BAOKZ.exe File created C:\windows\UCWCPZ.exe XBUZDV.exe File created C:\windows\system\YKSJYG.exe.bat GKQWU.exe File created C:\windows\system\VKHUT.exe FZWELV.exe File created C:\windows\IEKQMGN.exe.bat NQFGK.exe File created C:\windows\system\GFGZ.exe BAOKZ.exe File opened for modification C:\windows\system\UBHJPN.exe JIEYH.exe File created C:\windows\system\EOH.exe.bat PYGKQWT.exe File created C:\windows\system\RRP.exe.bat EOH.exe File created C:\windows\ZXKQKM.exe.bat RRYJZOG.exe File created C:\windows\system\UVT.exe.bat VCIO.exe File created C:\windows\system\GKQWU.exe MXM.exe File created C:\windows\JIEYH.exe.bat QFAUBI.exe File created C:\windows\FZWELV.exe.bat YKLBQQH.exe File created C:\windows\ZOU.exe PGSAISD.exe File created C:\windows\TVA.exe.bat NIBOVMU.exe File opened for modification C:\windows\system\DGUNXGG.exe LGSATJ.exe File created C:\windows\system\LIZCE.exe UALFRNC.exe File opened for modification C:\windows\system\GFGZ.exe BAOKZ.exe File opened for modification C:\windows\system\TATP.exe SFHLD.exe File opened for modification C:\windows\system\UVT.exe VCIO.exe File created C:\windows\YDZEP.exe UVT.exe File created C:\windows\system\YKSJYG.exe GKQWU.exe File opened for modification C:\windows\QFAUBI.exe PCXZ.exe File created C:\windows\JIEYH.exe QFAUBI.exe File created C:\windows\system\SGSC.exe.bat ZDOZI.exe File opened for modification C:\windows\YDZEP.exe UVT.exe File created C:\windows\QFAUBI.exe PCXZ.exe File created C:\windows\system\UBHJPN.exe JIEYH.exe File opened for modification C:\windows\JIEYH.exe QFAUBI.exe File created C:\windows\system\BZRFO.exe RRP.exe File created C:\windows\system\LGSATJ.exe.bat WLJ.exe File opened for modification C:\windows\YCL.exe WOGCAS.exe File opened for modification C:\windows\YEHMMK.exe DTZ.exe File created C:\windows\system\PFLAIS.exe BUVBUQ.exe File created C:\windows\FZWELV.exe YKLBQQH.exe File created C:\windows\system\SGYHTH.exe.bat IILVLZ.exe File opened for modification C:\windows\system\NQFGK.exe TVA.exe File opened for modification C:\windows\system\BAOKZ.exe GZYB.exe File created C:\windows\ORWU.exe.bat QGLEE.exe File created C:\windows\QMSSFOV.exe.bat YJGXA.exe File opened for modification C:\windows\system\NYV.exe NTD.exe File created C:\windows\system\UDDNQOS.exe.bat QNW.exe File created C:\windows\GJOR.exe UBHJPN.exe File opened for modification C:\windows\XPDEV.exe QUUA.exe File created C:\windows\system\YKLBQQH.exe.bat HZA.exe File opened for modification C:\windows\system\WNKPZZ.exe VKHUT.exe File opened for modification C:\windows\system\SGYHTH.exe IILVLZ.exe File created C:\windows\BMQ.exe.bat IJMESX.exe File created C:\windows\GZYB.exe.bat 2026-07-31_57f5e592a961c5a9f14794f601e6b2f4_elex_emotet_stop.exe File created C:\windows\system\ZXSXHBZ.exe BMQ.exe File opened for modification C:\windows\system\NIBOVMU.exe ZXSXHBZ.exe File opened for modification C:\windows\system\RRP.exe EOH.exe File opened for modification C:\windows\SJZTI.exe KVUNY.exe File created C:\windows\system\VJYJ.exe DGUNXGG.exe File opened for modification C:\windows\system\WOGCAS.exe SGSC.exe File opened for modification C:\windows\XBUZDV.exe TTNR.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2532 cmd.exe 5208 cmd.exe 6140 cmd.exe 5036 cmd.exe 2576 cmd.exe 3736 cmd.exe 4956 cmd.exe 4312 cmd.exe 3580 cmd.exe 3260 cmd.exe 4692 cmd.exe 5216 cmd.exe 3504 cmd.exe 1492 cmd.exe 1912 cmd.exe 3780 cmd.exe 5956 cmd.exe 5828 cmd.exe 1356 cmd.exe 1188 cmd.exe 3028 cmd.exe 2144 cmd.exe 4320 cmd.exe 2560 cmd.exe 1696 cmd.exe 4532 cmd.exe 1284 cmd.exe 1780 cmd.exe 1512 cmd.exe 4236 cmd.exe 2192 cmd.exe 680 cmd.exe 2500 cmd.exe 2920 cmd.exe 3148 cmd.exe 5540 cmd.exe 4660 cmd.exe 1156 cmd.exe 5964 cmd.exe 6068 cmd.exe 2516 cmd.exe 2896 cmd.exe 2484 cmd.exe 5940 cmd.exe 6032 cmd.exe 5508 cmd.exe 5512 cmd.exe 5984 cmd.exe 1680 cmd.exe 5032 cmd.exe 5136 cmd.exe 4672 cmd.exe 2280 cmd.exe 2260 cmd.exe 3800 cmd.exe 2600 cmd.exe 5164 cmd.exe 5848 cmd.exe 4004 cmd.exe 4684 cmd.exe 1316 cmd.exe 5412 cmd.exe 2352 cmd.exe 5560 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 1928 3412 WerFault.exe 88 5664 5260 WerFault.exe 92 6116 2808 WerFault.exe 99 1384 2788 WerFault.exe 104 3280 4820 WerFault.exe 109 1380 5608 WerFault.exe 114 1464 5092 WerFault.exe 119 5468 1444 WerFault.exe 124 5240 5804 WerFault.exe 129 3572 6092 WerFault.exe 134 256 1108 WerFault.exe 139 1928 3040 WerFault.exe 144 4680 2720 WerFault.exe 149 2428 972 WerFault.exe 154 5984 5380 WerFault.exe 159 4560 2284 WerFault.exe 164 4788 4432 WerFault.exe 169 6132 4832 WerFault.exe 174 5196 2968 WerFault.exe 179 2624 4492 WerFault.exe 184 2748 632 WerFault.exe 189 240 248 WerFault.exe 194 4932 1928 WerFault.exe 199 4548 844 WerFault.exe 204 4556 2176 WerFault.exe 209 3356 5752 WerFault.exe 214 1348 3500 WerFault.exe 219 2328 3908 WerFault.exe 224 1188 4676 WerFault.exe 229 1924 2504 WerFault.exe 234 4136 2892 WerFault.exe 239 5112 4916 WerFault.exe 244 5044 3048 WerFault.exe 249 6124 6016 WerFault.exe 254 5640 4996 WerFault.exe 259 1948 3144 WerFault.exe 264 2816 1412 WerFault.exe 269 2620 1348 WerFault.exe 275 2500 5184 WerFault.exe 280 3220 6132 WerFault.exe 285 5796 1864 WerFault.exe 290 4336 2624 WerFault.exe 295 4936 3208 WerFault.exe 300 5616 3740 WerFault.exe 305 1828 1992 WerFault.exe 310 2428 3968 WerFault.exe 315 2816 3356 WerFault.exe 320 5952 3940 WerFault.exe 325 4544 1700 WerFault.exe 330 5620 3808 WerFault.exe 335 3588 3484 WerFault.exe 340 5384 6096 WerFault.exe 345 4740 4884 WerFault.exe 350 1776 5480 WerFault.exe 355 6048 2004 WerFault.exe 360 1392 3616 WerFault.exe 365 5824 2816 WerFault.exe 369 3580 1892 WerFault.exe 375 2404 2400 WerFault.exe 380 4724 5892 WerFault.exe 385 5768 244 WerFault.exe 390 5308 5044 WerFault.exe 395 2028 5188 WerFault.exe 400 3280 1776 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TUIR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NEREG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PRQWF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IVVJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GZYB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZDOZI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AMHIJW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QMSSFOV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NTD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UVT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HMJR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NQFGK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YAK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YCL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GVQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YCMDZD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UDDNQOS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UUWLDR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SGSC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SFHLD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PYGKQWT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FZWELV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PGSAISD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KVJNNTV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZOU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZXSXHBZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EDMASP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YKSJYG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UALFRNC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LIZCE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NCWKDN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YJGXA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TATP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UCZAR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FZIZTOO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GNN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SGYHTH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3412 2026-07-31_57f5e592a961c5a9f14794f601e6b2f4_elex_emotet_stop.exe 3412 2026-07-31_57f5e592a961c5a9f14794f601e6b2f4_elex_emotet_stop.exe 5260 GZYB.exe 5260 GZYB.exe 2808 BAOKZ.exe 2808 BAOKZ.exe 2788 GFGZ.exe 2788 GFGZ.exe 4820 YAK.exe 4820 YAK.exe 5608 ZDOZI.exe 5608 ZDOZI.exe 5092 SGSC.exe 5092 SGSC.exe 1444 WOGCAS.exe 1444 WOGCAS.exe 5804 YCL.exe 5804 YCL.exe 6092 RFPQQ.exe 6092 RFPQQ.exe 1108 GVQ.exe 1108 GVQ.exe 3040 UFZGDG.exe 3040 UFZGDG.exe 2720 EDMASP.exe 2720 EDMASP.exe 972 TTNR.exe 972 TTNR.exe 5380 XBUZDV.exe 5380 XBUZDV.exe 2284 UCWCPZ.exe 2284 UCWCPZ.exe 4432 SSPF.exe 4432 SSPF.exe 4832 SFHLD.exe 4832 SFHLD.exe 2968 TATP.exe 2968 TATP.exe 4492 MBAAAID.exe 4492 MBAAAID.exe 632 DLDQJO.exe 632 DLDQJO.exe 248 FZIZTOO.exe 248 FZIZTOO.exe 1928 YCMDZD.exe 1928 YCMDZD.exe 844 ZXX.exe 844 ZXX.exe 2176 VCIO.exe 2176 VCIO.exe 5752 UVT.exe 5752 UVT.exe 3500 YDZEP.exe 3500 YDZEP.exe 3908 NTADWQT.exe 3908 NTADWQT.exe 4676 TUIR.exe 4676 TUIR.exe 2504 MXM.exe 2504 MXM.exe 2892 GKQWU.exe 2892 GKQWU.exe 4916 YKSJYG.exe 4916 YKSJYG.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 3412 2026-07-31_57f5e592a961c5a9f14794f601e6b2f4_elex_emotet_stop.exe 3412 2026-07-31_57f5e592a961c5a9f14794f601e6b2f4_elex_emotet_stop.exe 5260 GZYB.exe 5260 GZYB.exe 2808 BAOKZ.exe 2808 BAOKZ.exe 2788 GFGZ.exe 2788 GFGZ.exe 4820 YAK.exe 4820 YAK.exe 5608 ZDOZI.exe 5608 ZDOZI.exe 5092 SGSC.exe 5092 SGSC.exe 1444 WOGCAS.exe 1444 WOGCAS.exe 5804 YCL.exe 5804 YCL.exe 6092 RFPQQ.exe 6092 RFPQQ.exe 1108 GVQ.exe 1108 GVQ.exe 3040 UFZGDG.exe 3040 UFZGDG.exe 2720 EDMASP.exe 2720 EDMASP.exe 972 TTNR.exe 972 TTNR.exe 5380 XBUZDV.exe 5380 XBUZDV.exe 2284 UCWCPZ.exe 2284 UCWCPZ.exe 4432 SSPF.exe 4432 SSPF.exe 4832 SFHLD.exe 4832 SFHLD.exe 2968 TATP.exe 2968 TATP.exe 4492 MBAAAID.exe 4492 MBAAAID.exe 632 DLDQJO.exe 632 DLDQJO.exe 248 FZIZTOO.exe 248 FZIZTOO.exe 1928 YCMDZD.exe 1928 YCMDZD.exe 844 ZXX.exe 844 ZXX.exe 2176 VCIO.exe 2176 VCIO.exe 5752 UVT.exe 5752 UVT.exe 3500 YDZEP.exe 3500 YDZEP.exe 3908 NTADWQT.exe 3908 NTADWQT.exe 4676 TUIR.exe 4676 TUIR.exe 2504 MXM.exe 2504 MXM.exe 2892 GKQWU.exe 2892 GKQWU.exe 4916 YKSJYG.exe 4916 YKSJYG.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3412 wrote to memory of 680 3412 2026-07-31_57f5e592a961c5a9f14794f601e6b2f4_elex_emotet_stop.exe 89 PID 680 wrote to memory of 5260 680 cmd.exe 92 PID 5260 wrote to memory of 5828 5260 GZYB.exe 95 PID 5828 wrote to memory of 2808 5828 cmd.exe 99 PID 2808 wrote to memory of 3612 2808 BAOKZ.exe 100 PID 3612 wrote to memory of 2788 3612 cmd.exe 104 PID 2788 wrote to memory of 3440 2788 GFGZ.exe 105 PID 3440 wrote to memory of 4820 3440 cmd.exe 109 PID 4820 wrote to memory of 1180 4820 YAK.exe 110 PID 1180 wrote to memory of 5608 1180 cmd.exe 114 PID 5608 wrote to memory of 6036 5608 ZDOZI.exe 115 PID 6036 wrote to memory of 5092 6036 cmd.exe 119 PID 5092 wrote to memory of 464 5092 SGSC.exe 120 PID 464 wrote to memory of 1444 464 cmd.exe 124 PID 1444 wrote to memory of 4944 1444 WOGCAS.exe 125 PID 4944 wrote to memory of 5804 4944 cmd.exe 129 PID 5804 wrote to memory of 724 5804 YCL.exe 130 PID 724 wrote to memory of 6092 724 cmd.exe 134 PID 6092 wrote to memory of 5508 6092 RFPQQ.exe 135 PID 5508 wrote to memory of 1108 5508 cmd.exe 139 PID 1108 wrote to memory of 5292 1108 GVQ.exe 140 PID 5292 wrote to memory of 3040 5292 cmd.exe 144 PID 3040 wrote to memory of 4956 3040 UFZGDG.exe 145 PID 4956 wrote to memory of 2720 4956 cmd.exe 149 PID 2720 wrote to memory of 5448 2720 EDMASP.exe 150 PID 5448 wrote to memory of 972 5448 cmd.exe 154 PID 972 wrote to memory of 4532 972 TTNR.exe 155 PID 4532 wrote to memory of 5380 4532 cmd.exe 159 PID 5380 wrote to memory of 3752 5380 XBUZDV.exe 160 PID 3752 wrote to memory of 2284 3752 cmd.exe 164 PID 2284 wrote to memory of 5560 2284 UCWCPZ.exe 165 PID 5560 wrote to memory of 4432 5560 cmd.exe 169 PID 4432 wrote to memory of 4948 4432 SSPF.exe 170 PID 4948 wrote to memory of 4832 4948 cmd.exe 174 PID 4832 wrote to memory of 4416 4832 SFHLD.exe 175 PID 4416 wrote to memory of 2968 4416 cmd.exe 179 PID 2968 wrote to memory of 2000 2968 TATP.exe 180 PID 2000 wrote to memory of 4492 2000 cmd.exe 184 PID 4492 wrote to memory of 3788 4492 MBAAAID.exe 185 PID 3788 wrote to memory of 632 3788 cmd.exe 189 PID 632 wrote to memory of 3504 632 DLDQJO.exe 190 PID 3504 wrote to memory of 248 3504 cmd.exe 194 PID 248 wrote to memory of 6068 248 FZIZTOO.exe 195 PID 6068 wrote to memory of 1928 6068 cmd.exe 199 PID 1928 wrote to memory of 5216 1928 YCMDZD.exe 200 PID 5216 wrote to memory of 844 5216 cmd.exe 204 PID 844 wrote to memory of 1284 844 ZXX.exe 205 PID 1284 wrote to memory of 2176 1284 cmd.exe 209 PID 2176 wrote to memory of 2724 2176 VCIO.exe 210 PID 2724 wrote to memory of 5752 2724 cmd.exe 214 PID 5752 wrote to memory of 3492 5752 UVT.exe 215 PID 3492 wrote to memory of 3500 3492 cmd.exe 219 PID 3500 wrote to memory of 1780 3500 YDZEP.exe 220 PID 1780 wrote to memory of 3908 1780 cmd.exe 224 PID 3908 wrote to memory of 2084 3908 NTADWQT.exe 225 PID 2084 wrote to memory of 4676 2084 cmd.exe 229 PID 4676 wrote to memory of 3892 4676 TUIR.exe 230 PID 3892 wrote to memory of 2504 3892 cmd.exe 234 PID 2504 wrote to memory of 980 2504 MXM.exe 235 PID 980 wrote to memory of 2892 980 cmd.exe 239 PID 2892 wrote to memory of 1512 2892 GKQWU.exe 240 PID 1512 wrote to memory of 4916 1512 cmd.exe 244 PID 4916 wrote to memory of 1356 4916 YKSJYG.exe 245 PID 1356 wrote to memory of 3048 1356 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_57f5e592a961c5a9f14794f601e6b2f4_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-31_57f5e592a961c5a9f14794f601e6b2f4_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GZYB.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:680 -
C:\windows\GZYB.exeC:\windows\GZYB.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BAOKZ.exe.bat" "4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5828 -
C:\windows\system\BAOKZ.exeC:\windows\system\BAOKZ.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GFGZ.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\windows\system\GFGZ.exeC:\windows\system\GFGZ.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YAK.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\windows\SysWOW64\YAK.exeC:\windows\system32\YAK.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZDOZI.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\windows\ZDOZI.exeC:\windows\ZDOZI.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5608 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SGSC.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:6036 -
C:\windows\system\SGSC.exeC:\windows\system\SGSC.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WOGCAS.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:464 -
C:\windows\system\WOGCAS.exeC:\windows\system\WOGCAS.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YCL.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\windows\YCL.exeC:\windows\YCL.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RFPQQ.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:724 -
C:\windows\SysWOW64\RFPQQ.exeC:\windows\system32\RFPQQ.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GVQ.exe.bat" "20⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5508 -
C:\windows\SysWOW64\GVQ.exeC:\windows\system32\GVQ.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UFZGDG.exe.bat" "22⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5292 -
C:\windows\UFZGDG.exeC:\windows\UFZGDG.exe23⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EDMASP.exe.bat" "24⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\windows\EDMASP.exeC:\windows\EDMASP.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TTNR.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:5448 -
C:\windows\SysWOW64\TTNR.exeC:\windows\system32\TTNR.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XBUZDV.exe.bat" "28⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\windows\XBUZDV.exeC:\windows\XBUZDV.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UCWCPZ.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:3752 -
C:\windows\UCWCPZ.exeC:\windows\UCWCPZ.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SSPF.exe.bat" "32⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5560 -
C:\windows\SysWOW64\SSPF.exeC:\windows\system32\SSPF.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SFHLD.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\windows\SysWOW64\SFHLD.exeC:\windows\system32\SFHLD.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TATP.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\windows\system\TATP.exeC:\windows\system\TATP.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MBAAAID.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\windows\SysWOW64\MBAAAID.exeC:\windows\system32\MBAAAID.exe39⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DLDQJO.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:3788 -
C:\windows\system\DLDQJO.exeC:\windows\system\DLDQJO.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:632 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FZIZTOO.exe.bat" "42⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3504 -
C:\windows\SysWOW64\FZIZTOO.exeC:\windows\system32\FZIZTOO.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YCMDZD.exe.bat" "44⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6068 -
C:\windows\SysWOW64\YCMDZD.exeC:\windows\system32\YCMDZD.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZXX.exe.bat" "46⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5216 -
C:\windows\SysWOW64\ZXX.exeC:\windows\system32\ZXX.exe47⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VCIO.exe.bat" "48⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\windows\system\VCIO.exeC:\windows\system\VCIO.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UVT.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\windows\system\UVT.exeC:\windows\system\UVT.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YDZEP.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\windows\YDZEP.exeC:\windows\YDZEP.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NTADWQT.exe.bat" "54⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\windows\SysWOW64\NTADWQT.exeC:\windows\system32\NTADWQT.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TUIR.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\windows\SysWOW64\TUIR.exeC:\windows\system32\TUIR.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MXM.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\windows\SysWOW64\MXM.exeC:\windows\system32\MXM.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GKQWU.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:980 -
C:\windows\system\GKQWU.exeC:\windows\system\GKQWU.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YKSJYG.exe.bat" "62⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\windows\system\YKSJYG.exeC:\windows\system\YKSJYG.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QNW.exe.bat" "64⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\windows\SysWOW64\QNW.exeC:\windows\system32\QNW.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3048 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UDDNQOS.exe.bat" "66⤵PID:4576
-
C:\windows\system\UDDNQOS.exeC:\windows\system\UDDNQOS.exe67⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QGLEE.exe.bat" "68⤵PID:3288
-
C:\windows\system\QGLEE.exeC:\windows\system\QGLEE.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ORWU.exe.bat" "70⤵PID:1972
-
C:\windows\ORWU.exeC:\windows\ORWU.exe71⤵
- Executes dropped EXE
PID:3144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WHXTT.exe.bat" "72⤵
- System Location Discovery: System Language Discovery
PID:4204 -
C:\windows\system\WHXTT.exeC:\windows\system\WHXTT.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AMHIJW.exe.bat" "74⤵PID:4500
-
C:\windows\SysWOW64\AMHIJW.exeC:\windows\system32\AMHIJW.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1348 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KVJNNTV.exe.bat" "76⤵
- System Location Discovery: System Language Discovery
PID:4264 -
C:\windows\SysWOW64\KVJNNTV.exeC:\windows\system32\KVJNNTV.exe77⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5184 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FFAMB.exe.bat" "78⤵PID:2988
-
C:\windows\system\FFAMB.exeC:\windows\system\FFAMB.exe79⤵
- Executes dropped EXE
PID:6132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DTZ.exe.bat" "80⤵
- Executes a command shell one-liner
PID:2560 -
C:\windows\DTZ.exeC:\windows\DTZ.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YEHMMK.exe.bat" "82⤵PID:252
-
C:\windows\YEHMMK.exeC:\windows\YEHMMK.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HMJR.exe.bat" "84⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2532 -
C:\windows\SysWOW64\HMJR.exeC:\windows\system32\HMJR.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NEREG.exe.bat" "86⤵PID:5572
-
C:\windows\SysWOW64\NEREG.exeC:\windows\system32\NEREG.exe87⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PCXZ.exe.bat" "88⤵PID:3368
-
C:\windows\system\PCXZ.exeC:\windows\system\PCXZ.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QFAUBI.exe.bat" "90⤵PID:4960
-
C:\windows\QFAUBI.exeC:\windows\QFAUBI.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JIEYH.exe.bat" "92⤵PID:4644
-
C:\windows\JIEYH.exeC:\windows\JIEYH.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3356 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UBHJPN.exe.bat" "94⤵PID:3000
-
C:\windows\system\UBHJPN.exeC:\windows\system\UBHJPN.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GJOR.exe.bat" "96⤵PID:3816
-
C:\windows\GJOR.exeC:\windows\GJOR.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PRQWF.exe.bat" "98⤵
- Executes a command shell one-liner
PID:1188 -
C:\windows\PRQWF.exeC:\windows\PRQWF.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QUUA.exe.bat" "100⤵
- Executes a command shell one-liner
PID:3260 -
C:\windows\SysWOW64\QUUA.exeC:\windows\system32\QUUA.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3484 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XPDEV.exe.bat" "102⤵
- Executes a command shell one-liner
PID:1696 -
C:\windows\XPDEV.exeC:\windows\XPDEV.exe103⤵
- Executes dropped EXE
PID:6096 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OPF.exe.bat" "104⤵
- System Location Discovery: System Language Discovery
PID:1200 -
C:\windows\system\OPF.exeC:\windows\system\OPF.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DKXNSY.exe.bat" "106⤵
- System Location Discovery: System Language Discovery
PID:4304 -
C:\windows\SysWOW64\DKXNSY.exeC:\windows\system32\DKXNSY.exe107⤵
- Executes dropped EXE
PID:5480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IVVJ.exe.bat" "108⤵PID:4548
-
C:\windows\IVVJ.exeC:\windows\IVVJ.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VYDHGBO.exe.bat" "110⤵
- Executes a command shell one-liner
PID:4692 -
C:\windows\SysWOW64\VYDHGBO.exeC:\windows\system32\VYDHGBO.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SWRZ.exe.bat" "112⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5208 -
C:\windows\SysWOW64\SWRZ.exeC:\windows\system32\SWRZ.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UUWLDR.exe.bat" "114⤵
- System Location Discovery: System Language Discovery
PID:5160 -
C:\windows\UUWLDR.exeC:\windows\UUWLDR.exe115⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1892 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AHVU.exe.bat" "116⤵
- Executes a command shell one-liner
PID:2500 -
C:\windows\AHVU.exeC:\windows\AHVU.exe117⤵
- Executes dropped EXE
PID:2400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UALFRNC.exe.bat" "118⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5848 -
C:\windows\system\UALFRNC.exeC:\windows\system\UALFRNC.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5892 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LIZCE.exe.bat" "120⤵PID:4260
-
C:\windows\system\LIZCE.exeC:\windows\system\LIZCE.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:244
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-