Analysis
- max time kernel
88s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
01/08/2026, 12:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-01_bc2666c6f9673a8ab7f0252f4b43868b_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-01_bc2666c6f9673a8ab7f0252f4b43868b_elex_emotet_stop.exe
- Size 208KB
- Sample260801-p7blyaah78
- SHA256 a1b7f4624dafba835d00e17bde45c208407117c4700caffaf9b25943bd9a1a11
- MD5 bc2666c6f9673a8ab7f0252f4b43868b
- SHA1 34602bb4ec580763f9de3ac0159b7724a7fa0ebf
- SHA512 f30447d95401debcae63356df3298ff0242a29d02a12e928c336bc382c58aed4c72374718369cb2df8c739fea2ae633a6ec319990fb694ca90237107c0724433
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbclcdL+LOfM4NLthEjQT6j:MlZtbLWIgd1LZ9oECZbclc5+LO0QEj1
- TLSH T1BF247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4960 UFU.exe 2452 JLN.exe 3260 WRZHV.exe 3104 RTQYJ.exe 4948 ZJRXQKE.exe 4580 DPBMGNH.exe 4848 JKA.exe 6656 WVR.exe 3208 KTRXBE.exe 6128 GYJNR.exe 6348 HBNI.exe 6124 EUP.exe 6708 OSCFPCH.exe 3916 ZSKQZD.exe 4724 YDUGH.exe 6588 RVCRR.exe 5480 MJHABJ.exe 2388 QMFV.exe 6852 FPOAUPT.exe 4372 GKAD.exe 2044 KAHDMY.exe 5336 ZQIDS.exe 2740 DYODXLB.exe 1776 SOPCDZ.exe 1168 WEW.exe 2972 LZFPBE.exe 6620 LFGDCRQ.exe 1008 BAPHV.exe 5552 KIRNZJ.exe 1036 BITS.exe 2176 HJBF.exe 3300 LZHN.exe 5056 ECLJLR.exe 256 QKS.exe 3460 ZSUW.exe 4520 ANY.exe 1944 UICBQ.exe 2312 GBFUQE.exe 6468 JJMC.exe 5896 PJUQUY.exe 2072 OUW.exe 4964 JHBPF.exe 4668 SQD.exe 2184 WYKUU.exe 2380 RJA.exe 7112 ARCYMCT.exe 1924 XOAVBM.exe 416 IHD.exe 6724 SPFT.exe 6928 HKPXYLN.exe 4444 PQPMZYQ.exe 712 TGVUL.exe 3424 XOCU.exe 3264 BEJCKTO.exe 6104 MXM.exe 6692 XPPGTQL.exe 5992 SCTP.exe 800 ZNUQJU.exe 6040 LGXJRBE.exe 6532 DJBF.exe 3328 VRDSI.exe 6868 KMM.exe 4620 KSML.exe 5580 ZNWPNJT.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\ODA.exe.bat FVYKLBZ.exe File created C:\windows\SysWOW64\KAHDMY.exe GKAD.exe File opened for modification C:\windows\SysWOW64\OUW.exe PJUQUY.exe File created C:\windows\SysWOW64\XOAVBM.exe.bat ARCYMCT.exe File created C:\windows\SysWOW64\KMM.exe VRDSI.exe File created C:\windows\SysWOW64\XAFHD.exe BUAJW.exe File created C:\windows\SysWOW64\LSRM.exe.bat LPFJKT.exe File opened for modification C:\windows\SysWOW64\KIRNZJ.exe BAPHV.exe File created C:\windows\SysWOW64\ANY.exe.bat ZSUW.exe File created C:\windows\SysWOW64\OUW.exe PJUQUY.exe File created C:\windows\SysWOW64\HKPXYLN.exe.bat SPFT.exe File created C:\windows\SysWOW64\XNO.exe.bat ISEXF.exe File created C:\windows\SysWOW64\LSRM.exe LPFJKT.exe File opened for modification C:\windows\SysWOW64\AMQ.exe ZRMAFWE.exe File created C:\windows\SysWOW64\AMQ.exe.bat ZRMAFWE.exe File created C:\windows\SysWOW64\KIRNZJ.exe BAPHV.exe File opened for modification C:\windows\SysWOW64\KAHDMY.exe GKAD.exe File created C:\windows\SysWOW64\LZFPBE.exe.bat WEW.exe File created C:\windows\SysWOW64\QKS.exe.bat ECLJLR.exe File opened for modification C:\windows\SysWOW64\HKPXYLN.exe SPFT.exe File created C:\windows\SysWOW64\PPYCD.exe.bat JPRPM.exe File opened for modification C:\windows\SysWOW64\LHMTNU.exe QTHK.exe File opened for modification C:\windows\SysWOW64\ODA.exe FVYKLBZ.exe File created C:\windows\SysWOW64\DPBMGNH.exe ZJRXQKE.exe File opened for modification C:\windows\SysWOW64\LZFPBE.exe WEW.exe File created C:\windows\SysWOW64\LPFJKT.exe KKNUJ.exe File created C:\windows\SysWOW64\QKS.exe ECLJLR.exe File opened for modification C:\windows\SysWOW64\TGVUL.exe PQPMZYQ.exe File created C:\windows\SysWOW64\VRDSI.exe DJBF.exe File created C:\windows\SysWOW64\OVGIA.exe ZAWEPWW.exe File opened for modification C:\windows\SysWOW64\OVGIA.exe ZAWEPWW.exe File opened for modification C:\windows\SysWOW64\JQFHY.exe ODA.exe File created C:\windows\SysWOW64\AMQ.exe ZRMAFWE.exe File created C:\windows\SysWOW64\DPBMGNH.exe.bat ZJRXQKE.exe File created C:\windows\SysWOW64\ZSKQZD.exe OSCFPCH.exe File opened for modification C:\windows\SysWOW64\WDEGRIH.exe EVCT.exe File opened for modification C:\windows\SysWOW64\PPYCD.exe JPRPM.exe File created C:\windows\SysWOW64\FJFGZ.exe.bat BTZGN.exe File opened for modification C:\windows\SysWOW64\GYJNR.exe KTRXBE.exe File created C:\windows\SysWOW64\MJHABJ.exe RVCRR.exe File opened for modification C:\windows\SysWOW64\MJHABJ.exe RVCRR.exe File created C:\windows\SysWOW64\LZFPBE.exe WEW.exe File created C:\windows\SysWOW64\JQFHY.exe.bat ODA.exe File created C:\windows\SysWOW64\WIGDWM.exe.bat NIMYS.exe File created C:\windows\SysWOW64\FJFGZ.exe BTZGN.exe File created C:\windows\SysWOW64\LPFJKT.exe.bat KKNUJ.exe File created C:\windows\SysWOW64\LZHN.exe HJBF.exe File created C:\windows\SysWOW64\JKA.exe DPBMGNH.exe File created C:\windows\SysWOW64\JKA.exe.bat DPBMGNH.exe File opened for modification C:\windows\SysWOW64\VRDSI.exe DJBF.exe File opened for modification C:\windows\SysWOW64\KMM.exe VRDSI.exe File opened for modification C:\windows\SysWOW64\LSRM.exe LPFJKT.exe File created C:\windows\SysWOW64\XOAVBM.exe ARCYMCT.exe File created C:\windows\SysWOW64\LGXJRBE.exe.bat ZNUQJU.exe File created C:\windows\SysWOW64\DJBF.exe LGXJRBE.exe File created C:\windows\SysWOW64\XAFHD.exe.bat BUAJW.exe File created C:\windows\SysWOW64\LHMTNU.exe QTHK.exe File created C:\windows\SysWOW64\LHMTNU.exe.bat QTHK.exe File created C:\windows\SysWOW64\GYJNR.exe KTRXBE.exe File created C:\windows\SysWOW64\KAHDMY.exe.bat GKAD.exe File opened for modification C:\windows\SysWOW64\LZHN.exe HJBF.exe File created C:\windows\SysWOW64\HKPXYLN.exe SPFT.exe File created C:\windows\SysWOW64\BUAJW.exe.bat PCXZ.exe File created C:\windows\SysWOW64\WDEGRIH.exe EVCT.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\FPOAUPT.exe QMFV.exe File opened for modification C:\windows\system\UICBQ.exe ANY.exe File created C:\windows\system\DFHHSF.exe KKDMNPX.exe File opened for modification C:\windows\system\GWJX.exe LJEOZTY.exe File created C:\windows\system\AZQSMR.exe.bat AMQ.exe File created C:\windows\ZJRXQKE.exe RTQYJ.exe File created C:\windows\system\HBNI.exe.bat GYJNR.exe File created C:\windows\system\RVCRR.exe YDUGH.exe File opened for modification C:\windows\system\KKDMNPX.exe PPYCD.exe File created C:\windows\XVSTFSB.exe XQRFDFY.exe File created C:\windows\system\KKDMNPX.exe PPYCD.exe File created C:\windows\EVHRV.exe.bat PAYMKCP.exe File created C:\windows\system\GBFUQE.exe UICBQ.exe File created C:\windows\system\WVR.exe JKA.exe File opened for modification C:\windows\system\EUP.exe HBNI.exe File created C:\windows\system\ECLJLR.exe LZHN.exe File opened for modification C:\windows\UFU.exe 2026-08-01_bc2666c6f9673a8ab7f0252f4b43868b_elex_emotet_stop.exe File created C:\windows\system\GKAD.exe.bat FPOAUPT.exe File opened for modification C:\windows\JHBPF.exe OUW.exe File created C:\windows\IYV.exe WIGDWM.exe File opened for modification C:\windows\system\PQPMZYQ.exe HKPXYLN.exe File opened for modification C:\windows\system\BEJCKTO.exe XOCU.exe File opened for modification C:\windows\system\PCXZ.exe BER.exe File created C:\windows\PAYMKCP.exe.bat LSRM.exe File created C:\windows\ZQIDS.exe.bat KAHDMY.exe File created C:\windows\ZNUQJU.exe.bat SCTP.exe File opened for modification C:\windows\PAYMKCP.exe LSRM.exe File opened for modification C:\windows\ZJRXQKE.exe RTQYJ.exe File opened for modification C:\windows\system\XQRFDFY.exe XNO.exe File opened for modification C:\windows\system\LJEOZTY.exe BLYTR.exe File created C:\windows\THRW.exe.bat GWJX.exe File created C:\windows\system\DKZDD.exe.bat ZUS.exe File opened for modification C:\windows\system\QRJP.exe WDEGRIH.exe File created C:\windows\system\EUP.exe HBNI.exe File created C:\windows\PJUQUY.exe JJMC.exe File created C:\windows\system\OBYWBW.exe.bat OVGIA.exe File created C:\windows\system\UBF.exe.bat OBYWBW.exe File opened for modification C:\windows\ZRMAFWE.exe EVHRV.exe File created C:\windows\system\YDUGH.exe ZSKQZD.exe File created C:\windows\system\RJA.exe.bat WYKUU.exe File opened for modification C:\windows\EVHRV.exe PAYMKCP.exe File created C:\windows\system\YDUGH.exe.bat ZSKQZD.exe File opened for modification C:\windows\ARCYMCT.exe RJA.exe File opened for modification C:\windows\system\WVR.exe JKA.exe File created C:\windows\system\QMFV.exe.bat MJHABJ.exe File created C:\windows\system\UICBQ.exe.bat ANY.exe File created C:\windows\WYKUU.exe.bat SQD.exe File opened for modification C:\windows\system\ISEXF.exe KWFW.exe File opened for modification C:\windows\FPOAUPT.exe QMFV.exe File created C:\windows\system\DYODXLB.exe.bat ZQIDS.exe File opened for modification C:\windows\system\RJA.exe WYKUU.exe File opened for modification C:\windows\LITBA.exe THRW.exe File opened for modification C:\windows\system\GKAD.exe FPOAUPT.exe File created C:\windows\JUNLGX.exe.bat QRJP.exe File opened for modification C:\windows\ZUS.exe OCPKQGN.exe File created C:\windows\LFGDCRQ.exe LZFPBE.exe File created C:\windows\system\QRJP.exe WDEGRIH.exe File created C:\windows\ZUS.exe OCPKQGN.exe File created C:\windows\NIMYS.exe.bat DKZDD.exe File created C:\windows\system\XPPGTQL.exe.bat MXM.exe File created C:\windows\system\GWJX.exe.bat LJEOZTY.exe File created C:\windows\ZUS.exe.bat OCPKQGN.exe File opened for modification C:\windows\NIMYS.exe DKZDD.exe File created C:\windows\XOCU.exe.bat TGVUL.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4656 cmd.exe 3220 cmd.exe 3056 cmd.exe 5656 cmd.exe 4868 cmd.exe 4076 cmd.exe 5528 cmd.exe 6068 cmd.exe 1432 cmd.exe 3936 cmd.exe 4540 cmd.exe 6808 cmd.exe 4976 cmd.exe 832 cmd.exe 628 cmd.exe 1360 cmd.exe 1264 cmd.exe 6940 cmd.exe 2660 cmd.exe 5136 cmd.exe 2904 cmd.exe 6772 cmd.exe 5400 cmd.exe 2320 cmd.exe 1136 cmd.exe 3256 cmd.exe 608 cmd.exe 3148 cmd.exe 1640 cmd.exe 6640 cmd.exe 3244 cmd.exe 1444 cmd.exe 3544 cmd.exe 6700 cmd.exe 4088 cmd.exe 6092 cmd.exe 4856 cmd.exe 2608 cmd.exe 5812 cmd.exe 400 cmd.exe 6776 cmd.exe 6752 cmd.exe 3312 cmd.exe 5448 cmd.exe 5628 cmd.exe 5132 cmd.exe 2128 cmd.exe 5928 cmd.exe 6032 cmd.exe 3436 cmd.exe 6748 cmd.exe 1088 cmd.exe 5544 cmd.exe 4204 cmd.exe 6648 cmd.exe 4748 cmd.exe 7000 cmd.exe 5272 cmd.exe 4800 cmd.exe 5224 cmd.exe 6536 cmd.exe 4048 cmd.exe 3304 cmd.exe 6256 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 416 4392 WerFault.exe 89 3320 4960 WerFault.exe 95 4344 2452 WerFault.exe 101 1976 3260 WerFault.exe 106 4716 3104 WerFault.exe 111 2968 4948 WerFault.exe 116 3936 4580 WerFault.exe 121 3056 4848 WerFault.exe 126 4108 6656 WerFault.exe 131 5712 3208 WerFault.exe 136 5844 6128 WerFault.exe 140 5468 6348 WerFault.exe 146 4708 6124 WerFault.exe 151 6748 6708 WerFault.exe 155 6652 3916 WerFault.exe 161 5260 4724 WerFault.exe 166 3300 6588 WerFault.exe 171 4332 5480 WerFault.exe 176 5580 2388 WerFault.exe 181 5892 6852 WerFault.exe 186 4444 4372 WerFault.exe 191 3424 2044 WerFault.exe 196 6776 5336 WerFault.exe 201 5628 2740 WerFault.exe 206 5896 1776 WerFault.exe 211 2072 1168 WerFault.exe 216 5496 2972 WerFault.exe 221 4104 6620 WerFault.exe 226 3668 1008 WerFault.exe 231 1320 5552 WerFault.exe 236 624 1036 WerFault.exe 241 4136 2176 WerFault.exe 246 4944 3300 WerFault.exe 251 4596 5056 WerFault.exe 256 1116 256 WerFault.exe 261 2928 3460 WerFault.exe 266 6436 4520 WerFault.exe 271 3488 1944 WerFault.exe 277 5524 2312 WerFault.exe 282 6552 6468 WerFault.exe 287 5020 5896 WerFault.exe 292 5004 2072 WerFault.exe 297 2776 4964 WerFault.exe 302 836 4668 WerFault.exe 307 6084 2184 WerFault.exe 312 4760 2380 WerFault.exe 317 6284 7112 WerFault.exe 322 2784 1924 WerFault.exe 327 3796 416 WerFault.exe 332 2180 6724 WerFault.exe 337 4692 6928 WerFault.exe 342 2968 4444 WerFault.exe 347 2204 712 WerFault.exe 352 4752 3424 WerFault.exe 357 5256 3264 WerFault.exe 362 7108 6104 WerFault.exe 367 3376 6692 WerFault.exe 372 2776 5992 WerFault.exe 377 948 800 WerFault.exe 382 5356 6040 WerFault.exe 387 3080 6532 WerFault.exe 392 3304 3328 WerFault.exe 397 4332 6868 WerFault.exe 402 6984 4620 WerFault.exe 407 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UICBQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MXM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SCTP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UBF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FVYKLBZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ISEXF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RTQYJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LZFPBE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QKS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XOAVBM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PPYCD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SPFT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YDUGH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MJHABJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZQIDS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BUAJW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KWFW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WIGDWM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KKDMNPX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GKAD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WDEGRIH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UFU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZAWEPWW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LSRM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WRZHV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TGVUL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BEJCKTO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JLN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LZHN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BTZGN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DJBF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JPRPM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ODA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XOCU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4392 2026-08-01_bc2666c6f9673a8ab7f0252f4b43868b_elex_emotet_stop.exe 4392 2026-08-01_bc2666c6f9673a8ab7f0252f4b43868b_elex_emotet_stop.exe 4960 UFU.exe 4960 UFU.exe 2452 JLN.exe 2452 JLN.exe 3260 WRZHV.exe 3260 WRZHV.exe 3104 RTQYJ.exe 3104 RTQYJ.exe 4948 ZJRXQKE.exe 4948 ZJRXQKE.exe 4580 DPBMGNH.exe 4580 DPBMGNH.exe 4848 JKA.exe 4848 JKA.exe 6656 WVR.exe 6656 WVR.exe 3208 KTRXBE.exe 3208 KTRXBE.exe 6128 GYJNR.exe 6128 GYJNR.exe 6348 HBNI.exe 6348 HBNI.exe 6124 EUP.exe 6124 EUP.exe 6708 OSCFPCH.exe 6708 OSCFPCH.exe 3916 ZSKQZD.exe 3916 ZSKQZD.exe 4724 YDUGH.exe 4724 YDUGH.exe 6588 RVCRR.exe 6588 RVCRR.exe 5480 MJHABJ.exe 5480 MJHABJ.exe 2388 QMFV.exe 2388 QMFV.exe 6852 FPOAUPT.exe 6852 FPOAUPT.exe 4372 GKAD.exe 4372 GKAD.exe 2044 KAHDMY.exe 2044 KAHDMY.exe 5336 ZQIDS.exe 5336 ZQIDS.exe 2740 DYODXLB.exe 2740 DYODXLB.exe 1776 SOPCDZ.exe 1776 SOPCDZ.exe 1168 WEW.exe 1168 WEW.exe 2972 LZFPBE.exe 2972 LZFPBE.exe 6620 LFGDCRQ.exe 6620 LFGDCRQ.exe 1008 BAPHV.exe 1008 BAPHV.exe 5552 KIRNZJ.exe 5552 KIRNZJ.exe 1036 BITS.exe 1036 BITS.exe 2176 HJBF.exe 2176 HJBF.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4392 2026-08-01_bc2666c6f9673a8ab7f0252f4b43868b_elex_emotet_stop.exe 4392 2026-08-01_bc2666c6f9673a8ab7f0252f4b43868b_elex_emotet_stop.exe 4960 UFU.exe 4960 UFU.exe 2452 JLN.exe 2452 JLN.exe 3260 WRZHV.exe 3260 WRZHV.exe 3104 RTQYJ.exe 3104 RTQYJ.exe 4948 ZJRXQKE.exe 4948 ZJRXQKE.exe 4580 DPBMGNH.exe 4580 DPBMGNH.exe 4848 JKA.exe 4848 JKA.exe 6656 WVR.exe 6656 WVR.exe 3208 KTRXBE.exe 3208 KTRXBE.exe 6128 GYJNR.exe 6128 GYJNR.exe 6348 HBNI.exe 6348 HBNI.exe 6124 EUP.exe 6124 EUP.exe 6708 OSCFPCH.exe 6708 OSCFPCH.exe 3916 ZSKQZD.exe 3916 ZSKQZD.exe 4724 YDUGH.exe 4724 YDUGH.exe 6588 RVCRR.exe 6588 RVCRR.exe 5480 MJHABJ.exe 5480 MJHABJ.exe 2388 QMFV.exe 2388 QMFV.exe 6852 FPOAUPT.exe 6852 FPOAUPT.exe 4372 GKAD.exe 4372 GKAD.exe 2044 KAHDMY.exe 2044 KAHDMY.exe 5336 ZQIDS.exe 5336 ZQIDS.exe 2740 DYODXLB.exe 2740 DYODXLB.exe 1776 SOPCDZ.exe 1776 SOPCDZ.exe 1168 WEW.exe 1168 WEW.exe 2972 LZFPBE.exe 2972 LZFPBE.exe 6620 LFGDCRQ.exe 6620 LFGDCRQ.exe 1008 BAPHV.exe 1008 BAPHV.exe 5552 KIRNZJ.exe 5552 KIRNZJ.exe 1036 BITS.exe 1036 BITS.exe 2176 HJBF.exe 2176 HJBF.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4392 wrote to memory of 5452 4392 2026-08-01_bc2666c6f9673a8ab7f0252f4b43868b_elex_emotet_stop.exe 91 PID 5452 wrote to memory of 4960 5452 cmd.exe 95 PID 4960 wrote to memory of 5048 4960 UFU.exe 97 PID 5048 wrote to memory of 2452 5048 cmd.exe 101 PID 2452 wrote to memory of 3436 2452 JLN.exe 102 PID 3436 wrote to memory of 3260 3436 cmd.exe 106 PID 3260 wrote to memory of 5520 3260 WRZHV.exe 107 PID 5520 wrote to memory of 3104 5520 cmd.exe 111 PID 3104 wrote to memory of 1264 3104 RTQYJ.exe 112 PID 1264 wrote to memory of 4948 1264 cmd.exe 116 PID 4948 wrote to memory of 6208 4948 ZJRXQKE.exe 117 PID 6208 wrote to memory of 4580 6208 cmd.exe 121 PID 4580 wrote to memory of 4564 4580 DPBMGNH.exe 122 PID 4564 wrote to memory of 4848 4564 cmd.exe 126 PID 4848 wrote to memory of 4784 4848 JKA.exe 127 PID 4784 wrote to memory of 6656 4784 cmd.exe 131 PID 6656 wrote to memory of 4812 6656 WVR.exe 132 PID 4812 wrote to memory of 3208 4812 cmd.exe 136 PID 3208 wrote to memory of 6940 3208 KTRXBE.exe 137 PID 6940 wrote to memory of 6128 6940 cmd.exe 140 PID 6128 wrote to memory of 6648 6128 GYJNR.exe 142 PID 6648 wrote to memory of 6348 6648 cmd.exe 146 PID 6348 wrote to memory of 4540 6348 HBNI.exe 147 PID 4540 wrote to memory of 6124 4540 cmd.exe 151 PID 6124 wrote to memory of 2660 6124 EUP.exe 152 PID 2660 wrote to memory of 6708 2660 cmd.exe 155 PID 6708 wrote to memory of 5376 6708 OSCFPCH.exe 157 PID 5376 wrote to memory of 3916 5376 cmd.exe 161 PID 3916 wrote to memory of 4588 3916 ZSKQZD.exe 162 PID 4588 wrote to memory of 4724 4588 cmd.exe 166 PID 4724 wrote to memory of 5800 4724 YDUGH.exe 167 PID 5800 wrote to memory of 6588 5800 cmd.exe 171 PID 6588 wrote to memory of 1120 6588 RVCRR.exe 172 PID 1120 wrote to memory of 5480 1120 cmd.exe 176 PID 5480 wrote to memory of 4744 5480 MJHABJ.exe 177 PID 4744 wrote to memory of 2388 4744 cmd.exe 181 PID 2388 wrote to memory of 1444 2388 QMFV.exe 182 PID 1444 wrote to memory of 6852 1444 cmd.exe 186 PID 6852 wrote to memory of 6304 6852 FPOAUPT.exe 187 PID 6304 wrote to memory of 4372 6304 cmd.exe 191 PID 4372 wrote to memory of 6808 4372 GKAD.exe 192 PID 6808 wrote to memory of 2044 6808 cmd.exe 196 PID 2044 wrote to memory of 5148 2044 KAHDMY.exe 197 PID 5148 wrote to memory of 5336 5148 cmd.exe 201 PID 5336 wrote to memory of 6756 5336 ZQIDS.exe 202 PID 6756 wrote to memory of 2740 6756 cmd.exe 206 PID 2740 wrote to memory of 4048 2740 DYODXLB.exe 207 PID 4048 wrote to memory of 1776 4048 cmd.exe 211 PID 1776 wrote to memory of 4856 1776 SOPCDZ.exe 212 PID 4856 wrote to memory of 1168 4856 cmd.exe 216 PID 1168 wrote to memory of 4748 1168 WEW.exe 217 PID 4748 wrote to memory of 2972 4748 cmd.exe 221 PID 2972 wrote to memory of 1664 2972 LZFPBE.exe 222 PID 1664 wrote to memory of 6620 1664 cmd.exe 226 PID 6620 wrote to memory of 6280 6620 LFGDCRQ.exe 227 PID 6280 wrote to memory of 1008 6280 cmd.exe 231 PID 1008 wrote to memory of 4680 1008 BAPHV.exe 232 PID 4680 wrote to memory of 5552 4680 cmd.exe 236 PID 5552 wrote to memory of 6096 5552 KIRNZJ.exe 237 PID 6096 wrote to memory of 1036 6096 cmd.exe 241 PID 1036 wrote to memory of 3116 1036 BITS.exe 242 PID 3116 wrote to memory of 2176 3116 cmd.exe 246 PID 2176 wrote to memory of 3132 2176 HJBF.exe 247 PID 3132 wrote to memory of 3300 3132 cmd.exe 251
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-01_bc2666c6f9673a8ab7f0252f4b43868b_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-01_bc2666c6f9673a8ab7f0252f4b43868b_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UFU.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:5452 -
C:\windows\UFU.exeC:\windows\UFU.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JLN.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\windows\JLN.exeC:\windows\JLN.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WRZHV.exe.bat" "6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\windows\system\WRZHV.exeC:\windows\system\WRZHV.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RTQYJ.exe.bat" "8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5520 -
C:\windows\system\RTQYJ.exeC:\windows\system\RTQYJ.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZJRXQKE.exe.bat" "10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\windows\ZJRXQKE.exeC:\windows\ZJRXQKE.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DPBMGNH.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:6208 -
C:\windows\SysWOW64\DPBMGNH.exeC:\windows\system32\DPBMGNH.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JKA.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\windows\SysWOW64\JKA.exeC:\windows\system32\JKA.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WVR.exe.bat" "16⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\windows\system\WVR.exeC:\windows\system\WVR.exe17⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6656 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KTRXBE.exe.bat" "18⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\windows\KTRXBE.exeC:\windows\KTRXBE.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GYJNR.exe.bat" "20⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6940 -
C:\windows\SysWOW64\GYJNR.exeC:\windows\system32\GYJNR.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HBNI.exe.bat" "22⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6648 -
C:\windows\system\HBNI.exeC:\windows\system\HBNI.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6348 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EUP.exe.bat" "24⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\windows\system\EUP.exeC:\windows\system\EUP.exe25⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OSCFPCH.exe.bat" "26⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\windows\OSCFPCH.exeC:\windows\OSCFPCH.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZSKQZD.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:5376 -
C:\windows\SysWOW64\ZSKQZD.exeC:\windows\system32\ZSKQZD.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YDUGH.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\windows\system\YDUGH.exeC:\windows\system\YDUGH.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RVCRR.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:5800 -
C:\windows\system\RVCRR.exeC:\windows\system\RVCRR.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6588 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MJHABJ.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\windows\SysWOW64\MJHABJ.exeC:\windows\system32\MJHABJ.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QMFV.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\windows\system\QMFV.exeC:\windows\system\QMFV.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FPOAUPT.exe.bat" "38⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\windows\FPOAUPT.exeC:\windows\FPOAUPT.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GKAD.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:6304 -
C:\windows\system\GKAD.exeC:\windows\system\GKAD.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KAHDMY.exe.bat" "42⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6808 -
C:\windows\SysWOW64\KAHDMY.exeC:\windows\system32\KAHDMY.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZQIDS.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:5148 -
C:\windows\ZQIDS.exeC:\windows\ZQIDS.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5336 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DYODXLB.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:6756 -
C:\windows\system\DYODXLB.exeC:\windows\system\DYODXLB.exe47⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SOPCDZ.exe.bat" "48⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\windows\system\SOPCDZ.exeC:\windows\system\SOPCDZ.exe49⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WEW.exe.bat" "50⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\windows\system\WEW.exeC:\windows\system\WEW.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LZFPBE.exe.bat" "52⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\windows\SysWOW64\LZFPBE.exeC:\windows\system32\LZFPBE.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LFGDCRQ.exe.bat" "54⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\windows\LFGDCRQ.exeC:\windows\LFGDCRQ.exe55⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6620 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BAPHV.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:6280 -
C:\windows\system\BAPHV.exeC:\windows\system\BAPHV.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1008 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KIRNZJ.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\windows\SysWOW64\KIRNZJ.exeC:\windows\system32\KIRNZJ.exe59⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BITS.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:6096 -
C:\windows\system\BITS.exeC:\windows\system\BITS.exe61⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HJBF.exe.bat" "62⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\windows\system\HJBF.exeC:\windows\system\HJBF.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LZHN.exe.bat" "64⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3132 -
C:\windows\SysWOW64\LZHN.exeC:\windows\system32\LZHN.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ECLJLR.exe.bat" "66⤵PID:3192
-
C:\windows\system\ECLJLR.exeC:\windows\system\ECLJLR.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5056 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QKS.exe.bat" "68⤵
- Executes a command shell one-liner
PID:7000 -
C:\windows\SysWOW64\QKS.exeC:\windows\system32\QKS.exe69⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZSUW.exe.bat" "70⤵PID:1976
-
C:\windows\ZSUW.exeC:\windows\ZSUW.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ANY.exe.bat" "72⤵PID:4148
-
C:\windows\SysWOW64\ANY.exeC:\windows\system32\ANY.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UICBQ.exe.bat" "74⤵
- Executes a command shell one-liner
PID:2320 -
C:\windows\system\UICBQ.exeC:\windows\system\UICBQ.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GBFUQE.exe.bat" "76⤵PID:2692
-
C:\windows\system\GBFUQE.exeC:\windows\system\GBFUQE.exe77⤵
- Executes dropped EXE
PID:2312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JJMC.exe.bat" "78⤵
- System Location Discovery: System Language Discovery
PID:5180 -
C:\windows\system\JJMC.exeC:\windows\system\JJMC.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PJUQUY.exe.bat" "80⤵PID:6856
-
C:\windows\PJUQUY.exeC:\windows\PJUQUY.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5896 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OUW.exe.bat" "82⤵
- System Location Discovery: System Language Discovery
PID:4736 -
C:\windows\SysWOW64\OUW.exeC:\windows\system32\OUW.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2072 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JHBPF.exe.bat" "84⤵PID:6836
-
C:\windows\JHBPF.exeC:\windows\JHBPF.exe85⤵
- Executes dropped EXE
PID:4964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SQD.exe.bat" "86⤵
- System Location Discovery: System Language Discovery
PID:6504 -
C:\windows\SysWOW64\SQD.exeC:\windows\system32\SQD.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WYKUU.exe.bat" "88⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1136 -
C:\windows\WYKUU.exeC:\windows\WYKUU.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2184 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RJA.exe.bat" "90⤵PID:4832
-
C:\windows\system\RJA.exeC:\windows\system\RJA.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ARCYMCT.exe.bat" "92⤵PID:1232
-
C:\windows\ARCYMCT.exeC:\windows\ARCYMCT.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:7112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XOAVBM.exe.bat" "94⤵PID:4056
-
C:\windows\SysWOW64\XOAVBM.exeC:\windows\system32\XOAVBM.exe95⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IHD.exe.bat" "96⤵PID:4780
-
C:\windows\IHD.exeC:\windows\IHD.exe97⤵
- Executes dropped EXE
PID:416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SPFT.exe.bat" "98⤵PID:7068
-
C:\windows\SPFT.exeC:\windows\SPFT.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:6724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HKPXYLN.exe.bat" "100⤵
- Executes a command shell one-liner
PID:3256 -
C:\windows\SysWOW64\HKPXYLN.exeC:\windows\system32\HKPXYLN.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PQPMZYQ.exe.bat" "102⤵
- Executes a command shell one-liner
PID:3312 -
C:\windows\system\PQPMZYQ.exeC:\windows\system\PQPMZYQ.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TGVUL.exe.bat" "104⤵PID:5380
-
C:\windows\SysWOW64\TGVUL.exeC:\windows\system32\TGVUL.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XOCU.exe.bat" "106⤵
- System Location Discovery: System Language Discovery
PID:2364 -
C:\windows\XOCU.exeC:\windows\XOCU.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BEJCKTO.exe.bat" "108⤵PID:5196
-
C:\windows\system\BEJCKTO.exeC:\windows\system\BEJCKTO.exe109⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MXM.exe.bat" "110⤵PID:1296
-
C:\windows\SysWOW64\MXM.exeC:\windows\system32\MXM.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6104 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XPPGTQL.exe.bat" "112⤵PID:5916
-
C:\windows\system\XPPGTQL.exeC:\windows\system\XPPGTQL.exe113⤵
- Executes dropped EXE
PID:6692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SCTP.exe.bat" "114⤵PID:5468
-
C:\windows\SCTP.exeC:\windows\SCTP.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZNUQJU.exe.bat" "116⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5136 -
C:\windows\ZNUQJU.exeC:\windows\ZNUQJU.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LGXJRBE.exe.bat" "118⤵
- Executes a command shell one-liner
PID:6748 -
C:\windows\SysWOW64\LGXJRBE.exeC:\windows\system32\LGXJRBE.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6040 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DJBF.exe.bat" "120⤵PID:4100
-
C:\windows\SysWOW64\DJBF.exeC:\windows\system32\DJBF.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:6532
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-