Analysis
- max time kernel
56s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
01/08/2026, 13:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-01_8de79eb30e309a1ef63cd4709b6cd854_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-01_8de79eb30e309a1ef63cd4709b6cd854_elex_emotet_stop.exe
- Size 208KB
- Sample260801-qmdfgabc22
- SHA256 3018abf9919efaf9d50003914b3cd2ef1f8ef9dc31ff111f9067b811321dd6e1
- MD5 8de79eb30e309a1ef63cd4709b6cd854
- SHA1 93199969bc3fc12509e2dc9fba634c4342943afd
- SHA512 80832edac640465f6d5e105074d3c3af9b7f10c126374ad1543d8b67eda133f621edfcc1d50bfdf62e490ab20601faf1c2945bd0c5dcbb4a79160df6eba42e7e
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlcKL+LOfK4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFlcS+LOikEj1
- TLSH T1E2247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2036 UFU.exe 5964 DOW.exe 2340 RYMCDG.exe 1276 KMLAIIK.exe 4680 XPCYP.exe 1252 YSFUCAH.exe 4880 CAMCOT.exe 5872 RQN.exe 1692 VGUCZ.exe 4832 URWS.exe 1248 QWPH.exe 2056 XROID.exe 3408 KUWGR.exe 4180 ZKXYQJX.exe 5104 MVOWEUS.exe 2712 NYRS.exe 6116 PWX.exe 5336 TEEUL.exe 3192 ZZDVIO.exe 5600 EFVLYJI.exe 1228 CAU.exe 3268 MYAGKUH.exe 2548 QGHG.exe 4412 ORR.exe 4496 YOX.exe 2368 VPHSYXJ.exe 5220 DULZJEE.exe 2224 CSFCW.exe 3400 RIGT.exe 3732 AJAGG.exe 5900 EZOGSUR.exe 2852 TUYLD.exe 1952 XXW.exe 3064 BNDGP.exe 5692 XPLFE.exe 2280 PTXIJLV.exe 3068 KGUS.exe 4804 BOWXX.exe 6040 WBAGHQA.exe 5768 NKPLUHV.exe 5280 WKRRXE.exe 5828 IAX.exe 4916 BVBUX.exe 2008 OGSLD.exe 2908 EWTKKL.exe 5224 IMZKWD.exe 5260 IHD.exe 2688 VSMNQE.exe 5680 CNL.exe 692 PQBMIK.exe 3404 TGIM.exe 4620 RRL.exe 2516 SUOYJGC.exe 5320 REZO.exe 2568 GZJSCZ.exe 5700 ZDMWI.exe 2196 ZGQSNNK.exe 5112 DOXAA.exe 5580 NWZ.exe 3796 GOOQUD.exe 3460 RHJJDLY.exe 1064 BFXDKTG.exe 4724 ZAWEPWW.exe 3596 DIDEBOK.exe - Drops file in System32 directory 51 IoCs
description ioc Process File created C:\windows\SysWOW64\VGUCZ.exe.bat RQN.exe File created C:\windows\SysWOW64\CAU.exe.bat EFVLYJI.exe File created C:\windows\SysWOW64\CSFCW.exe DULZJEE.exe File created C:\windows\SysWOW64\EWTKKL.exe.bat OGSLD.exe File created C:\windows\SysWOW64\BFXDKTG.exe RHJJDLY.exe File opened for modification C:\windows\SysWOW64\BFXDKTG.exe RHJJDLY.exe File created C:\windows\SysWOW64\KMLAIIK.exe RYMCDG.exe File created C:\windows\SysWOW64\XPCYP.exe KMLAIIK.exe File opened for modification C:\windows\SysWOW64\XPCYP.exe KMLAIIK.exe File created C:\windows\SysWOW64\URWS.exe VGUCZ.exe File created C:\windows\SysWOW64\MVOWEUS.exe ZKXYQJX.exe File opened for modification C:\windows\SysWOW64\DULZJEE.exe VPHSYXJ.exe File created C:\windows\SysWOW64\NKPLUHV.exe WBAGHQA.exe File created C:\windows\SysWOW64\NKPLUHV.exe.bat WBAGHQA.exe File created C:\windows\SysWOW64\KMLAIIK.exe.bat RYMCDG.exe File created C:\windows\SysWOW64\VGUCZ.exe RQN.exe File opened for modification C:\windows\SysWOW64\URWS.exe VGUCZ.exe File created C:\windows\SysWOW64\URWS.exe.bat VGUCZ.exe File opened for modification C:\windows\SysWOW64\MVOWEUS.exe ZKXYQJX.exe File opened for modification C:\windows\SysWOW64\NYRS.exe MVOWEUS.exe File created C:\windows\SysWOW64\VPHSYXJ.exe.bat YOX.exe File created C:\windows\SysWOW64\PTXIJLV.exe.bat XPLFE.exe File opened for modification C:\windows\SysWOW64\KMLAIIK.exe RYMCDG.exe File created C:\windows\SysWOW64\MVOWEUS.exe.bat ZKXYQJX.exe File opened for modification C:\windows\SysWOW64\CAU.exe EFVLYJI.exe File opened for modification C:\windows\SysWOW64\VPHSYXJ.exe YOX.exe File opened for modification C:\windows\SysWOW64\CSFCW.exe DULZJEE.exe File opened for modification C:\windows\SysWOW64\WBAGHQA.exe BOWXX.exe File created C:\windows\SysWOW64\EWTKKL.exe OGSLD.exe File created C:\windows\SysWOW64\NWZ.exe.bat DOXAA.exe File created C:\windows\SysWOW64\XPCYP.exe.bat KMLAIIK.exe File created C:\windows\SysWOW64\DULZJEE.exe VPHSYXJ.exe File created C:\windows\SysWOW64\DULZJEE.exe.bat VPHSYXJ.exe File opened for modification C:\windows\SysWOW64\EWTKKL.exe OGSLD.exe File opened for modification C:\windows\SysWOW64\NWZ.exe DOXAA.exe File opened for modification C:\windows\SysWOW64\DIDEBOK.exe ZAWEPWW.exe File created C:\windows\SysWOW64\DIDEBOK.exe.bat ZAWEPWW.exe File created C:\windows\SysWOW64\CAU.exe EFVLYJI.exe File created C:\windows\SysWOW64\VPHSYXJ.exe YOX.exe File created C:\windows\SysWOW64\PTXIJLV.exe XPLFE.exe File opened for modification C:\windows\SysWOW64\PTXIJLV.exe XPLFE.exe File created C:\windows\SysWOW64\WBAGHQA.exe BOWXX.exe File created C:\windows\SysWOW64\WBAGHQA.exe.bat BOWXX.exe File created C:\windows\SysWOW64\BFXDKTG.exe.bat RHJJDLY.exe File opened for modification C:\windows\SysWOW64\VGUCZ.exe RQN.exe File created C:\windows\SysWOW64\NYRS.exe MVOWEUS.exe File created C:\windows\SysWOW64\NYRS.exe.bat MVOWEUS.exe File opened for modification C:\windows\SysWOW64\NKPLUHV.exe WBAGHQA.exe File created C:\windows\SysWOW64\CSFCW.exe.bat DULZJEE.exe File created C:\windows\SysWOW64\NWZ.exe DOXAA.exe File created C:\windows\SysWOW64\DIDEBOK.exe ZAWEPWW.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\RRL.exe TGIM.exe File created C:\windows\UFU.exe.bat 2026-08-01_8de79eb30e309a1ef63cd4709b6cd854_elex_emotet_stop.exe File opened for modification C:\windows\system\VSMNQE.exe IHD.exe File created C:\windows\GZJSCZ.exe REZO.exe File opened for modification C:\windows\system\RHJJDLY.exe GOOQUD.exe File opened for modification C:\windows\ZAWEPWW.exe BFXDKTG.exe File created C:\windows\OCZNJU.exe OZVK.exe File created C:\windows\RYMCDG.exe DOW.exe File created C:\windows\RYMCDG.exe.bat DOW.exe File opened for modification C:\windows\YSFUCAH.exe XPCYP.exe File created C:\windows\MYAGKUH.exe CAU.exe File created C:\windows\system\RIGT.exe CSFCW.exe File opened for modification C:\windows\system\EZOGSUR.exe AJAGG.exe File created C:\windows\system\VSMNQE.exe.bat IHD.exe File opened for modification C:\windows\system\PQBMIK.exe CNL.exe File opened for modification C:\windows\system\EFVLYJI.exe ZZDVIO.exe File created C:\windows\BVBUX.exe IAX.exe File created C:\windows\system\ZGQSNNK.exe ZDMWI.exe File created C:\windows\system\TGQMSRU.exe YTLCH.exe File opened for modification C:\windows\ZKXYQJX.exe KUWGR.exe File created C:\windows\SUOYJGC.exe.bat RRL.exe File opened for modification C:\windows\YOX.exe ORR.exe File opened for modification C:\windows\BVBUX.exe IAX.exe File created C:\windows\GZJSCZ.exe.bat REZO.exe File created C:\windows\OCZNJU.exe.bat OZVK.exe File created C:\windows\YSFUCAH.exe.bat XPCYP.exe File opened for modification C:\windows\system\KUWGR.exe XROID.exe File opened for modification C:\windows\XPLFE.exe BNDGP.exe File opened for modification C:\windows\system\TGIM.exe PQBMIK.exe File created C:\windows\SUOYJGC.exe RRL.exe File created C:\windows\system\QWPH.exe.bat URWS.exe File created C:\windows\TEEUL.exe.bat PWX.exe File opened for modification C:\windows\MYAGKUH.exe CAU.exe File opened for modification C:\windows\QGHG.exe MYAGKUH.exe File opened for modification C:\windows\system\ORR.exe QGHG.exe File created C:\windows\BOWXX.exe KGUS.exe File created C:\windows\IMZKWD.exe.bat EWTKKL.exe File created C:\windows\system\RHJJDLY.exe GOOQUD.exe File created C:\windows\system\KGUS.exe PTXIJLV.exe File created C:\windows\WKRRXE.exe.bat NKPLUHV.exe File created C:\windows\RRL.exe TGIM.exe File opened for modification C:\windows\EZT.exe TGQMSRU.exe File opened for modification C:\windows\system\RIGT.exe CSFCW.exe File created C:\windows\system\OGSLD.exe.bat BVBUX.exe File opened for modification C:\windows\system\YTLCH.exe DIDEBOK.exe File opened for modification C:\windows\UFU.exe 2026-08-01_8de79eb30e309a1ef63cd4709b6cd854_elex_emotet_stop.exe File created C:\windows\system\XROID.exe QWPH.exe File created C:\windows\system\EFVLYJI.exe ZZDVIO.exe File created C:\windows\QGHG.exe.bat MYAGKUH.exe File opened for modification C:\windows\AJAGG.exe RIGT.exe File opened for modification C:\windows\WKRRXE.exe NKPLUHV.exe File created C:\windows\system\OZVK.exe EZT.exe File created C:\windows\system\ZZDVIO.exe.bat TEEUL.exe File created C:\windows\BVBUX.exe.bat IAX.exe File opened for modification C:\windows\IMZKWD.exe EWTKKL.exe File created C:\windows\system\PQBMIK.exe CNL.exe File created C:\windows\REZO.exe.bat SUOYJGC.exe File created C:\windows\system\YTLCH.exe.bat DIDEBOK.exe File opened for modification C:\windows\system\CAMCOT.exe YSFUCAH.exe File created C:\windows\system\EZOGSUR.exe AJAGG.exe File created C:\windows\system\TUYLD.exe.bat EZOGSUR.exe File opened for modification C:\windows\GZJSCZ.exe REZO.exe File created C:\windows\DOXAA.exe ZGQSNNK.exe File opened for modification C:\windows\DOW.exe UFU.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1800 cmd.exe 3448 cmd.exe 5996 cmd.exe 2316 cmd.exe 6016 cmd.exe 2540 cmd.exe 4140 cmd.exe 5228 cmd.exe 2472 cmd.exe 1788 cmd.exe 3444 cmd.exe 4820 cmd.exe 936 cmd.exe 4656 cmd.exe 3632 cmd.exe 1600 cmd.exe 4908 cmd.exe 4896 cmd.exe 5744 cmd.exe 5664 cmd.exe 5916 cmd.exe 5244 cmd.exe 4432 cmd.exe 5720 cmd.exe 4500 cmd.exe 1660 cmd.exe 2544 cmd.exe 6028 cmd.exe 2308 cmd.exe 3388 cmd.exe 4272 cmd.exe 4736 cmd.exe 5588 cmd.exe 1236 cmd.exe 4212 cmd.exe 4080 cmd.exe 3896 cmd.exe 5608 cmd.exe 4792 cmd.exe 4296 cmd.exe 536 cmd.exe 3332 cmd.exe 5668 cmd.exe 1632 cmd.exe 6084 cmd.exe 3520 cmd.exe 1688 cmd.exe 1084 cmd.exe 3088 cmd.exe 6008 cmd.exe 2800 cmd.exe 2448 cmd.exe 5820 cmd.exe 1896 cmd.exe 3968 cmd.exe 812 cmd.exe 4148 cmd.exe 5172 cmd.exe 4520 cmd.exe 2100 cmd.exe 1232 cmd.exe 2484 cmd.exe 2728 cmd.exe 1120 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 2728 2968 WerFault.exe 87 3896 2036 WerFault.exe 93 4568 5964 WerFault.exe 99 5952 2340 WerFault.exe 104 4572 1276 WerFault.exe 109 1088 4680 WerFault.exe 114 4904 1252 WerFault.exe 119 748 4880 WerFault.exe 124 4804 5872 WerFault.exe 129 4416 1692 WerFault.exe 134 4564 4832 WerFault.exe 139 1080 1248 WerFault.exe 144 2548 2056 WerFault.exe 149 5216 3408 WerFault.exe 154 1864 4180 WerFault.exe 159 3728 5104 WerFault.exe 164 4112 2712 WerFault.exe 169 4784 6116 WerFault.exe 174 5224 5336 WerFault.exe 179 4432 3192 WerFault.exe 184 5792 5600 WerFault.exe 189 1316 1228 WerFault.exe 194 5096 3268 WerFault.exe 199 2648 2548 WerFault.exe 204 3856 4412 WerFault.exe 209 2008 4496 WerFault.exe 214 6088 2368 WerFault.exe 219 852 5220 WerFault.exe 224 5620 2224 WerFault.exe 229 3824 3400 WerFault.exe 234 5992 3732 WerFault.exe 239 2952 5900 WerFault.exe 244 3360 2852 WerFault.exe 249 4948 1952 WerFault.exe 254 2708 3064 WerFault.exe 259 3464 5692 WerFault.exe 264 2592 2280 WerFault.exe 270 2696 3068 WerFault.exe 275 1164 4804 WerFault.exe 280 4568 6040 WerFault.exe 285 4124 5768 WerFault.exe 290 1256 5280 WerFault.exe 295 3392 5828 WerFault.exe 300 1652 4916 WerFault.exe 305 4120 2008 WerFault.exe 310 4512 2908 WerFault.exe 315 5324 5224 WerFault.exe 320 124 5260 WerFault.exe 325 5992 2688 WerFault.exe 330 5296 5680 WerFault.exe 335 6124 692 WerFault.exe 340 2136 3404 WerFault.exe 345 1632 4620 WerFault.exe 350 4784 2516 WerFault.exe 355 5808 5320 WerFault.exe 360 3476 2568 WerFault.exe 365 3700 5700 WerFault.exe 370 2952 2196 WerFault.exe 375 1304 5112 WerFault.exe 380 1688 5580 WerFault.exe 385 4128 3796 WerFault.exe 390 4424 3460 WerFault.exe 395 4624 1064 WerFault.exe 400 5652 4724 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REZO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZDMWI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language URWS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZGQSNNK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TEEUL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KMLAIIK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CAMCOT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VGUCZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OZVK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EFVLYJI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GOOQUD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PQBMIK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CSFCW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NWZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RQN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RIGT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VSMNQE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XROID.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BVBUX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TGIM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XXW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BNDGP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YSFUCAH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MYAGKUH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XPLFE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PTXIJLV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TGQMSRU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ORR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RHJJDLY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BFXDKTG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KGUS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QGHG.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2968 2026-08-01_8de79eb30e309a1ef63cd4709b6cd854_elex_emotet_stop.exe 2968 2026-08-01_8de79eb30e309a1ef63cd4709b6cd854_elex_emotet_stop.exe 2036 UFU.exe 2036 UFU.exe 5964 DOW.exe 5964 DOW.exe 2340 RYMCDG.exe 2340 RYMCDG.exe 1276 KMLAIIK.exe 1276 KMLAIIK.exe 4680 XPCYP.exe 4680 XPCYP.exe 1252 YSFUCAH.exe 1252 YSFUCAH.exe 4880 CAMCOT.exe 4880 CAMCOT.exe 5872 RQN.exe 5872 RQN.exe 1692 VGUCZ.exe 1692 VGUCZ.exe 4832 URWS.exe 4832 URWS.exe 1248 QWPH.exe 1248 QWPH.exe 2056 XROID.exe 2056 XROID.exe 3408 KUWGR.exe 3408 KUWGR.exe 4180 ZKXYQJX.exe 4180 ZKXYQJX.exe 5104 MVOWEUS.exe 5104 MVOWEUS.exe 2712 NYRS.exe 2712 NYRS.exe 6116 PWX.exe 6116 PWX.exe 5336 TEEUL.exe 5336 TEEUL.exe 3192 ZZDVIO.exe 3192 ZZDVIO.exe 5600 EFVLYJI.exe 5600 EFVLYJI.exe 1228 CAU.exe 1228 CAU.exe 3268 MYAGKUH.exe 3268 MYAGKUH.exe 2548 QGHG.exe 2548 QGHG.exe 4412 ORR.exe 4412 ORR.exe 4496 YOX.exe 4496 YOX.exe 2368 VPHSYXJ.exe 2368 VPHSYXJ.exe 5220 DULZJEE.exe 5220 DULZJEE.exe 2224 CSFCW.exe 2224 CSFCW.exe 3400 RIGT.exe 3400 RIGT.exe 3732 AJAGG.exe 3732 AJAGG.exe 5900 EZOGSUR.exe 5900 EZOGSUR.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2968 2026-08-01_8de79eb30e309a1ef63cd4709b6cd854_elex_emotet_stop.exe 2968 2026-08-01_8de79eb30e309a1ef63cd4709b6cd854_elex_emotet_stop.exe 2036 UFU.exe 2036 UFU.exe 5964 DOW.exe 5964 DOW.exe 2340 RYMCDG.exe 2340 RYMCDG.exe 1276 KMLAIIK.exe 1276 KMLAIIK.exe 4680 XPCYP.exe 4680 XPCYP.exe 1252 YSFUCAH.exe 1252 YSFUCAH.exe 4880 CAMCOT.exe 4880 CAMCOT.exe 5872 RQN.exe 5872 RQN.exe 1692 VGUCZ.exe 1692 VGUCZ.exe 4832 URWS.exe 4832 URWS.exe 1248 QWPH.exe 1248 QWPH.exe 2056 XROID.exe 2056 XROID.exe 3408 KUWGR.exe 3408 KUWGR.exe 4180 ZKXYQJX.exe 4180 ZKXYQJX.exe 5104 MVOWEUS.exe 5104 MVOWEUS.exe 2712 NYRS.exe 2712 NYRS.exe 6116 PWX.exe 6116 PWX.exe 5336 TEEUL.exe 5336 TEEUL.exe 3192 ZZDVIO.exe 3192 ZZDVIO.exe 5600 EFVLYJI.exe 5600 EFVLYJI.exe 1228 CAU.exe 1228 CAU.exe 3268 MYAGKUH.exe 3268 MYAGKUH.exe 2548 QGHG.exe 2548 QGHG.exe 4412 ORR.exe 4412 ORR.exe 4496 YOX.exe 4496 YOX.exe 2368 VPHSYXJ.exe 2368 VPHSYXJ.exe 5220 DULZJEE.exe 5220 DULZJEE.exe 2224 CSFCW.exe 2224 CSFCW.exe 3400 RIGT.exe 3400 RIGT.exe 3732 AJAGG.exe 3732 AJAGG.exe 5900 EZOGSUR.exe 5900 EZOGSUR.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2968 wrote to memory of 3632 2968 2026-08-01_8de79eb30e309a1ef63cd4709b6cd854_elex_emotet_stop.exe 89 PID 3632 wrote to memory of 2036 3632 cmd.exe 93 PID 2036 wrote to memory of 2408 2036 UFU.exe 95 PID 2408 wrote to memory of 5964 2408 cmd.exe 99 PID 5964 wrote to memory of 3892 5964 DOW.exe 100 PID 3892 wrote to memory of 2340 3892 cmd.exe 104 PID 2340 wrote to memory of 6080 2340 RYMCDG.exe 105 PID 6080 wrote to memory of 1276 6080 cmd.exe 109 PID 1276 wrote to memory of 4140 1276 KMLAIIK.exe 110 PID 4140 wrote to memory of 4680 4140 cmd.exe 114 PID 4680 wrote to memory of 1600 4680 XPCYP.exe 115 PID 1600 wrote to memory of 1252 1600 cmd.exe 119 PID 1252 wrote to memory of 844 1252 YSFUCAH.exe 120 PID 844 wrote to memory of 4880 844 cmd.exe 124 PID 4880 wrote to memory of 2308 4880 CAMCOT.exe 125 PID 2308 wrote to memory of 5872 2308 cmd.exe 129 PID 5872 wrote to memory of 764 5872 RQN.exe 130 PID 764 wrote to memory of 1692 764 cmd.exe 134 PID 1692 wrote to memory of 5728 1692 VGUCZ.exe 135 PID 5728 wrote to memory of 4832 5728 cmd.exe 139 PID 4832 wrote to memory of 2040 4832 URWS.exe 140 PID 2040 wrote to memory of 1248 2040 cmd.exe 144 PID 1248 wrote to memory of 2432 1248 QWPH.exe 145 PID 2432 wrote to memory of 2056 2432 cmd.exe 149 PID 2056 wrote to memory of 4908 2056 XROID.exe 150 PID 4908 wrote to memory of 3408 4908 cmd.exe 154 PID 3408 wrote to memory of 3224 3408 KUWGR.exe 155 PID 3224 wrote to memory of 4180 3224 cmd.exe 159 PID 4180 wrote to memory of 4080 4180 ZKXYQJX.exe 160 PID 4080 wrote to memory of 5104 4080 cmd.exe 164 PID 5104 wrote to memory of 4216 5104 MVOWEUS.exe 165 PID 4216 wrote to memory of 2712 4216 cmd.exe 169 PID 2712 wrote to memory of 4668 2712 NYRS.exe 170 PID 4668 wrote to memory of 6116 4668 cmd.exe 174 PID 6116 wrote to memory of 4520 6116 PWX.exe 175 PID 4520 wrote to memory of 5336 4520 cmd.exe 179 PID 5336 wrote to memory of 1264 5336 TEEUL.exe 180 PID 1264 wrote to memory of 3192 1264 cmd.exe 184 PID 3192 wrote to memory of 3008 3192 ZZDVIO.exe 185 PID 3008 wrote to memory of 5600 3008 cmd.exe 189 PID 5600 wrote to memory of 3968 5600 EFVLYJI.exe 190 PID 3968 wrote to memory of 1228 3968 cmd.exe 194 PID 1228 wrote to memory of 5944 1228 CAU.exe 195 PID 5944 wrote to memory of 3268 5944 cmd.exe 199 PID 3268 wrote to memory of 3388 3268 MYAGKUH.exe 200 PID 3388 wrote to memory of 2548 3388 cmd.exe 204 PID 2548 wrote to memory of 1372 2548 QGHG.exe 205 PID 1372 wrote to memory of 4412 1372 cmd.exe 209 PID 4412 wrote to memory of 2912 4412 ORR.exe 210 PID 2912 wrote to memory of 4496 2912 cmd.exe 214 PID 4496 wrote to memory of 812 4496 YOX.exe 215 PID 812 wrote to memory of 2368 812 cmd.exe 219 PID 2368 wrote to memory of 2140 2368 VPHSYXJ.exe 220 PID 2140 wrote to memory of 5220 2140 cmd.exe 224 PID 5220 wrote to memory of 4776 5220 DULZJEE.exe 225 PID 4776 wrote to memory of 2224 4776 cmd.exe 229 PID 2224 wrote to memory of 3320 2224 CSFCW.exe 230 PID 3320 wrote to memory of 3400 3320 cmd.exe 234 PID 3400 wrote to memory of 4272 3400 RIGT.exe 235 PID 4272 wrote to memory of 3732 4272 cmd.exe 239 PID 3732 wrote to memory of 5300 3732 AJAGG.exe 240 PID 5300 wrote to memory of 5900 5300 cmd.exe 244 PID 5900 wrote to memory of 4844 5900 EZOGSUR.exe 245 PID 4844 wrote to memory of 2852 4844 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-01_8de79eb30e309a1ef63cd4709b6cd854_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-01_8de79eb30e309a1ef63cd4709b6cd854_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UFU.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3632 -
C:\windows\UFU.exeC:\windows\UFU.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DOW.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\windows\DOW.exeC:\windows\DOW.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RYMCDG.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\windows\RYMCDG.exeC:\windows\RYMCDG.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KMLAIIK.exe.bat" "8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6080 -
C:\windows\SysWOW64\KMLAIIK.exeC:\windows\system32\KMLAIIK.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XPCYP.exe.bat" "10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\windows\SysWOW64\XPCYP.exeC:\windows\system32\XPCYP.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YSFUCAH.exe.bat" "12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\windows\YSFUCAH.exeC:\windows\YSFUCAH.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CAMCOT.exe.bat" "14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:844 -
C:\windows\system\CAMCOT.exeC:\windows\system\CAMCOT.exe15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RQN.exe.bat" "16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\windows\system\RQN.exeC:\windows\system\RQN.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VGUCZ.exe.bat" "18⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:764 -
C:\windows\SysWOW64\VGUCZ.exeC:\windows\system32\VGUCZ.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\URWS.exe.bat" "20⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5728 -
C:\windows\SysWOW64\URWS.exeC:\windows\system32\URWS.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QWPH.exe.bat" "22⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\windows\system\QWPH.exeC:\windows\system\QWPH.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XROID.exe.bat" "24⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\windows\system\XROID.exeC:\windows\system\XROID.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KUWGR.exe.bat" "26⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\windows\system\KUWGR.exeC:\windows\system\KUWGR.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZKXYQJX.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:3224 -
C:\windows\ZKXYQJX.exeC:\windows\ZKXYQJX.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MVOWEUS.exe.bat" "30⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\windows\SysWOW64\MVOWEUS.exeC:\windows\system32\MVOWEUS.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NYRS.exe.bat" "32⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\windows\SysWOW64\NYRS.exeC:\windows\system32\NYRS.exe33⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PWX.exe.bat" "34⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\windows\PWX.exeC:\windows\PWX.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TEEUL.exe.bat" "36⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\windows\TEEUL.exeC:\windows\TEEUL.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5336 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZZDVIO.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\windows\system\ZZDVIO.exeC:\windows\system\ZZDVIO.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EFVLYJI.exe.bat" "40⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\windows\system\EFVLYJI.exeC:\windows\system\EFVLYJI.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CAU.exe.bat" "42⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\windows\SysWOW64\CAU.exeC:\windows\system32\CAU.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MYAGKUH.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:5944 -
C:\windows\MYAGKUH.exeC:\windows\MYAGKUH.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QGHG.exe.bat" "46⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\windows\QGHG.exeC:\windows\QGHG.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ORR.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\windows\system\ORR.exeC:\windows\system\ORR.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YOX.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\windows\YOX.exeC:\windows\YOX.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VPHSYXJ.exe.bat" "52⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:812 -
C:\windows\SysWOW64\VPHSYXJ.exeC:\windows\system32\VPHSYXJ.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DULZJEE.exe.bat" "54⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\windows\SysWOW64\DULZJEE.exeC:\windows\system32\DULZJEE.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5220 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CSFCW.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\windows\SysWOW64\CSFCW.exeC:\windows\system32\CSFCW.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RIGT.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\windows\system\RIGT.exeC:\windows\system\RIGT.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AJAGG.exe.bat" "60⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\windows\AJAGG.exeC:\windows\AJAGG.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EZOGSUR.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:5300 -
C:\windows\system\EZOGSUR.exeC:\windows\system\EZOGSUR.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TUYLD.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\windows\system\TUYLD.exeC:\windows\system\TUYLD.exe65⤵
- Executes dropped EXE
PID:2852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XXW.exe.bat" "66⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3896 -
C:\windows\system\XXW.exeC:\windows\system\XXW.exe67⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BNDGP.exe.bat" "68⤵
- Executes a command shell one-liner
PID:5228 -
C:\windows\system\BNDGP.exeC:\windows\system\BNDGP.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XPLFE.exe.bat" "70⤵PID:2252
-
C:\windows\XPLFE.exeC:\windows\XPLFE.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PTXIJLV.exe.bat" "72⤵
- Executes a command shell one-liner
PID:5820 -
C:\windows\SysWOW64\PTXIJLV.exeC:\windows\system32\PTXIJLV.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KGUS.exe.bat" "74⤵
- System Location Discovery: System Language Discovery
PID:1532 -
C:\windows\system\KGUS.exeC:\windows\system\KGUS.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BOWXX.exe.bat" "76⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4896 -
C:\windows\BOWXX.exeC:\windows\BOWXX.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WBAGHQA.exe.bat" "78⤵
- System Location Discovery: System Language Discovery
PID:4872 -
C:\windows\SysWOW64\WBAGHQA.exeC:\windows\system32\WBAGHQA.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6040 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NKPLUHV.exe.bat" "80⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4148 -
C:\windows\SysWOW64\NKPLUHV.exeC:\windows\system32\NKPLUHV.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WKRRXE.exe.bat" "82⤵PID:2160
-
C:\windows\WKRRXE.exeC:\windows\WKRRXE.exe83⤵
- Executes dropped EXE
PID:5280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IAX.exe.bat" "84⤵
- Executes a command shell one-liner
PID:2472 -
C:\windows\system\IAX.exeC:\windows\system\IAX.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BVBUX.exe.bat" "86⤵
- System Location Discovery: System Language Discovery
PID:5756 -
C:\windows\BVBUX.exeC:\windows\BVBUX.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OGSLD.exe.bat" "88⤵
- Executes a command shell one-liner
PID:2100 -
C:\windows\system\OGSLD.exeC:\windows\system\OGSLD.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2008 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EWTKKL.exe.bat" "90⤵
- Executes a command shell one-liner
PID:1788 -
C:\windows\SysWOW64\EWTKKL.exeC:\windows\system32\EWTKKL.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IMZKWD.exe.bat" "92⤵PID:1736
-
C:\windows\IMZKWD.exeC:\windows\IMZKWD.exe93⤵
- Executes dropped EXE
PID:5224 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IHD.exe.bat" "94⤵PID:2716
-
C:\windows\IHD.exeC:\windows\IHD.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VSMNQE.exe.bat" "96⤵PID:4172
-
C:\windows\system\VSMNQE.exeC:\windows\system\VSMNQE.exe97⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CNL.exe.bat" "98⤵PID:4988
-
C:\windows\CNL.exeC:\windows\CNL.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5680 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PQBMIK.exe.bat" "100⤵
- System Location Discovery: System Language Discovery
PID:4568 -
C:\windows\system\PQBMIK.exeC:\windows\system\PQBMIK.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TGIM.exe.bat" "102⤵PID:5444
-
C:\windows\system\TGIM.exeC:\windows\system\TGIM.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RRL.exe.bat" "104⤵
- System Location Discovery: System Language Discovery
PID:3932 -
C:\windows\RRL.exeC:\windows\RRL.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4620 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SUOYJGC.exe.bat" "106⤵PID:2928
-
C:\windows\SUOYJGC.exeC:\windows\SUOYJGC.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\REZO.exe.bat" "108⤵
- System Location Discovery: System Language Discovery
PID:2872 -
C:\windows\REZO.exeC:\windows\REZO.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GZJSCZ.exe.bat" "110⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2448 -
C:\windows\GZJSCZ.exeC:\windows\GZJSCZ.exe111⤵
- Executes dropped EXE
PID:2568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZDMWI.exe.bat" "112⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1232 -
C:\windows\system\ZDMWI.exeC:\windows\system\ZDMWI.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZGQSNNK.exe.bat" "114⤵
- System Location Discovery: System Language Discovery
PID:5316 -
C:\windows\system\ZGQSNNK.exeC:\windows\system\ZGQSNNK.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2196 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DOXAA.exe.bat" "116⤵
- System Location Discovery: System Language Discovery
PID:6112 -
C:\windows\DOXAA.exeC:\windows\DOXAA.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NWZ.exe.bat" "118⤵PID:1664
-
C:\windows\SysWOW64\NWZ.exeC:\windows\system32\NWZ.exe119⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GOOQUD.exe.bat" "120⤵PID:4748
-
C:\windows\system\GOOQUD.exeC:\windows\system\GOOQUD.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3796
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-