Analysis
- max time kernel
92s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
01/08/2026, 15:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-01_de3e9e21d0041559675b7eadd946ba6a_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-01_de3e9e21d0041559675b7eadd946ba6a_elex_emotet_stop.exe
- Size 208KB
- Sample260801-s3zprastds
- SHA256 0185590c8c6e85aa865ee19641cd3888871860ff16f7c51e641785da4af3e487
- MD5 de3e9e21d0041559675b7eadd946ba6a
- SHA1 f8e736eb8a21ab55f4b0401dbc516a1c0cff255c
- SHA512 f5bf6b200805c093299700ffb8f749fa44f6303aee98a131f2d38ed8337e3d7ce96b7d8e86d155388f8ede6769b2adc55e3ae4391a954647486d2df7982e9e19
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlUtL+LOfj4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFlUp+LObkEj1
- TLSH T1D3247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2040 PRJAEC.exe 996 USFV.exe 4696 GDIIAX.exe 5800 VYZULRC.exe 5972 ZBXHL.exe 5272 DREP.exe 2184 WJTAOWI.exe 5828 YHZNWER.exe 5612 EUYVBHG.exe 4084 SFHMPSC.exe 2140 HVIL.exe 2928 UGYK.exe 1240 KWZCI.exe 5812 UUFWQ.exe 5640 YCLWCEF.exe 4452 QFPAPU.exe 5832 LQGY.exe 776 ELJUJV.exe 4940 UBKT.exe 5600 QGDJY.exe 2156 YUHP.exe 5572 XFK.exe 3200 HCYSZH.exe 5304 JADMO.exe 4928 PWCVTK.exe 5920 QRGQY.exe 2668 BRW.exe 3296 UKD.exe 1472 JAMMYXB.exe 5192 NITM.exe 4284 RYZUWA.exe 2740 STDQC.exe 2068 WJK.exe 3632 JHKBYU.exe 2620 DZZMHV.exe 1196 ZAJXL.exe 1304 DQQ.exe 3324 HYWFJ.exe 1832 IBAA.exe 2444 MJHABJ.exe 2288 DRJ.exe 6100 YEOXP.exe 4176 CMUXBZV.exe 6064 AFXNKN.exe 4828 CDLHR.exe 264 OWGAZDH.exe 940 AEUA.exe 5528 SHYERL.exe 4192 TKCZX.exe 4104 CKEFAY.exe 5956 BAPHV.exe 5560 ZTAX.exe 3328 PJBPCFJ.exe 908 JWGY.exe 4576 RBK.exe 5976 VRRNJW.exe 1396 JUHM.exe 4232 ADJRB.exe 3928 GDREKGG.exe 1288 RVM.exe 4152 RBMM.exe 2344 MORVEA.exe 3380 GKW.exe 936 BXBO.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\DREP.exe ZBXHL.exe File opened for modification C:\windows\SysWOW64\NOAPME.exe YLR.exe File opened for modification C:\windows\SysWOW64\GDIIAX.exe USFV.exe File created C:\windows\SysWOW64\EUYVBHG.exe.bat YHZNWER.exe File created C:\windows\SysWOW64\OWGAZDH.exe CDLHR.exe File created C:\windows\SysWOW64\NOAPME.exe.bat YLR.exe File opened for modification C:\windows\SysWOW64\DVOID.exe SCTP.exe File created C:\windows\SysWOW64\GDIIAX.exe USFV.exe File created C:\windows\SysWOW64\QGDJY.exe UBKT.exe File created C:\windows\SysWOW64\XFK.exe YUHP.exe File created C:\windows\SysWOW64\MJHABJ.exe IBAA.exe File created C:\windows\SysWOW64\OUTWFC.exe.bat KMM.exe File created C:\windows\SysWOW64\EUYVBHG.exe YHZNWER.exe File created C:\windows\SysWOW64\CKEFAY.exe.bat TKCZX.exe File opened for modification C:\windows\SysWOW64\NFHODSF.exe BXBO.exe File opened for modification C:\windows\SysWOW64\URM.exe QBXQG.exe File opened for modification C:\windows\SysWOW64\KGAOYM.exe EFT.exe File created C:\windows\SysWOW64\JVTMOX.exe.bat PHPC.exe File opened for modification C:\windows\SysWOW64\OWGAZDH.exe CDLHR.exe File created C:\windows\SysWOW64\URM.exe.bat QBXQG.exe File created C:\windows\SysWOW64\PHPC.exe XZV.exe File created C:\windows\SysWOW64\PHPC.exe.bat XZV.exe File created C:\windows\SysWOW64\JUHM.exe.bat VRRNJW.exe File opened for modification C:\windows\SysWOW64\HACV.exe XRA.exe File created C:\windows\SysWOW64\GDREKGG.exe.bat ADJRB.exe File opened for modification C:\windows\SysWOW64\WGKDMU.exe LOHSEN.exe File created C:\windows\SysWOW64\HACV.exe XRA.exe File opened for modification C:\windows\SysWOW64\PTB.exe AYSUG.exe File opened for modification C:\windows\SysWOW64\UKD.exe BRW.exe File created C:\windows\SysWOW64\CKEFAY.exe TKCZX.exe File created C:\windows\SysWOW64\OUTWFC.exe KMM.exe File opened for modification C:\windows\SysWOW64\QGDJY.exe UBKT.exe File created C:\windows\SysWOW64\BXBO.exe.bat GKW.exe File opened for modification C:\windows\SysWOW64\KMM.exe PZHNJK.exe File created C:\windows\SysWOW64\URM.exe QBXQG.exe File created C:\windows\SysWOW64\JVTMOX.exe PHPC.exe File opened for modification C:\windows\SysWOW64\PRJAEC.exe 2026-08-01_de3e9e21d0041559675b7eadd946ba6a_elex_emotet_stop.exe File opened for modification C:\windows\SysWOW64\VEBG.exe NOAPME.exe File created C:\windows\SysWOW64\DREP.exe.bat ZBXHL.exe File opened for modification C:\windows\SysWOW64\CKEFAY.exe TKCZX.exe File created C:\windows\SysWOW64\MORVEA.exe.bat RBMM.exe File created C:\windows\SysWOW64\ZAJXL.exe.bat DZZMHV.exe File opened for modification C:\windows\SysWOW64\MORVEA.exe RBMM.exe File opened for modification C:\windows\SysWOW64\OFRIC.exe URM.exe File created C:\windows\SysWOW64\SHYERL.exe AEUA.exe File created C:\windows\SysWOW64\TKCZX.exe.bat SHYERL.exe File opened for modification C:\windows\SysWOW64\JVTMOX.exe PHPC.exe File created C:\windows\SysWOW64\PRJAEC.exe.bat 2026-08-01_de3e9e21d0041559675b7eadd946ba6a_elex_emotet_stop.exe File created C:\windows\SysWOW64\JADMO.exe HCYSZH.exe File created C:\windows\SysWOW64\BRW.exe.bat QRGQY.exe File opened for modification C:\windows\SysWOW64\TKCZX.exe SHYERL.exe File created C:\windows\SysWOW64\MJUP.exe WGKDMU.exe File created C:\windows\SysWOW64\HACV.exe.bat XRA.exe File opened for modification C:\windows\SysWOW64\SHYERL.exe AEUA.exe File created C:\windows\SysWOW64\JUHM.exe VRRNJW.exe File created C:\windows\SysWOW64\MXKOO.exe.bat XCAKDZQ.exe File created C:\windows\SysWOW64\WGKDMU.exe LOHSEN.exe File created C:\windows\SysWOW64\OFRIC.exe.bat URM.exe File created C:\windows\SysWOW64\BRW.exe QRGQY.exe File opened for modification C:\windows\SysWOW64\XFK.exe YUHP.exe File opened for modification C:\windows\SysWOW64\MJHABJ.exe IBAA.exe File created C:\windows\SysWOW64\DVOID.exe.bat SCTP.exe File opened for modification C:\windows\SysWOW64\MJUP.exe WGKDMU.exe File created C:\windows\SysWOW64\OFRIC.exe URM.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\VYZULRC.exe GDIIAX.exe File opened for modification C:\windows\system\UBKT.exe ELJUJV.exe File opened for modification C:\windows\system\CDLHR.exe AFXNKN.exe File created C:\windows\EFT.exe JSORES.exe File created C:\windows\system\XZV.exe.bat KOEZM.exe File created C:\windows\system\ZBXHL.exe.bat VYZULRC.exe File created C:\windows\VOBH.exe.bat PTB.exe File created C:\windows\QBXQG.exe.bat VOBH.exe File created C:\windows\system\KOEZM.exe BOCUJSB.exe File created C:\windows\PWCVTK.exe.bat JADMO.exe File created C:\windows\QRGQY.exe.bat PWCVTK.exe File created C:\windows\RVOW.exe.bat NFHODSF.exe File opened for modification C:\windows\system\SXT.exe MXM.exe File created C:\windows\YXZFOX.exe DKUW.exe File created C:\windows\YEOXP.exe.bat DRJ.exe File created C:\windows\YUHP.exe QGDJY.exe File created C:\windows\system\ROSI.exe RJA.exe File created C:\windows\system\STE.exe YXZFOX.exe File opened for modification C:\windows\YUHP.exe QGDJY.exe File opened for modification C:\windows\ADJRB.exe JUHM.exe File created C:\windows\system\YHZNWER.exe.bat WJTAOWI.exe File opened for modification C:\windows\JAMMYXB.exe UKD.exe File created C:\windows\system\RVM.exe.bat GDREKGG.exe File opened for modification C:\windows\QBXQG.exe VOBH.exe File opened for modification C:\windows\system\AEUA.exe OWGAZDH.exe File opened for modification C:\windows\system\BEJCKTO.exe VEBG.exe File opened for modification C:\windows\system\PWEJD.exe JVWVURQ.exe File created C:\windows\system\XLCZENO.exe EIY.exe File opened for modification C:\windows\system\XLCZENO.exe EIY.exe File opened for modification C:\windows\system\HCYSZH.exe XFK.exe File opened for modification C:\windows\HVIL.exe SFHMPSC.exe File created C:\windows\system\NITM.exe.bat JAMMYXB.exe File created C:\windows\system\RBK.exe.bat JWGY.exe File created C:\windows\VRRNJW.exe.bat RBK.exe File opened for modification C:\windows\AYSUG.exe LIJDZPI.exe File created C:\windows\system\SFHMPSC.exe EUYVBHG.exe File created C:\windows\CMUXBZV.exe.bat YEOXP.exe File created C:\windows\SCTP.exe SXT.exe File created C:\windows\ZTAX.exe BAPHV.exe File created C:\windows\ADJRB.exe JUHM.exe File created C:\windows\USFV.exe PRJAEC.exe File created C:\windows\UUFWQ.exe.bat KWZCI.exe File created C:\windows\system\RYZUWA.exe.bat NITM.exe File created C:\windows\system\STDQC.exe RYZUWA.exe File created C:\windows\system\SXT.exe.bat MXM.exe File opened for modification C:\windows\SCTP.exe SXT.exe File opened for modification C:\windows\system\JSORES.exe OFRIC.exe File opened for modification C:\windows\system\XVVKYFC.exe RVOW.exe File created C:\windows\JVWVURQ.exe.bat DVOID.exe File opened for modification C:\windows\PZHNJK.exe PWEJD.exe File created C:\windows\LOHSEN.exe STE.exe File opened for modification C:\windows\system\RYZUWA.exe NITM.exe File opened for modification C:\windows\system\DQQ.exe ZAJXL.exe File created C:\windows\SCTP.exe.bat SXT.exe File opened for modification C:\windows\JVWVURQ.exe DVOID.exe File created C:\windows\system\UGYK.exe HVIL.exe File opened for modification C:\windows\system\NITM.exe JAMMYXB.exe File opened for modification C:\windows\YEOXP.exe DRJ.exe File opened for modification C:\windows\YLR.exe QFQWAEM.exe File opened for modification C:\windows\system\UGYK.exe HVIL.exe File created C:\windows\system\YCLWCEF.exe UUFWQ.exe File opened for modification C:\windows\system\SFHMPSC.exe EUYVBHG.exe File created C:\windows\system\SFHMPSC.exe.bat EUYVBHG.exe File created C:\windows\system\YCLWCEF.exe.bat UUFWQ.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4916 cmd.exe 2692 cmd.exe 2308 cmd.exe 792 cmd.exe 1088 cmd.exe 296 cmd.exe 4468 cmd.exe 3364 cmd.exe 5644 cmd.exe 432 cmd.exe 4116 cmd.exe 1560 cmd.exe 4924 cmd.exe 716 cmd.exe 3524 cmd.exe 4988 cmd.exe 5896 cmd.exe 5568 cmd.exe 1808 cmd.exe 2648 cmd.exe 3800 cmd.exe 916 cmd.exe 1444 cmd.exe 2260 cmd.exe 1216 cmd.exe 108 cmd.exe 5180 cmd.exe 3884 cmd.exe 1348 cmd.exe 2348 cmd.exe 1508 cmd.exe 2932 cmd.exe 4804 cmd.exe 2164 cmd.exe 5632 cmd.exe 3708 cmd.exe 4532 cmd.exe 5820 cmd.exe 3428 cmd.exe 5648 cmd.exe 3656 cmd.exe 1388 cmd.exe 4196 cmd.exe 2096 cmd.exe 3100 cmd.exe 4080 cmd.exe 5420 cmd.exe 1148 cmd.exe 3116 cmd.exe 4264 cmd.exe 1704 cmd.exe 3436 cmd.exe 2356 cmd.exe 1268 cmd.exe 5996 cmd.exe 2588 cmd.exe 2876 cmd.exe 1604 cmd.exe 5112 cmd.exe 5016 cmd.exe 5220 cmd.exe 5932 cmd.exe 3412 cmd.exe 1700 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 5496 2912 WerFault.exe 87 4480 2040 WerFault.exe 93 4464 996 WerFault.exe 98 2448 4696 WerFault.exe 104 1488 5800 WerFault.exe 109 2096 5972 WerFault.exe 114 4796 5272 WerFault.exe 119 5480 2184 WerFault.exe 124 4380 5828 WerFault.exe 129 3216 5612 WerFault.exe 134 5564 4084 WerFault.exe 139 6064 2140 WerFault.exe 144 5960 2928 WerFault.exe 149 3356 1240 WerFault.exe 154 3908 5812 WerFault.exe 159 3156 5640 WerFault.exe 164 2528 4452 WerFault.exe 169 4996 5832 WerFault.exe 174 3252 776 WerFault.exe 179 3160 4940 WerFault.exe 184 5784 5600 WerFault.exe 189 5268 2156 WerFault.exe 194 2160 5572 WerFault.exe 199 1800 3200 WerFault.exe 204 5748 5304 WerFault.exe 209 2592 4928 WerFault.exe 214 1792 5920 WerFault.exe 219 3092 2668 WerFault.exe 224 1524 3296 WerFault.exe 229 4104 1472 WerFault.exe 234 2548 5192 WerFault.exe 239 3684 4284 WerFault.exe 244 3784 2740 WerFault.exe 249 4636 2068 WerFault.exe 254 1816 3632 WerFault.exe 259 4396 2620 WerFault.exe 264 1264 1196 WerFault.exe 269 5180 1304 WerFault.exe 274 4260 3324 WerFault.exe 279 5792 1832 WerFault.exe 284 604 2444 WerFault.exe 289 3364 2288 WerFault.exe 294 4244 6100 WerFault.exe 299 1012 4176 WerFault.exe 304 5552 6064 WerFault.exe 309 4560 4828 WerFault.exe 314 4400 264 WerFault.exe 319 5996 940 WerFault.exe 324 2388 5528 WerFault.exe 329 1948 4192 WerFault.exe 334 2472 4104 WerFault.exe 339 4196 5956 WerFault.exe 344 4596 5560 WerFault.exe 349 432 3328 WerFault.exe 354 3056 908 WerFault.exe 359 3580 4576 WerFault.exe 364 5404 5976 WerFault.exe 369 296 1396 WerFault.exe 374 5116 4232 WerFault.exe 379 3392 3928 WerFault.exe 384 1052 1288 WerFault.exe 389 3452 4152 WerFault.exe 394 4968 2344 WerFault.exe 399 5440 3380 WerFault.exe 404 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WJK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SHYERL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RVOW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language STE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PJBPCFJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LOHSEN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language USFV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language STDQC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JHKBYU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMUXBZV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JVWVURQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WGKDMU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAMMYXB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MJXRUR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YXZFOX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JADMO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RBK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VEBG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JVTMOX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZBXHL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NFHODSF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SCTP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DVOID.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZTAX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RJA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LQGY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BEJCKTO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VRRNJW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DQQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QBXQG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YCLWCEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AFXNKN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2912 2026-08-01_de3e9e21d0041559675b7eadd946ba6a_elex_emotet_stop.exe 2912 2026-08-01_de3e9e21d0041559675b7eadd946ba6a_elex_emotet_stop.exe 2040 PRJAEC.exe 2040 PRJAEC.exe 996 USFV.exe 996 USFV.exe 4696 GDIIAX.exe 4696 GDIIAX.exe 5800 VYZULRC.exe 5800 VYZULRC.exe 5972 ZBXHL.exe 5972 ZBXHL.exe 5272 DREP.exe 5272 DREP.exe 2184 WJTAOWI.exe 2184 WJTAOWI.exe 5828 YHZNWER.exe 5828 YHZNWER.exe 5612 EUYVBHG.exe 5612 EUYVBHG.exe 4084 SFHMPSC.exe 4084 SFHMPSC.exe 2140 HVIL.exe 2140 HVIL.exe 2928 UGYK.exe 2928 UGYK.exe 1240 KWZCI.exe 1240 KWZCI.exe 5812 UUFWQ.exe 5812 UUFWQ.exe 5640 YCLWCEF.exe 5640 YCLWCEF.exe 4452 QFPAPU.exe 4452 QFPAPU.exe 5832 LQGY.exe 5832 LQGY.exe 776 ELJUJV.exe 776 ELJUJV.exe 4940 UBKT.exe 4940 UBKT.exe 5600 QGDJY.exe 5600 QGDJY.exe 2156 YUHP.exe 2156 YUHP.exe 5572 XFK.exe 5572 XFK.exe 3200 HCYSZH.exe 3200 HCYSZH.exe 5304 JADMO.exe 5304 JADMO.exe 4928 PWCVTK.exe 4928 PWCVTK.exe 5920 QRGQY.exe 5920 QRGQY.exe 2668 BRW.exe 2668 BRW.exe 3296 UKD.exe 3296 UKD.exe 1472 JAMMYXB.exe 1472 JAMMYXB.exe 5192 NITM.exe 5192 NITM.exe 4284 RYZUWA.exe 4284 RYZUWA.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2912 2026-08-01_de3e9e21d0041559675b7eadd946ba6a_elex_emotet_stop.exe 2912 2026-08-01_de3e9e21d0041559675b7eadd946ba6a_elex_emotet_stop.exe 2040 PRJAEC.exe 2040 PRJAEC.exe 996 USFV.exe 996 USFV.exe 4696 GDIIAX.exe 4696 GDIIAX.exe 5800 VYZULRC.exe 5800 VYZULRC.exe 5972 ZBXHL.exe 5972 ZBXHL.exe 5272 DREP.exe 5272 DREP.exe 2184 WJTAOWI.exe 2184 WJTAOWI.exe 5828 YHZNWER.exe 5828 YHZNWER.exe 5612 EUYVBHG.exe 5612 EUYVBHG.exe 4084 SFHMPSC.exe 4084 SFHMPSC.exe 2140 HVIL.exe 2140 HVIL.exe 2928 UGYK.exe 2928 UGYK.exe 1240 KWZCI.exe 1240 KWZCI.exe 5812 UUFWQ.exe 5812 UUFWQ.exe 5640 YCLWCEF.exe 5640 YCLWCEF.exe 4452 QFPAPU.exe 4452 QFPAPU.exe 5832 LQGY.exe 5832 LQGY.exe 776 ELJUJV.exe 776 ELJUJV.exe 4940 UBKT.exe 4940 UBKT.exe 5600 QGDJY.exe 5600 QGDJY.exe 2156 YUHP.exe 2156 YUHP.exe 5572 XFK.exe 5572 XFK.exe 3200 HCYSZH.exe 3200 HCYSZH.exe 5304 JADMO.exe 5304 JADMO.exe 4928 PWCVTK.exe 4928 PWCVTK.exe 5920 QRGQY.exe 5920 QRGQY.exe 2668 BRW.exe 2668 BRW.exe 3296 UKD.exe 3296 UKD.exe 1472 JAMMYXB.exe 1472 JAMMYXB.exe 5192 NITM.exe 5192 NITM.exe 4284 RYZUWA.exe 4284 RYZUWA.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2912 wrote to memory of 4312 2912 2026-08-01_de3e9e21d0041559675b7eadd946ba6a_elex_emotet_stop.exe 89 PID 4312 wrote to memory of 2040 4312 cmd.exe 93 PID 2040 wrote to memory of 3384 2040 PRJAEC.exe 95 PID 3384 wrote to memory of 996 3384 cmd.exe 98 PID 996 wrote to memory of 3212 996 USFV.exe 100 PID 3212 wrote to memory of 4696 3212 cmd.exe 104 PID 4696 wrote to memory of 4804 4696 GDIIAX.exe 105 PID 4804 wrote to memory of 5800 4804 cmd.exe 109 PID 5800 wrote to memory of 4256 5800 VYZULRC.exe 110 PID 4256 wrote to memory of 5972 4256 cmd.exe 114 PID 5972 wrote to memory of 2420 5972 ZBXHL.exe 115 PID 2420 wrote to memory of 5272 2420 cmd.exe 119 PID 5272 wrote to memory of 2164 5272 DREP.exe 120 PID 2164 wrote to memory of 2184 2164 cmd.exe 124 PID 2184 wrote to memory of 4052 2184 WJTAOWI.exe 125 PID 4052 wrote to memory of 5828 4052 cmd.exe 129 PID 5828 wrote to memory of 5736 5828 YHZNWER.exe 130 PID 5736 wrote to memory of 5612 5736 cmd.exe 134 PID 5612 wrote to memory of 5896 5612 EUYVBHG.exe 135 PID 5896 wrote to memory of 4084 5896 cmd.exe 139 PID 4084 wrote to memory of 2136 4084 SFHMPSC.exe 140 PID 2136 wrote to memory of 2140 2136 cmd.exe 144 PID 2140 wrote to memory of 3792 2140 HVIL.exe 145 PID 3792 wrote to memory of 2928 3792 cmd.exe 149 PID 2928 wrote to memory of 4168 2928 UGYK.exe 150 PID 4168 wrote to memory of 1240 4168 cmd.exe 154 PID 1240 wrote to memory of 5392 1240 KWZCI.exe 155 PID 5392 wrote to memory of 5812 5392 cmd.exe 159 PID 5812 wrote to memory of 4916 5812 UUFWQ.exe 160 PID 4916 wrote to memory of 5640 4916 cmd.exe 164 PID 5640 wrote to memory of 2868 5640 YCLWCEF.exe 165 PID 2868 wrote to memory of 4452 2868 cmd.exe 169 PID 4452 wrote to memory of 2804 4452 QFPAPU.exe 170 PID 2804 wrote to memory of 5832 2804 cmd.exe 174 PID 5832 wrote to memory of 6104 5832 LQGY.exe 175 PID 6104 wrote to memory of 776 6104 cmd.exe 179 PID 776 wrote to memory of 5068 776 ELJUJV.exe 180 PID 5068 wrote to memory of 4940 5068 cmd.exe 184 PID 4940 wrote to memory of 1336 4940 UBKT.exe 185 PID 1336 wrote to memory of 5600 1336 cmd.exe 189 PID 5600 wrote to memory of 1384 5600 QGDJY.exe 190 PID 1384 wrote to memory of 2156 1384 cmd.exe 194 PID 2156 wrote to memory of 5620 2156 YUHP.exe 195 PID 5620 wrote to memory of 5572 5620 cmd.exe 199 PID 5572 wrote to memory of 5644 5572 XFK.exe 200 PID 5644 wrote to memory of 3200 5644 cmd.exe 204 PID 3200 wrote to memory of 2544 3200 HCYSZH.exe 205 PID 2544 wrote to memory of 5304 2544 cmd.exe 209 PID 5304 wrote to memory of 4884 5304 JADMO.exe 210 PID 4884 wrote to memory of 4928 4884 cmd.exe 214 PID 4928 wrote to memory of 2296 4928 PWCVTK.exe 215 PID 2296 wrote to memory of 5920 2296 cmd.exe 219 PID 5920 wrote to memory of 2572 5920 QRGQY.exe 220 PID 2572 wrote to memory of 2668 2572 cmd.exe 224 PID 2668 wrote to memory of 2724 2668 BRW.exe 225 PID 2724 wrote to memory of 3296 2724 cmd.exe 229 PID 3296 wrote to memory of 1216 3296 UKD.exe 230 PID 1216 wrote to memory of 1472 1216 cmd.exe 234 PID 1472 wrote to memory of 1780 1472 JAMMYXB.exe 235 PID 1780 wrote to memory of 5192 1780 cmd.exe 239 PID 5192 wrote to memory of 5448 5192 NITM.exe 240 PID 5448 wrote to memory of 4284 5448 cmd.exe 244 PID 4284 wrote to memory of 5856 4284 RYZUWA.exe 245 PID 5856 wrote to memory of 2740 5856 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-01_de3e9e21d0041559675b7eadd946ba6a_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-01_de3e9e21d0041559675b7eadd946ba6a_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PRJAEC.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\windows\SysWOW64\PRJAEC.exeC:\windows\system32\PRJAEC.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\USFV.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\windows\USFV.exeC:\windows\USFV.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GDIIAX.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\windows\SysWOW64\GDIIAX.exeC:\windows\system32\GDIIAX.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VYZULRC.exe.bat" "8⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\windows\VYZULRC.exeC:\windows\VYZULRC.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZBXHL.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\windows\system\ZBXHL.exeC:\windows\system\ZBXHL.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DREP.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\windows\SysWOW64\DREP.exeC:\windows\system32\DREP.exe13⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5272 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WJTAOWI.exe.bat" "14⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\windows\WJTAOWI.exeC:\windows\WJTAOWI.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YHZNWER.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:4052 -
C:\windows\system\YHZNWER.exeC:\windows\system\YHZNWER.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EUYVBHG.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:5736 -
C:\windows\SysWOW64\EUYVBHG.exeC:\windows\system32\EUYVBHG.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SFHMPSC.exe.bat" "20⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5896 -
C:\windows\system\SFHMPSC.exeC:\windows\system\SFHMPSC.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HVIL.exe.bat" "22⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\windows\HVIL.exeC:\windows\HVIL.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UGYK.exe.bat" "24⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3792 -
C:\windows\system\UGYK.exeC:\windows\system\UGYK.exe25⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KWZCI.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\windows\system\KWZCI.exeC:\windows\system\KWZCI.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UUFWQ.exe.bat" "28⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5392 -
C:\windows\UUFWQ.exeC:\windows\UUFWQ.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YCLWCEF.exe.bat" "30⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\windows\system\YCLWCEF.exeC:\windows\system\YCLWCEF.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QFPAPU.exe.bat" "32⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\windows\QFPAPU.exeC:\windows\QFPAPU.exe33⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LQGY.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\windows\LQGY.exeC:\windows\LQGY.exe35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ELJUJV.exe.bat" "36⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6104 -
C:\windows\system\ELJUJV.exeC:\windows\system\ELJUJV.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UBKT.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\windows\system\UBKT.exeC:\windows\system\UBKT.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QGDJY.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\windows\SysWOW64\QGDJY.exeC:\windows\system32\QGDJY.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YUHP.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\windows\YUHP.exeC:\windows\YUHP.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XFK.exe.bat" "44⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5620 -
C:\windows\SysWOW64\XFK.exeC:\windows\system32\XFK.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HCYSZH.exe.bat" "46⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5644 -
C:\windows\system\HCYSZH.exeC:\windows\system\HCYSZH.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JADMO.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\windows\SysWOW64\JADMO.exeC:\windows\system32\JADMO.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PWCVTK.exe.bat" "50⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\windows\PWCVTK.exeC:\windows\PWCVTK.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QRGQY.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\windows\QRGQY.exeC:\windows\QRGQY.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BRW.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\windows\SysWOW64\BRW.exeC:\windows\system32\BRW.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UKD.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\windows\SysWOW64\UKD.exeC:\windows\system32\UKD.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JAMMYXB.exe.bat" "58⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\windows\JAMMYXB.exeC:\windows\JAMMYXB.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NITM.exe.bat" "60⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\windows\system\NITM.exeC:\windows\system\NITM.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5192 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RYZUWA.exe.bat" "62⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5448 -
C:\windows\system\RYZUWA.exeC:\windows\system\RYZUWA.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\STDQC.exe.bat" "64⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5856 -
C:\windows\system\STDQC.exeC:\windows\system\STDQC.exe65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WJK.exe.bat" "66⤵PID:4352
-
C:\windows\system\WJK.exeC:\windows\system\WJK.exe67⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JHKBYU.exe.bat" "68⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1148 -
C:\windows\JHKBYU.exeC:\windows\JHKBYU.exe69⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3632 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DZZMHV.exe.bat" "70⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5648 -
C:\windows\DZZMHV.exeC:\windows\DZZMHV.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2620 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZAJXL.exe.bat" "72⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3116 -
C:\windows\SysWOW64\ZAJXL.exeC:\windows\system32\ZAJXL.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1196 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DQQ.exe.bat" "74⤵
- Executes a command shell one-liner
PID:5632 -
C:\windows\system\DQQ.exeC:\windows\system\DQQ.exe75⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HYWFJ.exe.bat" "76⤵
- Executes a command shell one-liner
PID:5568 -
C:\windows\HYWFJ.exeC:\windows\HYWFJ.exe77⤵
- Executes dropped EXE
PID:3324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IBAA.exe.bat" "78⤵PID:1068
-
C:\windows\IBAA.exeC:\windows\IBAA.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MJHABJ.exe.bat" "80⤵PID:596
-
C:\windows\SysWOW64\MJHABJ.exeC:\windows\system32\MJHABJ.exe81⤵
- Executes dropped EXE
PID:2444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DRJ.exe.bat" "82⤵
- System Location Discovery: System Language Discovery
PID:1568 -
C:\windows\system\DRJ.exeC:\windows\system\DRJ.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2288 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YEOXP.exe.bat" "84⤵
- System Location Discovery: System Language Discovery
PID:2700 -
C:\windows\YEOXP.exeC:\windows\YEOXP.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CMUXBZV.exe.bat" "86⤵PID:4684
-
C:\windows\CMUXBZV.exeC:\windows\CMUXBZV.exe87⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4176 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AFXNKN.exe.bat" "88⤵
- Executes a command shell one-liner
PID:5932 -
C:\windows\AFXNKN.exeC:\windows\AFXNKN.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CDLHR.exe.bat" "90⤵
- System Location Discovery: System Language Discovery
PID:1816 -
C:\windows\system\CDLHR.exeC:\windows\system\CDLHR.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OWGAZDH.exe.bat" "92⤵PID:4236
-
C:\windows\SysWOW64\OWGAZDH.exeC:\windows\system32\OWGAZDH.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AEUA.exe.bat" "94⤵
- System Location Discovery: System Language Discovery
PID:3356 -
C:\windows\system\AEUA.exeC:\windows\system\AEUA.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SHYERL.exe.bat" "96⤵PID:4860
-
C:\windows\SysWOW64\SHYERL.exeC:\windows\system32\SHYERL.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5528 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TKCZX.exe.bat" "98⤵PID:1592
-
C:\windows\SysWOW64\TKCZX.exeC:\windows\system32\TKCZX.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4192 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CKEFAY.exe.bat" "100⤵
- System Location Discovery: System Language Discovery
PID:1152 -
C:\windows\SysWOW64\CKEFAY.exeC:\windows\system32\CKEFAY.exe101⤵
- Executes dropped EXE
PID:4104 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BAPHV.exe.bat" "102⤵PID:4656
-
C:\windows\system\BAPHV.exeC:\windows\system\BAPHV.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZTAX.exe.bat" "104⤵
- Executes a command shell one-liner
PID:1808 -
C:\windows\ZTAX.exeC:\windows\ZTAX.exe105⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PJBPCFJ.exe.bat" "106⤵
- Executes a command shell one-liner
PID:1268 -
C:\windows\system\PJBPCFJ.exeC:\windows\system\PJBPCFJ.exe107⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3328 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JWGY.exe.bat" "108⤵PID:5556
-
C:\windows\system\JWGY.exeC:\windows\system\JWGY.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RBK.exe.bat" "110⤵
- System Location Discovery: System Language Discovery
PID:4480 -
C:\windows\system\RBK.exeC:\windows\system\RBK.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VRRNJW.exe.bat" "112⤵PID:1280
-
C:\windows\VRRNJW.exeC:\windows\VRRNJW.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JUHM.exe.bat" "114⤵PID:3168
-
C:\windows\SysWOW64\JUHM.exeC:\windows\system32\JUHM.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ADJRB.exe.bat" "116⤵
- Executes a command shell one-liner
PID:5996 -
C:\windows\ADJRB.exeC:\windows\ADJRB.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4232 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GDREKGG.exe.bat" "118⤵
- Executes a command shell one-liner
PID:2648 -
C:\windows\SysWOW64\GDREKGG.exeC:\windows\system32\GDREKGG.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RVM.exe.bat" "120⤵PID:5668
-
C:\windows\system\RVM.exeC:\windows\system\RVM.exe121⤵
- Executes dropped EXE
PID:1288
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-