Analysis
- max time kernel
88s - max time network
132s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/08/2026, 02:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-02_a371e5917137361c90f4d72e84cbb3e7_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-02_a371e5917137361c90f4d72e84cbb3e7_elex_emotet_stop.exe
- Size 208KB
- Sample260802-dafc3ssfrf
- SHA256 40b817578b0a58b2c597298484966a20084e279a33b3f75534ae2d9b4d4d6e5b
- MD5 a371e5917137361c90f4d72e84cbb3e7
- SHA1 83541dee21182bb6e957afc40c380c3a7a70be05
- SHA512 e9db69a65c01200ea66bc9fbd1bd7557c96512a58c866e1805ac5570bd83a0a7f36284990436d398d43f7fb93a12988d6efdd4f446189df44147f57b86099196
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlUWL+LOfo4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFlUu+LOwkEj1
- TLSH T1C1247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2528 ZEZI.exe 2340 IXKPC.exe 2776 DDKA.exe 1840 YQBK.exe 2852 FWI.exe 1368 BBAUTV.exe 1760 PHAGVHO.exe 1276 SURIOA.exe 4472 MIWRRAS.exe 2432 AOW.exe 4284 CBNM.exe 1568 HBX.exe 2684 UEFFEE.exe 2536 YPDA.exe 1316 CXKIYQ.exe 4740 WQATHQ.exe 960 LGBL.exe 3092 EJEOUC.exe 5220 TEOT.exe 2624 RPZ.exe 6120 KSCFT.exe 904 WIJNFDM.exe 4440 PDNISB.exe 5500 GLP.exe 1352 NGYAHL.exe 1012 ZWF.exe 2192 SRJDZTO.exe 3588 JZL.exe 1532 LXY.exe 2472 RXG.exe 612 STKMGRJ.exe 988 BBM.exe 3544 FJSZE.exe 1544 WRUEHMC.exe 3748 DMEJS.exe 1120 VVG.exe 5504 PILFG.exe 4296 ZINKJC.exe 5972 ZLQ.exe 4936 UYVQZ.exe 3696 PMAHJR.exe 3324 GZKZ.exe 2956 EUCAE.exe 5268 TPT.exe 2564 BVLT.exe 1244 ZVTGHT.exe 3648 ZYXKN.exe 1648 UMCTXJP.exe 4672 AMJHGLQ.exe 4912 ECQHSD.exe 4120 TSR.exe 3724 XAFHD.exe 3860 SNKQNJM.exe 1224 QGNGWP.exe 4236 CZQZEEP.exe 4716 WMNI.exe 5712 CMUWYY.exe 5904 INC.exe 4556 OIBS.exe 4612 BLSJ.exe 696 LTMODM.exe 460 WMPHDTJ.exe 2196 CMWVUNK.exe 5440 IMEI.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\NCMRR.exe FWMC.exe File created C:\windows\SysWOW64\QDBSR.exe TCUFILM.exe File opened for modification C:\windows\SysWOW64\QDBSR.exe TCUFILM.exe File created C:\windows\SysWOW64\UYVQZ.exe.bat ZLQ.exe File opened for modification C:\windows\SysWOW64\BMTJVX.exe EHNMOO.exe File created C:\windows\SysWOW64\QHDN.exe BMTJVX.exe File opened for modification C:\windows\SysWOW64\FNIKV.exe QHDN.exe File created C:\windows\SysWOW64\EJEOUC.exe LGBL.exe File created C:\windows\SysWOW64\PDNISB.exe WIJNFDM.exe File created C:\windows\SysWOW64\EUCAE.exe GZKZ.exe File opened for modification C:\windows\SysWOW64\IMEI.exe CMWVUNK.exe File opened for modification C:\windows\SysWOW64\OQI.exe BNRKZ.exe File created C:\windows\SysWOW64\WNEO.exe.bat QNXAMMQ.exe File opened for modification C:\windows\SysWOW64\JHYFEBL.exe WWQO.exe File created C:\windows\SysWOW64\OQI.exe BNRKZ.exe File created C:\windows\SysWOW64\NCMRR.exe FWMC.exe File opened for modification C:\windows\SysWOW64\MVE.exe ADOOF.exe File created C:\windows\SysWOW64\RXG.exe.bat LXY.exe File created C:\windows\SysWOW64\CFOEXGV.exe KKKJ.exe File created C:\windows\SysWOW64\BNRKZ.exe THRW.exe File created C:\windows\SysWOW64\HGF.exe NTBZXH.exe File created C:\windows\SysWOW64\YPDA.exe UEFFEE.exe File created C:\windows\SysWOW64\DLAW.exe.bat GLSJDXA.exe File created C:\windows\SysWOW64\AMJHGLQ.exe.bat UMCTXJP.exe File created C:\windows\SysWOW64\XAFHD.exe.bat TSR.exe File created C:\windows\SysWOW64\MVE.exe ADOOF.exe File created C:\windows\SysWOW64\WIJNFDM.exe.bat KSCFT.exe File created C:\windows\SysWOW64\FJSZE.exe.bat BBM.exe File created C:\windows\SysWOW64\WRUEHMC.exe.bat FJSZE.exe File opened for modification C:\windows\SysWOW64\TPT.exe EUCAE.exe File created C:\windows\SysWOW64\ZVTGHT.exe.bat BVLT.exe File created C:\windows\SysWOW64\FNIKV.exe.bat QHDN.exe File opened for modification C:\windows\SysWOW64\DBAJQJ.exe IGVSG.exe File created C:\windows\SysWOW64\PMAHJR.exe UYVQZ.exe File created C:\windows\SysWOW64\EUCAE.exe.bat GZKZ.exe File created C:\windows\SysWOW64\EHNMOO.exe EBNXN.exe File created C:\windows\SysWOW64\EHNMOO.exe.bat EBNXN.exe File opened for modification C:\windows\SysWOW64\WNEO.exe QNXAMMQ.exe File opened for modification C:\windows\SysWOW64\CFOEXGV.exe KKKJ.exe File opened for modification C:\windows\SysWOW64\RXG.exe LXY.exe File created C:\windows\SysWOW64\WRUEHMC.exe FJSZE.exe File created C:\windows\SysWOW64\XAFHD.exe TSR.exe File created C:\windows\SysWOW64\BNRKZ.exe.bat THRW.exe File created C:\windows\SysWOW64\YPDA.exe.bat UEFFEE.exe File created C:\windows\SysWOW64\FJSZE.exe BBM.exe File opened for modification C:\windows\SysWOW64\QHDN.exe BMTJVX.exe File created C:\windows\SysWOW64\QHDN.exe.bat BMTJVX.exe File opened for modification C:\windows\SysWOW64\CZQZEEP.exe QGNGWP.exe File created C:\windows\SysWOW64\IMEI.exe CMWVUNK.exe File created C:\windows\SysWOW64\BMTJVX.exe.bat EHNMOO.exe File opened for modification C:\windows\SysWOW64\LWMQL.exe HGF.exe File created C:\windows\SysWOW64\HGF.exe.bat NTBZXH.exe File opened for modification C:\windows\SysWOW64\EJEOUC.exe LGBL.exe File created C:\windows\SysWOW64\CZQZEEP.exe QGNGWP.exe File created C:\windows\SysWOW64\CZQZEEP.exe.bat QGNGWP.exe File opened for modification C:\windows\SysWOW64\OTVUYQ.exe DBAJQJ.exe File created C:\windows\SysWOW64\PDNISB.exe.bat WIJNFDM.exe File created C:\windows\SysWOW64\STKMGRJ.exe.bat RXG.exe File opened for modification C:\windows\SysWOW64\GLP.exe PDNISB.exe File created C:\windows\SysWOW64\ZVTGHT.exe BVLT.exe File created C:\windows\SysWOW64\AMJHGLQ.exe UMCTXJP.exe File created C:\windows\SysWOW64\KFJGPCD.exe ISEXF.exe File created C:\windows\SysWOW64\KFJGPCD.exe.bat ISEXF.exe File created C:\windows\SysWOW64\LGBL.exe WQATHQ.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\TSR.exe ECQHSD.exe File created C:\windows\system\TSR.exe.bat ECQHSD.exe File created C:\windows\system\INC.exe CMUWYY.exe File created C:\windows\LTMODM.exe.bat BLSJ.exe File created C:\windows\CMWVUNK.exe WMPHDTJ.exe File opened for modification C:\windows\CMUWYY.exe WMNI.exe File created C:\windows\system\KUPEHZ.exe KOOPGM.exe File created C:\windows\THRW.exe.bat KUPEHZ.exe File opened for modification C:\windows\system\EBNXN.exe KGQ.exe File opened for modification C:\windows\system\GJRAWZN.exe LWMQL.exe File opened for modification C:\windows\system\FWMC.exe DZGQI.exe File opened for modification C:\windows\system\SNKQNJM.exe XAFHD.exe File created C:\windows\RASTA.exe.bat KFJGPCD.exe File created C:\windows\system\TQGKBNC.exe.bat QDBSR.exe File created C:\windows\system\JHAMBQQ.exe OTVUYQ.exe File created C:\windows\FWI.exe YQBK.exe File created C:\windows\system\WQATHQ.exe CXKIYQ.exe File created C:\windows\LXY.exe.bat JZL.exe File opened for modification C:\windows\system\UMCTXJP.exe ZYXKN.exe File created C:\windows\system\ECQHSD.exe.bat AMJHGLQ.exe File created C:\windows\BLSJ.exe OIBS.exe File created C:\windows\BLSJ.exe.bat OIBS.exe File opened for modification C:\windows\WMPHDTJ.exe LTMODM.exe File created C:\windows\system\QGNGWP.exe.bat SNKQNJM.exe File created C:\windows\system\ZEZI.exe 2026-08-02_a371e5917137361c90f4d72e84cbb3e7_elex_emotet_stop.exe File created C:\windows\system\IXKPC.exe.bat ZEZI.exe File created C:\windows\SURIOA.exe.bat PHAGVHO.exe File created C:\windows\system\MIWRRAS.exe.bat SURIOA.exe File created C:\windows\system\TEOT.exe EJEOUC.exe File created C:\windows\ZWF.exe.bat NGYAHL.exe File opened for modification C:\windows\KGQ.exe EGJATH.exe File opened for modification C:\windows\PHAGVHO.exe BBAUTV.exe File created C:\windows\system\CXKIYQ.exe YPDA.exe File opened for modification C:\windows\system\KUPEHZ.exe KOOPGM.exe File created C:\windows\THRW.exe KUPEHZ.exe File created C:\windows\system\ONIGT.exe.bat UZDW.exe File created C:\windows\CMUWYY.exe.bat WMNI.exe File opened for modification C:\windows\FWI.exe YQBK.exe File created C:\windows\FWI.exe.bat YQBK.exe File created C:\windows\system\AOW.exe MIWRRAS.exe File created C:\windows\PILFG.exe.bat VVG.exe File created C:\windows\system\QGNGWP.exe SNKQNJM.exe File created C:\windows\OIBS.exe.bat INC.exe File opened for modification C:\windows\system\TQGKBNC.exe QDBSR.exe File created C:\windows\system\RPZ.exe TEOT.exe File created C:\windows\system\GZKZ.exe PMAHJR.exe File opened for modification C:\windows\system\TSR.exe ECQHSD.exe File created C:\windows\WMPHDTJ.exe.bat LTMODM.exe File opened for modification C:\windows\CMWVUNK.exe WMPHDTJ.exe File created C:\windows\system\KOOPGM.exe.bat EOH.exe File opened for modification C:\windows\GMDVBP.exe GJRAWZN.exe File created C:\windows\DZGQI.exe CWC.exe File created C:\windows\system\RPZ.exe.bat TEOT.exe File created C:\windows\system\VVG.exe DMEJS.exe File created C:\windows\system\UMCTXJP.exe ZYXKN.exe File opened for modification C:\windows\system\ISEXF.exe IMEI.exe File created C:\windows\system\ONIGT.exe UZDW.exe File created C:\windows\system\CBNM.exe.bat AOW.exe File opened for modification C:\windows\system\KSCFT.exe RPZ.exe File created C:\windows\ZLQ.exe.bat ZINKJC.exe File opened for modification C:\windows\system\ZYXKN.exe ZVTGHT.exe File created C:\windows\LTMODM.exe BLSJ.exe File opened for modification C:\windows\OLL.exe TQGKBNC.exe File created C:\windows\GGPPR.exe OLL.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2152 cmd.exe 5964 cmd.exe 5160 cmd.exe 4608 cmd.exe 3164 cmd.exe 5412 cmd.exe 3612 cmd.exe 4108 cmd.exe 3400 cmd.exe 4300 cmd.exe 3056 cmd.exe 3900 cmd.exe 2992 cmd.exe 3448 cmd.exe 1836 cmd.exe 4072 cmd.exe 2872 cmd.exe 2984 cmd.exe 2908 cmd.exe 1032 cmd.exe 5704 cmd.exe 5956 cmd.exe 1772 cmd.exe 2440 cmd.exe 3800 cmd.exe 5560 cmd.exe 1564 cmd.exe 2452 cmd.exe 1708 cmd.exe 5680 cmd.exe 620 cmd.exe 4924 cmd.exe 5036 cmd.exe 2304 cmd.exe 4500 cmd.exe 5316 cmd.exe 3196 cmd.exe 5672 cmd.exe 5080 cmd.exe 4904 cmd.exe 4124 cmd.exe 1652 cmd.exe 3364 cmd.exe 924 cmd.exe 3360 cmd.exe 5244 cmd.exe 1064 cmd.exe 4168 cmd.exe 4332 cmd.exe 3788 cmd.exe 3068 cmd.exe 5424 cmd.exe 5692 cmd.exe 5068 cmd.exe 3372 cmd.exe 3256 cmd.exe 3384 cmd.exe 4828 cmd.exe 3192 cmd.exe 628 cmd.exe 4092 cmd.exe 4180 cmd.exe 5556 cmd.exe 4384 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 5160 2392 WerFault.exe 86 1564 2528 WerFault.exe 92 3216 2340 WerFault.exe 98 5080 2776 WerFault.exe 103 2188 1840 WerFault.exe 108 4276 2852 WerFault.exe 113 3612 1368 WerFault.exe 118 3028 1760 WerFault.exe 123 3808 1276 WerFault.exe 128 2624 4472 WerFault.exe 133 2016 2432 WerFault.exe 138 6020 4284 WerFault.exe 143 5348 1568 WerFault.exe 148 576 2684 WerFault.exe 153 3288 2536 WerFault.exe 158 4824 1316 WerFault.exe 163 3632 4740 WerFault.exe 168 5832 960 WerFault.exe 173 3372 3092 WerFault.exe 178 4132 5220 WerFault.exe 183 4924 2624 WerFault.exe 188 6020 6120 WerFault.exe 193 5348 904 WerFault.exe 198 3212 4440 WerFault.exe 203 2912 5500 WerFault.exe 208 3068 1352 WerFault.exe 213 2560 1012 WerFault.exe 218 5528 2192 WerFault.exe 223 5428 3588 WerFault.exe 228 4944 1532 WerFault.exe 233 5628 2472 WerFault.exe 238 3160 612 WerFault.exe 243 5864 988 WerFault.exe 248 3212 3544 WerFault.exe 253 948 1544 WerFault.exe 258 2404 3748 WerFault.exe 263 3364 1120 WerFault.exe 269 3408 5504 WerFault.exe 274 4160 4296 WerFault.exe 279 1092 5972 WerFault.exe 284 2464 4936 WerFault.exe 289 2452 3696 WerFault.exe 294 1436 3324 WerFault.exe 299 2904 2956 WerFault.exe 304 4536 5268 WerFault.exe 309 2560 2564 WerFault.exe 314 4636 1244 WerFault.exe 319 2240 3648 WerFault.exe 324 3372 1648 WerFault.exe 329 4144 4672 WerFault.exe 334 1708 4912 WerFault.exe 339 3128 4120 WerFault.exe 344 4324 3724 WerFault.exe 349 4344 3860 WerFault.exe 354 4868 1224 WerFault.exe 359 5012 4236 WerFault.exe 364 3408 4716 WerFault.exe 369 3508 5712 WerFault.exe 374 4108 5904 WerFault.exe 379 4148 4556 WerFault.exe 384 688 4612 WerFault.exe 389 3752 696 WerFault.exe 394 4092 460 WerFault.exe 399 5696 2196 WerFault.exe 404 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YQBK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EUCAE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ECQHSD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SNKQNJM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OQI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UZDW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DDKA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BBAUTV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EJEOUC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WIJNFDM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JZL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FJSZE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AMJHGLQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZINKJC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMWVUNK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EOH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GLSJDXA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GGPPR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AOW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BVLT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RASTA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ADOOF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UEFFEE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GLP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RXG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_a371e5917137361c90f4d72e84cbb3e7_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DLAW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JHYFEBL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HBX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language INC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BLSJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WMPHDTJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KGQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CXKIYQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2392 2026-08-02_a371e5917137361c90f4d72e84cbb3e7_elex_emotet_stop.exe 2392 2026-08-02_a371e5917137361c90f4d72e84cbb3e7_elex_emotet_stop.exe 2528 ZEZI.exe 2528 ZEZI.exe 2340 IXKPC.exe 2340 IXKPC.exe 2776 DDKA.exe 2776 DDKA.exe 1840 YQBK.exe 1840 YQBK.exe 2852 FWI.exe 2852 FWI.exe 1368 BBAUTV.exe 1368 BBAUTV.exe 1760 PHAGVHO.exe 1760 PHAGVHO.exe 1276 SURIOA.exe 1276 SURIOA.exe 4472 MIWRRAS.exe 4472 MIWRRAS.exe 2432 AOW.exe 2432 AOW.exe 4284 CBNM.exe 4284 CBNM.exe 1568 HBX.exe 1568 HBX.exe 2684 UEFFEE.exe 2684 UEFFEE.exe 2536 YPDA.exe 2536 YPDA.exe 1316 CXKIYQ.exe 1316 CXKIYQ.exe 4740 WQATHQ.exe 4740 WQATHQ.exe 960 LGBL.exe 960 LGBL.exe 3092 EJEOUC.exe 3092 EJEOUC.exe 5220 TEOT.exe 5220 TEOT.exe 2624 RPZ.exe 2624 RPZ.exe 6120 KSCFT.exe 6120 KSCFT.exe 904 WIJNFDM.exe 904 WIJNFDM.exe 4440 PDNISB.exe 4440 PDNISB.exe 5500 GLP.exe 5500 GLP.exe 1352 NGYAHL.exe 1352 NGYAHL.exe 1012 ZWF.exe 1012 ZWF.exe 2192 SRJDZTO.exe 2192 SRJDZTO.exe 3588 JZL.exe 3588 JZL.exe 1532 LXY.exe 1532 LXY.exe 2472 RXG.exe 2472 RXG.exe 612 STKMGRJ.exe 612 STKMGRJ.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2392 2026-08-02_a371e5917137361c90f4d72e84cbb3e7_elex_emotet_stop.exe 2392 2026-08-02_a371e5917137361c90f4d72e84cbb3e7_elex_emotet_stop.exe 2528 ZEZI.exe 2528 ZEZI.exe 2340 IXKPC.exe 2340 IXKPC.exe 2776 DDKA.exe 2776 DDKA.exe 1840 YQBK.exe 1840 YQBK.exe 2852 FWI.exe 2852 FWI.exe 1368 BBAUTV.exe 1368 BBAUTV.exe 1760 PHAGVHO.exe 1760 PHAGVHO.exe 1276 SURIOA.exe 1276 SURIOA.exe 4472 MIWRRAS.exe 4472 MIWRRAS.exe 2432 AOW.exe 2432 AOW.exe 4284 CBNM.exe 4284 CBNM.exe 1568 HBX.exe 1568 HBX.exe 2684 UEFFEE.exe 2684 UEFFEE.exe 2536 YPDA.exe 2536 YPDA.exe 1316 CXKIYQ.exe 1316 CXKIYQ.exe 4740 WQATHQ.exe 4740 WQATHQ.exe 960 LGBL.exe 960 LGBL.exe 3092 EJEOUC.exe 3092 EJEOUC.exe 5220 TEOT.exe 5220 TEOT.exe 2624 RPZ.exe 2624 RPZ.exe 6120 KSCFT.exe 6120 KSCFT.exe 904 WIJNFDM.exe 904 WIJNFDM.exe 4440 PDNISB.exe 4440 PDNISB.exe 5500 GLP.exe 5500 GLP.exe 1352 NGYAHL.exe 1352 NGYAHL.exe 1012 ZWF.exe 1012 ZWF.exe 2192 SRJDZTO.exe 2192 SRJDZTO.exe 3588 JZL.exe 3588 JZL.exe 1532 LXY.exe 1532 LXY.exe 2472 RXG.exe 2472 RXG.exe 612 STKMGRJ.exe 612 STKMGRJ.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2392 wrote to memory of 2324 2392 2026-08-02_a371e5917137361c90f4d72e84cbb3e7_elex_emotet_stop.exe 88 PID 2324 wrote to memory of 2528 2324 cmd.exe 92 PID 2528 wrote to memory of 4588 2528 ZEZI.exe 94 PID 4588 wrote to memory of 2340 4588 cmd.exe 98 PID 2340 wrote to memory of 1772 2340 IXKPC.exe 99 PID 1772 wrote to memory of 2776 1772 cmd.exe 103 PID 2776 wrote to memory of 2152 2776 DDKA.exe 104 PID 2152 wrote to memory of 1840 2152 cmd.exe 108 PID 1840 wrote to memory of 5964 1840 YQBK.exe 109 PID 5964 wrote to memory of 2852 5964 cmd.exe 113 PID 2852 wrote to memory of 3404 2852 FWI.exe 114 PID 3404 wrote to memory of 1368 3404 cmd.exe 118 PID 1368 wrote to memory of 2440 1368 BBAUTV.exe 119 PID 2440 wrote to memory of 1760 2440 cmd.exe 123 PID 1760 wrote to memory of 6068 1760 PHAGVHO.exe 124 PID 6068 wrote to memory of 1276 6068 cmd.exe 128 PID 1276 wrote to memory of 992 1276 SURIOA.exe 129 PID 992 wrote to memory of 4472 992 cmd.exe 133 PID 4472 wrote to memory of 5636 4472 MIWRRAS.exe 134 PID 5636 wrote to memory of 2432 5636 cmd.exe 138 PID 2432 wrote to memory of 2248 2432 AOW.exe 139 PID 2248 wrote to memory of 4284 2248 cmd.exe 143 PID 4284 wrote to memory of 6060 4284 CBNM.exe 144 PID 6060 wrote to memory of 1568 6060 cmd.exe 148 PID 1568 wrote to memory of 4332 1568 HBX.exe 149 PID 4332 wrote to memory of 2684 4332 cmd.exe 153 PID 2684 wrote to memory of 6088 2684 UEFFEE.exe 154 PID 6088 wrote to memory of 2536 6088 cmd.exe 158 PID 2536 wrote to memory of 5884 2536 YPDA.exe 159 PID 5884 wrote to memory of 1316 5884 cmd.exe 163 PID 1316 wrote to memory of 5784 1316 CXKIYQ.exe 164 PID 5784 wrote to memory of 4740 5784 cmd.exe 168 PID 4740 wrote to memory of 552 4740 WQATHQ.exe 169 PID 552 wrote to memory of 960 552 cmd.exe 173 PID 960 wrote to memory of 2364 960 LGBL.exe 174 PID 2364 wrote to memory of 3092 2364 cmd.exe 178 PID 3092 wrote to memory of 5552 3092 EJEOUC.exe 179 PID 5552 wrote to memory of 5220 5552 cmd.exe 183 PID 5220 wrote to memory of 4552 5220 TEOT.exe 184 PID 4552 wrote to memory of 2624 4552 cmd.exe 188 PID 2624 wrote to memory of 4828 2624 RPZ.exe 189 PID 4828 wrote to memory of 6120 4828 cmd.exe 193 PID 6120 wrote to memory of 5160 6120 KSCFT.exe 194 PID 5160 wrote to memory of 904 5160 cmd.exe 198 PID 904 wrote to memory of 5720 904 WIJNFDM.exe 199 PID 5720 wrote to memory of 4440 5720 cmd.exe 203 PID 4440 wrote to memory of 2872 4440 PDNISB.exe 204 PID 2872 wrote to memory of 5500 2872 cmd.exe 208 PID 5500 wrote to memory of 3800 5500 GLP.exe 209 PID 3800 wrote to memory of 1352 3800 cmd.exe 213 PID 1352 wrote to memory of 1488 1352 NGYAHL.exe 214 PID 1488 wrote to memory of 1012 1488 cmd.exe 218 PID 1012 wrote to memory of 6008 1012 ZWF.exe 219 PID 6008 wrote to memory of 2192 6008 cmd.exe 223 PID 2192 wrote to memory of 1424 2192 SRJDZTO.exe 224 PID 1424 wrote to memory of 3588 1424 cmd.exe 228 PID 3588 wrote to memory of 3244 3588 JZL.exe 229 PID 3244 wrote to memory of 1532 3244 cmd.exe 233 PID 1532 wrote to memory of 2984 1532 LXY.exe 234 PID 2984 wrote to memory of 2472 2984 cmd.exe 238 PID 2472 wrote to memory of 5716 2472 RXG.exe 239 PID 5716 wrote to memory of 612 5716 cmd.exe 243 PID 612 wrote to memory of 5316 612 STKMGRJ.exe 244 PID 5316 wrote to memory of 988 5316 cmd.exe 248
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_a371e5917137361c90f4d72e84cbb3e7_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_a371e5917137361c90f4d72e84cbb3e7_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZEZI.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\windows\system\ZEZI.exeC:\windows\system\ZEZI.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IXKPC.exe.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\windows\system\IXKPC.exeC:\windows\system\IXKPC.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DDKA.exe.bat" "6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\windows\SysWOW64\DDKA.exeC:\windows\system32\DDKA.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YQBK.exe.bat" "8⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\windows\YQBK.exeC:\windows\YQBK.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FWI.exe.bat" "10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5964 -
C:\windows\FWI.exeC:\windows\FWI.exe11⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BBAUTV.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\windows\BBAUTV.exeC:\windows\BBAUTV.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PHAGVHO.exe.bat" "14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\windows\PHAGVHO.exeC:\windows\PHAGVHO.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SURIOA.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:6068 -
C:\windows\SURIOA.exeC:\windows\SURIOA.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MIWRRAS.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:992 -
C:\windows\system\MIWRRAS.exeC:\windows\system\MIWRRAS.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AOW.exe.bat" "20⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5636 -
C:\windows\system\AOW.exeC:\windows\system\AOW.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CBNM.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\windows\system\CBNM.exeC:\windows\system\CBNM.exe23⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HBX.exe.bat" "24⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6060 -
C:\windows\SysWOW64\HBX.exeC:\windows\system32\HBX.exe25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UEFFEE.exe.bat" "26⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\windows\UEFFEE.exeC:\windows\UEFFEE.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YPDA.exe.bat" "28⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6088 -
C:\windows\SysWOW64\YPDA.exeC:\windows\system32\YPDA.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CXKIYQ.exe.bat" "30⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5884 -
C:\windows\system\CXKIYQ.exeC:\windows\system\CXKIYQ.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WQATHQ.exe.bat" "32⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5784 -
C:\windows\system\WQATHQ.exeC:\windows\system\WQATHQ.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LGBL.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:552 -
C:\windows\SysWOW64\LGBL.exeC:\windows\system32\LGBL.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EJEOUC.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\windows\SysWOW64\EJEOUC.exeC:\windows\system32\EJEOUC.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TEOT.exe.bat" "38⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5552 -
C:\windows\system\TEOT.exeC:\windows\system\TEOT.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5220 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RPZ.exe.bat" "40⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\windows\system\RPZ.exeC:\windows\system\RPZ.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KSCFT.exe.bat" "42⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\windows\system\KSCFT.exeC:\windows\system\KSCFT.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6120 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WIJNFDM.exe.bat" "44⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5160 -
C:\windows\SysWOW64\WIJNFDM.exeC:\windows\system32\WIJNFDM.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PDNISB.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:5720 -
C:\windows\SysWOW64\PDNISB.exeC:\windows\system32\PDNISB.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GLP.exe.bat" "48⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\windows\SysWOW64\GLP.exeC:\windows\system32\GLP.exe49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NGYAHL.exe.bat" "50⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3800 -
C:\windows\NGYAHL.exeC:\windows\NGYAHL.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZWF.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\windows\ZWF.exeC:\windows\ZWF.exe53⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SRJDZTO.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:6008 -
C:\windows\SRJDZTO.exeC:\windows\SRJDZTO.exe55⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JZL.exe.bat" "56⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\windows\system\JZL.exeC:\windows\system\JZL.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3588 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LXY.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:3244 -
C:\windows\LXY.exeC:\windows\LXY.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RXG.exe.bat" "60⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\windows\SysWOW64\RXG.exeC:\windows\system32\RXG.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\STKMGRJ.exe.bat" "62⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5716 -
C:\windows\SysWOW64\STKMGRJ.exeC:\windows\system32\STKMGRJ.exe63⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BBM.exe.bat" "64⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5316 -
C:\windows\BBM.exeC:\windows\BBM.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FJSZE.exe.bat" "66⤵
- Executes a command shell one-liner
PID:4124 -
C:\windows\SysWOW64\FJSZE.exeC:\windows\system32\FJSZE.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WRUEHMC.exe.bat" "68⤵PID:2244
-
C:\windows\SysWOW64\WRUEHMC.exeC:\windows\system32\WRUEHMC.exe69⤵
- Executes dropped EXE
PID:1544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DMEJS.exe.bat" "70⤵PID:600
-
C:\windows\DMEJS.exeC:\windows\DMEJS.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VVG.exe.bat" "72⤵PID:4972
-
C:\windows\system\VVG.exeC:\windows\system\VVG.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1120 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PILFG.exe.bat" "74⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5560 -
C:\windows\PILFG.exeC:\windows\PILFG.exe75⤵
- Executes dropped EXE
PID:5504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZINKJC.exe.bat" "76⤵PID:5728
-
C:\windows\ZINKJC.exeC:\windows\ZINKJC.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZLQ.exe.bat" "78⤵PID:5808
-
C:\windows\ZLQ.exeC:\windows\ZLQ.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UYVQZ.exe.bat" "80⤵
- Executes a command shell one-liner
PID:4608 -
C:\windows\SysWOW64\UYVQZ.exeC:\windows\system32\UYVQZ.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PMAHJR.exe.bat" "82⤵
- Executes a command shell one-liner
PID:620 -
C:\windows\SysWOW64\PMAHJR.exeC:\windows\system32\PMAHJR.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GZKZ.exe.bat" "84⤵PID:5228
-
C:\windows\system\GZKZ.exeC:\windows\system\GZKZ.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EUCAE.exe.bat" "86⤵PID:2616
-
C:\windows\SysWOW64\EUCAE.exeC:\windows\system32\EUCAE.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TPT.exe.bat" "88⤵
- System Location Discovery: System Language Discovery
PID:3268 -
C:\windows\SysWOW64\TPT.exeC:\windows\system32\TPT.exe89⤵
- Executes dropped EXE
PID:5268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BVLT.exe.bat" "90⤵
- Executes a command shell one-liner
PID:3788 -
C:\windows\system\BVLT.exeC:\windows\system\BVLT.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZVTGHT.exe.bat" "92⤵
- Executes a command shell one-liner
PID:1652 -
C:\windows\SysWOW64\ZVTGHT.exeC:\windows\system32\ZVTGHT.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZYXKN.exe.bat" "94⤵
- Executes a command shell one-liner
PID:3364 -
C:\windows\system\ZYXKN.exeC:\windows\system\ZYXKN.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3648 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UMCTXJP.exe.bat" "96⤵PID:2060
-
C:\windows\system\UMCTXJP.exeC:\windows\system\UMCTXJP.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1648 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AMJHGLQ.exe.bat" "98⤵
- Executes a command shell one-liner
PID:924 -
C:\windows\SysWOW64\AMJHGLQ.exeC:\windows\system32\AMJHGLQ.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4672 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ECQHSD.exe.bat" "100⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3196 -
C:\windows\system\ECQHSD.exeC:\windows\system\ECQHSD.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TSR.exe.bat" "102⤵PID:2464
-
C:\windows\system\TSR.exeC:\windows\system\TSR.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4120 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XAFHD.exe.bat" "104⤵PID:4600
-
C:\windows\SysWOW64\XAFHD.exeC:\windows\system32\XAFHD.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SNKQNJM.exe.bat" "106⤵PID:5932
-
C:\windows\system\SNKQNJM.exeC:\windows\system\SNKQNJM.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QGNGWP.exe.bat" "108⤵PID:2952
-
C:\windows\system\QGNGWP.exeC:\windows\system\QGNGWP.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1224 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CZQZEEP.exe.bat" "110⤵
- System Location Discovery: System Language Discovery
PID:1956 -
C:\windows\SysWOW64\CZQZEEP.exeC:\windows\system32\CZQZEEP.exe111⤵
- Executes dropped EXE
PID:4236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WMNI.exe.bat" "112⤵
- Executes a command shell one-liner
PID:2908 -
C:\windows\WMNI.exeC:\windows\WMNI.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CMUWYY.exe.bat" "114⤵
- System Location Discovery: System Language Discovery
PID:4784 -
C:\windows\CMUWYY.exeC:\windows\CMUWYY.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\INC.exe.bat" "116⤵PID:5912
-
C:\windows\system\INC.exeC:\windows\system\INC.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OIBS.exe.bat" "118⤵
- System Location Discovery: System Language Discovery
PID:4664 -
C:\windows\OIBS.exeC:\windows\OIBS.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BLSJ.exe.bat" "120⤵
- Executes a command shell one-liner
PID:5672 -
C:\windows\BLSJ.exeC:\windows\BLSJ.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4612
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-