Analysis
- max time kernel
76s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/08/2026, 04:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-01_6c73594c9d66d8a3469464a31b9b68c1_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-01_6c73594c9d66d8a3469464a31b9b68c1_elex_emotet_stop.exe
- Size 384KB
- Sample260802-eq7myach34
- SHA256 6ec23365bcfd57a6ef6d5b18febce96fe4b316e0d0b5384999fc8135a5d7bb5d
- MD5 6c73594c9d66d8a3469464a31b9b68c1
- SHA1 738b1f42fb5cea66153123f96b5f4a6687c20ea5
- SHA512 cc51f14a076a88829d3377c65e20afcdd96f4c2ca97b3cd3c56204e54da2e195d7d660219b37d330cc315b35d81dad0180eddfe21cd60e6c5eeb2567561a39f4
- SSDEEP 6144:TlZtbLWIgd1LZ9oECZbxlUS+LO1kEjiPISUOgW9X+hOGzC/NM:RLWI09QZb6LO1kmZzcukG2/
- TLSH T1A6848E167AC58333D1A302715CEB86A4773ABCA1A7B687872798720D6773BB44737390
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4128 IHVOE.exe 4436 DCAOXI.exe 1352 KSBG.exe 5668 PTK.exe 3328 QWBE.exe 3404 HEPJJA.exe 1424 DCBN.exe 1608 ACD.exe 5744 GXPIMQS.exe 3428 ILG.exe 2376 CYFQ.exe 1952 KMS.exe 1724 QHD.exe 4748 SUUZ.exe 4888 AAZ.exe 2508 OFZRZTC.exe 5004 QDNMGB.exe 708 JWUXXC.exe 1536 RBHDAB.exe 2644 WCVG.exe 2184 QPC.exe 4136 BIR.exe 4284 LGXJRBE.exe 6064 UOZ.exe 3840 SEMGKO.exe 5036 FPVF.exe 1668 DZG.exe 556 WCJQM.exe 5980 XYN.exe 2516 RTSDC.exe 1680 FWB.exe 6012 FZEYW.exe 1212 YCIT.exe 2032 XMT.exe 4080 XPXNX.exe 4904 MKG.exe 4316 MQG.exe 2944 ABPXYH.exe 5888 IGBLJG.exe 4028 ZPDQ.exe 3468 QPKOZ.exe 2344 UFQWLMW.exe 4764 EDEISV.exe 5680 BDGSEZ.exe 624 KEIXIWP.exe 3260 AZRCT.exe 5956 IMEI.exe 4588 RMGVHN.exe 2496 SPKR.exe 4596 SSANJ.exe 400 IJBE.exe 5248 AMFIVY.exe 2000 WOVHBI.exe 5280 ORZDPYU.exe 1412 LITBA.exe 5612 JSER.exe 4660 ZIRIROO.exe 3736 FJZWIQP.exe 1196 XMDSNG.exe 1120 YPH.exe 4780 HPJB.exe 3584 PDNH.exe 3816 BLC.exe 1736 KTWU.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\SEMGKO.exe UOZ.exe File created C:\windows\SysWOW64\HPJB.exe YPH.exe File opened for modification C:\windows\SysWOW64\FXF.exe ZCGLNSV.exe File opened for modification C:\windows\SysWOW64\MKG.exe XPXNX.exe File opened for modification C:\windows\SysWOW64\AONZQCW.exe KTWU.exe File opened for modification C:\windows\SysWOW64\PDNH.exe HPJB.exe File created C:\windows\SysWOW64\DZG.exe FPVF.exe File created C:\windows\SysWOW64\OFZRZTC.exe.bat AAZ.exe File created C:\windows\SysWOW64\XYN.exe.bat WCJQM.exe File opened for modification C:\windows\SysWOW64\ZIRIROO.exe JSER.exe File opened for modification C:\windows\SysWOW64\HPJB.exe YPH.exe File created C:\windows\SysWOW64\DZG.exe.bat FPVF.exe File created C:\windows\SysWOW64\MKG.exe XPXNX.exe File opened for modification C:\windows\SysWOW64\WOVHBI.exe AMFIVY.exe File created C:\windows\SysWOW64\TYQL.exe ZLLBEQP.exe File opened for modification C:\windows\SysWOW64\DCAOXI.exe IHVOE.exe File opened for modification C:\windows\SysWOW64\LGXJRBE.exe BIR.exe File created C:\windows\SysWOW64\LGXJRBE.exe.bat BIR.exe File created C:\windows\SysWOW64\MKG.exe.bat XPXNX.exe File opened for modification C:\windows\SysWOW64\QPKOZ.exe ZPDQ.exe File created C:\windows\SysWOW64\HVLGZDT.exe FXF.exe File opened for modification C:\windows\SysWOW64\ZLLBEQP.exe MADD.exe File opened for modification C:\windows\SysWOW64\XCMF.exe NEGKH.exe File created C:\windows\SysWOW64\DCAOXI.exe IHVOE.exe File created C:\windows\SysWOW64\SEMGKO.exe.bat UOZ.exe File created C:\windows\SysWOW64\IGBLJG.exe ABPXYH.exe File created C:\windows\SysWOW64\PDNH.exe.bat HPJB.exe File created C:\windows\SysWOW64\AONZQCW.exe.bat KTWU.exe File created C:\windows\SysWOW64\ZLLBEQP.exe.bat MADD.exe File created C:\windows\SysWOW64\XCMF.exe NEGKH.exe File created C:\windows\SysWOW64\XCMF.exe.bat NEGKH.exe File created C:\windows\SysWOW64\QDNMGB.exe.bat OFZRZTC.exe File created C:\windows\SysWOW64\JWUXXC.exe.bat QDNMGB.exe File created C:\windows\SysWOW64\QPKOZ.exe ZPDQ.exe File opened for modification C:\windows\SysWOW64\HVLGZDT.exe FXF.exe File opened for modification C:\windows\SysWOW64\UQAEMKX.exe TNWIG.exe File created C:\windows\SysWOW64\QPKOZ.exe.bat ZPDQ.exe File created C:\windows\SysWOW64\BLC.exe PDNH.exe File created C:\windows\SysWOW64\NPAVH.exe FKOGEB.exe File created C:\windows\SysWOW64\LGXJRBE.exe BIR.exe File opened for modification C:\windows\SysWOW64\XYN.exe WCJQM.exe File opened for modification C:\windows\SysWOW64\ZPDQ.exe IGBLJG.exe File opened for modification C:\windows\SysWOW64\BLC.exe PDNH.exe File created C:\windows\SysWOW64\AONZQCW.exe KTWU.exe File opened for modification C:\windows\SysWOW64\FKOGEB.exe NBMB.exe File created C:\windows\SysWOW64\UQAEMKX.exe.bat TNWIG.exe File created C:\windows\SysWOW64\AAZ.exe SUUZ.exe File created C:\windows\SysWOW64\IGBLJG.exe.bat ABPXYH.exe File created C:\windows\SysWOW64\IMEI.exe.bat AZRCT.exe File created C:\windows\SysWOW64\HPJB.exe.bat YPH.exe File created C:\windows\SysWOW64\FXF.exe.bat ZCGLNSV.exe File created C:\windows\SysWOW64\ZLLBEQP.exe MADD.exe File created C:\windows\SysWOW64\TYQL.exe.bat ZLLBEQP.exe File opened for modification C:\windows\SysWOW64\QDNMGB.exe OFZRZTC.exe File opened for modification C:\windows\SysWOW64\IGBLJG.exe ABPXYH.exe File opened for modification C:\windows\SysWOW64\IMEI.exe AZRCT.exe File created C:\windows\SysWOW64\BLC.exe.bat PDNH.exe File created C:\windows\SysWOW64\FXF.exe ZCGLNSV.exe File opened for modification C:\windows\SysWOW64\MGWK.exe WQVKK.exe File created C:\windows\SysWOW64\CYFQ.exe.bat ILG.exe File opened for modification C:\windows\SysWOW64\JWUXXC.exe QDNMGB.exe File opened for modification C:\windows\SysWOW64\DZG.exe FPVF.exe File created C:\windows\SysWOW64\IMEI.exe AZRCT.exe File created C:\windows\SysWOW64\PDNH.exe HPJB.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\WQVKK.exe HVLGZDT.exe File created C:\windows\DCBN.exe.bat HEPJJA.exe File created C:\windows\system\FPVF.exe.bat SEMGKO.exe File created C:\windows\system\AZRCT.exe.bat KEIXIWP.exe File created C:\windows\ZCGLNSV.exe.bat PEBQXJM.exe File created C:\windows\system\WCVG.exe.bat RBHDAB.exe File created C:\windows\RTSDC.exe.bat XYN.exe File opened for modification C:\windows\ZCGLNSV.exe PEBQXJM.exe File created C:\windows\system\KRG.exe.bat MGWK.exe File opened for modification C:\windows\system\XMT.exe YCIT.exe File opened for modification C:\windows\WQVKK.exe HVLGZDT.exe File opened for modification C:\windows\NEGKH.exe DWE.exe File created C:\windows\TNWIG.exe DCTSXH.exe File opened for modification C:\windows\TNWIG.exe DCTSXH.exe File opened for modification C:\windows\system\QPC.exe WCVG.exe File created C:\windows\EDEISV.exe.bat UFQWLMW.exe File opened for modification C:\windows\system\ORZDPYU.exe WOVHBI.exe File opened for modification C:\windows\TOHSREU.exe GDYT.exe File created C:\windows\system\ORZDPYU.exe WOVHBI.exe File created C:\windows\system\QWBE.exe PTK.exe File created C:\windows\RMGVHN.exe IMEI.exe File opened for modification C:\windows\YPH.exe XMDSNG.exe File opened for modification C:\windows\system\MCNYE.exe VRCIVJ.exe File created C:\windows\system\GDYT.exe AQZSYQJ.exe File created C:\windows\system\DCTSXH.exe.bat XCMF.exe File opened for modification C:\windows\IHVOE.exe 2026-08-01_6c73594c9d66d8a3469464a31b9b68c1_elex_emotet_stop.exe File created C:\windows\PTK.exe KSBG.exe File opened for modification C:\windows\system\QWBE.exe PTK.exe File created C:\windows\UFQWLMW.exe QPKOZ.exe File created C:\windows\SSANJ.exe.bat SPKR.exe File created C:\windows\IHVOE.exe 2026-08-01_6c73594c9d66d8a3469464a31b9b68c1_elex_emotet_stop.exe File opened for modification C:\windows\system\ACD.exe DCBN.exe File opened for modification C:\windows\system\FPVF.exe SEMGKO.exe File created C:\windows\system\YCIT.exe.bat FZEYW.exe File opened for modification C:\windows\system\AZRCT.exe KEIXIWP.exe File opened for modification C:\windows\system\FJZWIQP.exe ZIRIROO.exe File created C:\windows\system\MADD.exe NPAVH.exe File created C:\windows\ILG.exe.bat GXPIMQS.exe File created C:\windows\system\QPC.exe.bat WCVG.exe File created C:\windows\VRCIVJ.exe.bat AHU.exe File created C:\windows\NBMB.exe.bat TOHSREU.exe File created C:\windows\TNWIG.exe.bat DCTSXH.exe File created C:\windows\system\QWBE.exe.bat PTK.exe File opened for modification C:\windows\system\KRG.exe MGWK.exe File created C:\windows\system\HEPJJA.exe QWBE.exe File created C:\windows\KMS.exe CYFQ.exe File created C:\windows\VRCIVJ.exe AHU.exe File opened for modification C:\windows\NBMB.exe TOHSREU.exe File created C:\windows\system\UOZ.exe.bat LGXJRBE.exe File created C:\windows\ZCGLNSV.exe PEBQXJM.exe File created C:\windows\TOHSREU.exe.bat GDYT.exe File created C:\windows\PTK.exe.bat KSBG.exe File opened for modification C:\windows\UFQWLMW.exe QPKOZ.exe File created C:\windows\RMGVHN.exe.bat IMEI.exe File created C:\windows\system\PEBQXJM.exe AONZQCW.exe File created C:\windows\IHVOE.exe.bat 2026-08-01_6c73594c9d66d8a3469464a31b9b68c1_elex_emotet_stop.exe File created C:\windows\KSBG.exe DCAOXI.exe File created C:\windows\SUUZ.exe QHD.exe File created C:\windows\WCJQM.exe DZG.exe File created C:\windows\system\AZRCT.exe KEIXIWP.exe File opened for modification C:\windows\system\JSER.exe LITBA.exe File opened for modification C:\windows\system\PEBQXJM.exe AONZQCW.exe File opened for modification C:\windows\AHU.exe KRG.exe File opened for modification C:\windows\KSBG.exe DCAOXI.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4112 cmd.exe 5072 cmd.exe 824 cmd.exe 4652 cmd.exe 1548 cmd.exe 5260 cmd.exe 4168 cmd.exe 1504 cmd.exe 2892 cmd.exe 5432 cmd.exe 3200 cmd.exe 3524 cmd.exe 4872 cmd.exe 5840 cmd.exe 1756 cmd.exe 4952 cmd.exe 3056 cmd.exe 5304 cmd.exe 2400 cmd.exe 4496 cmd.exe 4776 cmd.exe 5028 cmd.exe 6124 cmd.exe 4876 cmd.exe 3976 cmd.exe 5452 cmd.exe 4288 cmd.exe 2500 cmd.exe 5384 cmd.exe 2900 cmd.exe 6116 cmd.exe 1208 cmd.exe 2668 cmd.exe 2664 cmd.exe 4664 cmd.exe 3332 cmd.exe 5512 cmd.exe 4248 cmd.exe 1460 cmd.exe 716 cmd.exe 1140 cmd.exe 1772 cmd.exe 3324 cmd.exe 3560 cmd.exe 5928 cmd.exe 1068 cmd.exe 3160 cmd.exe 4452 cmd.exe 5264 cmd.exe 4840 cmd.exe 3152 cmd.exe 5100 cmd.exe 4988 cmd.exe 3520 cmd.exe 2288 cmd.exe 3076 cmd.exe 5244 cmd.exe 4212 cmd.exe 4148 cmd.exe 2120 cmd.exe 4996 cmd.exe 2392 cmd.exe 2372 cmd.exe 2232 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 2372 4692 WerFault.exe 86 5796 4128 WerFault.exe 92 2028 4436 WerFault.exe 98 2192 1352 WerFault.exe 103 712 5668 WerFault.exe 108 916 3328 WerFault.exe 113 1476 3404 WerFault.exe 118 2228 1424 WerFault.exe 123 2516 1608 WerFault.exe 128 2000 5744 WerFault.exe 133 4932 3428 WerFault.exe 138 4392 2376 WerFault.exe 143 4196 1952 WerFault.exe 148 3252 1724 WerFault.exe 153 940 4748 WerFault.exe 158 1016 4888 WerFault.exe 163 5368 2508 WerFault.exe 168 4624 5004 WerFault.exe 173 1676 708 WerFault.exe 178 2436 1536 WerFault.exe 183 1156 2644 WerFault.exe 188 1388 2184 WerFault.exe 193 2900 4136 WerFault.exe 198 3832 4284 WerFault.exe 203 4340 6064 WerFault.exe 208 1488 3840 WerFault.exe 213 2008 5036 WerFault.exe 218 3508 1668 WerFault.exe 223 2204 556 WerFault.exe 228 5628 5980 WerFault.exe 233 1076 2516 WerFault.exe 238 3528 1680 WerFault.exe 243 3700 6012 WerFault.exe 248 3224 1212 WerFault.exe 253 4156 2032 WerFault.exe 259 1376 4080 WerFault.exe 264 5428 4904 WerFault.exe 269 1196 4316 WerFault.exe 274 3580 2944 WerFault.exe 279 4224 5888 WerFault.exe 284 3472 4028 WerFault.exe 289 2368 3468 WerFault.exe 294 3940 2344 WerFault.exe 299 3956 4764 WerFault.exe 304 2760 5680 WerFault.exe 309 2448 624 WerFault.exe 314 5820 3260 WerFault.exe 319 3736 5956 WerFault.exe 324 3232 4588 WerFault.exe 329 1192 2496 WerFault.exe 334 1156 4596 WerFault.exe 339 3808 400 WerFault.exe 344 5064 5248 WerFault.exe 349 3332 2000 WerFault.exe 354 5896 5280 WerFault.exe 359 4340 1412 WerFault.exe 364 1860 5612 WerFault.exe 369 3712 4660 WerFault.exe 374 4004 3736 WerFault.exe 379 2396 1196 WerFault.exe 384 1228 1120 WerFault.exe 389 5312 4780 WerFault.exe 394 4288 3584 WerFault.exe 399 3304 3816 WerFault.exe 404 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MKG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IGBLJG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ORZDPYU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SUUZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SEMGKO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TYQL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TNWIG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DCBN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SSANJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PEBQXJM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UFQWLMW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KNQO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WCJQM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RTSDC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NPAVH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ILG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZPDQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LITBA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YPH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FKOGEB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XCMF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IHVOE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DCAOXI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IJBE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AZRCT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AHU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4692 2026-08-01_6c73594c9d66d8a3469464a31b9b68c1_elex_emotet_stop.exe 4692 2026-08-01_6c73594c9d66d8a3469464a31b9b68c1_elex_emotet_stop.exe 4128 IHVOE.exe 4128 IHVOE.exe 4436 DCAOXI.exe 4436 DCAOXI.exe 1352 KSBG.exe 1352 KSBG.exe 5668 PTK.exe 5668 PTK.exe 3328 QWBE.exe 3328 QWBE.exe 3404 HEPJJA.exe 3404 HEPJJA.exe 1424 DCBN.exe 1424 DCBN.exe 1608 ACD.exe 1608 ACD.exe 5744 GXPIMQS.exe 5744 GXPIMQS.exe 3428 ILG.exe 3428 ILG.exe 2376 CYFQ.exe 2376 CYFQ.exe 1952 KMS.exe 1952 KMS.exe 1724 QHD.exe 1724 QHD.exe 4748 SUUZ.exe 4748 SUUZ.exe 4888 AAZ.exe 4888 AAZ.exe 2508 OFZRZTC.exe 2508 OFZRZTC.exe 5004 QDNMGB.exe 5004 QDNMGB.exe 708 JWUXXC.exe 708 JWUXXC.exe 1536 RBHDAB.exe 1536 RBHDAB.exe 2644 WCVG.exe 2644 WCVG.exe 2184 QPC.exe 2184 QPC.exe 4136 BIR.exe 4136 BIR.exe 4284 LGXJRBE.exe 4284 LGXJRBE.exe 6064 UOZ.exe 6064 UOZ.exe 3840 SEMGKO.exe 3840 SEMGKO.exe 5036 FPVF.exe 5036 FPVF.exe 1668 DZG.exe 1668 DZG.exe 556 WCJQM.exe 556 WCJQM.exe 5980 XYN.exe 5980 XYN.exe 2516 RTSDC.exe 2516 RTSDC.exe 1680 FWB.exe 1680 FWB.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4692 2026-08-01_6c73594c9d66d8a3469464a31b9b68c1_elex_emotet_stop.exe 4692 2026-08-01_6c73594c9d66d8a3469464a31b9b68c1_elex_emotet_stop.exe 4128 IHVOE.exe 4128 IHVOE.exe 4436 DCAOXI.exe 4436 DCAOXI.exe 1352 KSBG.exe 1352 KSBG.exe 5668 PTK.exe 5668 PTK.exe 3328 QWBE.exe 3328 QWBE.exe 3404 HEPJJA.exe 3404 HEPJJA.exe 1424 DCBN.exe 1424 DCBN.exe 1608 ACD.exe 1608 ACD.exe 5744 GXPIMQS.exe 5744 GXPIMQS.exe 3428 ILG.exe 3428 ILG.exe 2376 CYFQ.exe 2376 CYFQ.exe 1952 KMS.exe 1952 KMS.exe 1724 QHD.exe 1724 QHD.exe 4748 SUUZ.exe 4748 SUUZ.exe 4888 AAZ.exe 4888 AAZ.exe 2508 OFZRZTC.exe 2508 OFZRZTC.exe 5004 QDNMGB.exe 5004 QDNMGB.exe 708 JWUXXC.exe 708 JWUXXC.exe 1536 RBHDAB.exe 1536 RBHDAB.exe 2644 WCVG.exe 2644 WCVG.exe 2184 QPC.exe 2184 QPC.exe 4136 BIR.exe 4136 BIR.exe 4284 LGXJRBE.exe 4284 LGXJRBE.exe 6064 UOZ.exe 6064 UOZ.exe 3840 SEMGKO.exe 3840 SEMGKO.exe 5036 FPVF.exe 5036 FPVF.exe 1668 DZG.exe 1668 DZG.exe 556 WCJQM.exe 556 WCJQM.exe 5980 XYN.exe 5980 XYN.exe 2516 RTSDC.exe 2516 RTSDC.exe 1680 FWB.exe 1680 FWB.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4692 wrote to memory of 4112 4692 2026-08-01_6c73594c9d66d8a3469464a31b9b68c1_elex_emotet_stop.exe 88 PID 4112 wrote to memory of 4128 4112 cmd.exe 92 PID 4128 wrote to memory of 3764 4128 IHVOE.exe 94 PID 3764 wrote to memory of 4436 3764 cmd.exe 98 PID 4436 wrote to memory of 5828 4436 DCAOXI.exe 99 PID 5828 wrote to memory of 1352 5828 cmd.exe 103 PID 1352 wrote to memory of 2320 1352 KSBG.exe 104 PID 2320 wrote to memory of 5668 2320 cmd.exe 108 PID 5668 wrote to memory of 1356 5668 PTK.exe 109 PID 1356 wrote to memory of 3328 1356 cmd.exe 113 PID 3328 wrote to memory of 4120 3328 QWBE.exe 114 PID 4120 wrote to memory of 3404 4120 cmd.exe 118 PID 3404 wrote to memory of 1596 3404 HEPJJA.exe 119 PID 1596 wrote to memory of 1424 1596 cmd.exe 123 PID 1424 wrote to memory of 1324 1424 DCBN.exe 124 PID 1324 wrote to memory of 1608 1324 cmd.exe 128 PID 1608 wrote to memory of 2456 1608 ACD.exe 129 PID 2456 wrote to memory of 5744 2456 cmd.exe 133 PID 5744 wrote to memory of 1548 5744 GXPIMQS.exe 134 PID 1548 wrote to memory of 3428 1548 cmd.exe 138 PID 3428 wrote to memory of 5384 3428 ILG.exe 139 PID 5384 wrote to memory of 2376 5384 cmd.exe 143 PID 2376 wrote to memory of 4408 2376 CYFQ.exe 144 PID 4408 wrote to memory of 1952 4408 cmd.exe 148 PID 1952 wrote to memory of 616 1952 KMS.exe 149 PID 616 wrote to memory of 1724 616 cmd.exe 153 PID 1724 wrote to memory of 5488 1724 QHD.exe 154 PID 5488 wrote to memory of 4748 5488 cmd.exe 158 PID 4748 wrote to memory of 5260 4748 SUUZ.exe 159 PID 5260 wrote to memory of 4888 5260 cmd.exe 163 PID 4888 wrote to memory of 2632 4888 AAZ.exe 164 PID 2632 wrote to memory of 2508 2632 cmd.exe 168 PID 2508 wrote to memory of 5028 2508 OFZRZTC.exe 169 PID 5028 wrote to memory of 5004 5028 cmd.exe 173 PID 5004 wrote to memory of 6016 5004 QDNMGB.exe 174 PID 6016 wrote to memory of 708 6016 cmd.exe 178 PID 708 wrote to memory of 6020 708 JWUXXC.exe 179 PID 6020 wrote to memory of 1536 6020 cmd.exe 183 PID 1536 wrote to memory of 3160 1536 RBHDAB.exe 184 PID 3160 wrote to memory of 2644 3160 cmd.exe 188 PID 2644 wrote to memory of 4840 2644 WCVG.exe 189 PID 4840 wrote to memory of 2184 4840 cmd.exe 193 PID 2184 wrote to memory of 4916 2184 QPC.exe 194 PID 4916 wrote to memory of 4136 4916 cmd.exe 198 PID 4136 wrote to memory of 4452 4136 BIR.exe 199 PID 4452 wrote to memory of 4284 4452 cmd.exe 203 PID 4284 wrote to memory of 5652 4284 LGXJRBE.exe 204 PID 5652 wrote to memory of 6064 5652 cmd.exe 208 PID 6064 wrote to memory of 4648 6064 UOZ.exe 209 PID 4648 wrote to memory of 3840 4648 cmd.exe 213 PID 3840 wrote to memory of 1140 3840 SEMGKO.exe 214 PID 1140 wrote to memory of 5036 1140 cmd.exe 218 PID 5036 wrote to memory of 4364 5036 FPVF.exe 219 PID 4364 wrote to memory of 1668 4364 cmd.exe 223 PID 1668 wrote to memory of 972 1668 DZG.exe 224 PID 972 wrote to memory of 556 972 cmd.exe 228 PID 556 wrote to memory of 800 556 WCJQM.exe 229 PID 800 wrote to memory of 5980 800 cmd.exe 233 PID 5980 wrote to memory of 4168 5980 XYN.exe 234 PID 4168 wrote to memory of 2516 4168 cmd.exe 238 PID 2516 wrote to memory of 4024 2516 RTSDC.exe 239 PID 4024 wrote to memory of 1680 4024 cmd.exe 243 PID 1680 wrote to memory of 2888 1680 FWB.exe 244 PID 2888 wrote to memory of 6012 2888 cmd.exe 248
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-01_6c73594c9d66d8a3469464a31b9b68c1_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-01_6c73594c9d66d8a3469464a31b9b68c1_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IHVOE.exe.bat" "2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\windows\IHVOE.exeC:\windows\IHVOE.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DCAOXI.exe.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\windows\SysWOW64\DCAOXI.exeC:\windows\system32\DCAOXI.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KSBG.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:5828 -
C:\windows\KSBG.exeC:\windows\KSBG.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PTK.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\windows\PTK.exeC:\windows\PTK.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QWBE.exe.bat" "10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\windows\system\QWBE.exeC:\windows\system\QWBE.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HEPJJA.exe.bat" "12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\windows\system\HEPJJA.exeC:\windows\system\HEPJJA.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DCBN.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\windows\DCBN.exeC:\windows\DCBN.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ACD.exe.bat" "16⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\windows\system\ACD.exeC:\windows\system\ACD.exe17⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GXPIMQS.exe.bat" "18⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\windows\system\GXPIMQS.exeC:\windows\system\GXPIMQS.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5744 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ILG.exe.bat" "20⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\windows\ILG.exeC:\windows\ILG.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CYFQ.exe.bat" "22⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5384 -
C:\windows\SysWOW64\CYFQ.exeC:\windows\system32\CYFQ.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KMS.exe.bat" "24⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\windows\KMS.exeC:\windows\KMS.exe25⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QHD.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:616 -
C:\windows\system\QHD.exeC:\windows\system\QHD.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SUUZ.exe.bat" "28⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5488 -
C:\windows\SUUZ.exeC:\windows\SUUZ.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AAZ.exe.bat" "30⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5260 -
C:\windows\SysWOW64\AAZ.exeC:\windows\system32\AAZ.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OFZRZTC.exe.bat" "32⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\windows\SysWOW64\OFZRZTC.exeC:\windows\system32\OFZRZTC.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QDNMGB.exe.bat" "34⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\windows\SysWOW64\QDNMGB.exeC:\windows\system32\QDNMGB.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JWUXXC.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:6016 -
C:\windows\SysWOW64\JWUXXC.exeC:\windows\system32\JWUXXC.exe37⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RBHDAB.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:6020 -
C:\windows\system\RBHDAB.exeC:\windows\system\RBHDAB.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WCVG.exe.bat" "40⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\windows\system\WCVG.exeC:\windows\system\WCVG.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QPC.exe.bat" "42⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\windows\system\QPC.exeC:\windows\system\QPC.exe43⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BIR.exe.bat" "44⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\windows\system\BIR.exeC:\windows\system\BIR.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LGXJRBE.exe.bat" "46⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\windows\SysWOW64\LGXJRBE.exeC:\windows\system32\LGXJRBE.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UOZ.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:5652 -
C:\windows\system\UOZ.exeC:\windows\system\UOZ.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SEMGKO.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\windows\SysWOW64\SEMGKO.exeC:\windows\system32\SEMGKO.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FPVF.exe.bat" "52⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\windows\system\FPVF.exeC:\windows\system\FPVF.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DZG.exe.bat" "54⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\windows\SysWOW64\DZG.exeC:\windows\system32\DZG.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WCJQM.exe.bat" "56⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:972 -
C:\windows\WCJQM.exeC:\windows\WCJQM.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XYN.exe.bat" "58⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:800 -
C:\windows\SysWOW64\XYN.exeC:\windows\system32\XYN.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RTSDC.exe.bat" "60⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\windows\RTSDC.exeC:\windows\RTSDC.exe61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FWB.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\windows\FWB.exeC:\windows\FWB.exe63⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FZEYW.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\windows\FZEYW.exeC:\windows\FZEYW.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YCIT.exe.bat" "66⤵
- Executes a command shell one-liner
PID:1504 -
C:\windows\system\YCIT.exeC:\windows\system\YCIT.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1212 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XMT.exe.bat" "68⤵
- Executes a command shell one-liner
PID:4664 -
C:\windows\system\XMT.exeC:\windows\system\XMT.exe69⤵
- Executes dropped EXE
PID:2032 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XPXNX.exe.bat" "70⤵
- System Location Discovery: System Language Discovery
PID:5948 -
C:\windows\system\XPXNX.exeC:\windows\system\XPXNX.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MKG.exe.bat" "72⤵
- Executes a command shell one-liner
PID:6124 -
C:\windows\SysWOW64\MKG.exeC:\windows\system32\MKG.exe73⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MQG.exe.bat" "74⤵
- System Location Discovery: System Language Discovery
PID:1488 -
C:\windows\system\MQG.exeC:\windows\system\MQG.exe75⤵
- Executes dropped EXE
PID:4316 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ABPXYH.exe.bat" "76⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3076 -
C:\windows\system\ABPXYH.exeC:\windows\system\ABPXYH.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IGBLJG.exe.bat" "78⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1772 -
C:\windows\SysWOW64\IGBLJG.exeC:\windows\system32\IGBLJG.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZPDQ.exe.bat" "80⤵PID:6140
-
C:\windows\SysWOW64\ZPDQ.exeC:\windows\system32\ZPDQ.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4028 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QPKOZ.exe.bat" "82⤵PID:4468
-
C:\windows\SysWOW64\QPKOZ.exeC:\windows\system32\QPKOZ.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UFQWLMW.exe.bat" "84⤵
- Executes a command shell one-liner
PID:5244 -
C:\windows\UFQWLMW.exeC:\windows\UFQWLMW.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EDEISV.exe.bat" "86⤵
- System Location Discovery: System Language Discovery
PID:4392 -
C:\windows\EDEISV.exeC:\windows\EDEISV.exe87⤵
- Executes dropped EXE
PID:4764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BDGSEZ.exe.bat" "88⤵
- System Location Discovery: System Language Discovery
PID:2724 -
C:\windows\BDGSEZ.exeC:\windows\BDGSEZ.exe89⤵
- Executes dropped EXE
PID:5680 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KEIXIWP.exe.bat" "90⤵PID:3980
-
C:\windows\KEIXIWP.exeC:\windows\KEIXIWP.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AZRCT.exe.bat" "92⤵PID:3392
-
C:\windows\system\AZRCT.exeC:\windows\system\AZRCT.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IMEI.exe.bat" "94⤵PID:4384
-
C:\windows\SysWOW64\IMEI.exeC:\windows\system32\IMEI.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RMGVHN.exe.bat" "96⤵PID:6076
-
C:\windows\RMGVHN.exeC:\windows\RMGVHN.exe97⤵
- Executes dropped EXE
PID:4588 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SPKR.exe.bat" "98⤵PID:4536
-
C:\windows\system\SPKR.exeC:\windows\system\SPKR.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SSANJ.exe.bat" "100⤵PID:1116
-
C:\windows\SSANJ.exeC:\windows\SSANJ.exe101⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IJBE.exe.bat" "102⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4212 -
C:\windows\IJBE.exeC:\windows\IJBE.exe103⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AMFIVY.exe.bat" "104⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4872 -
C:\windows\AMFIVY.exeC:\windows\AMFIVY.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WOVHBI.exe.bat" "106⤵
- System Location Discovery: System Language Discovery
PID:4784 -
C:\windows\SysWOW64\WOVHBI.exeC:\windows\system32\WOVHBI.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ORZDPYU.exe.bat" "108⤵
- System Location Discovery: System Language Discovery
PID:5156 -
C:\windows\system\ORZDPYU.exeC:\windows\system\ORZDPYU.exe109⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LITBA.exe.bat" "110⤵PID:1640
-
C:\windows\LITBA.exeC:\windows\LITBA.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JSER.exe.bat" "112⤵
- Executes a command shell one-liner
PID:3152 -
C:\windows\system\JSER.exeC:\windows\system\JSER.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZIRIROO.exe.bat" "114⤵PID:4036
-
C:\windows\SysWOW64\ZIRIROO.exeC:\windows\system32\ZIRIROO.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FJZWIQP.exe.bat" "116⤵
- Executes a command shell one-liner
PID:4876 -
C:\windows\system\FJZWIQP.exeC:\windows\system\FJZWIQP.exe117⤵
- Executes dropped EXE
PID:3736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XMDSNG.exe.bat" "118⤵PID:3580
-
C:\windows\XMDSNG.exeC:\windows\XMDSNG.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1196 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YPH.exe.bat" "120⤵
- Executes a command shell one-liner
PID:5840 -
C:\windows\YPH.exeC:\windows\YPH.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1120
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-