Analysis
- max time kernel
89s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/08/2026, 16:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-02_f2ae905a01b6631b7247386b63f952da_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-02_f2ae905a01b6631b7247386b63f952da_elex_emotet_stop.exe
- Size 208KB
- Sample260802-tnamrawerg
- SHA256 9555f103a2b213bae04cb0ab1e4f8e841ef1975330b2d2a15a6fe5d23723c806
- MD5 f2ae905a01b6631b7247386b63f952da
- SHA1 d9a6597d83254037143821d9180960c8db48cf4a
- SHA512 f0a0e8bbad78bed5b60242c476703366e0451e9951861527bad4746d831c912fc87463af22f7373a64a12533f52fff0e260c9028ffffd4133f2aa798cf98204d
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlldL+LOf/4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFll5+LOnkEj1
- TLSH T1C7247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4908 JDZIXQ.exe 1540 STTRIMS.exe 5588 CMD.exe 5900 XHIAX.exe 2484 OHKFAM.exe 1852 SXQN.exe 4844 WFXNYW.exe 2220 NGZSC.exe 5800 BQP.exe 1424 TTTNWV.exe 5632 JJU.exe 3212 NRBMP.exe 3540 PNFEZIH.exe 5788 RLLQGR.exe 724 KDABQKY.exe 1272 ATB.exe 5280 UGGKH.exe 4192 DMLQ.exe 1304 BFW.exe 3776 FNCGEC.exe 1184 SYLFSM.exe 2620 RIWVB.exe 1572 IRCSO.exe 4512 JMOWTZD.exe 4736 QCPVA.exe 3260 ZPTCK.exe 6028 XAES.exe 4464 MVOWEUS.exe 5072 LGQMNA.exe 3700 PWX.exe 2176 ZULHGB.exe 1192 SXPD.exe 2736 EFVLYJI.exe 5808 NFX.exe 4688 TFFDS.exe 3768 LIJHYZN.exe 244 DRLMBE.exe 3908 VMOIPUZ.exe 3656 QHTR.exe 1012 RCX.exe 5784 GFGZ.exe 4668 VVHZWSM.exe 2276 ZDOZI.exe 3012 IDQ.exe 5124 MTXMY.exe 2836 NXIIEQA.exe 5804 GSMLJG.exe 1644 VVWQ.exe 2980 WQATHQ.exe 4620 QLE.exe 5428 LYJMU.exe 2820 PGQMGIL.exe 4284 EWRMN.exe 1508 NFTRQBK.exe 268 TFAE.exe 4972 ZFISQY.exe 4336 ZLAHSDP.exe 5772 OGSLD.exe 1532 WLKZMC.exe 3016 YJX.exe 3280 NMHYFG.exe 1116 VSHNGKF.exe 5920 JDQLVVA.exe 1080 DQU.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\XHIAX.exe CMD.exe File created C:\windows\SysWOW64\KJH.exe EJZ.exe File created C:\windows\SysWOW64\KJH.exe.bat EJZ.exe File created C:\windows\SysWOW64\PBEYF.exe UOZ.exe File created C:\windows\SysWOW64\XHIAX.exe.bat CMD.exe File created C:\windows\SysWOW64\IYFDD.exe.bat ZQDY.exe File created C:\windows\SysWOW64\LIJHYZN.exe.bat TFFDS.exe File created C:\windows\SysWOW64\VMOIPUZ.exe.bat DRLMBE.exe File created C:\windows\SysWOW64\DVNJ.exe.bat DQU.exe File created C:\windows\SysWOW64\EJVFKA.exe FTKCPUN.exe File created C:\windows\SysWOW64\GEA.exe EJVFKA.exe File created C:\windows\SysWOW64\WNA.exe DKXNSY.exe File opened for modification C:\windows\SysWOW64\VHIYFAJ.exe AUMOU.exe File created C:\windows\SysWOW64\LIJHYZN.exe TFFDS.exe File created C:\windows\SysWOW64\DIDEBOK.exe.bat SQATTZ.exe File created C:\windows\SysWOW64\WNA.exe.bat DKXNSY.exe File created C:\windows\SysWOW64\JVTMOX.exe.bat PHPC.exe File created C:\windows\SysWOW64\MVOWEUS.exe.bat XAES.exe File created C:\windows\SysWOW64\IDQ.exe.bat ZDOZI.exe File created C:\windows\SysWOW64\DQU.exe JDQLVVA.exe File opened for modification C:\windows\SysWOW64\IYFDD.exe ZQDY.exe File opened for modification C:\windows\SysWOW64\SPXJN.exe HWC.exe File created C:\windows\SysWOW64\PGQMGIL.exe LYJMU.exe File created C:\windows\SysWOW64\TFFDS.exe.bat NFX.exe File opened for modification C:\windows\SysWOW64\VMOIPUZ.exe DRLMBE.exe File opened for modification C:\windows\SysWOW64\DKXNSY.exe OPF.exe File created C:\windows\SysWOW64\BQP.exe NGZSC.exe File created C:\windows\SysWOW64\RIWVB.exe.bat SYLFSM.exe File created C:\windows\SysWOW64\NFX.exe EFVLYJI.exe File opened for modification C:\windows\SysWOW64\TFFDS.exe NFX.exe File created C:\windows\SysWOW64\QLE.exe WQATHQ.exe File created C:\windows\SysWOW64\DQU.exe.bat JDQLVVA.exe File opened for modification C:\windows\SysWOW64\DVNJ.exe DQU.exe File created C:\windows\SysWOW64\TSJZUCL.exe.bat KJH.exe File created C:\windows\SysWOW64\STTRIMS.exe JDZIXQ.exe File created C:\windows\SysWOW64\JOJHPGJ.exe PBEYF.exe File opened for modification C:\windows\SysWOW64\JOJHPGJ.exe PBEYF.exe File created C:\windows\SysWOW64\RUYE.exe.bat XHTVICE.exe File created C:\windows\SysWOW64\HWC.exe YOALBAK.exe File created C:\windows\SysWOW64\VHIYFAJ.exe AUMOU.exe File created C:\windows\SysWOW64\PBEYF.exe.bat UOZ.exe File created C:\windows\SysWOW64\RUYE.exe XHTVICE.exe File created C:\windows\SysWOW64\XAES.exe ZPTCK.exe File opened for modification C:\windows\SysWOW64\DRLMBE.exe LIJHYZN.exe File created C:\windows\SysWOW64\SPXJN.exe.bat HWC.exe File created C:\windows\SysWOW64\FHH.exe.bat FEDBFC.exe File created C:\windows\SysWOW64\JDZIXQ.exe 2026-08-02_f2ae905a01b6631b7247386b63f952da_elex_emotet_stop.exe File opened for modification C:\windows\SysWOW64\STTRIMS.exe JDZIXQ.exe File opened for modification C:\windows\SysWOW64\QLE.exe WQATHQ.exe File created C:\windows\SysWOW64\JOJHPGJ.exe.bat PBEYF.exe File created C:\windows\SysWOW64\GEA.exe.bat EJVFKA.exe File opened for modification C:\windows\SysWOW64\HWC.exe YOALBAK.exe File created C:\windows\SysWOW64\HWC.exe.bat YOALBAK.exe File created C:\windows\SysWOW64\BQP.exe.bat NGZSC.exe File created C:\windows\SysWOW64\MVOWEUS.exe XAES.exe File opened for modification C:\windows\SysWOW64\MVOWEUS.exe XAES.exe File opened for modification C:\windows\SysWOW64\NFX.exe EFVLYJI.exe File opened for modification C:\windows\SysWOW64\DQU.exe JDQLVVA.exe File created C:\windows\SysWOW64\XHIAX.exe CMD.exe File created C:\windows\SysWOW64\IRCSO.exe RIWVB.exe File created C:\windows\SysWOW64\IYFDD.exe ZQDY.exe File opened for modification C:\windows\SysWOW64\FHH.exe FEDBFC.exe File created C:\windows\SysWOW64\VMOIPUZ.exe DRLMBE.exe File opened for modification C:\windows\SysWOW64\PGQMGIL.exe LYJMU.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\YOALBAK.exe.bat JTRZ.exe File created C:\windows\system\BWOB.exe.bat GIJSIST.exe File created C:\windows\PWX.exe.bat LGQMNA.exe File opened for modification C:\windows\system\GFGZ.exe RCX.exe File created C:\windows\system\LYJMU.exe QLE.exe File opened for modification C:\windows\ZFISQY.exe TFAE.exe File created C:\windows\system\SXPD.exe.bat ZULHGB.exe File opened for modification C:\windows\NMHYFG.exe YJX.exe File created C:\windows\EJZ.exe UJXBW.exe File opened for modification C:\windows\FOIO.exe LBLFHSZ.exe File created C:\windows\system\FEDBFC.exe BWOB.exe File created C:\windows\system\FNCGEC.exe.bat BFW.exe File created C:\windows\ZQDY.exe.bat JVTMOX.exe File created C:\windows\system\FEDBFC.exe.bat BWOB.exe File created C:\windows\system\KDABQKY.exe.bat RLLQGR.exe File opened for modification C:\windows\ZLAHSDP.exe ZFISQY.exe File created C:\windows\FOIO.exe.bat LBLFHSZ.exe File created C:\windows\system\FTKCPUN.exe.bat LGFSNV.exe File created C:\windows\VBHD.exe CJASCQ.exe File created C:\windows\ZQDY.exe JVTMOX.exe File created C:\windows\system\SXPD.exe ZULHGB.exe File opened for modification C:\windows\NXIIEQA.exe MTXMY.exe File created C:\windows\UNMD.exe TSJZUCL.exe File opened for modification C:\windows\system\UGGKH.exe ATB.exe File created C:\windows\NXIIEQA.exe.bat MTXMY.exe File created C:\windows\system\GSMLJG.exe.bat NXIIEQA.exe File created C:\windows\system\ATB.exe.bat KDABQKY.exe File created C:\windows\SYLFSM.exe.bat FNCGEC.exe File created C:\windows\ZLAHSDP.exe.bat ZFISQY.exe File created C:\windows\SXQN.exe.bat OHKFAM.exe File created C:\windows\WFXNYW.exe SXQN.exe File created C:\windows\DMLQ.exe.bat UGGKH.exe File created C:\windows\ZFISQY.exe.bat TFAE.exe File created C:\windows\WLKZMC.exe OGSLD.exe File created C:\windows\LSBFTU.exe.bat SPXJN.exe File created C:\windows\system\VKUCKQ.exe VHIYFAJ.exe File created C:\windows\system\VSHNGKF.exe NMHYFG.exe File created C:\windows\system\UIZ.exe.bat ZNUQJU.exe File opened for modification C:\windows\system\YOALBAK.exe JTRZ.exe File created C:\windows\SYLFSM.exe FNCGEC.exe File opened for modification C:\windows\system\GSMLJG.exe NXIIEQA.exe File created C:\windows\system\WQATHQ.exe VVWQ.exe File created C:\windows\system\EFVLYJI.exe SXPD.exe File opened for modification C:\windows\ZDOZI.exe VVHZWSM.exe File opened for modification C:\windows\system\NFTRQBK.exe EWRMN.exe File created C:\windows\VBHD.exe.bat CJASCQ.exe File opened for modification C:\windows\system\EWRMN.exe PGQMGIL.exe File opened for modification C:\windows\system\VSHNGKF.exe NMHYFG.exe File opened for modification C:\windows\UJXBW.exe DVNJ.exe File opened for modification C:\windows\ZNUQJU.exe UNMD.exe File created C:\windows\system\ZNWPNJT.exe ACT.exe File created C:\windows\OFG.exe LSBFTU.exe File created C:\windows\XHTVICE.exe FUIDT.exe File created C:\windows\system\TTTNWV.exe.bat BQP.exe File opened for modification C:\windows\system\NRBMP.exe JJU.exe File created C:\windows\JMOWTZD.exe.bat IRCSO.exe File opened for modification C:\windows\system\VKUCKQ.exe VHIYFAJ.exe File created C:\windows\OHKFAM.exe.bat XHIAX.exe File opened for modification C:\windows\system\TTTNWV.exe BQP.exe File created C:\windows\system\FNCGEC.exe BFW.exe File opened for modification C:\windows\ZPTCK.exe QCPVA.exe File created C:\windows\system\EFVLYJI.exe.bat SXPD.exe File opened for modification C:\windows\system\UOZ.exe UIZ.exe File created C:\windows\LGQMNA.exe MVOWEUS.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2924 cmd.exe 2648 cmd.exe 6096 cmd.exe 4852 cmd.exe 3176 cmd.exe 6024 cmd.exe 4832 cmd.exe 4568 cmd.exe 2164 cmd.exe 2368 cmd.exe 1764 cmd.exe 820 cmd.exe 4088 cmd.exe 976 cmd.exe 3544 cmd.exe 2524 cmd.exe 1308 cmd.exe 2384 cmd.exe 5940 cmd.exe 412 cmd.exe 3792 cmd.exe 580 cmd.exe 1260 cmd.exe 2000 cmd.exe 2272 cmd.exe 3472 cmd.exe 4928 cmd.exe 3464 cmd.exe 3240 cmd.exe 5292 cmd.exe 992 cmd.exe 4412 cmd.exe 3432 cmd.exe 3048 cmd.exe 3976 cmd.exe 4696 cmd.exe 572 cmd.exe 3248 cmd.exe 6008 cmd.exe 4416 cmd.exe 2896 cmd.exe 3008 cmd.exe 4932 cmd.exe 4868 cmd.exe 4420 cmd.exe 3948 cmd.exe 808 cmd.exe 6040 cmd.exe 2724 cmd.exe 4456 cmd.exe 2060 cmd.exe 3428 cmd.exe 3408 cmd.exe 4580 cmd.exe 4112 cmd.exe 1324 cmd.exe 5316 cmd.exe 3964 cmd.exe 2584 cmd.exe 4632 cmd.exe 4344 cmd.exe 4304 cmd.exe 3312 cmd.exe 3036 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 3156 2168 WerFault.exe 88 5736 4908 WerFault.exe 93 3960 1540 WerFault.exe 99 2092 5588 WerFault.exe 104 1692 5900 WerFault.exe 109 2416 2484 WerFault.exe 114 1860 1852 WerFault.exe 119 2716 4844 WerFault.exe 124 1840 2220 WerFault.exe 129 6120 5800 WerFault.exe 134 4308 1424 WerFault.exe 139 2436 5632 WerFault.exe 144 1508 3212 WerFault.exe 149 820 3540 WerFault.exe 154 5852 5788 WerFault.exe 159 4336 724 WerFault.exe 164 4868 1272 WerFault.exe 169 4720 5280 WerFault.exe 174 732 4192 WerFault.exe 179 1648 1304 WerFault.exe 184 964 3776 WerFault.exe 189 4812 1184 WerFault.exe 194 5092 2620 WerFault.exe 199 300 1572 WerFault.exe 204 1528 4512 WerFault.exe 209 5032 4736 WerFault.exe 214 4840 3260 WerFault.exe 219 2108 6028 WerFault.exe 224 5856 4464 WerFault.exe 229 3412 5072 WerFault.exe 234 1440 3700 WerFault.exe 239 1848 2176 WerFault.exe 244 4256 1192 WerFault.exe 249 3156 2736 WerFault.exe 254 4140 5808 WerFault.exe 259 5756 4688 WerFault.exe 264 4400 3768 WerFault.exe 269 1248 244 WerFault.exe 275 5728 3908 WerFault.exe 280 5248 3656 WerFault.exe 285 6076 1012 WerFault.exe 290 4304 5784 WerFault.exe 295 3804 4668 WerFault.exe 300 4144 2276 WerFault.exe 305 412 3012 WerFault.exe 310 2864 5124 WerFault.exe 315 3568 2836 WerFault.exe 320 6100 5804 WerFault.exe 325 5820 1644 WerFault.exe 330 1036 2980 WerFault.exe 335 5952 4620 WerFault.exe 340 4556 5428 WerFault.exe 345 2660 2820 WerFault.exe 350 5252 4284 WerFault.exe 355 2612 1508 WerFault.exe 360 1752 268 WerFault.exe 365 3052 4972 WerFault.exe 370 5540 4336 WerFault.exe 375 628 5772 WerFault.exe 380 3844 1532 WerFault.exe 385 6092 3016 WerFault.exe 390 5624 3280 WerFault.exe 395 5940 1116 WerFault.exe 400 820 5920 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZULHGB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PGQMGIL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OHKFAM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IRCSO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LGFSNV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KHYJUS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_f2ae905a01b6631b7247386b63f952da_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QHTR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JTRZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UGGKH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SXPD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LIJHYZN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BQP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TTTNWV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RCX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YJX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EJZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PNFEZIH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FNCGEC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EFVLYJI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KJH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UIZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UOZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FTKCPUN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TFAE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OPF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JOJHPGJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZFISQY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SPXJN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XHTVICE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SXQN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GIJSIST.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VSHNGKF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CJASCQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PHPC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2168 2026-08-02_f2ae905a01b6631b7247386b63f952da_elex_emotet_stop.exe 2168 2026-08-02_f2ae905a01b6631b7247386b63f952da_elex_emotet_stop.exe 4908 JDZIXQ.exe 4908 JDZIXQ.exe 1540 STTRIMS.exe 1540 STTRIMS.exe 5588 CMD.exe 5588 CMD.exe 5900 XHIAX.exe 5900 XHIAX.exe 2484 OHKFAM.exe 2484 OHKFAM.exe 1852 SXQN.exe 1852 SXQN.exe 4844 WFXNYW.exe 4844 WFXNYW.exe 2220 NGZSC.exe 2220 NGZSC.exe 5800 BQP.exe 5800 BQP.exe 1424 TTTNWV.exe 1424 TTTNWV.exe 5632 JJU.exe 5632 JJU.exe 3212 NRBMP.exe 3212 NRBMP.exe 3540 PNFEZIH.exe 3540 PNFEZIH.exe 5788 RLLQGR.exe 5788 RLLQGR.exe 724 KDABQKY.exe 724 KDABQKY.exe 1272 ATB.exe 1272 ATB.exe 5280 UGGKH.exe 5280 UGGKH.exe 4192 DMLQ.exe 4192 DMLQ.exe 1304 BFW.exe 1304 BFW.exe 3776 FNCGEC.exe 3776 FNCGEC.exe 1184 SYLFSM.exe 1184 SYLFSM.exe 2620 RIWVB.exe 2620 RIWVB.exe 1572 IRCSO.exe 1572 IRCSO.exe 4512 JMOWTZD.exe 4512 JMOWTZD.exe 4736 QCPVA.exe 4736 QCPVA.exe 3260 ZPTCK.exe 3260 ZPTCK.exe 6028 XAES.exe 6028 XAES.exe 4464 MVOWEUS.exe 4464 MVOWEUS.exe 5072 LGQMNA.exe 5072 LGQMNA.exe 3700 PWX.exe 3700 PWX.exe 2176 ZULHGB.exe 2176 ZULHGB.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2168 2026-08-02_f2ae905a01b6631b7247386b63f952da_elex_emotet_stop.exe 2168 2026-08-02_f2ae905a01b6631b7247386b63f952da_elex_emotet_stop.exe 4908 JDZIXQ.exe 4908 JDZIXQ.exe 1540 STTRIMS.exe 1540 STTRIMS.exe 5588 CMD.exe 5588 CMD.exe 5900 XHIAX.exe 5900 XHIAX.exe 2484 OHKFAM.exe 2484 OHKFAM.exe 1852 SXQN.exe 1852 SXQN.exe 4844 WFXNYW.exe 4844 WFXNYW.exe 2220 NGZSC.exe 2220 NGZSC.exe 5800 BQP.exe 5800 BQP.exe 1424 TTTNWV.exe 1424 TTTNWV.exe 5632 JJU.exe 5632 JJU.exe 3212 NRBMP.exe 3212 NRBMP.exe 3540 PNFEZIH.exe 3540 PNFEZIH.exe 5788 RLLQGR.exe 5788 RLLQGR.exe 724 KDABQKY.exe 724 KDABQKY.exe 1272 ATB.exe 1272 ATB.exe 5280 UGGKH.exe 5280 UGGKH.exe 4192 DMLQ.exe 4192 DMLQ.exe 1304 BFW.exe 1304 BFW.exe 3776 FNCGEC.exe 3776 FNCGEC.exe 1184 SYLFSM.exe 1184 SYLFSM.exe 2620 RIWVB.exe 2620 RIWVB.exe 1572 IRCSO.exe 1572 IRCSO.exe 4512 JMOWTZD.exe 4512 JMOWTZD.exe 4736 QCPVA.exe 4736 QCPVA.exe 3260 ZPTCK.exe 3260 ZPTCK.exe 6028 XAES.exe 6028 XAES.exe 4464 MVOWEUS.exe 4464 MVOWEUS.exe 5072 LGQMNA.exe 5072 LGQMNA.exe 3700 PWX.exe 3700 PWX.exe 2176 ZULHGB.exe 2176 ZULHGB.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2168 wrote to memory of 2444 2168 2026-08-02_f2ae905a01b6631b7247386b63f952da_elex_emotet_stop.exe 89 PID 2444 wrote to memory of 4908 2444 cmd.exe 93 PID 4908 wrote to memory of 3056 4908 JDZIXQ.exe 95 PID 3056 wrote to memory of 1540 3056 cmd.exe 99 PID 1540 wrote to memory of 5648 1540 STTRIMS.exe 100 PID 5648 wrote to memory of 5588 5648 cmd.exe 104 PID 5588 wrote to memory of 3048 5588 CMD.exe 105 PID 3048 wrote to memory of 5900 3048 cmd.exe 109 PID 5900 wrote to memory of 3328 5900 XHIAX.exe 110 PID 3328 wrote to memory of 2484 3328 cmd.exe 114 PID 2484 wrote to memory of 2896 2484 OHKFAM.exe 115 PID 2896 wrote to memory of 1852 2896 cmd.exe 119 PID 1852 wrote to memory of 5316 1852 SXQN.exe 120 PID 5316 wrote to memory of 4844 5316 cmd.exe 124 PID 4844 wrote to memory of 2724 4844 WFXNYW.exe 125 PID 2724 wrote to memory of 2220 2724 cmd.exe 129 PID 2220 wrote to memory of 3240 2220 NGZSC.exe 130 PID 3240 wrote to memory of 5800 3240 cmd.exe 134 PID 5800 wrote to memory of 1568 5800 BQP.exe 135 PID 1568 wrote to memory of 1424 1568 cmd.exe 139 PID 1424 wrote to memory of 3572 1424 TTTNWV.exe 140 PID 3572 wrote to memory of 5632 3572 cmd.exe 144 PID 5632 wrote to memory of 2240 5632 JJU.exe 145 PID 2240 wrote to memory of 3212 2240 cmd.exe 149 PID 3212 wrote to memory of 2164 3212 NRBMP.exe 150 PID 2164 wrote to memory of 3540 2164 cmd.exe 154 PID 3540 wrote to memory of 5308 3540 PNFEZIH.exe 155 PID 5308 wrote to memory of 5788 5308 cmd.exe 159 PID 5788 wrote to memory of 3620 5788 RLLQGR.exe 160 PID 3620 wrote to memory of 724 3620 cmd.exe 164 PID 724 wrote to memory of 2372 724 KDABQKY.exe 165 PID 2372 wrote to memory of 1272 2372 cmd.exe 169 PID 1272 wrote to memory of 4456 1272 ATB.exe 170 PID 4456 wrote to memory of 5280 4456 cmd.exe 174 PID 5280 wrote to memory of 3964 5280 UGGKH.exe 175 PID 3964 wrote to memory of 4192 3964 cmd.exe 179 PID 4192 wrote to memory of 4804 4192 DMLQ.exe 180 PID 4804 wrote to memory of 1304 4804 cmd.exe 184 PID 1304 wrote to memory of 4184 1304 BFW.exe 185 PID 4184 wrote to memory of 3776 4184 cmd.exe 189 PID 3776 wrote to memory of 1292 3776 FNCGEC.exe 190 PID 1292 wrote to memory of 1184 1292 cmd.exe 194 PID 1184 wrote to memory of 5616 1184 SYLFSM.exe 195 PID 5616 wrote to memory of 2620 5616 cmd.exe 199 PID 2620 wrote to memory of 5412 2620 RIWVB.exe 200 PID 5412 wrote to memory of 1572 5412 cmd.exe 204 PID 1572 wrote to memory of 3380 1572 IRCSO.exe 205 PID 3380 wrote to memory of 4512 3380 cmd.exe 209 PID 4512 wrote to memory of 1108 4512 JMOWTZD.exe 210 PID 1108 wrote to memory of 4736 1108 cmd.exe 214 PID 4736 wrote to memory of 5520 4736 QCPVA.exe 215 PID 5520 wrote to memory of 3260 5520 cmd.exe 219 PID 3260 wrote to memory of 3008 3260 ZPTCK.exe 220 PID 3008 wrote to memory of 6028 3008 cmd.exe 224 PID 6028 wrote to memory of 5740 6028 XAES.exe 225 PID 5740 wrote to memory of 4464 5740 cmd.exe 229 PID 4464 wrote to memory of 3664 4464 MVOWEUS.exe 230 PID 3664 wrote to memory of 5072 3664 cmd.exe 234 PID 5072 wrote to memory of 3304 5072 LGQMNA.exe 235 PID 3304 wrote to memory of 3700 3304 cmd.exe 239 PID 3700 wrote to memory of 2784 3700 PWX.exe 240 PID 2784 wrote to memory of 2176 2784 cmd.exe 244 PID 2176 wrote to memory of 4740 2176 ZULHGB.exe 245 PID 4740 wrote to memory of 1192 4740 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_f2ae905a01b6631b7247386b63f952da_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_f2ae905a01b6631b7247386b63f952da_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JDZIXQ.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\windows\SysWOW64\JDZIXQ.exeC:\windows\system32\JDZIXQ.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\STTRIMS.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\windows\SysWOW64\STTRIMS.exeC:\windows\system32\STTRIMS.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CMD.exe.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5648 -
C:\windows\system\CMD.exeC:\windows\system\CMD.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5588 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XHIAX.exe.bat" "8⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\windows\SysWOW64\XHIAX.exeC:\windows\system32\XHIAX.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OHKFAM.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\windows\OHKFAM.exeC:\windows\OHKFAM.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SXQN.exe.bat" "12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\windows\SXQN.exeC:\windows\SXQN.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WFXNYW.exe.bat" "14⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5316 -
C:\windows\WFXNYW.exeC:\windows\WFXNYW.exe15⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NGZSC.exe.bat" "16⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\windows\SysWOW64\NGZSC.exeC:\windows\system32\NGZSC.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BQP.exe.bat" "18⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\windows\SysWOW64\BQP.exeC:\windows\system32\BQP.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TTTNWV.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\windows\system\TTTNWV.exeC:\windows\system\TTTNWV.exe21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JJU.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:3572 -
C:\windows\system\JJU.exeC:\windows\system\JJU.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5632 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NRBMP.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\windows\system\NRBMP.exeC:\windows\system\NRBMP.exe25⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PNFEZIH.exe.bat" "26⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\windows\system\PNFEZIH.exeC:\windows\system\PNFEZIH.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RLLQGR.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:5308 -
C:\windows\SysWOW64\RLLQGR.exeC:\windows\system32\RLLQGR.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KDABQKY.exe.bat" "30⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\windows\system\KDABQKY.exeC:\windows\system\KDABQKY.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ATB.exe.bat" "32⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\windows\system\ATB.exeC:\windows\system\ATB.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UGGKH.exe.bat" "34⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\windows\system\UGGKH.exeC:\windows\system\UGGKH.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DMLQ.exe.bat" "36⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\windows\DMLQ.exeC:\windows\DMLQ.exe37⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BFW.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\windows\BFW.exeC:\windows\BFW.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FNCGEC.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\windows\system\FNCGEC.exeC:\windows\system\FNCGEC.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SYLFSM.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\windows\SYLFSM.exeC:\windows\SYLFSM.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RIWVB.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:5616 -
C:\windows\SysWOW64\RIWVB.exeC:\windows\system32\RIWVB.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IRCSO.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:5412 -
C:\windows\SysWOW64\IRCSO.exeC:\windows\system32\IRCSO.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JMOWTZD.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\windows\JMOWTZD.exeC:\windows\JMOWTZD.exe49⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QCPVA.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\windows\system\QCPVA.exeC:\windows\system\QCPVA.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZPTCK.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:5520 -
C:\windows\ZPTCK.exeC:\windows\ZPTCK.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XAES.exe.bat" "54⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\windows\SysWOW64\XAES.exeC:\windows\system32\XAES.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6028 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MVOWEUS.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:5740 -
C:\windows\SysWOW64\MVOWEUS.exeC:\windows\system32\MVOWEUS.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LGQMNA.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:3664 -
C:\windows\LGQMNA.exeC:\windows\LGQMNA.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PWX.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\windows\PWX.exeC:\windows\PWX.exe61⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZULHGB.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\windows\system\ZULHGB.exeC:\windows\system\ZULHGB.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SXPD.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\windows\system\SXPD.exeC:\windows\system\SXPD.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1192 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EFVLYJI.exe.bat" "66⤵
- Executes a command shell one-liner
PID:3976 -
C:\windows\system\EFVLYJI.exeC:\windows\system\EFVLYJI.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NFX.exe.bat" "68⤵
- System Location Discovery: System Language Discovery
PID:3348 -
C:\windows\SysWOW64\NFX.exeC:\windows\system32\NFX.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TFFDS.exe.bat" "70⤵PID:4188
-
C:\windows\SysWOW64\TFFDS.exeC:\windows\system32\TFFDS.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LIJHYZN.exe.bat" "72⤵PID:388
-
C:\windows\SysWOW64\LIJHYZN.exeC:\windows\system32\LIJHYZN.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DRLMBE.exe.bat" "74⤵PID:1068
-
C:\windows\SysWOW64\DRLMBE.exeC:\windows\system32\DRLMBE.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VMOIPUZ.exe.bat" "76⤵
- Executes a command shell one-liner
PID:4932 -
C:\windows\SysWOW64\VMOIPUZ.exeC:\windows\system32\VMOIPUZ.exe77⤵
- Executes dropped EXE
PID:3908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QHTR.exe.bat" "78⤵PID:700
-
C:\windows\system\QHTR.exeC:\windows\system\QHTR.exe79⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3656 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RCX.exe.bat" "80⤵
- System Location Discovery: System Language Discovery
PID:2672 -
C:\windows\system\RCX.exeC:\windows\system\RCX.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GFGZ.exe.bat" "82⤵PID:712
-
C:\windows\system\GFGZ.exeC:\windows\system\GFGZ.exe83⤵
- Executes dropped EXE
PID:5784 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VVHZWSM.exe.bat" "84⤵PID:3548
-
C:\windows\system\VVHZWSM.exeC:\windows\system\VVHZWSM.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZDOZI.exe.bat" "86⤵PID:3456
-
C:\windows\ZDOZI.exeC:\windows\ZDOZI.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2276 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IDQ.exe.bat" "88⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2060 -
C:\windows\SysWOW64\IDQ.exeC:\windows\system32\IDQ.exe89⤵
- Executes dropped EXE
PID:3012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MTXMY.exe.bat" "90⤵
- Executes a command shell one-liner
PID:2368 -
C:\windows\MTXMY.exeC:\windows\MTXMY.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NXIIEQA.exe.bat" "92⤵
- Executes a command shell one-liner
PID:6096 -
C:\windows\NXIIEQA.exeC:\windows\NXIIEQA.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GSMLJG.exe.bat" "94⤵PID:4320
-
C:\windows\system\GSMLJG.exeC:\windows\system\GSMLJG.exe95⤵
- Executes dropped EXE
PID:5804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VVWQ.exe.bat" "96⤵PID:2944
-
C:\windows\system\VVWQ.exeC:\windows\system\VVWQ.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WQATHQ.exe.bat" "98⤵PID:2792
-
C:\windows\system\WQATHQ.exeC:\windows\system\WQATHQ.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QLE.exe.bat" "100⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2584 -
C:\windows\SysWOW64\QLE.exeC:\windows\system32\QLE.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4620 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LYJMU.exe.bat" "102⤵
- Executes a command shell one-liner
PID:5292 -
C:\windows\system\LYJMU.exeC:\windows\system\LYJMU.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PGQMGIL.exe.bat" "104⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:976 -
C:\windows\SysWOW64\PGQMGIL.exeC:\windows\system32\PGQMGIL.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EWRMN.exe.bat" "106⤵
- System Location Discovery: System Language Discovery
PID:4448 -
C:\windows\system\EWRMN.exeC:\windows\system\EWRMN.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NFTRQBK.exe.bat" "108⤵
- Executes a command shell one-liner
PID:3432 -
C:\windows\system\NFTRQBK.exeC:\windows\system\NFTRQBK.exe109⤵
- Executes dropped EXE
PID:1508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TFAE.exe.bat" "110⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:412 -
C:\windows\system\TFAE.exeC:\windows\system\TFAE.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZFISQY.exe.bat" "112⤵
- System Location Discovery: System Language Discovery
PID:1556 -
C:\windows\ZFISQY.exeC:\windows\ZFISQY.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZLAHSDP.exe.bat" "114⤵
- Executes a command shell one-liner
PID:3428 -
C:\windows\ZLAHSDP.exeC:\windows\ZLAHSDP.exe115⤵
- Executes dropped EXE
PID:4336 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OGSLD.exe.bat" "116⤵PID:1696
-
C:\windows\system\OGSLD.exeC:\windows\system\OGSLD.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5772 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WLKZMC.exe.bat" "118⤵
- Executes a command shell one-liner
PID:3544 -
C:\windows\WLKZMC.exeC:\windows\WLKZMC.exe119⤵
- Executes dropped EXE
PID:1532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YJX.exe.bat" "120⤵
- System Location Discovery: System Language Discovery
PID:5100 -
C:\windows\system\YJX.exeC:\windows\system\YJX.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3016
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-