Analysis
- max time kernel
63s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/08/2026, 18:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-02_681d94ed1333ab24e785be8c51f0adde_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-02_681d94ed1333ab24e785be8c51f0adde_elex_emotet_stop.exe
- Size 208KB
- Sample260802-wv93asea24
- SHA256 7e4149971dee64027a3586427372c5e1d180bed27da0926b1e1a2d9e8f981e9f
- MD5 681d94ed1333ab24e785be8c51f0adde
- SHA1 8007533106012ce20b46643062112d33be529d7f
- SHA512 8326756abfcf7d4143839d2abd659b3aa6edf44ebcbeddd8b7a9e1a84d0d287f7f15cfd3edeb0702ac39ab0dfa0e2c678be85da49a5c7864275b6715624c3531
- SSDEEP 3072:7tLQaL9tbLkRIgd1Lye9yjE2hWAN5XbslcdL+LOfB4pLthEjQT6j:7NlZtbLWIgd1LZ9oECZbslc5+LO5kEj1
- TLSH T100247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3060 JGIYX.exe 2548 QPFQ.exe 4792 IXUV.exe 632 BKFL.exe 6136 PGR.exe 5436 UGN.exe 5816 POODSAU.exe 3580 BEPV.exe 4172 RFX.exe 2616 RTQBKMK.exe 3508 GJELA.exe 3552 FBPB.exe 3480 BUQ.exe 1916 EPIN.exe 1864 MVU.exe 948 SQY.exe 4124 QGLEE.exe 5372 YUYKO.exe 2812 GZKZ.exe 2088 VPYJH.exe 5832 HAJWQI.exe 4920 ETKYCMY.exe 1892 VBZ.exe 5784 JWKWURJ.exe 2612 GXMHGV.exe 5804 XXBE.exe 5400 ASSF.exe 2584 TVWJKN.exe 5820 GTWVT.exe 5872 ZLLGD.exe 5540 YWOW.exe 3440 IUBQTO.exe 2576 KSHDAX.exe 3204 DKXNSY.exe 4304 CDZEA.exe 5972 BOCUJSB.exe 5688 OZTSPUW.exe 2272 WEXZAB.exe 2376 PHB.exe 6000 PCFYTHD.exe 6076 OVQO.exe 5364 BYYN.exe 5748 ARB.exe 4916 JRDI.exe 2192 REPP.exe 2816 NHYFTKC.exe 2084 LDXOX.exe 5124 GNN.exe 4616 XYQVUEJ.exe 2316 HWWPCM.exe 4572 AOLA.exe 4404 XPNCX.exe 5516 MFBUNY.exe 4724 LQLKN.exe 2636 EITVF.exe 3640 OGGPMOD.exe 3492 NRJFVU.exe 1344 KRTIZ.exe 5848 CCQ.exe 5812 VQXZ.exe 5864 DWJN.exe 4256 ABUVGTR.exe 3868 EESQG.exe 5544 RPI.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\IUBQTO.exe.bat YWOW.exe File created C:\windows\SysWOW64\DKXNSY.exe KSHDAX.exe File created C:\windows\SysWOW64\WEXZAB.exe.bat OZTSPUW.exe File created C:\windows\SysWOW64\RGFWWDP.exe.bat YNYLNCH.exe File opened for modification C:\windows\SysWOW64\HAJWQI.exe VPYJH.exe File created C:\windows\SysWOW64\VBZ.exe ETKYCMY.exe File created C:\windows\SysWOW64\KSHDAX.exe IUBQTO.exe File opened for modification C:\windows\SysWOW64\KSHDAX.exe IUBQTO.exe File created C:\windows\SysWOW64\AOLA.exe HWWPCM.exe File created C:\windows\SysWOW64\KRTIZ.exe.bat NRJFVU.exe File created C:\windows\SysWOW64\MVU.exe EPIN.exe File created C:\windows\SysWOW64\ARB.exe.bat BYYN.exe File opened for modification C:\windows\SysWOW64\JRDI.exe ARB.exe File created C:\windows\SysWOW64\HWWPCM.exe XYQVUEJ.exe File created C:\windows\SysWOW64\CCQ.exe.bat KRTIZ.exe File created C:\windows\SysWOW64\HAJWQI.exe VPYJH.exe File created C:\windows\SysWOW64\VBZ.exe.bat ETKYCMY.exe File created C:\windows\SysWOW64\IUBQTO.exe YWOW.exe File created C:\windows\SysWOW64\WEXZAB.exe OZTSPUW.exe File created C:\windows\SysWOW64\IXUV.exe QPFQ.exe File created C:\windows\SysWOW64\BEPV.exe POODSAU.exe File created C:\windows\SysWOW64\MVU.exe.bat EPIN.exe File created C:\windows\SysWOW64\VPYJH.exe.bat GZKZ.exe File opened for modification C:\windows\SysWOW64\WEXZAB.exe OZTSPUW.exe File created C:\windows\SysWOW64\CCQ.exe KRTIZ.exe File created C:\windows\SysWOW64\BEPV.exe.bat POODSAU.exe File opened for modification C:\windows\SysWOW64\VBZ.exe ETKYCMY.exe File created C:\windows\SysWOW64\JRDI.exe.bat ARB.exe File created C:\windows\SysWOW64\SQY.exe.bat MVU.exe File opened for modification C:\windows\SysWOW64\VPYJH.exe GZKZ.exe File created C:\windows\SysWOW64\YWOW.exe.bat ZLLGD.exe File created C:\windows\SysWOW64\JRDI.exe ARB.exe File opened for modification C:\windows\SysWOW64\AOLA.exe HWWPCM.exe File opened for modification C:\windows\SysWOW64\VQXZ.exe CCQ.exe File opened for modification C:\windows\SysWOW64\ARB.exe BYYN.exe File created C:\windows\SysWOW64\OGGPMOD.exe EITVF.exe File created C:\windows\SysWOW64\RPI.exe.bat EESQG.exe File opened for modification C:\windows\SysWOW64\IXUV.exe QPFQ.exe File created C:\windows\SysWOW64\GJELA.exe RTQBKMK.exe File opened for modification C:\windows\SysWOW64\MFBUNY.exe XPNCX.exe File created C:\windows\SysWOW64\VQXZ.exe.bat CCQ.exe File created C:\windows\SysWOW64\IXUV.exe.bat QPFQ.exe File opened for modification C:\windows\SysWOW64\BEPV.exe POODSAU.exe File created C:\windows\SysWOW64\MFBUNY.exe.bat XPNCX.exe File created C:\windows\SysWOW64\DWJN.exe VQXZ.exe File created C:\windows\SysWOW64\ARB.exe BYYN.exe File opened for modification C:\windows\SysWOW64\HWWPCM.exe XYQVUEJ.exe File created C:\windows\SysWOW64\RGFWWDP.exe YNYLNCH.exe File created C:\windows\SysWOW64\VPYJH.exe GZKZ.exe File created C:\windows\SysWOW64\YWOW.exe ZLLGD.exe File opened for modification C:\windows\SysWOW64\IUBQTO.exe YWOW.exe File created C:\windows\SysWOW64\MFBUNY.exe XPNCX.exe File created C:\windows\SysWOW64\KRTIZ.exe NRJFVU.exe File created C:\windows\SysWOW64\QPFQ.exe.bat JGIYX.exe File opened for modification C:\windows\SysWOW64\DKXNSY.exe KSHDAX.exe File created C:\windows\SysWOW64\AOLA.exe.bat HWWPCM.exe File created C:\windows\SysWOW64\OGGPMOD.exe.bat EITVF.exe File opened for modification C:\windows\SysWOW64\CCQ.exe KRTIZ.exe File opened for modification C:\windows\SysWOW64\RGFWWDP.exe YNYLNCH.exe File opened for modification C:\windows\SysWOW64\QPFQ.exe JGIYX.exe File opened for modification C:\windows\SysWOW64\MVU.exe EPIN.exe File opened for modification C:\windows\SysWOW64\YWOW.exe ZLLGD.exe File created C:\windows\SysWOW64\DKXNSY.exe.bat KSHDAX.exe File created C:\windows\SysWOW64\HWWPCM.exe.bat XYQVUEJ.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\OZTSPUW.exe.bat BOCUJSB.exe File created C:\windows\NHYFTKC.exe.bat REPP.exe File created C:\windows\NRJFVU.exe OGGPMOD.exe File created C:\windows\system\POODSAU.exe UGN.exe File opened for modification C:\windows\UGN.exe PGR.exe File created C:\windows\TVWJKN.exe.bat ASSF.exe File created C:\windows\BUQ.exe.bat FBPB.exe File opened for modification C:\windows\ASSF.exe XXBE.exe File opened for modification C:\windows\REPP.exe JRDI.exe File opened for modification C:\windows\system\XYQVUEJ.exe GNN.exe File created C:\windows\EESQG.exe ABUVGTR.exe File opened for modification C:\windows\system\POODSAU.exe UGN.exe File created C:\windows\RTQBKMK.exe HVLHC.exe File created C:\windows\system\QGLEE.exe.bat SQY.exe File created C:\windows\YUYKO.exe QGLEE.exe File opened for modification C:\windows\system\OZTSPUW.exe BOCUJSB.exe File created C:\windows\system\PHB.exe.bat WEXZAB.exe File created C:\windows\system\PCFYTHD.exe.bat PHB.exe File opened for modification C:\windows\BUQ.exe FBPB.exe File opened for modification C:\windows\system\QGLEE.exe SQY.exe File created C:\windows\system\GZKZ.exe YUYKO.exe File created C:\windows\system\BOCUJSB.exe CDZEA.exe File opened for modification C:\windows\NRJFVU.exe OGGPMOD.exe File created C:\windows\system\ABUVGTR.exe DWJN.exe File created C:\windows\system\OZTSPUW.exe BOCUJSB.exe File created C:\windows\NRJFVU.exe.bat OGGPMOD.exe File created C:\windows\system\ABUVGTR.exe.bat DWJN.exe File opened for modification C:\windows\EESQG.exe ABUVGTR.exe File opened for modification C:\windows\YUYKO.exe QGLEE.exe File created C:\windows\system\BOCUJSB.exe.bat CDZEA.exe File created C:\windows\system\BYYN.exe.bat OVQO.exe File created C:\windows\REPP.exe.bat JRDI.exe File opened for modification C:\windows\XPNCX.exe AOLA.exe File created C:\windows\BKFL.exe.bat IXUV.exe File created C:\windows\system\POODSAU.exe.bat UGN.exe File opened for modification C:\windows\system\FBPB.exe GJELA.exe File created C:\windows\system\GZKZ.exe.bat YUYKO.exe File created C:\windows\TVWJKN.exe ASSF.exe File created C:\windows\RTQBKMK.exe.bat HVLHC.exe File opened for modification C:\windows\system\ABUVGTR.exe DWJN.exe File created C:\windows\system\QALECDL.exe.bat RPI.exe File created C:\windows\system\ZLLGD.exe.bat GTWVT.exe File opened for modification C:\windows\system\GZKZ.exe YUYKO.exe File created C:\windows\system\CDZEA.exe.bat DKXNSY.exe File created C:\windows\BUQ.exe FBPB.exe File created C:\windows\YUYKO.exe.bat QGLEE.exe File created C:\windows\LDXOX.exe NHYFTKC.exe File created C:\windows\system\PGR.exe BKFL.exe File created C:\windows\LDXOX.exe.bat NHYFTKC.exe File created C:\windows\system\GNN.exe.bat LDXOX.exe File created C:\windows\ASSF.exe.bat XXBE.exe File created C:\windows\system\JWKWURJ.exe VBZ.exe File opened for modification C:\windows\system\XXBE.exe GXMHGV.exe File created C:\windows\system\GTWVT.exe TVWJKN.exe File opened for modification C:\windows\system\PCFYTHD.exe PHB.exe File created C:\windows\system\XYQVUEJ.exe.bat GNN.exe File opened for modification C:\windows\system\GXMHGV.exe JWKWURJ.exe File created C:\windows\LQLKN.exe MFBUNY.exe File created C:\windows\system\HWGND.exe RGFWWDP.exe File opened for modification C:\windows\RTQBKMK.exe HVLHC.exe File created C:\windows\system\XXBE.exe GXMHGV.exe File opened for modification C:\windows\system\PHB.exe WEXZAB.exe File created C:\windows\EITVF.exe.bat LQLKN.exe File created C:\windows\system\ZLLGD.exe GTWVT.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5644 cmd.exe 3444 cmd.exe 1844 cmd.exe 1432 cmd.exe 4896 cmd.exe 5132 cmd.exe 5284 cmd.exe 2888 cmd.exe 5416 cmd.exe 4504 cmd.exe 712 cmd.exe 2992 cmd.exe 5536 cmd.exe 4636 cmd.exe 2572 cmd.exe 6112 cmd.exe 4120 cmd.exe 1644 cmd.exe 488 cmd.exe 3468 cmd.exe 1936 cmd.exe 5188 cmd.exe 5212 cmd.exe 4332 cmd.exe 6088 cmd.exe 1888 cmd.exe 4832 cmd.exe 252 cmd.exe 4592 cmd.exe 5196 cmd.exe 4168 cmd.exe 4448 cmd.exe 728 cmd.exe 1860 cmd.exe 1700 cmd.exe 3692 cmd.exe 4516 cmd.exe 5180 cmd.exe 4512 cmd.exe 2752 cmd.exe 4372 cmd.exe 2532 cmd.exe 5128 cmd.exe 2076 cmd.exe 5440 cmd.exe 2960 cmd.exe 1496 cmd.exe 2928 cmd.exe 3124 cmd.exe 5592 cmd.exe 1800 cmd.exe 1412 cmd.exe 3420 cmd.exe 4144 cmd.exe 2864 cmd.exe 5164 cmd.exe 1808 cmd.exe 2860 cmd.exe 4780 cmd.exe 5420 cmd.exe 2308 cmd.exe 2632 cmd.exe 1564 cmd.exe 4560 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 4116 608 WerFault.exe 87 2828 3060 WerFault.exe 92 2752 2548 WerFault.exe 98 4608 4792 WerFault.exe 103 4600 632 WerFault.exe 108 3900 6136 WerFault.exe 113 2652 5436 WerFault.exe 118 4604 5816 WerFault.exe 123 5808 3580 WerFault.exe 128 2164 4172 WerFault.exe 133 3124 4272 WerFault.exe 137 3800 2616 WerFault.exe 143 4920 3508 WerFault.exe 148 3232 3552 WerFault.exe 153 5076 3480 WerFault.exe 158 5544 1916 WerFault.exe 163 1120 1864 WerFault.exe 168 4892 948 WerFault.exe 173 3512 4124 WerFault.exe 178 924 5372 WerFault.exe 183 2980 2812 WerFault.exe 188 6012 2088 WerFault.exe 193 2940 5832 WerFault.exe 198 1964 4920 WerFault.exe 203 5184 1892 WerFault.exe 208 6112 5784 WerFault.exe 213 4184 2612 WerFault.exe 218 2076 5804 WerFault.exe 222 5548 5400 WerFault.exe 228 1668 2584 WerFault.exe 233 5848 5820 WerFault.exe 237 1584 5872 WerFault.exe 243 5508 5540 WerFault.exe 249 2300 3440 WerFault.exe 254 1364 2576 WerFault.exe 259 4676 3204 WerFault.exe 264 5732 4304 WerFault.exe 269 2572 5972 WerFault.exe 274 3972 5688 WerFault.exe 279 2504 2272 WerFault.exe 284 2980 2376 WerFault.exe 289 5692 6000 WerFault.exe 294 4264 6076 WerFault.exe 299 1088 5364 WerFault.exe 304 4872 5748 WerFault.exe 309 5764 4916 WerFault.exe 314 5300 2192 WerFault.exe 319 1060 2816 WerFault.exe 324 2932 2084 WerFault.exe 329 1228 5124 WerFault.exe 334 1084 4616 WerFault.exe 338 5776 2316 WerFault.exe 344 3916 4572 WerFault.exe 349 3548 4404 WerFault.exe 354 1044 5516 WerFault.exe 359 3816 4724 WerFault.exe 364 2092 2636 WerFault.exe 368 1140 3640 WerFault.exe 374 4300 3492 WerFault.exe 379 5444 1344 WerFault.exe 384 4944 5848 WerFault.exe 389 3188 5812 WerFault.exe 394 6128 5864 WerFault.exe 399 2052 4256 WerFault.exe 404 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GJELA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BEPV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YUYKO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HAJWQI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UGN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TVWJKN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REPP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VQXZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RGFWWDP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XYQVUEJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SQY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ASSF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GTWVT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZLLGD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YWOW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BOCUJSB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ARB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RTQBKMK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VPYJH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JGIYX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KSHDAX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PHB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WEXZAB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PCFYTHD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language POODSAU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ABUVGTR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GXMHGV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QGLEE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XPNCX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NRJFVU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EPIN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_681d94ed1333ab24e785be8c51f0adde_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBPB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JWKWURJ.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 608 2026-08-02_681d94ed1333ab24e785be8c51f0adde_elex_emotet_stop.exe 608 2026-08-02_681d94ed1333ab24e785be8c51f0adde_elex_emotet_stop.exe 3060 JGIYX.exe 3060 JGIYX.exe 2548 QPFQ.exe 2548 QPFQ.exe 4792 IXUV.exe 4792 IXUV.exe 632 BKFL.exe 632 BKFL.exe 6136 PGR.exe 6136 PGR.exe 5436 UGN.exe 5436 UGN.exe 5816 POODSAU.exe 5816 POODSAU.exe 3580 BEPV.exe 3580 BEPV.exe 4272 HVLHC.exe 4272 HVLHC.exe 2616 RTQBKMK.exe 2616 RTQBKMK.exe 3508 GJELA.exe 3508 GJELA.exe 3552 FBPB.exe 3552 FBPB.exe 3480 BUQ.exe 3480 BUQ.exe 1916 EPIN.exe 1916 EPIN.exe 1864 MVU.exe 1864 MVU.exe 948 SQY.exe 948 SQY.exe 4124 QGLEE.exe 4124 QGLEE.exe 5372 YUYKO.exe 5372 YUYKO.exe 2812 GZKZ.exe 2812 GZKZ.exe 2088 VPYJH.exe 2088 VPYJH.exe 5832 HAJWQI.exe 5832 HAJWQI.exe 4920 ETKYCMY.exe 4920 ETKYCMY.exe 1892 VBZ.exe 1892 VBZ.exe 5784 JWKWURJ.exe 5784 JWKWURJ.exe 2612 GXMHGV.exe 2612 GXMHGV.exe 5804 XXBE.exe 5804 XXBE.exe 5400 ASSF.exe 5400 ASSF.exe 2584 TVWJKN.exe 2584 TVWJKN.exe 5820 GTWVT.exe 5820 GTWVT.exe 5872 ZLLGD.exe 5872 ZLLGD.exe 5540 YWOW.exe 5540 YWOW.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 608 2026-08-02_681d94ed1333ab24e785be8c51f0adde_elex_emotet_stop.exe 608 2026-08-02_681d94ed1333ab24e785be8c51f0adde_elex_emotet_stop.exe 3060 JGIYX.exe 3060 JGIYX.exe 2548 QPFQ.exe 2548 QPFQ.exe 4792 IXUV.exe 4792 IXUV.exe 632 BKFL.exe 632 BKFL.exe 6136 PGR.exe 6136 PGR.exe 5436 UGN.exe 5436 UGN.exe 5816 POODSAU.exe 5816 POODSAU.exe 3580 BEPV.exe 3580 BEPV.exe 4272 HVLHC.exe 4272 HVLHC.exe 2616 RTQBKMK.exe 2616 RTQBKMK.exe 3508 GJELA.exe 3508 GJELA.exe 3552 FBPB.exe 3552 FBPB.exe 3480 BUQ.exe 3480 BUQ.exe 1916 EPIN.exe 1916 EPIN.exe 1864 MVU.exe 1864 MVU.exe 948 SQY.exe 948 SQY.exe 4124 QGLEE.exe 4124 QGLEE.exe 5372 YUYKO.exe 5372 YUYKO.exe 2812 GZKZ.exe 2812 GZKZ.exe 2088 VPYJH.exe 2088 VPYJH.exe 5832 HAJWQI.exe 5832 HAJWQI.exe 4920 ETKYCMY.exe 4920 ETKYCMY.exe 1892 VBZ.exe 1892 VBZ.exe 5784 JWKWURJ.exe 5784 JWKWURJ.exe 2612 GXMHGV.exe 2612 GXMHGV.exe 5804 XXBE.exe 5804 XXBE.exe 5400 ASSF.exe 5400 ASSF.exe 2584 TVWJKN.exe 2584 TVWJKN.exe 5820 GTWVT.exe 5820 GTWVT.exe 5872 ZLLGD.exe 5872 ZLLGD.exe 5540 YWOW.exe 5540 YWOW.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 608 wrote to memory of 1932 608 2026-08-02_681d94ed1333ab24e785be8c51f0adde_elex_emotet_stop.exe 88 PID 1932 wrote to memory of 3060 1932 cmd.exe 92 PID 3060 wrote to memory of 1412 3060 JGIYX.exe 94 PID 1412 wrote to memory of 2548 1412 cmd.exe 98 PID 2548 wrote to memory of 4972 2548 QPFQ.exe 99 PID 4972 wrote to memory of 4792 4972 cmd.exe 103 PID 4792 wrote to memory of 3424 4792 IXUV.exe 104 PID 3424 wrote to memory of 632 3424 cmd.exe 108 PID 632 wrote to memory of 3044 632 BKFL.exe 109 PID 3044 wrote to memory of 6136 3044 cmd.exe 113 PID 6136 wrote to memory of 1644 6136 PGR.exe 114 PID 1644 wrote to memory of 5436 1644 cmd.exe 118 PID 5436 wrote to memory of 2356 5436 UGN.exe 119 PID 2356 wrote to memory of 5816 2356 cmd.exe 123 PID 5816 wrote to memory of 4848 5816 POODSAU.exe 124 PID 4848 wrote to memory of 3580 4848 cmd.exe 128 PID 3580 wrote to memory of 2512 3580 BEPV.exe 129 PID 2512 wrote to memory of 4172 2512 cmd.exe 133 PID 2644 wrote to memory of 4272 2644 cmd.exe 137 PID 4272 wrote to memory of 5552 4272 HVLHC.exe 139 PID 5552 wrote to memory of 2616 5552 cmd.exe 143 PID 2616 wrote to memory of 488 2616 RTQBKMK.exe 144 PID 488 wrote to memory of 3508 488 cmd.exe 148 PID 3508 wrote to memory of 5196 3508 GJELA.exe 149 PID 5196 wrote to memory of 3552 5196 cmd.exe 153 PID 3552 wrote to memory of 3420 3552 FBPB.exe 154 PID 3420 wrote to memory of 3480 3420 cmd.exe 158 PID 3480 wrote to memory of 4948 3480 BUQ.exe 159 PID 4948 wrote to memory of 1916 4948 cmd.exe 163 PID 1916 wrote to memory of 3444 1916 EPIN.exe 164 PID 3444 wrote to memory of 1864 3444 cmd.exe 168 PID 1864 wrote to memory of 2960 1864 MVU.exe 169 PID 2960 wrote to memory of 948 2960 cmd.exe 173 PID 948 wrote to memory of 4816 948 SQY.exe 174 PID 4816 wrote to memory of 4124 4816 cmd.exe 178 PID 4124 wrote to memory of 4656 4124 QGLEE.exe 179 PID 4656 wrote to memory of 5372 4656 cmd.exe 183 PID 5372 wrote to memory of 868 5372 YUYKO.exe 184 PID 868 wrote to memory of 2812 868 cmd.exe 188 PID 2812 wrote to memory of 2116 2812 GZKZ.exe 189 PID 2116 wrote to memory of 2088 2116 cmd.exe 193 PID 2088 wrote to memory of 1564 2088 VPYJH.exe 194 PID 1564 wrote to memory of 5832 1564 cmd.exe 198 PID 5832 wrote to memory of 4144 5832 HAJWQI.exe 199 PID 4144 wrote to memory of 4920 4144 cmd.exe 203 PID 4920 wrote to memory of 4560 4920 ETKYCMY.exe 204 PID 4560 wrote to memory of 1892 4560 cmd.exe 208 PID 1892 wrote to memory of 2452 1892 VBZ.exe 209 PID 2452 wrote to memory of 5784 2452 cmd.exe 213 PID 5784 wrote to memory of 3940 5784 JWKWURJ.exe 214 PID 3940 wrote to memory of 2612 3940 cmd.exe 218 PID 2612 wrote to memory of 2860 2612 GXMHGV.exe 219 PID 2860 wrote to memory of 5804 2860 cmd.exe 222 PID 5804 wrote to memory of 3144 5804 XXBE.exe 224 PID 3144 wrote to memory of 5400 3144 cmd.exe 228 PID 5400 wrote to memory of 4504 5400 ASSF.exe 229 PID 4504 wrote to memory of 2584 4504 cmd.exe 233 PID 2584 wrote to memory of 5448 2584 TVWJKN.exe 234 PID 5448 wrote to memory of 5820 5448 cmd.exe 237 PID 5820 wrote to memory of 1860 5820 GTWVT.exe 240 PID 1860 wrote to memory of 5872 1860 cmd.exe 243 PID 5872 wrote to memory of 3192 5872 ZLLGD.exe 245 PID 3192 wrote to memory of 5540 3192 cmd.exe 249 PID 5540 wrote to memory of 3104 5540 YWOW.exe 250
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_681d94ed1333ab24e785be8c51f0adde_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_681d94ed1333ab24e785be8c51f0adde_elex_emotet_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:608 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JGIYX.exe.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\windows\system\JGIYX.exeC:\windows\system\JGIYX.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QPFQ.exe.bat" "4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\windows\SysWOW64\QPFQ.exeC:\windows\system32\QPFQ.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IXUV.exe.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\windows\SysWOW64\IXUV.exeC:\windows\system32\IXUV.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BKFL.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\windows\BKFL.exeC:\windows\BKFL.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:632 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PGR.exe.bat" "10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\windows\system\PGR.exeC:\windows\system\PGR.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6136 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UGN.exe.bat" "12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\windows\UGN.exeC:\windows\UGN.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\POODSAU.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\windows\system\POODSAU.exeC:\windows\system\POODSAU.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BEPV.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\windows\SysWOW64\BEPV.exeC:\windows\system32\BEPV.exe17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RFX.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\windows\system\RFX.exeC:\windows\system\RFX.exe19⤵
- Executes dropped EXE
PID:4172 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HVLHC.exe.bat" "20⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\windows\HVLHC.exeC:\windows\HVLHC.exe21⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RTQBKMK.exe.bat" "22⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5552 -
C:\windows\RTQBKMK.exeC:\windows\RTQBKMK.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GJELA.exe.bat" "24⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:488 -
C:\windows\SysWOW64\GJELA.exeC:\windows\system32\GJELA.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FBPB.exe.bat" "26⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5196 -
C:\windows\system\FBPB.exeC:\windows\system\FBPB.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BUQ.exe.bat" "28⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\windows\BUQ.exeC:\windows\BUQ.exe29⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EPIN.exe.bat" "30⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\windows\EPIN.exeC:\windows\EPIN.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MVU.exe.bat" "32⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\windows\SysWOW64\MVU.exeC:\windows\system32\MVU.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SQY.exe.bat" "34⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\windows\SysWOW64\SQY.exeC:\windows\system32\SQY.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QGLEE.exe.bat" "36⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\windows\system\QGLEE.exeC:\windows\system\QGLEE.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YUYKO.exe.bat" "38⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\windows\YUYKO.exeC:\windows\YUYKO.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5372 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GZKZ.exe.bat" "40⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:868 -
C:\windows\system\GZKZ.exeC:\windows\system\GZKZ.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VPYJH.exe.bat" "42⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\windows\SysWOW64\VPYJH.exeC:\windows\system32\VPYJH.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HAJWQI.exe.bat" "44⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\windows\SysWOW64\HAJWQI.exeC:\windows\system32\HAJWQI.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ETKYCMY.exe.bat" "46⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\windows\system\ETKYCMY.exeC:\windows\system\ETKYCMY.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VBZ.exe.bat" "48⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\windows\SysWOW64\VBZ.exeC:\windows\system32\VBZ.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JWKWURJ.exe.bat" "50⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\windows\system\JWKWURJ.exeC:\windows\system\JWKWURJ.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5784 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GXMHGV.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\windows\system\GXMHGV.exeC:\windows\system\GXMHGV.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XXBE.exe.bat" "54⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\windows\system\XXBE.exeC:\windows\system\XXBE.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ASSF.exe.bat" "56⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\windows\ASSF.exeC:\windows\ASSF.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TVWJKN.exe.bat" "58⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\windows\TVWJKN.exeC:\windows\TVWJKN.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GTWVT.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:5448 -
C:\windows\system\GTWVT.exeC:\windows\system\GTWVT.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZLLGD.exe.bat" "62⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\windows\system\ZLLGD.exeC:\windows\system\ZLLGD.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YWOW.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\windows\SysWOW64\YWOW.exeC:\windows\system32\YWOW.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IUBQTO.exe.bat" "66⤵PID:3104
-
C:\windows\SysWOW64\IUBQTO.exeC:\windows\system32\IUBQTO.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KSHDAX.exe.bat" "68⤵PID:5504
-
C:\windows\SysWOW64\KSHDAX.exeC:\windows\system32\KSHDAX.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DKXNSY.exe.bat" "70⤵PID:3068
-
C:\windows\SysWOW64\DKXNSY.exeC:\windows\system32\DKXNSY.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3204 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CDZEA.exe.bat" "72⤵PID:2944
-
C:\windows\system\CDZEA.exeC:\windows\system\CDZEA.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BOCUJSB.exe.bat" "74⤵PID:4216
-
C:\windows\system\BOCUJSB.exeC:\windows\system\BOCUJSB.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OZTSPUW.exe.bat" "76⤵
- System Location Discovery: System Language Discovery
PID:3720 -
C:\windows\system\OZTSPUW.exeC:\windows\system\OZTSPUW.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WEXZAB.exe.bat" "78⤵PID:3196
-
C:\windows\SysWOW64\WEXZAB.exeC:\windows\system32\WEXZAB.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2272 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PHB.exe.bat" "80⤵
- Executes a command shell one-liner
PID:1496 -
C:\windows\system\PHB.exeC:\windows\system\PHB.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PCFYTHD.exe.bat" "82⤵PID:4672
-
C:\windows\system\PCFYTHD.exeC:\windows\system\PCFYTHD.exe83⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OVQO.exe.bat" "84⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:712 -
C:\windows\OVQO.exeC:\windows\OVQO.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BYYN.exe.bat" "86⤵PID:4532
-
C:\windows\system\BYYN.exeC:\windows\system\BYYN.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ARB.exe.bat" "88⤵
- System Location Discovery: System Language Discovery
PID:3536 -
C:\windows\SysWOW64\ARB.exeC:\windows\system32\ARB.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JRDI.exe.bat" "90⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2928 -
C:\windows\SysWOW64\JRDI.exeC:\windows\system32\JRDI.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\REPP.exe.bat" "92⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3468 -
C:\windows\REPP.exeC:\windows\REPP.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2192 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NHYFTKC.exe.bat" "94⤵PID:3432
-
C:\windows\NHYFTKC.exeC:\windows\NHYFTKC.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LDXOX.exe.bat" "96⤵
- Executes a command shell one-liner
PID:1936 -
C:\windows\LDXOX.exeC:\windows\LDXOX.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GNN.exe.bat" "98⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2992 -
C:\windows\system\GNN.exeC:\windows\system\GNN.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XYQVUEJ.exe.bat" "100⤵
- System Location Discovery: System Language Discovery
PID:2444 -
C:\windows\system\XYQVUEJ.exeC:\windows\system\XYQVUEJ.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HWWPCM.exe.bat" "102⤵PID:4444
-
C:\windows\SysWOW64\HWWPCM.exeC:\windows\system32\HWWPCM.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2316 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AOLA.exe.bat" "104⤵PID:4212
-
C:\windows\SysWOW64\AOLA.exeC:\windows\system32\AOLA.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XPNCX.exe.bat" "106⤵
- System Location Discovery: System Language Discovery
PID:3000 -
C:\windows\XPNCX.exeC:\windows\XPNCX.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MFBUNY.exe.bat" "108⤵
- System Location Discovery: System Language Discovery
PID:1964 -
C:\windows\SysWOW64\MFBUNY.exeC:\windows\system32\MFBUNY.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LQLKN.exe.bat" "110⤵
- System Location Discovery: System Language Discovery
PID:2184 -
C:\windows\LQLKN.exeC:\windows\LQLKN.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EITVF.exe.bat" "112⤵PID:6008
-
C:\windows\EITVF.exeC:\windows\EITVF.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2636 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OGGPMOD.exe.bat" "114⤵PID:2400
-
C:\windows\SysWOW64\OGGPMOD.exeC:\windows\system32\OGGPMOD.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NRJFVU.exe.bat" "116⤵PID:2524
-
C:\windows\NRJFVU.exeC:\windows\NRJFVU.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KRTIZ.exe.bat" "118⤵PID:4520
-
C:\windows\SysWOW64\KRTIZ.exeC:\windows\system32\KRTIZ.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CCQ.exe.bat" "120⤵
- System Location Discovery: System Language Discovery
PID:5016 -
C:\windows\SysWOW64\CCQ.exeC:\windows\system32\CCQ.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5848
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-