Analysis
- max time kernel
78s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/08/2026, 18:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-02_4629f995e7e2f162e3e80c01937bcb41_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-02_4629f995e7e2f162e3e80c01937bcb41_elex_emotet_stop.exe
- Size 448KB
- Sample260802-xfg9eaec59
- SHA256 1042f2acf93609caf8f0f96321a05ea9a6cf5058290190fb0486aa22c07e95c1
- MD5 4629f995e7e2f162e3e80c01937bcb41
- SHA1 ff0f13ffdab59727ce654590e9cd0a376f31e60e
- SHA512 65f130d61175ea7e178d19563c0e10b16193dd8bca182a6ba51a0ae8f38bcb1a06f5d2f2077e05d29c2c58f8c98149ad90dd24837be5a0c04e4b48c715154e58
- SSDEEP 6144:TlZtbLWIgd1LZ9oECZbxlUS+LO+kEjiPISUOgW9X+hOGzC/NM:RLWI09QZb6LO+kmZzcukG2/
- TLSH T18EA49F20B9D58673E2630135689AF1A4B3BABCA0F765C28B3158B71C2773B90173E75D
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5388 HZTPOCL.exe 5940 RSPPB.exe 1060 WSZR.exe 460 MIMJV.exe 2780 VRO.exe 596 BRW.exe 4356 WUE.exe 4524 RHJJG.exe 5220 PCIKLO.exe 5060 KNRJRR.exe 4296 OVF.exe 620 WJK.exe 2892 AMILOB.exe 1768 KKW.exe 2512 VCD.exe 5352 LSEPTGY.exe 2764 ELTADZG.exe 3008 XOXW.exe 2080 VZA.exe 5988 REUQK.exe 4240 BCNCAC.exe 5384 NFX.exe 1780 VTC.exe 1332 STMZYJP.exe 5964 FWUXMUK.exe 5936 KWEAQQ.exe 4652 BFSFDH.exe 4056 APVVL.exe 5484 CNBHT.exe 2576 OVHPFNH.exe 3728 EGSFNB.exe 2880 ARAW.exe 3544 SUE.exe 4960 TXIVN.exe 2208 GVQ.exe 1920 OIV.exe 236 LGN.exe 5536 RBMM.exe 1724 AOXEKXN.exe 4452 RPZ.exe 5768 QHBZWJD.exe 5648 FCLDH.exe 2896 TATP.exe 1448 VYYJYP.exe 4552 VBCFE.exe 4492 BBKTVHH.exe 4620 HCR.exe 2184 CPWQ.exe 3476 RFX.exe 4104 TDDJCFU.exe 1928 DAREK.exe 1028 SGOTRX.exe 5344 AMPHACA.exe 2668 SPSL.exe 4484 YPAZPV.exe 3480 QPC.exe 3324 KDHN.exe 5224 TQRFSXP.exe 3780 SBUVBD.exe 5296 WRBV.exe 4048 EWBK.exe 4632 YKGTZA.exe 4736 TFK.exe 1952 OSPUL.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\BRW.exe.bat VRO.exe File created C:\windows\SysWOW64\REUQK.exe VZA.exe File created C:\windows\SysWOW64\LGN.exe OIV.exe File created C:\windows\SysWOW64\BRW.exe VRO.exe File created C:\windows\SysWOW64\PCIKLO.exe RHJJG.exe File opened for modification C:\windows\SysWOW64\OVF.exe KNRJRR.exe File opened for modification C:\windows\SysWOW64\VCD.exe KKW.exe File created C:\windows\SysWOW64\LHMTNU.exe.bat UYSOKPP.exe File created C:\windows\SysWOW64\RUKJ.exe WGFAHVD.exe File opened for modification C:\windows\SysWOW64\RUKJ.exe WGFAHVD.exe File opened for modification C:\windows\SysWOW64\PCIKLO.exe RHJJG.exe File created C:\windows\SysWOW64\YKGTZA.exe EWBK.exe File created C:\windows\SysWOW64\ACDF.exe LHMTNU.exe File opened for modification C:\windows\SysWOW64\OLQWREI.exe OGYIPZ.exe File created C:\windows\SysWOW64\VRO.exe MIMJV.exe File created C:\windows\SysWOW64\VRO.exe.bat MIMJV.exe File created C:\windows\SysWOW64\VZA.exe.bat XOXW.exe File created C:\windows\SysWOW64\NRF.exe NLETMCM.exe File opened for modification C:\windows\SysWOW64\IGP.exe FYIV.exe File created C:\windows\SysWOW64\MIMJV.exe.bat WSZR.exe File opened for modification C:\windows\SysWOW64\BRW.exe VRO.exe File created C:\windows\SysWOW64\VQOZAD.exe.bat AUKQ.exe File created C:\windows\SysWOW64\WSZR.exe.bat RSPPB.exe File created C:\windows\SysWOW64\ACDF.exe.bat LHMTNU.exe File opened for modification C:\windows\SysWOW64\LEOZLH.exe LYOKC.exe File opened for modification C:\windows\SysWOW64\AZXD.exe LEOZLH.exe File created C:\windows\SysWOW64\NFX.exe BCNCAC.exe File created C:\windows\SysWOW64\GVQ.exe TXIVN.exe File created C:\windows\SysWOW64\GVQ.exe.bat TXIVN.exe File created C:\windows\SysWOW64\BBKTVHH.exe VBCFE.exe File opened for modification C:\windows\SysWOW64\YKGTZA.exe EWBK.exe File opened for modification C:\windows\SysWOW64\OTIN.exe UGDEKTR.exe File created C:\windows\SysWOW64\KKW.exe.bat AMILOB.exe File created C:\windows\SysWOW64\VZA.exe XOXW.exe File created C:\windows\SysWOW64\SGOTRX.exe DAREK.exe File created C:\windows\SysWOW64\LEOZLH.exe LYOKC.exe File created C:\windows\SysWOW64\OLQWREI.exe.bat OGYIPZ.exe File created C:\windows\SysWOW64\RSPPB.exe HZTPOCL.exe File opened for modification C:\windows\SysWOW64\SPSL.exe AMPHACA.exe File created C:\windows\SysWOW64\XAFHD.exe.bat TSR.exe File created C:\windows\SysWOW64\OTIN.exe UGDEKTR.exe File created C:\windows\SysWOW64\BIBVDX.exe.bat VUCMGC.exe File opened for modification C:\windows\SysWOW64\VRO.exe MIMJV.exe File created C:\windows\SysWOW64\VYYJYP.exe.bat TATP.exe File created C:\windows\SysWOW64\KKXBOT.exe.bat XHTVICE.exe File created C:\windows\SysWOW64\KNRJRR.exe.bat PCIKLO.exe File created C:\windows\SysWOW64\REUQK.exe.bat VZA.exe File created C:\windows\SysWOW64\NRF.exe.bat NLETMCM.exe File created C:\windows\SysWOW64\KKXBOT.exe XHTVICE.exe File created C:\windows\SysWOW64\UGDEKTR.exe XAFHD.exe File opened for modification C:\windows\SysWOW64\VQOZAD.exe AUKQ.exe File created C:\windows\SysWOW64\RSPPB.exe.bat HZTPOCL.exe File opened for modification C:\windows\SysWOW64\VZA.exe XOXW.exe File opened for modification C:\windows\SysWOW64\TXIVN.exe SUE.exe File created C:\windows\SysWOW64\SPSL.exe AMPHACA.exe File created C:\windows\SysWOW64\TQRFSXP.exe.bat KDHN.exe File created C:\windows\SysWOW64\HMJR.exe NRF.exe File created C:\windows\SysWOW64\UGDEKTR.exe.bat XAFHD.exe File opened for modification C:\windows\SysWOW64\WSZR.exe RSPPB.exe File created C:\windows\SysWOW64\VCD.exe.bat KKW.exe File opened for modification C:\windows\SysWOW64\GVQ.exe TXIVN.exe File created C:\windows\SysWOW64\VYYJYP.exe TATP.exe File opened for modification C:\windows\SysWOW64\BIBVDX.exe VUCMGC.exe File created C:\windows\SysWOW64\IGP.exe.bat FYIV.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\ARAW.exe.bat EGSFNB.exe File created C:\windows\system\HZTPOCL.exe 2026-08-02_4629f995e7e2f162e3e80c01937bcb41_elex_emotet_stop.exe File created C:\windows\XOXW.exe.bat ELTADZG.exe File opened for modification C:\windows\DAREK.exe TDDJCFU.exe File opened for modification C:\windows\SBUVBD.exe TQRFSXP.exe File created C:\windows\VUCMGC.exe AZXD.exe File opened for modification C:\windows\VUCMGC.exe AZXD.exe File created C:\windows\system\PHB.exe ACDF.exe File created C:\windows\system\ELTADZG.exe.bat LSEPTGY.exe File created C:\windows\EGSFNB.exe.bat OVHPFNH.exe File created C:\windows\system\RBMM.exe.bat LGN.exe File created C:\windows\HCR.exe.bat BBKTVHH.exe File opened for modification C:\windows\XHTVICE.exe HMJR.exe File created C:\windows\EXCUMEQ.exe.bat PHB.exe File created C:\windows\system\KQYSV.exe KLYE.exe File created C:\windows\XOXW.exe ELTADZG.exe File created C:\windows\system\OIV.exe.bat GVQ.exe File created C:\windows\FCLDH.exe QHBZWJD.exe File created C:\windows\ZLH.exe EXCUMEQ.exe File created C:\windows\system\OIV.exe GVQ.exe File created C:\windows\system\QPC.exe YPAZPV.exe File created C:\windows\system\EWBK.exe WRBV.exe File created C:\windows\UYSOKPP.exe IGP.exe File created C:\windows\system\WUE.exe.bat BRW.exe File created C:\windows\system\RPZ.exe AOXEKXN.exe File opened for modification C:\windows\system\QHBZWJD.exe RPZ.exe File created C:\windows\CPWQ.exe.bat HCR.exe File created C:\windows\system\RFX.exe CPWQ.exe File created C:\windows\system\TDDJCFU.exe.bat RFX.exe File opened for modification C:\windows\system\OGYIPZ.exe ZLH.exe File created C:\windows\AUKQ.exe.bat RUI.exe File created C:\windows\EGSFNB.exe OVHPFNH.exe File opened for modification C:\windows\system\TATP.exe FCLDH.exe File opened for modification C:\windows\system\NLETMCM.exe BDY.exe File created C:\windows\system\PHB.exe.bat ACDF.exe File opened for modification C:\windows\system\WGFAHVD.exe KQYSV.exe File opened for modification C:\windows\system\ARAW.exe EGSFNB.exe File opened for modification C:\windows\system\BCNCAC.exe REUQK.exe File created C:\windows\system\RPZ.exe.bat AOXEKXN.exe File opened for modification C:\windows\CPWQ.exe HCR.exe File created C:\windows\RUI.exe LUAXDD.exe File created C:\windows\system\WJK.exe OVF.exe File opened for modification C:\windows\AMILOB.exe WJK.exe File created C:\windows\AMILOB.exe.bat WJK.exe File created C:\windows\system\BFSFDH.exe KWEAQQ.exe File created C:\windows\system\RFX.exe.bat CPWQ.exe File opened for modification C:\windows\system\KDHN.exe QPC.exe File created C:\windows\system\KDHN.exe.bat QPC.exe File opened for modification C:\windows\XOXW.exe ELTADZG.exe File opened for modification C:\windows\KWEAQQ.exe FWUXMUK.exe File created C:\windows\DAREK.exe TDDJCFU.exe File created C:\windows\RHJJG.exe WUE.exe File opened for modification C:\windows\LSEPTGY.exe VCD.exe File created C:\windows\system\TATP.exe FCLDH.exe File created C:\windows\system\YPAZPV.exe SPSL.exe File created C:\windows\system\TSR.exe KKXBOT.exe File created C:\windows\system\OGYIPZ.exe.bat ZLH.exe File created C:\windows\system\ELTADZG.exe LSEPTGY.exe File opened for modification C:\windows\FCLDH.exe QHBZWJD.exe File created C:\windows\WRBV.exe.bat SBUVBD.exe File opened for modification C:\windows\system\PHB.exe ACDF.exe File opened for modification C:\windows\system\KLYE.exe VQOZAD.exe File created C:\windows\system\WGFAHVD.exe KQYSV.exe File created C:\windows\system\HZTPOCL.exe.bat 2026-08-02_4629f995e7e2f162e3e80c01937bcb41_elex_emotet_stop.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5640 cmd.exe 3156 cmd.exe 2420 cmd.exe 4044 cmd.exe 4108 cmd.exe 4208 cmd.exe 4656 cmd.exe 2532 cmd.exe 1432 cmd.exe 4436 cmd.exe 2020 cmd.exe 2804 cmd.exe 5376 cmd.exe 1176 cmd.exe 5428 cmd.exe 4900 cmd.exe 2484 cmd.exe 4888 cmd.exe 1224 cmd.exe 4232 cmd.exe 3028 cmd.exe 2720 cmd.exe 2788 cmd.exe 5604 cmd.exe 4828 cmd.exe 1884 cmd.exe 2216 cmd.exe 3452 cmd.exe 3536 cmd.exe 1612 cmd.exe 4660 cmd.exe 3804 cmd.exe 1616 cmd.exe 4776 cmd.exe 2544 cmd.exe 6120 cmd.exe 4536 cmd.exe 884 cmd.exe 1568 cmd.exe 2752 cmd.exe 2604 cmd.exe 5300 cmd.exe 2908 cmd.exe 2932 cmd.exe 4708 cmd.exe 4496 cmd.exe 3004 cmd.exe 2440 cmd.exe 4408 cmd.exe 4544 cmd.exe 5960 cmd.exe 5832 cmd.exe 2316 cmd.exe 4264 cmd.exe 4608 cmd.exe 1888 cmd.exe 4316 cmd.exe 5480 cmd.exe 1624 cmd.exe 5416 cmd.exe 4288 cmd.exe 4192 cmd.exe 2724 cmd.exe 4128 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 2912 4224 WerFault.exe 87 3660 5388 WerFault.exe 93 3868 5940 WerFault.exe 99 5636 1060 WerFault.exe 104 5348 460 WerFault.exe 109 5552 2780 WerFault.exe 114 1084 596 WerFault.exe 119 2280 4356 WerFault.exe 124 1748 4524 WerFault.exe 129 1612 5220 WerFault.exe 134 2544 5060 WerFault.exe 139 1780 4296 WerFault.exe 144 2720 620 WerFault.exe 149 5168 2892 WerFault.exe 154 5936 1768 WerFault.exe 159 2592 2512 WerFault.exe 164 3004 5352 WerFault.exe 169 3020 2764 WerFault.exe 174 1280 3008 WerFault.exe 179 5560 2080 WerFault.exe 184 4740 5988 WerFault.exe 189 4648 4240 WerFault.exe 194 4388 5384 WerFault.exe 199 3412 1780 WerFault.exe 204 2692 1332 WerFault.exe 209 5280 5964 WerFault.exe 214 5244 5936 WerFault.exe 219 5616 4652 WerFault.exe 224 5076 4056 WerFault.exe 229 1280 5484 WerFault.exe 234 5768 2576 WerFault.exe 239 4740 3728 WerFault.exe 244 3548 2880 WerFault.exe 249 5392 3544 WerFault.exe 254 2292 4960 WerFault.exe 259 4748 2208 WerFault.exe 265 4392 1920 WerFault.exe 270 2852 236 WerFault.exe 275 4436 5536 WerFault.exe 280 756 1724 WerFault.exe 285 5560 4452 WerFault.exe 290 1144 5768 WerFault.exe 295 3416 5648 WerFault.exe 300 1500 2896 WerFault.exe 305 5748 1448 WerFault.exe 310 1220 4552 WerFault.exe 315 720 4492 WerFault.exe 320 3928 4620 WerFault.exe 325 3452 2184 WerFault.exe 330 5396 3476 WerFault.exe 335 5808 4104 WerFault.exe 340 5372 1928 WerFault.exe 345 3016 1028 WerFault.exe 350 2160 5344 WerFault.exe 355 4236 2668 WerFault.exe 360 4112 4484 WerFault.exe 365 5812 3480 WerFault.exe 370 5696 3324 WerFault.exe 375 4328 5224 WerFault.exe 380 4480 3780 WerFault.exe 385 2460 5296 WerFault.exe 390 2840 4048 WerFault.exe 395 252 4632 WerFault.exe 400 4804 4736 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VRO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WUE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TQRFSXP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MIMJV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language STMZYJP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QHBZWJD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NRF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FYIV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AUKQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WGFAHVD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OLQWREI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KNRJRR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BCNCAC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GVQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VYYJYP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CPWQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OSPUL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HMJR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RSPPB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KKXBOT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZLH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RHJJG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NFX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AMILOB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TDDJCFU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SGOTRX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SPSL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HCR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LEOZLH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OVF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VCD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XOXW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REUQK.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4224 2026-08-02_4629f995e7e2f162e3e80c01937bcb41_elex_emotet_stop.exe 4224 2026-08-02_4629f995e7e2f162e3e80c01937bcb41_elex_emotet_stop.exe 5388 HZTPOCL.exe 5388 HZTPOCL.exe 5940 RSPPB.exe 5940 RSPPB.exe 1060 WSZR.exe 1060 WSZR.exe 460 MIMJV.exe 460 MIMJV.exe 2780 VRO.exe 2780 VRO.exe 596 BRW.exe 596 BRW.exe 4356 WUE.exe 4356 WUE.exe 4524 RHJJG.exe 4524 RHJJG.exe 5220 PCIKLO.exe 5220 PCIKLO.exe 5060 KNRJRR.exe 5060 KNRJRR.exe 4296 OVF.exe 4296 OVF.exe 620 WJK.exe 620 WJK.exe 2892 AMILOB.exe 2892 AMILOB.exe 1768 KKW.exe 1768 KKW.exe 2512 VCD.exe 2512 VCD.exe 5352 LSEPTGY.exe 5352 LSEPTGY.exe 2764 ELTADZG.exe 2764 ELTADZG.exe 3008 XOXW.exe 3008 XOXW.exe 2080 VZA.exe 2080 VZA.exe 5988 REUQK.exe 5988 REUQK.exe 4240 BCNCAC.exe 4240 BCNCAC.exe 5384 NFX.exe 5384 NFX.exe 1780 VTC.exe 1780 VTC.exe 1332 STMZYJP.exe 1332 STMZYJP.exe 5964 FWUXMUK.exe 5964 FWUXMUK.exe 5936 KWEAQQ.exe 5936 KWEAQQ.exe 4652 BFSFDH.exe 4652 BFSFDH.exe 4056 APVVL.exe 4056 APVVL.exe 5484 CNBHT.exe 5484 CNBHT.exe 2576 OVHPFNH.exe 2576 OVHPFNH.exe 3728 EGSFNB.exe 3728 EGSFNB.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4224 2026-08-02_4629f995e7e2f162e3e80c01937bcb41_elex_emotet_stop.exe 4224 2026-08-02_4629f995e7e2f162e3e80c01937bcb41_elex_emotet_stop.exe 5388 HZTPOCL.exe 5388 HZTPOCL.exe 5940 RSPPB.exe 5940 RSPPB.exe 1060 WSZR.exe 1060 WSZR.exe 460 MIMJV.exe 460 MIMJV.exe 2780 VRO.exe 2780 VRO.exe 596 BRW.exe 596 BRW.exe 4356 WUE.exe 4356 WUE.exe 4524 RHJJG.exe 4524 RHJJG.exe 5220 PCIKLO.exe 5220 PCIKLO.exe 5060 KNRJRR.exe 5060 KNRJRR.exe 4296 OVF.exe 4296 OVF.exe 620 WJK.exe 620 WJK.exe 2892 AMILOB.exe 2892 AMILOB.exe 1768 KKW.exe 1768 KKW.exe 2512 VCD.exe 2512 VCD.exe 5352 LSEPTGY.exe 5352 LSEPTGY.exe 2764 ELTADZG.exe 2764 ELTADZG.exe 3008 XOXW.exe 3008 XOXW.exe 2080 VZA.exe 2080 VZA.exe 5988 REUQK.exe 5988 REUQK.exe 4240 BCNCAC.exe 4240 BCNCAC.exe 5384 NFX.exe 5384 NFX.exe 1780 VTC.exe 1780 VTC.exe 1332 STMZYJP.exe 1332 STMZYJP.exe 5964 FWUXMUK.exe 5964 FWUXMUK.exe 5936 KWEAQQ.exe 5936 KWEAQQ.exe 4652 BFSFDH.exe 4652 BFSFDH.exe 4056 APVVL.exe 4056 APVVL.exe 5484 CNBHT.exe 5484 CNBHT.exe 2576 OVHPFNH.exe 2576 OVHPFNH.exe 3728 EGSFNB.exe 3728 EGSFNB.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4224 wrote to memory of 3268 4224 2026-08-02_4629f995e7e2f162e3e80c01937bcb41_elex_emotet_stop.exe 89 PID 3268 wrote to memory of 5388 3268 cmd.exe 93 PID 5388 wrote to memory of 3576 5388 HZTPOCL.exe 95 PID 3576 wrote to memory of 5940 3576 cmd.exe 99 PID 5940 wrote to memory of 4888 5940 RSPPB.exe 100 PID 4888 wrote to memory of 1060 4888 cmd.exe 104 PID 1060 wrote to memory of 1268 1060 WSZR.exe 105 PID 1268 wrote to memory of 460 1268 cmd.exe 109 PID 460 wrote to memory of 2816 460 MIMJV.exe 110 PID 2816 wrote to memory of 2780 2816 cmd.exe 114 PID 2780 wrote to memory of 5976 2780 VRO.exe 115 PID 5976 wrote to memory of 596 5976 cmd.exe 119 PID 596 wrote to memory of 3804 596 BRW.exe 120 PID 3804 wrote to memory of 4356 3804 cmd.exe 124 PID 4356 wrote to memory of 3448 4356 WUE.exe 125 PID 3448 wrote to memory of 4524 3448 cmd.exe 129 PID 4524 wrote to memory of 2220 4524 RHJJG.exe 130 PID 2220 wrote to memory of 5220 2220 cmd.exe 134 PID 5220 wrote to memory of 1116 5220 PCIKLO.exe 135 PID 1116 wrote to memory of 5060 1116 cmd.exe 139 PID 5060 wrote to memory of 4340 5060 KNRJRR.exe 140 PID 4340 wrote to memory of 4296 4340 cmd.exe 144 PID 4296 wrote to memory of 5692 4296 OVF.exe 145 PID 5692 wrote to memory of 620 5692 cmd.exe 149 PID 620 wrote to memory of 5604 620 WJK.exe 150 PID 5604 wrote to memory of 2892 5604 cmd.exe 154 PID 2892 wrote to memory of 2752 2892 AMILOB.exe 155 PID 2752 wrote to memory of 1768 2752 cmd.exe 159 PID 1768 wrote to memory of 4196 1768 KKW.exe 160 PID 4196 wrote to memory of 2512 4196 cmd.exe 164 PID 2512 wrote to memory of 1532 2512 VCD.exe 165 PID 1532 wrote to memory of 5352 1532 cmd.exe 169 PID 5352 wrote to memory of 1224 5352 LSEPTGY.exe 170 PID 1224 wrote to memory of 2764 1224 cmd.exe 174 PID 2764 wrote to memory of 4468 2764 ELTADZG.exe 175 PID 4468 wrote to memory of 3008 4468 cmd.exe 179 PID 3008 wrote to memory of 2440 3008 XOXW.exe 180 PID 2440 wrote to memory of 2080 2440 cmd.exe 184 PID 2080 wrote to memory of 3512 2080 VZA.exe 185 PID 3512 wrote to memory of 5988 3512 cmd.exe 189 PID 5988 wrote to memory of 2372 5988 REUQK.exe 190 PID 2372 wrote to memory of 4240 2372 cmd.exe 194 PID 4240 wrote to memory of 2288 4240 BCNCAC.exe 195 PID 2288 wrote to memory of 5384 2288 cmd.exe 199 PID 5384 wrote to memory of 5728 5384 NFX.exe 200 PID 5728 wrote to memory of 1780 5728 cmd.exe 204 PID 1780 wrote to memory of 4084 1780 VTC.exe 205 PID 4084 wrote to memory of 1332 4084 cmd.exe 209 PID 1332 wrote to memory of 2720 1332 STMZYJP.exe 210 PID 2720 wrote to memory of 5964 2720 cmd.exe 214 PID 5964 wrote to memory of 5164 5964 FWUXMUK.exe 215 PID 5164 wrote to memory of 5936 5164 cmd.exe 219 PID 5936 wrote to memory of 4208 5936 KWEAQQ.exe 220 PID 4208 wrote to memory of 4652 4208 cmd.exe 224 PID 4652 wrote to memory of 1520 4652 BFSFDH.exe 225 PID 1520 wrote to memory of 4056 1520 cmd.exe 229 PID 4056 wrote to memory of 4608 4056 APVVL.exe 230 PID 4608 wrote to memory of 5484 4608 cmd.exe 234 PID 5484 wrote to memory of 2452 5484 CNBHT.exe 235 PID 2452 wrote to memory of 2576 2452 cmd.exe 239 PID 2576 wrote to memory of 2724 2576 OVHPFNH.exe 240 PID 2724 wrote to memory of 3728 2724 cmd.exe 244 PID 3728 wrote to memory of 2980 3728 EGSFNB.exe 245 PID 2980 wrote to memory of 2880 2980 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_4629f995e7e2f162e3e80c01937bcb41_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_4629f995e7e2f162e3e80c01937bcb41_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HZTPOCL.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\windows\system\HZTPOCL.exeC:\windows\system\HZTPOCL.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5388 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RSPPB.exe.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\windows\SysWOW64\RSPPB.exeC:\windows\system32\RSPPB.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WSZR.exe.bat" "6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\windows\SysWOW64\WSZR.exeC:\windows\system32\WSZR.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MIMJV.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\windows\SysWOW64\MIMJV.exeC:\windows\system32\MIMJV.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VRO.exe.bat" "10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\windows\SysWOW64\VRO.exeC:\windows\system32\VRO.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BRW.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:5976 -
C:\windows\SysWOW64\BRW.exeC:\windows\system32\BRW.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WUE.exe.bat" "14⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3804 -
C:\windows\system\WUE.exeC:\windows\system\WUE.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RHJJG.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\windows\RHJJG.exeC:\windows\RHJJG.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PCIKLO.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\windows\SysWOW64\PCIKLO.exeC:\windows\system32\PCIKLO.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5220 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KNRJRR.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\windows\SysWOW64\KNRJRR.exeC:\windows\system32\KNRJRR.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OVF.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\windows\SysWOW64\OVF.exeC:\windows\system32\OVF.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WJK.exe.bat" "24⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5692 -
C:\windows\system\WJK.exeC:\windows\system\WJK.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:620 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AMILOB.exe.bat" "26⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5604 -
C:\windows\AMILOB.exeC:\windows\AMILOB.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KKW.exe.bat" "28⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\windows\SysWOW64\KKW.exeC:\windows\system32\KKW.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VCD.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\windows\SysWOW64\VCD.exeC:\windows\system32\VCD.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LSEPTGY.exe.bat" "32⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\windows\LSEPTGY.exeC:\windows\LSEPTGY.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ELTADZG.exe.bat" "34⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\windows\system\ELTADZG.exeC:\windows\system\ELTADZG.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XOXW.exe.bat" "36⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\windows\XOXW.exeC:\windows\XOXW.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VZA.exe.bat" "38⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\windows\SysWOW64\VZA.exeC:\windows\system32\VZA.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\REUQK.exe.bat" "40⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\windows\SysWOW64\REUQK.exeC:\windows\system32\REUQK.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BCNCAC.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\windows\system\BCNCAC.exeC:\windows\system\BCNCAC.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NFX.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\windows\SysWOW64\NFX.exeC:\windows\system32\NFX.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VTC.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:5728 -
C:\windows\SysWOW64\VTC.exeC:\windows\system32\VTC.exe47⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\STMZYJP.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\windows\STMZYJP.exeC:\windows\STMZYJP.exe49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FWUXMUK.exe.bat" "50⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\windows\FWUXMUK.exeC:\windows\FWUXMUK.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KWEAQQ.exe.bat" "52⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5164 -
C:\windows\KWEAQQ.exeC:\windows\KWEAQQ.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BFSFDH.exe.bat" "54⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\windows\system\BFSFDH.exeC:\windows\system\BFSFDH.exe55⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\APVVL.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\windows\system\APVVL.exeC:\windows\system\APVVL.exe57⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CNBHT.exe.bat" "58⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\windows\CNBHT.exeC:\windows\CNBHT.exe59⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5484 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OVHPFNH.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\windows\system\OVHPFNH.exeC:\windows\system\OVHPFNH.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EGSFNB.exe.bat" "62⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\windows\EGSFNB.exeC:\windows\EGSFNB.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ARAW.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\windows\system\ARAW.exeC:\windows\system\ARAW.exe65⤵
- Executes dropped EXE
PID:2880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SUE.exe.bat" "66⤵
- System Location Discovery: System Language Discovery
PID:6028 -
C:\windows\SysWOW64\SUE.exeC:\windows\system32\SUE.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TXIVN.exe.bat" "68⤵
- System Location Discovery: System Language Discovery
PID:1296 -
C:\windows\SysWOW64\TXIVN.exeC:\windows\system32\TXIVN.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GVQ.exe.bat" "70⤵PID:552
-
C:\windows\SysWOW64\GVQ.exeC:\windows\system32\GVQ.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OIV.exe.bat" "72⤵PID:1528
-
C:\windows\system\OIV.exeC:\windows\system\OIV.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LGN.exe.bat" "74⤵PID:4020
-
C:\windows\SysWOW64\LGN.exeC:\windows\system32\LGN.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RBMM.exe.bat" "76⤵
- Executes a command shell one-liner
PID:4828 -
C:\windows\system\RBMM.exeC:\windows\system\RBMM.exe77⤵
- Executes dropped EXE
PID:5536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AOXEKXN.exe.bat" "78⤵
- System Location Discovery: System Language Discovery
PID:2644 -
C:\windows\SysWOW64\AOXEKXN.exeC:\windows\system32\AOXEKXN.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RPZ.exe.bat" "80⤵PID:4556
-
C:\windows\system\RPZ.exeC:\windows\system\RPZ.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QHBZWJD.exe.bat" "82⤵PID:2392
-
C:\windows\system\QHBZWJD.exeC:\windows\system\QHBZWJD.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FCLDH.exe.bat" "84⤵PID:944
-
C:\windows\FCLDH.exeC:\windows\FCLDH.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5648 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TATP.exe.bat" "86⤵
- Executes a command shell one-liner
PID:1888 -
C:\windows\system\TATP.exeC:\windows\system\TATP.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2896 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VYYJYP.exe.bat" "88⤵PID:2060
-
C:\windows\SysWOW64\VYYJYP.exeC:\windows\system32\VYYJYP.exe89⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VBCFE.exe.bat" "90⤵
- System Location Discovery: System Language Discovery
PID:5644 -
C:\windows\system\VBCFE.exeC:\windows\system\VBCFE.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BBKTVHH.exe.bat" "92⤵
- Executes a command shell one-liner
PID:1616 -
C:\windows\SysWOW64\BBKTVHH.exeC:\windows\system32\BBKTVHH.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HCR.exe.bat" "94⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4316 -
C:\windows\HCR.exeC:\windows\HCR.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4620 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CPWQ.exe.bat" "96⤵
- System Location Discovery: System Language Discovery
PID:3012 -
C:\windows\CPWQ.exeC:\windows\CPWQ.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2184 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RFX.exe.bat" "98⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4776 -
C:\windows\system\RFX.exeC:\windows\system\RFX.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TDDJCFU.exe.bat" "100⤵
- Executes a command shell one-liner
PID:4232 -
C:\windows\system\TDDJCFU.exeC:\windows\system\TDDJCFU.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4104 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DAREK.exe.bat" "102⤵PID:3552
-
C:\windows\DAREK.exeC:\windows\DAREK.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SGOTRX.exe.bat" "104⤵PID:2976
-
C:\windows\SysWOW64\SGOTRX.exeC:\windows\system32\SGOTRX.exe105⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1028 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AMPHACA.exe.bat" "106⤵
- Executes a command shell one-liner
PID:3028 -
C:\windows\system\AMPHACA.exeC:\windows\system\AMPHACA.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SPSL.exe.bat" "108⤵PID:4212
-
C:\windows\SysWOW64\SPSL.exeC:\windows\system32\SPSL.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YPAZPV.exe.bat" "110⤵
- Executes a command shell one-liner
PID:5640 -
C:\windows\system\YPAZPV.exeC:\windows\system\YPAZPV.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4484 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QPC.exe.bat" "112⤵PID:4424
-
C:\windows\system\QPC.exeC:\windows\system\QPC.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KDHN.exe.bat" "114⤵
- System Location Discovery: System Language Discovery
PID:4860 -
C:\windows\system\KDHN.exeC:\windows\system\KDHN.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TQRFSXP.exe.bat" "116⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2788 -
C:\windows\SysWOW64\TQRFSXP.exeC:\windows\system32\TQRFSXP.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5224 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SBUVBD.exe.bat" "118⤵
- Executes a command shell one-liner
PID:2604 -
C:\windows\SBUVBD.exeC:\windows\SBUVBD.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WRBV.exe.bat" "120⤵PID:1856
-
C:\windows\WRBV.exeC:\windows\WRBV.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5296
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-