Analysis
- max time kernel
74s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/08/2026, 09:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-03_2ddae66b33fb68c50481bc0bdb93631c_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
General
- Target 2026-08-03_2ddae66b33fb68c50481bc0bdb93631c_elex_emotet_stop.exe
- Size 208KB
- Sample260803-ld2pgstbpb
- SHA256 920c2137c93a6d3bc279df7fe1882f3f468ee5f5791f637580880857791ea359
- MD5 2ddae66b33fb68c50481bc0bdb93631c
- SHA1 450a1da9088198d6f319f9a3fc4fef1a7143a942
- SHA512 2ba714bb9ca5522bacc86691221bef2d98b5267718c1b35a50aa05d1755442d5ad60a03f32e2884a85b2cc70b3a3ca7726ee2d162edb7a067d8ac1e9ba9aebf3
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlUtL+LOfh4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFlUp+LOZkEj1
- TLSH T156247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5096 XPWIUF.exe 4992 JLDX.exe 5748 PGPYWZ.exe 1724 IZEJ.exe 1820 QMJ.exe 5424 NFSS.exe 4488 BAWT.exe 2388 SIKQ.exe 3316 IYYHCPT.exe 3780 UBI.exe 3312 WXAW.exe 3284 RFJ.exe 4568 ZSN.exe 408 RTC.exe 5900 IBQCV.exe 1816 COXA.exe 1956 KUC.exe 3848 FAOLOL.exe 2320 WICQBB.exe 5808 CDO.exe 4340 ATB.exe 2508 BWSWLO.exe 2680 SRYGLG.exe 4256 NFPQFSN.exe 1244 BATJKOD.exe 5044 UAIUCHL.exe 4736 LLLKKV.exe 2368 QEVMO.exe 1372 HMJSB.exe 832 GXMI.exe 3684 OKYO.exe 3616 SNBBDZ.exe 2360 WTTR.exe 2516 YRZD.exe 904 CUFYBEM.exe 1708 YEOXP.exe 1000 ACTR.exe 1216 IIGY.exe 1564 VNGJRZN.exe 4516 OGVUAAV.exe 5312 NRYKJG.exe 2344 VELRTN.exe 688 LUYBBU.exe 6056 LXCEH.exe 124 OLTG.exe 4880 SOETJ.exe 2608 LOLET.exe 4564 KZWU.exe 1352 XXW.exe 1316 CCOV.exe 1436 JSPVA.exe 1932 KVTQ.exe 240 NIKSZ.exe 5116 UZLRFN.exe 5092 CMQYQM.exe 1572 KSCFT.exe 4760 LVGI.exe 1852 ENWTQJI.exe 5320 VYYJYP.exe 5964 FWEEGY.exe 4952 CWOGS.exe 3468 AMZ.exe 3880 IAM.exe 2152 WXMTRR.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\KZWU.exe LOLET.exe File created C:\windows\SysWOW64\JSPVA.exe.bat CCOV.exe File created C:\windows\SysWOW64\ENWTQJI.exe.bat LVGI.exe File created C:\windows\SysWOW64\FAOLOL.exe KUC.exe File created C:\windows\SysWOW64\LLLKKV.exe UAIUCHL.exe File opened for modification C:\windows\SysWOW64\QEVMO.exe LLLKKV.exe File created C:\windows\SysWOW64\FWEEGY.exe VYYJYP.exe File opened for modification C:\windows\SysWOW64\IAM.exe AMZ.exe File opened for modification C:\windows\SysWOW64\YITRNXE.exe QSSAH.exe File created C:\windows\SysWOW64\YITRNXE.exe.bat QSSAH.exe File opened for modification C:\windows\SysWOW64\YNROJ.exe SSFNV.exe File opened for modification C:\windows\SysWOW64\KUC.exe COXA.exe File created C:\windows\SysWOW64\QBVSEWP.exe.bat OEIYXOG.exe File created C:\windows\SysWOW64\IUATOE.exe GXMHGV.exe File created C:\windows\SysWOW64\YNROJ.exe SSFNV.exe File created C:\windows\SysWOW64\XPWIUF.exe 2026-08-03_2ddae66b33fb68c50481bc0bdb93631c_elex_emotet_stop.exe File opened for modification C:\windows\SysWOW64\OKYO.exe GXMI.exe File created C:\windows\SysWOW64\ACTR.exe.bat YEOXP.exe File opened for modification C:\windows\SysWOW64\OLTG.exe LXCEH.exe File opened for modification C:\windows\SysWOW64\FWEEGY.exe VYYJYP.exe File opened for modification C:\windows\SysWOW64\PGPYWZ.exe JLDX.exe File opened for modification C:\windows\SysWOW64\LLLKKV.exe UAIUCHL.exe File created C:\windows\SysWOW64\VYYJYP.exe ENWTQJI.exe File created C:\windows\SysWOW64\UIPJA.exe.bat WXMTRR.exe File created C:\windows\SysWOW64\PSBF.exe.bat FUVL.exe File created C:\windows\SysWOW64\KUC.exe COXA.exe File created C:\windows\SysWOW64\ACTR.exe YEOXP.exe File created C:\windows\SysWOW64\KZWU.exe LOLET.exe File created C:\windows\SysWOW64\PSBF.exe FUVL.exe File opened for modification C:\windows\SysWOW64\ENWTQJI.exe LVGI.exe File created C:\windows\SysWOW64\OKYO.exe.bat GXMI.exe File created C:\windows\SysWOW64\IIGY.exe ACTR.exe File created C:\windows\SysWOW64\JSPVA.exe CCOV.exe File created C:\windows\SysWOW64\CWOGS.exe FWEEGY.exe File created C:\windows\SysWOW64\CWOGS.exe.bat FWEEGY.exe File opened for modification C:\windows\SysWOW64\QBVSEWP.exe OEIYXOG.exe File created C:\windows\SysWOW64\IUATOE.exe.bat GXMHGV.exe File opened for modification C:\windows\SysWOW64\FAOLOL.exe KUC.exe File opened for modification C:\windows\SysWOW64\BWSWLO.exe ATB.exe File created C:\windows\SysWOW64\ZOHYQS.exe UIPJA.exe File opened for modification C:\windows\SysWOW64\IUATOE.exe GXMHGV.exe File created C:\windows\SysWOW64\FAOLOL.exe.bat KUC.exe File created C:\windows\SysWOW64\QEVMO.exe.bat LLLKKV.exe File created C:\windows\SysWOW64\LUYBBU.exe VELRTN.exe File created C:\windows\SysWOW64\IAM.exe AMZ.exe File created C:\windows\SysWOW64\HMJSB.exe QEVMO.exe File created C:\windows\SysWOW64\VNGJRZN.exe IIGY.exe File opened for modification C:\windows\SysWOW64\JSPVA.exe CCOV.exe File created C:\windows\SysWOW64\COXA.exe.bat IBQCV.exe File opened for modification C:\windows\SysWOW64\VNGJRZN.exe IIGY.exe File opened for modification C:\windows\SysWOW64\LUYBBU.exe VELRTN.exe File created C:\windows\SysWOW64\KZWU.exe.bat LOLET.exe File created C:\windows\SysWOW64\FWEEGY.exe.bat VYYJYP.exe File created C:\windows\SysWOW64\ZOHYQS.exe.bat UIPJA.exe File created C:\windows\SysWOW64\PGPYWZ.exe JLDX.exe File opened for modification C:\windows\SysWOW64\COXA.exe IBQCV.exe File opened for modification C:\windows\SysWOW64\ACTR.exe YEOXP.exe File opened for modification C:\windows\SysWOW64\ZOHYQS.exe UIPJA.exe File created C:\windows\SysWOW64\QEVMO.exe LLLKKV.exe File created C:\windows\SysWOW64\OLTG.exe.bat LXCEH.exe File opened for modification C:\windows\SysWOW64\CWOGS.exe FWEEGY.exe File created C:\windows\SysWOW64\UIPJA.exe WXMTRR.exe File opened for modification C:\windows\SysWOW64\PSBF.exe FUVL.exe File created C:\windows\SysWOW64\KUC.exe.bat COXA.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\ZSN.exe RFJ.exe File created C:\windows\SOETJ.exe.bat OLTG.exe File created C:\windows\LOLET.exe.bat SOETJ.exe File opened for modification C:\windows\YJIAVXW.exe UGJFOE.exe File created C:\windows\system\NIKSZ.exe.bat KVTQ.exe File created C:\windows\system\IZEJ.exe.bat PGPYWZ.exe File created C:\windows\system\CDO.exe WICQBB.exe File created C:\windows\system\UAIUCHL.exe.bat BATJKOD.exe File created C:\windows\system\GXMI.exe.bat HMJSB.exe File created C:\windows\system\OEIYXOG.exe.bat ZOHYQS.exe File created C:\windows\system\GXMHGV.exe YJIAVXW.exe File created C:\windows\SOETJ.exe OLTG.exe File opened for modification C:\windows\RFJ.exe WXAW.exe File created C:\windows\system\IBQCV.exe RTC.exe File opened for modification C:\windows\NRYKJG.exe OGVUAAV.exe File created C:\windows\system\LVGI.exe.bat KSCFT.exe File created C:\windows\system\AMZ.exe CWOGS.exe File opened for modification C:\windows\system\XXW.exe KZWU.exe File opened for modification C:\windows\SRYGLG.exe BWSWLO.exe File created C:\windows\RFJ.exe WXAW.exe File created C:\windows\WICQBB.exe.bat FAOLOL.exe File created C:\windows\system\CDO.exe.bat WICQBB.exe File opened for modification C:\windows\system\ATB.exe CDO.exe File created C:\windows\system\CUFYBEM.exe.bat YRZD.exe File created C:\windows\system\OGVUAAV.exe.bat VNGJRZN.exe File created C:\windows\ZSN.exe.bat RFJ.exe File created C:\windows\system\ATB.exe CDO.exe File created C:\windows\system\KSCFT.exe.bat CMQYQM.exe File created C:\windows\YJIAVXW.exe UGJFOE.exe File created C:\windows\system\SSFNV.exe IUATOE.exe File created C:\windows\system\NFSS.exe QMJ.exe File created C:\windows\IYYHCPT.exe.bat SIKQ.exe File created C:\windows\WICQBB.exe FAOLOL.exe File opened for modification C:\windows\BATJKOD.exe NFPQFSN.exe File created C:\windows\SNBBDZ.exe.bat OKYO.exe File created C:\windows\system\VELRTN.exe NRYKJG.exe File opened for modification C:\windows\LOLET.exe SOETJ.exe File opened for modification C:\windows\CCOV.exe XXW.exe File created C:\windows\system\CUFYBEM.exe YRZD.exe File created C:\windows\system\KVTQ.exe.bat JSPVA.exe File created C:\windows\system\NGG.exe NDDEY.exe File opened for modification C:\windows\system\CDREWPQ.exe PSBF.exe File opened for modification C:\windows\UGJFOE.exe RTSDC.exe File created C:\windows\system\SSFNV.exe.bat IUATOE.exe File created C:\windows\BAWT.exe NFSS.exe File created C:\windows\YEOXP.exe CUFYBEM.exe File created C:\windows\HKCPRNK.exe QBVSEWP.exe File created C:\windows\system\NFPQFSN.exe SRYGLG.exe File opened for modification C:\windows\system\NIKSZ.exe KVTQ.exe File created C:\windows\BATJKOD.exe NFPQFSN.exe File created C:\windows\system\KVTQ.exe JSPVA.exe File created C:\windows\system\AMZ.exe.bat CWOGS.exe File created C:\windows\UGJFOE.exe RTSDC.exe File opened for modification C:\windows\system\CDO.exe WICQBB.exe File created C:\windows\SRYGLG.exe.bat BWSWLO.exe File opened for modification C:\windows\system\RHPKGV.exe HKCPRNK.exe File created C:\windows\UGJFOE.exe.bat RTSDC.exe File opened for modification C:\windows\system\UZLRFN.exe NIKSZ.exe File created C:\windows\QMJ.exe.bat IZEJ.exe File created C:\windows\RFJ.exe.bat WXAW.exe File opened for modification C:\windows\SNBBDZ.exe OKYO.exe File created C:\windows\system\OGVUAAV.exe VNGJRZN.exe File opened for modification C:\windows\system\VELRTN.exe NRYKJG.exe File opened for modification C:\windows\LXCEH.exe LUYBBU.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5816 cmd.exe 3272 cmd.exe 2904 cmd.exe 5220 cmd.exe 4580 cmd.exe 4476 cmd.exe 1784 cmd.exe 1036 cmd.exe 5148 cmd.exe 4240 cmd.exe 2696 cmd.exe 5584 cmd.exe 3004 cmd.exe 6020 cmd.exe 5864 cmd.exe 4612 cmd.exe 5376 cmd.exe 4384 cmd.exe 3852 cmd.exe 2456 cmd.exe 5176 cmd.exe 4932 cmd.exe 4244 cmd.exe 4140 cmd.exe 3788 cmd.exe 4772 cmd.exe 2520 cmd.exe 912 cmd.exe 1552 cmd.exe 5016 cmd.exe 4560 cmd.exe 5140 cmd.exe 1300 cmd.exe 5480 cmd.exe 5544 cmd.exe 5440 cmd.exe 4324 cmd.exe 5392 cmd.exe 2264 cmd.exe 5896 cmd.exe 936 cmd.exe 5416 cmd.exe 2108 cmd.exe 1900 cmd.exe 3156 cmd.exe 5420 cmd.exe 4068 cmd.exe 3296 cmd.exe 2860 cmd.exe 1792 cmd.exe 2140 cmd.exe 3104 cmd.exe 5916 cmd.exe 4448 cmd.exe 4176 cmd.exe 1340 cmd.exe 4812 cmd.exe 5732 cmd.exe 4156 cmd.exe 5676 cmd.exe 6100 cmd.exe 1088 cmd.exe 4084 cmd.exe 4640 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 4652 2960 WerFault.exe 87 4860 5096 WerFault.exe 93 3440 4992 WerFault.exe 99 2028 5748 WerFault.exe 103 1992 1724 WerFault.exe 109 700 1820 WerFault.exe 114 764 5424 WerFault.exe 118 3680 4488 WerFault.exe 124 624 2388 WerFault.exe 129 4192 3316 WerFault.exe 134 5396 3780 WerFault.exe 139 1884 3312 WerFault.exe 144 1128 3284 WerFault.exe 149 4640 4568 WerFault.exe 154 1980 408 WerFault.exe 159 4540 5900 WerFault.exe 164 556 1816 WerFault.exe 169 3928 1956 WerFault.exe 174 3680 3848 WerFault.exe 179 6032 2320 WerFault.exe 184 4368 5808 WerFault.exe 189 2344 4340 WerFault.exe 194 3468 2508 WerFault.exe 199 860 2680 WerFault.exe 204 2568 4256 WerFault.exe 209 120 1244 WerFault.exe 214 3536 5044 WerFault.exe 219 4276 4736 WerFault.exe 224 4468 2368 WerFault.exe 229 5956 1372 WerFault.exe 234 2768 832 WerFault.exe 239 2792 3684 WerFault.exe 244 4244 3616 WerFault.exe 250 240 2360 WerFault.exe 255 2568 2516 WerFault.exe 260 2012 904 WerFault.exe 265 1572 1708 WerFault.exe 270 5812 1000 WerFault.exe 275 5176 1216 WerFault.exe 280 4492 1564 WerFault.exe 285 2588 4516 WerFault.exe 290 2272 5312 WerFault.exe 295 4140 2344 WerFault.exe 300 6044 688 WerFault.exe 305 2964 6056 WerFault.exe 310 4352 124 WerFault.exe 315 1908 4880 WerFault.exe 320 4668 2608 WerFault.exe 325 4156 4564 WerFault.exe 330 4208 1352 WerFault.exe 335 2792 1316 WerFault.exe 340 3292 1436 WerFault.exe 345 3212 1932 WerFault.exe 350 2544 240 WerFault.exe 355 4528 5116 WerFault.exe 360 3644 5092 WerFault.exe 365 700 1572 WerFault.exe 370 4848 4760 WerFault.exe 375 2120 1852 WerFault.exe 380 2920 5320 WerFault.exe 385 2848 5964 WerFault.exe 390 4652 4952 WerFault.exe 395 2544 3468 WerFault.exe 400 4248 3880 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VYYJYP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KUC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WTTR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SNBBDZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CWOGS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QEVMO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LUYBBU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HKCPRNK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FAOLOL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QBVSEWP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IUATOE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IYYHCPT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WICQBB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NRYKJG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VELRTN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YJIAVXW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language COXA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KVTQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ATB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YRZD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NFPQFSN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IBQCV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PSBF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BATJKOD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CCOV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NGG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMQYQM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KSCFT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WXAW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QSSAH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HZWKVAW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QMJ.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2960 2026-08-03_2ddae66b33fb68c50481bc0bdb93631c_elex_emotet_stop.exe 2960 2026-08-03_2ddae66b33fb68c50481bc0bdb93631c_elex_emotet_stop.exe 5096 XPWIUF.exe 5096 XPWIUF.exe 4992 JLDX.exe 4992 JLDX.exe 5748 PGPYWZ.exe 5748 PGPYWZ.exe 1724 IZEJ.exe 1724 IZEJ.exe 1820 QMJ.exe 1820 QMJ.exe 5424 NFSS.exe 5424 NFSS.exe 4488 BAWT.exe 4488 BAWT.exe 2388 SIKQ.exe 2388 SIKQ.exe 3316 IYYHCPT.exe 3316 IYYHCPT.exe 3780 UBI.exe 3780 UBI.exe 3312 WXAW.exe 3312 WXAW.exe 3284 RFJ.exe 3284 RFJ.exe 4568 ZSN.exe 4568 ZSN.exe 408 RTC.exe 408 RTC.exe 5900 IBQCV.exe 5900 IBQCV.exe 1816 COXA.exe 1816 COXA.exe 1956 KUC.exe 1956 KUC.exe 3848 FAOLOL.exe 3848 FAOLOL.exe 2320 WICQBB.exe 2320 WICQBB.exe 5808 CDO.exe 5808 CDO.exe 4340 ATB.exe 4340 ATB.exe 2508 BWSWLO.exe 2508 BWSWLO.exe 2680 SRYGLG.exe 2680 SRYGLG.exe 4256 NFPQFSN.exe 4256 NFPQFSN.exe 1244 BATJKOD.exe 1244 BATJKOD.exe 5044 UAIUCHL.exe 5044 UAIUCHL.exe 4736 LLLKKV.exe 4736 LLLKKV.exe 2368 QEVMO.exe 2368 QEVMO.exe 1372 HMJSB.exe 1372 HMJSB.exe 832 GXMI.exe 832 GXMI.exe 3684 OKYO.exe 3684 OKYO.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2960 2026-08-03_2ddae66b33fb68c50481bc0bdb93631c_elex_emotet_stop.exe 2960 2026-08-03_2ddae66b33fb68c50481bc0bdb93631c_elex_emotet_stop.exe 5096 XPWIUF.exe 5096 XPWIUF.exe 4992 JLDX.exe 4992 JLDX.exe 5748 PGPYWZ.exe 5748 PGPYWZ.exe 1724 IZEJ.exe 1724 IZEJ.exe 1820 QMJ.exe 1820 QMJ.exe 5424 NFSS.exe 5424 NFSS.exe 4488 BAWT.exe 4488 BAWT.exe 2388 SIKQ.exe 2388 SIKQ.exe 3316 IYYHCPT.exe 3316 IYYHCPT.exe 3780 UBI.exe 3780 UBI.exe 3312 WXAW.exe 3312 WXAW.exe 3284 RFJ.exe 3284 RFJ.exe 4568 ZSN.exe 4568 ZSN.exe 408 RTC.exe 408 RTC.exe 5900 IBQCV.exe 5900 IBQCV.exe 1816 COXA.exe 1816 COXA.exe 1956 KUC.exe 1956 KUC.exe 3848 FAOLOL.exe 3848 FAOLOL.exe 2320 WICQBB.exe 2320 WICQBB.exe 5808 CDO.exe 5808 CDO.exe 4340 ATB.exe 4340 ATB.exe 2508 BWSWLO.exe 2508 BWSWLO.exe 2680 SRYGLG.exe 2680 SRYGLG.exe 4256 NFPQFSN.exe 4256 NFPQFSN.exe 1244 BATJKOD.exe 1244 BATJKOD.exe 5044 UAIUCHL.exe 5044 UAIUCHL.exe 4736 LLLKKV.exe 4736 LLLKKV.exe 2368 QEVMO.exe 2368 QEVMO.exe 1372 HMJSB.exe 1372 HMJSB.exe 832 GXMI.exe 832 GXMI.exe 3684 OKYO.exe 3684 OKYO.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2960 wrote to memory of 5324 2960 2026-08-03_2ddae66b33fb68c50481bc0bdb93631c_elex_emotet_stop.exe 89 PID 5324 wrote to memory of 5096 5324 cmd.exe 93 PID 5096 wrote to memory of 4796 5096 XPWIUF.exe 95 PID 4796 wrote to memory of 4992 4796 cmd.exe 99 PID 4992 wrote to memory of 2972 4992 JLDX.exe 100 PID 2972 wrote to memory of 5748 2972 cmd.exe 103 PID 5748 wrote to memory of 5568 5748 PGPYWZ.exe 105 PID 5568 wrote to memory of 1724 5568 cmd.exe 109 PID 1724 wrote to memory of 4692 1724 IZEJ.exe 110 PID 4692 wrote to memory of 1820 4692 cmd.exe 114 PID 1820 wrote to memory of 4476 1820 QMJ.exe 115 PID 4476 wrote to memory of 5424 4476 cmd.exe 118 PID 5424 wrote to memory of 4436 5424 NFSS.exe 120 PID 4436 wrote to memory of 4488 4436 cmd.exe 124 PID 4488 wrote to memory of 2928 4488 BAWT.exe 125 PID 2928 wrote to memory of 2388 2928 cmd.exe 129 PID 2388 wrote to memory of 1868 2388 SIKQ.exe 130 PID 1868 wrote to memory of 3316 1868 cmd.exe 134 PID 3316 wrote to memory of 2472 3316 IYYHCPT.exe 135 PID 2472 wrote to memory of 3780 2472 cmd.exe 139 PID 3780 wrote to memory of 3188 3780 UBI.exe 140 PID 3188 wrote to memory of 3312 3188 cmd.exe 144 PID 3312 wrote to memory of 3296 3312 WXAW.exe 145 PID 3296 wrote to memory of 3284 3296 cmd.exe 149 PID 3284 wrote to memory of 5816 3284 RFJ.exe 150 PID 5816 wrote to memory of 4568 5816 cmd.exe 154 PID 4568 wrote to memory of 1936 4568 ZSN.exe 155 PID 1936 wrote to memory of 408 1936 cmd.exe 159 PID 408 wrote to memory of 6100 408 RTC.exe 160 PID 6100 wrote to memory of 5900 6100 cmd.exe 164 PID 5900 wrote to memory of 4872 5900 IBQCV.exe 165 PID 4872 wrote to memory of 1816 4872 cmd.exe 169 PID 1816 wrote to memory of 2860 1816 COXA.exe 170 PID 2860 wrote to memory of 1956 2860 cmd.exe 174 PID 1956 wrote to memory of 4448 1956 KUC.exe 175 PID 4448 wrote to memory of 3848 4448 cmd.exe 179 PID 3848 wrote to memory of 5416 3848 FAOLOL.exe 180 PID 5416 wrote to memory of 2320 5416 cmd.exe 184 PID 2320 wrote to memory of 3272 2320 WICQBB.exe 185 PID 3272 wrote to memory of 5808 3272 cmd.exe 189 PID 5808 wrote to memory of 3480 5808 CDO.exe 190 PID 3480 wrote to memory of 4340 3480 cmd.exe 194 PID 4340 wrote to memory of 4100 4340 ATB.exe 195 PID 4100 wrote to memory of 2508 4100 cmd.exe 199 PID 2508 wrote to memory of 6084 2508 BWSWLO.exe 200 PID 6084 wrote to memory of 2680 6084 cmd.exe 204 PID 2680 wrote to memory of 1088 2680 SRYGLG.exe 205 PID 1088 wrote to memory of 4256 1088 cmd.exe 209 PID 4256 wrote to memory of 3004 4256 NFPQFSN.exe 210 PID 3004 wrote to memory of 1244 3004 cmd.exe 214 PID 1244 wrote to memory of 952 1244 BATJKOD.exe 215 PID 952 wrote to memory of 5044 952 cmd.exe 219 PID 5044 wrote to memory of 2460 5044 UAIUCHL.exe 220 PID 2460 wrote to memory of 4736 2460 cmd.exe 224 PID 4736 wrote to memory of 1784 4736 LLLKKV.exe 225 PID 1784 wrote to memory of 2368 1784 cmd.exe 229 PID 2368 wrote to memory of 3928 2368 QEVMO.exe 230 PID 3928 wrote to memory of 1372 3928 cmd.exe 234 PID 1372 wrote to memory of 4772 1372 HMJSB.exe 235 PID 4772 wrote to memory of 832 4772 cmd.exe 239 PID 832 wrote to memory of 5480 832 GXMI.exe 240 PID 5480 wrote to memory of 3684 5480 cmd.exe 244 PID 3684 wrote to memory of 3436 3684 OKYO.exe 245 PID 3436 wrote to memory of 3616 3436 cmd.exe 250
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_2ddae66b33fb68c50481bc0bdb93631c_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-03_2ddae66b33fb68c50481bc0bdb93631c_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XPWIUF.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:5324 -
C:\windows\SysWOW64\XPWIUF.exeC:\windows\system32\XPWIUF.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JLDX.exe.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\windows\JLDX.exeC:\windows\JLDX.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PGPYWZ.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\windows\SysWOW64\PGPYWZ.exeC:\windows\system32\PGPYWZ.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IZEJ.exe.bat" "8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5568 -
C:\windows\system\IZEJ.exeC:\windows\system\IZEJ.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QMJ.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\windows\QMJ.exeC:\windows\QMJ.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NFSS.exe.bat" "12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\windows\system\NFSS.exeC:\windows\system\NFSS.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BAWT.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\windows\BAWT.exeC:\windows\BAWT.exe15⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SIKQ.exe.bat" "16⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\windows\system\SIKQ.exeC:\windows\system\SIKQ.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IYYHCPT.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\windows\IYYHCPT.exeC:\windows\IYYHCPT.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UBI.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\windows\system\UBI.exeC:\windows\system\UBI.exe21⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WXAW.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\windows\system\WXAW.exeC:\windows\system\WXAW.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RFJ.exe.bat" "24⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3296 -
C:\windows\RFJ.exeC:\windows\RFJ.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZSN.exe.bat" "26⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5816 -
C:\windows\ZSN.exeC:\windows\ZSN.exe27⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RTC.exe.bat" "28⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\windows\RTC.exeC:\windows\RTC.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IBQCV.exe.bat" "30⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6100 -
C:\windows\system\IBQCV.exeC:\windows\system\IBQCV.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\COXA.exe.bat" "32⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\windows\SysWOW64\COXA.exeC:\windows\system32\COXA.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KUC.exe.bat" "34⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\windows\SysWOW64\KUC.exeC:\windows\system32\KUC.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FAOLOL.exe.bat" "36⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\windows\SysWOW64\FAOLOL.exeC:\windows\system32\FAOLOL.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WICQBB.exe.bat" "38⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5416 -
C:\windows\WICQBB.exeC:\windows\WICQBB.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CDO.exe.bat" "40⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3272 -
C:\windows\system\CDO.exeC:\windows\system\CDO.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ATB.exe.bat" "42⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3480 -
C:\windows\system\ATB.exeC:\windows\system\ATB.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BWSWLO.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\windows\SysWOW64\BWSWLO.exeC:\windows\system32\BWSWLO.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SRYGLG.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:6084 -
C:\windows\SRYGLG.exeC:\windows\SRYGLG.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NFPQFSN.exe.bat" "48⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\windows\system\NFPQFSN.exeC:\windows\system\NFPQFSN.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BATJKOD.exe.bat" "50⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\windows\BATJKOD.exeC:\windows\BATJKOD.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UAIUCHL.exe.bat" "52⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:952 -
C:\windows\system\UAIUCHL.exeC:\windows\system\UAIUCHL.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LLLKKV.exe.bat" "54⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\windows\SysWOW64\LLLKKV.exeC:\windows\system32\LLLKKV.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QEVMO.exe.bat" "56⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\windows\SysWOW64\QEVMO.exeC:\windows\system32\QEVMO.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HMJSB.exe.bat" "58⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\windows\SysWOW64\HMJSB.exeC:\windows\system32\HMJSB.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GXMI.exe.bat" "60⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\windows\system\GXMI.exeC:\windows\system\GXMI.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OKYO.exe.bat" "62⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5480 -
C:\windows\SysWOW64\OKYO.exeC:\windows\system32\OKYO.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3684 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SNBBDZ.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\windows\SNBBDZ.exeC:\windows\SNBBDZ.exe65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WTTR.exe.bat" "66⤵PID:2096
-
C:\windows\WTTR.exeC:\windows\WTTR.exe67⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YRZD.exe.bat" "68⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2520 -
C:\windows\YRZD.exeC:\windows\YRZD.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CUFYBEM.exe.bat" "70⤵PID:4700
-
C:\windows\system\CUFYBEM.exeC:\windows\system\CUFYBEM.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YEOXP.exe.bat" "72⤵PID:4272
-
C:\windows\YEOXP.exeC:\windows\YEOXP.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ACTR.exe.bat" "74⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4176 -
C:\windows\SysWOW64\ACTR.exeC:\windows\system32\ACTR.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IIGY.exe.bat" "76⤵PID:2688
-
C:\windows\SysWOW64\IIGY.exeC:\windows\system32\IIGY.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1216 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VNGJRZN.exe.bat" "78⤵
- Executes a command shell one-liner
PID:4384 -
C:\windows\SysWOW64\VNGJRZN.exeC:\windows\system32\VNGJRZN.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OGVUAAV.exe.bat" "80⤵
- Executes a command shell one-liner
PID:3852 -
C:\windows\system\OGVUAAV.exeC:\windows\system\OGVUAAV.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NRYKJG.exe.bat" "82⤵PID:4996
-
C:\windows\NRYKJG.exeC:\windows\NRYKJG.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VELRTN.exe.bat" "84⤵PID:5836
-
C:\windows\system\VELRTN.exeC:\windows\system\VELRTN.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LUYBBU.exe.bat" "86⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:912 -
C:\windows\SysWOW64\LUYBBU.exeC:\windows\system32\LUYBBU.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LXCEH.exe.bat" "88⤵
- System Location Discovery: System Language Discovery
PID:1128 -
C:\windows\LXCEH.exeC:\windows\LXCEH.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6056 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OLTG.exe.bat" "90⤵PID:2672
-
C:\windows\SysWOW64\OLTG.exeC:\windows\system32\OLTG.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SOETJ.exe.bat" "92⤵
- Executes a command shell one-liner
PID:4084 -
C:\windows\SOETJ.exeC:\windows\SOETJ.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LOLET.exe.bat" "94⤵
- Executes a command shell one-liner
PID:5544 -
C:\windows\LOLET.exeC:\windows\LOLET.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2608 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KZWU.exe.bat" "96⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2904 -
C:\windows\SysWOW64\KZWU.exeC:\windows\system32\KZWU.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XXW.exe.bat" "98⤵
- System Location Discovery: System Language Discovery
PID:1952 -
C:\windows\system\XXW.exeC:\windows\system\XXW.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CCOV.exe.bat" "100⤵
- System Location Discovery: System Language Discovery
PID:4356 -
C:\windows\CCOV.exeC:\windows\CCOV.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1316 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JSPVA.exe.bat" "102⤵PID:6092
-
C:\windows\SysWOW64\JSPVA.exeC:\windows\system32\JSPVA.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KVTQ.exe.bat" "104⤵PID:3032
-
C:\windows\system\KVTQ.exeC:\windows\system\KVTQ.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NIKSZ.exe.bat" "106⤵PID:2304
-
C:\windows\system\NIKSZ.exeC:\windows\system\NIKSZ.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UZLRFN.exe.bat" "108⤵PID:4716
-
C:\windows\system\UZLRFN.exeC:\windows\system\UZLRFN.exe109⤵
- Executes dropped EXE
PID:5116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CMQYQM.exe.bat" "110⤵PID:1288
-
C:\windows\SysWOW64\CMQYQM.exeC:\windows\system32\CMQYQM.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KSCFT.exe.bat" "112⤵
- System Location Discovery: System Language Discovery
PID:3576 -
C:\windows\system\KSCFT.exeC:\windows\system\KSCFT.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LVGI.exe.bat" "114⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2108 -
C:\windows\system\LVGI.exeC:\windows\system\LVGI.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ENWTQJI.exe.bat" "116⤵
- System Location Discovery: System Language Discovery
PID:2916 -
C:\windows\SysWOW64\ENWTQJI.exeC:\windows\system32\ENWTQJI.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VYYJYP.exe.bat" "118⤵PID:5604
-
C:\windows\SysWOW64\VYYJYP.exeC:\windows\system32\VYYJYP.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FWEEGY.exe.bat" "120⤵
- System Location Discovery: System Language Discovery
PID:4088 -
C:\windows\SysWOW64\FWEEGY.exeC:\windows\system32\FWEEGY.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5964
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-