Analysis
- max time kernel
80s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/08/2026, 16:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-03_f76be8535bd943afb614b077ca8dfff9_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-03_f76be8535bd943afb614b077ca8dfff9_elex_emotet_stop.exe
- Size 208KB
- Sample260803-txecasvxdy
- SHA256 e3c825d80745b8244d2b122b38b470257e7a6ea7c4b1791f64ec9df5fdd2a03e
- MD5 f76be8535bd943afb614b077ca8dfff9
- SHA1 b76b1aaeb85841c5e4d762f8017650af40613ff3
- SHA512 5eb98cf2c18c17f63a8b3bb192ee96f0fa47994907f369bebea5c526b213a9f9a68251fd38854947d2ed627267ee5a135890d9737735b98ea26fe92deb448585
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFl1dL+LOfb4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFl15+LOzkEj1
- TLSH T160247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2092 BEOHVVE.exe 6012 NHDMNT.exe 3904 CYSSQKW.exe 2588 NGZSC.exe 3008 GJDWHS.exe 1664 QGQIXA.exe 1476 DRZH.exe 1924 WUC.exe 5476 LKDC.exe 5088 HNUB.exe 416 ODVAKN.exe 3516 TJFQAI.exe 3436 XMDD.exe 4592 TRW.exe 3728 BFIZBDU.exe 4248 JKNFMBP.exe 3764 DYULRDL.exe 5976 FWZFY.exe 2012 HRRHRF.exe 716 RHWBZ.exe 6000 HXX.exe 5584 HKK.exe 4080 GSY.exe 5108 JLIVQ.exe 1100 BOLYDMR.exe 1780 LMZLLV.exe 1884 EPD.exe 3384 FKHKDBD.exe 3404 XNLO.exe 2376 YQOKOG.exe 4268 CYVSB.exe 1720 MWJEIHL.exe 5276 VELRTN.exe 3280 FCQ.exe 2152 HAW.exe 944 RYJSY.exe 5036 VGQ.exe 1292 VLQHM.exe 924 OEY.exe 1088 WRK.exe 4720 GSMLJG.exe 1204 XFXDZCX.exe 1872 DAOEE.exe 4252 YNTNOFC.exe 5292 UTLDE.exe 2552 YWJ.exe 5620 EWRMN.exe 5964 OUW.exe 2456 JHBPF.exe 2880 BKFL.exe 5376 CORPX.exe 2112 PYZFM.exe 252 JEYL.exe 2728 HCR.exe 5600 HHS.exe 5124 USA.exe 4432 BNZU.exe 4232 UGHF.exe 980 SGOTRX.exe 4344 UTT.exe 4596 NWXGG.exe 200 MHIW.exe 5992 RHPKGV.exe 4360 QDPLDZI.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\DSJVBY.exe ZKCV.exe File created C:\windows\SysWOW64\QDPLDZI.exe.bat RHPKGV.exe File created C:\windows\SysWOW64\KGS.exe LOHSEN.exe File created C:\windows\SysWOW64\HEO.exe.bat EIJXDB.exe File created C:\windows\SysWOW64\USA.exe HHS.exe File opened for modification C:\windows\SysWOW64\PTB.exe AYSUG.exe File opened for modification C:\windows\SysWOW64\URM.exe JZJGJLQ.exe File created C:\windows\SysWOW64\QCAQMIA.exe MUL.exe File opened for modification C:\windows\SysWOW64\PFPJ.exe LXIBTL.exe File created C:\windows\SysWOW64\GSY.exe.bat HKK.exe File created C:\windows\SysWOW64\FCQ.exe VELRTN.exe File created C:\windows\SysWOW64\JEYL.exe PYZFM.exe File created C:\windows\SysWOW64\USA.exe.bat HHS.exe File opened for modification C:\windows\SysWOW64\HEO.exe EIJXDB.exe File created C:\windows\SysWOW64\QGQIXA.exe.bat GJDWHS.exe File created C:\windows\SysWOW64\VGQ.exe.bat RYJSY.exe File created C:\windows\SysWOW64\OUW.exe.bat EWRMN.exe File created C:\windows\SysWOW64\EPSLZBG.exe URM.exe File opened for modification C:\windows\SysWOW64\DSJVBY.exe ZKCV.exe File opened for modification C:\windows\SysWOW64\QGQIXA.exe GJDWHS.exe File opened for modification C:\windows\SysWOW64\JEYL.exe PYZFM.exe File created C:\windows\SysWOW64\TEATYQ.exe PTB.exe File created C:\windows\SysWOW64\URM.exe JZJGJLQ.exe File created C:\windows\SysWOW64\ZKCV.exe.bat QCAQMIA.exe File created C:\windows\SysWOW64\FKHKDBD.exe EPD.exe File opened for modification C:\windows\SysWOW64\WRK.exe OEY.exe File created C:\windows\SysWOW64\WRK.exe.bat OEY.exe File opened for modification C:\windows\SysWOW64\SGOTRX.exe UGHF.exe File created C:\windows\SysWOW64\TEATYQ.exe.bat PTB.exe File created C:\windows\SysWOW64\EPSLZBG.exe.bat URM.exe File created C:\windows\SysWOW64\NGZSC.exe.bat CYSSQKW.exe File created C:\windows\SysWOW64\XNLO.exe FKHKDBD.exe File opened for modification C:\windows\SysWOW64\USA.exe HHS.exe File created C:\windows\SysWOW64\PTB.exe.bat AYSUG.exe File created C:\windows\SysWOW64\GXH.exe WZBE.exe File created C:\windows\SysWOW64\WRK.exe OEY.exe File created C:\windows\SysWOW64\APW.exe.bat GXH.exe File created C:\windows\SysWOW64\GSY.exe HKK.exe File opened for modification C:\windows\SysWOW64\XNLO.exe FKHKDBD.exe File created C:\windows\SysWOW64\FCQ.exe.bat VELRTN.exe File created C:\windows\SysWOW64\UTLDE.exe YNTNOFC.exe File created C:\windows\SysWOW64\JEYL.exe.bat PYZFM.exe File created C:\windows\SysWOW64\SGOTRX.exe UGHF.exe File opened for modification C:\windows\SysWOW64\FKHKDBD.exe EPD.exe File created C:\windows\SysWOW64\UTLDE.exe.bat YNTNOFC.exe File created C:\windows\SysWOW64\KGS.exe.bat LOHSEN.exe File created C:\windows\SysWOW64\PFPJ.exe.bat LXIBTL.exe File opened for modification C:\windows\SysWOW64\APW.exe GXH.exe File opened for modification C:\windows\SysWOW64\NGZSC.exe CYSSQKW.exe File created C:\windows\SysWOW64\QGQIXA.exe GJDWHS.exe File opened for modification C:\windows\SysWOW64\VGQ.exe RYJSY.exe File created C:\windows\SysWOW64\HHS.exe HCR.exe File opened for modification C:\windows\SysWOW64\HHS.exe HCR.exe File opened for modification C:\windows\SysWOW64\EPSLZBG.exe URM.exe File created C:\windows\SysWOW64\HEO.exe EIJXDB.exe File created C:\windows\SysWOW64\DSJVBY.exe.bat ZKCV.exe File created C:\windows\SysWOW64\QDPLDZI.exe RHPKGV.exe File created C:\windows\SysWOW64\NGZSC.exe CYSSQKW.exe File created C:\windows\SysWOW64\FKHKDBD.exe.bat EPD.exe File created C:\windows\SysWOW64\XNLO.exe.bat FKHKDBD.exe File opened for modification C:\windows\SysWOW64\OUW.exe EWRMN.exe File created C:\windows\SysWOW64\SGOTRX.exe.bat UGHF.exe File created C:\windows\SysWOW64\GXH.exe.bat WZBE.exe File created C:\windows\SysWOW64\APW.exe GXH.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\IJBE.exe YLVS.exe File created C:\windows\system\JKNFMBP.exe BFIZBDU.exe File opened for modification C:\windows\system\HRRHRF.exe FWZFY.exe File created C:\windows\LMZLLV.exe BOLYDMR.exe File created C:\windows\BKFL.exe JHBPF.exe File created C:\windows\WZBE.exe SRVESD.exe File opened for modification C:\windows\IJBE.exe YLVS.exe File created C:\windows\WUC.exe DRZH.exe File created C:\windows\TRW.exe.bat XMDD.exe File opened for modification C:\windows\system\JKNFMBP.exe BFIZBDU.exe File opened for modification C:\windows\MWJEIHL.exe CYVSB.exe File created C:\windows\JHBPF.exe.bat OUW.exe File opened for modification C:\windows\system\BNZU.exe USA.exe File opened for modification C:\windows\system\RHPKGV.exe MHIW.exe File created C:\windows\system\RHPKGV.exe.bat MHIW.exe File opened for modification C:\windows\system\TJFQAI.exe ODVAKN.exe File created C:\windows\system\FWZFY.exe DYULRDL.exe File created C:\windows\system\RHWBZ.exe.bat HRRHRF.exe File created C:\windows\system\BOLYDMR.exe JLIVQ.exe File created C:\windows\system\EPD.exe.bat LMZLLV.exe File created C:\windows\system\BLVTP.exe QDPLDZI.exe File created C:\windows\system\XCVB.exe TMOBWP.exe File created C:\windows\system\NSWBP.exe XCVB.exe File created C:\windows\JLIVQ.exe.bat OIZWJ.exe File created C:\windows\system\UGHF.exe BNZU.exe File opened for modification C:\windows\system\UGHF.exe BNZU.exe File created C:\windows\system\NWXGG.exe UTT.exe File created C:\windows\system\DJINKY.exe.bat OOZ.exe File opened for modification C:\windows\AYSUG.exe PFPJ.exe File created C:\windows\YLVS.exe APW.exe File created C:\windows\ODVAKN.exe HNUB.exe File created C:\windows\system\TJFQAI.exe.bat ODVAKN.exe File opened for modification C:\windows\system\HKK.exe HXX.exe File created C:\windows\XFXDZCX.exe GSMLJG.exe File opened for modification C:\windows\LOHSEN.exe CNF.exe File created C:\windows\GJDWHS.exe.bat NGZSC.exe File opened for modification C:\windows\system\RYJSY.exe HAW.exe File created C:\windows\system\EIJXDB.exe.bat GTX.exe File opened for modification C:\windows\AMFIVY.exe IJBE.exe File created C:\windows\system\NHDMNT.exe.bat BEOHVVE.exe File opened for modification C:\windows\XMDD.exe TJFQAI.exe File created C:\windows\system\OEY.exe.bat VLQHM.exe File opened for modification C:\windows\system\DAOEE.exe XFXDZCX.exe File opened for modification C:\windows\YNTNOFC.exe DAOEE.exe File created C:\windows\system\XCVB.exe.bat TMOBWP.exe File created C:\windows\system\BFIZBDU.exe.bat TRW.exe File created C:\windows\system\HRRHRF.exe FWZFY.exe File opened for modification C:\windows\LMZLLV.exe BOLYDMR.exe File created C:\windows\HCR.exe JEYL.exe File opened for modification C:\windows\system\TMOBWP.exe BRK.exe File created C:\windows\system\JZJGJLQ.exe.bat TEATYQ.exe File created C:\windows\system\MUL.exe AMFIVY.exe File opened for modification C:\windows\DRZH.exe QGQIXA.exe File created C:\windows\system\JKNFMBP.exe.bat BFIZBDU.exe File created C:\windows\system\DAOEE.exe XFXDZCX.exe File created C:\windows\system\YWJ.exe UTLDE.exe File opened for modification C:\windows\BRK.exe JJITNT.exe File opened for modification C:\windows\WZBE.exe SRVESD.exe File created C:\windows\system\FWZFY.exe.bat DYULRDL.exe File created C:\windows\YNTNOFC.exe DAOEE.exe File opened for modification C:\windows\MHIW.exe NWXGG.exe File created C:\windows\AMFIVY.exe IJBE.exe File opened for modification C:\windows\ODVAKN.exe HNUB.exe File created C:\windows\PYZFM.exe CORPX.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2900 cmd.exe 5380 cmd.exe 1948 cmd.exe 5728 cmd.exe 5996 cmd.exe 2180 cmd.exe 4860 cmd.exe 2208 cmd.exe 6044 cmd.exe 3820 cmd.exe 1436 cmd.exe 2780 cmd.exe 2572 cmd.exe 3328 cmd.exe 4480 cmd.exe 3260 cmd.exe 2536 cmd.exe 4548 cmd.exe 4284 cmd.exe 1864 cmd.exe 5420 cmd.exe 5260 cmd.exe 2396 cmd.exe 2844 cmd.exe 5732 cmd.exe 2400 cmd.exe 2524 cmd.exe 1716 cmd.exe 4768 cmd.exe 4488 cmd.exe 4384 cmd.exe 4400 cmd.exe 2720 cmd.exe 2704 cmd.exe 5916 cmd.exe 5596 cmd.exe 5444 cmd.exe 380 cmd.exe 3116 cmd.exe 2856 cmd.exe 5020 cmd.exe 3412 cmd.exe 3284 cmd.exe 5928 cmd.exe 4552 cmd.exe 940 cmd.exe 764 cmd.exe 5180 cmd.exe 5436 cmd.exe 2276 cmd.exe 6064 cmd.exe 3924 cmd.exe 5344 cmd.exe 4076 cmd.exe 1364 cmd.exe 5544 cmd.exe 2428 cmd.exe 2640 cmd.exe 5696 cmd.exe 2644 cmd.exe 5256 cmd.exe 3336 cmd.exe 5680 cmd.exe 2656 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 2900 3780 WerFault.exe 88 5980 2092 WerFault.exe 93 4076 6012 WerFault.exe 99 4284 3904 WerFault.exe 104 4184 2588 WerFault.exe 109 5616 3008 WerFault.exe 114 2452 1664 WerFault.exe 119 4492 1476 WerFault.exe 124 6044 1924 WerFault.exe 129 5608 5476 WerFault.exe 134 5224 5088 WerFault.exe 139 6016 416 WerFault.exe 144 4900 3516 WerFault.exe 149 3276 3436 WerFault.exe 154 3172 4592 WerFault.exe 159 4904 3728 WerFault.exe 164 2104 4248 WerFault.exe 169 4588 3764 WerFault.exe 174 3120 5976 WerFault.exe 179 3944 2012 WerFault.exe 184 1656 716 WerFault.exe 189 3824 6000 WerFault.exe 194 6016 5584 WerFault.exe 199 2988 4080 WerFault.exe 204 108 3520 WerFault.exe 209 5988 5108 WerFault.exe 214 2148 1100 WerFault.exe 219 4756 1780 WerFault.exe 224 3132 1884 WerFault.exe 229 2336 3384 WerFault.exe 234 3492 3404 WerFault.exe 239 3832 2376 WerFault.exe 244 5772 4268 WerFault.exe 249 2988 1720 WerFault.exe 254 108 5276 WerFault.exe 259 5640 3280 WerFault.exe 264 3416 2152 WerFault.exe 270 4988 944 WerFault.exe 275 2176 5036 WerFault.exe 280 1224 1292 WerFault.exe 285 4384 924 WerFault.exe 290 5380 1088 WerFault.exe 295 4440 4720 WerFault.exe 300 1044 1204 WerFault.exe 305 1692 1872 WerFault.exe 310 6088 4252 WerFault.exe 315 2760 5292 WerFault.exe 320 3396 2552 WerFault.exe 325 2724 5620 WerFault.exe 330 5940 5964 WerFault.exe 335 2132 2456 WerFault.exe 340 1320 2880 WerFault.exe 345 4596 5376 WerFault.exe 350 5060 2112 WerFault.exe 355 4740 252 WerFault.exe 360 3964 2728 WerFault.exe 365 1404 5600 WerFault.exe 370 5896 5124 WerFault.exe 375 5740 4432 WerFault.exe 380 3336 4232 WerFault.exe 385 4144 980 WerFault.exe 390 2440 4344 WerFault.exe 395 4416 4596 WerFault.exe 400 3968 200 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DRZH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EWRMN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UTT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SRVESD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BLVTP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HLDGYLG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DJINKY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AYSUG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OIZWJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UTLDE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OOZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EPSLZBG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GSMLJG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BKFL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LKDC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LMZLLV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XCVB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XMDD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JEYL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HCR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RHPKGV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WUC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BFIZBDU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UGHF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language APW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OEY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KGS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YNTNOFC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OUW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3780 2026-08-03_f76be8535bd943afb614b077ca8dfff9_elex_emotet_stop.exe 3780 2026-08-03_f76be8535bd943afb614b077ca8dfff9_elex_emotet_stop.exe 2092 BEOHVVE.exe 2092 BEOHVVE.exe 6012 NHDMNT.exe 6012 NHDMNT.exe 3904 CYSSQKW.exe 3904 CYSSQKW.exe 2588 NGZSC.exe 2588 NGZSC.exe 3008 GJDWHS.exe 3008 GJDWHS.exe 1664 QGQIXA.exe 1664 QGQIXA.exe 1476 DRZH.exe 1476 DRZH.exe 1924 WUC.exe 1924 WUC.exe 5476 LKDC.exe 5476 LKDC.exe 5088 HNUB.exe 5088 HNUB.exe 416 ODVAKN.exe 416 ODVAKN.exe 3516 TJFQAI.exe 3516 TJFQAI.exe 3436 XMDD.exe 3436 XMDD.exe 4592 TRW.exe 4592 TRW.exe 3728 BFIZBDU.exe 3728 BFIZBDU.exe 4248 JKNFMBP.exe 4248 JKNFMBP.exe 3764 DYULRDL.exe 3764 DYULRDL.exe 5976 FWZFY.exe 5976 FWZFY.exe 2012 HRRHRF.exe 2012 HRRHRF.exe 716 RHWBZ.exe 716 RHWBZ.exe 6000 HXX.exe 6000 HXX.exe 5584 HKK.exe 5584 HKK.exe 3520 OIZWJ.exe 3520 OIZWJ.exe 5108 JLIVQ.exe 5108 JLIVQ.exe 1100 BOLYDMR.exe 1100 BOLYDMR.exe 1780 LMZLLV.exe 1780 LMZLLV.exe 1884 EPD.exe 1884 EPD.exe 3384 FKHKDBD.exe 3384 FKHKDBD.exe 3404 XNLO.exe 3404 XNLO.exe 2376 YQOKOG.exe 2376 YQOKOG.exe 4268 CYVSB.exe 4268 CYVSB.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 3780 2026-08-03_f76be8535bd943afb614b077ca8dfff9_elex_emotet_stop.exe 3780 2026-08-03_f76be8535bd943afb614b077ca8dfff9_elex_emotet_stop.exe 2092 BEOHVVE.exe 2092 BEOHVVE.exe 6012 NHDMNT.exe 6012 NHDMNT.exe 3904 CYSSQKW.exe 3904 CYSSQKW.exe 2588 NGZSC.exe 2588 NGZSC.exe 3008 GJDWHS.exe 3008 GJDWHS.exe 1664 QGQIXA.exe 1664 QGQIXA.exe 1476 DRZH.exe 1476 DRZH.exe 1924 WUC.exe 1924 WUC.exe 5476 LKDC.exe 5476 LKDC.exe 5088 HNUB.exe 5088 HNUB.exe 416 ODVAKN.exe 416 ODVAKN.exe 3516 TJFQAI.exe 3516 TJFQAI.exe 3436 XMDD.exe 3436 XMDD.exe 4592 TRW.exe 4592 TRW.exe 3728 BFIZBDU.exe 3728 BFIZBDU.exe 4248 JKNFMBP.exe 4248 JKNFMBP.exe 3764 DYULRDL.exe 3764 DYULRDL.exe 5976 FWZFY.exe 5976 FWZFY.exe 2012 HRRHRF.exe 2012 HRRHRF.exe 716 RHWBZ.exe 716 RHWBZ.exe 6000 HXX.exe 6000 HXX.exe 5584 HKK.exe 5584 HKK.exe 3520 OIZWJ.exe 3520 OIZWJ.exe 5108 JLIVQ.exe 5108 JLIVQ.exe 1100 BOLYDMR.exe 1100 BOLYDMR.exe 1780 LMZLLV.exe 1780 LMZLLV.exe 1884 EPD.exe 1884 EPD.exe 3384 FKHKDBD.exe 3384 FKHKDBD.exe 3404 XNLO.exe 3404 XNLO.exe 2376 YQOKOG.exe 2376 YQOKOG.exe 4268 CYVSB.exe 4268 CYVSB.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3780 wrote to memory of 2780 3780 2026-08-03_f76be8535bd943afb614b077ca8dfff9_elex_emotet_stop.exe 89 PID 2780 wrote to memory of 2092 2780 cmd.exe 93 PID 2092 wrote to memory of 2572 2092 BEOHVVE.exe 95 PID 2572 wrote to memory of 6012 2572 cmd.exe 99 PID 6012 wrote to memory of 2720 6012 NHDMNT.exe 100 PID 2720 wrote to memory of 3904 2720 cmd.exe 104 PID 3904 wrote to memory of 3136 3904 CYSSQKW.exe 105 PID 3136 wrote to memory of 2588 3136 cmd.exe 109 PID 2588 wrote to memory of 1364 2588 NGZSC.exe 110 PID 1364 wrote to memory of 3008 1364 cmd.exe 114 PID 3008 wrote to memory of 5928 3008 GJDWHS.exe 115 PID 5928 wrote to memory of 1664 5928 cmd.exe 119 PID 1664 wrote to memory of 5436 1664 QGQIXA.exe 120 PID 5436 wrote to memory of 1476 5436 cmd.exe 124 PID 1476 wrote to memory of 5544 1476 DRZH.exe 125 PID 5544 wrote to memory of 1924 5544 cmd.exe 129 PID 1924 wrote to memory of 5996 1924 WUC.exe 130 PID 5996 wrote to memory of 5476 5996 cmd.exe 134 PID 5476 wrote to memory of 5352 5476 LKDC.exe 135 PID 5352 wrote to memory of 5088 5352 cmd.exe 139 PID 5088 wrote to memory of 3288 5088 HNUB.exe 140 PID 3288 wrote to memory of 416 3288 cmd.exe 144 PID 416 wrote to memory of 5264 416 ODVAKN.exe 145 PID 5264 wrote to memory of 3516 5264 cmd.exe 149 PID 3516 wrote to memory of 2172 3516 TJFQAI.exe 150 PID 2172 wrote to memory of 3436 2172 cmd.exe 154 PID 3436 wrote to memory of 2180 3436 XMDD.exe 155 PID 2180 wrote to memory of 4592 2180 cmd.exe 159 PID 4592 wrote to memory of 1288 4592 TRW.exe 160 PID 1288 wrote to memory of 3728 1288 cmd.exe 164 PID 3728 wrote to memory of 552 3728 BFIZBDU.exe 165 PID 552 wrote to memory of 4248 552 cmd.exe 169 PID 4248 wrote to memory of 3676 4248 JKNFMBP.exe 170 PID 3676 wrote to memory of 3764 3676 cmd.exe 174 PID 3764 wrote to memory of 4552 3764 DYULRDL.exe 175 PID 4552 wrote to memory of 5976 4552 cmd.exe 179 PID 5976 wrote to memory of 2660 5976 FWZFY.exe 180 PID 2660 wrote to memory of 2012 2660 cmd.exe 184 PID 2012 wrote to memory of 5372 2012 HRRHRF.exe 185 PID 5372 wrote to memory of 716 5372 cmd.exe 189 PID 716 wrote to memory of 5392 716 RHWBZ.exe 190 PID 5392 wrote to memory of 6000 5392 cmd.exe 194 PID 6000 wrote to memory of 2524 6000 HXX.exe 195 PID 2524 wrote to memory of 5584 2524 cmd.exe 199 PID 5584 wrote to memory of 5552 5584 HKK.exe 200 PID 5552 wrote to memory of 4080 5552 cmd.exe 204 PID 2448 wrote to memory of 3520 2448 cmd.exe 209 PID 3520 wrote to memory of 5980 3520 OIZWJ.exe 210 PID 5980 wrote to memory of 5108 5980 cmd.exe 214 PID 5108 wrote to memory of 4860 5108 JLIVQ.exe 215 PID 4860 wrote to memory of 1100 4860 cmd.exe 219 PID 1100 wrote to memory of 5540 1100 BOLYDMR.exe 220 PID 5540 wrote to memory of 1780 5540 cmd.exe 224 PID 1780 wrote to memory of 5920 1780 LMZLLV.exe 225 PID 5920 wrote to memory of 1884 5920 cmd.exe 229 PID 1884 wrote to memory of 2232 1884 EPD.exe 230 PID 2232 wrote to memory of 3384 2232 cmd.exe 234 PID 3384 wrote to memory of 2208 3384 FKHKDBD.exe 235 PID 2208 wrote to memory of 3404 2208 cmd.exe 239 PID 3404 wrote to memory of 6044 3404 XNLO.exe 240 PID 6044 wrote to memory of 2376 6044 cmd.exe 244 PID 2376 wrote to memory of 3328 2376 YQOKOG.exe 245 PID 3328 wrote to memory of 4268 3328 cmd.exe 249 PID 4268 wrote to memory of 1460 4268 CYVSB.exe 250
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_f76be8535bd943afb614b077ca8dfff9_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-03_f76be8535bd943afb614b077ca8dfff9_elex_emotet_stop.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BEOHVVE.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\windows\BEOHVVE.exeC:\windows\BEOHVVE.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NHDMNT.exe.bat" "4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\windows\system\NHDMNT.exeC:\windows\system\NHDMNT.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CYSSQKW.exe.bat" "6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\windows\system\CYSSQKW.exeC:\windows\system\CYSSQKW.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NGZSC.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\windows\SysWOW64\NGZSC.exeC:\windows\system32\NGZSC.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GJDWHS.exe.bat" "10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\windows\GJDWHS.exeC:\windows\GJDWHS.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QGQIXA.exe.bat" "12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5928 -
C:\windows\SysWOW64\QGQIXA.exeC:\windows\system32\QGQIXA.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DRZH.exe.bat" "14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5436 -
C:\windows\DRZH.exeC:\windows\DRZH.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WUC.exe.bat" "16⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5544 -
C:\windows\WUC.exeC:\windows\WUC.exe17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LKDC.exe.bat" "18⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5996 -
C:\windows\system\LKDC.exeC:\windows\system\LKDC.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HNUB.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:5352 -
C:\windows\HNUB.exeC:\windows\HNUB.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ODVAKN.exe.bat" "22⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\windows\ODVAKN.exeC:\windows\ODVAKN.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TJFQAI.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:5264 -
C:\windows\system\TJFQAI.exeC:\windows\system\TJFQAI.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XMDD.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\windows\XMDD.exeC:\windows\XMDD.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TRW.exe.bat" "28⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\windows\TRW.exeC:\windows\TRW.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BFIZBDU.exe.bat" "30⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\windows\system\BFIZBDU.exeC:\windows\system\BFIZBDU.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JKNFMBP.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:552 -
C:\windows\system\JKNFMBP.exeC:\windows\system\JKNFMBP.exe33⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DYULRDL.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:3676 -
C:\windows\DYULRDL.exeC:\windows\DYULRDL.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FWZFY.exe.bat" "36⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\windows\system\FWZFY.exeC:\windows\system\FWZFY.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HRRHRF.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\windows\system\HRRHRF.exeC:\windows\system\HRRHRF.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RHWBZ.exe.bat" "40⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5372 -
C:\windows\system\RHWBZ.exeC:\windows\system\RHWBZ.exe41⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HXX.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:5392 -
C:\windows\system\HXX.exeC:\windows\system\HXX.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HKK.exe.bat" "44⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\windows\system\HKK.exeC:\windows\system\HKK.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GSY.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:5552 -
C:\windows\SysWOW64\GSY.exeC:\windows\system32\GSY.exe47⤵
- Executes dropped EXE
PID:4080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OIZWJ.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\windows\OIZWJ.exeC:\windows\OIZWJ.exe49⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JLIVQ.exe.bat" "50⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5980 -
C:\windows\JLIVQ.exeC:\windows\JLIVQ.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BOLYDMR.exe.bat" "52⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\windows\system\BOLYDMR.exeC:\windows\system\BOLYDMR.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LMZLLV.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:5540 -
C:\windows\LMZLLV.exeC:\windows\LMZLLV.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EPD.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:5920 -
C:\windows\system\EPD.exeC:\windows\system\EPD.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FKHKDBD.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\windows\SysWOW64\FKHKDBD.exeC:\windows\system32\FKHKDBD.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XNLO.exe.bat" "60⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\windows\SysWOW64\XNLO.exeC:\windows\system32\XNLO.exe61⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YQOKOG.exe.bat" "62⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6044 -
C:\windows\YQOKOG.exeC:\windows\YQOKOG.exe63⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CYVSB.exe.bat" "64⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\windows\system\CYVSB.exeC:\windows\system\CYVSB.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MWJEIHL.exe.bat" "66⤵PID:1460
-
C:\windows\MWJEIHL.exeC:\windows\MWJEIHL.exe67⤵
- Executes dropped EXE
PID:1720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VELRTN.exe.bat" "68⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2276 -
C:\windows\system\VELRTN.exeC:\windows\system\VELRTN.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5276 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FCQ.exe.bat" "70⤵PID:352
-
C:\windows\SysWOW64\FCQ.exeC:\windows\system32\FCQ.exe71⤵
- Executes dropped EXE
PID:3280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HAW.exe.bat" "72⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2428 -
C:\windows\HAW.exeC:\windows\HAW.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2152 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RYJSY.exe.bat" "74⤵PID:2148
-
C:\windows\system\RYJSY.exeC:\windows\system\RYJSY.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VGQ.exe.bat" "76⤵
- System Location Discovery: System Language Discovery
PID:5624 -
C:\windows\SysWOW64\VGQ.exeC:\windows\system32\VGQ.exe77⤵
- Executes dropped EXE
PID:5036 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VLQHM.exe.bat" "78⤵
- System Location Discovery: System Language Discovery
PID:5432 -
C:\windows\VLQHM.exeC:\windows\VLQHM.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1292 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OEY.exe.bat" "80⤵
- System Location Discovery: System Language Discovery
PID:5044 -
C:\windows\system\OEY.exeC:\windows\system\OEY.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WRK.exe.bat" "82⤵PID:4984
-
C:\windows\SysWOW64\WRK.exeC:\windows\system32\WRK.exe83⤵
- Executes dropped EXE
PID:1088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GSMLJG.exe.bat" "84⤵PID:4852
-
C:\windows\system\GSMLJG.exeC:\windows\system\GSMLJG.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XFXDZCX.exe.bat" "86⤵
- System Location Discovery: System Language Discovery
PID:5220 -
C:\windows\XFXDZCX.exeC:\windows\XFXDZCX.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1204 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DAOEE.exe.bat" "88⤵
- Executes a command shell one-liner
PID:2536 -
C:\windows\system\DAOEE.exeC:\windows\system\DAOEE.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YNTNOFC.exe.bat" "90⤵
- System Location Discovery: System Language Discovery
PID:2624 -
C:\windows\YNTNOFC.exeC:\windows\YNTNOFC.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UTLDE.exe.bat" "92⤵
- Executes a command shell one-liner
PID:6064 -
C:\windows\SysWOW64\UTLDE.exeC:\windows\system32\UTLDE.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5292 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YWJ.exe.bat" "94⤵
- Executes a command shell one-liner
PID:4284 -
C:\windows\system\YWJ.exeC:\windows\system\YWJ.exe95⤵
- Executes dropped EXE
PID:2552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EWRMN.exe.bat" "96⤵PID:5892
-
C:\windows\system\EWRMN.exeC:\windows\system\EWRMN.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5620 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OUW.exe.bat" "98⤵PID:2740
-
C:\windows\SysWOW64\OUW.exeC:\windows\system32\OUW.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JHBPF.exe.bat" "100⤵
- Executes a command shell one-liner
PID:1864 -
C:\windows\JHBPF.exeC:\windows\JHBPF.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BKFL.exe.bat" "102⤵PID:4648
-
C:\windows\BKFL.exeC:\windows\BKFL.exe103⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CORPX.exe.bat" "104⤵PID:3784
-
C:\windows\system\CORPX.exeC:\windows\system\CORPX.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PYZFM.exe.bat" "106⤵PID:3576
-
C:\windows\PYZFM.exeC:\windows\PYZFM.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JEYL.exe.bat" "108⤵
- System Location Discovery: System Language Discovery
PID:1800 -
C:\windows\SysWOW64\JEYL.exeC:\windows\system32\JEYL.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HCR.exe.bat" "110⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:380 -
C:\windows\HCR.exeC:\windows\HCR.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2728 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HHS.exe.bat" "112⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2640 -
C:\windows\SysWOW64\HHS.exeC:\windows\system32\HHS.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\USA.exe.bat" "114⤵PID:4184
-
C:\windows\SysWOW64\USA.exeC:\windows\system32\USA.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BNZU.exe.bat" "116⤵PID:1244
-
C:\windows\system\BNZU.exeC:\windows\system\BNZU.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UGHF.exe.bat" "118⤵
- Executes a command shell one-liner
PID:5696 -
C:\windows\system\UGHF.exeC:\windows\system\UGHF.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4232 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SGOTRX.exe.bat" "120⤵PID:3016
-
C:\windows\SysWOW64\SGOTRX.exeC:\windows\system32\SGOTRX.exe121⤵
- Executes dropped EXE
PID:980
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-