Analysis
- max time kernel
66s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/08/2026, 18:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-03_30e7f47e167ed8229a04e6c7b151f6ca_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-03_30e7f47e167ed8229a04e6c7b151f6ca_elex_emotet_stop.exe
- Size 384KB
- Sample260803-w7dvmahn7t
- SHA256 a007c6a0dabd896a1e3b8ba3bbffb8509ac1b0c239d698fa1c908c4cca06445e
- MD5 30e7f47e167ed8229a04e6c7b151f6ca
- SHA1 4795f6fe7733dca9add96cc72a89d296e0e2e3e1
- SHA512 ba14642881645d42a4142bf9d53825a84dd2265be6ffae0d867f8ac8e699a3842b18faad91b6a7b9a394b4d11b57ded7b74b6a70ff5e9f5a78e9939557a5e0eb
- SSDEEP 6144:TlZtbLWIgd1LZ9oECZbxlUS+LOIkEjiPISUOgW9X+hOGzC/NM:RLWI09QZb6LOIkmZzcukG2/
- TLSH T132848E167AC58333D1A302715CEB86A4773ABCA1A7B687872798720D6773BB44737390
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2680 HNODW.exe 5524 OTHRK.exe 2584 LYZGAM.exe 1536 GWZS.exe 4672 SXPD.exe 2668 SSSGZH.exe 4608 IITYG.exe 4416 GFF.exe 4536 BTJKD.exe 4284 KTLPHN.exe 5716 URZJON.exe 1928 PMW.exe 2324 HHIX.exe 2752 NIPKVFK.exe 2320 TDGLR.exe 5632 XLVTEAV.exe 3852 HJBF.exe 424 LZHN.exe 1064 UZJSJ.exe 484 ZALV.exe 5868 BXZP.exe 2472 WIHOIOH.exe 4592 AQOO.exe 2768 AWOCW.exe 1280 KTUX.exe 2392 UCWCPZ.exe 3836 SSPF.exe 5760 IIQWJZG.exe 1060 RQSB.exe 5996 LDXLW.exe 6116 DQH.exe 3512 VMLGS.exe 2348 LCMY.exe 2808 LFQBE.exe 2128 PVW.exe 2232 SIO.exe 2844 RTQBKMK.exe 2968 YJRSRI.exe 5616 TWW.exe 628 VRBL.exe 2080 GKQWU.exe 3936 QIWRCJT.exe 5672 NIGTON.exe 1848 ALOSCQ.exe 1836 KJCM.exe 5656 QETNOB.exe 572 PPQV.exe 5000 DKUW.exe 2456 ENKSA.exe 5200 BOUUED.exe 4656 YEHMMK.exe 5232 VEROYOC.exe 4932 XCXIF.exe 5924 WNAQ.exe 4648 KIL.exe 1392 VAB.exe 1980 QLJ.exe 4520 PWMRI.exe 2260 WMNI.exe 2500 OUBN.exe 3212 HNRY.exe 616 RLWL.exe 2916 QVH.exe 1744 TDOJN.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\SSPF.exe UCWCPZ.exe File created C:\windows\SysWOW64\GFF.exe IITYG.exe File created C:\windows\SysWOW64\UZJSJ.exe LZHN.exe File opened for modification C:\windows\SysWOW64\TWW.exe YJRSRI.exe File created C:\windows\SysWOW64\TWW.exe.bat YJRSRI.exe File created C:\windows\SysWOW64\RHTHWO.exe JTPAMQ.exe File created C:\windows\SysWOW64\GFF.exe.bat IITYG.exe File opened for modification C:\windows\SysWOW64\QIWRCJT.exe GKQWU.exe File created C:\windows\SysWOW64\KJCM.exe ALOSCQ.exe File created C:\windows\SysWOW64\HNODW.exe.bat 2026-08-03_30e7f47e167ed8229a04e6c7b151f6ca_elex_emotet_stop.exe File created C:\windows\SysWOW64\PMW.exe URZJON.exe File opened for modification C:\windows\SysWOW64\PMW.exe URZJON.exe File created C:\windows\SysWOW64\ZALV.exe UZJSJ.exe File created C:\windows\SysWOW64\SSPF.exe.bat UCWCPZ.exe File created C:\windows\SysWOW64\DQH.exe LDXLW.exe File opened for modification C:\windows\SysWOW64\ALOSCQ.exe NIGTON.exe File created C:\windows\SysWOW64\LZHN.exe HJBF.exe File opened for modification C:\windows\SysWOW64\ZALV.exe UZJSJ.exe File created C:\windows\SysWOW64\ZALV.exe.bat UZJSJ.exe File created C:\windows\SysWOW64\LDXLW.exe.bat RQSB.exe File opened for modification C:\windows\SysWOW64\KJCM.exe ALOSCQ.exe File created C:\windows\SysWOW64\HNRY.exe.bat OUBN.exe File opened for modification C:\windows\SysWOW64\MXOMVY.exe ISEXF.exe File created C:\windows\SysWOW64\MXOMVY.exe.bat ISEXF.exe File opened for modification C:\windows\SysWOW64\RHTHWO.exe JTPAMQ.exe File created C:\windows\SysWOW64\UZJSJ.exe.bat LZHN.exe File created C:\windows\SysWOW64\QIWRCJT.exe GKQWU.exe File created C:\windows\SysWOW64\HWWPCM.exe.bat XYQVUEJ.exe File opened for modification C:\windows\SysWOW64\JPN.exe HZA.exe File opened for modification C:\windows\SysWOW64\XLVTEAV.exe TDGLR.exe File opened for modification C:\windows\SysWOW64\LZHN.exe HJBF.exe File created C:\windows\SysWOW64\VMLGS.exe DQH.exe File created C:\windows\SysWOW64\VMLGS.exe.bat DQH.exe File created C:\windows\SysWOW64\ALOSCQ.exe NIGTON.exe File opened for modification C:\windows\SysWOW64\SZTKSX.exe REPP.exe File opened for modification C:\windows\SysWOW64\UZJSJ.exe LZHN.exe File created C:\windows\SysWOW64\DQH.exe.bat LDXLW.exe File created C:\windows\SysWOW64\TDOJN.exe.bat QVH.exe File created C:\windows\SysWOW64\JPN.exe HZA.exe File opened for modification C:\windows\SysWOW64\PVW.exe LFQBE.exe File created C:\windows\SysWOW64\QIWRCJT.exe.bat GKQWU.exe File created C:\windows\SysWOW64\XLVTEAV.exe.bat TDGLR.exe File opened for modification C:\windows\SysWOW64\DQH.exe LDXLW.exe File created C:\windows\SysWOW64\KJCM.exe.bat ALOSCQ.exe File created C:\windows\SysWOW64\TDOJN.exe QVH.exe File created C:\windows\SysWOW64\SSPF.exe UCWCPZ.exe File opened for modification C:\windows\SysWOW64\VMLGS.exe DQH.exe File opened for modification C:\windows\SysWOW64\HNRY.exe OUBN.exe File opened for modification C:\windows\SysWOW64\HNODW.exe 2026-08-03_30e7f47e167ed8229a04e6c7b151f6ca_elex_emotet_stop.exe File opened for modification C:\windows\SysWOW64\LDXLW.exe RQSB.exe File created C:\windows\SysWOW64\HNRY.exe OUBN.exe File created C:\windows\SysWOW64\TWW.exe YJRSRI.exe File created C:\windows\SysWOW64\HWWPCM.exe XYQVUEJ.exe File created C:\windows\SysWOW64\PMW.exe.bat URZJON.exe File created C:\windows\SysWOW64\XLVTEAV.exe TDGLR.exe File created C:\windows\SysWOW64\LZHN.exe.bat HJBF.exe File created C:\windows\SysWOW64\PVW.exe LFQBE.exe File created C:\windows\SysWOW64\MXOMVY.exe ISEXF.exe File opened for modification C:\windows\SysWOW64\HWWPCM.exe XYQVUEJ.exe File created C:\windows\SysWOW64\HNODW.exe 2026-08-03_30e7f47e167ed8229a04e6c7b151f6ca_elex_emotet_stop.exe File opened for modification C:\windows\SysWOW64\GFF.exe IITYG.exe File created C:\windows\SysWOW64\ALOSCQ.exe.bat NIGTON.exe File created C:\windows\SysWOW64\JPN.exe.bat HZA.exe File opened for modification C:\windows\SysWOW64\TDOJN.exe QVH.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\OJJSZC.exe.bat ELDGJC.exe File opened for modification C:\windows\QETNOB.exe KJCM.exe File created C:\windows\system\XCXIF.exe.bat VEROYOC.exe File opened for modification C:\windows\system\HZA.exe HWWPCM.exe File created C:\windows\system\GWZS.exe LYZGAM.exe File opened for modification C:\windows\system\GWZS.exe LYZGAM.exe File created C:\windows\system\HJBF.exe.bat XLVTEAV.exe File opened for modification C:\windows\AWOCW.exe AQOO.exe File created C:\windows\AWOCW.exe.bat AQOO.exe File opened for modification C:\windows\system\VRBL.exe TWW.exe File created C:\windows\BOUUED.exe ENKSA.exe File created C:\windows\BOUUED.exe.bat ENKSA.exe File opened for modification C:\windows\system\LYZGAM.exe OTHRK.exe File created C:\windows\system\SSSGZH.exe SXPD.exe File opened for modification C:\windows\IITYG.exe SSSGZH.exe File created C:\windows\IITYG.exe.bat SSSGZH.exe File created C:\windows\NIPKVFK.exe HHIX.exe File opened for modification C:\windows\UCWCPZ.exe KTUX.exe File opened for modification C:\windows\LCMY.exe VMLGS.exe File created C:\windows\system\XCXIF.exe VEROYOC.exe File opened for modification C:\windows\system\IIQWJZG.exe SSPF.exe File created C:\windows\system\IIQWJZG.exe.bat SSPF.exe File created C:\windows\system\LFQBE.exe.bat LCMY.exe File opened for modification C:\windows\NIPKVFK.exe HHIX.exe File opened for modification C:\windows\system\DKUW.exe PPQV.exe File created C:\windows\JTPAMQ.exe TDOJN.exe File created C:\windows\REPP.exe.bat DZKSXYE.exe File created C:\windows\system\UXZFZ.exe.bat SZTKSX.exe File created C:\windows\system\PIP.exe.bat UXZFZ.exe File created C:\windows\system\IIQWJZG.exe SSPF.exe File created C:\windows\system\WNAQ.exe XCXIF.exe File created C:\windows\system\XYQVUEJ.exe.bat PIP.exe File created C:\windows\system\HHIX.exe PMW.exe File created C:\windows\OTHRK.exe HNODW.exe File created C:\windows\system\DKUW.exe.bat PPQV.exe File opened for modification C:\windows\ENKSA.exe DKUW.exe File created C:\windows\QVH.exe.bat RLWL.exe File created C:\windows\ELDGJC.exe.bat LIZCE.exe File opened for modification C:\windows\system\AQOO.exe WIHOIOH.exe File opened for modification C:\windows\RTQBKMK.exe SIO.exe File opened for modification C:\windows\VEROYOC.exe YEHMMK.exe File opened for modification C:\windows\system\WNAQ.exe XCXIF.exe File opened for modification C:\windows\DZKSXYE.exe OJJSZC.exe File opened for modification C:\windows\system\GKQWU.exe VRBL.exe File created C:\windows\YEHMMK.exe BOUUED.exe File created C:\windows\VEROYOC.exe.bat YEHMMK.exe File opened for modification C:\windows\system\VAB.exe KIL.exe File created C:\windows\PWMRI.exe.bat QLJ.exe File created C:\windows\QVH.exe RLWL.exe File created C:\windows\system\LYZGAM.exe.bat OTHRK.exe File opened for modification C:\windows\system\KTLPHN.exe BTJKD.exe File created C:\windows\system\TDGLR.exe NIPKVFK.exe File opened for modification C:\windows\BOUUED.exe ENKSA.exe File opened for modification C:\windows\system\BTJKD.exe GFF.exe File created C:\windows\system\HJBF.exe XLVTEAV.exe File created C:\windows\LCMY.exe.bat VMLGS.exe File created C:\windows\system\SIO.exe PVW.exe File created C:\windows\system\NIGTON.exe.bat QIWRCJT.exe File created C:\windows\system\PPQV.exe QETNOB.exe File created C:\windows\system\KIL.exe.bat WNAQ.exe File created C:\windows\RLWL.exe.bat HNRY.exe File created C:\windows\system\BTJKD.exe.bat GFF.exe File created C:\windows\QETNOB.exe.bat KJCM.exe File opened for modification C:\windows\system\PPQV.exe QETNOB.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 980 cmd.exe 2272 cmd.exe 5340 cmd.exe 4956 cmd.exe 2828 cmd.exe 4552 cmd.exe 4176 cmd.exe 1728 cmd.exe 4324 cmd.exe 5344 cmd.exe 1496 cmd.exe 3136 cmd.exe 2332 cmd.exe 2988 cmd.exe 3024 cmd.exe 1264 cmd.exe 2016 cmd.exe 4352 cmd.exe 1348 cmd.exe 5456 cmd.exe 2832 cmd.exe 3248 cmd.exe 3352 cmd.exe 3064 cmd.exe 1208 cmd.exe 1516 cmd.exe 6064 cmd.exe 4424 cmd.exe 4872 cmd.exe 1796 cmd.exe 5928 cmd.exe 1384 cmd.exe 3760 cmd.exe 3156 cmd.exe 4264 cmd.exe 2364 cmd.exe 4320 cmd.exe 3280 cmd.exe 2380 cmd.exe 1244 cmd.exe 6096 cmd.exe 4512 cmd.exe 5836 cmd.exe 1152 cmd.exe 4468 cmd.exe 4736 cmd.exe 1080 cmd.exe 5764 cmd.exe 3756 cmd.exe 5952 cmd.exe 2156 cmd.exe 2352 cmd.exe 6132 cmd.exe 4916 cmd.exe 5624 cmd.exe 5840 cmd.exe 4812 cmd.exe 4180 cmd.exe 5076 cmd.exe 2912 cmd.exe 3872 cmd.exe 256 cmd.exe 1412 cmd.exe 3188 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 4676 5044 WerFault.exe 88 4800 2680 WerFault.exe 94 2520 5524 WerFault.exe 100 5756 2584 WerFault.exe 105 2576 1536 WerFault.exe 110 3060 4672 WerFault.exe 115 3832 2668 WerFault.exe 120 424 4608 WerFault.exe 125 3444 4416 WerFault.exe 129 936 4536 WerFault.exe 135 1860 4284 WerFault.exe 140 4540 5716 WerFault.exe 145 4412 1928 WerFault.exe 150 1516 2324 WerFault.exe 155 3024 2752 WerFault.exe 160 2128 2320 WerFault.exe 165 5036 5632 WerFault.exe 170 4260 3852 WerFault.exe 175 1060 424 WerFault.exe 180 760 1064 WerFault.exe 185 1960 484 WerFault.exe 190 1932 5868 WerFault.exe 195 5852 2472 WerFault.exe 200 2540 4592 WerFault.exe 205 5864 2768 WerFault.exe 210 4848 1280 WerFault.exe 215 5976 2392 WerFault.exe 220 1896 3836 WerFault.exe 225 2948 5760 WerFault.exe 230 4916 1060 WerFault.exe 235 4620 5996 WerFault.exe 240 5148 6116 WerFault.exe 245 2760 3512 WerFault.exe 250 5248 2348 WerFault.exe 255 1076 2808 WerFault.exe 260 1348 2128 WerFault.exe 265 5472 2232 WerFault.exe 270 1896 2844 WerFault.exe 276 5336 2968 WerFault.exe 281 2924 5616 WerFault.exe 286 5792 628 WerFault.exe 291 2688 2080 WerFault.exe 296 1676 3936 WerFault.exe 301 2856 5672 WerFault.exe 306 5684 1848 WerFault.exe 311 4508 1836 WerFault.exe 316 5240 5656 WerFault.exe 321 4184 572 WerFault.exe 326 4660 5000 WerFault.exe 331 1472 2456 WerFault.exe 336 4120 5200 WerFault.exe 341 3412 4656 WerFault.exe 346 5948 5232 WerFault.exe 351 5116 4932 WerFault.exe 356 4992 5924 WerFault.exe 361 4164 4648 WerFault.exe 366 3420 1392 WerFault.exe 371 4328 1980 WerFault.exe 376 5628 4520 WerFault.exe 381 1180 2260 WerFault.exe 386 3304 2500 WerFault.exe 391 5252 3212 WerFault.exe 396 2016 616 WerFault.exe 401 6092 2916 WerFault.exe 406 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AQOO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QLJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SXPD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RLWL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RQSB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ALOSCQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PWMRI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DKUW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WIHOIOH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VRBL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QETNOB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HNODW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SSSGZH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IITYG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XLVTEAV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YJRSRI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DQH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NIGTON.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BOUUED.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SZTKSX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PVW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PPQV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UXZFZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UZJSJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BXZP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KJCM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YEHMMK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HZA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PMW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HJBF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZALV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GKQWU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VAB.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5044 2026-08-03_30e7f47e167ed8229a04e6c7b151f6ca_elex_emotet_stop.exe 5044 2026-08-03_30e7f47e167ed8229a04e6c7b151f6ca_elex_emotet_stop.exe 2680 HNODW.exe 2680 HNODW.exe 5524 OTHRK.exe 5524 OTHRK.exe 2584 LYZGAM.exe 2584 LYZGAM.exe 1536 GWZS.exe 1536 GWZS.exe 4672 SXPD.exe 4672 SXPD.exe 2668 SSSGZH.exe 2668 SSSGZH.exe 4608 IITYG.exe 4608 IITYG.exe 4416 GFF.exe 4416 GFF.exe 4536 BTJKD.exe 4536 BTJKD.exe 4284 KTLPHN.exe 4284 KTLPHN.exe 5716 URZJON.exe 5716 URZJON.exe 1928 PMW.exe 1928 PMW.exe 2324 HHIX.exe 2324 HHIX.exe 2752 NIPKVFK.exe 2752 NIPKVFK.exe 2320 TDGLR.exe 2320 TDGLR.exe 5632 XLVTEAV.exe 5632 XLVTEAV.exe 3852 HJBF.exe 3852 HJBF.exe 424 LZHN.exe 424 LZHN.exe 1064 UZJSJ.exe 1064 UZJSJ.exe 484 ZALV.exe 484 ZALV.exe 5868 BXZP.exe 5868 BXZP.exe 2472 WIHOIOH.exe 2472 WIHOIOH.exe 4592 AQOO.exe 4592 AQOO.exe 2768 AWOCW.exe 2768 AWOCW.exe 1280 KTUX.exe 1280 KTUX.exe 2392 UCWCPZ.exe 2392 UCWCPZ.exe 3836 SSPF.exe 3836 SSPF.exe 5760 IIQWJZG.exe 5760 IIQWJZG.exe 1060 RQSB.exe 1060 RQSB.exe 5996 LDXLW.exe 5996 LDXLW.exe 6116 DQH.exe 6116 DQH.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 5044 2026-08-03_30e7f47e167ed8229a04e6c7b151f6ca_elex_emotet_stop.exe 5044 2026-08-03_30e7f47e167ed8229a04e6c7b151f6ca_elex_emotet_stop.exe 2680 HNODW.exe 2680 HNODW.exe 5524 OTHRK.exe 5524 OTHRK.exe 2584 LYZGAM.exe 2584 LYZGAM.exe 1536 GWZS.exe 1536 GWZS.exe 4672 SXPD.exe 4672 SXPD.exe 2668 SSSGZH.exe 2668 SSSGZH.exe 4608 IITYG.exe 4608 IITYG.exe 4416 GFF.exe 4416 GFF.exe 4536 BTJKD.exe 4536 BTJKD.exe 4284 KTLPHN.exe 4284 KTLPHN.exe 5716 URZJON.exe 5716 URZJON.exe 1928 PMW.exe 1928 PMW.exe 2324 HHIX.exe 2324 HHIX.exe 2752 NIPKVFK.exe 2752 NIPKVFK.exe 2320 TDGLR.exe 2320 TDGLR.exe 5632 XLVTEAV.exe 5632 XLVTEAV.exe 3852 HJBF.exe 3852 HJBF.exe 424 LZHN.exe 424 LZHN.exe 1064 UZJSJ.exe 1064 UZJSJ.exe 484 ZALV.exe 484 ZALV.exe 5868 BXZP.exe 5868 BXZP.exe 2472 WIHOIOH.exe 2472 WIHOIOH.exe 4592 AQOO.exe 4592 AQOO.exe 2768 AWOCW.exe 2768 AWOCW.exe 1280 KTUX.exe 1280 KTUX.exe 2392 UCWCPZ.exe 2392 UCWCPZ.exe 3836 SSPF.exe 3836 SSPF.exe 5760 IIQWJZG.exe 5760 IIQWJZG.exe 1060 RQSB.exe 1060 RQSB.exe 5996 LDXLW.exe 5996 LDXLW.exe 6116 DQH.exe 6116 DQH.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5044 wrote to memory of 1816 5044 2026-08-03_30e7f47e167ed8229a04e6c7b151f6ca_elex_emotet_stop.exe 90 PID 1816 wrote to memory of 2680 1816 cmd.exe 94 PID 2680 wrote to memory of 964 2680 HNODW.exe 96 PID 964 wrote to memory of 5524 964 cmd.exe 100 PID 5524 wrote to memory of 4840 5524 OTHRK.exe 101 PID 4840 wrote to memory of 2584 4840 cmd.exe 105 PID 2584 wrote to memory of 5764 2584 LYZGAM.exe 106 PID 5764 wrote to memory of 1536 5764 cmd.exe 110 PID 1536 wrote to memory of 4936 1536 GWZS.exe 111 PID 4936 wrote to memory of 4672 4936 cmd.exe 115 PID 4672 wrote to memory of 1504 4672 SXPD.exe 116 PID 1504 wrote to memory of 2668 1504 cmd.exe 120 PID 2668 wrote to memory of 3204 2668 SSSGZH.exe 121 PID 3204 wrote to memory of 4608 3204 cmd.exe 125 PID 4608 wrote to memory of 2272 4608 IITYG.exe 126 PID 2272 wrote to memory of 4416 2272 cmd.exe 129 PID 4416 wrote to memory of 3576 4416 GFF.exe 131 PID 3576 wrote to memory of 4536 3576 cmd.exe 135 PID 4536 wrote to memory of 3264 4536 BTJKD.exe 136 PID 3264 wrote to memory of 4284 3264 cmd.exe 140 PID 4284 wrote to memory of 5340 4284 KTLPHN.exe 141 PID 5340 wrote to memory of 5716 5340 cmd.exe 145 PID 5716 wrote to memory of 1732 5716 URZJON.exe 146 PID 1732 wrote to memory of 1928 1732 cmd.exe 150 PID 1928 wrote to memory of 1120 1928 PMW.exe 151 PID 1120 wrote to memory of 2324 1120 cmd.exe 155 PID 2324 wrote to memory of 5804 2324 HHIX.exe 156 PID 5804 wrote to memory of 2752 5804 cmd.exe 160 PID 2752 wrote to memory of 5568 2752 NIPKVFK.exe 161 PID 5568 wrote to memory of 2320 5568 cmd.exe 165 PID 2320 wrote to memory of 4972 2320 TDGLR.exe 166 PID 4972 wrote to memory of 5632 4972 cmd.exe 170 PID 5632 wrote to memory of 4368 5632 XLVTEAV.exe 171 PID 4368 wrote to memory of 3852 4368 cmd.exe 175 PID 3852 wrote to memory of 4824 3852 HJBF.exe 176 PID 4824 wrote to memory of 424 4824 cmd.exe 180 PID 424 wrote to memory of 3632 424 LZHN.exe 181 PID 3632 wrote to memory of 1064 3632 cmd.exe 185 PID 1064 wrote to memory of 1244 1064 UZJSJ.exe 186 PID 1244 wrote to memory of 484 1244 cmd.exe 190 PID 484 wrote to memory of 3728 484 ZALV.exe 191 PID 3728 wrote to memory of 5868 3728 cmd.exe 195 PID 5868 wrote to memory of 5724 5868 BXZP.exe 196 PID 5724 wrote to memory of 2472 5724 cmd.exe 200 PID 2472 wrote to memory of 4320 2472 WIHOIOH.exe 201 PID 4320 wrote to memory of 4592 4320 cmd.exe 205 PID 4592 wrote to memory of 2532 4592 AQOO.exe 206 PID 2532 wrote to memory of 2768 2532 cmd.exe 210 PID 2768 wrote to memory of 4112 2768 AWOCW.exe 211 PID 4112 wrote to memory of 1280 4112 cmd.exe 215 PID 1280 wrote to memory of 3756 1280 KTUX.exe 216 PID 3756 wrote to memory of 2392 3756 cmd.exe 220 PID 2392 wrote to memory of 3020 2392 UCWCPZ.exe 221 PID 3020 wrote to memory of 3836 3020 cmd.exe 225 PID 3836 wrote to memory of 4180 3836 SSPF.exe 226 PID 4180 wrote to memory of 5760 4180 cmd.exe 230 PID 5760 wrote to memory of 5192 5760 IIQWJZG.exe 231 PID 5192 wrote to memory of 1060 5192 cmd.exe 235 PID 1060 wrote to memory of 5468 1060 RQSB.exe 236 PID 5468 wrote to memory of 5996 5468 cmd.exe 240 PID 5996 wrote to memory of 4984 5996 LDXLW.exe 241 PID 4984 wrote to memory of 6116 4984 cmd.exe 245 PID 6116 wrote to memory of 4696 6116 DQH.exe 246 PID 4696 wrote to memory of 3512 4696 cmd.exe 250
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_30e7f47e167ed8229a04e6c7b151f6ca_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-03_30e7f47e167ed8229a04e6c7b151f6ca_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HNODW.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\windows\SysWOW64\HNODW.exeC:\windows\system32\HNODW.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OTHRK.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:964 -
C:\windows\OTHRK.exeC:\windows\OTHRK.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LYZGAM.exe.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\windows\system\LYZGAM.exeC:\windows\system\LYZGAM.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GWZS.exe.bat" "8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5764 -
C:\windows\system\GWZS.exeC:\windows\system\GWZS.exe9⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SXPD.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\windows\system\SXPD.exeC:\windows\system\SXPD.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SSSGZH.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\windows\system\SSSGZH.exeC:\windows\system\SSSGZH.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IITYG.exe.bat" "14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3204 -
C:\windows\IITYG.exeC:\windows\IITYG.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GFF.exe.bat" "16⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\windows\SysWOW64\GFF.exeC:\windows\system32\GFF.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BTJKD.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\windows\system\BTJKD.exeC:\windows\system\BTJKD.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KTLPHN.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\windows\system\KTLPHN.exeC:\windows\system\KTLPHN.exe21⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\URZJON.exe.bat" "22⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5340 -
C:\windows\system\URZJON.exeC:\windows\system\URZJON.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PMW.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\windows\SysWOW64\PMW.exeC:\windows\system32\PMW.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HHIX.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\windows\system\HHIX.exeC:\windows\system\HHIX.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NIPKVFK.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:5804 -
C:\windows\NIPKVFK.exeC:\windows\NIPKVFK.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TDGLR.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:5568 -
C:\windows\system\TDGLR.exeC:\windows\system\TDGLR.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XLVTEAV.exe.bat" "32⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\windows\SysWOW64\XLVTEAV.exeC:\windows\system32\XLVTEAV.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5632 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HJBF.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\windows\system\HJBF.exeC:\windows\system\HJBF.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LZHN.exe.bat" "36⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\windows\SysWOW64\LZHN.exeC:\windows\system32\LZHN.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UZJSJ.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:3632 -
C:\windows\SysWOW64\UZJSJ.exeC:\windows\system32\UZJSJ.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZALV.exe.bat" "40⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\windows\SysWOW64\ZALV.exeC:\windows\system32\ZALV.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:484 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BXZP.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\windows\BXZP.exeC:\windows\BXZP.exe43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WIHOIOH.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:5724 -
C:\windows\WIHOIOH.exeC:\windows\WIHOIOH.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AQOO.exe.bat" "46⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\windows\system\AQOO.exeC:\windows\system\AQOO.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AWOCW.exe.bat" "48⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\windows\AWOCW.exeC:\windows\AWOCW.exe49⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KTUX.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\windows\KTUX.exeC:\windows\KTUX.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UCWCPZ.exe.bat" "52⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3756 -
C:\windows\UCWCPZ.exeC:\windows\UCWCPZ.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SSPF.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\windows\SysWOW64\SSPF.exeC:\windows\system32\SSPF.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IIQWJZG.exe.bat" "56⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\windows\system\IIQWJZG.exeC:\windows\system\IIQWJZG.exe57⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RQSB.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:5192 -
C:\windows\RQSB.exeC:\windows\RQSB.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LDXLW.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:5468 -
C:\windows\SysWOW64\LDXLW.exeC:\windows\system32\LDXLW.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DQH.exe.bat" "62⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\windows\SysWOW64\DQH.exeC:\windows\system32\DQH.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VMLGS.exe.bat" "64⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\windows\SysWOW64\VMLGS.exeC:\windows\system32\VMLGS.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LCMY.exe.bat" "66⤵
- System Location Discovery: System Language Discovery
PID:1184 -
C:\windows\LCMY.exeC:\windows\LCMY.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2348 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LFQBE.exe.bat" "68⤵
- System Location Discovery: System Language Discovery
PID:5228 -
C:\windows\system\LFQBE.exeC:\windows\system\LFQBE.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PVW.exe.bat" "70⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3024 -
C:\windows\SysWOW64\PVW.exeC:\windows\system32\PVW.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SIO.exe.bat" "72⤵PID:672
-
C:\windows\system\SIO.exeC:\windows\system\SIO.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2232 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RTQBKMK.exe.bat" "74⤵
- System Location Discovery: System Language Discovery
PID:5588 -
C:\windows\RTQBKMK.exeC:\windows\RTQBKMK.exe75⤵
- Executes dropped EXE
PID:2844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YJRSRI.exe.bat" "76⤵
- System Location Discovery: System Language Discovery
PID:3444 -
C:\windows\YJRSRI.exeC:\windows\YJRSRI.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TWW.exe.bat" "78⤵
- System Location Discovery: System Language Discovery
PID:1964 -
C:\windows\SysWOW64\TWW.exeC:\windows\system32\TWW.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VRBL.exe.bat" "80⤵
- Executes a command shell one-liner
PID:4916 -
C:\windows\system\VRBL.exeC:\windows\system\VRBL.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:628 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GKQWU.exe.bat" "82⤵PID:352
-
C:\windows\system\GKQWU.exeC:\windows\system\GKQWU.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QIWRCJT.exe.bat" "84⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:6064 -
C:\windows\SysWOW64\QIWRCJT.exeC:\windows\system32\QIWRCJT.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NIGTON.exe.bat" "86⤵
- Executes a command shell one-liner
PID:4176 -
C:\windows\system\NIGTON.exeC:\windows\system\NIGTON.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5672 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ALOSCQ.exe.bat" "88⤵
- System Location Discovery: System Language Discovery
PID:4640 -
C:\windows\SysWOW64\ALOSCQ.exeC:\windows\system32\ALOSCQ.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KJCM.exe.bat" "90⤵
- System Location Discovery: System Language Discovery
PID:5404 -
C:\windows\SysWOW64\KJCM.exeC:\windows\system32\KJCM.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QETNOB.exe.bat" "92⤵
- Executes a command shell one-liner
PID:3352 -
C:\windows\QETNOB.exeC:\windows\QETNOB.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5656 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PPQV.exe.bat" "94⤵PID:5712
-
C:\windows\system\PPQV.exeC:\windows\system\PPQV.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DKUW.exe.bat" "96⤵
- Executes a command shell one-liner
PID:6096 -
C:\windows\system\DKUW.exeC:\windows\system\DKUW.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ENKSA.exe.bat" "98⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3188 -
C:\windows\ENKSA.exeC:\windows\ENKSA.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BOUUED.exe.bat" "100⤵PID:5172
-
C:\windows\BOUUED.exeC:\windows\BOUUED.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YEHMMK.exe.bat" "102⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4424 -
C:\windows\YEHMMK.exeC:\windows\YEHMMK.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4656 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VEROYOC.exe.bat" "104⤵
- Executes a command shell one-liner
PID:3280 -
C:\windows\VEROYOC.exeC:\windows\VEROYOC.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5232 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XCXIF.exe.bat" "106⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4872 -
C:\windows\system\XCXIF.exeC:\windows\system\XCXIF.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WNAQ.exe.bat" "108⤵PID:2264
-
C:\windows\system\WNAQ.exeC:\windows\system\WNAQ.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KIL.exe.bat" "110⤵
- System Location Discovery: System Language Discovery
PID:696 -
C:\windows\system\KIL.exeC:\windows\system\KIL.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4648 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VAB.exe.bat" "112⤵
- System Location Discovery: System Language Discovery
PID:5016 -
C:\windows\system\VAB.exeC:\windows\system\VAB.exe113⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QLJ.exe.bat" "114⤵PID:4308
-
C:\windows\QLJ.exeC:\windows\QLJ.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PWMRI.exe.bat" "116⤵PID:8
-
C:\windows\PWMRI.exeC:\windows\PWMRI.exe117⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WMNI.exe.bat" "118⤵PID:4104
-
C:\windows\WMNI.exeC:\windows\WMNI.exe119⤵
- Executes dropped EXE
PID:2260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OUBN.exe.bat" "120⤵PID:756
-
C:\windows\system\OUBN.exeC:\windows\system\OUBN.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2500
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-