Analysis
- max time kernel
90s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/08/2026, 23:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-04_39f437ace09987e025e91098b7065020_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-04_39f437ace09987e025e91098b7065020_elex_emotet_stop.exe
- Size 208KB
- Sample260804-24hbjazyfv
- SHA256 a789bd831c3cc7fada5844fbb05eaae816ee7b05709de30a04b5552801e1c398
- MD5 39f437ace09987e025e91098b7065020
- SHA1 50c1dcad09085920321307c6c70bdae8c06e81fa
- SHA512 6a5612e158b23da31e75b995ebcf39e4d34fbb5af482284e70c0f24d5a42086a51f3ec5b9b2cb20e4730a644a4b3884bd4162ca65c9342e017520183005f2e08
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlldL+LOfO4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFll5+LOmkEj1
- TLSH T12A247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3408 RXWAHEU.exe 248 AVQ.exe 4956 IJUIDHZ.exe 1840 MRJQQ.exe 3864 YHQQCJJ.exe 4264 AFVKJS.exe 3872 KCBE.exe 2280 TDDJCFU.exe 1528 MVSUM.exe 4040 TRS.exe 4760 KZG.exe 3340 OHNBPL.exe 2080 DXOA.exe 3680 QIWRCJT.exe 3692 IQKWPAW.exe 4304 MTJJW.exe 4140 QBPRB.exe 4828 AZDLQUV.exe 5304 SCHHWK.exe 2140 CAM.exe 3156 GITBPK.exe 2852 QFHWF.exe 5320 CTGU.exe 4912 OJM.exe 120 IWRLY.exe 3172 DKWUIMY.exe 1576 FHBP.exe 4396 GKN.exe 5500 EVQBE.exe 3392 TQZ.exe 4588 MTDJCBO.exe 3844 QBKJ.exe 4068 FRL.exe 1100 JHZIA.exe 1972 ZXAH.exe 6132 DFHHSF.exe 4996 FBM.exe 3008 HZSLK.exe 2328 IUVP.exe 2228 CHAYAL.exe 3556 IHI.exe 4620 IVIB.exe 1216 OVQO.exe 5400 ZOLHC.exe 52 DWZ.exe 4332 JWHVF.exe 5928 JCZJGB.exe 1116 GHFGNDB.exe 4224 RAIZ.exe 4940 ANSR.exe 2936 RNM.exe 3712 MJRG.exe 4908 SJZTI.exe 5612 SOZIK.exe 2492 HJI.exe 4148 IMMQIEJ.exe 3600 ISM.exe 3396 OSUST.exe 1284 UTCGC.exe 1416 FLFZKVE.exe 5472 MBGQR.exe 4488 HPKZBQH.exe 4536 JCHJ.exe 1352 NSWRQB.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\FHYL.exe.bat KUTCPLF.exe File opened for modification C:\windows\SysWOW64\LIGZIF.exe FHYL.exe File created C:\windows\SysWOW64\TAKEW.exe ZNFV.exe File created C:\windows\SysWOW64\QBPRB.exe MTJJW.exe File created C:\windows\SysWOW64\IFB.exe.bat NSWRQB.exe File created C:\windows\SysWOW64\WBH.exe WNPOGEF.exe File opened for modification C:\windows\SysWOW64\GPW.exe WPUZBTY.exe File opened for modification C:\windows\SysWOW64\KFCMRI.exe GPW.exe File created C:\windows\SysWOW64\KFCMRI.exe.bat GPW.exe File opened for modification C:\windows\SysWOW64\MVHAM.exe IFB.exe File created C:\windows\SysWOW64\LIGZIF.exe FHYL.exe File opened for modification C:\windows\SysWOW64\WNPOGEF.exe TAKEW.exe File created C:\windows\SysWOW64\CBPQR.exe.bat WBH.exe File opened for modification C:\windows\SysWOW64\QBPRB.exe MTJJW.exe File created C:\windows\SysWOW64\HJI.exe SOZIK.exe File opened for modification C:\windows\SysWOW64\IFB.exe NSWRQB.exe File created C:\windows\SysWOW64\CMHUF.exe.bat WMAG.exe File opened for modification C:\windows\SysWOW64\PKJEEL.exe VXEV.exe File created C:\windows\SysWOW64\DDSMKO.exe IQNCZ.exe File created C:\windows\SysWOW64\ISM.exe IMMQIEJ.exe File created C:\windows\SysWOW64\FLFZKVE.exe UTCGC.exe File created C:\windows\SysWOW64\HPKZBQH.exe MBGQR.exe File created C:\windows\SysWOW64\PKJEEL.exe VXEV.exe File opened for modification C:\windows\SysWOW64\EGW.exe DDSMKO.exe File created C:\windows\SysWOW64\SBHS.exe YNCJVOZ.exe File opened for modification C:\windows\SysWOW64\HPKZBQH.exe MBGQR.exe File opened for modification C:\windows\SysWOW64\AFVKJS.exe YHQQCJJ.exe File created C:\windows\SysWOW64\KZG.exe TRS.exe File created C:\windows\SysWOW64\QIWRCJT.exe.bat DXOA.exe File opened for modification C:\windows\SysWOW64\JCZJGB.exe JWHVF.exe File created C:\windows\SysWOW64\JRJFGK.exe FJDX.exe File created C:\windows\SysWOW64\AFVKJS.exe YHQQCJJ.exe File created C:\windows\SysWOW64\MVHAM.exe IFB.exe File created C:\windows\SysWOW64\KEWCZ.exe EEO.exe File created C:\windows\SysWOW64\EGW.exe DDSMKO.exe File created C:\windows\SysWOW64\IOC.exe.bat EGW.exe File created C:\windows\SysWOW64\IQKWPAW.exe.bat QIWRCJT.exe File opened for modification C:\windows\SysWOW64\JHZIA.exe FRL.exe File created C:\windows\SysWOW64\DVDM.exe.bat LNB.exe File created C:\windows\SysWOW64\URGF.exe OQYR.exe File opened for modification C:\windows\SysWOW64\IOC.exe EGW.exe File created C:\windows\SysWOW64\IQKWPAW.exe QIWRCJT.exe File created C:\windows\SysWOW64\QFHWF.exe.bat GITBPK.exe File created C:\windows\SysWOW64\JHZIA.exe.bat FRL.exe File created C:\windows\SysWOW64\MBGQR.exe.bat FLFZKVE.exe File created C:\windows\SysWOW64\TMRXLF.exe.bat NMK.exe File created C:\windows\SysWOW64\IOC.exe EGW.exe File created C:\windows\SysWOW64\SBHS.exe.bat YNCJVOZ.exe File opened for modification C:\windows\SysWOW64\GITBPK.exe CAM.exe File created C:\windows\SysWOW64\IFB.exe NSWRQB.exe File opened for modification C:\windows\SysWOW64\DVDM.exe LNB.exe File opened for modification C:\windows\SysWOW64\JRJFGK.exe FJDX.exe File opened for modification C:\windows\SysWOW64\DDSMKO.exe IQNCZ.exe File opened for modification C:\windows\SysWOW64\QCIXVO.exe MUBPJWP.exe File created C:\windows\SysWOW64\QCIXVO.exe.bat MUBPJWP.exe File created C:\windows\SysWOW64\EVQBE.exe GKN.exe File opened for modification C:\windows\SysWOW64\HJI.exe SOZIK.exe File created C:\windows\SysWOW64\JRJFGK.exe.bat FJDX.exe File created C:\windows\SysWOW64\KFCMRI.exe GPW.exe File created C:\windows\SysWOW64\EGW.exe.bat DDSMKO.exe File opened for modification C:\windows\SysWOW64\IQKWPAW.exe QIWRCJT.exe File opened for modification C:\windows\SysWOW64\QFHWF.exe GITBPK.exe File opened for modification C:\windows\SysWOW64\ANSR.exe RAIZ.exe File created C:\windows\SysWOW64\TMRXLF.exe NMK.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\OJM.exe CTGU.exe File created C:\windows\system\IWRLY.exe.bat OJM.exe File opened for modification C:\windows\SOZIK.exe SJZTI.exe File created C:\windows\OSUST.exe.bat ISM.exe File opened for modification C:\windows\JCHJ.exe HPKZBQH.exe File opened for modification C:\windows\system\NSWRQB.exe JCHJ.exe File created C:\windows\OIUHR.exe PKJEEL.exe File created C:\windows\EEO.exe JRJFGK.exe File created C:\windows\system\FBM.exe DFHHSF.exe File opened for modification C:\windows\DWZ.exe ZOLHC.exe File created C:\windows\RAIZ.exe.bat GHFGNDB.exe File opened for modification C:\windows\system\WMAG.exe LUX.exe File created C:\windows\ZGWQEV.exe.bat BLW.exe File created C:\windows\system\FVD.exe LIGZIF.exe File created C:\windows\system\WPUZBTY.exe.bat CBPQR.exe File created C:\windows\system\NCCS.exe.bat NOK.exe File created C:\windows\TQZ.exe.bat EVQBE.exe File created C:\windows\SJZTI.exe.bat MJRG.exe File created C:\windows\system\NOK.exe IOC.exe File created C:\windows\system\DSXAK.exe IPHBW.exe File opened for modification C:\windows\CBBYI.exe SBHS.exe File created C:\windows\CBBYI.exe.bat SBHS.exe File created C:\windows\ORQ.exe CBBYI.exe File created C:\windows\MRXTE.exe ORQ.exe File created C:\windows\TRS.exe MVSUM.exe File created C:\windows\OJM.exe.bat CTGU.exe File created C:\windows\system\IUVP.exe.bat HZSLK.exe File created C:\windows\system\CHAYAL.exe IUVP.exe File created C:\windows\system\IHI.exe.bat CHAYAL.exe File created C:\windows\system\JWHVF.exe.bat DWZ.exe File created C:\windows\system\IPHBW.exe.bat NCCS.exe File created C:\windows\DXOA.exe.bat OHNBPL.exe File opened for modification C:\windows\system\IWRLY.exe OJM.exe File created C:\windows\IVIB.exe.bat IHI.exe File created C:\windows\system\ZOLHC.exe OVQO.exe File opened for modification C:\windows\ORQ.exe CBBYI.exe File created C:\windows\MRXTE.exe.bat ORQ.exe File opened for modification C:\windows\system\CTGU.exe QFHWF.exe File created C:\windows\system\GKN.exe.bat FHBP.exe File opened for modification C:\windows\system\DFHHSF.exe ZXAH.exe File opened for modification C:\windows\GHFGNDB.exe JCZJGB.exe File created C:\windows\VXEV.exe.bat PBFU.exe File opened for modification C:\windows\FJDX.exe FVD.exe File opened for modification C:\windows\system\NCCS.exe NOK.exe File created C:\windows\MUBPJWP.exe MRXTE.exe File created C:\windows\system\MRJQQ.exe IJUIDHZ.exe File opened for modification C:\windows\CAM.exe SCHHWK.exe File created C:\windows\system\FHBP.exe DKWUIMY.exe File created C:\windows\ZXAH.exe.bat JHZIA.exe File created C:\windows\system\DFHHSF.exe ZXAH.exe File opened for modification C:\windows\system\FBM.exe DFHHSF.exe File opened for modification C:\windows\system\ZOLHC.exe OVQO.exe File opened for modification C:\windows\RAIZ.exe GHFGNDB.exe File opened for modification C:\windows\system\MRJQQ.exe IJUIDHZ.exe File created C:\windows\system\MRJQQ.exe.bat IJUIDHZ.exe File created C:\windows\system\YHQQCJJ.exe MRJQQ.exe File created C:\windows\system\NSWRQB.exe.bat JCHJ.exe File opened for modification C:\windows\QDO.exe MVHAM.exe File created C:\windows\system\LNB.exe.bat CMHUF.exe File created C:\windows\system\PBFU.exe ZGWQEV.exe File created C:\windows\system\NMK.exe URGF.exe File created C:\windows\RXWAHEU.exe 2026-08-04_39f437ace09987e025e91098b7065020_elex_emotet_stop.exe File created C:\windows\system\YHQQCJJ.exe.bat MRJQQ.exe File created C:\windows\OHNBPL.exe.bat KZG.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4848 cmd.exe 692 cmd.exe 4796 cmd.exe 3248 cmd.exe 2264 cmd.exe 2620 cmd.exe 1920 cmd.exe 4680 cmd.exe 5876 cmd.exe 2452 cmd.exe 1980 cmd.exe 1648 cmd.exe 4608 cmd.exe 2900 cmd.exe 4424 cmd.exe 4212 cmd.exe 4752 cmd.exe 3356 cmd.exe 1380 cmd.exe 2432 cmd.exe 6108 cmd.exe 1248 cmd.exe 244 cmd.exe 3064 cmd.exe 1376 cmd.exe 5924 cmd.exe 4124 cmd.exe 5384 cmd.exe 704 cmd.exe 2556 cmd.exe 700 cmd.exe 708 cmd.exe 4964 cmd.exe 5208 cmd.exe 4628 cmd.exe 1580 cmd.exe 1536 cmd.exe 3208 cmd.exe 6100 cmd.exe 4596 cmd.exe 5216 cmd.exe 2704 cmd.exe 3260 cmd.exe 1304 cmd.exe 4692 cmd.exe 4564 cmd.exe 2824 cmd.exe 500 cmd.exe 5788 cmd.exe 3280 cmd.exe 5352 cmd.exe 2516 cmd.exe 3924 cmd.exe 2444 cmd.exe 2648 cmd.exe 2696 cmd.exe 2104 cmd.exe 3532 cmd.exe 5824 cmd.exe 1600 cmd.exe 2776 cmd.exe 2056 cmd.exe 5316 cmd.exe 1264 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 5768 4976 WerFault.exe 87 4676 3408 WerFault.exe 92 5132 248 WerFault.exe 98 4752 4956 WerFault.exe 103 1116 1840 WerFault.exe 108 4608 3864 WerFault.exe 112 5472 4264 WerFault.exe 118 4888 3872 WerFault.exe 123 5884 2280 WerFault.exe 128 4620 1528 WerFault.exe 133 1008 4040 WerFault.exe 138 4208 4760 WerFault.exe 143 2068 3340 WerFault.exe 148 2720 2080 WerFault.exe 153 2940 3680 WerFault.exe 158 4380 3692 WerFault.exe 163 1808 4304 WerFault.exe 168 2988 4140 WerFault.exe 173 5432 4828 WerFault.exe 178 2264 5304 WerFault.exe 183 4520 2140 WerFault.exe 188 6128 3156 WerFault.exe 193 2504 2852 WerFault.exe 198 4320 5320 WerFault.exe 203 2720 4912 WerFault.exe 208 2940 120 WerFault.exe 213 4380 3172 WerFault.exe 218 3700 1576 WerFault.exe 223 5780 4396 WerFault.exe 228 2284 5500 WerFault.exe 233 1260 3392 WerFault.exe 238 5824 4588 WerFault.exe 243 4652 3844 WerFault.exe 248 1324 4068 WerFault.exe 253 3384 1100 WerFault.exe 258 4568 1972 WerFault.exe 263 5764 6132 WerFault.exe 268 2032 4996 WerFault.exe 274 3152 3008 WerFault.exe 279 6032 2328 WerFault.exe 284 5264 2228 WerFault.exe 289 4236 3556 WerFault.exe 294 2296 4620 WerFault.exe 299 2644 1216 WerFault.exe 304 1660 5400 WerFault.exe 309 1208 52 WerFault.exe 314 5244 4332 WerFault.exe 319 1832 5928 WerFault.exe 324 2148 1116 WerFault.exe 329 5596 4224 WerFault.exe 334 5472 4940 WerFault.exe 339 3112 2936 WerFault.exe 344 2964 3712 WerFault.exe 349 3300 4908 WerFault.exe 354 5308 5612 WerFault.exe 359 4624 2492 WerFault.exe 364 468 4148 WerFault.exe 369 4968 3600 WerFault.exe 374 2952 3396 WerFault.exe 379 3152 1284 WerFault.exe 384 5644 1416 WerFault.exe 389 4736 5472 WerFault.exe 394 2156 4488 WerFault.exe 399 2612 4536 WerFault.exe 404 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CHAYAL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NCCS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QBPRB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JCHJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FRL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OSUST.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RXWAHEU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IFB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NMK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LUX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TAKEW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KCBE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZNFV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JWHVF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QDO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HJI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ORQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HZSLK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language URGF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DSXAK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MRJQQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OVQO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IMMQIEJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DFHHSF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BLW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FHYL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PKJEEL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FVD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FLFZKVE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SOZIK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMHUF.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4976 2026-08-04_39f437ace09987e025e91098b7065020_elex_emotet_stop.exe 4976 2026-08-04_39f437ace09987e025e91098b7065020_elex_emotet_stop.exe 3408 RXWAHEU.exe 3408 RXWAHEU.exe 248 AVQ.exe 248 AVQ.exe 4956 IJUIDHZ.exe 4956 IJUIDHZ.exe 1840 MRJQQ.exe 1840 MRJQQ.exe 3864 YHQQCJJ.exe 3864 YHQQCJJ.exe 4264 AFVKJS.exe 4264 AFVKJS.exe 3872 KCBE.exe 3872 KCBE.exe 2280 TDDJCFU.exe 2280 TDDJCFU.exe 1528 MVSUM.exe 1528 MVSUM.exe 4040 TRS.exe 4040 TRS.exe 4760 KZG.exe 4760 KZG.exe 3340 OHNBPL.exe 3340 OHNBPL.exe 2080 DXOA.exe 2080 DXOA.exe 3680 QIWRCJT.exe 3680 QIWRCJT.exe 3692 IQKWPAW.exe 3692 IQKWPAW.exe 4304 MTJJW.exe 4304 MTJJW.exe 4140 QBPRB.exe 4140 QBPRB.exe 4828 AZDLQUV.exe 4828 AZDLQUV.exe 5304 SCHHWK.exe 5304 SCHHWK.exe 2140 CAM.exe 2140 CAM.exe 3156 GITBPK.exe 3156 GITBPK.exe 2852 QFHWF.exe 2852 QFHWF.exe 5320 CTGU.exe 5320 CTGU.exe 4912 OJM.exe 4912 OJM.exe 120 IWRLY.exe 120 IWRLY.exe 3172 DKWUIMY.exe 3172 DKWUIMY.exe 1576 FHBP.exe 1576 FHBP.exe 4396 GKN.exe 4396 GKN.exe 5500 EVQBE.exe 5500 EVQBE.exe 3392 TQZ.exe 3392 TQZ.exe 4588 MTDJCBO.exe 4588 MTDJCBO.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4976 2026-08-04_39f437ace09987e025e91098b7065020_elex_emotet_stop.exe 4976 2026-08-04_39f437ace09987e025e91098b7065020_elex_emotet_stop.exe 3408 RXWAHEU.exe 3408 RXWAHEU.exe 248 AVQ.exe 248 AVQ.exe 4956 IJUIDHZ.exe 4956 IJUIDHZ.exe 1840 MRJQQ.exe 1840 MRJQQ.exe 3864 YHQQCJJ.exe 3864 YHQQCJJ.exe 4264 AFVKJS.exe 4264 AFVKJS.exe 3872 KCBE.exe 3872 KCBE.exe 2280 TDDJCFU.exe 2280 TDDJCFU.exe 1528 MVSUM.exe 1528 MVSUM.exe 4040 TRS.exe 4040 TRS.exe 4760 KZG.exe 4760 KZG.exe 3340 OHNBPL.exe 3340 OHNBPL.exe 2080 DXOA.exe 2080 DXOA.exe 3680 QIWRCJT.exe 3680 QIWRCJT.exe 3692 IQKWPAW.exe 3692 IQKWPAW.exe 4304 MTJJW.exe 4304 MTJJW.exe 4140 QBPRB.exe 4140 QBPRB.exe 4828 AZDLQUV.exe 4828 AZDLQUV.exe 5304 SCHHWK.exe 5304 SCHHWK.exe 2140 CAM.exe 2140 CAM.exe 3156 GITBPK.exe 3156 GITBPK.exe 2852 QFHWF.exe 2852 QFHWF.exe 5320 CTGU.exe 5320 CTGU.exe 4912 OJM.exe 4912 OJM.exe 120 IWRLY.exe 120 IWRLY.exe 3172 DKWUIMY.exe 3172 DKWUIMY.exe 1576 FHBP.exe 1576 FHBP.exe 4396 GKN.exe 4396 GKN.exe 5500 EVQBE.exe 5500 EVQBE.exe 3392 TQZ.exe 3392 TQZ.exe 4588 MTDJCBO.exe 4588 MTDJCBO.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4976 wrote to memory of 6068 4976 2026-08-04_39f437ace09987e025e91098b7065020_elex_emotet_stop.exe 88 PID 6068 wrote to memory of 3408 6068 cmd.exe 92 PID 3408 wrote to memory of 4744 3408 RXWAHEU.exe 94 PID 4744 wrote to memory of 248 4744 cmd.exe 98 PID 248 wrote to memory of 124 248 AVQ.exe 99 PID 124 wrote to memory of 4956 124 cmd.exe 103 PID 4956 wrote to memory of 5324 4956 IJUIDHZ.exe 104 PID 5324 wrote to memory of 1840 5324 cmd.exe 108 PID 1840 wrote to memory of 1736 1840 MRJQQ.exe 109 PID 1736 wrote to memory of 3864 1736 cmd.exe 112 PID 3864 wrote to memory of 4964 3864 YHQQCJJ.exe 114 PID 4964 wrote to memory of 4264 4964 cmd.exe 118 PID 4264 wrote to memory of 4784 4264 AFVKJS.exe 119 PID 4784 wrote to memory of 3872 4784 cmd.exe 123 PID 3872 wrote to memory of 5524 3872 KCBE.exe 124 PID 5524 wrote to memory of 2280 5524 cmd.exe 128 PID 2280 wrote to memory of 1396 2280 TDDJCFU.exe 129 PID 1396 wrote to memory of 1528 1396 cmd.exe 133 PID 1528 wrote to memory of 5588 1528 MVSUM.exe 134 PID 5588 wrote to memory of 4040 5588 cmd.exe 138 PID 4040 wrote to memory of 4156 4040 TRS.exe 139 PID 4156 wrote to memory of 4760 4156 cmd.exe 143 PID 4760 wrote to memory of 5388 4760 KZG.exe 144 PID 5388 wrote to memory of 3340 5388 cmd.exe 148 PID 3340 wrote to memory of 5768 3340 OHNBPL.exe 149 PID 5768 wrote to memory of 2080 5768 cmd.exe 153 PID 2080 wrote to memory of 2260 2080 DXOA.exe 154 PID 2260 wrote to memory of 3680 2260 cmd.exe 158 PID 3680 wrote to memory of 416 3680 QIWRCJT.exe 159 PID 416 wrote to memory of 3692 416 cmd.exe 163 PID 3692 wrote to memory of 2124 3692 IQKWPAW.exe 164 PID 2124 wrote to memory of 4304 2124 cmd.exe 168 PID 4304 wrote to memory of 972 4304 MTJJW.exe 169 PID 972 wrote to memory of 4140 972 cmd.exe 173 PID 4140 wrote to memory of 6040 4140 QBPRB.exe 174 PID 6040 wrote to memory of 4828 6040 cmd.exe 178 PID 4828 wrote to memory of 2900 4828 AZDLQUV.exe 179 PID 2900 wrote to memory of 5304 2900 cmd.exe 183 PID 5304 wrote to memory of 1952 5304 SCHHWK.exe 184 PID 1952 wrote to memory of 2140 1952 cmd.exe 188 PID 2140 wrote to memory of 4564 2140 CAM.exe 189 PID 4564 wrote to memory of 3156 4564 cmd.exe 193 PID 3156 wrote to memory of 4424 3156 GITBPK.exe 194 PID 4424 wrote to memory of 2852 4424 cmd.exe 198 PID 2852 wrote to memory of 704 2852 QFHWF.exe 199 PID 704 wrote to memory of 5320 704 cmd.exe 203 PID 5320 wrote to memory of 1584 5320 CTGU.exe 204 PID 1584 wrote to memory of 4912 1584 cmd.exe 208 PID 4912 wrote to memory of 2620 4912 OJM.exe 209 PID 2620 wrote to memory of 120 2620 cmd.exe 213 PID 120 wrote to memory of 2880 120 IWRLY.exe 214 PID 2880 wrote to memory of 3172 2880 cmd.exe 218 PID 3172 wrote to memory of 5864 3172 DKWUIMY.exe 219 PID 5864 wrote to memory of 1576 5864 cmd.exe 223 PID 1576 wrote to memory of 2824 1576 FHBP.exe 224 PID 2824 wrote to memory of 4396 2824 cmd.exe 228 PID 4396 wrote to memory of 460 4396 GKN.exe 229 PID 460 wrote to memory of 5500 460 cmd.exe 233 PID 5500 wrote to memory of 4212 5500 EVQBE.exe 234 PID 4212 wrote to memory of 3392 4212 cmd.exe 238 PID 3392 wrote to memory of 4592 3392 TQZ.exe 239 PID 4592 wrote to memory of 4588 4592 cmd.exe 243 PID 4588 wrote to memory of 1496 4588 MTDJCBO.exe 244 PID 1496 wrote to memory of 3844 1496 cmd.exe 248
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_39f437ace09987e025e91098b7065020_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_39f437ace09987e025e91098b7065020_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RXWAHEU.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:6068 -
C:\windows\RXWAHEU.exeC:\windows\RXWAHEU.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AVQ.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\windows\system\AVQ.exeC:\windows\system\AVQ.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IJUIDHZ.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:124 -
C:\windows\IJUIDHZ.exeC:\windows\IJUIDHZ.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MRJQQ.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:5324 -
C:\windows\system\MRJQQ.exeC:\windows\system\MRJQQ.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YHQQCJJ.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\windows\system\YHQQCJJ.exeC:\windows\system\YHQQCJJ.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AFVKJS.exe.bat" "12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\windows\SysWOW64\AFVKJS.exeC:\windows\system32\AFVKJS.exe13⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KCBE.exe.bat" "14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\windows\KCBE.exeC:\windows\KCBE.exe15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TDDJCFU.exe.bat" "16⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5524 -
C:\windows\system\TDDJCFU.exeC:\windows\system\TDDJCFU.exe17⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MVSUM.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\windows\SysWOW64\MVSUM.exeC:\windows\system32\MVSUM.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TRS.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:5588 -
C:\windows\TRS.exeC:\windows\TRS.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4040 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KZG.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\windows\SysWOW64\KZG.exeC:\windows\system32\KZG.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OHNBPL.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:5388 -
C:\windows\OHNBPL.exeC:\windows\OHNBPL.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DXOA.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:5768 -
C:\windows\DXOA.exeC:\windows\DXOA.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QIWRCJT.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\windows\SysWOW64\QIWRCJT.exeC:\windows\system32\QIWRCJT.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IQKWPAW.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:416 -
C:\windows\SysWOW64\IQKWPAW.exeC:\windows\system32\IQKWPAW.exe31⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MTJJW.exe.bat" "32⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\windows\MTJJW.exeC:\windows\MTJJW.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QBPRB.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:972 -
C:\windows\SysWOW64\QBPRB.exeC:\windows\system32\QBPRB.exe35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AZDLQUV.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:6040 -
C:\windows\AZDLQUV.exeC:\windows\AZDLQUV.exe37⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SCHHWK.exe.bat" "38⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\windows\system\SCHHWK.exeC:\windows\system\SCHHWK.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CAM.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\windows\CAM.exeC:\windows\CAM.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GITBPK.exe.bat" "42⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\windows\SysWOW64\GITBPK.exeC:\windows\system32\GITBPK.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QFHWF.exe.bat" "44⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\windows\SysWOW64\QFHWF.exeC:\windows\system32\QFHWF.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CTGU.exe.bat" "46⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:704 -
C:\windows\system\CTGU.exeC:\windows\system\CTGU.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OJM.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\windows\OJM.exeC:\windows\OJM.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IWRLY.exe.bat" "50⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\windows\system\IWRLY.exeC:\windows\system\IWRLY.exe51⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:120 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DKWUIMY.exe.bat" "52⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\windows\DKWUIMY.exeC:\windows\DKWUIMY.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FHBP.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:5864 -
C:\windows\system\FHBP.exeC:\windows\system\FHBP.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GKN.exe.bat" "56⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\windows\system\GKN.exeC:\windows\system\GKN.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EVQBE.exe.bat" "58⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:460 -
C:\windows\SysWOW64\EVQBE.exeC:\windows\system32\EVQBE.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TQZ.exe.bat" "60⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\windows\TQZ.exeC:\windows\TQZ.exe61⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MTDJCBO.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\windows\system\MTDJCBO.exeC:\windows\system\MTDJCBO.exe63⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QBKJ.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\windows\system\QBKJ.exeC:\windows\system\QBKJ.exe65⤵
- Executes dropped EXE
PID:3844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FRL.exe.bat" "66⤵
- System Location Discovery: System Language Discovery
PID:4160 -
C:\windows\FRL.exeC:\windows\FRL.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JHZIA.exe.bat" "68⤵PID:4644
-
C:\windows\SysWOW64\JHZIA.exeC:\windows\system32\JHZIA.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZXAH.exe.bat" "70⤵PID:5912
-
C:\windows\ZXAH.exeC:\windows\ZXAH.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DFHHSF.exe.bat" "72⤵
- Executes a command shell one-liner
PID:5216 -
C:\windows\system\DFHHSF.exeC:\windows\system\DFHHSF.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FBM.exe.bat" "74⤵PID:2040
-
C:\windows\system\FBM.exeC:\windows\system\FBM.exe75⤵
- Executes dropped EXE
PID:4996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HZSLK.exe.bat" "76⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4752 -
C:\windows\system\HZSLK.exeC:\windows\system\HZSLK.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3008 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IUVP.exe.bat" "78⤵
- Executes a command shell one-liner
PID:4848 -
C:\windows\system\IUVP.exeC:\windows\system\IUVP.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2328 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CHAYAL.exe.bat" "80⤵
- Executes a command shell one-liner
PID:3356 -
C:\windows\system\CHAYAL.exeC:\windows\system\CHAYAL.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2228 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IHI.exe.bat" "82⤵
- Executes a command shell one-liner
PID:692 -
C:\windows\system\IHI.exeC:\windows\system\IHI.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IVIB.exe.bat" "84⤵PID:2240
-
C:\windows\IVIB.exeC:\windows\IVIB.exe85⤵
- Executes dropped EXE
PID:4620 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OVQO.exe.bat" "86⤵
- Executes a command shell one-liner
PID:5824 -
C:\windows\OVQO.exeC:\windows\OVQO.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1216 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZOLHC.exe.bat" "88⤵
- Executes a command shell one-liner
PID:3924 -
C:\windows\system\ZOLHC.exeC:\windows\system\ZOLHC.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DWZ.exe.bat" "90⤵PID:2756
-
C:\windows\DWZ.exeC:\windows\DWZ.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:52 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JWHVF.exe.bat" "92⤵
- System Location Discovery: System Language Discovery
PID:4756 -
C:\windows\system\JWHVF.exeC:\windows\system\JWHVF.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4332 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JCZJGB.exe.bat" "94⤵
- Executes a command shell one-liner
PID:2556 -
C:\windows\SysWOW64\JCZJGB.exeC:\windows\system32\JCZJGB.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GHFGNDB.exe.bat" "96⤵PID:1520
-
C:\windows\GHFGNDB.exeC:\windows\GHFGNDB.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RAIZ.exe.bat" "98⤵PID:3076
-
C:\windows\RAIZ.exeC:\windows\RAIZ.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4224 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ANSR.exe.bat" "100⤵PID:1436
-
C:\windows\SysWOW64\ANSR.exeC:\windows\system32\ANSR.exe101⤵
- Executes dropped EXE
PID:4940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RNM.exe.bat" "102⤵PID:1344
-
C:\windows\system\RNM.exeC:\windows\system\RNM.exe103⤵
- Executes dropped EXE
PID:2936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MJRG.exe.bat" "104⤵
- System Location Discovery: System Language Discovery
PID:3332 -
C:\windows\SysWOW64\MJRG.exeC:\windows\system32\MJRG.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SJZTI.exe.bat" "106⤵PID:5152
-
C:\windows\SJZTI.exeC:\windows\SJZTI.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SOZIK.exe.bat" "108⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:700 -
C:\windows\SOZIK.exeC:\windows\SOZIK.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HJI.exe.bat" "110⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:500 -
C:\windows\SysWOW64\HJI.exeC:\windows\system32\HJI.exe111⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IMMQIEJ.exe.bat" "112⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5316 -
C:\windows\IMMQIEJ.exeC:\windows\IMMQIEJ.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4148 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ISM.exe.bat" "114⤵
- System Location Discovery: System Language Discovery
PID:5656 -
C:\windows\SysWOW64\ISM.exeC:\windows\system32\ISM.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OSUST.exe.bat" "116⤵
- Executes a command shell one-liner
PID:708 -
C:\windows\OSUST.exeC:\windows\OSUST.exe117⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UTCGC.exe.bat" "118⤵
- Executes a command shell one-liner
PID:1920 -
C:\windows\system\UTCGC.exeC:\windows\system\UTCGC.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FLFZKVE.exe.bat" "120⤵PID:5620
-
C:\windows\SysWOW64\FLFZKVE.exeC:\windows\system32\FLFZKVE.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1416
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-