Analysis
- max time kernel
91s - max time network
134s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/08/2026, 22:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-04_6a4dd888c1edb8e6a481c467affd3fc8_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-04_6a4dd888c1edb8e6a481c467affd3fc8_elex_emotet_stop.exe
- Size 208KB
- Sample260804-2szrfafl6x
- SHA256 a1e14e463f628c38578af38305ba5d593862603013759f02d8b927db4c6697b1
- MD5 6a4dd888c1edb8e6a481c467affd3fc8
- SHA1 60555d925b76f674f83628f61a161664e2c4c472
- SHA512 c2d2e682d5ad4cfe0b565770454d5bac0d3ec617b2d84268ce587504f7752ed3d374dadb4bd5b5f916aecdcf990663b57edb2d024d11a5e87aa8306c3fb95898
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlldL+LOfZ4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFll5+LOxkEj1
- TLSH T1A4247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4464 SEZMCL.exe 5716 OKM.exe 296 HDB.exe 4672 QDDGZ.exe 1908 LYIQKG.exe 2120 ATRU.exe 1312 JUTHGZU.exe 1548 KXXD.exe 4452 DABHRE.exe 3468 NXHTGN.exe 4772 RFV.exe 5712 ZTA.exe 4088 DBGII.exe 5384 BMRY.exe 1716 TUTDUHS.exe 4628 RKFGPN.exe 3656 GAGFNIP.exe 3120 QIIKZG.exe 2664 AGN.exe 3652 SBRAMEB.exe 5076 CZFU.exe 4768 KMJB.exe 4200 YPAA.exe 5924 SKEJCV.exe 4496 IAFBJRE.exe 3336 QGKPUPA.exe 4048 SEYCBY.exe 2860 QPASK.exe 4736 UFH.exe 4604 QHYQKZ.exe 3296 KDCAMZD.exe 3916 ATDZTU.exe 4380 LLLKKV.exe 2884 LGP.exe 4456 RHWBZ.exe 5548 MCBLJNZ.exe 4560 FXFH.exe 5044 FAJ.exe 5036 YDUGH.exe 3500 ZGY.exe 2980 KZT.exe 1160 ZULHGB.exe 4228 KMGAPIA.exe 1088 QMNN.exe 4924 ZNPSB.exe 5916 UAUCLIS.exe 2600 VDYGRY.exe 1516 NGC.exe 5520 JRSASY.exe 6028 BMWWY.exe 4376 AFZM.exe 5084 XCF.exe 1564 CNBHT.exe 4840 PQFO.exe 2244 AJAGG.exe 2296 PMR.exe 3248 BEME.exe 5704 HEURIY.exe 5132 JUVLP.exe 4612 WFDKD.exe 1144 ELQR.exe 4064 KGPZS.exe 2992 IEAU.exe 5236 SECAJ.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\IAFBJRE.exe SKEJCV.exe File created C:\windows\SysWOW64\HEURIY.exe.bat BEME.exe File opened for modification C:\windows\SysWOW64\BPDFKXX.exe WKTPCU.exe File created C:\windows\SysWOW64\ABSG.exe.bat WLMYJA.exe File opened for modification C:\windows\SysWOW64\VCKNR.exe KJH.exe File opened for modification C:\windows\SysWOW64\HWSKD.exe JWKWURJ.exe File created C:\windows\SysWOW64\NKT.exe.bat WXJRLPA.exe File created C:\windows\SysWOW64\ACDF.exe LHMTNU.exe File opened for modification C:\windows\SysWOW64\QIIKZG.exe GAGFNIP.exe File opened for modification C:\windows\SysWOW64\ABSG.exe WLMYJA.exe File created C:\windows\SysWOW64\NKT.exe WXJRLPA.exe File created C:\windows\SysWOW64\OYKABVN.exe.bat VDY.exe File opened for modification C:\windows\SysWOW64\LHMTNU.exe KEIXIWP.exe File created C:\windows\SysWOW64\FLORFG.exe.bat KYKI.exe File created C:\windows\SysWOW64\BKNHTS.exe GWJX.exe File created C:\windows\SysWOW64\PMR.exe AJAGG.exe File created C:\windows\SysWOW64\BPDFKXX.exe.bat WKTPCU.exe File created C:\windows\SysWOW64\ABSG.exe WLMYJA.exe File created C:\windows\SysWOW64\AWBJ.exe FLORFG.exe File created C:\windows\SysWOW64\JUTHGZU.exe.bat ATRU.exe File created C:\windows\SysWOW64\KIZM.exe GATMRF.exe File created C:\windows\SysWOW64\KJH.exe EJZ.exe File opened for modification C:\windows\SysWOW64\AHLOG.exe XZFOUY.exe File created C:\windows\SysWOW64\HWSKD.exe.bat JWKWURJ.exe File created C:\windows\SysWOW64\ACDF.exe.bat LHMTNU.exe File opened for modification C:\windows\SysWOW64\ZTA.exe RFV.exe File opened for modification C:\windows\SysWOW64\BMRY.exe DBGII.exe File created C:\windows\SysWOW64\ZNPSB.exe.bat QMNN.exe File opened for modification C:\windows\SysWOW64\PQFO.exe CNBHT.exe File created C:\windows\SysWOW64\PMR.exe.bat AJAGG.exe File created C:\windows\SysWOW64\BEME.exe PMR.exe File created C:\windows\SysWOW64\MAOGO.exe AHLOG.exe File created C:\windows\SysWOW64\BMRY.exe DBGII.exe File created C:\windows\SysWOW64\KIZM.exe.bat GATMRF.exe File created C:\windows\SysWOW64\TDZAF.exe.bat YPV.exe File created C:\windows\SysWOW64\OYKABVN.exe VDY.exe File created C:\windows\SysWOW64\LHMTNU.exe KEIXIWP.exe File created C:\windows\SysWOW64\LHMTNU.exe.bat KEIXIWP.exe File opened for modification C:\windows\SysWOW64\LLLKKV.exe ATDZTU.exe File opened for modification C:\windows\SysWOW64\TDZAF.exe YPV.exe File created C:\windows\SysWOW64\TUTDUHS.exe BMRY.exe File created C:\windows\SysWOW64\IAFBJRE.exe SKEJCV.exe File created C:\windows\SysWOW64\ZNPSB.exe QMNN.exe File created C:\windows\SysWOW64\AHLOG.exe XZFOUY.exe File created C:\windows\SysWOW64\FLORFG.exe KYKI.exe File created C:\windows\SysWOW64\AWBJ.exe.bat FLORFG.exe File created C:\windows\SysWOW64\JUTHGZU.exe ATRU.exe File opened for modification C:\windows\SysWOW64\JUTHGZU.exe ATRU.exe File created C:\windows\SysWOW64\LLLKKV.exe ATDZTU.exe File created C:\windows\SysWOW64\HEURIY.exe BEME.exe File opened for modification C:\windows\SysWOW64\KXXD.exe JUTHGZU.exe File created C:\windows\SysWOW64\KXXD.exe.bat JUTHGZU.exe File opened for modification C:\windows\SysWOW64\TUTDUHS.exe BMRY.exe File created C:\windows\SysWOW64\EWDJL.exe.bat JJY.exe File opened for modification C:\windows\SysWOW64\OYKABVN.exe VDY.exe File opened for modification C:\windows\SysWOW64\AWBJ.exe FLORFG.exe File created C:\windows\SysWOW64\LLLKKV.exe.bat ATDZTU.exe File opened for modification C:\windows\SysWOW64\JRSASY.exe NGC.exe File created C:\windows\SysWOW64\PQFO.exe.bat CNBHT.exe File opened for modification C:\windows\SysWOW64\NKT.exe WXJRLPA.exe File created C:\windows\SysWOW64\KXXD.exe JUTHGZU.exe File created C:\windows\SysWOW64\ZTA.exe.bat RFV.exe File created C:\windows\SysWOW64\TUTDUHS.exe.bat BMRY.exe File created C:\windows\SysWOW64\IAFBJRE.exe.bat SKEJCV.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\WUJI.exe SECAJ.exe File opened for modification C:\windows\system\EZWO.exe WUJI.exe File created C:\windows\system\WKTPCU.exe.bat NJRKQ.exe File created C:\windows\system\DABHRE.exe KXXD.exe File created C:\windows\LGP.exe.bat LLLKKV.exe File opened for modification C:\windows\BDWMDVL.exe FYYPW.exe File created C:\windows\system\SBRAMEB.exe.bat AGN.exe File created C:\windows\system\SKEJCV.exe.bat YPAA.exe File created C:\windows\KGPZS.exe.bat ELQR.exe File created C:\windows\KCXLK.exe.bat ACDF.exe File opened for modification C:\windows\HDB.exe OKM.exe File created C:\windows\system\GWJX.exe AWBJ.exe File created C:\windows\QLJ.exe.bat WQERPDE.exe File created C:\windows\OKM.exe SEZMCL.exe File created C:\windows\ZGY.exe YDUGH.exe File created C:\windows\XUEZS.exe WRBV.exe File opened for modification C:\windows\WQERPDE.exe TDZAF.exe File created C:\windows\KMJB.exe.bat CZFU.exe File opened for modification C:\windows\system\QMNN.exe KMGAPIA.exe File opened for modification C:\windows\system\VCIO.exe BPDFKXX.exe File opened for modification C:\windows\LGP.exe LLLKKV.exe File created C:\windows\YNAYQT.exe EZWO.exe File created C:\windows\system\JWKWURJ.exe.bat EWDJL.exe File created C:\windows\system\KYKI.exe EXCUMEQ.exe File opened for modification C:\windows\CZFU.exe SBRAMEB.exe File created C:\windows\QGKPUPA.exe.bat IAFBJRE.exe File opened for modification C:\windows\system\ATDZTU.exe KDCAMZD.exe File opened for modification C:\windows\XCF.exe AFZM.exe File created C:\windows\EJZ.exe ABSG.exe File opened for modification C:\windows\KMJB.exe CZFU.exe File opened for modification C:\windows\QGKPUPA.exe IAFBJRE.exe File created C:\windows\system\LYIQKG.exe.bat QDDGZ.exe File opened for modification C:\windows\system\DABHRE.exe KXXD.exe File created C:\windows\system\KYKI.exe.bat EXCUMEQ.exe File opened for modification C:\windows\system\SEZMCL.exe 2026-08-04_6a4dd888c1edb8e6a481c467affd3fc8_elex_emotet_stop.exe File created C:\windows\UFH.exe.bat QPASK.exe File opened for modification C:\windows\HVLHC.exe VCIO.exe File created C:\windows\WQERPDE.exe.bat TDZAF.exe File created C:\windows\BMWWY.exe JRSASY.exe File created C:\windows\AFZM.exe.bat BMWWY.exe File opened for modification C:\windows\WUJI.exe SECAJ.exe File opened for modification C:\windows\FYYPW.exe KKT.exe File created C:\windows\CZFU.exe.bat SBRAMEB.exe File created C:\windows\VAUBIH.exe.bat NKT.exe File opened for modification C:\windows\VDY.exe VAUBIH.exe File opened for modification C:\windows\system\ZULHGB.exe KZT.exe File opened for modification C:\windows\QLJ.exe WQERPDE.exe File created C:\windows\OKM.exe.bat SEZMCL.exe File created C:\windows\HDB.exe OKM.exe File created C:\windows\GUNFZT.exe.bat VCKNR.exe File created C:\windows\BDWMDVL.exe.bat FYYPW.exe File created C:\windows\system\JJY.exe DNZYWUD.exe File created C:\windows\WXJRLPA.exe BJEAJ.exe File created C:\windows\VDY.exe VAUBIH.exe File created C:\windows\RFV.exe.bat NXHTGN.exe File created C:\windows\system\SEZMCL.exe 2026-08-04_6a4dd888c1edb8e6a481c467affd3fc8_elex_emotet_stop.exe File created C:\windows\UFH.exe QPASK.exe File created C:\windows\system\EZWO.exe WUJI.exe File created C:\windows\system\WKTPCU.exe NJRKQ.exe File created C:\windows\KKT.exe GUNFZT.exe File created C:\windows\system\QDDGZ.exe.bat HDB.exe File opened for modification C:\windows\ATRU.exe LYIQKG.exe File created C:\windows\system\YDUGH.exe FAJ.exe File opened for modification C:\windows\YPV.exe TPNDMB.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3428 cmd.exe 4300 cmd.exe 2448 cmd.exe 1988 cmd.exe 4976 cmd.exe 1720 cmd.exe 5324 cmd.exe 2544 cmd.exe 2724 cmd.exe 6132 cmd.exe 4648 cmd.exe 4080 cmd.exe 4384 cmd.exe 6108 cmd.exe 1200 cmd.exe 4176 cmd.exe 5128 cmd.exe 1604 cmd.exe 3664 cmd.exe 4928 cmd.exe 2740 cmd.exe 2088 cmd.exe 4828 cmd.exe 816 cmd.exe 1644 cmd.exe 880 cmd.exe 5000 cmd.exe 2388 cmd.exe 4268 cmd.exe 1812 cmd.exe 3648 cmd.exe 5592 cmd.exe 5740 cmd.exe 4860 cmd.exe 4472 cmd.exe 2036 cmd.exe 3252 cmd.exe 3472 cmd.exe 1300 cmd.exe 1408 cmd.exe 1708 cmd.exe 4260 cmd.exe 4388 cmd.exe 5624 cmd.exe 3160 cmd.exe 5032 cmd.exe 3260 cmd.exe 1280 cmd.exe 3516 cmd.exe 4588 cmd.exe 1436 cmd.exe 5420 cmd.exe 5180 cmd.exe 1040 cmd.exe 5724 cmd.exe 1808 cmd.exe 4312 cmd.exe 4856 cmd.exe 3012 cmd.exe 5396 cmd.exe 2136 cmd.exe 1156 cmd.exe 1788 cmd.exe 6036 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 4536 4820 WerFault.exe 87 4608 4464 WerFault.exe 93 5624 5716 WerFault.exe 99 4892 296 WerFault.exe 104 4628 4672 WerFault.exe 109 1532 1908 WerFault.exe 114 5928 2120 WerFault.exe 119 1144 1312 WerFault.exe 124 5856 1548 WerFault.exe 129 3620 4452 WerFault.exe 134 5964 3468 WerFault.exe 139 1540 4772 WerFault.exe 144 4708 5712 WerFault.exe 149 4640 4088 WerFault.exe 154 4596 5384 WerFault.exe 159 1296 1716 WerFault.exe 164 4384 4628 WerFault.exe 169 4516 3656 WerFault.exe 174 1200 3120 WerFault.exe 179 4128 2664 WerFault.exe 184 5668 3652 WerFault.exe 189 1944 5076 WerFault.exe 194 1180 4768 WerFault.exe 199 5880 4200 WerFault.exe 204 5548 5924 WerFault.exe 209 4424 4496 WerFault.exe 214 5080 3336 WerFault.exe 219 3252 4048 WerFault.exe 224 4268 2860 WerFault.exe 229 4916 4736 WerFault.exe 234 5784 4604 WerFault.exe 239 4312 3296 WerFault.exe 244 4176 3916 WerFault.exe 249 5004 4380 WerFault.exe 254 6064 2884 WerFault.exe 259 4204 4456 WerFault.exe 264 2056 5548 WerFault.exe 269 3900 4560 WerFault.exe 275 788 5044 WerFault.exe 280 6140 5036 WerFault.exe 285 4612 3500 WerFault.exe 290 1272 2980 WerFault.exe 295 2768 1160 WerFault.exe 300 2428 4228 WerFault.exe 305 1540 1088 WerFault.exe 310 2208 4924 WerFault.exe 315 2056 5916 WerFault.exe 320 3900 2600 WerFault.exe 325 1844 1516 WerFault.exe 330 3256 5520 WerFault.exe 335 4508 6028 WerFault.exe 340 1200 4376 WerFault.exe 345 4568 5084 WerFault.exe 350 2824 1564 WerFault.exe 355 1740 4840 WerFault.exe 360 5620 2244 WerFault.exe 364 2552 2296 WerFault.exe 370 3312 3248 WerFault.exe 375 3940 5704 WerFault.exe 380 3420 5132 WerFault.exe 385 5784 4612 WerFault.exe 390 4052 1144 WerFault.exe 395 5488 4064 WerFault.exe 400 4708 2992 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SEZMCL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QLJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XZFOUY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BEME.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ATRU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WQERPDE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GATMRF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ABSG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VAUBIH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LHMTNU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZTA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IAFBJRE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEAU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WLMYJA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RFV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QPASK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NGC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OYKABVN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GUNFZT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LGP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KJH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KYKI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CNBHT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QDDGZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SEYCBY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZGY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KZT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VCKNR.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4820 2026-08-04_6a4dd888c1edb8e6a481c467affd3fc8_elex_emotet_stop.exe 4820 2026-08-04_6a4dd888c1edb8e6a481c467affd3fc8_elex_emotet_stop.exe 4464 SEZMCL.exe 4464 SEZMCL.exe 5716 OKM.exe 5716 OKM.exe 296 HDB.exe 296 HDB.exe 4672 QDDGZ.exe 4672 QDDGZ.exe 1908 LYIQKG.exe 1908 LYIQKG.exe 2120 ATRU.exe 2120 ATRU.exe 1312 JUTHGZU.exe 1312 JUTHGZU.exe 1548 KXXD.exe 1548 KXXD.exe 4452 DABHRE.exe 4452 DABHRE.exe 3468 NXHTGN.exe 3468 NXHTGN.exe 4772 RFV.exe 4772 RFV.exe 5712 ZTA.exe 5712 ZTA.exe 4088 DBGII.exe 4088 DBGII.exe 5384 BMRY.exe 5384 BMRY.exe 1716 TUTDUHS.exe 1716 TUTDUHS.exe 4628 RKFGPN.exe 4628 RKFGPN.exe 3656 GAGFNIP.exe 3656 GAGFNIP.exe 3120 QIIKZG.exe 3120 QIIKZG.exe 2664 AGN.exe 2664 AGN.exe 3652 SBRAMEB.exe 3652 SBRAMEB.exe 5076 CZFU.exe 5076 CZFU.exe 4768 KMJB.exe 4768 KMJB.exe 4200 YPAA.exe 4200 YPAA.exe 5924 SKEJCV.exe 5924 SKEJCV.exe 4496 IAFBJRE.exe 4496 IAFBJRE.exe 3336 QGKPUPA.exe 3336 QGKPUPA.exe 4048 SEYCBY.exe 4048 SEYCBY.exe 2860 QPASK.exe 2860 QPASK.exe 4736 UFH.exe 4736 UFH.exe 4604 QHYQKZ.exe 4604 QHYQKZ.exe 3296 KDCAMZD.exe 3296 KDCAMZD.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4820 2026-08-04_6a4dd888c1edb8e6a481c467affd3fc8_elex_emotet_stop.exe 4820 2026-08-04_6a4dd888c1edb8e6a481c467affd3fc8_elex_emotet_stop.exe 4464 SEZMCL.exe 4464 SEZMCL.exe 5716 OKM.exe 5716 OKM.exe 296 HDB.exe 296 HDB.exe 4672 QDDGZ.exe 4672 QDDGZ.exe 1908 LYIQKG.exe 1908 LYIQKG.exe 2120 ATRU.exe 2120 ATRU.exe 1312 JUTHGZU.exe 1312 JUTHGZU.exe 1548 KXXD.exe 1548 KXXD.exe 4452 DABHRE.exe 4452 DABHRE.exe 3468 NXHTGN.exe 3468 NXHTGN.exe 4772 RFV.exe 4772 RFV.exe 5712 ZTA.exe 5712 ZTA.exe 4088 DBGII.exe 4088 DBGII.exe 5384 BMRY.exe 5384 BMRY.exe 1716 TUTDUHS.exe 1716 TUTDUHS.exe 4628 RKFGPN.exe 4628 RKFGPN.exe 3656 GAGFNIP.exe 3656 GAGFNIP.exe 3120 QIIKZG.exe 3120 QIIKZG.exe 2664 AGN.exe 2664 AGN.exe 3652 SBRAMEB.exe 3652 SBRAMEB.exe 5076 CZFU.exe 5076 CZFU.exe 4768 KMJB.exe 4768 KMJB.exe 4200 YPAA.exe 4200 YPAA.exe 5924 SKEJCV.exe 5924 SKEJCV.exe 4496 IAFBJRE.exe 4496 IAFBJRE.exe 3336 QGKPUPA.exe 3336 QGKPUPA.exe 4048 SEYCBY.exe 4048 SEYCBY.exe 2860 QPASK.exe 2860 QPASK.exe 4736 UFH.exe 4736 UFH.exe 4604 QHYQKZ.exe 4604 QHYQKZ.exe 3296 KDCAMZD.exe 3296 KDCAMZD.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4820 wrote to memory of 4092 4820 2026-08-04_6a4dd888c1edb8e6a481c467affd3fc8_elex_emotet_stop.exe 89 PID 4092 wrote to memory of 4464 4092 cmd.exe 93 PID 4464 wrote to memory of 1500 4464 SEZMCL.exe 95 PID 1500 wrote to memory of 5716 1500 cmd.exe 99 PID 5716 wrote to memory of 3308 5716 OKM.exe 100 PID 3308 wrote to memory of 296 3308 cmd.exe 104 PID 296 wrote to memory of 5724 296 HDB.exe 105 PID 5724 wrote to memory of 4672 5724 cmd.exe 109 PID 4672 wrote to memory of 2812 4672 QDDGZ.exe 110 PID 2812 wrote to memory of 1908 2812 cmd.exe 114 PID 1908 wrote to memory of 4260 1908 LYIQKG.exe 115 PID 4260 wrote to memory of 2120 4260 cmd.exe 119 PID 2120 wrote to memory of 552 2120 ATRU.exe 120 PID 552 wrote to memory of 1312 552 cmd.exe 124 PID 1312 wrote to memory of 2740 1312 JUTHGZU.exe 125 PID 2740 wrote to memory of 1548 2740 cmd.exe 129 PID 1548 wrote to memory of 996 1548 KXXD.exe 130 PID 996 wrote to memory of 4452 996 cmd.exe 134 PID 4452 wrote to memory of 5888 4452 DABHRE.exe 135 PID 5888 wrote to memory of 3468 5888 cmd.exe 139 PID 3468 wrote to memory of 4420 3468 NXHTGN.exe 140 PID 4420 wrote to memory of 4772 4420 cmd.exe 144 PID 4772 wrote to memory of 4588 4772 RFV.exe 145 PID 4588 wrote to memory of 5712 4588 cmd.exe 149 PID 5712 wrote to memory of 4132 5712 ZTA.exe 150 PID 4132 wrote to memory of 4088 4132 cmd.exe 154 PID 4088 wrote to memory of 5396 4088 DBGII.exe 155 PID 5396 wrote to memory of 5384 5396 cmd.exe 159 PID 5384 wrote to memory of 3432 5384 BMRY.exe 160 PID 3432 wrote to memory of 1716 3432 cmd.exe 164 PID 1716 wrote to memory of 2404 1716 TUTDUHS.exe 165 PID 2404 wrote to memory of 4628 2404 cmd.exe 169 PID 4628 wrote to memory of 3400 4628 RKFGPN.exe 170 PID 3400 wrote to memory of 3656 3400 cmd.exe 174 PID 3656 wrote to memory of 2292 3656 GAGFNIP.exe 175 PID 2292 wrote to memory of 3120 2292 cmd.exe 179 PID 3120 wrote to memory of 2784 3120 QIIKZG.exe 180 PID 2784 wrote to memory of 2664 2784 cmd.exe 184 PID 2664 wrote to memory of 4572 2664 AGN.exe 185 PID 4572 wrote to memory of 3652 4572 cmd.exe 189 PID 3652 wrote to memory of 6008 3652 SBRAMEB.exe 190 PID 6008 wrote to memory of 5076 6008 cmd.exe 194 PID 5076 wrote to memory of 1436 5076 CZFU.exe 195 PID 1436 wrote to memory of 4768 1436 cmd.exe 199 PID 4768 wrote to memory of 2764 4768 KMJB.exe 200 PID 2764 wrote to memory of 4200 2764 cmd.exe 204 PID 4200 wrote to memory of 4172 4200 YPAA.exe 205 PID 4172 wrote to memory of 5924 4172 cmd.exe 209 PID 5924 wrote to memory of 3392 5924 SKEJCV.exe 210 PID 3392 wrote to memory of 4496 3392 cmd.exe 214 PID 4496 wrote to memory of 2136 4496 IAFBJRE.exe 215 PID 2136 wrote to memory of 3336 2136 cmd.exe 219 PID 3336 wrote to memory of 4248 3336 QGKPUPA.exe 220 PID 4248 wrote to memory of 4048 4248 cmd.exe 224 PID 4048 wrote to memory of 4080 4048 SEYCBY.exe 225 PID 4080 wrote to memory of 2860 4080 cmd.exe 229 PID 2860 wrote to memory of 2544 2860 QPASK.exe 230 PID 2544 wrote to memory of 4736 2544 cmd.exe 234 PID 4736 wrote to memory of 5420 4736 UFH.exe 235 PID 5420 wrote to memory of 4604 5420 cmd.exe 239 PID 4604 wrote to memory of 1080 4604 QHYQKZ.exe 240 PID 1080 wrote to memory of 3296 1080 cmd.exe 244 PID 3296 wrote to memory of 4472 3296 KDCAMZD.exe 245 PID 4472 wrote to memory of 3916 4472 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_6a4dd888c1edb8e6a481c467affd3fc8_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_6a4dd888c1edb8e6a481c467affd3fc8_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SEZMCL.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\windows\system\SEZMCL.exeC:\windows\system\SEZMCL.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OKM.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\windows\OKM.exeC:\windows\OKM.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HDB.exe.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\windows\HDB.exeC:\windows\HDB.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QDDGZ.exe.bat" "8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5724 -
C:\windows\system\QDDGZ.exeC:\windows\system\QDDGZ.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LYIQKG.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\windows\system\LYIQKG.exeC:\windows\system\LYIQKG.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ATRU.exe.bat" "12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\windows\ATRU.exeC:\windows\ATRU.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JUTHGZU.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:552 -
C:\windows\SysWOW64\JUTHGZU.exeC:\windows\system32\JUTHGZU.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KXXD.exe.bat" "16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\windows\SysWOW64\KXXD.exeC:\windows\system32\KXXD.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DABHRE.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:996 -
C:\windows\system\DABHRE.exeC:\windows\system\DABHRE.exe19⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NXHTGN.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:5888 -
C:\windows\system\NXHTGN.exeC:\windows\system\NXHTGN.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RFV.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\windows\RFV.exeC:\windows\RFV.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZTA.exe.bat" "24⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\windows\SysWOW64\ZTA.exeC:\windows\system32\ZTA.exe25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DBGII.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\windows\system\DBGII.exeC:\windows\system\DBGII.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BMRY.exe.bat" "28⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5396 -
C:\windows\SysWOW64\BMRY.exeC:\windows\system32\BMRY.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TUTDUHS.exe.bat" "30⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\windows\SysWOW64\TUTDUHS.exeC:\windows\system32\TUTDUHS.exe31⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RKFGPN.exe.bat" "32⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\windows\RKFGPN.exeC:\windows\RKFGPN.exe33⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GAGFNIP.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\windows\GAGFNIP.exeC:\windows\GAGFNIP.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QIIKZG.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\windows\SysWOW64\QIIKZG.exeC:\windows\system32\QIIKZG.exe37⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AGN.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\windows\system\AGN.exeC:\windows\system\AGN.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SBRAMEB.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\windows\system\SBRAMEB.exeC:\windows\system\SBRAMEB.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CZFU.exe.bat" "42⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6008 -
C:\windows\CZFU.exeC:\windows\CZFU.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KMJB.exe.bat" "44⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\windows\KMJB.exeC:\windows\KMJB.exe45⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YPAA.exe.bat" "46⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\windows\system\YPAA.exeC:\windows\system\YPAA.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SKEJCV.exe.bat" "48⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\windows\system\SKEJCV.exeC:\windows\system\SKEJCV.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IAFBJRE.exe.bat" "50⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\windows\SysWOW64\IAFBJRE.exeC:\windows\system32\IAFBJRE.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QGKPUPA.exe.bat" "52⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\windows\QGKPUPA.exeC:\windows\QGKPUPA.exe53⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SEYCBY.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\windows\system\SEYCBY.exeC:\windows\system\SEYCBY.exe55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QPASK.exe.bat" "56⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\windows\system\QPASK.exeC:\windows\system\QPASK.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UFH.exe.bat" "58⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\windows\UFH.exeC:\windows\UFH.exe59⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QHYQKZ.exe.bat" "60⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5420 -
C:\windows\SysWOW64\QHYQKZ.exeC:\windows\system32\QHYQKZ.exe61⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KDCAMZD.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\windows\KDCAMZD.exeC:\windows\KDCAMZD.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ATDZTU.exe.bat" "64⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\windows\system\ATDZTU.exeC:\windows\system\ATDZTU.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LLLKKV.exe.bat" "66⤵PID:4740
-
C:\windows\SysWOW64\LLLKKV.exeC:\windows\system32\LLLKKV.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LGP.exe.bat" "68⤵
- Executes a command shell one-liner
PID:2036 -
C:\windows\LGP.exeC:\windows\LGP.exe69⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RHWBZ.exe.bat" "70⤵
- System Location Discovery: System Language Discovery
PID:5796 -
C:\windows\system\RHWBZ.exeC:\windows\system\RHWBZ.exe71⤵
- Executes dropped EXE
PID:4456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MCBLJNZ.exe.bat" "72⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1808 -
C:\windows\system\MCBLJNZ.exeC:\windows\system\MCBLJNZ.exe73⤵
- Executes dropped EXE
PID:5548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FXFH.exe.bat" "74⤵
- System Location Discovery: System Language Discovery
PID:5892 -
C:\windows\FXFH.exeC:\windows\FXFH.exe75⤵
- Executes dropped EXE
PID:4560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FAJ.exe.bat" "76⤵
- Executes a command shell one-liner
PID:4388 -
C:\windows\system\FAJ.exeC:\windows\system\FAJ.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YDUGH.exe.bat" "78⤵
- Executes a command shell one-liner
PID:3252 -
C:\windows\system\YDUGH.exeC:\windows\system\YDUGH.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5036 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZGY.exe.bat" "80⤵
- System Location Discovery: System Language Discovery
PID:1532 -
C:\windows\ZGY.exeC:\windows\ZGY.exe81⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KZT.exe.bat" "82⤵
- System Location Discovery: System Language Discovery
PID:3452 -
C:\windows\system\KZT.exeC:\windows\system\KZT.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZULHGB.exe.bat" "84⤵
- System Location Discovery: System Language Discovery
PID:5428 -
C:\windows\system\ZULHGB.exeC:\windows\system\ZULHGB.exe85⤵
- Executes dropped EXE
PID:1160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KMGAPIA.exe.bat" "86⤵PID:4276
-
C:\windows\KMGAPIA.exeC:\windows\KMGAPIA.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4228 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QMNN.exe.bat" "88⤵
- System Location Discovery: System Language Discovery
PID:5136 -
C:\windows\system\QMNN.exeC:\windows\system\QMNN.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZNPSB.exe.bat" "90⤵PID:2640
-
C:\windows\SysWOW64\ZNPSB.exeC:\windows\system32\ZNPSB.exe91⤵
- Executes dropped EXE
PID:4924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UAUCLIS.exe.bat" "92⤵
- Executes a command shell one-liner
PID:5624 -
C:\windows\system\UAUCLIS.exeC:\windows\system\UAUCLIS.exe93⤵
- Executes dropped EXE
PID:5916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VDYGRY.exe.bat" "94⤵PID:4608
-
C:\windows\VDYGRY.exeC:\windows\VDYGRY.exe95⤵
- Executes dropped EXE
PID:2600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NGC.exe.bat" "96⤵PID:5356
-
C:\windows\NGC.exeC:\windows\NGC.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JRSASY.exe.bat" "98⤵
- System Location Discovery: System Language Discovery
PID:5872 -
C:\windows\SysWOW64\JRSASY.exeC:\windows\system32\JRSASY.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BMWWY.exe.bat" "100⤵
- Executes a command shell one-liner
PID:3160 -
C:\windows\BMWWY.exeC:\windows\BMWWY.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6028 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AFZM.exe.bat" "102⤵
- Executes a command shell one-liner
PID:5032 -
C:\windows\AFZM.exeC:\windows\AFZM.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XCF.exe.bat" "104⤵
- System Location Discovery: System Language Discovery
PID:5012 -
C:\windows\XCF.exeC:\windows\XCF.exe105⤵
- Executes dropped EXE
PID:5084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CNBHT.exe.bat" "106⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2088 -
C:\windows\CNBHT.exeC:\windows\CNBHT.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PQFO.exe.bat" "108⤵PID:3404
-
C:\windows\SysWOW64\PQFO.exeC:\windows\system32\PQFO.exe109⤵
- Executes dropped EXE
PID:4840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AJAGG.exe.bat" "110⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5324 -
C:\windows\AJAGG.exeC:\windows\AJAGG.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PMR.exe.bat" "112⤵PID:2128
-
C:\windows\SysWOW64\PMR.exeC:\windows\system32\PMR.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BEME.exe.bat" "114⤵PID:5556
-
C:\windows\SysWOW64\BEME.exeC:\windows\system32\BEME.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HEURIY.exe.bat" "116⤵PID:1652
-
C:\windows\SysWOW64\HEURIY.exeC:\windows\system32\HEURIY.exe117⤵
- Executes dropped EXE
PID:5704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JUVLP.exe.bat" "118⤵
- Executes a command shell one-liner
PID:1156 -
C:\windows\JUVLP.exeC:\windows\JUVLP.exe119⤵
- Executes dropped EXE
PID:5132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WFDKD.exe.bat" "120⤵PID:5920
-
C:\windows\WFDKD.exeC:\windows\WFDKD.exe121⤵
- Executes dropped EXE
PID:4612
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-