Analysis
- max time kernel
88s - max time network
134s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
05/08/2026, 15:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-05_71c32bd22c483c2e3f5a65527acdffa4_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-05_71c32bd22c483c2e3f5a65527acdffa4_elex_emotet_stop.exe
- Size 208KB
- Sample260805-talg4abp6v
- SHA256 37b64dbe2627f1ad2b940eec9e4392a2383ff18923a41673a635f5e80a34114c
- MD5 71c32bd22c483c2e3f5a65527acdffa4
- SHA1 357fcefe8bf3a6056314ccf0476d436a937e730c
- SHA512 f8df7e00e9248467b46831c74ecb58891db7dc93a632fa93be93f1ac9036f60e0db7d51e7ae1988dc4bc375d1c56c4f6650e09dfbd77901bc2645457018557c4
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbclcdL+LOfI4NLthEjQT6E:MlZtbLWIgd1LZ9oECZbclc5+LOgQEj6
- TLSH T186247D2235D2C073E4B7023188F6C7787BB6BD919B36928B7BC03B4D6E315A68A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5852 YSZXY.exe 3788 LNDXRDB.exe 6088 BDEXP.exe 1456 XJXM.exe 1556 DEWNKW.exe 5644 HMCV.exe 1260 JKI.exe 3728 IVLXN.exe 5268 DIQHXDI.exe 2504 SLHTI.exe 5492 SGLP.exe 1020 IWMOUBO.exe 1328 AZQK.exe 256 WKYIOCL.exe 2096 YIMDDKU.exe 3776 WTPTMQ.exe 3236 CTWGVS.exe 1420 VWACA.exe 6004 MWCHEG.exe 3208 HKH.exe 4448 BFMIY.exe 4156 FNSIKYU.exe 5600 XVUNO.exe 2744 BDB.exe 3196 VRGF.exe 4124 LHH.exe 6080 ACQI.exe 2796 HSRABRM.exe 5048 IVVDOH.exe 3732 ZIFVEEJ.exe 3096 GYGND.exe 4168 BLLWNZN.exe 5008 NBAE.exe 5336 HPXOJR.exe 5044 RPZTNPA.exe 1492 VFNBZ.exe 4760 QIWRN.exe 2728 KDABQKY.exe 3772 DYE.exe 5020 CRHVENV.exe 2256 GZOVQ.exe 5348 XHQABD.exe 3464 BPWIGW.exe 5764 KYYNRTK.exe 4872 JIJDSH.exe 400 CBRO.exe 5052 GJX.exe 1216 YRZTZ.exe 5632 APNN.exe 2400 RPPSK.exe 6028 MLUKUDM.exe 2956 GYQT.exe 5612 BLVDPD.exe 4252 OWMB.exe 1308 DMNTBBZ.exe 5140 RPVRQ.exe 3560 TKABAMJ.exe 2804 KVDRJS.exe 4904 LYP.exe 5032 EQW.exe 3620 MWJEIHL.exe 1640 XOQ.exe 4932 DKPYE.exe 2868 QVG.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\BLLWNZN.exe GYGND.exe File opened for modification C:\windows\SysWOW64\BLVDPD.exe GYQT.exe File created C:\windows\SysWOW64\CBRO.exe.bat JIJDSH.exe File created C:\windows\SysWOW64\ELQR.exe.bat HNYB.exe File created C:\windows\SysWOW64\TMQATEX.exe.bat EWPJ.exe File created C:\windows\SysWOW64\AZQK.exe IWMOUBO.exe File created C:\windows\SysWOW64\HSRABRM.exe ACQI.exe File created C:\windows\SysWOW64\JIJDSH.exe KYYNRTK.exe File created C:\windows\SysWOW64\XNRLN.exe TFK.exe File created C:\windows\SysWOW64\XJXM.exe BDEXP.exe File opened for modification C:\windows\SysWOW64\KYYNRTK.exe BPWIGW.exe File opened for modification C:\windows\SysWOW64\YAK.exe QVG.exe File created C:\windows\SysWOW64\HPXOJR.exe NBAE.exe File created C:\windows\SysWOW64\VFNBZ.exe RPZTNPA.exe File created C:\windows\SysWOW64\NKPLUHV.exe JUIDH.exe File created C:\windows\SysWOW64\YXRGR.exe OXPTODQ.exe File opened for modification C:\windows\SysWOW64\RPZTNPA.exe HPXOJR.exe File created C:\windows\SysWOW64\VFNBZ.exe.bat RPZTNPA.exe File created C:\windows\SysWOW64\MLUKUDM.exe.bat RPPSK.exe File created C:\windows\SysWOW64\KVDRJS.exe TKABAMJ.exe File created C:\windows\SysWOW64\WRUEHMC.exe UEQVX.exe File opened for modification C:\windows\SysWOW64\WRUEHMC.exe UEQVX.exe File opened for modification C:\windows\SysWOW64\BDEXP.exe LNDXRDB.exe File opened for modification C:\windows\SysWOW64\VWACA.exe CTWGVS.exe File created C:\windows\SysWOW64\DDTHWK.exe ELQR.exe File opened for modification C:\windows\SysWOW64\NKPLUHV.exe JUIDH.exe File created C:\windows\SysWOW64\BDEXP.exe.bat LNDXRDB.exe File opened for modification C:\windows\SysWOW64\IVLXN.exe JKI.exe File created C:\windows\SysWOW64\RPPSK.exe APNN.exe File opened for modification C:\windows\SysWOW64\MHYQV.exe GMMXIB.exe File created C:\windows\SysWOW64\MOPW.exe.bat EACP.exe File created C:\windows\SysWOW64\IWMOUBO.exe.bat SGLP.exe File opened for modification C:\windows\SysWOW64\ACQI.exe LHH.exe File created C:\windows\SysWOW64\IVLXN.exe JKI.exe File opened for modification C:\windows\SysWOW64\DIQHXDI.exe IVLXN.exe File created C:\windows\SysWOW64\KNXGDTO.exe.bat YXRGR.exe File opened for modification C:\windows\SysWOW64\XNRLN.exe TFK.exe File opened for modification C:\windows\SysWOW64\TMQATEX.exe EWPJ.exe File created C:\windows\SysWOW64\CBRO.exe JIJDSH.exe File created C:\windows\SysWOW64\KMEXOVS.exe.bat PYZFM.exe File created C:\windows\SysWOW64\YXRGR.exe.bat OXPTODQ.exe File created C:\windows\SysWOW64\ZIFVEEJ.exe IVVDOH.exe File created C:\windows\SysWOW64\KYYNRTK.exe.bat BPWIGW.exe File opened for modification C:\windows\SysWOW64\ELQR.exe HNYB.exe File opened for modification C:\windows\SysWOW64\KNXGDTO.exe YXRGR.exe File created C:\windows\SysWOW64\XNRLN.exe.bat TFK.exe File created C:\windows\SysWOW64\LHH.exe.bat VRGF.exe File opened for modification C:\windows\SysWOW64\CBRO.exe JIJDSH.exe File created C:\windows\SysWOW64\KVDRJS.exe.bat TKABAMJ.exe File created C:\windows\SysWOW64\KMEXOVS.exe PYZFM.exe File created C:\windows\SysWOW64\QTZKGG.exe.bat HLXFV.exe File opened for modification C:\windows\SysWOW64\IWMOUBO.exe SGLP.exe File opened for modification C:\windows\SysWOW64\ZIFVEEJ.exe IVVDOH.exe File opened for modification C:\windows\SysWOW64\VFNBZ.exe RPZTNPA.exe File created C:\windows\SysWOW64\RPPSK.exe.bat APNN.exe File created C:\windows\SysWOW64\MLUKUDM.exe RPPSK.exe File opened for modification C:\windows\SysWOW64\DDTHWK.exe ELQR.exe File created C:\windows\SysWOW64\NKPLUHV.exe.bat JUIDH.exe File created C:\windows\SysWOW64\XJXM.exe.bat BDEXP.exe File created C:\windows\SysWOW64\IVLXN.exe.bat JKI.exe File opened for modification C:\windows\SysWOW64\HSRABRM.exe ACQI.exe File opened for modification C:\windows\SysWOW64\JIJDSH.exe KYYNRTK.exe File created C:\windows\SysWOW64\BDB.exe.bat XVUNO.exe File created C:\windows\SysWOW64\ACQI.exe LHH.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\system\XVUNO.exe FNSIKYU.exe File created C:\windows\NBAE.exe.bat BLLWNZN.exe File created C:\windows\EQW.exe.bat LYP.exe File created C:\windows\XOQ.exe MWJEIHL.exe File opened for modification C:\windows\system\EACP.exe KNXGDTO.exe File created C:\windows\system\TFK.exe.bat TRKWZUL.exe File opened for modification C:\windows\EWPJ.exe QTZKGG.exe File created C:\windows\system\SLHTI.exe.bat DIQHXDI.exe File created C:\windows\system\DYE.exe.bat KDABQKY.exe File opened for modification C:\windows\EQW.exe LYP.exe File created C:\windows\GYSIP.exe FVO.exe File created C:\windows\system\ZBDL.exe GYSIP.exe File created C:\windows\system\SLHTI.exe DIQHXDI.exe File created C:\windows\system\XVUNO.exe FNSIKYU.exe File opened for modification C:\windows\system\DYE.exe KDABQKY.exe File opened for modification C:\windows\CRHVENV.exe DYE.exe File opened for modification C:\windows\system\RPVRQ.exe DMNTBBZ.exe File opened for modification C:\windows\system\LNDXRDB.exe YSZXY.exe File created C:\windows\system\HMCV.exe.bat DEWNKW.exe File created C:\windows\system\JKI.exe.bat HMCV.exe File opened for modification C:\windows\VPBSEFZ.exe NKPLUHV.exe File created C:\windows\UAEINL.exe.bat VPBSEFZ.exe File opened for modification C:\windows\DMEJS.exe WRUEHMC.exe File opened for modification C:\windows\DOXAA.exe FYMXNS.exe File created C:\windows\system\HLXFV.exe.bat XNRLN.exe File created C:\windows\HKH.exe MWCHEG.exe File created C:\windows\GYGND.exe.bat ZIFVEEJ.exe File opened for modification C:\windows\system\GZOVQ.exe CRHVENV.exe File created C:\windows\GJX.exe CBRO.exe File created C:\windows\system\DKPYE.exe.bat XOQ.exe File created C:\windows\EWPJ.exe QTZKGG.exe File opened for modification C:\windows\system\WNAQ.exe XCXIF.exe File created C:\windows\system\JZJGJLQ.exe ZBDL.exe File created C:\windows\system\YIMDDKU.exe WKYIOCL.exe File created C:\windows\MWJEIHL.exe.bat EQW.exe File opened for modification C:\windows\system\UEQVX.exe MOPW.exe File opened for modification C:\windows\system\SGLP.exe SLHTI.exe File created C:\windows\HKH.exe.bat MWCHEG.exe File created C:\windows\system\KDABQKY.exe QIWRN.exe File created C:\windows\system\BPWIGW.exe.bat XHQABD.exe File created C:\windows\XOQ.exe.bat MWJEIHL.exe File opened for modification C:\windows\RRD.exe PTP.exe File created C:\windows\system\TFK.exe TRKWZUL.exe File opened for modification C:\windows\system\JZJGJLQ.exe ZBDL.exe File created C:\windows\system\WKYIOCL.exe AZQK.exe File created C:\windows\system\GZOVQ.exe CRHVENV.exe File created C:\windows\system\JUIDH.exe STUGV.exe File created C:\windows\LIJDZPI.exe.bat WNAQ.exe File created C:\windows\system\ZBDL.exe.bat GYSIP.exe File created C:\windows\system\YIMDDKU.exe.bat WKYIOCL.exe File created C:\windows\MWCHEG.exe.bat VWACA.exe File opened for modification C:\windows\NBAE.exe BLLWNZN.exe File created C:\windows\system\OXPTODQ.exe.bat ZCFO.exe File created C:\windows\system\XKLIL.exe.bat VVG.exe File opened for modification C:\windows\VRGF.exe BDB.exe File created C:\windows\system\YRZTZ.exe GJX.exe File opened for modification C:\windows\system\YRZTZ.exe GJX.exe File created C:\windows\RRD.exe.bat PTP.exe File created C:\windows\WYKUU.exe.bat UAEINL.exe File opened for modification C:\windows\PYZFM.exe WYKUU.exe File opened for modification C:\windows\system\TFK.exe TRKWZUL.exe File created C:\windows\FVO.exe.bat LIJDZPI.exe File opened for modification C:\windows\OWMB.exe BLVDPD.exe File created C:\windows\system\RPVRQ.exe.bat DMNTBBZ.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5544 cmd.exe 4196 cmd.exe 4508 cmd.exe 4632 cmd.exe 5420 cmd.exe 5808 cmd.exe 3520 cmd.exe 1484 cmd.exe 2752 cmd.exe 4668 cmd.exe 1188 cmd.exe 4496 cmd.exe 1192 cmd.exe 3052 cmd.exe 1212 cmd.exe 1932 cmd.exe 1288 cmd.exe 4256 cmd.exe 1748 cmd.exe 5124 cmd.exe 5728 cmd.exe 3044 cmd.exe 1868 cmd.exe 4656 cmd.exe 5640 cmd.exe 956 cmd.exe 4148 cmd.exe 3164 cmd.exe 5944 cmd.exe 4696 cmd.exe 2168 cmd.exe 3220 cmd.exe 4700 cmd.exe 4416 cmd.exe 1516 cmd.exe 2424 cmd.exe 3860 cmd.exe 5456 cmd.exe 4364 cmd.exe 2320 cmd.exe 1468 cmd.exe 4268 cmd.exe 5980 cmd.exe 5188 cmd.exe 1096 cmd.exe 3984 cmd.exe 1432 cmd.exe 2824 cmd.exe 1296 cmd.exe 4204 cmd.exe 3780 cmd.exe 2300 cmd.exe 3252 cmd.exe 3528 cmd.exe 5780 cmd.exe 436 cmd.exe 5672 cmd.exe 4212 cmd.exe 2928 cmd.exe 5768 cmd.exe 1240 cmd.exe 5692 cmd.exe 5184 cmd.exe 3312 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 3984 6128 WerFault.exe 87 2432 5852 WerFault.exe 93 4124 3788 WerFault.exe 99 5472 6088 WerFault.exe 104 2408 1456 WerFault.exe 109 5824 1556 WerFault.exe 114 4120 5644 WerFault.exe 119 5996 1260 WerFault.exe 124 1364 3728 WerFault.exe 129 4276 5268 WerFault.exe 134 3060 2504 WerFault.exe 139 3692 5492 WerFault.exe 144 1072 1020 WerFault.exe 149 404 1328 WerFault.exe 154 5472 256 WerFault.exe 159 2080 2096 WerFault.exe 164 5180 3776 WerFault.exe 169 2400 3236 WerFault.exe 174 5584 1420 WerFault.exe 179 1304 6004 WerFault.exe 184 904 3208 WerFault.exe 189 1408 4448 WerFault.exe 194 5068 4156 WerFault.exe 199 4180 5600 WerFault.exe 204 1764 2744 WerFault.exe 209 5448 3196 WerFault.exe 214 1256 4124 WerFault.exe 219 3764 6080 WerFault.exe 224 2976 2796 WerFault.exe 229 1584 5048 WerFault.exe 234 5164 3732 WerFault.exe 239 4272 3096 WerFault.exe 244 5900 4168 WerFault.exe 249 5128 5008 WerFault.exe 254 5576 5336 WerFault.exe 259 5240 5044 WerFault.exe 264 5448 1492 WerFault.exe 269 2232 4760 WerFault.exe 275 4896 2728 WerFault.exe 280 3892 3772 WerFault.exe 285 2716 5020 WerFault.exe 290 3112 2256 WerFault.exe 295 1640 5348 WerFault.exe 300 5836 3464 WerFault.exe 305 4864 5764 WerFault.exe 310 4892 4872 WerFault.exe 315 1592 400 WerFault.exe 320 2508 5052 WerFault.exe 325 5748 1216 WerFault.exe 330 3364 5632 WerFault.exe 335 3188 2400 WerFault.exe 340 2704 6028 WerFault.exe 345 5228 2956 WerFault.exe 350 2144 5612 WerFault.exe 355 3328 4252 WerFault.exe 360 5024 1308 WerFault.exe 365 2328 5140 WerFault.exe 370 2932 3560 WerFault.exe 375 3976 2804 WerFault.exe 380 4516 4904 WerFault.exe 385 1052 5032 WerFault.exe 390 4660 3620 WerFault.exe 395 1600 1640 WerFault.exe 400 3704 4932 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FYMXNS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YSZXY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AZQK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ACQI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IYYPK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DIQHXDI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HSRABRM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XHQABD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WYKUU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XCXIF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KVDRJS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MWJEIHL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XKLIL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BDB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QIWRN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YRZTZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MWCHEG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XVUNO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VFNBZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BPWIGW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ELQR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JKI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YXRGR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CTWGVS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QVG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JIJDSH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZBDL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BFMIY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DMNTBBZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JUIDH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TKABAMJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 6128 2026-08-05_71c32bd22c483c2e3f5a65527acdffa4_elex_emotet_stop.exe 6128 2026-08-05_71c32bd22c483c2e3f5a65527acdffa4_elex_emotet_stop.exe 5852 YSZXY.exe 5852 YSZXY.exe 3788 LNDXRDB.exe 3788 LNDXRDB.exe 6088 BDEXP.exe 6088 BDEXP.exe 1456 XJXM.exe 1456 XJXM.exe 1556 DEWNKW.exe 1556 DEWNKW.exe 5644 HMCV.exe 5644 HMCV.exe 1260 JKI.exe 1260 JKI.exe 3728 IVLXN.exe 3728 IVLXN.exe 5268 DIQHXDI.exe 5268 DIQHXDI.exe 2504 SLHTI.exe 2504 SLHTI.exe 5492 SGLP.exe 5492 SGLP.exe 1020 IWMOUBO.exe 1020 IWMOUBO.exe 1328 AZQK.exe 1328 AZQK.exe 256 WKYIOCL.exe 256 WKYIOCL.exe 2096 YIMDDKU.exe 2096 YIMDDKU.exe 3776 WTPTMQ.exe 3776 WTPTMQ.exe 3236 CTWGVS.exe 3236 CTWGVS.exe 1420 VWACA.exe 1420 VWACA.exe 6004 MWCHEG.exe 6004 MWCHEG.exe 3208 HKH.exe 3208 HKH.exe 4448 BFMIY.exe 4448 BFMIY.exe 4156 FNSIKYU.exe 4156 FNSIKYU.exe 5600 XVUNO.exe 5600 XVUNO.exe 2744 BDB.exe 2744 BDB.exe 3196 VRGF.exe 3196 VRGF.exe 4124 LHH.exe 4124 LHH.exe 6080 ACQI.exe 6080 ACQI.exe 2796 HSRABRM.exe 2796 HSRABRM.exe 5048 IVVDOH.exe 5048 IVVDOH.exe 3732 ZIFVEEJ.exe 3732 ZIFVEEJ.exe 3096 GYGND.exe 3096 GYGND.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 6128 2026-08-05_71c32bd22c483c2e3f5a65527acdffa4_elex_emotet_stop.exe 6128 2026-08-05_71c32bd22c483c2e3f5a65527acdffa4_elex_emotet_stop.exe 5852 YSZXY.exe 5852 YSZXY.exe 3788 LNDXRDB.exe 3788 LNDXRDB.exe 6088 BDEXP.exe 6088 BDEXP.exe 1456 XJXM.exe 1456 XJXM.exe 1556 DEWNKW.exe 1556 DEWNKW.exe 5644 HMCV.exe 5644 HMCV.exe 1260 JKI.exe 1260 JKI.exe 3728 IVLXN.exe 3728 IVLXN.exe 5268 DIQHXDI.exe 5268 DIQHXDI.exe 2504 SLHTI.exe 2504 SLHTI.exe 5492 SGLP.exe 5492 SGLP.exe 1020 IWMOUBO.exe 1020 IWMOUBO.exe 1328 AZQK.exe 1328 AZQK.exe 256 WKYIOCL.exe 256 WKYIOCL.exe 2096 YIMDDKU.exe 2096 YIMDDKU.exe 3776 WTPTMQ.exe 3776 WTPTMQ.exe 3236 CTWGVS.exe 3236 CTWGVS.exe 1420 VWACA.exe 1420 VWACA.exe 6004 MWCHEG.exe 6004 MWCHEG.exe 3208 HKH.exe 3208 HKH.exe 4448 BFMIY.exe 4448 BFMIY.exe 4156 FNSIKYU.exe 4156 FNSIKYU.exe 5600 XVUNO.exe 5600 XVUNO.exe 2744 BDB.exe 2744 BDB.exe 3196 VRGF.exe 3196 VRGF.exe 4124 LHH.exe 4124 LHH.exe 6080 ACQI.exe 6080 ACQI.exe 2796 HSRABRM.exe 2796 HSRABRM.exe 5048 IVVDOH.exe 5048 IVVDOH.exe 3732 ZIFVEEJ.exe 3732 ZIFVEEJ.exe 3096 GYGND.exe 3096 GYGND.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 6128 wrote to memory of 3616 6128 2026-08-05_71c32bd22c483c2e3f5a65527acdffa4_elex_emotet_stop.exe 89 PID 3616 wrote to memory of 5852 3616 cmd.exe 93 PID 5852 wrote to memory of 3312 5852 YSZXY.exe 95 PID 3312 wrote to memory of 3788 3312 cmd.exe 99 PID 3788 wrote to memory of 1232 3788 LNDXRDB.exe 100 PID 1232 wrote to memory of 6088 1232 cmd.exe 104 PID 6088 wrote to memory of 1428 6088 BDEXP.exe 105 PID 1428 wrote to memory of 1456 1428 cmd.exe 109 PID 1456 wrote to memory of 1092 1456 XJXM.exe 110 PID 1092 wrote to memory of 1556 1092 cmd.exe 114 PID 1556 wrote to memory of 5756 1556 DEWNKW.exe 115 PID 5756 wrote to memory of 5644 5756 cmd.exe 119 PID 5644 wrote to memory of 5396 5644 HMCV.exe 120 PID 5396 wrote to memory of 1260 5396 cmd.exe 124 PID 1260 wrote to memory of 772 1260 JKI.exe 125 PID 772 wrote to memory of 3728 772 cmd.exe 129 PID 3728 wrote to memory of 2040 3728 IVLXN.exe 130 PID 2040 wrote to memory of 5268 2040 cmd.exe 134 PID 5268 wrote to memory of 4496 5268 DIQHXDI.exe 135 PID 4496 wrote to memory of 2504 4496 cmd.exe 139 PID 2504 wrote to memory of 4656 2504 SLHTI.exe 140 PID 4656 wrote to memory of 5492 4656 cmd.exe 144 PID 5492 wrote to memory of 4212 5492 SGLP.exe 145 PID 4212 wrote to memory of 1020 4212 cmd.exe 149 PID 1020 wrote to memory of 1748 1020 IWMOUBO.exe 150 PID 1748 wrote to memory of 1328 1748 cmd.exe 154 PID 1328 wrote to memory of 1192 1328 AZQK.exe 155 PID 1192 wrote to memory of 256 1192 cmd.exe 159 PID 256 wrote to memory of 880 256 WKYIOCL.exe 160 PID 880 wrote to memory of 2096 880 cmd.exe 164 PID 2096 wrote to memory of 4688 2096 YIMDDKU.exe 165 PID 4688 wrote to memory of 3776 4688 cmd.exe 169 PID 3776 wrote to memory of 1096 3776 WTPTMQ.exe 170 PID 1096 wrote to memory of 3236 1096 cmd.exe 174 PID 3236 wrote to memory of 2928 3236 CTWGVS.exe 175 PID 2928 wrote to memory of 1420 2928 cmd.exe 179 PID 1420 wrote to memory of 2112 1420 VWACA.exe 180 PID 2112 wrote to memory of 6004 2112 cmd.exe 184 PID 6004 wrote to memory of 3052 6004 MWCHEG.exe 185 PID 3052 wrote to memory of 3208 3052 cmd.exe 189 PID 3208 wrote to memory of 5640 3208 HKH.exe 190 PID 5640 wrote to memory of 4448 5640 cmd.exe 194 PID 4448 wrote to memory of 4652 4448 BFMIY.exe 195 PID 4652 wrote to memory of 4156 4652 cmd.exe 199 PID 4156 wrote to memory of 4092 4156 FNSIKYU.exe 200 PID 4092 wrote to memory of 5600 4092 cmd.exe 204 PID 5600 wrote to memory of 5124 5600 XVUNO.exe 205 PID 5124 wrote to memory of 2744 5124 cmd.exe 209 PID 2744 wrote to memory of 2952 2744 BDB.exe 210 PID 2952 wrote to memory of 3196 2952 cmd.exe 214 PID 3196 wrote to memory of 2168 3196 VRGF.exe 215 PID 2168 wrote to memory of 4124 2168 cmd.exe 219 PID 4124 wrote to memory of 2264 4124 LHH.exe 220 PID 2264 wrote to memory of 6080 2264 cmd.exe 224 PID 6080 wrote to memory of 4548 6080 ACQI.exe 225 PID 4548 wrote to memory of 2796 4548 cmd.exe 229 PID 2796 wrote to memory of 5156 2796 HSRABRM.exe 230 PID 5156 wrote to memory of 5048 5156 cmd.exe 234 PID 5048 wrote to memory of 3220 5048 IVVDOH.exe 235 PID 3220 wrote to memory of 3732 3220 cmd.exe 239 PID 3732 wrote to memory of 2864 3732 ZIFVEEJ.exe 240 PID 2864 wrote to memory of 3096 2864 cmd.exe 244 PID 3096 wrote to memory of 4744 3096 GYGND.exe 245 PID 4744 wrote to memory of 4168 4744 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-05_71c32bd22c483c2e3f5a65527acdffa4_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-05_71c32bd22c483c2e3f5a65527acdffa4_elex_emotet_stop.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YSZXY.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:3616 -
C:\windows\YSZXY.exeC:\windows\YSZXY.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LNDXRDB.exe.bat" "4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\windows\system\LNDXRDB.exeC:\windows\system\LNDXRDB.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BDEXP.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\windows\SysWOW64\BDEXP.exeC:\windows\system32\BDEXP.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XJXM.exe.bat" "8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\windows\SysWOW64\XJXM.exeC:\windows\system32\XJXM.exe9⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DEWNKW.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\windows\DEWNKW.exeC:\windows\DEWNKW.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HMCV.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:5756 -
C:\windows\system\HMCV.exeC:\windows\system\HMCV.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JKI.exe.bat" "14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5396 -
C:\windows\system\JKI.exeC:\windows\system\JKI.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IVLXN.exe.bat" "16⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:772 -
C:\windows\SysWOW64\IVLXN.exeC:\windows\system32\IVLXN.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DIQHXDI.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\windows\SysWOW64\DIQHXDI.exeC:\windows\system32\DIQHXDI.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SLHTI.exe.bat" "20⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\windows\system\SLHTI.exeC:\windows\system\SLHTI.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SGLP.exe.bat" "22⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\windows\system\SGLP.exeC:\windows\system\SGLP.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IWMOUBO.exe.bat" "24⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\windows\SysWOW64\IWMOUBO.exeC:\windows\system32\IWMOUBO.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1020 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AZQK.exe.bat" "26⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\windows\SysWOW64\AZQK.exeC:\windows\system32\AZQK.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1328 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WKYIOCL.exe.bat" "28⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\windows\system\WKYIOCL.exeC:\windows\system\WKYIOCL.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YIMDDKU.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:880 -
C:\windows\system\YIMDDKU.exeC:\windows\system\YIMDDKU.exe31⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WTPTMQ.exe.bat" "32⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\windows\WTPTMQ.exeC:\windows\WTPTMQ.exe33⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CTWGVS.exe.bat" "34⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\windows\system\CTWGVS.exeC:\windows\system\CTWGVS.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VWACA.exe.bat" "36⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\windows\SysWOW64\VWACA.exeC:\windows\system32\VWACA.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MWCHEG.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\windows\MWCHEG.exeC:\windows\MWCHEG.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HKH.exe.bat" "40⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\windows\HKH.exeC:\windows\HKH.exe41⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BFMIY.exe.bat" "42⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5640 -
C:\windows\system\BFMIY.exeC:\windows\system\BFMIY.exe43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FNSIKYU.exe.bat" "44⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\windows\FNSIKYU.exeC:\windows\FNSIKYU.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XVUNO.exe.bat" "46⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\windows\system\XVUNO.exeC:\windows\system\XVUNO.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BDB.exe.bat" "48⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5124 -
C:\windows\SysWOW64\BDB.exeC:\windows\system32\BDB.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VRGF.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\windows\VRGF.exeC:\windows\VRGF.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LHH.exe.bat" "52⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\windows\SysWOW64\LHH.exeC:\windows\system32\LHH.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ACQI.exe.bat" "54⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\windows\SysWOW64\ACQI.exeC:\windows\system32\ACQI.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HSRABRM.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\windows\SysWOW64\HSRABRM.exeC:\windows\system32\HSRABRM.exe57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IVVDOH.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:5156 -
C:\windows\system\IVVDOH.exeC:\windows\system\IVVDOH.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZIFVEEJ.exe.bat" "60⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\windows\SysWOW64\ZIFVEEJ.exeC:\windows\system32\ZIFVEEJ.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GYGND.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\windows\GYGND.exeC:\windows\GYGND.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BLLWNZN.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\windows\SysWOW64\BLLWNZN.exeC:\windows\system32\BLLWNZN.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4168 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NBAE.exe.bat" "66⤵PID:4460
-
C:\windows\NBAE.exeC:\windows\NBAE.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5008 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HPXOJR.exe.bat" "68⤵
- System Location Discovery: System Language Discovery
PID:1804 -
C:\windows\SysWOW64\HPXOJR.exeC:\windows\system32\HPXOJR.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5336 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RPZTNPA.exe.bat" "70⤵
- Executes a command shell one-liner
PID:3984 -
C:\windows\SysWOW64\RPZTNPA.exeC:\windows\system32\RPZTNPA.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VFNBZ.exe.bat" "72⤵PID:5208
-
C:\windows\SysWOW64\VFNBZ.exeC:\windows\system32\VFNBZ.exe73⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QIWRN.exe.bat" "74⤵PID:3284
-
C:\windows\system\QIWRN.exeC:\windows\system\QIWRN.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KDABQKY.exe.bat" "76⤵
- System Location Discovery: System Language Discovery
PID:1384 -
C:\windows\system\KDABQKY.exeC:\windows\system\KDABQKY.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2728 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DYE.exe.bat" "78⤵PID:5452
-
C:\windows\system\DYE.exeC:\windows\system\DYE.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3772 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CRHVENV.exe.bat" "80⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3860 -
C:\windows\CRHVENV.exeC:\windows\CRHVENV.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5020 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GZOVQ.exe.bat" "82⤵PID:5996
-
C:\windows\system\GZOVQ.exeC:\windows\system\GZOVQ.exe83⤵
- Executes dropped EXE
PID:2256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XHQABD.exe.bat" "84⤵PID:1220
-
C:\windows\XHQABD.exeC:\windows\XHQABD.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5348 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BPWIGW.exe.bat" "86⤵
- Executes a command shell one-liner
PID:5456 -
C:\windows\system\BPWIGW.exeC:\windows\system\BPWIGW.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KYYNRTK.exe.bat" "88⤵PID:5900
-
C:\windows\SysWOW64\KYYNRTK.exeC:\windows\system32\KYYNRTK.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JIJDSH.exe.bat" "90⤵PID:4884
-
C:\windows\SysWOW64\JIJDSH.exeC:\windows\system32\JIJDSH.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CBRO.exe.bat" "92⤵PID:5316
-
C:\windows\SysWOW64\CBRO.exeC:\windows\system32\CBRO.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GJX.exe.bat" "94⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3252 -
C:\windows\GJX.exeC:\windows\GJX.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YRZTZ.exe.bat" "96⤵PID:2732
-
C:\windows\system\YRZTZ.exeC:\windows\system\YRZTZ.exe97⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1216 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\APNN.exe.bat" "98⤵
- System Location Discovery: System Language Discovery
PID:2536 -
C:\windows\SysWOW64\APNN.exeC:\windows\system32\APNN.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5632 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RPPSK.exe.bat" "100⤵
- Executes a command shell one-liner
PID:5544 -
C:\windows\SysWOW64\RPPSK.exeC:\windows\system32\RPPSK.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MLUKUDM.exe.bat" "102⤵
- Executes a command shell one-liner
PID:4700 -
C:\windows\SysWOW64\MLUKUDM.exeC:\windows\system32\MLUKUDM.exe103⤵
- Executes dropped EXE
PID:6028 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GYQT.exe.bat" "104⤵PID:3864
-
C:\windows\GYQT.exeC:\windows\GYQT.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BLVDPD.exe.bat" "106⤵
- Executes a command shell one-liner
PID:4196 -
C:\windows\SysWOW64\BLVDPD.exeC:\windows\system32\BLVDPD.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OWMB.exe.bat" "108⤵PID:5836
-
C:\windows\OWMB.exeC:\windows\OWMB.exe109⤵
- Executes dropped EXE
PID:4252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DMNTBBZ.exe.bat" "110⤵
- System Location Discovery: System Language Discovery
PID:4960 -
C:\windows\DMNTBBZ.exeC:\windows\DMNTBBZ.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RPVRQ.exe.bat" "112⤵PID:204
-
C:\windows\system\RPVRQ.exeC:\windows\system\RPVRQ.exe113⤵
- Executes dropped EXE
PID:5140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TKABAMJ.exe.bat" "114⤵
- Executes a command shell one-liner
PID:1432 -
C:\windows\SysWOW64\TKABAMJ.exeC:\windows\system32\TKABAMJ.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KVDRJS.exe.bat" "116⤵PID:5624
-
C:\windows\SysWOW64\KVDRJS.exeC:\windows\system32\KVDRJS.exe117⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LYP.exe.bat" "118⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4364 -
C:\windows\LYP.exeC:\windows\LYP.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EQW.exe.bat" "120⤵PID:2656
-
C:\windows\EQW.exeC:\windows\EQW.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5032
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-