Analysis
- max time kernel
95s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
05/08/2026, 18:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-05_50a65ce723ddec593c5096193ecd7c86_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-05_50a65ce723ddec593c5096193ecd7c86_elex_emotet_stop.exe
- Size 208KB
- Sample260805-w87jbstejf
- SHA256 a696f73207d364c588e6827097140c7d9c2e0a9bb235c196da09c45b4446a668
- MD5 50a65ce723ddec593c5096193ecd7c86
- SHA1 f37fe15525683a6666eadadb5a0ab07696437af9
- SHA512 346c24447a2f084515821543f21e410a689b9979db21571a1bed42c7f2e82f90ba5566270b7d0457bdb635ccafba2af11cca92224ed66951ab4451ebba19946d
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbclcdL+LOfo4NLthEjQT6j:MlZtbLWIgd1LZ9oECZbclc5+LOgQEj1
- TLSH T150247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3196 POGHAGL.exe 2268 SWBVQ.exe 4804 QHTSCVD.exe 460 BAOLDC.exe 6032 VNT.exe 2016 FLYPCKI.exe 3312 AGDY.exe 1844 KERS.exe 5972 FRWCWS.exe 5132 DCYSF.exe 1760 KXIWY.exe 3860 LAMA.exe 920 WTPTMQ.exe 860 GTRYPOK.exe 3508 GWUU.exe 3252 DBNJ.exe 4440 EEQNQX.exe 5032 WIUIE.exe 5864 XDYMJLB.exe 5524 QGCIPB.exe 5520 KTH.exe 1352 NGLI.exe 4072 ARUZXDJ.exe 3356 JZWE.exe 400 NHDMNT.exe 704 QVH.exe 5620 XLIVWO.exe 3432 MOAZ.exe 2852 EOCES.exe 4224 NWWK.exe 5876 CRNWHYY.exe 5736 GZUW.exe 4708 XIWBX.exe 5408 QDAFKEQ.exe 1872 LYEO.exe 2136 CYGTYBP.exe 5792 LMR.exe 4208 GZOVQ.exe 1672 OFOJRL.exe 5928 BPWIGW.exe 4604 EYFWN.exe 1164 YLKGXQA.exe 2144 CBRO.exe 244 MBTTNFQ.exe 4344 WZGNU.exe 2688 QUDXEN.exe 2988 FPUB.exe 1080 CVSYEK.exe 4244 CASNGXT.exe 5892 XOXW.exe 2664 VZA.exe 5444 JJQLFO.exe 2868 OKY.exe 4760 PNCUB.exe 3148 PSUJD.exe 1644 TAJRP.exe 2452 OWGAZDH.exe 4880 TWNOIXJ.exe 5076 OJSX.exe 1812 DZTOZSU.exe 4640 JZBC.exe 2564 TADPMS.exe 1008 VVHZWSM.exe 1188 KTNW.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\JJQLFO.exe.bat VZA.exe File opened for modification C:\windows\SysWOW64\LBJG.exe WYA.exe File opened for modification C:\windows\SysWOW64\CBRO.exe YLKGXQA.exe File opened for modification C:\windows\SysWOW64\TSJZUCL.exe YWEQK.exe File created C:\windows\SysWOW64\XIWBX.exe GZUW.exe File created C:\windows\SysWOW64\OWGAZDH.exe.bat TAJRP.exe File created C:\windows\SysWOW64\LLA.exe ZTFW.exe File created C:\windows\SysWOW64\CYGTYBP.exe.bat LYEO.exe File created C:\windows\SysWOW64\WFNQ.exe.bat TSJZUCL.exe File opened for modification C:\windows\SysWOW64\ROFGS.exe FGRGFLI.exe File created C:\windows\SysWOW64\DBNJ.exe.bat GWUU.exe File opened for modification C:\windows\SysWOW64\RLQOOVI.exe NVJ.exe File created C:\windows\SysWOW64\HBX.exe EGSFNB.exe File created C:\windows\SysWOW64\WUHJYF.exe NHXRII.exe File opened for modification C:\windows\SysWOW64\DDTHWK.exe RLQOOVI.exe File opened for modification C:\windows\SysWOW64\WEDZU.exe LLA.exe File opened for modification C:\windows\SysWOW64\FGRGFLI.exe YQQG.exe File created C:\windows\SysWOW64\CYGTYBP.exe LYEO.exe File opened for modification C:\windows\SysWOW64\JJQLFO.exe VZA.exe File opened for modification C:\windows\SysWOW64\HBX.exe EGSFNB.exe File opened for modification C:\windows\SysWOW64\WUHJYF.exe NHXRII.exe File created C:\windows\SysWOW64\GWXPK.exe.bat VDUW.exe File created C:\windows\SysWOW64\CMAE.exe.bat LBJG.exe File created C:\windows\SysWOW64\LLA.exe.bat ZTFW.exe File created C:\windows\SysWOW64\WEDZU.exe.bat LLA.exe File created C:\windows\SysWOW64\BAOLDC.exe.bat QHTSCVD.exe File created C:\windows\SysWOW64\GBAUEM.exe.bat CLTM.exe File created C:\windows\SysWOW64\CMAE.exe LBJG.exe File created C:\windows\SysWOW64\QVH.exe NHDMNT.exe File created C:\windows\SysWOW64\DDTHWK.exe.bat RLQOOVI.exe File created C:\windows\SysWOW64\SFHLD.exe YKC.exe File created C:\windows\SysWOW64\YOZ.exe.bat SSANJ.exe File opened for modification C:\windows\SysWOW64\EYFWN.exe BPWIGW.exe File opened for modification C:\windows\SysWOW64\YWEQK.exe GBAUEM.exe File created C:\windows\SysWOW64\TSJZUCL.exe.bat YWEQK.exe File created C:\windows\SysWOW64\WEDZU.exe LLA.exe File created C:\windows\SysWOW64\FPUB.exe.bat QUDXEN.exe File created C:\windows\SysWOW64\OWGAZDH.exe TAJRP.exe File created C:\windows\SysWOW64\CLTM.exe.bat WLMYJA.exe File created C:\windows\SysWOW64\BAOLDC.exe QHTSCVD.exe File created C:\windows\SysWOW64\XIWBX.exe.bat GZUW.exe File opened for modification C:\windows\SysWOW64\OFOJRL.exe GZOVQ.exe File opened for modification C:\windows\SysWOW64\OWGAZDH.exe TAJRP.exe File opened for modification C:\windows\SysWOW64\NVJ.exe WUHJYF.exe File created C:\windows\SysWOW64\CBVMR.exe.bat GWXPK.exe File created C:\windows\SysWOW64\BYHPZ.exe QFE.exe File opened for modification C:\windows\SysWOW64\WFNQ.exe TSJZUCL.exe File created C:\windows\SysWOW64\FGRGFLI.exe.bat YQQG.exe File created C:\windows\SysWOW64\JZWE.exe ARUZXDJ.exe File opened for modification C:\windows\SysWOW64\MOAZ.exe XLIVWO.exe File created C:\windows\SysWOW64\RLQOOVI.exe NVJ.exe File opened for modification C:\windows\SysWOW64\VDUW.exe DYKEMY.exe File created C:\windows\SysWOW64\GWXPK.exe VDUW.exe File created C:\windows\SysWOW64\QGCIPB.exe XDYMJLB.exe File opened for modification C:\windows\SysWOW64\VZA.exe XOXW.exe File created C:\windows\SysWOW64\JJQLFO.exe VZA.exe File opened for modification C:\windows\SysWOW64\BYHPZ.exe QFE.exe File created C:\windows\SysWOW64\BYHPZ.exe.bat QFE.exe File opened for modification C:\windows\SysWOW64\CLTM.exe WLMYJA.exe File created C:\windows\SysWOW64\YWEQK.exe.bat GBAUEM.exe File opened for modification C:\windows\SysWOW64\XNRLN.exe TFK.exe File opened for modification C:\windows\SysWOW64\DBNJ.exe GWUU.exe File created C:\windows\SysWOW64\MOAZ.exe.bat XLIVWO.exe File created C:\windows\SysWOW64\OFOJRL.exe GZOVQ.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\YEKNSEC.exe SECAJ.exe File created C:\windows\WTPTMQ.exe.bat LAMA.exe File created C:\windows\USXIUCW.exe XNRLN.exe File opened for modification C:\windows\AGDY.exe FLYPCKI.exe File created C:\windows\system\LAMA.exe KXIWY.exe File opened for modification C:\windows\system\KTH.exe QGCIPB.exe File opened for modification C:\windows\XLIVWO.exe QVH.exe File opened for modification C:\windows\CVSYEK.exe FPUB.exe File created C:\windows\system\TFK.exe XZFOUY.exe File created C:\windows\system\KTH.exe.bat QGCIPB.exe File created C:\windows\system\OKY.exe JJQLFO.exe File created C:\windows\system\WZVMFLU.exe.bat HBX.exe File created C:\windows\system\UUG.exe.bat OUYFZT.exe File opened for modification C:\windows\system\BLVTP.exe QSSAH.exe File created C:\windows\TXPSRT.exe.bat QBKJ.exe File created C:\windows\system\KXIWY.exe.bat DCYSF.exe File created C:\windows\system\BGAEWZ.exe.bat DLBEZW.exe File created C:\windows\system\QBKJ.exe BGAEWZ.exe File opened for modification C:\windows\KUNFK.exe KRJBFUG.exe File opened for modification C:\windows\system\LAMA.exe KXIWY.exe File opened for modification C:\windows\PNCUB.exe OKY.exe File created C:\windows\OKADEWJ.exe WXPL.exe File created C:\windows\system\QHTSCVD.exe SWBVQ.exe File opened for modification C:\windows\system\YEKNSEC.exe SECAJ.exe File opened for modification C:\windows\YQQG.exe XNMCTAS.exe File created C:\windows\FRWCWS.exe KERS.exe File created C:\windows\system\BPWIGW.exe OFOJRL.exe File opened for modification C:\windows\TADPMS.exe JZBC.exe File opened for modification C:\windows\WTPTMQ.exe LAMA.exe File opened for modification C:\windows\GWUU.exe GTRYPOK.exe File created C:\windows\system\GZUW.exe.bat CRNWHYY.exe File created C:\windows\TAJRP.exe PSUJD.exe File created C:\windows\OJSX.exe TWNOIXJ.exe File opened for modification C:\windows\JZBC.exe DZTOZSU.exe File opened for modification C:\windows\system\DYKEMY.exe SFHLD.exe File created C:\windows\XTU.exe.bat OKADEWJ.exe File opened for modification C:\windows\system\PSUJD.exe PNCUB.exe File created C:\windows\system\XRY.exe DDTHWK.exe File created C:\windows\YFV.exe.bat KUNFK.exe File created C:\windows\system\DCYSF.exe.bat FRWCWS.exe File opened for modification C:\windows\system\NHDMNT.exe JZWE.exe File created C:\windows\system\YLKGXQA.exe.bat EYFWN.exe File created C:\windows\system\WZGNU.exe MBTTNFQ.exe File created C:\windows\system\DYKEMY.exe.bat SFHLD.exe File created C:\windows\EOCES.exe.bat MOAZ.exe File created C:\windows\system\CRNWHYY.exe.bat NWWK.exe File created C:\windows\QDAFKEQ.exe.bat XIWBX.exe File created C:\windows\WYA.exe.bat BLVTP.exe File created C:\windows\PNCUB.exe OKY.exe File created C:\windows\TXPSRT.exe QBKJ.exe File opened for modification C:\windows\XNMCTAS.exe ZXAH.exe File opened for modification C:\windows\system\FLYPCKI.exe VNT.exe File created C:\windows\GTRYPOK.exe WTPTMQ.exe File opened for modification C:\windows\system\OUYFZT.exe CBVMR.exe File opened for modification C:\windows\USXIUCW.exe XNRLN.exe File created C:\windows\CASNGXT.exe.bat CVSYEK.exe File opened for modification C:\windows\system\KTNW.exe VVHZWSM.exe File created C:\windows\QFE.exe IAM.exe File created C:\windows\KUNFK.exe KRJBFUG.exe File created C:\windows\system\VVHZWSM.exe.bat TADPMS.exe File created C:\windows\system\QBKJ.exe.bat BGAEWZ.exe File created C:\windows\PNCUB.exe.bat OKY.exe File created C:\windows\system\LMR.exe CYGTYBP.exe File opened for modification C:\windows\system\GZOVQ.exe LMR.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4480 cmd.exe 3076 cmd.exe 4644 cmd.exe 5612 cmd.exe 4828 cmd.exe 4972 cmd.exe 3080 cmd.exe 2360 cmd.exe 2276 cmd.exe 692 cmd.exe 1724 cmd.exe 4120 cmd.exe 5080 cmd.exe 4936 cmd.exe 4856 cmd.exe 3720 cmd.exe 5776 cmd.exe 4728 cmd.exe 3036 cmd.exe 4580 cmd.exe 3596 cmd.exe 5060 cmd.exe 2220 cmd.exe 4720 cmd.exe 2880 cmd.exe 1628 cmd.exe 4984 cmd.exe 124 cmd.exe 4872 cmd.exe 824 cmd.exe 5848 cmd.exe 1720 cmd.exe 1020 cmd.exe 6056 cmd.exe 3556 cmd.exe 2776 cmd.exe 1756 cmd.exe 1484 cmd.exe 4420 cmd.exe 1268 cmd.exe 3896 cmd.exe 1504 cmd.exe 3244 cmd.exe 1072 cmd.exe 5912 cmd.exe 4520 cmd.exe 3944 cmd.exe 4896 cmd.exe 820 cmd.exe 6108 cmd.exe 2720 cmd.exe 4512 cmd.exe 2444 cmd.exe 4488 cmd.exe 4540 cmd.exe 2240 cmd.exe 4864 cmd.exe 952 cmd.exe 616 cmd.exe 2696 cmd.exe 1816 cmd.exe 3816 cmd.exe 1376 cmd.exe 2884 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 2976 2420 WerFault.exe 88 5368 3196 WerFault.exe 93 4540 2268 WerFault.exe 99 2088 4804 WerFault.exe 104 4536 460 WerFault.exe 109 5128 6032 WerFault.exe 114 5912 2016 WerFault.exe 119 708 3312 WerFault.exe 124 2208 1844 WerFault.exe 129 4732 5972 WerFault.exe 134 1052 5132 WerFault.exe 139 2976 1760 WerFault.exe 144 3140 3860 WerFault.exe 149 2244 920 WerFault.exe 154 3344 860 WerFault.exe 159 5840 3508 WerFault.exe 164 4208 3252 WerFault.exe 169 1196 4440 WerFault.exe 174 2208 5032 WerFault.exe 179 1168 5864 WerFault.exe 184 2092 5524 WerFault.exe 189 4076 5520 WerFault.exe 194 2880 1352 WerFault.exe 199 2824 4072 WerFault.exe 204 3344 3356 WerFault.exe 209 5128 400 WerFault.exe 214 1256 704 WerFault.exe 219 3084 5620 WerFault.exe 224 2896 3432 WerFault.exe 229 3208 2852 WerFault.exe 234 4212 4224 WerFault.exe 239 1604 5876 WerFault.exe 244 2844 5736 WerFault.exe 249 5824 4708 WerFault.exe 254 2840 5408 WerFault.exe 259 4892 1872 WerFault.exe 264 4592 2136 WerFault.exe 268 3000 5792 WerFault.exe 274 2896 4208 WerFault.exe 280 3976 1672 WerFault.exe 285 4732 5928 WerFault.exe 290 6076 4604 WerFault.exe 295 2596 1164 WerFault.exe 300 2868 2144 WerFault.exe 305 1968 244 WerFault.exe 310 1072 4344 WerFault.exe 315 1996 2688 WerFault.exe 320 4944 2988 WerFault.exe 325 3696 1080 WerFault.exe 330 4248 4244 WerFault.exe 335 2128 5892 WerFault.exe 340 5300 2664 WerFault.exe 345 3556 5444 WerFault.exe 350 3396 2868 WerFault.exe 355 1212 4760 WerFault.exe 360 3900 3148 WerFault.exe 365 5080 1644 WerFault.exe 370 3076 2452 WerFault.exe 375 3124 4880 WerFault.exe 380 4840 5076 WerFault.exe 385 4876 1812 WerFault.exe 390 5856 4640 WerFault.exe 395 200 2564 WerFault.exe 400 3340 1008 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EEQNQX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XNMCTAS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FRWCWS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DBNJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JZWE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TAJRP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BGAEWZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CBVMR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NWWK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RLQOOVI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GBAUEM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CBRO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OWGAZDH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PNCUB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TADPMS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VDUW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TFK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LLA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ARUZXDJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WLMYJA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ROFGS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CVSYEK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KTNW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NVJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OUYFZT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TSJZUCL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WXPL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CYGTYBP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LAMA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CRNWHYY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YWEQK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WEDZU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2420 2026-08-05_50a65ce723ddec593c5096193ecd7c86_elex_emotet_stop.exe 2420 2026-08-05_50a65ce723ddec593c5096193ecd7c86_elex_emotet_stop.exe 3196 POGHAGL.exe 3196 POGHAGL.exe 2268 SWBVQ.exe 2268 SWBVQ.exe 4804 QHTSCVD.exe 4804 QHTSCVD.exe 460 BAOLDC.exe 460 BAOLDC.exe 6032 VNT.exe 6032 VNT.exe 2016 FLYPCKI.exe 2016 FLYPCKI.exe 3312 AGDY.exe 3312 AGDY.exe 1844 KERS.exe 1844 KERS.exe 5972 FRWCWS.exe 5972 FRWCWS.exe 5132 DCYSF.exe 5132 DCYSF.exe 1760 KXIWY.exe 1760 KXIWY.exe 3860 LAMA.exe 3860 LAMA.exe 920 WTPTMQ.exe 920 WTPTMQ.exe 860 GTRYPOK.exe 860 GTRYPOK.exe 3508 GWUU.exe 3508 GWUU.exe 3252 DBNJ.exe 3252 DBNJ.exe 4440 EEQNQX.exe 4440 EEQNQX.exe 5032 WIUIE.exe 5032 WIUIE.exe 5864 XDYMJLB.exe 5864 XDYMJLB.exe 5524 QGCIPB.exe 5524 QGCIPB.exe 5520 KTH.exe 5520 KTH.exe 1352 NGLI.exe 1352 NGLI.exe 4072 ARUZXDJ.exe 4072 ARUZXDJ.exe 3356 JZWE.exe 3356 JZWE.exe 400 NHDMNT.exe 400 NHDMNT.exe 704 QVH.exe 704 QVH.exe 5620 XLIVWO.exe 5620 XLIVWO.exe 3432 MOAZ.exe 3432 MOAZ.exe 2852 EOCES.exe 2852 EOCES.exe 4224 NWWK.exe 4224 NWWK.exe 5876 CRNWHYY.exe 5876 CRNWHYY.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2420 2026-08-05_50a65ce723ddec593c5096193ecd7c86_elex_emotet_stop.exe 2420 2026-08-05_50a65ce723ddec593c5096193ecd7c86_elex_emotet_stop.exe 3196 POGHAGL.exe 3196 POGHAGL.exe 2268 SWBVQ.exe 2268 SWBVQ.exe 4804 QHTSCVD.exe 4804 QHTSCVD.exe 460 BAOLDC.exe 460 BAOLDC.exe 6032 VNT.exe 6032 VNT.exe 2016 FLYPCKI.exe 2016 FLYPCKI.exe 3312 AGDY.exe 3312 AGDY.exe 1844 KERS.exe 1844 KERS.exe 5972 FRWCWS.exe 5972 FRWCWS.exe 5132 DCYSF.exe 5132 DCYSF.exe 1760 KXIWY.exe 1760 KXIWY.exe 3860 LAMA.exe 3860 LAMA.exe 920 WTPTMQ.exe 920 WTPTMQ.exe 860 GTRYPOK.exe 860 GTRYPOK.exe 3508 GWUU.exe 3508 GWUU.exe 3252 DBNJ.exe 3252 DBNJ.exe 4440 EEQNQX.exe 4440 EEQNQX.exe 5032 WIUIE.exe 5032 WIUIE.exe 5864 XDYMJLB.exe 5864 XDYMJLB.exe 5524 QGCIPB.exe 5524 QGCIPB.exe 5520 KTH.exe 5520 KTH.exe 1352 NGLI.exe 1352 NGLI.exe 4072 ARUZXDJ.exe 4072 ARUZXDJ.exe 3356 JZWE.exe 3356 JZWE.exe 400 NHDMNT.exe 400 NHDMNT.exe 704 QVH.exe 704 QVH.exe 5620 XLIVWO.exe 5620 XLIVWO.exe 3432 MOAZ.exe 3432 MOAZ.exe 2852 EOCES.exe 2852 EOCES.exe 4224 NWWK.exe 4224 NWWK.exe 5876 CRNWHYY.exe 5876 CRNWHYY.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2420 wrote to memory of 3040 2420 2026-08-05_50a65ce723ddec593c5096193ecd7c86_elex_emotet_stop.exe 89 PID 3040 wrote to memory of 3196 3040 cmd.exe 93 PID 3196 wrote to memory of 2276 3196 POGHAGL.exe 95 PID 2276 wrote to memory of 2268 2276 cmd.exe 99 PID 2268 wrote to memory of 692 2268 SWBVQ.exe 100 PID 692 wrote to memory of 4804 692 cmd.exe 104 PID 4804 wrote to memory of 1816 4804 QHTSCVD.exe 105 PID 1816 wrote to memory of 460 1816 cmd.exe 109 PID 460 wrote to memory of 1112 460 BAOLDC.exe 110 PID 1112 wrote to memory of 6032 1112 cmd.exe 114 PID 6032 wrote to memory of 2720 6032 VNT.exe 115 PID 2720 wrote to memory of 2016 2720 cmd.exe 119 PID 2016 wrote to memory of 3816 2016 FLYPCKI.exe 120 PID 3816 wrote to memory of 3312 3816 cmd.exe 124 PID 3312 wrote to memory of 4352 3312 AGDY.exe 125 PID 4352 wrote to memory of 1844 4352 cmd.exe 129 PID 1844 wrote to memory of 5848 1844 KERS.exe 130 PID 5848 wrote to memory of 5972 5848 cmd.exe 134 PID 5972 wrote to memory of 4480 5972 FRWCWS.exe 135 PID 4480 wrote to memory of 5132 4480 cmd.exe 139 PID 5132 wrote to memory of 1628 5132 DCYSF.exe 140 PID 1628 wrote to memory of 1760 1628 cmd.exe 144 PID 1760 wrote to memory of 4772 1760 KXIWY.exe 145 PID 4772 wrote to memory of 3860 4772 cmd.exe 149 PID 3860 wrote to memory of 4140 3860 LAMA.exe 150 PID 4140 wrote to memory of 920 4140 cmd.exe 154 PID 920 wrote to memory of 2696 920 WTPTMQ.exe 155 PID 2696 wrote to memory of 860 2696 cmd.exe 159 PID 860 wrote to memory of 4196 860 GTRYPOK.exe 160 PID 4196 wrote to memory of 3508 4196 cmd.exe 164 PID 3508 wrote to memory of 4984 3508 GWUU.exe 165 PID 4984 wrote to memory of 3252 4984 cmd.exe 169 PID 3252 wrote to memory of 1548 3252 DBNJ.exe 170 PID 1548 wrote to memory of 4440 1548 cmd.exe 174 PID 4440 wrote to memory of 1724 4440 EEQNQX.exe 175 PID 1724 wrote to memory of 5032 1724 cmd.exe 179 PID 5032 wrote to memory of 3044 5032 WIUIE.exe 180 PID 3044 wrote to memory of 5864 3044 cmd.exe 184 PID 5864 wrote to memory of 6124 5864 XDYMJLB.exe 185 PID 6124 wrote to memory of 5524 6124 cmd.exe 189 PID 5524 wrote to memory of 1820 5524 QGCIPB.exe 190 PID 1820 wrote to memory of 5520 1820 cmd.exe 194 PID 5520 wrote to memory of 2004 5520 KTH.exe 195 PID 2004 wrote to memory of 1352 2004 cmd.exe 199 PID 1352 wrote to memory of 4936 1352 NGLI.exe 200 PID 4936 wrote to memory of 4072 4936 cmd.exe 204 PID 4072 wrote to memory of 124 4072 ARUZXDJ.exe 205 PID 124 wrote to memory of 3356 124 cmd.exe 209 PID 3356 wrote to memory of 3764 3356 JZWE.exe 210 PID 3764 wrote to memory of 400 3764 cmd.exe 214 PID 400 wrote to memory of 2656 400 NHDMNT.exe 215 PID 2656 wrote to memory of 704 2656 cmd.exe 219 PID 704 wrote to memory of 1756 704 QVH.exe 220 PID 1756 wrote to memory of 5620 1756 cmd.exe 224 PID 5620 wrote to memory of 616 5620 XLIVWO.exe 225 PID 616 wrote to memory of 3432 616 cmd.exe 229 PID 3432 wrote to memory of 2636 3432 MOAZ.exe 230 PID 2636 wrote to memory of 2852 2636 cmd.exe 234 PID 2852 wrote to memory of 4464 2852 EOCES.exe 235 PID 4464 wrote to memory of 4224 4464 cmd.exe 239 PID 4224 wrote to memory of 1720 4224 NWWK.exe 240 PID 1720 wrote to memory of 5876 1720 cmd.exe 244 PID 5876 wrote to memory of 1020 5876 CRNWHYY.exe 245 PID 1020 wrote to memory of 5736 1020 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-05_50a65ce723ddec593c5096193ecd7c86_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-05_50a65ce723ddec593c5096193ecd7c86_elex_emotet_stop.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\POGHAGL.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\windows\POGHAGL.exeC:\windows\POGHAGL.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SWBVQ.exe.bat" "4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\windows\system\SWBVQ.exeC:\windows\system\SWBVQ.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QHTSCVD.exe.bat" "6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:692 -
C:\windows\system\QHTSCVD.exeC:\windows\system\QHTSCVD.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BAOLDC.exe.bat" "8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\windows\SysWOW64\BAOLDC.exeC:\windows\system32\BAOLDC.exe9⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VNT.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\windows\VNT.exeC:\windows\VNT.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6032 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FLYPCKI.exe.bat" "12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\windows\system\FLYPCKI.exeC:\windows\system\FLYPCKI.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AGDY.exe.bat" "14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\windows\AGDY.exeC:\windows\AGDY.exe15⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KERS.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\windows\SysWOW64\KERS.exeC:\windows\system32\KERS.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FRWCWS.exe.bat" "18⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5848 -
C:\windows\FRWCWS.exeC:\windows\FRWCWS.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DCYSF.exe.bat" "20⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\windows\system\DCYSF.exeC:\windows\system\DCYSF.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KXIWY.exe.bat" "22⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\windows\system\KXIWY.exeC:\windows\system\KXIWY.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LAMA.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\windows\system\LAMA.exeC:\windows\system\LAMA.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WTPTMQ.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\windows\WTPTMQ.exeC:\windows\WTPTMQ.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GTRYPOK.exe.bat" "28⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\windows\GTRYPOK.exeC:\windows\GTRYPOK.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GWUU.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\windows\GWUU.exeC:\windows\GWUU.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DBNJ.exe.bat" "32⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\windows\SysWOW64\DBNJ.exeC:\windows\system32\DBNJ.exe33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EEQNQX.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\windows\system\EEQNQX.exeC:\windows\system\EEQNQX.exe35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WIUIE.exe.bat" "36⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\windows\WIUIE.exeC:\windows\WIUIE.exe37⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XDYMJLB.exe.bat" "38⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\windows\SysWOW64\XDYMJLB.exeC:\windows\system32\XDYMJLB.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QGCIPB.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:6124 -
C:\windows\SysWOW64\QGCIPB.exeC:\windows\system32\QGCIPB.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KTH.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\windows\system\KTH.exeC:\windows\system\KTH.exe43⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NGLI.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\windows\NGLI.exeC:\windows\NGLI.exe45⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ARUZXDJ.exe.bat" "46⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\windows\SysWOW64\ARUZXDJ.exeC:\windows\system32\ARUZXDJ.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JZWE.exe.bat" "48⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:124 -
C:\windows\SysWOW64\JZWE.exeC:\windows\system32\JZWE.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NHDMNT.exe.bat" "50⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\windows\system\NHDMNT.exeC:\windows\system\NHDMNT.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QVH.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\windows\SysWOW64\QVH.exeC:\windows\system32\QVH.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XLIVWO.exe.bat" "54⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\windows\XLIVWO.exeC:\windows\XLIVWO.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5620 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MOAZ.exe.bat" "56⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:616 -
C:\windows\SysWOW64\MOAZ.exeC:\windows\system32\MOAZ.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EOCES.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\windows\EOCES.exeC:\windows\EOCES.exe59⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NWWK.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\windows\NWWK.exeC:\windows\NWWK.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CRNWHYY.exe.bat" "62⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\windows\system\CRNWHYY.exeC:\windows\system\CRNWHYY.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GZUW.exe.bat" "64⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1020 -
C:\windows\system\GZUW.exeC:\windows\system\GZUW.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XIWBX.exe.bat" "66⤵
- System Location Discovery: System Language Discovery
PID:5984 -
C:\windows\SysWOW64\XIWBX.exeC:\windows\system32\XIWBX.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QDAFKEQ.exe.bat" "68⤵PID:5380
-
C:\windows\QDAFKEQ.exeC:\windows\QDAFKEQ.exe69⤵
- Executes dropped EXE
PID:5408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LYEO.exe.bat" "70⤵PID:4724
-
C:\windows\system\LYEO.exeC:\windows\system\LYEO.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CYGTYBP.exe.bat" "72⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:6056 -
C:\windows\SysWOW64\CYGTYBP.exeC:\windows\system32\CYGTYBP.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2136 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LMR.exe.bat" "74⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4512 -
C:\windows\system\LMR.exeC:\windows\system\LMR.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5792 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GZOVQ.exe.bat" "76⤵
- System Location Discovery: System Language Discovery
PID:3648 -
C:\windows\system\GZOVQ.exeC:\windows\system\GZOVQ.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OFOJRL.exe.bat" "78⤵
- Executes a command shell one-liner
PID:1484 -
C:\windows\SysWOW64\OFOJRL.exeC:\windows\system32\OFOJRL.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1672 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BPWIGW.exe.bat" "80⤵PID:5904
-
C:\windows\system\BPWIGW.exeC:\windows\system\BPWIGW.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EYFWN.exe.bat" "82⤵PID:5788
-
C:\windows\SysWOW64\EYFWN.exeC:\windows\system32\EYFWN.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4604 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YLKGXQA.exe.bat" "84⤵PID:4128
-
C:\windows\system\YLKGXQA.exeC:\windows\system\YLKGXQA.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1164 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CBRO.exe.bat" "86⤵PID:3580
-
C:\windows\SysWOW64\CBRO.exeC:\windows\system32\CBRO.exe87⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MBTTNFQ.exe.bat" "88⤵PID:6136
-
C:\windows\SysWOW64\MBTTNFQ.exeC:\windows\system32\MBTTNFQ.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WZGNU.exe.bat" "90⤵
- System Location Discovery: System Language Discovery
PID:1972 -
C:\windows\system\WZGNU.exeC:\windows\system\WZGNU.exe91⤵
- Executes dropped EXE
PID:4344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QUDXEN.exe.bat" "92⤵
- Executes a command shell one-liner
PID:824 -
C:\windows\system\QUDXEN.exeC:\windows\system\QUDXEN.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FPUB.exe.bat" "94⤵PID:3012
-
C:\windows\SysWOW64\FPUB.exeC:\windows\system32\FPUB.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CVSYEK.exe.bat" "96⤵PID:2812
-
C:\windows\CVSYEK.exeC:\windows\CVSYEK.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CASNGXT.exe.bat" "98⤵
- Executes a command shell one-liner
PID:3244 -
C:\windows\CASNGXT.exeC:\windows\CASNGXT.exe99⤵
- Executes dropped EXE
PID:4244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XOXW.exe.bat" "100⤵PID:5980
-
C:\windows\XOXW.exeC:\windows\XOXW.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5892 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VZA.exe.bat" "102⤵
- System Location Discovery: System Language Discovery
PID:3464 -
C:\windows\SysWOW64\VZA.exeC:\windows\system32\VZA.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2664 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JJQLFO.exe.bat" "104⤵PID:1012
-
C:\windows\SysWOW64\JJQLFO.exeC:\windows\system32\JJQLFO.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OKY.exe.bat" "106⤵
- Executes a command shell one-liner
PID:2880 -
C:\windows\system\OKY.exeC:\windows\system\OKY.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PNCUB.exe.bat" "108⤵PID:620
-
C:\windows\PNCUB.exeC:\windows\PNCUB.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PSUJD.exe.bat" "110⤵PID:5632
-
C:\windows\system\PSUJD.exeC:\windows\system\PSUJD.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3148 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TAJRP.exe.bat" "112⤵
- System Location Discovery: System Language Discovery
PID:4368 -
C:\windows\TAJRP.exeC:\windows\TAJRP.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OWGAZDH.exe.bat" "114⤵PID:752
-
C:\windows\SysWOW64\OWGAZDH.exeC:\windows\system32\OWGAZDH.exe115⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TWNOIXJ.exe.bat" "116⤵PID:4848
-
C:\windows\SysWOW64\TWNOIXJ.exeC:\windows\system32\TWNOIXJ.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OJSX.exe.bat" "118⤵
- System Location Discovery: System Language Discovery
PID:4732 -
C:\windows\OJSX.exeC:\windows\OJSX.exe119⤵
- Executes dropped EXE
PID:5076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DZTOZSU.exe.bat" "120⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4856 -
C:\windows\DZTOZSU.exeC:\windows\DZTOZSU.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1812
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-