Analysis
- max time kernel
150s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
05/08/2026, 18:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-05_86264710c6a05d099e37d7bf1590dc33_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-05_86264710c6a05d099e37d7bf1590dc33_elex_emotet_stop.exe
- Size 208KB
- Sample260805-wp1lnssgmd
- SHA256 b70ad39ea9a9a8fef9bd7b29384e9bc347cc0b888d9bafd40063e415e74e1330
- MD5 86264710c6a05d099e37d7bf1590dc33
- SHA1 3b6e2b4648ff6ec4df474295c831352988c81419
- SHA512 fb60f6a7ab402f66d703d41b1a56b6f55694c520d6cfdce5eacefd6678b8b5a9d31e7b43cce5dbf17391e73b9734abe73da69e674fab995a78dbc37d368ef77a
- SSDEEP 3072:jLQaL9tbLkRIgd1Lye9yjE2hWAN5Xb8l9dL+LOfI4pLthEjQT6j:vlZtbLWIgd1LZ9oECZb8l95+LOQkEj1
- TLSH T1D9247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1408 YDSOB.exe 6116 ODVAKN.exe 5868 YBANZ.exe 4632 BWSWLO.exe 1976 BCSLMT.exe 1436 EKZL.exe 1884 ZFDUJM.exe 5092 AAH.exe 3148 NLQ.exe 1112 TGP.exe 4436 MBTTNFQ.exe 4296 UPFAXEM.exe 1804 PZOYL.exe 4412 WQP.exe 3676 ZDTHU.exe 3656 BBHTKKT.exe 3512 WDPSYVP.exe 6084 GMRX.exe 5076 ZEZI.exe 2400 ZKZWM.exe 5640 XIS.exe 3124 QLWVN.exe 5040 YQBK.exe 5160 BDGTIA.exe 2904 TGJPN.exe 4480 OUOYXPT.exe 4888 DKPYE.exe 4720 APHN.exe 6016 ASLJAW.exe 5824 IYYPK.exe 3780 CEFPVI.exe 1664 UZJSJ.exe 3792 EXP.exe 5044 OFRSUE.exe 1356 ANY.exe 828 UICBQ.exe 5116 WYQ.exe 1788 XBUZDV.exe 1960 WMXPM.exe 2588 SSPF.exe 4572 MFODH.exe 5412 ZQE.exe 5768 MOENXU.exe 4660 HJJ.exe 4848 WESBSP.exe 3060 VPVRB.exe 2128 EXXWEA.exe 3172 ZAOVTD.exe 4816 JIQAEIV.exe 3088 PIXNN.exe 2544 UJXBW.exe 4740 NEJX.exe 2092 YWEQK.exe 1076 EXLDT.exe 1200 VHKBA.exe 2292 DAK.exe 5140 SQLU.exe 5872 HLDGYLG.exe 3452 RTFLJ.exe 5532 NRDIQ.exe 1316 RHJJDLY.exe 5280 KKVEIA.exe 1060 UIBZ.exe 6108 UNBN.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\PIXNN.exe JIQAEIV.exe File opened for modification C:\windows\SysWOW64\KKVEIA.exe RHJJDLY.exe File created C:\windows\SysWOW64\KKVEIA.exe.bat RHJJDLY.exe File created C:\windows\SysWOW64\EPSLZBG.exe.bat JEJU.exe File created C:\windows\SysWOW64\ASLJAW.exe.bat APHN.exe File opened for modification C:\windows\SysWOW64\QXJDQ.exe SKKD.exe File opened for modification C:\windows\SysWOW64\SSPF.exe WMXPM.exe File created C:\windows\SysWOW64\JIQAEIV.exe ZAOVTD.exe File opened for modification C:\windows\SysWOW64\NEJX.exe UJXBW.exe File created C:\windows\SysWOW64\YWEQK.exe.bat NEJX.exe File created C:\windows\SysWOW64\HACV.exe UPUE.exe File opened for modification C:\windows\SysWOW64\HACV.exe UPUE.exe File opened for modification C:\windows\SysWOW64\BWSWLO.exe YBANZ.exe File created C:\windows\SysWOW64\OUOYXPT.exe TGJPN.exe File created C:\windows\SysWOW64\JIQAEIV.exe.bat ZAOVTD.exe File opened for modification C:\windows\SysWOW64\PIXNN.exe JIQAEIV.exe File created C:\windows\SysWOW64\NEJX.exe UJXBW.exe File created C:\windows\SysWOW64\JEJU.exe JZJGJLQ.exe File created C:\windows\SysWOW64\QXJDQ.exe.bat SKKD.exe File created C:\windows\SysWOW64\TGP.exe.bat NLQ.exe File opened for modification C:\windows\SysWOW64\MBTTNFQ.exe TGP.exe File opened for modification C:\windows\SysWOW64\TEATYQ.exe TQZ.exe File created C:\windows\SysWOW64\SKKD.exe.bat XPFTJYF.exe File opened for modification C:\windows\SysWOW64\TGP.exe NLQ.exe File created C:\windows\SysWOW64\MBTTNFQ.exe.bat TGP.exe File opened for modification C:\windows\SysWOW64\OUOYXPT.exe TGJPN.exe File created C:\windows\SysWOW64\UZJSJ.exe.bat CEFPVI.exe File created C:\windows\SysWOW64\ZQE.exe MFODH.exe File opened for modification C:\windows\SysWOW64\YWEQK.exe NEJX.exe File created C:\windows\SysWOW64\TEATYQ.exe TQZ.exe File created C:\windows\SysWOW64\TEATYQ.exe.bat TQZ.exe File created C:\windows\SysWOW64\BWSWLO.exe YBANZ.exe File created C:\windows\SysWOW64\OUOYXPT.exe.bat TGJPN.exe File opened for modification C:\windows\SysWOW64\ASLJAW.exe APHN.exe File opened for modification C:\windows\SysWOW64\UZJSJ.exe CEFPVI.exe File created C:\windows\SysWOW64\ANY.exe.bat OFRSUE.exe File created C:\windows\SysWOW64\VPVRB.exe.bat WESBSP.exe File created C:\windows\SysWOW64\EXXWEA.exe VPVRB.exe File created C:\windows\SysWOW64\RTFLJ.exe.bat HLDGYLG.exe File opened for modification C:\windows\SysWOW64\EXXWEA.exe VPVRB.exe File created C:\windows\SysWOW64\ASLJAW.exe APHN.exe File created C:\windows\SysWOW64\UZJSJ.exe CEFPVI.exe File created C:\windows\SysWOW64\VPVRB.exe WESBSP.exe File created C:\windows\SysWOW64\NRDIQ.exe RTFLJ.exe File created C:\windows\SysWOW64\NRDIQ.exe.bat RTFLJ.exe File opened for modification C:\windows\SysWOW64\SKKD.exe XPFTJYF.exe File opened for modification C:\windows\SysWOW64\ANY.exe OFRSUE.exe File opened for modification C:\windows\SysWOW64\ZQE.exe MFODH.exe File created C:\windows\SysWOW64\WESBSP.exe.bat HJJ.exe File created C:\windows\SysWOW64\YWEQK.exe NEJX.exe File created C:\windows\SysWOW64\KKVEIA.exe RHJJDLY.exe File created C:\windows\SysWOW64\SYABKZ.exe.bat LIZCE.exe File created C:\windows\SysWOW64\BWSWLO.exe.bat YBANZ.exe File created C:\windows\SysWOW64\AAH.exe.bat ZFDUJM.exe File opened for modification C:\windows\SysWOW64\XIS.exe ZKZWM.exe File created C:\windows\SysWOW64\XIS.exe.bat ZKZWM.exe File created C:\windows\SysWOW64\ANY.exe OFRSUE.exe File created C:\windows\SysWOW64\SSPF.exe WMXPM.exe File opened for modification C:\windows\SysWOW64\VPVRB.exe WESBSP.exe File created C:\windows\SysWOW64\NEJX.exe.bat UJXBW.exe File opened for modification C:\windows\SysWOW64\JEJU.exe JZJGJLQ.exe File created C:\windows\SysWOW64\TGP.exe NLQ.exe File opened for modification C:\windows\SysWOW64\WESBSP.exe HJJ.exe File opened for modification C:\windows\SysWOW64\JIQAEIV.exe ZAOVTD.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\NDN.exe XNMCTAS.exe File created C:\windows\system\NDN.exe.bat XNMCTAS.exe File created C:\windows\system\UICBQ.exe ANY.exe File created C:\windows\VHKBA.exe EXLDT.exe File created C:\windows\VHKBA.exe.bat EXLDT.exe File created C:\windows\GVIV.exe.bat UNBN.exe File created C:\windows\system\QTT.exe.bat NDN.exe File created C:\windows\system\ZKZWM.exe.bat ZEZI.exe File created C:\windows\BCSLMT.exe BWSWLO.exe File opened for modification C:\windows\system\TGJPN.exe BDGTIA.exe File created C:\windows\WMXPM.exe XBUZDV.exe File created C:\windows\MFODH.exe SSPF.exe File created C:\windows\UIBZ.exe.bat KKVEIA.exe File opened for modification C:\windows\system\JZJGJLQ.exe TEATYQ.exe File opened for modification C:\windows\system\NDN.exe XNMCTAS.exe File opened for modification C:\windows\system\NLQ.exe AAH.exe File created C:\windows\system\WQP.exe.bat PZOYL.exe File opened for modification C:\windows\WDPSYVP.exe BBHTKKT.exe File created C:\windows\system\ZKZWM.exe ZEZI.exe File opened for modification C:\windows\system\EXLDT.exe YWEQK.exe File created C:\windows\XNMCTAS.exe.bat LFTKGO.exe File created C:\windows\system\PZOYL.exe UPFAXEM.exe File created C:\windows\ZDTHU.exe WQP.exe File opened for modification C:\windows\system\UICBQ.exe ANY.exe File opened for modification C:\windows\MFODH.exe SSPF.exe File opened for modification C:\windows\DAK.exe VHKBA.exe File created C:\windows\system\UNBN.exe UIBZ.exe File created C:\windows\ESM.exe.bat HACV.exe File opened for modification C:\windows\system\YBANZ.exe ODVAKN.exe File created C:\windows\system\UPUE.exe.bat CHS.exe File created C:\windows\system\UBIKY.exe.bat QTT.exe File created C:\windows\system\LIZCE.exe QXJDQ.exe File opened for modification C:\windows\ZDTHU.exe WQP.exe File opened for modification C:\windows\system\BBHTKKT.exe ZDTHU.exe File created C:\windows\BDGTIA.exe YQBK.exe File created C:\windows\system\DKPYE.exe.bat OUOYXPT.exe File opened for modification C:\windows\WMXPM.exe XBUZDV.exe File opened for modification C:\windows\VHKBA.exe EXLDT.exe File created C:\windows\system\UNBN.exe.bat UIBZ.exe File created C:\windows\system\UPUE.exe CHS.exe File created C:\windows\BDGTIA.exe.bat YQBK.exe File created C:\windows\system\TGJPN.exe BDGTIA.exe File created C:\windows\system\DKPYE.exe OUOYXPT.exe File created C:\windows\system\EXP.exe.bat UZJSJ.exe File opened for modification C:\windows\OFRSUE.exe EXP.exe File created C:\windows\OFRSUE.exe.bat EXP.exe File created C:\windows\DAK.exe.bat VHKBA.exe File opened for modification C:\windows\LFTKGO.exe EPSLZBG.exe File created C:\windows\system\ZEZI.exe.bat GMRX.exe File created C:\windows\YQBK.exe QLWVN.exe File created C:\windows\MOENXU.exe ZQE.exe File created C:\windows\system\ZAOVTD.exe.bat EXXWEA.exe File created C:\windows\system\SQLU.exe DAK.exe File opened for modification C:\windows\UIBZ.exe KKVEIA.exe File opened for modification C:\windows\XPFTJYF.exe UBIKY.exe File created C:\windows\system\LIZCE.exe.bat QXJDQ.exe File created C:\windows\UPFAXEM.exe.bat MBTTNFQ.exe File created C:\windows\system\UICBQ.exe.bat ANY.exe File opened for modification C:\windows\GVIV.exe UNBN.exe File created C:\windows\CHS.exe.bat ITNHTX.exe File opened for modification C:\windows\BCSLMT.exe BWSWLO.exe File created C:\windows\BCSLMT.exe.bat BWSWLO.exe File created C:\windows\EKZL.exe BCSLMT.exe File created C:\windows\system\WQP.exe PZOYL.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3224 cmd.exe 4752 cmd.exe 4196 cmd.exe 2380 cmd.exe 2208 cmd.exe 6060 cmd.exe 2416 cmd.exe 2240 cmd.exe 2716 cmd.exe 5796 cmd.exe 4320 cmd.exe 3440 cmd.exe 2012 cmd.exe 1552 cmd.exe 5648 cmd.exe 3112 cmd.exe 5024 cmd.exe 1928 cmd.exe 924 cmd.exe 4692 cmd.exe 620 cmd.exe 2444 cmd.exe 3352 cmd.exe 804 cmd.exe 6104 cmd.exe 3696 cmd.exe 5784 cmd.exe 200 cmd.exe 5168 cmd.exe 4476 cmd.exe 4080 cmd.exe 872 cmd.exe 2436 cmd.exe 5300 cmd.exe 2364 cmd.exe 1208 cmd.exe 1228 cmd.exe 5180 cmd.exe 3284 cmd.exe 5488 cmd.exe 4864 cmd.exe 5420 cmd.exe 5924 cmd.exe 4536 cmd.exe 2784 cmd.exe 988 cmd.exe 4392 cmd.exe 2164 cmd.exe 4732 cmd.exe 5992 cmd.exe 4092 cmd.exe 904 cmd.exe 2344 cmd.exe 1300 cmd.exe 2984 cmd.exe 1716 cmd.exe 2556 cmd.exe 5884 cmd.exe 4504 cmd.exe 3724 cmd.exe 5264 cmd.exe 1632 cmd.exe 4132 cmd.exe 5172 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 4704 2300 WerFault.exe 88 96 1408 WerFault.exe 94 2620 6116 WerFault.exe 100 4896 5868 WerFault.exe 105 1092 4632 WerFault.exe 110 2092 1976 WerFault.exe 115 1608 1436 WerFault.exe 120 4828 1884 WerFault.exe 125 1792 5092 WerFault.exe 130 2716 3148 WerFault.exe 135 5636 1112 WerFault.exe 140 1576 4436 WerFault.exe 145 5172 4296 WerFault.exe 150 2316 1804 WerFault.exe 155 4952 4412 WerFault.exe 160 5848 3676 WerFault.exe 165 5116 3656 WerFault.exe 170 5228 3512 WerFault.exe 175 5492 6084 WerFault.exe 180 2460 5076 WerFault.exe 184 5872 2400 WerFault.exe 190 5476 5640 WerFault.exe 195 3912 3124 WerFault.exe 200 3452 5040 WerFault.exe 205 3668 5160 WerFault.exe 210 4956 2904 WerFault.exe 215 4100 4480 WerFault.exe 220 2340 4888 WerFault.exe 225 440 4720 WerFault.exe 230 1456 6016 WerFault.exe 235 5544 5824 WerFault.exe 240 4472 3772 WerFault.exe 245 4960 3780 WerFault.exe 250 1680 1664 WerFault.exe 255 5596 3792 WerFault.exe 260 4320 5044 WerFault.exe 265 4100 1356 WerFault.exe 270 4104 828 WerFault.exe 276 2204 5116 WerFault.exe 281 5020 1788 WerFault.exe 286 4400 1960 WerFault.exe 291 3240 2588 WerFault.exe 296 4744 4572 WerFault.exe 301 4740 5412 WerFault.exe 306 5064 5768 WerFault.exe 311 2288 4660 WerFault.exe 316 3092 4848 WerFault.exe 321 5324 3060 WerFault.exe 326 5876 2128 WerFault.exe 331 3336 3172 WerFault.exe 336 2556 4816 WerFault.exe 341 2416 3088 WerFault.exe 346 3692 2544 WerFault.exe 351 6088 4740 WerFault.exe 356 3300 2092 WerFault.exe 361 1208 1076 WerFault.exe 366 2116 1200 WerFault.exe 371 200 2292 WerFault.exe 376 3112 5140 WerFault.exe 381 5084 5872 WerFault.exe 386 6128 3452 WerFault.exe 391 5916 5532 WerFault.exe 396 728 1316 WerFault.exe 401 5080 5280 WerFault.exe 406 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UPFAXEM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YQBK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HACV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ESM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UNBN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JEJU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WDPSYVP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ASLJAW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MFODH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WQP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VPVRB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SGSC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZQE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WMXPM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NRDIQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LFTKGO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BWSWLO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXXWEA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DAK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HLDGYLG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EPSLZBG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RHJJDLY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GMRX.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2300 2026-08-05_86264710c6a05d099e37d7bf1590dc33_elex_emotet_stop.exe 2300 2026-08-05_86264710c6a05d099e37d7bf1590dc33_elex_emotet_stop.exe 1408 YDSOB.exe 1408 YDSOB.exe 6116 ODVAKN.exe 6116 ODVAKN.exe 5868 YBANZ.exe 5868 YBANZ.exe 4632 BWSWLO.exe 4632 BWSWLO.exe 1976 BCSLMT.exe 1976 BCSLMT.exe 1436 EKZL.exe 1436 EKZL.exe 1884 ZFDUJM.exe 1884 ZFDUJM.exe 5092 AAH.exe 5092 AAH.exe 3148 NLQ.exe 3148 NLQ.exe 1112 TGP.exe 1112 TGP.exe 4436 MBTTNFQ.exe 4436 MBTTNFQ.exe 4296 UPFAXEM.exe 4296 UPFAXEM.exe 1804 PZOYL.exe 1804 PZOYL.exe 4412 WQP.exe 4412 WQP.exe 3676 ZDTHU.exe 3676 ZDTHU.exe 3656 BBHTKKT.exe 3656 BBHTKKT.exe 3512 WDPSYVP.exe 3512 WDPSYVP.exe 6084 GMRX.exe 6084 GMRX.exe 5076 ZEZI.exe 5076 ZEZI.exe 2400 ZKZWM.exe 2400 ZKZWM.exe 5640 XIS.exe 5640 XIS.exe 3124 QLWVN.exe 3124 QLWVN.exe 5040 YQBK.exe 5040 YQBK.exe 5160 BDGTIA.exe 5160 BDGTIA.exe 2904 TGJPN.exe 2904 TGJPN.exe 4480 OUOYXPT.exe 4480 OUOYXPT.exe 4888 DKPYE.exe 4888 DKPYE.exe 4720 APHN.exe 4720 APHN.exe 6016 ASLJAW.exe 6016 ASLJAW.exe 3772 SGSC.exe 3772 SGSC.exe 3780 CEFPVI.exe 3780 CEFPVI.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2300 2026-08-05_86264710c6a05d099e37d7bf1590dc33_elex_emotet_stop.exe 2300 2026-08-05_86264710c6a05d099e37d7bf1590dc33_elex_emotet_stop.exe 1408 YDSOB.exe 1408 YDSOB.exe 6116 ODVAKN.exe 6116 ODVAKN.exe 5868 YBANZ.exe 5868 YBANZ.exe 4632 BWSWLO.exe 4632 BWSWLO.exe 1976 BCSLMT.exe 1976 BCSLMT.exe 1436 EKZL.exe 1436 EKZL.exe 1884 ZFDUJM.exe 1884 ZFDUJM.exe 5092 AAH.exe 5092 AAH.exe 3148 NLQ.exe 3148 NLQ.exe 1112 TGP.exe 1112 TGP.exe 4436 MBTTNFQ.exe 4436 MBTTNFQ.exe 4296 UPFAXEM.exe 4296 UPFAXEM.exe 1804 PZOYL.exe 1804 PZOYL.exe 4412 WQP.exe 4412 WQP.exe 3676 ZDTHU.exe 3676 ZDTHU.exe 3656 BBHTKKT.exe 3656 BBHTKKT.exe 3512 WDPSYVP.exe 3512 WDPSYVP.exe 6084 GMRX.exe 6084 GMRX.exe 5076 ZEZI.exe 5076 ZEZI.exe 2400 ZKZWM.exe 2400 ZKZWM.exe 5640 XIS.exe 5640 XIS.exe 3124 QLWVN.exe 3124 QLWVN.exe 5040 YQBK.exe 5040 YQBK.exe 5160 BDGTIA.exe 5160 BDGTIA.exe 2904 TGJPN.exe 2904 TGJPN.exe 4480 OUOYXPT.exe 4480 OUOYXPT.exe 4888 DKPYE.exe 4888 DKPYE.exe 4720 APHN.exe 4720 APHN.exe 6016 ASLJAW.exe 6016 ASLJAW.exe 3772 SGSC.exe 3772 SGSC.exe 3780 CEFPVI.exe 3780 CEFPVI.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2300 wrote to memory of 704 2300 2026-08-05_86264710c6a05d099e37d7bf1590dc33_elex_emotet_stop.exe 90 PID 704 wrote to memory of 1408 704 cmd.exe 94 PID 1408 wrote to memory of 4684 1408 YDSOB.exe 96 PID 4684 wrote to memory of 6116 4684 cmd.exe 100 PID 6116 wrote to memory of 5488 6116 ODVAKN.exe 101 PID 5488 wrote to memory of 5868 5488 cmd.exe 105 PID 5868 wrote to memory of 4196 5868 YBANZ.exe 106 PID 4196 wrote to memory of 4632 4196 cmd.exe 110 PID 4632 wrote to memory of 792 4632 BWSWLO.exe 111 PID 792 wrote to memory of 1976 792 cmd.exe 115 PID 1976 wrote to memory of 2448 1976 BCSLMT.exe 116 PID 2448 wrote to memory of 1436 2448 cmd.exe 120 PID 1436 wrote to memory of 5168 1436 EKZL.exe 121 PID 5168 wrote to memory of 1884 5168 cmd.exe 125 PID 1884 wrote to memory of 5884 1884 ZFDUJM.exe 126 PID 5884 wrote to memory of 5092 5884 cmd.exe 130 PID 5092 wrote to memory of 2320 5092 AAH.exe 131 PID 2320 wrote to memory of 3148 2320 cmd.exe 135 PID 3148 wrote to memory of 5420 3148 NLQ.exe 136 PID 5420 wrote to memory of 1112 5420 cmd.exe 140 PID 1112 wrote to memory of 5924 1112 TGP.exe 141 PID 5924 wrote to memory of 4436 5924 cmd.exe 145 PID 4436 wrote to memory of 1552 4436 MBTTNFQ.exe 146 PID 1552 wrote to memory of 4296 1552 cmd.exe 150 PID 4296 wrote to memory of 2860 4296 UPFAXEM.exe 151 PID 2860 wrote to memory of 1804 2860 cmd.exe 155 PID 1804 wrote to memory of 2364 1804 PZOYL.exe 156 PID 2364 wrote to memory of 4412 2364 cmd.exe 160 PID 4412 wrote to memory of 1984 4412 WQP.exe 161 PID 1984 wrote to memory of 3676 1984 cmd.exe 165 PID 3676 wrote to memory of 1232 3676 ZDTHU.exe 166 PID 1232 wrote to memory of 3656 1232 cmd.exe 170 PID 3656 wrote to memory of 620 3656 BBHTKKT.exe 171 PID 620 wrote to memory of 3512 620 cmd.exe 175 PID 3512 wrote to memory of 4152 3512 WDPSYVP.exe 176 PID 4152 wrote to memory of 6084 4152 cmd.exe 180 PID 6084 wrote to memory of 4132 6084 GMRX.exe 181 PID 4132 wrote to memory of 5076 4132 cmd.exe 184 PID 5076 wrote to memory of 4396 5076 ZEZI.exe 186 PID 4396 wrote to memory of 2400 4396 cmd.exe 190 PID 2400 wrote to memory of 5396 2400 ZKZWM.exe 191 PID 5396 wrote to memory of 5640 5396 cmd.exe 195 PID 5640 wrote to memory of 3232 5640 XIS.exe 196 PID 3232 wrote to memory of 3124 3232 cmd.exe 200 PID 3124 wrote to memory of 5992 3124 QLWVN.exe 201 PID 5992 wrote to memory of 5040 5992 cmd.exe 205 PID 5040 wrote to memory of 4092 5040 YQBK.exe 206 PID 4092 wrote to memory of 5160 4092 cmd.exe 210 PID 5160 wrote to memory of 3324 5160 BDGTIA.exe 211 PID 3324 wrote to memory of 2904 3324 cmd.exe 215 PID 2904 wrote to memory of 3348 2904 TGJPN.exe 216 PID 3348 wrote to memory of 4480 3348 cmd.exe 220 PID 4480 wrote to memory of 1728 4480 OUOYXPT.exe 221 PID 1728 wrote to memory of 4888 1728 cmd.exe 225 PID 4888 wrote to memory of 2444 4888 DKPYE.exe 226 PID 2444 wrote to memory of 4720 2444 cmd.exe 230 PID 4720 wrote to memory of 3736 4720 APHN.exe 231 PID 3736 wrote to memory of 6016 3736 cmd.exe 235 PID 6016 wrote to memory of 904 6016 ASLJAW.exe 236 PID 904 wrote to memory of 5824 904 cmd.exe 240 PID 1248 wrote to memory of 3772 1248 cmd.exe 245 PID 3772 wrote to memory of 4192 3772 SGSC.exe 246 PID 4192 wrote to memory of 3780 4192 cmd.exe 250 PID 3780 wrote to memory of 5404 3780 CEFPVI.exe 251
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-05_86264710c6a05d099e37d7bf1590dc33_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-05_86264710c6a05d099e37d7bf1590dc33_elex_emotet_stop.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YDSOB.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:704 -
C:\windows\YDSOB.exeC:\windows\YDSOB.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ODVAKN.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\windows\ODVAKN.exeC:\windows\ODVAKN.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YBANZ.exe.bat" "6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5488 -
C:\windows\system\YBANZ.exeC:\windows\system\YBANZ.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BWSWLO.exe.bat" "8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\windows\SysWOW64\BWSWLO.exeC:\windows\system32\BWSWLO.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BCSLMT.exe.bat" "10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:792 -
C:\windows\BCSLMT.exeC:\windows\BCSLMT.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EKZL.exe.bat" "12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\windows\EKZL.exeC:\windows\EKZL.exe13⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZFDUJM.exe.bat" "14⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5168 -
C:\windows\ZFDUJM.exeC:\windows\ZFDUJM.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AAH.exe.bat" "16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5884 -
C:\windows\SysWOW64\AAH.exeC:\windows\system32\AAH.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NLQ.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\windows\system\NLQ.exeC:\windows\system\NLQ.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TGP.exe.bat" "20⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5420 -
C:\windows\SysWOW64\TGP.exeC:\windows\system32\TGP.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MBTTNFQ.exe.bat" "22⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5924 -
C:\windows\SysWOW64\MBTTNFQ.exeC:\windows\system32\MBTTNFQ.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UPFAXEM.exe.bat" "24⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\windows\UPFAXEM.exeC:\windows\UPFAXEM.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PZOYL.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\windows\system\PZOYL.exeC:\windows\system\PZOYL.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WQP.exe.bat" "28⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\windows\system\WQP.exeC:\windows\system\WQP.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZDTHU.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\windows\ZDTHU.exeC:\windows\ZDTHU.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3676 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BBHTKKT.exe.bat" "32⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\windows\system\BBHTKKT.exeC:\windows\system\BBHTKKT.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WDPSYVP.exe.bat" "34⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:620 -
C:\windows\WDPSYVP.exeC:\windows\WDPSYVP.exe35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GMRX.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\windows\GMRX.exeC:\windows\GMRX.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZEZI.exe.bat" "38⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\windows\system\ZEZI.exeC:\windows\system\ZEZI.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZKZWM.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\windows\system\ZKZWM.exeC:\windows\system\ZKZWM.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XIS.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:5396 -
C:\windows\SysWOW64\XIS.exeC:\windows\system32\XIS.exe43⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QLWVN.exe.bat" "44⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3232 -
C:\windows\QLWVN.exeC:\windows\QLWVN.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YQBK.exe.bat" "46⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5992 -
C:\windows\YQBK.exeC:\windows\YQBK.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BDGTIA.exe.bat" "48⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\windows\BDGTIA.exeC:\windows\BDGTIA.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TGJPN.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\windows\system\TGJPN.exeC:\windows\system\TGJPN.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OUOYXPT.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:3348 -
C:\windows\SysWOW64\OUOYXPT.exeC:\windows\system32\OUOYXPT.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DKPYE.exe.bat" "54⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\windows\system\DKPYE.exeC:\windows\system\DKPYE.exe55⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\APHN.exe.bat" "56⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\windows\APHN.exeC:\windows\APHN.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ASLJAW.exe.bat" "58⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3736 -
C:\windows\SysWOW64\ASLJAW.exeC:\windows\system32\ASLJAW.exe59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IYYPK.exe.bat" "60⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:904 -
C:\windows\IYYPK.exeC:\windows\IYYPK.exe61⤵
- Executes dropped EXE
PID:5824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SGSC.exe.bat" "62⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\windows\system\SGSC.exeC:\windows\system\SGSC.exe63⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CEFPVI.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\windows\CEFPVI.exeC:\windows\CEFPVI.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UZJSJ.exe.bat" "66⤵
- System Location Discovery: System Language Discovery
PID:5404 -
C:\windows\SysWOW64\UZJSJ.exeC:\windows\system32\UZJSJ.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1664 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EXP.exe.bat" "68⤵
- Executes a command shell one-liner
PID:3224 -
C:\windows\system\EXP.exeC:\windows\system\EXP.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3792 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OFRSUE.exe.bat" "70⤵PID:5148
-
C:\windows\OFRSUE.exeC:\windows\OFRSUE.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ANY.exe.bat" "72⤵PID:4700
-
C:\windows\SysWOW64\ANY.exeC:\windows\system32\ANY.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1356 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UICBQ.exe.bat" "74⤵PID:4384
-
C:\windows\system\UICBQ.exeC:\windows\system\UICBQ.exe75⤵
- Executes dropped EXE
PID:828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WYQ.exe.bat" "76⤵
- System Location Discovery: System Language Discovery
PID:1308 -
C:\windows\SysWOW64\WYQ.exeC:\windows\system32\WYQ.exe77⤵
- Executes dropped EXE
PID:5116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XBUZDV.exe.bat" "78⤵
- System Location Discovery: System Language Discovery
PID:4084 -
C:\windows\XBUZDV.exeC:\windows\XBUZDV.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WMXPM.exe.bat" "80⤵PID:4120
-
C:\windows\WMXPM.exeC:\windows\WMXPM.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SSPF.exe.bat" "82⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4476 -
C:\windows\SysWOW64\SSPF.exeC:\windows\system32\SSPF.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2588 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MFODH.exe.bat" "84⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4536 -
C:\windows\MFODH.exeC:\windows\MFODH.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZQE.exe.bat" "86⤵
- Executes a command shell one-liner
PID:5796 -
C:\windows\SysWOW64\ZQE.exeC:\windows\system32\ZQE.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MOENXU.exe.bat" "88⤵
- System Location Discovery: System Language Discovery
PID:1368 -
C:\windows\MOENXU.exeC:\windows\MOENXU.exe89⤵
- Executes dropped EXE
PID:5768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HJJ.exe.bat" "90⤵
- System Location Discovery: System Language Discovery
PID:1972 -
C:\windows\system\HJJ.exeC:\windows\system\HJJ.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WESBSP.exe.bat" "92⤵
- Executes a command shell one-liner
PID:3352 -
C:\windows\SysWOW64\WESBSP.exeC:\windows\system32\WESBSP.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VPVRB.exe.bat" "94⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4752 -
C:\windows\SysWOW64\VPVRB.exeC:\windows\system32\VPVRB.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EXXWEA.exe.bat" "96⤵PID:4128
-
C:\windows\SysWOW64\EXXWEA.exeC:\windows\system32\EXXWEA.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZAOVTD.exe.bat" "98⤵
- Executes a command shell one-liner
PID:2380 -
C:\windows\system\ZAOVTD.exeC:\windows\system\ZAOVTD.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3172 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JIQAEIV.exe.bat" "100⤵
- System Location Discovery: System Language Discovery
PID:3028 -
C:\windows\SysWOW64\JIQAEIV.exeC:\windows\system32\JIQAEIV.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PIXNN.exe.bat" "102⤵
- Executes a command shell one-liner
PID:4080 -
C:\windows\SysWOW64\PIXNN.exeC:\windows\system32\PIXNN.exe103⤵
- Executes dropped EXE
PID:3088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UJXBW.exe.bat" "104⤵PID:6120
-
C:\windows\UJXBW.exeC:\windows\UJXBW.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NEJX.exe.bat" "106⤵PID:304
-
C:\windows\SysWOW64\NEJX.exeC:\windows\system32\NEJX.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YWEQK.exe.bat" "108⤵PID:3864
-
C:\windows\SysWOW64\YWEQK.exeC:\windows\system32\YWEQK.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EXLDT.exe.bat" "110⤵PID:5704
-
C:\windows\system\EXLDT.exeC:\windows\system\EXLDT.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VHKBA.exe.bat" "112⤵
- Executes a command shell one-liner
PID:4504 -
C:\windows\VHKBA.exeC:\windows\VHKBA.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DAK.exe.bat" "114⤵
- System Location Discovery: System Language Discovery
PID:2996 -
C:\windows\DAK.exeC:\windows\DAK.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2292 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SQLU.exe.bat" "116⤵
- Executes a command shell one-liner
PID:5648 -
C:\windows\system\SQLU.exeC:\windows\system\SQLU.exe117⤵
- Executes dropped EXE
PID:5140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HLDGYLG.exe.bat" "118⤵PID:5536
-
C:\windows\system\HLDGYLG.exeC:\windows\system\HLDGYLG.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RTFLJ.exe.bat" "120⤵
- System Location Discovery: System Language Discovery
PID:4268 -
C:\windows\SysWOW64\RTFLJ.exeC:\windows\system32\RTFLJ.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3452
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-