Analysis
- max time kernel
88s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/08/2026, 01:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-07_5faaf4cb07eb035dfc24807d64c56dbf_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-07_5faaf4cb07eb035dfc24807d64c56dbf_elex_emotet_stop.exe
- Size 208KB
- Sample260807-b9yycsvhjh
- SHA256 9b065712c899552862aa714034503716037cf3307e22fe8f4058c5dd14da5a1c
- MD5 5faaf4cb07eb035dfc24807d64c56dbf
- SHA1 fe0cd076d166e2ba5e8ca7f548dada9ef820475a
- SHA512 a416f68fe1b2bbf5256b3b51c095b5848ed0d58ed2a4d8725a7caa54c3cce930aaae82a78f688765487a18ab8e084060e51b9c2227394991e00cb9ba2a56ea3a
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlydL+LOfJ4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFly5+LORkEj1
- TLSH T155247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4352 HCQSLA.exe 3508 OHKFAM.exe 1368 YFCSR.exe 4820 CIA.exe 5524 MGNHG.exe 1988 YGVSP.exe 5924 PHXXTOD.exe 1780 CRNWHYY.exe 3456 MSH.exe 2500 HCYSZH.exe 5364 UAYD.exe 440 XVPNU.exe 1584 UOZP.exe 4776 EMEK.exe 2960 MZJ.exe 5200 ECVMD.exe 5636 IKBUQ.exe 2432 SIHOXFY.exe 3524 LLLKKV.exe 3400 KWWAL.exe 944 SBAH.exe 5544 JKPMI.exe 1192 VAVMVJI.exe 3952 TNU.exe 1936 XDBVLEU.exe 6128 ZQGE.exe 6132 JRIJZ.exe 2016 NHO.exe 4996 HUTBO.exe 2460 TKABAMJ.exe 4000 OXFK.exe 5604 XYHPO.exe 2736 MBQ.exe 2924 WZEOOEK.exe 6120 ACCJO.exe 2780 MUJUX.exe 5188 HFA.exe 3476 EXCVXFY.exe 5052 YTGE.exe 2300 OJH.exe 3292 DERIZ.exe 3460 WZVMFLU.exe 2828 BZCZO.exe 6136 HUCATIL.exe 4436 CIGK.exe 3332 EGUEKRI.exe 1476 HBRN.exe 2816 STGY.exe 5560 EBNYQC.exe 3616 CXMH.exe 4556 GFTHZX.exe 1468 OSFOKV.exe 856 JDOM.exe 5808 HQNNDJL.exe 4668 TGTV.exe 5372 XOAVBM.exe 568 BEPV.exe 3756 USOB.exe 3392 CXAI.exe 1480 ZDLXLAW.exe 3372 DGJKL.exe 2176 NEWFA.exe 2504 APF.exe 5500 ZZITPSY.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\HUTBO.exe NHO.exe File created C:\windows\SysWOW64\MUJUX.exe ACCJO.exe File created C:\windows\SysWOW64\BEPV.exe.bat XOAVBM.exe File created C:\windows\SysWOW64\QBPRB.exe IVLKQ.exe File created C:\windows\SysWOW64\QBPRB.exe.bat IVLKQ.exe File created C:\windows\SysWOW64\CXPGGCW.exe IKSPV.exe File opened for modification C:\windows\SysWOW64\CUUCKU.exe YRW.exe File created C:\windows\SysWOW64\OQI.exe.bat EAUPF.exe File created C:\windows\SysWOW64\KWWAL.exe.bat LLLKKV.exe File opened for modification C:\windows\SysWOW64\OTIN.exe XTU.exe File opened for modification C:\windows\SysWOW64\KWWAL.exe LLLKKV.exe File created C:\windows\SysWOW64\EXCVXFY.exe.bat HFA.exe File opened for modification C:\windows\SysWOW64\QBPRB.exe IVLKQ.exe File opened for modification C:\windows\SysWOW64\EAUPF.exe RPMQR.exe File created C:\windows\SysWOW64\OXFK.exe TKABAMJ.exe File created C:\windows\SysWOW64\WZEOOEK.exe.bat MBQ.exe File created C:\windows\SysWOW64\ACCJO.exe.bat WZEOOEK.exe File created C:\windows\SysWOW64\HUCATIL.exe.bat BZCZO.exe File created C:\windows\SysWOW64\ACCJO.exe WZEOOEK.exe File created C:\windows\SysWOW64\XOAVBM.exe.bat TGTV.exe File created C:\windows\SysWOW64\OVGIA.exe.bat WSC.exe File created C:\windows\SysWOW64\OIO.exe.bat ZNEYC.exe File created C:\windows\SysWOW64\OQI.exe EAUPF.exe File created C:\windows\SysWOW64\TKABAMJ.exe.bat HUTBO.exe File created C:\windows\SysWOW64\PDSGAFY.exe.bat OIO.exe File created C:\windows\SysWOW64\PSXESJP.exe VZQTBI.exe File created C:\windows\SysWOW64\UOZP.exe.bat XVPNU.exe File created C:\windows\SysWOW64\NEWFA.exe DGJKL.exe File created C:\windows\SysWOW64\NEWFA.exe.bat DGJKL.exe File created C:\windows\SysWOW64\PMAHJR.exe.bat QBPRB.exe File created C:\windows\SysWOW64\IKSPV.exe.bat HHGTIM.exe File opened for modification C:\windows\SysWOW64\OIO.exe ZNEYC.exe File created C:\windows\SysWOW64\UOZP.exe XVPNU.exe File opened for modification C:\windows\SysWOW64\TGTV.exe HQNNDJL.exe File created C:\windows\SysWOW64\BEPV.exe XOAVBM.exe File created C:\windows\SysWOW64\IKSPV.exe HHGTIM.exe File created C:\windows\SysWOW64\YTGE.exe EXCVXFY.exe File created C:\windows\SysWOW64\CUUCKU.exe YRW.exe File created C:\windows\SysWOW64\WZEOOEK.exe MBQ.exe File opened for modification C:\windows\SysWOW64\NEWFA.exe DGJKL.exe File created C:\windows\SysWOW64\ZZITPSY.exe APF.exe File created C:\windows\SysWOW64\PMAHJR.exe QBPRB.exe File created C:\windows\SysWOW64\VZQTBI.exe NMDMQKM.exe File opened for modification C:\windows\SysWOW64\YTGE.exe EXCVXFY.exe File created C:\windows\SysWOW64\HUCATIL.exe BZCZO.exe File opened for modification C:\windows\SysWOW64\PSXESJP.exe VZQTBI.exe File opened for modification C:\windows\SysWOW64\OQI.exe EAUPF.exe File opened for modification C:\windows\SysWOW64\TKABAMJ.exe HUTBO.exe File opened for modification C:\windows\SysWOW64\MUJUX.exe ACCJO.exe File created C:\windows\SysWOW64\HFA.exe.bat MUJUX.exe File created C:\windows\SysWOW64\OJH.exe.bat YTGE.exe File opened for modification C:\windows\SysWOW64\IYFDD.exe PXXSTOK.exe File created C:\windows\SysWOW64\EAUPF.exe RPMQR.exe File created C:\windows\SysWOW64\OSFOKV.exe GFTHZX.exe File created C:\windows\SysWOW64\CUUCKU.exe.bat YRW.exe File opened for modification C:\windows\SysWOW64\UOZP.exe XVPNU.exe File created C:\windows\SysWOW64\MUJUX.exe.bat ACCJO.exe File opened for modification C:\windows\SysWOW64\EXCVXFY.exe HFA.exe File created C:\windows\SysWOW64\OTIN.exe.bat XTU.exe File opened for modification C:\windows\SysWOW64\TNU.exe VAVMVJI.exe File opened for modification C:\windows\SysWOW64\OXFK.exe TKABAMJ.exe File opened for modification C:\windows\SysWOW64\WZEOOEK.exe MBQ.exe File created C:\windows\SysWOW64\YTGE.exe.bat EXCVXFY.exe File created C:\windows\SysWOW64\EAUPF.exe.bat RPMQR.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\LQLKN.exe LKLV.exe File opened for modification C:\windows\DGJKL.exe ZDLXLAW.exe File opened for modification C:\windows\WSC.exe MUOS.exe File created C:\windows\system\DMYN.exe.bat AZTELPL.exe File created C:\windows\system\CRNWHYY.exe PHXXTOD.exe File created C:\windows\system\HHGTIM.exe OOZ.exe File created C:\windows\LKLV.exe.bat YZDXYP.exe File created C:\windows\LQLKN.exe.bat LKLV.exe File created C:\windows\system\HVJHCO.exe LQLKN.exe File created C:\windows\XDBVLEU.exe TNU.exe File opened for modification C:\windows\system\MSH.exe CRNWHYY.exe File created C:\windows\SIHOXFY.exe.bat IKBUQ.exe File created C:\windows\XTU.exe.bat CXPGGCW.exe File created C:\windows\system\HBRN.exe EGUEKRI.exe File created C:\windows\system\CXAI.exe USOB.exe File opened for modification C:\windows\system\HHGTIM.exe OOZ.exe File created C:\windows\KGQ.exe ODA.exe File created C:\windows\system\HVJHCO.exe.bat LQLKN.exe File created C:\windows\YGVSP.exe.bat MGNHG.exe File created C:\windows\VAVMVJI.exe.bat JKPMI.exe File created C:\windows\system\WZVMFLU.exe.bat DERIZ.exe File created C:\windows\system\HBRN.exe.bat EGUEKRI.exe File created C:\windows\system\ZDLXLAW.exe CXAI.exe File created C:\windows\DGJKL.exe ZDLXLAW.exe File opened for modification C:\windows\NGDYOX.exe LIXDHPA.exe File created C:\windows\YFCSR.exe OHKFAM.exe File created C:\windows\IKBUQ.exe.bat ECVMD.exe File created C:\windows\SIHOXFY.exe IKBUQ.exe File opened for modification C:\windows\ZQGE.exe XDBVLEU.exe File created C:\windows\system\WZVMFLU.exe DERIZ.exe File opened for modification C:\windows\BZCZO.exe WZVMFLU.exe File created C:\windows\GFTHZX.exe CXMH.exe File created C:\windows\HCQSLA.exe 2026-08-07_5faaf4cb07eb035dfc24807d64c56dbf_elex_emotet_stop.exe File created C:\windows\system\PHXXTOD.exe.bat YGVSP.exe File opened for modification C:\windows\MBQ.exe XYHPO.exe File created C:\windows\NGDYOX.exe LIXDHPA.exe File created C:\windows\AZTELPL.exe KGQ.exe File created C:\windows\LKLV.exe YZDXYP.exe File opened for modification C:\windows\system\HCYSZH.exe MSH.exe File created C:\windows\MBQ.exe.bat XYHPO.exe File opened for modification C:\windows\YZDXYP.exe DMYN.exe File opened for modification C:\windows\system\CIA.exe YFCSR.exe File created C:\windows\system\CRNWHYY.exe.bat PHXXTOD.exe File opened for modification C:\windows\XDBVLEU.exe TNU.exe File created C:\windows\MBQ.exe XYHPO.exe File created C:\windows\GFTHZX.exe.bat CXMH.exe File created C:\windows\system\GVU.exe.bat OVGIA.exe File opened for modification C:\windows\system\PHXXTOD.exe YGVSP.exe File created C:\windows\XDBVLEU.exe.bat TNU.exe File created C:\windows\NHO.exe.bat JRIJZ.exe File created C:\windows\system\PXXSTOK.exe.bat PSXESJP.exe File created C:\windows\RPMQR.exe XCHG.exe File opened for modification C:\windows\system\DERIZ.exe OJH.exe File created C:\windows\system\HQNNDJL.exe JDOM.exe File opened for modification C:\windows\system\HQNNDJL.exe JDOM.exe File created C:\windows\OHKFAM.exe HCQSLA.exe File opened for modification C:\windows\SIHOXFY.exe IKBUQ.exe File created C:\windows\system\JRIJZ.exe ZQGE.exe File opened for modification C:\windows\system\ZDLXLAW.exe CXAI.exe File created C:\windows\system\APF.exe NEWFA.exe File opened for modification C:\windows\HCQSLA.exe 2026-08-07_5faaf4cb07eb035dfc24807d64c56dbf_elex_emotet_stop.exe File created C:\windows\system\JKPMI.exe SBAH.exe File opened for modification C:\windows\system\WZVMFLU.exe DERIZ.exe File opened for modification C:\windows\system\HBRN.exe EGUEKRI.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5852 cmd.exe 4700 cmd.exe 5492 cmd.exe 5780 cmd.exe 4144 cmd.exe 4940 cmd.exe 772 cmd.exe 2956 cmd.exe 1544 cmd.exe 5980 cmd.exe 4532 cmd.exe 1000 cmd.exe 4372 cmd.exe 1224 cmd.exe 480 cmd.exe 1420 cmd.exe 1376 cmd.exe 2868 cmd.exe 2784 cmd.exe 1588 cmd.exe 4500 cmd.exe 1388 cmd.exe 3104 cmd.exe 4504 cmd.exe 4492 cmd.exe 5556 cmd.exe 2560 cmd.exe 708 cmd.exe 6116 cmd.exe 5840 cmd.exe 4196 cmd.exe 2756 cmd.exe 3236 cmd.exe 4692 cmd.exe 2340 cmd.exe 4900 cmd.exe 996 cmd.exe 5576 cmd.exe 1128 cmd.exe 4972 cmd.exe 3164 cmd.exe 2308 cmd.exe 3248 cmd.exe 2468 cmd.exe 3424 cmd.exe 2796 cmd.exe 2676 cmd.exe 2804 cmd.exe 2788 cmd.exe 2480 cmd.exe 1400 cmd.exe 6000 cmd.exe 4908 cmd.exe 3296 cmd.exe 5040 cmd.exe 3584 cmd.exe 200 cmd.exe 5916 cmd.exe 4568 cmd.exe 3980 cmd.exe 5468 cmd.exe 4400 cmd.exe 3300 cmd.exe 712 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 4340 4112 WerFault.exe 87 1124 4352 WerFault.exe 93 5984 3508 WerFault.exe 99 2732 1368 WerFault.exe 104 1140 4820 WerFault.exe 109 3912 5524 WerFault.exe 114 2308 1988 WerFault.exe 119 1604 5924 WerFault.exe 124 5788 1780 WerFault.exe 129 1480 3456 WerFault.exe 134 1260 2500 WerFault.exe 139 4700 5364 WerFault.exe 144 632 440 WerFault.exe 149 5476 1584 WerFault.exe 154 4348 4776 WerFault.exe 159 1140 2960 WerFault.exe 164 3812 5200 WerFault.exe 169 960 5636 WerFault.exe 174 2560 2432 WerFault.exe 179 4896 3524 WerFault.exe 184 3588 3400 WerFault.exe 189 5604 944 WerFault.exe 194 1128 5544 WerFault.exe 199 5600 1192 WerFault.exe 204 5728 3952 WerFault.exe 209 4668 1936 WerFault.exe 214 5372 6128 WerFault.exe 219 4592 6132 WerFault.exe 224 2600 2016 WerFault.exe 229 4004 4996 WerFault.exe 234 2092 2460 WerFault.exe 239 256 4000 WerFault.exe 244 2576 5604 WerFault.exe 249 5984 2736 WerFault.exe 254 4468 2924 WerFault.exe 259 3004 6120 WerFault.exe 264 5212 2780 WerFault.exe 270 4592 5188 WerFault.exe 275 4328 3476 WerFault.exe 280 4764 5052 WerFault.exe 285 5832 2300 WerFault.exe 290 236 3292 WerFault.exe 295 2272 3460 WerFault.exe 300 5792 2828 WerFault.exe 305 3028 6136 WerFault.exe 310 3080 4436 WerFault.exe 315 5972 3332 WerFault.exe 320 4448 1476 WerFault.exe 325 3212 2816 WerFault.exe 330 884 5560 WerFault.exe 335 5780 3616 WerFault.exe 340 3116 4556 WerFault.exe 345 3188 1468 WerFault.exe 350 2068 856 WerFault.exe 355 6108 5808 WerFault.exe 360 2864 4668 WerFault.exe 365 3948 5372 WerFault.exe 370 1636 568 WerFault.exe 375 200 3756 WerFault.exe 380 4260 3392 WerFault.exe 385 3352 1480 WerFault.exe 389 5164 3372 WerFault.exe 395 480 2176 WerFault.exe 400 4952 2504 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TGTV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JKPMI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HUCATIL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language STGY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IUBQTO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CXMH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YKSJYG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QBPRB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MZJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NEWFA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XEWS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CUUCKU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZNEYC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZYHI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CIGK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XCHG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_5faaf4cb07eb035dfc24807d64c56dbf_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MGNHG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DGJKL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JRIJZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OJH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HBRN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XOAVBM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PMAHJR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CIA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LLLKKV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PDSGAFY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VAVMVJI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TKABAMJ.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4112 2026-08-07_5faaf4cb07eb035dfc24807d64c56dbf_elex_emotet_stop.exe 4112 2026-08-07_5faaf4cb07eb035dfc24807d64c56dbf_elex_emotet_stop.exe 4352 HCQSLA.exe 4352 HCQSLA.exe 3508 OHKFAM.exe 3508 OHKFAM.exe 1368 YFCSR.exe 1368 YFCSR.exe 4820 CIA.exe 4820 CIA.exe 5524 MGNHG.exe 5524 MGNHG.exe 1988 YGVSP.exe 1988 YGVSP.exe 5924 PHXXTOD.exe 5924 PHXXTOD.exe 1780 CRNWHYY.exe 1780 CRNWHYY.exe 3456 MSH.exe 3456 MSH.exe 2500 HCYSZH.exe 2500 HCYSZH.exe 5364 UAYD.exe 5364 UAYD.exe 440 XVPNU.exe 440 XVPNU.exe 1584 UOZP.exe 1584 UOZP.exe 4776 EMEK.exe 4776 EMEK.exe 2960 MZJ.exe 2960 MZJ.exe 5200 ECVMD.exe 5200 ECVMD.exe 5636 IKBUQ.exe 5636 IKBUQ.exe 2432 SIHOXFY.exe 2432 SIHOXFY.exe 3524 LLLKKV.exe 3524 LLLKKV.exe 3400 KWWAL.exe 3400 KWWAL.exe 944 SBAH.exe 944 SBAH.exe 5544 JKPMI.exe 5544 JKPMI.exe 1192 VAVMVJI.exe 1192 VAVMVJI.exe 3952 TNU.exe 3952 TNU.exe 1936 XDBVLEU.exe 1936 XDBVLEU.exe 6128 ZQGE.exe 6128 ZQGE.exe 6132 JRIJZ.exe 6132 JRIJZ.exe 2016 NHO.exe 2016 NHO.exe 4996 HUTBO.exe 4996 HUTBO.exe 2460 TKABAMJ.exe 2460 TKABAMJ.exe 4000 OXFK.exe 4000 OXFK.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4112 2026-08-07_5faaf4cb07eb035dfc24807d64c56dbf_elex_emotet_stop.exe 4112 2026-08-07_5faaf4cb07eb035dfc24807d64c56dbf_elex_emotet_stop.exe 4352 HCQSLA.exe 4352 HCQSLA.exe 3508 OHKFAM.exe 3508 OHKFAM.exe 1368 YFCSR.exe 1368 YFCSR.exe 4820 CIA.exe 4820 CIA.exe 5524 MGNHG.exe 5524 MGNHG.exe 1988 YGVSP.exe 1988 YGVSP.exe 5924 PHXXTOD.exe 5924 PHXXTOD.exe 1780 CRNWHYY.exe 1780 CRNWHYY.exe 3456 MSH.exe 3456 MSH.exe 2500 HCYSZH.exe 2500 HCYSZH.exe 5364 UAYD.exe 5364 UAYD.exe 440 XVPNU.exe 440 XVPNU.exe 1584 UOZP.exe 1584 UOZP.exe 4776 EMEK.exe 4776 EMEK.exe 2960 MZJ.exe 2960 MZJ.exe 5200 ECVMD.exe 5200 ECVMD.exe 5636 IKBUQ.exe 5636 IKBUQ.exe 2432 SIHOXFY.exe 2432 SIHOXFY.exe 3524 LLLKKV.exe 3524 LLLKKV.exe 3400 KWWAL.exe 3400 KWWAL.exe 944 SBAH.exe 944 SBAH.exe 5544 JKPMI.exe 5544 JKPMI.exe 1192 VAVMVJI.exe 1192 VAVMVJI.exe 3952 TNU.exe 3952 TNU.exe 1936 XDBVLEU.exe 1936 XDBVLEU.exe 6128 ZQGE.exe 6128 ZQGE.exe 6132 JRIJZ.exe 6132 JRIJZ.exe 2016 NHO.exe 2016 NHO.exe 4996 HUTBO.exe 4996 HUTBO.exe 2460 TKABAMJ.exe 2460 TKABAMJ.exe 4000 OXFK.exe 4000 OXFK.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4112 wrote to memory of 252 4112 2026-08-07_5faaf4cb07eb035dfc24807d64c56dbf_elex_emotet_stop.exe 89 PID 252 wrote to memory of 4352 252 cmd.exe 93 PID 4352 wrote to memory of 5096 4352 HCQSLA.exe 95 PID 5096 wrote to memory of 3508 5096 cmd.exe 99 PID 3508 wrote to memory of 1092 3508 OHKFAM.exe 100 PID 1092 wrote to memory of 1368 1092 cmd.exe 104 PID 1368 wrote to memory of 3416 1368 YFCSR.exe 105 PID 3416 wrote to memory of 4820 3416 cmd.exe 109 PID 4820 wrote to memory of 5664 4820 CIA.exe 110 PID 5664 wrote to memory of 5524 5664 cmd.exe 114 PID 5524 wrote to memory of 1864 5524 MGNHG.exe 115 PID 1864 wrote to memory of 1988 1864 cmd.exe 119 PID 1988 wrote to memory of 4960 1988 YGVSP.exe 120 PID 4960 wrote to memory of 5924 4960 cmd.exe 124 PID 5924 wrote to memory of 2064 5924 PHXXTOD.exe 125 PID 2064 wrote to memory of 1780 2064 cmd.exe 129 PID 1780 wrote to memory of 4812 1780 CRNWHYY.exe 130 PID 4812 wrote to memory of 3456 4812 cmd.exe 134 PID 3456 wrote to memory of 4444 3456 MSH.exe 135 PID 4444 wrote to memory of 2500 4444 cmd.exe 139 PID 2500 wrote to memory of 5852 2500 HCYSZH.exe 140 PID 5852 wrote to memory of 5364 5852 cmd.exe 144 PID 5364 wrote to memory of 2936 5364 UAYD.exe 145 PID 2936 wrote to memory of 440 2936 cmd.exe 149 PID 440 wrote to memory of 2676 440 XVPNU.exe 150 PID 2676 wrote to memory of 1584 2676 cmd.exe 154 PID 1584 wrote to memory of 1968 1584 UOZP.exe 155 PID 1968 wrote to memory of 4776 1968 cmd.exe 159 PID 4776 wrote to memory of 4200 4776 EMEK.exe 160 PID 4200 wrote to memory of 2960 4200 cmd.exe 164 PID 2960 wrote to memory of 3300 2960 MZJ.exe 165 PID 3300 wrote to memory of 5200 3300 cmd.exe 169 PID 5200 wrote to memory of 712 5200 ECVMD.exe 170 PID 712 wrote to memory of 5636 712 cmd.exe 174 PID 5636 wrote to memory of 6076 5636 IKBUQ.exe 175 PID 6076 wrote to memory of 2432 6076 cmd.exe 179 PID 2432 wrote to memory of 812 2432 SIHOXFY.exe 180 PID 812 wrote to memory of 3524 812 cmd.exe 184 PID 3524 wrote to memory of 4484 3524 LLLKKV.exe 185 PID 4484 wrote to memory of 3400 4484 cmd.exe 189 PID 3400 wrote to memory of 4356 3400 KWWAL.exe 190 PID 4356 wrote to memory of 944 4356 cmd.exe 194 PID 944 wrote to memory of 4504 944 SBAH.exe 195 PID 4504 wrote to memory of 5544 4504 cmd.exe 199 PID 5544 wrote to memory of 3104 5544 JKPMI.exe 200 PID 3104 wrote to memory of 1192 3104 cmd.exe 204 PID 1192 wrote to memory of 5128 1192 VAVMVJI.exe 205 PID 5128 wrote to memory of 3952 5128 cmd.exe 209 PID 3952 wrote to memory of 4804 3952 TNU.exe 210 PID 4804 wrote to memory of 1936 4804 cmd.exe 214 PID 1936 wrote to memory of 5764 1936 XDBVLEU.exe 215 PID 5764 wrote to memory of 6128 5764 cmd.exe 219 PID 6128 wrote to memory of 4180 6128 ZQGE.exe 220 PID 4180 wrote to memory of 6132 4180 cmd.exe 224 PID 6132 wrote to memory of 4344 6132 JRIJZ.exe 225 PID 4344 wrote to memory of 2016 4344 cmd.exe 229 PID 2016 wrote to memory of 5840 2016 NHO.exe 230 PID 5840 wrote to memory of 4996 5840 cmd.exe 234 PID 4996 wrote to memory of 2804 4996 HUTBO.exe 235 PID 2804 wrote to memory of 2460 2804 cmd.exe 239 PID 2460 wrote to memory of 996 2460 TKABAMJ.exe 240 PID 996 wrote to memory of 4000 996 cmd.exe 244 PID 4000 wrote to memory of 4908 4000 OXFK.exe 245 PID 4908 wrote to memory of 5604 4908 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_5faaf4cb07eb035dfc24807d64c56dbf_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-07_5faaf4cb07eb035dfc24807d64c56dbf_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HCQSLA.exe.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:252 -
C:\windows\HCQSLA.exeC:\windows\HCQSLA.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OHKFAM.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\windows\OHKFAM.exeC:\windows\OHKFAM.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YFCSR.exe.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\windows\YFCSR.exeC:\windows\YFCSR.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CIA.exe.bat" "8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\windows\system\CIA.exeC:\windows\system\CIA.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MGNHG.exe.bat" "10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5664 -
C:\windows\MGNHG.exeC:\windows\MGNHG.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YGVSP.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\windows\YGVSP.exeC:\windows\YGVSP.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PHXXTOD.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\windows\system\PHXXTOD.exeC:\windows\system\PHXXTOD.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CRNWHYY.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\windows\system\CRNWHYY.exeC:\windows\system\CRNWHYY.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MSH.exe.bat" "18⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\windows\system\MSH.exeC:\windows\system\MSH.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HCYSZH.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\windows\system\HCYSZH.exeC:\windows\system\HCYSZH.exe21⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UAYD.exe.bat" "22⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5852 -
C:\windows\system\UAYD.exeC:\windows\system\UAYD.exe23⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XVPNU.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\windows\XVPNU.exeC:\windows\XVPNU.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UOZP.exe.bat" "26⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\windows\SysWOW64\UOZP.exeC:\windows\system32\UOZP.exe27⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EMEK.exe.bat" "28⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\windows\EMEK.exeC:\windows\EMEK.exe29⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MZJ.exe.bat" "30⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\windows\SysWOW64\MZJ.exeC:\windows\system32\MZJ.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ECVMD.exe.bat" "32⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3300 -
C:\windows\SysWOW64\ECVMD.exeC:\windows\system32\ECVMD.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IKBUQ.exe.bat" "34⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:712 -
C:\windows\IKBUQ.exeC:\windows\IKBUQ.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5636 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SIHOXFY.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:6076 -
C:\windows\SIHOXFY.exeC:\windows\SIHOXFY.exe37⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LLLKKV.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:812 -
C:\windows\SysWOW64\LLLKKV.exeC:\windows\system32\LLLKKV.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KWWAL.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\windows\SysWOW64\KWWAL.exeC:\windows\system32\KWWAL.exe41⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SBAH.exe.bat" "42⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\windows\system\SBAH.exeC:\windows\system\SBAH.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JKPMI.exe.bat" "44⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\windows\system\JKPMI.exeC:\windows\system\JKPMI.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VAVMVJI.exe.bat" "46⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\windows\VAVMVJI.exeC:\windows\VAVMVJI.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TNU.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:5128 -
C:\windows\SysWOW64\TNU.exeC:\windows\system32\TNU.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XDBVLEU.exe.bat" "50⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\windows\XDBVLEU.exeC:\windows\XDBVLEU.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZQGE.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:5764 -
C:\windows\ZQGE.exeC:\windows\ZQGE.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JRIJZ.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\windows\system\JRIJZ.exeC:\windows\system\JRIJZ.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NHO.exe.bat" "56⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\windows\NHO.exeC:\windows\NHO.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HUTBO.exe.bat" "58⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5840 -
C:\windows\SysWOW64\HUTBO.exeC:\windows\system32\HUTBO.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TKABAMJ.exe.bat" "60⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\windows\SysWOW64\TKABAMJ.exeC:\windows\system32\TKABAMJ.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OXFK.exe.bat" "62⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:996 -
C:\windows\SysWOW64\OXFK.exeC:\windows\system32\OXFK.exe63⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XYHPO.exe.bat" "64⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\windows\XYHPO.exeC:\windows\XYHPO.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5604 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MBQ.exe.bat" "66⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2868 -
C:\windows\MBQ.exeC:\windows\MBQ.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WZEOOEK.exe.bat" "68⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1000 -
C:\windows\SysWOW64\WZEOOEK.exeC:\windows\system32\WZEOOEK.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ACCJO.exe.bat" "70⤵
- System Location Discovery: System Language Discovery
PID:2084 -
C:\windows\SysWOW64\ACCJO.exeC:\windows\system32\ACCJO.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6120 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MUJUX.exe.bat" "72⤵
- System Location Discovery: System Language Discovery
PID:5516 -
C:\windows\SysWOW64\MUJUX.exeC:\windows\system32\MUJUX.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HFA.exe.bat" "74⤵PID:4704
-
C:\windows\SysWOW64\HFA.exeC:\windows\system32\HFA.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EXCVXFY.exe.bat" "76⤵
- System Location Discovery: System Language Discovery
PID:1984 -
C:\windows\SysWOW64\EXCVXFY.exeC:\windows\system32\EXCVXFY.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YTGE.exe.bat" "78⤵
- Executes a command shell one-liner
PID:3296 -
C:\windows\SysWOW64\YTGE.exeC:\windows\system32\YTGE.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OJH.exe.bat" "80⤵PID:2476
-
C:\windows\SysWOW64\OJH.exeC:\windows\system32\OJH.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DERIZ.exe.bat" "82⤵PID:3864
-
C:\windows\system\DERIZ.exeC:\windows\system\DERIZ.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3292 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WZVMFLU.exe.bat" "84⤵
- Executes a command shell one-liner
PID:4492 -
C:\windows\system\WZVMFLU.exeC:\windows\system\WZVMFLU.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BZCZO.exe.bat" "86⤵
- Executes a command shell one-liner
PID:4700 -
C:\windows\BZCZO.exeC:\windows\BZCZO.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HUCATIL.exe.bat" "88⤵
- Executes a command shell one-liner
PID:5040 -
C:\windows\SysWOW64\HUCATIL.exeC:\windows\system32\HUCATIL.exe89⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6136 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CIGK.exe.bat" "90⤵PID:4468
-
C:\windows\system\CIGK.exeC:\windows\system\CIGK.exe91⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EGUEKRI.exe.bat" "92⤵
- Executes a command shell one-liner
PID:2788 -
C:\windows\system\EGUEKRI.exeC:\windows\system\EGUEKRI.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3332 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HBRN.exe.bat" "94⤵PID:2256
-
C:\windows\system\HBRN.exeC:\windows\system\HBRN.exe95⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\STGY.exe.bat" "96⤵PID:4388
-
C:\windows\system\STGY.exeC:\windows\system\STGY.exe97⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EBNYQC.exe.bat" "98⤵
- Executes a command shell one-liner
PID:3424 -
C:\windows\EBNYQC.exeC:\windows\EBNYQC.exe99⤵
- Executes dropped EXE
PID:5560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CXMH.exe.bat" "100⤵
- Executes a command shell one-liner
PID:3584 -
C:\windows\CXMH.exeC:\windows\CXMH.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GFTHZX.exe.bat" "102⤵PID:5756
-
C:\windows\GFTHZX.exeC:\windows\GFTHZX.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OSFOKV.exe.bat" "104⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4196 -
C:\windows\SysWOW64\OSFOKV.exeC:\windows\system32\OSFOKV.exe105⤵
- Executes dropped EXE
PID:1468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JDOM.exe.bat" "106⤵
- Executes a command shell one-liner
PID:5556 -
C:\windows\JDOM.exeC:\windows\JDOM.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HQNNDJL.exe.bat" "108⤵PID:3900
-
C:\windows\system\HQNNDJL.exeC:\windows\system\HQNNDJL.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TGTV.exe.bat" "110⤵PID:5584
-
C:\windows\SysWOW64\TGTV.exeC:\windows\system32\TGTV.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XOAVBM.exe.bat" "112⤵
- Executes a command shell one-liner
PID:2796 -
C:\windows\SysWOW64\XOAVBM.exeC:\windows\system32\XOAVBM.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5372 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BEPV.exe.bat" "114⤵
- System Location Discovery: System Language Discovery
PID:4188 -
C:\windows\SysWOW64\BEPV.exeC:\windows\system32\BEPV.exe115⤵
- Executes dropped EXE
PID:568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\USOB.exe.bat" "116⤵PID:1604
-
C:\windows\system\USOB.exeC:\windows\system\USOB.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CXAI.exe.bat" "118⤵
- Executes a command shell one-liner
PID:2560 -
C:\windows\system\CXAI.exeC:\windows\system\CXAI.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZDLXLAW.exe.bat" "120⤵PID:1068
-
C:\windows\system\ZDLXLAW.exeC:\windows\system\ZDLXLAW.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1480
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-