Analysis
- max time kernel
79s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/08/2026, 15:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-07_90edc8c78d364c86a87ef08c6c761603_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-07_90edc8c78d364c86a87ef08c6c761603_elex_emotet_stop.exe
- Size 208KB
- Sample260807-s63kta1why
- SHA256 61447f12e3ee8aa552c8b764a74c6c9f09423ef726bf287c9bf2e0c535f6981e
- MD5 90edc8c78d364c86a87ef08c6c761603
- SHA1 8443930020164d47a11bd73d7bc1b6452cfa946a
- SHA512 738204dbe8012bb87a24c9f76461e4a3a9aaf4acce657f28784bcb4d5ac016e19d3cbc3b9713994702bc300595cc0374abdb67bab5a6b13ba29a7e2282b91b1a
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlcKL+LOfw4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFlcS+LOIkEj1
- TLSH T1A6247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1484 UGVKWIW.exe 1668 HBI.exe 4816 AUQ.exe 2252 QKRVFAK.exe 6012 BCGGO.exe 4448 SDI.exe 4320 RVLBI.exe 1352 TTYVQ.exe 4588 XBFVCFN.exe 4468 HZLPJN.exe 4740 RXQK.exe 5000 KAC.exe 4704 BAWT.exe 2796 WNBCSR.exe 120 ADP.exe 2792 SGTGKZU.exe 4464 CEZSR.exe 1156 ZXJCDD.exe 3428 UHRT.exe 2104 YQYBVG.exe 3376 RTC.exe 4364 GJDWHS.exe 4924 VEMA.exe 3188 BZLBXIK.exe 4260 DXZWN.exe 4528 JXGJWKU.exe 1256 KAKN.exe 5688 VTSY.exe 1080 FQF.exe 5856 EBIAJXJ.exe 1008 NJKN.exe 420 MUN.exe 3312 WSBQC.exe 4616 AAH.exe 2804 EQOYBUS.exe 5948 ROOKC.exe 2508 MBTTNFQ.exe 2512 FCIEWGY.exe 3392 OCKJ.exe 1472 YAQDPM.exe 5732 NVZI.exe 940 UQYQFCH.exe 4092 JLIVQ.exe 6044 BOLYDMR.exe 4356 TPN.exe 4876 XFUETCH.exe 2452 GFW.exe 2708 XSHB.exe 5332 VNGJRZN.exe 1540 KIPOC.exe 1116 AZQ.exe 2572 UMVXL.exe 2544 XHMY.exe 2800 DULZJEE.exe 1224 YQQ.exe 4532 PJNPMZ.exe 3872 ABIAU.exe 3760 DONJEGG.exe 1212 HEURIY.exe 4988 WUV.exe 5528 KSBG.exe 3408 GDREKGG.exe 1360 GIJ.exe 52 VDTXFG.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\YQYBVG.exe UHRT.exe File opened for modification C:\windows\SysWOW64\MBTTNFQ.exe ROOKC.exe File opened for modification C:\windows\SysWOW64\VYYJYP.exe LYWEV.exe File created C:\windows\SysWOW64\DCEWOQM.exe BER.exe File created C:\windows\SysWOW64\UMVXL.exe.bat AZQ.exe File opened for modification C:\windows\SysWOW64\RVLBI.exe SDI.exe File opened for modification C:\windows\SysWOW64\JXGJWKU.exe DXZWN.exe File created C:\windows\SysWOW64\VTSY.exe KAKN.exe File created C:\windows\SysWOW64\XFUETCH.exe TPN.exe File created C:\windows\SysWOW64\XSHB.exe.bat GFW.exe File created C:\windows\SysWOW64\UMVXL.exe AZQ.exe File created C:\windows\SysWOW64\ABSG.exe.bat DAREK.exe File created C:\windows\SysWOW64\GFW.exe.bat XFUETCH.exe File created C:\windows\SysWOW64\XSHB.exe GFW.exe File created C:\windows\SysWOW64\VNGJRZN.exe XSHB.exe File created C:\windows\SysWOW64\HEURIY.exe DONJEGG.exe File created C:\windows\SysWOW64\MRRPUOK.exe.bat XBQQ.exe File created C:\windows\SysWOW64\NAAA.exe FUVL.exe File created C:\windows\SysWOW64\VTSY.exe.bat KAKN.exe File created C:\windows\SysWOW64\HZLPJN.exe XBFVCFN.exe File opened for modification C:\windows\SysWOW64\AAH.exe WSBQC.exe File created C:\windows\SysWOW64\XFUETCH.exe.bat TPN.exe File created C:\windows\SysWOW64\DONJEGG.exe.bat ABIAU.exe File opened for modification C:\windows\SysWOW64\HEURIY.exe DONJEGG.exe File created C:\windows\SysWOW64\GDREKGG.exe KSBG.exe File created C:\windows\SysWOW64\ZXJCDD.exe CEZSR.exe File created C:\windows\SysWOW64\DXZWN.exe BZLBXIK.exe File created C:\windows\SysWOW64\MBTTNFQ.exe.bat ROOKC.exe File opened for modification C:\windows\SysWOW64\DULZJEE.exe XHMY.exe File opened for modification C:\windows\SysWOW64\ABSG.exe DAREK.exe File opened for modification C:\windows\SysWOW64\ZXJCDD.exe CEZSR.exe File opened for modification C:\windows\SysWOW64\QKRVFAK.exe AUQ.exe File created C:\windows\SysWOW64\JXGJWKU.exe DXZWN.exe File opened for modification C:\windows\SysWOW64\UQYQFCH.exe NVZI.exe File created C:\windows\SysWOW64\DULZJEE.exe.bat XHMY.exe File opened for modification C:\windows\SysWOW64\MRRPUOK.exe XBQQ.exe File created C:\windows\SysWOW64\NRF.exe.bat DTZ.exe File opened for modification C:\windows\SysWOW64\YQYBVG.exe UHRT.exe File created C:\windows\SysWOW64\JXGJWKU.exe.bat DXZWN.exe File created C:\windows\SysWOW64\GFW.exe XFUETCH.exe File created C:\windows\SysWOW64\VYYJYP.exe.bat LYWEV.exe File created C:\windows\SysWOW64\NRF.exe DTZ.exe File created C:\windows\SysWOW64\DCEWOQM.exe.bat BER.exe File created C:\windows\SysWOW64\CEZSR.exe SGTGKZU.exe File created C:\windows\SysWOW64\ZXJCDD.exe.bat CEZSR.exe File created C:\windows\SysWOW64\MBTTNFQ.exe ROOKC.exe File created C:\windows\SysWOW64\UQYQFCH.exe.bat NVZI.exe File created C:\windows\SysWOW64\VNGJRZN.exe.bat XSHB.exe File created C:\windows\SysWOW64\IHF.exe.bat ABSG.exe File opened for modification C:\windows\SysWOW64\NRF.exe DTZ.exe File created C:\windows\SysWOW64\HZLPJN.exe.bat XBFVCFN.exe File opened for modification C:\windows\SysWOW64\GFW.exe XFUETCH.exe File created C:\windows\SysWOW64\DULZJEE.exe XHMY.exe File created C:\windows\SysWOW64\GDREKGG.exe.bat KSBG.exe File created C:\windows\SysWOW64\QKRVFAK.exe.bat AUQ.exe File opened for modification C:\windows\SysWOW64\VTSY.exe KAKN.exe File created C:\windows\SysWOW64\DONJEGG.exe ABIAU.exe File created C:\windows\SysWOW64\VYYJYP.exe LYWEV.exe File opened for modification C:\windows\SysWOW64\IHF.exe ABSG.exe File opened for modification C:\windows\SysWOW64\DCEWOQM.exe BER.exe File created C:\windows\SysWOW64\RVLBI.exe SDI.exe File created C:\windows\SysWOW64\YAQDPM.exe OCKJ.exe File opened for modification C:\windows\SysWOW64\YAQDPM.exe OCKJ.exe File opened for modification C:\windows\SysWOW64\XSHB.exe GFW.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\system\IVWSZJB.exe CZT.exe File created C:\windows\system\XHMY.exe UMVXL.exe File created C:\windows\BAWT.exe.bat KAC.exe File created C:\windows\KIPOC.exe VNGJRZN.exe File created C:\windows\system\IJBJ.exe VDTXFG.exe File opened for modification C:\windows\WNBCSR.exe BAWT.exe File created C:\windows\system\SGTGKZU.exe ADP.exe File created C:\windows\NJKN.exe EBIAJXJ.exe File created C:\windows\WSBQC.exe.bat MUN.exe File created C:\windows\system\AZQ.exe KIPOC.exe File opened for modification C:\windows\GIJ.exe GDREKGG.exe File opened for modification C:\windows\XBQQ.exe AWYB.exe File created C:\windows\system\AUQ.exe HBI.exe File opened for modification C:\windows\system\TTYVQ.exe RVLBI.exe File opened for modification C:\windows\system\KAC.exe RXQK.exe File created C:\windows\system\TPN.exe BOLYDMR.exe File opened for modification C:\windows\system\EZWO.exe BME.exe File created C:\windows\NDYNZ.exe NAAA.exe File created C:\windows\BAWT.exe KAC.exe File opened for modification C:\windows\GJDWHS.exe RTC.exe File created C:\windows\system\EBIAJXJ.exe FQF.exe File opened for modification C:\windows\NJKN.exe EBIAJXJ.exe File opened for modification C:\windows\MUN.exe NJKN.exe File created C:\windows\KSBG.exe WUV.exe File created C:\windows\system\VDTXFG.exe.bat GIJ.exe File opened for modification C:\windows\system\IJBJ.exe VDTXFG.exe File created C:\windows\WNBCSR.exe BAWT.exe File created C:\windows\UHRT.exe.bat ZXJCDD.exe File created C:\windows\FQF.exe VTSY.exe File created C:\windows\system\FUVL.exe.bat MRRPUOK.exe File created C:\windows\system\KAC.exe.bat RXQK.exe File created C:\windows\UGVKWIW.exe 2026-08-07_90edc8c78d364c86a87ef08c6c761603_elex_emotet_stop.exe File created C:\windows\system\HBI.exe UGVKWIW.exe File created C:\windows\BCGGO.exe.bat QKRVFAK.exe File created C:\windows\system\SDI.exe BCGGO.exe File opened for modification C:\windows\ROOKC.exe EQOYBUS.exe File opened for modification C:\windows\system\XHMY.exe UMVXL.exe File created C:\windows\system\ABIAU.exe.bat PJNPMZ.exe File created C:\windows\ROOKC.exe EQOYBUS.exe File created C:\windows\system\IJBJ.exe.bat VDTXFG.exe File created C:\windows\MFODH.exe EZWO.exe File created C:\windows\system\NJRKQ.exe UGN.exe File created C:\windows\DAREK.exe.bat IVWSZJB.exe File created C:\windows\system\FUVL.exe MRRPUOK.exe File opened for modification C:\windows\system\FUVL.exe MRRPUOK.exe File opened for modification C:\windows\AYSUG.exe UCG.exe File created C:\windows\system\HBI.exe.bat UGVKWIW.exe File opened for modification C:\windows\XBFVCFN.exe TTYVQ.exe File created C:\windows\EQOYBUS.exe AAH.exe File created C:\windows\system\BOLYDMR.exe.bat JLIVQ.exe File created C:\windows\GIJ.exe.bat GDREKGG.exe File opened for modification C:\windows\system\HBI.exe UGVKWIW.exe File created C:\windows\WNBCSR.exe.bat BAWT.exe File opened for modification C:\windows\system\SGTGKZU.exe ADP.exe File created C:\windows\VEMA.exe.bat GJDWHS.exe File created C:\windows\WSBQC.exe MUN.exe File opened for modification C:\windows\YQQ.exe DULZJEE.exe File created C:\windows\KSBG.exe.bat WUV.exe File created C:\windows\system\LYWEV.exe MFODH.exe File created C:\windows\UGVKWIW.exe.bat 2026-08-07_90edc8c78d364c86a87ef08c6c761603_elex_emotet_stop.exe File created C:\windows\KAKN.exe.bat JXGJWKU.exe File created C:\windows\system\IVWSZJB.exe.bat CZT.exe File created C:\windows\system\ZDMWI.exe.bat CXUHS.exe File created C:\windows\XBQQ.exe.bat AWYB.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4388 cmd.exe 1556 cmd.exe 5956 cmd.exe 3992 cmd.exe 1500 cmd.exe 2704 cmd.exe 1476 cmd.exe 672 cmd.exe 1480 cmd.exe 2396 cmd.exe 3168 cmd.exe 4940 cmd.exe 4088 cmd.exe 3452 cmd.exe 4600 cmd.exe 1376 cmd.exe 5328 cmd.exe 4124 cmd.exe 944 cmd.exe 3212 cmd.exe 4772 cmd.exe 3380 cmd.exe 4840 cmd.exe 4484 cmd.exe 6016 cmd.exe 4844 cmd.exe 748 cmd.exe 2144 cmd.exe 4544 cmd.exe 5160 cmd.exe 2940 cmd.exe 2100 cmd.exe 6084 cmd.exe 4488 cmd.exe 4244 cmd.exe 3500 cmd.exe 2780 cmd.exe 5044 cmd.exe 1868 cmd.exe 4836 cmd.exe 3700 cmd.exe 4372 cmd.exe 3024 cmd.exe 4832 cmd.exe 5572 cmd.exe 4192 cmd.exe 1468 cmd.exe 796 cmd.exe 1044 cmd.exe 2352 cmd.exe 5936 cmd.exe 1216 cmd.exe 5904 cmd.exe 980 cmd.exe 4620 cmd.exe 4812 cmd.exe 2904 cmd.exe 3276 cmd.exe 5492 cmd.exe 4564 cmd.exe 4224 cmd.exe 4292 cmd.exe 3932 cmd.exe 5272 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 3668 2840 WerFault.exe 87 5824 1484 WerFault.exe 93 3592 1668 WerFault.exe 99 2396 4816 WerFault.exe 104 1680 2252 WerFault.exe 109 4264 6012 WerFault.exe 114 596 4448 WerFault.exe 119 2044 4320 WerFault.exe 124 3560 1352 WerFault.exe 129 5936 4588 WerFault.exe 134 5612 4468 WerFault.exe 139 2060 4740 WerFault.exe 144 5532 5000 WerFault.exe 149 3316 4704 WerFault.exe 154 960 2796 WerFault.exe 159 6076 120 WerFault.exe 164 4512 2792 WerFault.exe 169 3532 4464 WerFault.exe 174 5100 1156 WerFault.exe 179 5528 3428 WerFault.exe 184 2192 2104 WerFault.exe 189 4856 3376 WerFault.exe 194 4592 4364 WerFault.exe 199 6036 4924 WerFault.exe 204 1808 3188 WerFault.exe 209 1048 4260 WerFault.exe 214 4884 4528 WerFault.exe 219 6076 1256 WerFault.exe 224 5596 5688 WerFault.exe 229 2572 1080 WerFault.exe 234 3552 5856 WerFault.exe 239 5328 1008 WerFault.exe 244 6084 420 WerFault.exe 249 2560 3312 WerFault.exe 254 5300 4616 WerFault.exe 259 3480 2804 WerFault.exe 264 868 5948 WerFault.exe 268 2384 2508 WerFault.exe 274 2396 2512 WerFault.exe 279 1480 3392 WerFault.exe 284 5004 1472 WerFault.exe 289 6064 5732 WerFault.exe 294 5576 940 WerFault.exe 299 4404 4092 WerFault.exe 304 1404 6044 WerFault.exe 309 1424 4356 WerFault.exe 314 4724 4876 WerFault.exe 319 3960 2452 WerFault.exe 324 4316 2708 WerFault.exe 329 2844 5332 WerFault.exe 334 2148 1540 WerFault.exe 339 932 1116 WerFault.exe 344 4780 2572 WerFault.exe 349 1880 2544 WerFault.exe 354 1404 2800 WerFault.exe 359 4764 1224 WerFault.exe 364 2500 4304 WerFault.exe 369 2096 4532 WerFault.exe 374 1460 3872 WerFault.exe 379 1480 3760 WerFault.exe 384 2876 1212 WerFault.exe 389 672 4988 WerFault.exe 394 3196 5528 WerFault.exe 399 5844 3408 WerFault.exe 404 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AWYB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KAKN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IVWSZJB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BER.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UQYQFCH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RIGT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AZQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QKRVFAK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FQF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZDMWI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FUVL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NJKN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MUN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BOLYDMR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VDTXFG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EBIAJXJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KSBG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NAAA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DXZWN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_90edc8c78d364c86a87ef08c6c761603_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TTYVQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RTC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BZLBXIK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XSHB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VNGJRZN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ADP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GIJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YQYBVG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NJRKQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UCG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RVLBI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEZSR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2840 2026-08-07_90edc8c78d364c86a87ef08c6c761603_elex_emotet_stop.exe 2840 2026-08-07_90edc8c78d364c86a87ef08c6c761603_elex_emotet_stop.exe 1484 UGVKWIW.exe 1484 UGVKWIW.exe 1668 HBI.exe 1668 HBI.exe 4816 AUQ.exe 4816 AUQ.exe 2252 QKRVFAK.exe 2252 QKRVFAK.exe 6012 BCGGO.exe 6012 BCGGO.exe 4448 SDI.exe 4448 SDI.exe 4320 RVLBI.exe 4320 RVLBI.exe 1352 TTYVQ.exe 1352 TTYVQ.exe 4588 XBFVCFN.exe 4588 XBFVCFN.exe 4468 HZLPJN.exe 4468 HZLPJN.exe 4740 RXQK.exe 4740 RXQK.exe 5000 KAC.exe 5000 KAC.exe 4704 BAWT.exe 4704 BAWT.exe 2796 WNBCSR.exe 2796 WNBCSR.exe 120 ADP.exe 120 ADP.exe 2792 SGTGKZU.exe 2792 SGTGKZU.exe 4464 CEZSR.exe 4464 CEZSR.exe 1156 ZXJCDD.exe 1156 ZXJCDD.exe 3428 UHRT.exe 3428 UHRT.exe 2104 YQYBVG.exe 2104 YQYBVG.exe 3376 RTC.exe 3376 RTC.exe 4364 GJDWHS.exe 4364 GJDWHS.exe 4924 VEMA.exe 4924 VEMA.exe 3188 BZLBXIK.exe 3188 BZLBXIK.exe 4260 DXZWN.exe 4260 DXZWN.exe 4528 JXGJWKU.exe 4528 JXGJWKU.exe 1256 KAKN.exe 1256 KAKN.exe 5688 VTSY.exe 5688 VTSY.exe 1080 FQF.exe 1080 FQF.exe 5856 EBIAJXJ.exe 5856 EBIAJXJ.exe 1008 NJKN.exe 1008 NJKN.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2840 2026-08-07_90edc8c78d364c86a87ef08c6c761603_elex_emotet_stop.exe 2840 2026-08-07_90edc8c78d364c86a87ef08c6c761603_elex_emotet_stop.exe 1484 UGVKWIW.exe 1484 UGVKWIW.exe 1668 HBI.exe 1668 HBI.exe 4816 AUQ.exe 4816 AUQ.exe 2252 QKRVFAK.exe 2252 QKRVFAK.exe 6012 BCGGO.exe 6012 BCGGO.exe 4448 SDI.exe 4448 SDI.exe 4320 RVLBI.exe 4320 RVLBI.exe 1352 TTYVQ.exe 1352 TTYVQ.exe 4588 XBFVCFN.exe 4588 XBFVCFN.exe 4468 HZLPJN.exe 4468 HZLPJN.exe 4740 RXQK.exe 4740 RXQK.exe 5000 KAC.exe 5000 KAC.exe 4704 BAWT.exe 4704 BAWT.exe 2796 WNBCSR.exe 2796 WNBCSR.exe 120 ADP.exe 120 ADP.exe 2792 SGTGKZU.exe 2792 SGTGKZU.exe 4464 CEZSR.exe 4464 CEZSR.exe 1156 ZXJCDD.exe 1156 ZXJCDD.exe 3428 UHRT.exe 3428 UHRT.exe 2104 YQYBVG.exe 2104 YQYBVG.exe 3376 RTC.exe 3376 RTC.exe 4364 GJDWHS.exe 4364 GJDWHS.exe 4924 VEMA.exe 4924 VEMA.exe 3188 BZLBXIK.exe 3188 BZLBXIK.exe 4260 DXZWN.exe 4260 DXZWN.exe 4528 JXGJWKU.exe 4528 JXGJWKU.exe 1256 KAKN.exe 1256 KAKN.exe 5688 VTSY.exe 5688 VTSY.exe 1080 FQF.exe 1080 FQF.exe 5856 EBIAJXJ.exe 5856 EBIAJXJ.exe 1008 NJKN.exe 1008 NJKN.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2840 wrote to memory of 4192 2840 2026-08-07_90edc8c78d364c86a87ef08c6c761603_elex_emotet_stop.exe 89 PID 4192 wrote to memory of 1484 4192 cmd.exe 93 PID 1484 wrote to memory of 5728 1484 UGVKWIW.exe 95 PID 5728 wrote to memory of 1668 5728 cmd.exe 99 PID 1668 wrote to memory of 2676 1668 HBI.exe 100 PID 2676 wrote to memory of 4816 2676 cmd.exe 104 PID 4816 wrote to memory of 5096 4816 AUQ.exe 105 PID 5096 wrote to memory of 2252 5096 cmd.exe 109 PID 2252 wrote to memory of 1316 2252 QKRVFAK.exe 110 PID 1316 wrote to memory of 6012 1316 cmd.exe 114 PID 6012 wrote to memory of 4484 6012 BCGGO.exe 115 PID 4484 wrote to memory of 4448 4484 cmd.exe 119 PID 4448 wrote to memory of 1664 4448 SDI.exe 120 PID 1664 wrote to memory of 4320 1664 cmd.exe 124 PID 4320 wrote to memory of 4136 4320 RVLBI.exe 125 PID 4136 wrote to memory of 1352 4136 cmd.exe 129 PID 1352 wrote to memory of 2632 1352 TTYVQ.exe 130 PID 2632 wrote to memory of 4588 2632 cmd.exe 134 PID 4588 wrote to memory of 3992 4588 XBFVCFN.exe 135 PID 3992 wrote to memory of 4468 3992 cmd.exe 139 PID 4468 wrote to memory of 4152 4468 HZLPJN.exe 140 PID 4152 wrote to memory of 4740 4152 cmd.exe 144 PID 4740 wrote to memory of 5272 4740 RXQK.exe 145 PID 5272 wrote to memory of 5000 5272 cmd.exe 149 PID 5000 wrote to memory of 4660 5000 KAC.exe 150 PID 4660 wrote to memory of 4704 4660 cmd.exe 154 PID 4704 wrote to memory of 5884 4704 BAWT.exe 155 PID 5884 wrote to memory of 2796 5884 cmd.exe 159 PID 2796 wrote to memory of 5260 2796 WNBCSR.exe 160 PID 5260 wrote to memory of 120 5260 cmd.exe 164 PID 120 wrote to memory of 3424 120 ADP.exe 165 PID 3424 wrote to memory of 2792 3424 cmd.exe 169 PID 2792 wrote to memory of 5804 2792 SGTGKZU.exe 170 PID 5804 wrote to memory of 4464 5804 cmd.exe 174 PID 4464 wrote to memory of 4940 4464 CEZSR.exe 175 PID 4940 wrote to memory of 1156 4940 cmd.exe 179 PID 1156 wrote to memory of 612 1156 ZXJCDD.exe 180 PID 612 wrote to memory of 3428 612 cmd.exe 184 PID 3428 wrote to memory of 4664 3428 UHRT.exe 185 PID 4664 wrote to memory of 2104 4664 cmd.exe 189 PID 2104 wrote to memory of 1244 2104 YQYBVG.exe 190 PID 1244 wrote to memory of 3376 1244 cmd.exe 194 PID 3376 wrote to memory of 5160 3376 RTC.exe 195 PID 5160 wrote to memory of 4364 5160 cmd.exe 199 PID 4364 wrote to memory of 4900 4364 GJDWHS.exe 200 PID 4900 wrote to memory of 4924 4900 cmd.exe 204 PID 4924 wrote to memory of 5904 4924 VEMA.exe 205 PID 5904 wrote to memory of 3188 5904 cmd.exe 209 PID 3188 wrote to memory of 3904 3188 BZLBXIK.exe 210 PID 3904 wrote to memory of 4260 3904 cmd.exe 214 PID 4260 wrote to memory of 784 4260 DXZWN.exe 215 PID 784 wrote to memory of 4528 784 cmd.exe 219 PID 4528 wrote to memory of 1500 4528 JXGJWKU.exe 220 PID 1500 wrote to memory of 1256 1500 cmd.exe 224 PID 1256 wrote to memory of 2592 1256 KAKN.exe 225 PID 2592 wrote to memory of 5688 2592 cmd.exe 229 PID 5688 wrote to memory of 5924 5688 VTSY.exe 230 PID 5924 wrote to memory of 1080 5924 cmd.exe 234 PID 1080 wrote to memory of 2588 1080 FQF.exe 235 PID 2588 wrote to memory of 5856 2588 cmd.exe 239 PID 5856 wrote to memory of 3468 5856 EBIAJXJ.exe 240 PID 3468 wrote to memory of 1008 3468 cmd.exe 244 PID 1008 wrote to memory of 3416 1008 NJKN.exe 245 PID 3416 wrote to memory of 420 3416 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_90edc8c78d364c86a87ef08c6c761603_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-07_90edc8c78d364c86a87ef08c6c761603_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UGVKWIW.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\windows\UGVKWIW.exeC:\windows\UGVKWIW.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HBI.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:5728 -
C:\windows\system\HBI.exeC:\windows\system\HBI.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AUQ.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\windows\system\AUQ.exeC:\windows\system\AUQ.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QKRVFAK.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\windows\SysWOW64\QKRVFAK.exeC:\windows\system32\QKRVFAK.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BCGGO.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\windows\BCGGO.exeC:\windows\BCGGO.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SDI.exe.bat" "12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\windows\system\SDI.exeC:\windows\system\SDI.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RVLBI.exe.bat" "14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\windows\SysWOW64\RVLBI.exeC:\windows\system32\RVLBI.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TTYVQ.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\windows\system\TTYVQ.exeC:\windows\system\TTYVQ.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XBFVCFN.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\windows\XBFVCFN.exeC:\windows\XBFVCFN.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HZLPJN.exe.bat" "20⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\windows\SysWOW64\HZLPJN.exeC:\windows\system32\HZLPJN.exe21⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RXQK.exe.bat" "22⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\windows\system\RXQK.exeC:\windows\system\RXQK.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KAC.exe.bat" "24⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5272 -
C:\windows\system\KAC.exeC:\windows\system\KAC.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BAWT.exe.bat" "26⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\windows\BAWT.exeC:\windows\BAWT.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WNBCSR.exe.bat" "28⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5884 -
C:\windows\WNBCSR.exeC:\windows\WNBCSR.exe29⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ADP.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:5260 -
C:\windows\system\ADP.exeC:\windows\system\ADP.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:120 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SGTGKZU.exe.bat" "32⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\windows\system\SGTGKZU.exeC:\windows\system\SGTGKZU.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CEZSR.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:5804 -
C:\windows\SysWOW64\CEZSR.exeC:\windows\system32\CEZSR.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZXJCDD.exe.bat" "36⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\windows\SysWOW64\ZXJCDD.exeC:\windows\system32\ZXJCDD.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UHRT.exe.bat" "38⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:612 -
C:\windows\UHRT.exeC:\windows\UHRT.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YQYBVG.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\windows\SysWOW64\YQYBVG.exeC:\windows\system32\YQYBVG.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RTC.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\windows\RTC.exeC:\windows\RTC.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GJDWHS.exe.bat" "44⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5160 -
C:\windows\GJDWHS.exeC:\windows\GJDWHS.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VEMA.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\windows\VEMA.exeC:\windows\VEMA.exe47⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BZLBXIK.exe.bat" "48⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5904 -
C:\windows\BZLBXIK.exeC:\windows\BZLBXIK.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DXZWN.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\windows\SysWOW64\DXZWN.exeC:\windows\system32\DXZWN.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JXGJWKU.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:784 -
C:\windows\SysWOW64\JXGJWKU.exeC:\windows\system32\JXGJWKU.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KAKN.exe.bat" "54⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\windows\KAKN.exeC:\windows\KAKN.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VTSY.exe.bat" "56⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\windows\SysWOW64\VTSY.exeC:\windows\system32\VTSY.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FQF.exe.bat" "58⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5924 -
C:\windows\FQF.exeC:\windows\FQF.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EBIAJXJ.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\windows\system\EBIAJXJ.exeC:\windows\system\EBIAJXJ.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NJKN.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\windows\NJKN.exeC:\windows\NJKN.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1008 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MUN.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\windows\MUN.exeC:\windows\MUN.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WSBQC.exe.bat" "66⤵PID:1660
-
C:\windows\WSBQC.exeC:\windows\WSBQC.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AAH.exe.bat" "68⤵PID:1004
-
C:\windows\SysWOW64\AAH.exeC:\windows\system32\AAH.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EQOYBUS.exe.bat" "70⤵PID:3088
-
C:\windows\EQOYBUS.exeC:\windows\EQOYBUS.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ROOKC.exe.bat" "72⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4124 -
C:\windows\ROOKC.exeC:\windows\ROOKC.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MBTTNFQ.exe.bat" "74⤵
- System Location Discovery: System Language Discovery
PID:5032 -
C:\windows\SysWOW64\MBTTNFQ.exeC:\windows\system32\MBTTNFQ.exe75⤵
- Executes dropped EXE
PID:2508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FCIEWGY.exe.bat" "76⤵PID:5704
-
C:\windows\system\FCIEWGY.exeC:\windows\system\FCIEWGY.exe77⤵
- Executes dropped EXE
PID:2512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OCKJ.exe.bat" "78⤵PID:2432
-
C:\windows\system\OCKJ.exeC:\windows\system\OCKJ.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YAQDPM.exe.bat" "80⤵
- Executes a command shell one-liner
PID:6016 -
C:\windows\SysWOW64\YAQDPM.exeC:\windows\system32\YAQDPM.exe81⤵
- Executes dropped EXE
PID:1472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NVZI.exe.bat" "82⤵PID:1976
-
C:\windows\system\NVZI.exeC:\windows\system\NVZI.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UQYQFCH.exe.bat" "84⤵
- Executes a command shell one-liner
PID:4088 -
C:\windows\SysWOW64\UQYQFCH.exeC:\windows\system32\UQYQFCH.exe85⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JLIVQ.exe.bat" "86⤵PID:4164
-
C:\windows\JLIVQ.exeC:\windows\JLIVQ.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BOLYDMR.exe.bat" "88⤵
- System Location Discovery: System Language Discovery
PID:6088 -
C:\windows\system\BOLYDMR.exeC:\windows\system\BOLYDMR.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TPN.exe.bat" "90⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:6084 -
C:\windows\system\TPN.exeC:\windows\system\TPN.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4356 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XFUETCH.exe.bat" "92⤵PID:2956
-
C:\windows\SysWOW64\XFUETCH.exeC:\windows\system32\XFUETCH.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GFW.exe.bat" "94⤵
- System Location Discovery: System Language Discovery
PID:4156 -
C:\windows\SysWOW64\GFW.exeC:\windows\system32\GFW.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XSHB.exe.bat" "96⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4488 -
C:\windows\SysWOW64\XSHB.exeC:\windows\system32\XSHB.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VNGJRZN.exe.bat" "98⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2704 -
C:\windows\SysWOW64\VNGJRZN.exeC:\windows\system32\VNGJRZN.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5332 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KIPOC.exe.bat" "100⤵
- Executes a command shell one-liner
PID:944 -
C:\windows\KIPOC.exeC:\windows\KIPOC.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AZQ.exe.bat" "102⤵PID:1772
-
C:\windows\system\AZQ.exeC:\windows\system\AZQ.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UMVXL.exe.bat" "104⤵
- Executes a command shell one-liner
PID:3452 -
C:\windows\SysWOW64\UMVXL.exeC:\windows\system32\UMVXL.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XHMY.exe.bat" "106⤵
- Executes a command shell one-liner
PID:4244 -
C:\windows\system\XHMY.exeC:\windows\system\XHMY.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DULZJEE.exe.bat" "108⤵
- System Location Discovery: System Language Discovery
PID:5504 -
C:\windows\SysWOW64\DULZJEE.exeC:\windows\system32\DULZJEE.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YQQ.exe.bat" "110⤵PID:4444
-
C:\windows\YQQ.exeC:\windows\YQQ.exe111⤵
- Executes dropped EXE
PID:1224 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RIGT.exe.bat" "112⤵PID:3640
-
C:\windows\system\RIGT.exeC:\windows\system\RIGT.exe113⤵
- System Location Discovery: System Language Discovery
PID:4304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PJNPMZ.exe.bat" "114⤵PID:3800
-
C:\windows\system\PJNPMZ.exeC:\windows\system\PJNPMZ.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ABIAU.exe.bat" "116⤵
- System Location Discovery: System Language Discovery
PID:3876 -
C:\windows\system\ABIAU.exeC:\windows\system\ABIAU.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DONJEGG.exe.bat" "118⤵
- System Location Discovery: System Language Discovery
PID:5864 -
C:\windows\SysWOW64\DONJEGG.exeC:\windows\system32\DONJEGG.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HEURIY.exe.bat" "120⤵PID:4956
-
C:\windows\SysWOW64\HEURIY.exeC:\windows\system32\HEURIY.exe121⤵
- Executes dropped EXE
PID:1212
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-