Analysis
- max time kernel
83s - max time network
115s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/08/2026, 15:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-07_7d7cfad808204a3d71ee005db33f1ccc_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-07_7d7cfad808204a3d71ee005db33f1ccc_elex_emotet_stop.exe
- Size 289KB
- Sample260807-ta3rda1yb1
- SHA256 8bc03c55fa05c6c81fc6ea41d2c5b4aebe3632e455360b09792431f7aa4ed704
- MD5 7d7cfad808204a3d71ee005db33f1ccc
- SHA1 b416b76fc816c9d7c09dec18757657165bcf28de
- SHA512 4466c4d621afe02ce20d5f0ca9aa86c8e0aaf0f11c5450bfd28546d0ccd65608a52d3456eeed43cd5fb3e5bd95607ccd5137a5fa3de5fa2ddb4d7bcc0c7decba
- SSDEEP 6144:RlZtbLWIgd1LZ9oECZbxlUS+LODkECzJLaQVbU5:fLWI09QZb6LODklJLJbU5
- TLSH T14B549E2236C2C133D5A3027149E6C7A9777ABCB1573686CB7BC4374D2A72AE58B35381
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5608 YFH.exe 4364 RSH.exe 5680 IBV.exe 4960 WWHDV.exe 4932 HOO.exe 2204 VMWAGGK.exe 3748 DABHRE.exe 5020 SVKL.exe 2820 HLL.exe 5648 NGXDXJL.exe 1564 XELYESU.exe 4548 BMRY.exe 4996 LKXS.exe 2324 FCMD.exe 3296 XFQHVB.exe 808 HNSMYHK.exe 4420 AGAXPHS.exe 1288 UTEG.exe 720 CZR.exe 4676 BSUDLMZ.exe 2108 FAADX.exe 5384 PDGLO.exe 1760 EGQ.exe 4948 MMQ.exe 3840 YETXJ.exe 2996 FZC.exe 1404 WZEP.exe 3180 CAMCOT.exe 5060 CNERQGY.exe 5544 XBJA.exe 2796 KLZZGII.exe 5652 BMB.exe 1840 HMJSB.exe 1576 LCQ.exe 1620 RPPSK.exe 5156 VFV.exe 4528 ZNCAI.exe 5432 FOKORII.exe 4680 ZBOY.exe 4856 KUJQK.exe 5092 WMNJSFU.exe 1448 WPQ.exe 2792 AFXNKN.exe 6100 TAJRP.exe 5536 ZBQEY.exe 3264 ZOJ.exe 1424 BBNCK.exe 3348 ZCVQT.exe 5412 FCDEKGO.exe 4500 APHN.exe 3548 GLHORJS.exe 4416 TNPMF.exe 3712 EGSFNB.exe 4572 MZBZBG.exe 4232 RJXFGXM.exe 4404 XXW.exe 5836 SKBPN.exe 6092 NFGZYAF.exe 6140 JDD.exe 3516 EYIFP.exe 1768 IGXNBBS.exe 3968 OGWBK.exe 1420 KMCQ.exe 556 FZHHBF.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\YFH.exe 2026-08-07_7d7cfad808204a3d71ee005db33f1ccc_elex_emotet_stop.exe File created C:\windows\SysWOW64\KZG.exe TQENZVT.exe File created C:\windows\SysWOW64\ZYZJKY.exe KIYJDKQ.exe File opened for modification C:\windows\SysWOW64\BMRY.exe XELYESU.exe File opened for modification C:\windows\SysWOW64\LKXS.exe BMRY.exe File created C:\windows\SysWOW64\HMJSB.exe.bat BMB.exe File created C:\windows\SysWOW64\RPPSK.exe LCQ.exe File created C:\windows\SysWOW64\ZNCAI.exe VFV.exe File opened for modification C:\windows\SysWOW64\BBNCK.exe ZOJ.exe File created C:\windows\SysWOW64\FCDEKGO.exe ZCVQT.exe File created C:\windows\SysWOW64\HOO.exe.bat WWHDV.exe File opened for modification C:\windows\SysWOW64\FCDEKGO.exe ZCVQT.exe File created C:\windows\SysWOW64\IURKRKX.exe TZAGG.exe File opened for modification C:\windows\SysWOW64\YDTDMK.exe DPWT.exe File created C:\windows\SysWOW64\YDTDMK.exe.bat DPWT.exe File created C:\windows\SysWOW64\NGXDXJL.exe.bat HLL.exe File created C:\windows\SysWOW64\BMRY.exe XELYESU.exe File created C:\windows\SysWOW64\KMCQ.exe OGWBK.exe File opened for modification C:\windows\SysWOW64\KMCQ.exe OGWBK.exe File opened for modification C:\windows\SysWOW64\IURKRKX.exe TZAGG.exe File opened for modification C:\windows\SysWOW64\TFF.exe ZSATFI.exe File opened for modification C:\windows\SysWOW64\HOO.exe WWHDV.exe File created C:\windows\SysWOW64\NGXDXJL.exe HLL.exe File opened for modification C:\windows\SysWOW64\RPPSK.exe LCQ.exe File opened for modification C:\windows\SysWOW64\ZNCAI.exe VFV.exe File created C:\windows\SysWOW64\ZNM.exe.bat FZHHBF.exe File created C:\windows\SysWOW64\ITR.exe.bat XBOYISX.exe File created C:\windows\SysWOW64\KZG.exe.bat TQENZVT.exe File created C:\windows\SysWOW64\YDTDMK.exe DPWT.exe File created C:\windows\SysWOW64\HOO.exe WWHDV.exe File created C:\windows\SysWOW64\HLL.exe SVKL.exe File created C:\windows\SysWOW64\RPPSK.exe.bat LCQ.exe File created C:\windows\SysWOW64\GLHORJS.exe APHN.exe File created C:\windows\SysWOW64\TNPMF.exe GLHORJS.exe File created C:\windows\SysWOW64\JDD.exe.bat NFGZYAF.exe File created C:\windows\SysWOW64\LWNM.exe.bat EGMUI.exe File created C:\windows\SysWOW64\XKMIVVZ.exe.bat RWVHYS.exe File created C:\windows\SysWOW64\KLZZGII.exe.bat XBJA.exe File created C:\windows\SysWOW64\VFV.exe.bat RPPSK.exe File created C:\windows\SysWOW64\ZNCAI.exe.bat VFV.exe File created C:\windows\SysWOW64\ZNM.exe FZHHBF.exe File opened for modification C:\windows\SysWOW64\ZNM.exe FZHHBF.exe File created C:\windows\SysWOW64\YETXJ.exe.bat MMQ.exe File created C:\windows\SysWOW64\KLZZGII.exe XBJA.exe File created C:\windows\SysWOW64\KUJQK.exe.bat ZBOY.exe File created C:\windows\SysWOW64\JDD.exe NFGZYAF.exe File opened for modification C:\windows\SysWOW64\KZG.exe TQENZVT.exe File opened for modification C:\windows\SysWOW64\IKSPV.exe JZHHNO.exe File created C:\windows\SysWOW64\YFH.exe.bat 2026-08-07_7d7cfad808204a3d71ee005db33f1ccc_elex_emotet_stop.exe File opened for modification C:\windows\SysWOW64\HLL.exe SVKL.exe File opened for modification C:\windows\SysWOW64\VFV.exe RPPSK.exe File created C:\windows\SysWOW64\OGWBK.exe.bat IGXNBBS.exe File created C:\windows\SysWOW64\JZHHNO.exe.bat MUJK.exe File opened for modification C:\windows\SysWOW64\YFH.exe 2026-08-07_7d7cfad808204a3d71ee005db33f1ccc_elex_emotet_stop.exe File created C:\windows\SysWOW64\YETXJ.exe MMQ.exe File created C:\windows\SysWOW64\HMJSB.exe BMB.exe File created C:\windows\SysWOW64\KUJQK.exe ZBOY.exe File created C:\windows\SysWOW64\BBNCK.exe ZOJ.exe File created C:\windows\SysWOW64\LWNM.exe EGMUI.exe File created C:\windows\SysWOW64\XKMIVVZ.exe RWVHYS.exe File created C:\windows\SysWOW64\IKSPV.exe JZHHNO.exe File created C:\windows\SysWOW64\FCDEKGO.exe.bat ZCVQT.exe File opened for modification C:\windows\SysWOW64\TNPMF.exe GLHORJS.exe File created C:\windows\SysWOW64\SKBPN.exe XXW.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\WWHDV.exe.bat IBV.exe File created C:\windows\HNSMYHK.exe.bat XFQHVB.exe File created C:\windows\system\EGQ.exe.bat PDGLO.exe File created C:\windows\ZBOY.exe.bat FOKORII.exe File created C:\windows\system\MZBZBG.exe EGSFNB.exe File created C:\windows\MUJK.exe.bat URYGSOI.exe File created C:\windows\system\PCM.exe.bat OYIC.exe File created C:\windows\system\JDUV.exe.bat YLR.exe File created C:\windows\RWVHYS.exe.bat LWNM.exe File created C:\windows\NFEMO.exe.bat XKMIVVZ.exe File created C:\windows\system\ULDSUYU.exe.bat ZYZJKY.exe File created C:\windows\system\DFHHSF.exe.bat TFF.exe File opened for modification C:\windows\RSH.exe YFH.exe File created C:\windows\AFXNKN.exe.bat WPQ.exe File created C:\windows\system\ZOJ.exe.bat ZBQEY.exe File opened for modification C:\windows\DPWT.exe IURKRKX.exe File created C:\windows\system\YGFGR.exe YDTDMK.exe File created C:\windows\URYGSOI.exe.bat ZOPQ.exe File opened for modification C:\windows\KIYJDKQ.exe IKSPV.exe File created C:\windows\system\HZSLK.exe.bat PVO.exe File created C:\windows\PDGLO.exe UQB.exe File created C:\windows\system\CAMCOT.exe WZEP.exe File opened for modification C:\windows\system\CAMCOT.exe WZEP.exe File created C:\windows\LCQ.exe HMJSB.exe File created C:\windows\EYIFP.exe JDD.exe File created C:\windows\FZHHBF.exe.bat KMCQ.exe File created C:\windows\MUJK.exe URYGSOI.exe File opened for modification C:\windows\system\DABHRE.exe VMWAGGK.exe File opened for modification C:\windows\HNSMYHK.exe XFQHVB.exe File opened for modification C:\windows\PDGLO.exe UQB.exe File opened for modification C:\windows\system\XXW.exe RJXFGXM.exe File opened for modification C:\windows\HAMF.exe ZNM.exe File opened for modification C:\windows\system\JDUV.exe YLR.exe File created C:\windows\system\YGFGR.exe.bat YDTDMK.exe File created C:\windows\system\ZOPQ.exe PGNCBG.exe File created C:\windows\system\FCMD.exe.bat LKXS.exe File created C:\windows\system\ZCVQT.exe.bat BBNCK.exe File created C:\windows\APHN.exe.bat FCDEKGO.exe File created C:\windows\IGXNBBS.exe.bat EYIFP.exe File created C:\windows\FZHHBF.exe KMCQ.exe File created C:\windows\system\GXC.exe.bat MJXRUR.exe File opened for modification C:\windows\system\PGNCBG.exe ALE.exe File opened for modification C:\windows\OYIC.exe ULDSUYU.exe File created C:\windows\system\ZBQEY.exe TAJRP.exe File created C:\windows\system\KFJIRCL.exe GXC.exe File created C:\windows\system\KFJIRCL.exe.bat GXC.exe File opened for modification C:\windows\system\MMQ.exe EGQ.exe File created C:\windows\system\FCMD.exe LKXS.exe File created C:\windows\HNSMYHK.exe XFQHVB.exe File created C:\windows\FZC.exe.bat YETXJ.exe File created C:\windows\system\WZEP.exe FZC.exe File opened for modification C:\windows\AFXNKN.exe WPQ.exe File opened for modification C:\windows\FZHHBF.exe KMCQ.exe File created C:\windows\system\TQENZVT.exe JDUV.exe File opened for modification C:\windows\system\FCMD.exe LKXS.exe File opened for modification C:\windows\system\WZEP.exe FZC.exe File created C:\windows\system\CNERQGY.exe CAMCOT.exe File opened for modification C:\windows\WPQ.exe WMNJSFU.exe File created C:\windows\TAJRP.exe AFXNKN.exe File opened for modification C:\windows\system\TQENZVT.exe JDUV.exe File created C:\windows\system\TZAGG.exe KZG.exe File created C:\windows\OYIC.exe ULDSUYU.exe File opened for modification C:\windows\system\FOKORII.exe ZNCAI.exe File created C:\windows\XBOYISX.exe TTHQV.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 6032 cmd.exe 772 cmd.exe 4912 cmd.exe 2680 cmd.exe 1896 cmd.exe 4632 cmd.exe 4308 cmd.exe 3956 cmd.exe 5180 cmd.exe 6060 cmd.exe 2044 cmd.exe 3408 cmd.exe 5996 cmd.exe 1340 cmd.exe 3388 cmd.exe 1056 cmd.exe 6040 cmd.exe 5204 cmd.exe 3200 cmd.exe 1592 cmd.exe 1728 cmd.exe 4312 cmd.exe 3256 cmd.exe 4728 cmd.exe 1528 cmd.exe 1256 cmd.exe 3464 cmd.exe 4836 cmd.exe 3048 cmd.exe 5692 cmd.exe 1144 cmd.exe 5100 cmd.exe 992 cmd.exe 4316 cmd.exe 5804 cmd.exe 5932 cmd.exe 3412 cmd.exe 4348 cmd.exe 5572 cmd.exe 2208 cmd.exe 840 cmd.exe 2584 cmd.exe 1396 cmd.exe 3844 cmd.exe 5540 cmd.exe 4440 cmd.exe 4296 cmd.exe 1320 cmd.exe 1980 cmd.exe 5656 cmd.exe 4520 cmd.exe 5200 cmd.exe 5036 cmd.exe 5660 cmd.exe 5096 cmd.exe 4944 cmd.exe 5740 cmd.exe 3008 cmd.exe 1684 cmd.exe 2808 cmd.exe 4136 cmd.exe 4804 cmd.exe 256 cmd.exe 1096 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 4124 1324 WerFault.exe 87 760 5608 WerFault.exe 93 3812 4364 WerFault.exe 99 4488 5680 WerFault.exe 104 4416 4960 WerFault.exe 109 2172 4932 WerFault.exe 114 4716 2204 WerFault.exe 119 2184 3748 WerFault.exe 124 4888 5020 WerFault.exe 129 4316 2820 WerFault.exe 134 4112 5648 WerFault.exe 139 2060 1564 WerFault.exe 144 4580 4548 WerFault.exe 149 4736 4996 WerFault.exe 154 5112 2324 WerFault.exe 159 3408 3296 WerFault.exe 164 4536 808 WerFault.exe 169 556 4420 WerFault.exe 173 4212 1288 WerFault.exe 179 4748 720 WerFault.exe 184 5672 4676 WerFault.exe 189 1392 2108 WerFault.exe 194 2624 3440 WerFault.exe 199 204 5384 WerFault.exe 204 1008 1760 WerFault.exe 209 4752 4948 WerFault.exe 214 5868 3840 WerFault.exe 219 4840 2996 WerFault.exe 224 3088 1404 WerFault.exe 229 4316 3180 WerFault.exe 234 2552 5060 WerFault.exe 239 2312 5544 WerFault.exe 244 5960 2796 WerFault.exe 249 6048 5652 WerFault.exe 254 1816 1840 WerFault.exe 259 1228 1576 WerFault.exe 264 5868 1620 WerFault.exe 269 2956 5156 WerFault.exe 275 1548 4528 WerFault.exe 280 1508 5432 WerFault.exe 285 1216 4680 WerFault.exe 290 240 4856 WerFault.exe 295 3568 5092 WerFault.exe 300 1688 1448 WerFault.exe 305 4412 2792 WerFault.exe 310 4652 6100 WerFault.exe 315 3184 5536 WerFault.exe 320 1412 3264 WerFault.exe 325 2968 1424 WerFault.exe 330 3304 3348 WerFault.exe 335 5672 5412 WerFault.exe 340 408 4500 WerFault.exe 345 4104 3548 WerFault.exe 350 2948 4416 WerFault.exe 355 3808 3712 WerFault.exe 360 1524 4572 WerFault.exe 365 5724 4232 WerFault.exe 370 2968 4404 WerFault.exe 375 3468 5836 WerFault.exe 380 4352 6092 WerFault.exe 385 3476 6140 WerFault.exe 390 968 3516 WerFault.exe 395 4920 1768 WerFault.exe 400 724 3968 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language URYGSOI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DFHHSF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YFH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BMRY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WPQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZNM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XXW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RWVHYS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FZHHBF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NFEMO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TFF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XFQHVB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BMB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GXC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZSATFI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CZR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FAADX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZOJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language APHN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LWNM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VMWAGGK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FZC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZNCAI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SKBPN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XKMIVVZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YETXJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KLZZGII.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HMJSB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AGAXPHS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZBOY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KMCQ.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1324 2026-08-07_7d7cfad808204a3d71ee005db33f1ccc_elex_emotet_stop.exe 1324 2026-08-07_7d7cfad808204a3d71ee005db33f1ccc_elex_emotet_stop.exe 5608 YFH.exe 5608 YFH.exe 4364 RSH.exe 4364 RSH.exe 5680 IBV.exe 5680 IBV.exe 4960 WWHDV.exe 4960 WWHDV.exe 4932 HOO.exe 4932 HOO.exe 2204 VMWAGGK.exe 2204 VMWAGGK.exe 3748 DABHRE.exe 3748 DABHRE.exe 5020 SVKL.exe 5020 SVKL.exe 2820 HLL.exe 2820 HLL.exe 5648 NGXDXJL.exe 5648 NGXDXJL.exe 1564 XELYESU.exe 1564 XELYESU.exe 4548 BMRY.exe 4548 BMRY.exe 4996 LKXS.exe 4996 LKXS.exe 2324 FCMD.exe 2324 FCMD.exe 3296 XFQHVB.exe 3296 XFQHVB.exe 808 HNSMYHK.exe 808 HNSMYHK.exe 4420 AGAXPHS.exe 4420 AGAXPHS.exe 1288 UTEG.exe 1288 UTEG.exe 720 CZR.exe 720 CZR.exe 4676 BSUDLMZ.exe 4676 BSUDLMZ.exe 3440 UQB.exe 3440 UQB.exe 5384 PDGLO.exe 5384 PDGLO.exe 1760 EGQ.exe 1760 EGQ.exe 4948 MMQ.exe 4948 MMQ.exe 3840 YETXJ.exe 3840 YETXJ.exe 2996 FZC.exe 2996 FZC.exe 1404 WZEP.exe 1404 WZEP.exe 3180 CAMCOT.exe 3180 CAMCOT.exe 5060 CNERQGY.exe 5060 CNERQGY.exe 5544 XBJA.exe 5544 XBJA.exe 2796 KLZZGII.exe 2796 KLZZGII.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1324 2026-08-07_7d7cfad808204a3d71ee005db33f1ccc_elex_emotet_stop.exe 1324 2026-08-07_7d7cfad808204a3d71ee005db33f1ccc_elex_emotet_stop.exe 5608 YFH.exe 5608 YFH.exe 4364 RSH.exe 4364 RSH.exe 5680 IBV.exe 5680 IBV.exe 4960 WWHDV.exe 4960 WWHDV.exe 4932 HOO.exe 4932 HOO.exe 2204 VMWAGGK.exe 2204 VMWAGGK.exe 3748 DABHRE.exe 3748 DABHRE.exe 5020 SVKL.exe 5020 SVKL.exe 2820 HLL.exe 2820 HLL.exe 5648 NGXDXJL.exe 5648 NGXDXJL.exe 1564 XELYESU.exe 1564 XELYESU.exe 4548 BMRY.exe 4548 BMRY.exe 4996 LKXS.exe 4996 LKXS.exe 2324 FCMD.exe 2324 FCMD.exe 3296 XFQHVB.exe 3296 XFQHVB.exe 808 HNSMYHK.exe 808 HNSMYHK.exe 4420 AGAXPHS.exe 4420 AGAXPHS.exe 1288 UTEG.exe 1288 UTEG.exe 720 CZR.exe 720 CZR.exe 4676 BSUDLMZ.exe 4676 BSUDLMZ.exe 3440 UQB.exe 3440 UQB.exe 5384 PDGLO.exe 5384 PDGLO.exe 1760 EGQ.exe 1760 EGQ.exe 4948 MMQ.exe 4948 MMQ.exe 3840 YETXJ.exe 3840 YETXJ.exe 2996 FZC.exe 2996 FZC.exe 1404 WZEP.exe 1404 WZEP.exe 3180 CAMCOT.exe 3180 CAMCOT.exe 5060 CNERQGY.exe 5060 CNERQGY.exe 5544 XBJA.exe 5544 XBJA.exe 2796 KLZZGII.exe 2796 KLZZGII.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1324 wrote to memory of 1056 1324 2026-08-07_7d7cfad808204a3d71ee005db33f1ccc_elex_emotet_stop.exe 89 PID 1056 wrote to memory of 5608 1056 cmd.exe 93 PID 5608 wrote to memory of 2712 5608 YFH.exe 95 PID 2712 wrote to memory of 4364 2712 cmd.exe 99 PID 4364 wrote to memory of 3048 4364 RSH.exe 100 PID 3048 wrote to memory of 5680 3048 cmd.exe 104 PID 5680 wrote to memory of 248 5680 IBV.exe 105 PID 248 wrote to memory of 4960 248 cmd.exe 109 PID 4960 wrote to memory of 3844 4960 WWHDV.exe 110 PID 3844 wrote to memory of 4932 3844 cmd.exe 114 PID 4932 wrote to memory of 4712 4932 HOO.exe 115 PID 4712 wrote to memory of 2204 4712 cmd.exe 119 PID 2204 wrote to memory of 5572 2204 VMWAGGK.exe 120 PID 5572 wrote to memory of 3748 5572 cmd.exe 124 PID 3748 wrote to memory of 1536 3748 DABHRE.exe 125 PID 1536 wrote to memory of 5020 1536 cmd.exe 129 PID 5020 wrote to memory of 5912 5020 SVKL.exe 130 PID 5912 wrote to memory of 2820 5912 cmd.exe 134 PID 2820 wrote to memory of 2208 2820 HLL.exe 135 PID 2208 wrote to memory of 5648 2208 cmd.exe 139 PID 5648 wrote to memory of 5452 5648 NGXDXJL.exe 140 PID 5452 wrote to memory of 1564 5452 cmd.exe 144 PID 1564 wrote to memory of 3772 1564 XELYESU.exe 145 PID 3772 wrote to memory of 4548 3772 cmd.exe 149 PID 4548 wrote to memory of 3536 4548 BMRY.exe 150 PID 3536 wrote to memory of 4996 3536 cmd.exe 154 PID 4996 wrote to memory of 4180 4996 LKXS.exe 155 PID 4180 wrote to memory of 2324 4180 cmd.exe 159 PID 2324 wrote to memory of 5996 2324 FCMD.exe 160 PID 5996 wrote to memory of 3296 5996 cmd.exe 164 PID 3296 wrote to memory of 2268 3296 XFQHVB.exe 165 PID 2268 wrote to memory of 808 2268 cmd.exe 169 PID 808 wrote to memory of 5932 808 HNSMYHK.exe 170 PID 5932 wrote to memory of 4420 5932 cmd.exe 173 PID 4420 wrote to memory of 5692 4420 AGAXPHS.exe 175 PID 5692 wrote to memory of 1288 5692 cmd.exe 179 PID 1288 wrote to memory of 6040 1288 UTEG.exe 180 PID 6040 wrote to memory of 720 6040 cmd.exe 184 PID 720 wrote to memory of 2984 720 CZR.exe 185 PID 2984 wrote to memory of 4676 2984 cmd.exe 189 PID 4676 wrote to memory of 4336 4676 BSUDLMZ.exe 190 PID 4336 wrote to memory of 2108 4336 cmd.exe 194 PID 712 wrote to memory of 3440 712 cmd.exe 199 PID 3440 wrote to memory of 5200 3440 UQB.exe 200 PID 5200 wrote to memory of 5384 5200 cmd.exe 204 PID 5384 wrote to memory of 1728 5384 PDGLO.exe 205 PID 1728 wrote to memory of 1760 1728 cmd.exe 209 PID 1760 wrote to memory of 5540 1760 EGQ.exe 210 PID 5540 wrote to memory of 4948 5540 cmd.exe 214 PID 4948 wrote to memory of 3728 4948 MMQ.exe 215 PID 3728 wrote to memory of 3840 3728 cmd.exe 219 PID 3840 wrote to memory of 3412 3840 YETXJ.exe 220 PID 3412 wrote to memory of 2996 3412 cmd.exe 224 PID 2996 wrote to memory of 2304 2996 FZC.exe 225 PID 2304 wrote to memory of 1404 2304 cmd.exe 229 PID 1404 wrote to memory of 4776 1404 WZEP.exe 230 PID 4776 wrote to memory of 3180 4776 cmd.exe 234 PID 3180 wrote to memory of 4632 3180 CAMCOT.exe 235 PID 4632 wrote to memory of 5060 4632 cmd.exe 239 PID 5060 wrote to memory of 4848 5060 CNERQGY.exe 240 PID 4848 wrote to memory of 5544 4848 cmd.exe 244 PID 5544 wrote to memory of 3776 5544 XBJA.exe 245 PID 3776 wrote to memory of 2796 3776 cmd.exe 249 PID 2796 wrote to memory of 5992 2796 KLZZGII.exe 250
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_7d7cfad808204a3d71ee005db33f1ccc_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-07_7d7cfad808204a3d71ee005db33f1ccc_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YFH.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\windows\SysWOW64\YFH.exeC:\windows\system32\YFH.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5608 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RSH.exe.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\windows\RSH.exeC:\windows\RSH.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IBV.exe.bat" "6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\windows\system\IBV.exeC:\windows\system\IBV.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5680 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WWHDV.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:248 -
C:\windows\system\WWHDV.exeC:\windows\system\WWHDV.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HOO.exe.bat" "10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\windows\SysWOW64\HOO.exeC:\windows\system32\HOO.exe11⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VMWAGGK.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\windows\system\VMWAGGK.exeC:\windows\system\VMWAGGK.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DABHRE.exe.bat" "14⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5572 -
C:\windows\system\DABHRE.exeC:\windows\system\DABHRE.exe15⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SVKL.exe.bat" "16⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\windows\SVKL.exeC:\windows\SVKL.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HLL.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:5912 -
C:\windows\SysWOW64\HLL.exeC:\windows\system32\HLL.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NGXDXJL.exe.bat" "20⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\windows\SysWOW64\NGXDXJL.exeC:\windows\system32\NGXDXJL.exe21⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5648 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XELYESU.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:5452 -
C:\windows\system\XELYESU.exeC:\windows\system\XELYESU.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BMRY.exe.bat" "24⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\windows\SysWOW64\BMRY.exeC:\windows\system32\BMRY.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LKXS.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:3536 -
C:\windows\SysWOW64\LKXS.exeC:\windows\system32\LKXS.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FCMD.exe.bat" "28⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\windows\system\FCMD.exeC:\windows\system\FCMD.exe29⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XFQHVB.exe.bat" "30⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5996 -
C:\windows\system\XFQHVB.exeC:\windows\system\XFQHVB.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HNSMYHK.exe.bat" "32⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\windows\HNSMYHK.exeC:\windows\HNSMYHK.exe33⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AGAXPHS.exe.bat" "34⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5932 -
C:\windows\system\AGAXPHS.exeC:\windows\system\AGAXPHS.exe35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UTEG.exe.bat" "36⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5692 -
C:\windows\system\UTEG.exeC:\windows\system\UTEG.exe37⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CZR.exe.bat" "38⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6040 -
C:\windows\system\CZR.exeC:\windows\system\CZR.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BSUDLMZ.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\windows\system\BSUDLMZ.exeC:\windows\system\BSUDLMZ.exe41⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FAADX.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\windows\FAADX.exeC:\windows\FAADX.exe43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UQB.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:712 -
C:\windows\SysWOW64\UQB.exeC:\windows\system32\UQB.exe45⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PDGLO.exe.bat" "46⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5200 -
C:\windows\PDGLO.exeC:\windows\PDGLO.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EGQ.exe.bat" "48⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\windows\system\EGQ.exeC:\windows\system\EGQ.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MMQ.exe.bat" "50⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5540 -
C:\windows\system\MMQ.exeC:\windows\system\MMQ.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YETXJ.exe.bat" "52⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\windows\SysWOW64\YETXJ.exeC:\windows\system32\YETXJ.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FZC.exe.bat" "54⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\windows\FZC.exeC:\windows\FZC.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WZEP.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\windows\system\WZEP.exeC:\windows\system\WZEP.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CAMCOT.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\windows\system\CAMCOT.exeC:\windows\system\CAMCOT.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CNERQGY.exe.bat" "60⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\windows\system\CNERQGY.exeC:\windows\system\CNERQGY.exe61⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XBJA.exe.bat" "62⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\windows\XBJA.exeC:\windows\XBJA.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KLZZGII.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:3776 -
C:\windows\SysWOW64\KLZZGII.exeC:\windows\system32\KLZZGII.exe65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BMB.exe.bat" "66⤵PID:5992
-
C:\windows\system\BMB.exeC:\windows\system\BMB.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HMJSB.exe.bat" "68⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5204 -
C:\windows\SysWOW64\HMJSB.exeC:\windows\system32\HMJSB.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LCQ.exe.bat" "70⤵
- System Location Discovery: System Language Discovery
PID:1200 -
C:\windows\LCQ.exeC:\windows\LCQ.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RPPSK.exe.bat" "72⤵PID:3980
-
C:\windows\SysWOW64\RPPSK.exeC:\windows\system32\RPPSK.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1620 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VFV.exe.bat" "74⤵PID:5940
-
C:\windows\SysWOW64\VFV.exeC:\windows\system32\VFV.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5156 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZNCAI.exe.bat" "76⤵PID:5936
-
C:\windows\SysWOW64\ZNCAI.exeC:\windows\system32\ZNCAI.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4528 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FOKORII.exe.bat" "78⤵PID:1820
-
C:\windows\system\FOKORII.exeC:\windows\system\FOKORII.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZBOY.exe.bat" "80⤵PID:2960
-
C:\windows\ZBOY.exeC:\windows\ZBOY.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4680 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KUJQK.exe.bat" "82⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5036 -
C:\windows\SysWOW64\KUJQK.exeC:\windows\system32\KUJQK.exe83⤵
- Executes dropped EXE
PID:4856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WMNJSFU.exe.bat" "84⤵PID:2312
-
C:\windows\WMNJSFU.exeC:\windows\WMNJSFU.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WPQ.exe.bat" "86⤵PID:4408
-
C:\windows\WPQ.exeC:\windows\WPQ.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AFXNKN.exe.bat" "88⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4312 -
C:\windows\AFXNKN.exeC:\windows\AFXNKN.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2792 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TAJRP.exe.bat" "90⤵PID:3672
-
C:\windows\TAJRP.exeC:\windows\TAJRP.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZBQEY.exe.bat" "92⤵
- Executes a command shell one-liner
PID:1144 -
C:\windows\system\ZBQEY.exeC:\windows\system\ZBQEY.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZOJ.exe.bat" "94⤵PID:2368
-
C:\windows\system\ZOJ.exeC:\windows\system\ZOJ.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BBNCK.exe.bat" "96⤵PID:6036
-
C:\windows\SysWOW64\BBNCK.exeC:\windows\system32\BBNCK.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZCVQT.exe.bat" "98⤵
- System Location Discovery: System Language Discovery
PID:4120 -
C:\windows\system\ZCVQT.exeC:\windows\system\ZCVQT.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3348 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FCDEKGO.exe.bat" "100⤵
- Executes a command shell one-liner
PID:4348 -
C:\windows\SysWOW64\FCDEKGO.exeC:\windows\system32\FCDEKGO.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\APHN.exe.bat" "102⤵PID:3824
-
C:\windows\APHN.exeC:\windows\APHN.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GLHORJS.exe.bat" "104⤵PID:2812
-
C:\windows\SysWOW64\GLHORJS.exeC:\windows\system32\GLHORJS.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TNPMF.exe.bat" "106⤵
- System Location Discovery: System Language Discovery
PID:624 -
C:\windows\SysWOW64\TNPMF.exeC:\windows\system32\TNPMF.exe107⤵
- Executes dropped EXE
PID:4416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EGSFNB.exe.bat" "108⤵PID:5116
-
C:\windows\EGSFNB.exeC:\windows\EGSFNB.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MZBZBG.exe.bat" "110⤵
- System Location Discovery: System Language Discovery
PID:916 -
C:\windows\system\MZBZBG.exeC:\windows\system\MZBZBG.exe111⤵
- Executes dropped EXE
PID:4572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RJXFGXM.exe.bat" "112⤵
- System Location Discovery: System Language Discovery
PID:1932 -
C:\windows\RJXFGXM.exeC:\windows\RJXFGXM.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4232 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XXW.exe.bat" "114⤵PID:1900
-
C:\windows\system\XXW.exeC:\windows\system\XXW.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SKBPN.exe.bat" "116⤵PID:1972
-
C:\windows\SysWOW64\SKBPN.exeC:\windows\system32\SKBPN.exe117⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NFGZYAF.exe.bat" "118⤵
- System Location Discovery: System Language Discovery
PID:4928 -
C:\windows\NFGZYAF.exeC:\windows\NFGZYAF.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JDD.exe.bat" "120⤵PID:108
-
C:\windows\SysWOW64\JDD.exeC:\windows\system32\JDD.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6140
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-