Analysis
- max time kernel
84s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/08/2026, 11:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-08_7cc35cade46c3500b17ad2f26d68d276_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-08_7cc35cade46c3500b17ad2f26d68d276_elex_emotet_stop.exe
- Size 208KB
- Sample260808-nt85lswckf
- SHA256 99b1048ec4805ab01c2fb542562707427fac4525f6dad332b3f970cd6680462c
- MD5 7cc35cade46c3500b17ad2f26d68d276
- SHA1 74bfbba7ec2a30ad28df09fb72e48beb0b88a01b
- SHA512 eefb6dd5047d9be7227ff568337e189ec402296e003aeb6bf0b218ee66cf2c90c33302aed47812830a6c9ec5eaa3f1626fef9ad462199333e8dbd31c0c671e63
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlcdL+LOfe4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFlc5+LOWkEj1
- TLSH T1B3247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3680 DDGA.exe 256 VRGF.exe 5436 SRHH.exe 2560 NCYGCU.exe 5904 IPD.exe 2392 ASHLSSU.exe 3528 ZDJBBY.exe 5540 MOAZ.exe 460 NJEVUZ.exe 4908 VWI.exe 4512 EXKP.exe 2752 USUTUPT.exe 4888 JIV.exe 2888 WSL.exe 624 MIMJV.exe 5508 MMQ.exe 4652 FHUIG.exe 1632 SRKHU.exe 2084 GXKK.exe 3336 SFRSIW.exe 3708 HAAX.exe 4160 ZDEAHY.exe 2396 FZDB.exe 252 HWRWTK.exe 3148 XRAA.exe 5200 RFFJOE.exe 3916 XAES.exe 5284 ELTADZG.exe 2516 NTV.exe 4468 IGAPQ.exe 2732 MWHPDWL.exe 5080 MRLS.exe 3468 FUP.exe 2872 KAHDMY.exe 2164 ENM.exe 4532 KJDWTA.exe 2416 YTTM.exe 4280 SHYERL.exe 5340 IXZV.exe 1252 SUFP.exe 5036 FXVOTSY.exe 3584 OGP.exe 824 DBGYIK.exe 2244 VJIDTHL.exe 3844 EJCQX.exe 4496 XMOLCDO.exe 5816 CNWZT.exe 4600 INWNCZR.exe 4260 WLEZE.exe 5764 GIJ.exe 1820 ETMJUZG.exe 5416 IJBJ.exe 5012 SHGD.exe 1856 GSPCCDY.exe 4320 MFODH.exe 4760 ZQE.exe 1216 DYLBH.exe 3304 UGN.exe 4628 NJRKQ.exe 2060 AMZ.exe 8 GHYKJC.exe 2428 VCIO.exe 2728 BYHPZ.exe 3320 DVNJ.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\DBGYIK.exe OGP.exe File created C:\windows\SysWOW64\DBGYIK.exe.bat OGP.exe File opened for modification C:\windows\SysWOW64\SRKHU.exe FHUIG.exe File opened for modification C:\windows\SysWOW64\SRHH.exe VRGF.exe File created C:\windows\SysWOW64\ZDJBBY.exe ASHLSSU.exe File opened for modification C:\windows\SysWOW64\WSL.exe JIV.exe File created C:\windows\SysWOW64\GSPCCDY.exe.bat SHGD.exe File opened for modification C:\windows\SysWOW64\ZQE.exe MFODH.exe File created C:\windows\SysWOW64\MIMJV.exe WSL.exe File opened for modification C:\windows\SysWOW64\HWRWTK.exe FZDB.exe File created C:\windows\SysWOW64\XAES.exe RFFJOE.exe File created C:\windows\SysWOW64\VJIDTHL.exe DBGYIK.exe File opened for modification C:\windows\SysWOW64\ETMJUZG.exe GIJ.exe File created C:\windows\SysWOW64\ZQE.exe.bat MFODH.exe File opened for modification C:\windows\SysWOW64\KOUALL.exe IZOGDDA.exe File created C:\windows\SysWOW64\CMOMYC.exe HYJC.exe File opened for modification C:\windows\SysWOW64\NCYGCU.exe SRHH.exe File opened for modification C:\windows\SysWOW64\XAES.exe RFFJOE.exe File created C:\windows\SysWOW64\DBGYIK.exe OGP.exe File created C:\windows\SysWOW64\XMOLCDO.exe EJCQX.exe File created C:\windows\SysWOW64\DVNJ.exe.bat BYHPZ.exe File opened for modification C:\windows\SysWOW64\IXQLHEF.exe ARDFWYJ.exe File created C:\windows\SysWOW64\CMOMYC.exe.bat HYJC.exe File created C:\windows\SysWOW64\UYF.exe CDBCXB.exe File created C:\windows\SysWOW64\SRKHU.exe.bat FHUIG.exe File created C:\windows\SysWOW64\SRHH.exe.bat VRGF.exe File opened for modification C:\windows\SysWOW64\USUTUPT.exe EXKP.exe File created C:\windows\SysWOW64\MWHPDWL.exe.bat IGAPQ.exe File opened for modification C:\windows\SysWOW64\VJIDTHL.exe DBGYIK.exe File created C:\windows\SysWOW64\IXQLHEF.exe.bat ARDFWYJ.exe File created C:\windows\SysWOW64\XAEI.exe FFAMB.exe File opened for modification C:\windows\SysWOW64\CMOMYC.exe HYJC.exe File created C:\windows\SysWOW64\HWRWTK.exe FZDB.exe File created C:\windows\SysWOW64\KAHDMY.exe.bat FUP.exe File created C:\windows\SysWOW64\IXZV.exe SHYERL.exe File created C:\windows\SysWOW64\VBVCR.exe.bat UYF.exe File created C:\windows\SysWOW64\USUTUPT.exe EXKP.exe File created C:\windows\SysWOW64\GXKK.exe SRKHU.exe File created C:\windows\SysWOW64\XAES.exe.bat RFFJOE.exe File created C:\windows\SysWOW64\ETMJUZG.exe GIJ.exe File created C:\windows\SysWOW64\ETMJUZG.exe.bat GIJ.exe File created C:\windows\SysWOW64\BYHPZ.exe VCIO.exe File created C:\windows\SysWOW64\BNHEXE.exe.bat FMFCTAZ.exe File created C:\windows\SysWOW64\UYF.exe.bat CDBCXB.exe File created C:\windows\SysWOW64\WSL.exe.bat JIV.exe File opened for modification C:\windows\SysWOW64\KAHDMY.exe FUP.exe File created C:\windows\SysWOW64\BNHEXE.exe FMFCTAZ.exe File opened for modification C:\windows\SysWOW64\BNHEXE.exe FMFCTAZ.exe File opened for modification C:\windows\SysWOW64\JHZIA.exe WXJRLPA.exe File created C:\windows\SysWOW64\JHZIA.exe.bat WXJRLPA.exe File opened for modification C:\windows\SysWOW64\VBVCR.exe UYF.exe File opened for modification C:\windows\SysWOW64\VQOZAD.exe AUKQ.exe File opened for modification C:\windows\SysWOW64\MIMJV.exe WSL.exe File created C:\windows\SysWOW64\HWRWTK.exe.bat FZDB.exe File opened for modification C:\windows\SysWOW64\MWHPDWL.exe IGAPQ.exe File created C:\windows\SysWOW64\SHYERL.exe YTTM.exe File created C:\windows\SysWOW64\VJIDTHL.exe.bat DBGYIK.exe File created C:\windows\SysWOW64\SHGD.exe.bat IJBJ.exe File opened for modification C:\windows\SysWOW64\XAEI.exe FFAMB.exe File opened for modification C:\windows\SysWOW64\GXKK.exe SRKHU.exe File created C:\windows\SysWOW64\MIMJV.exe.bat WSL.exe File opened for modification C:\windows\SysWOW64\SHYERL.exe YTTM.exe File opened for modification C:\windows\SysWOW64\IXZV.exe SHYERL.exe File opened for modification C:\windows\SysWOW64\GSPCCDY.exe SHGD.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\system\HHIS.exe FJCY.exe File opened for modification C:\windows\system\YOALBAK.exe VBVCR.exe File created C:\windows\system\GHYKJC.exe.bat AMZ.exe File created C:\windows\ZPTKLH.exe.bat HMIOFJB.exe File opened for modification C:\windows\QCQA.exe IXQLHEF.exe File opened for modification C:\windows\system\RCPLFQE.exe CMOMYC.exe File opened for modification C:\windows\system\SFOQIS.exe ZCKM.exe File opened for modification C:\windows\WMDIMTB.exe HWC.exe File created C:\windows\EXKP.exe.bat VWI.exe File created C:\windows\RDIDESX.exe.bat BNHEXE.exe File opened for modification C:\windows\GYSIP.exe RDIDESX.exe File created C:\windows\FHUIG.exe.bat MMQ.exe File created C:\windows\HAAX.exe.bat SFRSIW.exe File opened for modification C:\windows\system\IGAPQ.exe NTV.exe File opened for modification C:\windows\SUFP.exe IXZV.exe File created C:\windows\CNWZT.exe.bat XMOLCDO.exe File opened for modification C:\windows\system\WLEZE.exe INWNCZR.exe File created C:\windows\GIJ.exe WLEZE.exe File opened for modification C:\windows\system\DYLBH.exe ZQE.exe File opened for modification C:\windows\ZDEAHY.exe HAAX.exe File created C:\windows\ENM.exe KAHDMY.exe File created C:\windows\system\ASXOYXM.exe ZPTKLH.exe File opened for modification C:\windows\JSZT.exe ASXOYXM.exe File created C:\windows\GYSIP.exe RDIDESX.exe File created C:\windows\ZXAH.exe.bat JHZIA.exe File created C:\windows\EXKP.exe VWI.exe File created C:\windows\JIV.exe.bat USUTUPT.exe File opened for modification C:\windows\system\MMQ.exe MIMJV.exe File created C:\windows\FZDB.exe.bat ZDEAHY.exe File created C:\windows\XRAA.exe HWRWTK.exe File created C:\windows\CNWZT.exe XMOLCDO.exe File created C:\windows\system\DYLBH.exe.bat ZQE.exe File created C:\windows\system\HMIOFJB.exe IBF.exe File created C:\windows\JIV.exe USUTUPT.exe File opened for modification C:\windows\system\FXVOTSY.exe SUFP.exe File created C:\windows\system\IJBJ.exe ETMJUZG.exe File created C:\windows\system\AMZ.exe.bat NJRKQ.exe File opened for modification C:\windows\system\VCIO.exe GHYKJC.exe File opened for modification C:\windows\system\FFAMB.exe QCQA.exe File opened for modification C:\windows\system\HYJC.exe XAEI.exe File created C:\windows\XNMCTAS.exe.bat ZXAH.exe File opened for modification C:\windows\NTV.exe ELTADZG.exe File created C:\windows\XNMCTAS.exe ZXAH.exe File created C:\windows\system\NMDMQKM.exe.bat GWC.exe File created C:\windows\system\ASHLSSU.exe.bat IPD.exe File created C:\windows\system\MRLS.exe MWHPDWL.exe File opened for modification C:\windows\ENM.exe KAHDMY.exe File opened for modification C:\windows\IZOGDDA.exe YBBMOUR.exe File opened for modification C:\windows\ZXAH.exe JHZIA.exe File created C:\windows\system\NMDMQKM.exe GWC.exe File created C:\windows\system\VWI.exe NJEVUZ.exe File created C:\windows\FZDB.exe ZDEAHY.exe File created C:\windows\system\ELTADZG.exe XAES.exe File opened for modification C:\windows\INWNCZR.exe CNWZT.exe File created C:\windows\system\VCIO.exe.bat GHYKJC.exe File created C:\windows\GYSIP.exe.bat RDIDESX.exe File created C:\windows\SFRSIW.exe GXKK.exe File opened for modification C:\windows\system\MRLS.exe MWHPDWL.exe File opened for modification C:\windows\system\IJBJ.exe ETMJUZG.exe File created C:\windows\JSZT.exe ASXOYXM.exe File created C:\windows\system\CDBCXB.exe.bat SFOQIS.exe File opened for modification C:\windows\YTTM.exe KJDWTA.exe File created C:\windows\ZPTKLH.exe HMIOFJB.exe File created C:\windows\system\FMFCTAZ.exe RCPLFQE.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2188 cmd.exe 2620 cmd.exe 4736 cmd.exe 3028 cmd.exe 4192 cmd.exe 1740 cmd.exe 2760 cmd.exe 6088 cmd.exe 4964 cmd.exe 5704 cmd.exe 1040 cmd.exe 2952 cmd.exe 5908 cmd.exe 1108 cmd.exe 2932 cmd.exe 2216 cmd.exe 2744 cmd.exe 1500 cmd.exe 4460 cmd.exe 5456 cmd.exe 5552 cmd.exe 4832 cmd.exe 1420 cmd.exe 4272 cmd.exe 3652 cmd.exe 4644 cmd.exe 1060 cmd.exe 4336 cmd.exe 1096 cmd.exe 1756 cmd.exe 520 cmd.exe 4820 cmd.exe 5448 cmd.exe 1560 cmd.exe 2868 cmd.exe 3232 cmd.exe 3384 cmd.exe 2548 cmd.exe 4676 cmd.exe 4780 cmd.exe 1272 cmd.exe 4836 cmd.exe 5660 cmd.exe 5608 cmd.exe 4972 cmd.exe 5424 cmd.exe 4408 cmd.exe 4212 cmd.exe 4904 cmd.exe 4404 cmd.exe 4632 cmd.exe 4548 cmd.exe 5392 cmd.exe 5832 cmd.exe 5600 cmd.exe 4492 cmd.exe 1436 cmd.exe 6004 cmd.exe 2044 cmd.exe 1276 cmd.exe 4612 cmd.exe 5076 cmd.exe 4572 cmd.exe 1284 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 1700 3824 WerFault.exe 87 2068 3680 WerFault.exe 92 5420 256 WerFault.exe 99 1796 5436 WerFault.exe 104 5048 2560 WerFault.exe 109 2504 5904 WerFault.exe 114 4676 2392 WerFault.exe 119 3664 3528 WerFault.exe 124 3396 5540 WerFault.exe 129 6108 460 WerFault.exe 133 6088 4908 WerFault.exe 139 3584 4512 WerFault.exe 144 1436 2752 WerFault.exe 149 3148 4888 WerFault.exe 154 3012 2888 WerFault.exe 159 5496 624 WerFault.exe 164 4904 5508 WerFault.exe 169 5356 4652 WerFault.exe 174 4492 1632 WerFault.exe 179 4336 2084 WerFault.exe 184 1912 3336 WerFault.exe 188 1328 3708 WerFault.exe 194 2776 4160 WerFault.exe 199 360 2396 WerFault.exe 204 4220 252 WerFault.exe 209 3844 3148 WerFault.exe 214 2216 5200 WerFault.exe 219 6040 3916 WerFault.exe 224 608 5284 WerFault.exe 229 4748 2516 WerFault.exe 234 1672 4468 WerFault.exe 239 800 2732 WerFault.exe 244 4256 5080 WerFault.exe 249 248 3468 WerFault.exe 254 4520 2872 WerFault.exe 259 1664 2164 WerFault.exe 264 4332 4532 WerFault.exe 269 5636 2416 WerFault.exe 275 1708 4280 WerFault.exe 280 2500 5340 WerFault.exe 285 4648 1252 WerFault.exe 290 5988 5036 WerFault.exe 295 4832 3584 WerFault.exe 300 3228 824 WerFault.exe 305 2224 2244 WerFault.exe 310 2216 3844 WerFault.exe 315 700 4496 WerFault.exe 320 2976 5816 WerFault.exe 325 5620 4600 WerFault.exe 330 5348 4260 WerFault.exe 335 4476 5764 WerFault.exe 340 5044 1820 WerFault.exe 345 916 5416 WerFault.exe 350 3684 5012 WerFault.exe 355 5016 1856 WerFault.exe 360 1880 4320 WerFault.exe 365 3928 4760 WerFault.exe 370 788 1216 WerFault.exe 375 3604 3304 WerFault.exe 380 2608 4628 WerFault.exe 385 4836 2060 WerFault.exe 390 916 8 WerFault.exe 395 4636 2428 WerFault.exe 400 5864 2728 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IPD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXKP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MIMJV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FXVOTSY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NJRKQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VRGF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NCYGCU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZDEAHY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FZDB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MRLS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YNJXNHW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_7cc35cade46c3500b17ad2f26d68d276_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GXKK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MWHPDWL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FUP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ENM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EJCQX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NTV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ETMJUZG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DVNJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZXAH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VJIDTHL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CDBCXB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WMDIMTB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MFODH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RFFJOE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SUFP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GIJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HWC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FHUIG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMOMYC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZQE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language USUTUPT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3824 2026-08-08_7cc35cade46c3500b17ad2f26d68d276_elex_emotet_stop.exe 3824 2026-08-08_7cc35cade46c3500b17ad2f26d68d276_elex_emotet_stop.exe 3680 DDGA.exe 3680 DDGA.exe 256 VRGF.exe 256 VRGF.exe 5436 SRHH.exe 5436 SRHH.exe 2560 NCYGCU.exe 2560 NCYGCU.exe 5904 IPD.exe 5904 IPD.exe 2392 ASHLSSU.exe 2392 ASHLSSU.exe 3528 ZDJBBY.exe 3528 ZDJBBY.exe 5540 MOAZ.exe 5540 MOAZ.exe 460 NJEVUZ.exe 460 NJEVUZ.exe 4908 VWI.exe 4908 VWI.exe 4512 EXKP.exe 4512 EXKP.exe 2752 USUTUPT.exe 2752 USUTUPT.exe 4888 JIV.exe 4888 JIV.exe 2888 WSL.exe 2888 WSL.exe 624 MIMJV.exe 624 MIMJV.exe 5508 MMQ.exe 5508 MMQ.exe 4652 FHUIG.exe 4652 FHUIG.exe 1632 SRKHU.exe 1632 SRKHU.exe 2084 GXKK.exe 2084 GXKK.exe 3336 SFRSIW.exe 3336 SFRSIW.exe 3708 HAAX.exe 3708 HAAX.exe 4160 ZDEAHY.exe 4160 ZDEAHY.exe 2396 FZDB.exe 2396 FZDB.exe 252 HWRWTK.exe 252 HWRWTK.exe 3148 XRAA.exe 3148 XRAA.exe 5200 RFFJOE.exe 5200 RFFJOE.exe 3916 XAES.exe 3916 XAES.exe 5284 ELTADZG.exe 5284 ELTADZG.exe 2516 NTV.exe 2516 NTV.exe 4468 IGAPQ.exe 4468 IGAPQ.exe 2732 MWHPDWL.exe 2732 MWHPDWL.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 3824 2026-08-08_7cc35cade46c3500b17ad2f26d68d276_elex_emotet_stop.exe 3824 2026-08-08_7cc35cade46c3500b17ad2f26d68d276_elex_emotet_stop.exe 3680 DDGA.exe 3680 DDGA.exe 256 VRGF.exe 256 VRGF.exe 5436 SRHH.exe 5436 SRHH.exe 2560 NCYGCU.exe 2560 NCYGCU.exe 5904 IPD.exe 5904 IPD.exe 2392 ASHLSSU.exe 2392 ASHLSSU.exe 3528 ZDJBBY.exe 3528 ZDJBBY.exe 5540 MOAZ.exe 5540 MOAZ.exe 460 NJEVUZ.exe 460 NJEVUZ.exe 4908 VWI.exe 4908 VWI.exe 4512 EXKP.exe 4512 EXKP.exe 2752 USUTUPT.exe 2752 USUTUPT.exe 4888 JIV.exe 4888 JIV.exe 2888 WSL.exe 2888 WSL.exe 624 MIMJV.exe 624 MIMJV.exe 5508 MMQ.exe 5508 MMQ.exe 4652 FHUIG.exe 4652 FHUIG.exe 1632 SRKHU.exe 1632 SRKHU.exe 2084 GXKK.exe 2084 GXKK.exe 3336 SFRSIW.exe 3336 SFRSIW.exe 3708 HAAX.exe 3708 HAAX.exe 4160 ZDEAHY.exe 4160 ZDEAHY.exe 2396 FZDB.exe 2396 FZDB.exe 252 HWRWTK.exe 252 HWRWTK.exe 3148 XRAA.exe 3148 XRAA.exe 5200 RFFJOE.exe 5200 RFFJOE.exe 3916 XAES.exe 3916 XAES.exe 5284 ELTADZG.exe 5284 ELTADZG.exe 2516 NTV.exe 2516 NTV.exe 4468 IGAPQ.exe 4468 IGAPQ.exe 2732 MWHPDWL.exe 2732 MWHPDWL.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3824 wrote to memory of 1740 3824 2026-08-08_7cc35cade46c3500b17ad2f26d68d276_elex_emotet_stop.exe 89 PID 1740 wrote to memory of 3680 1740 cmd.exe 92 PID 3680 wrote to memory of 3312 3680 DDGA.exe 95 PID 3312 wrote to memory of 256 3312 cmd.exe 99 PID 256 wrote to memory of 4372 256 VRGF.exe 100 PID 4372 wrote to memory of 5436 4372 cmd.exe 104 PID 5436 wrote to memory of 4548 5436 SRHH.exe 105 PID 4548 wrote to memory of 2560 4548 cmd.exe 109 PID 2560 wrote to memory of 4460 2560 NCYGCU.exe 110 PID 4460 wrote to memory of 5904 4460 cmd.exe 114 PID 5904 wrote to memory of 5648 5904 IPD.exe 115 PID 5648 wrote to memory of 2392 5648 cmd.exe 119 PID 2392 wrote to memory of 3300 2392 ASHLSSU.exe 120 PID 3300 wrote to memory of 3528 3300 cmd.exe 124 PID 3528 wrote to memory of 4516 3528 ZDJBBY.exe 125 PID 4516 wrote to memory of 5540 4516 cmd.exe 129 PID 5540 wrote to memory of 3332 5540 MOAZ.exe 130 PID 3332 wrote to memory of 460 3332 cmd.exe 133 PID 460 wrote to memory of 2760 460 NJEVUZ.exe 135 PID 2760 wrote to memory of 4908 2760 cmd.exe 139 PID 4908 wrote to memory of 2148 4908 VWI.exe 140 PID 2148 wrote to memory of 4512 2148 cmd.exe 144 PID 4512 wrote to memory of 4580 4512 EXKP.exe 145 PID 4580 wrote to memory of 2752 4580 cmd.exe 149 PID 2752 wrote to memory of 4736 2752 USUTUPT.exe 150 PID 4736 wrote to memory of 4888 4736 cmd.exe 154 PID 4888 wrote to memory of 5456 4888 JIV.exe 155 PID 5456 wrote to memory of 2888 5456 cmd.exe 159 PID 2888 wrote to memory of 4752 2888 WSL.exe 160 PID 4752 wrote to memory of 624 4752 cmd.exe 164 PID 624 wrote to memory of 1644 624 MIMJV.exe 165 PID 1644 wrote to memory of 5508 1644 cmd.exe 169 PID 5508 wrote to memory of 6092 5508 MMQ.exe 170 PID 6092 wrote to memory of 4652 6092 cmd.exe 174 PID 4652 wrote to memory of 4188 4652 FHUIG.exe 175 PID 4188 wrote to memory of 1632 4188 cmd.exe 179 PID 1632 wrote to memory of 3392 1632 SRKHU.exe 180 PID 3392 wrote to memory of 2084 3392 cmd.exe 184 PID 2084 wrote to memory of 3172 2084 GXKK.exe 185 PID 3172 wrote to memory of 3336 3172 cmd.exe 188 PID 3336 wrote to memory of 3652 3336 SFRSIW.exe 190 PID 3652 wrote to memory of 3708 3652 cmd.exe 194 PID 3708 wrote to memory of 4728 3708 HAAX.exe 195 PID 4728 wrote to memory of 4160 4728 cmd.exe 199 PID 4160 wrote to memory of 4644 4160 ZDEAHY.exe 200 PID 4644 wrote to memory of 2396 4644 cmd.exe 204 PID 2396 wrote to memory of 5232 2396 FZDB.exe 205 PID 5232 wrote to memory of 252 5232 cmd.exe 209 PID 252 wrote to memory of 2720 252 HWRWTK.exe 210 PID 2720 wrote to memory of 3148 2720 cmd.exe 214 PID 3148 wrote to memory of 6012 3148 XRAA.exe 215 PID 6012 wrote to memory of 5200 6012 cmd.exe 219 PID 5200 wrote to memory of 2692 5200 RFFJOE.exe 220 PID 2692 wrote to memory of 3916 2692 cmd.exe 224 PID 3916 wrote to memory of 3504 3916 XAES.exe 225 PID 3504 wrote to memory of 5284 3504 cmd.exe 229 PID 5284 wrote to memory of 4408 5284 ELTADZG.exe 230 PID 4408 wrote to memory of 2516 4408 cmd.exe 234 PID 2516 wrote to memory of 1060 2516 NTV.exe 235 PID 1060 wrote to memory of 4468 1060 cmd.exe 239 PID 4468 wrote to memory of 2792 4468 IGAPQ.exe 240 PID 2792 wrote to memory of 2732 2792 cmd.exe 244 PID 2732 wrote to memory of 3456 2732 MWHPDWL.exe 245 PID 3456 wrote to memory of 5080 3456 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_7cc35cade46c3500b17ad2f26d68d276_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_7cc35cade46c3500b17ad2f26d68d276_elex_emotet_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DDGA.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\windows\system\DDGA.exeC:\windows\system\DDGA.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VRGF.exe.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\windows\VRGF.exeC:\windows\VRGF.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SRHH.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\windows\SysWOW64\SRHH.exeC:\windows\system32\SRHH.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NCYGCU.exe.bat" "8⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\windows\SysWOW64\NCYGCU.exeC:\windows\system32\NCYGCU.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IPD.exe.bat" "10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\windows\IPD.exeC:\windows\IPD.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ASHLSSU.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:5648 -
C:\windows\system\ASHLSSU.exeC:\windows\system\ASHLSSU.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZDJBBY.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:3300 -
C:\windows\SysWOW64\ZDJBBY.exeC:\windows\system32\ZDJBBY.exe15⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MOAZ.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\windows\SysWOW64\MOAZ.exeC:\windows\system32\MOAZ.exe17⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NJEVUZ.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\windows\NJEVUZ.exeC:\windows\NJEVUZ.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VWI.exe.bat" "20⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\windows\system\VWI.exeC:\windows\system\VWI.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EXKP.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\windows\EXKP.exeC:\windows\EXKP.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\USUTUPT.exe.bat" "24⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\windows\SysWOW64\USUTUPT.exeC:\windows\system32\USUTUPT.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JIV.exe.bat" "26⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\windows\JIV.exeC:\windows\JIV.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WSL.exe.bat" "28⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5456 -
C:\windows\SysWOW64\WSL.exeC:\windows\system32\WSL.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MIMJV.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\windows\SysWOW64\MIMJV.exeC:\windows\system32\MIMJV.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MMQ.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\windows\system\MMQ.exeC:\windows\system\MMQ.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FHUIG.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:6092 -
C:\windows\FHUIG.exeC:\windows\FHUIG.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SRKHU.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\windows\SysWOW64\SRKHU.exeC:\windows\system32\SRKHU.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GXKK.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\windows\SysWOW64\GXKK.exeC:\windows\system32\GXKK.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SFRSIW.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\windows\SFRSIW.exeC:\windows\SFRSIW.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HAAX.exe.bat" "42⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\windows\HAAX.exeC:\windows\HAAX.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZDEAHY.exe.bat" "44⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\windows\ZDEAHY.exeC:\windows\ZDEAHY.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FZDB.exe.bat" "46⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\windows\FZDB.exeC:\windows\FZDB.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HWRWTK.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:5232 -
C:\windows\SysWOW64\HWRWTK.exeC:\windows\system32\HWRWTK.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XRAA.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\windows\XRAA.exeC:\windows\XRAA.exe51⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RFFJOE.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:6012 -
C:\windows\RFFJOE.exeC:\windows\RFFJOE.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XAES.exe.bat" "54⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\windows\SysWOW64\XAES.exeC:\windows\system32\XAES.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ELTADZG.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:3504 -
C:\windows\system\ELTADZG.exeC:\windows\system\ELTADZG.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NTV.exe.bat" "58⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\windows\NTV.exeC:\windows\NTV.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IGAPQ.exe.bat" "60⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\windows\system\IGAPQ.exeC:\windows\system\IGAPQ.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MWHPDWL.exe.bat" "62⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\windows\SysWOW64\MWHPDWL.exeC:\windows\system32\MWHPDWL.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MRLS.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\windows\system\MRLS.exeC:\windows\system\MRLS.exe65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FUP.exe.bat" "66⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1276 -
C:\windows\system\FUP.exeC:\windows\system\FUP.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KAHDMY.exe.bat" "68⤵PID:204
-
C:\windows\SysWOW64\KAHDMY.exeC:\windows\system32\KAHDMY.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ENM.exe.bat" "70⤵PID:828
-
C:\windows\ENM.exeC:\windows\ENM.exe71⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2164 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KJDWTA.exe.bat" "72⤵PID:3040
-
C:\windows\SysWOW64\KJDWTA.exeC:\windows\system32\KJDWTA.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YTTM.exe.bat" "74⤵PID:4716
-
C:\windows\YTTM.exeC:\windows\YTTM.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SHYERL.exe.bat" "76⤵
- Executes a command shell one-liner
PID:5392 -
C:\windows\SysWOW64\SHYERL.exeC:\windows\system32\SHYERL.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IXZV.exe.bat" "78⤵PID:2716
-
C:\windows\SysWOW64\IXZV.exeC:\windows\system32\IXZV.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5340 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SUFP.exe.bat" "80⤵
- Executes a command shell one-liner
PID:4336 -
C:\windows\SUFP.exeC:\windows\SUFP.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FXVOTSY.exe.bat" "82⤵PID:4124
-
C:\windows\system\FXVOTSY.exeC:\windows\system\FXVOTSY.exe83⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5036 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OGP.exe.bat" "84⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5832 -
C:\windows\OGP.exeC:\windows\OGP.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DBGYIK.exe.bat" "86⤵
- Executes a command shell one-liner
PID:6088 -
C:\windows\SysWOW64\DBGYIK.exeC:\windows\system32\DBGYIK.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VJIDTHL.exe.bat" "88⤵
- Executes a command shell one-liner
PID:1096 -
C:\windows\SysWOW64\VJIDTHL.exeC:\windows\system32\VJIDTHL.exe89⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EJCQX.exe.bat" "90⤵
- Executes a command shell one-liner
PID:4212 -
C:\windows\system\EJCQX.exeC:\windows\system\EJCQX.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XMOLCDO.exe.bat" "92⤵PID:2280
-
C:\windows\SysWOW64\XMOLCDO.exeC:\windows\system32\XMOLCDO.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CNWZT.exe.bat" "94⤵
- Executes a command shell one-liner
PID:4904 -
C:\windows\CNWZT.exeC:\windows\CNWZT.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\INWNCZR.exe.bat" "96⤵PID:1176
-
C:\windows\INWNCZR.exeC:\windows\INWNCZR.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WLEZE.exe.bat" "98⤵
- System Location Discovery: System Language Discovery
PID:3068 -
C:\windows\system\WLEZE.exeC:\windows\system\WLEZE.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GIJ.exe.bat" "100⤵
- Executes a command shell one-liner
PID:1272 -
C:\windows\GIJ.exeC:\windows\GIJ.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ETMJUZG.exe.bat" "102⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4612 -
C:\windows\SysWOW64\ETMJUZG.exeC:\windows\system32\ETMJUZG.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IJBJ.exe.bat" "104⤵
- System Location Discovery: System Language Discovery
PID:5664 -
C:\windows\system\IJBJ.exeC:\windows\system\IJBJ.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SHGD.exe.bat" "106⤵PID:2372
-
C:\windows\SysWOW64\SHGD.exeC:\windows\system32\SHGD.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GSPCCDY.exe.bat" "108⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5600 -
C:\windows\SysWOW64\GSPCCDY.exeC:\windows\system32\GSPCCDY.exe109⤵
- Executes dropped EXE
PID:1856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MFODH.exe.bat" "110⤵PID:1664
-
C:\windows\MFODH.exeC:\windows\MFODH.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZQE.exe.bat" "112⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5448 -
C:\windows\SysWOW64\ZQE.exeC:\windows\system32\ZQE.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DYLBH.exe.bat" "114⤵
- Executes a command shell one-liner
PID:3028 -
C:\windows\system\DYLBH.exeC:\windows\system\DYLBH.exe115⤵
- Executes dropped EXE
PID:1216 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UGN.exe.bat" "116⤵PID:2552
-
C:\windows\UGN.exeC:\windows\UGN.exe117⤵
- Executes dropped EXE
PID:3304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NJRKQ.exe.bat" "118⤵
- System Location Discovery: System Language Discovery
PID:5796 -
C:\windows\system\NJRKQ.exeC:\windows\system\NJRKQ.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4628 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AMZ.exe.bat" "120⤵PID:2992
-
C:\windows\system\AMZ.exeC:\windows\system\AMZ.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2060
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-