Analysis
- max time kernel
89s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/08/2026, 15:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-08_bcb6db6498b2ce6461bf6c7877827e8b_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-08_bcb6db6498b2ce6461bf6c7877827e8b_elex_emotet_stop.exe
- Size 208KB
- Sample260808-s28k9szbph
- SHA256 425fae0b4eedd1f93f9645e99b8a42c21e50ce7c33f64fb390c639a7cb219aa7
- MD5 bcb6db6498b2ce6461bf6c7877827e8b
- SHA1 317b8b5e27a4941d83fb07ff859dad1999296132
- SHA512 e4af423860dbf96cfffe1f3cc1fef321e75e822cfc02088eafde306873b6a1944dfc56341681376c1de84420b81cbf1131b5774b565860cde63f76be4157ed2e
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlldL+LOf54pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFll5+LORkEj1
- TLSH T1B2247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3532 BSXEI.exe 1664 KISNU.exe 244 HNK.exe 1412 QVMINTJ.exe 4220 CDSI.exe 3820 VHWLFB.exe 4576 VMWAGGK.exe 1308 XZT.exe 8 VABXAI.exe 4748 FXOJP.exe 5348 ATTBZQX.exe 1388 PJU.exe 1316 VJCGPG.exe 4280 EJEL.exe 2148 TENXE.exe 4860 JVO.exe 2288 DQTYV.exe 3296 YDYPXLY.exe 1508 LGGGL.exe 4688 HMGSV.exe 2080 JJU.exe 5936 WUC.exe 2236 ICJLD.exe 2440 RLLQGR.exe 1116 SGP.exe 5916 MTUDW.exe 4568 HOYMGGC.exe 1532 AJCQMW.exe 1156 AMG.exe 4844 VALVB.exe 3752 KDCAMZD.exe 5472 QQUIR.exe 5600 FTL.exe 3460 FZDB.exe 4620 LZLPVE.exe 4344 EUP.exe 4504 FXSON.exe 3816 KXACWMJ.exe 1180 UGC.exe 4000 MBGLFZV.exe 2000 YRULS.exe 5240 TERUCRX.exe 5848 XUGC.exe 4364 TSERVT.exe 3056 ONJJFTC.exe 2908 XNLO.exe 2296 BDROVJ.exe 4424 RLSN.exe 4776 PJL.exe 2100 VELRTN.exe 3544 QSP.exe 3316 WSX.exe 2720 OVBKSXM.exe 4388 PQFO.exe 4640 VQMBPP.exe 120 EZOGSUR.exe 4316 BEME.exe 2040 JKZ.exe 3216 WUHJYF.exe 1304 EAHXASN.exe 4580 GYNKHAN.exe 3200 KGUS.exe 5560 VYXKC.exe 2364 HOD.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\XAFHD.exe VCS.exe File created C:\windows\SysWOW64\OEN.exe JYYOZ.exe File created C:\windows\SysWOW64\XNLO.exe.bat ONJJFTC.exe File created C:\windows\SysWOW64\BDROVJ.exe XNLO.exe File created C:\windows\SysWOW64\QPFQ.exe HOD.exe File opened for modification C:\windows\SysWOW64\SGOTRX.exe XTKKO.exe File created C:\windows\SysWOW64\APW.exe.bat OHQJJE.exe File opened for modification C:\windows\SysWOW64\RLLQGR.exe ICJLD.exe File created C:\windows\SysWOW64\SGOTRX.exe XTKKO.exe File created C:\windows\SysWOW64\OIZ.exe.bat XAFHD.exe File created C:\windows\SysWOW64\QHIW.exe.bat NMDMQKM.exe File created C:\windows\SysWOW64\VHWLFB.exe.bat CDSI.exe File opened for modification C:\windows\SysWOW64\PQFO.exe OVBKSXM.exe File opened for modification C:\windows\SysWOW64\BEME.exe EZOGSUR.exe File opened for modification C:\windows\SysWOW64\YDYPXLY.exe DQTYV.exe File opened for modification C:\windows\SysWOW64\YRULS.exe MBGLFZV.exe File created C:\windows\SysWOW64\XNLO.exe ONJJFTC.exe File created C:\windows\SysWOW64\JKZ.exe BEME.exe File created C:\windows\SysWOW64\JYYOZ.exe APW.exe File created C:\windows\SysWOW64\VHWLFB.exe CDSI.exe File created C:\windows\SysWOW64\PJU.exe ATTBZQX.exe File created C:\windows\SysWOW64\TCF.exe.bat NCXUQS.exe File created C:\windows\SysWOW64\PMAHJR.exe.bat FLYUG.exe File created C:\windows\SysWOW64\XAFHD.exe.bat VCS.exe File created C:\windows\SysWOW64\CDSI.exe.bat QVMINTJ.exe File created C:\windows\SysWOW64\TSERVT.exe.bat XUGC.exe File opened for modification C:\windows\SysWOW64\OIZ.exe XAFHD.exe File opened for modification C:\windows\SysWOW64\HDLPU.exe OIZ.exe File opened for modification C:\windows\SysWOW64\SCVVW.exe XPZ.exe File created C:\windows\SysWOW64\TENXE.exe EJEL.exe File created C:\windows\SysWOW64\PQFO.exe OVBKSXM.exe File created C:\windows\SysWOW64\GYNKHAN.exe EAHXASN.exe File created C:\windows\SysWOW64\HDLPU.exe OIZ.exe File created C:\windows\SysWOW64\AJCQMW.exe.bat HOYMGGC.exe File opened for modification C:\windows\SysWOW64\WUHJYF.exe JKZ.exe File created C:\windows\SysWOW64\ATTBZQX.exe.bat FXOJP.exe File created C:\windows\SysWOW64\YRULS.exe MBGLFZV.exe File created C:\windows\SysWOW64\JKZ.exe.bat BEME.exe File created C:\windows\SysWOW64\SPSL.exe.bat SJS.exe File opened for modification C:\windows\SysWOW64\QVMINTJ.exe HNK.exe File created C:\windows\SysWOW64\BDROVJ.exe.bat XNLO.exe File opened for modification C:\windows\SysWOW64\VQMBPP.exe PQFO.exe File created C:\windows\SysWOW64\VZRSGN.exe RRLS.exe File opened for modification C:\windows\SysWOW64\PMAHJR.exe FLYUG.exe File opened for modification C:\windows\SysWOW64\AMHIJW.exe UMIV.exe File created C:\windows\SysWOW64\OIZ.exe XAFHD.exe File created C:\windows\SysWOW64\SCVVW.exe.bat XPZ.exe File created C:\windows\SysWOW64\WSX.exe.bat QSP.exe File created C:\windows\SysWOW64\VQMBPP.exe.bat PQFO.exe File opened for modification C:\windows\SysWOW64\JKZ.exe BEME.exe File created C:\windows\SysWOW64\RRLS.exe JML.exe File created C:\windows\SysWOW64\SPSL.exe SJS.exe File created C:\windows\SysWOW64\QHIW.exe NMDMQKM.exe File opened for modification C:\windows\SysWOW64\OEN.exe JYYOZ.exe File opened for modification C:\windows\SysWOW64\PJU.exe ATTBZQX.exe File created C:\windows\SysWOW64\APW.exe OHQJJE.exe File opened for modification C:\windows\SysWOW64\TSERVT.exe XUGC.exe File created C:\windows\SysWOW64\BEME.exe EZOGSUR.exe File created C:\windows\SysWOW64\RLLQGR.exe.bat ICJLD.exe File created C:\windows\SysWOW64\PQFO.exe.bat OVBKSXM.exe File opened for modification C:\windows\SysWOW64\TCF.exe NCXUQS.exe File created C:\windows\SysWOW64\XAFHD.exe VCS.exe File created C:\windows\SysWOW64\PJU.exe.bat ATTBZQX.exe File created C:\windows\SysWOW64\TENXE.exe.bat EJEL.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\VALVB.exe AMG.exe File created C:\windows\FZDB.exe FTL.exe File opened for modification C:\windows\system\ZGQSNNK.exe ZDMWI.exe File created C:\windows\system\YIGJGRI.exe.bat AMHIJW.exe File opened for modification C:\windows\KIWLGV.exe EIOX.exe File created C:\windows\system\DODKZBW.exe.bat ZYXKN.exe File created C:\windows\system\EUP.exe.bat LZLPVE.exe File created C:\windows\PSR.exe.bat JSJ.exe File created C:\windows\system\SJS.exe.bat SGOTRX.exe File created C:\windows\LIXDHPA.exe.bat BLSJ.exe File created C:\windows\system\NMDMQKM.exe.bat ELBZNF.exe File created C:\windows\system\XZT.exe.bat VMWAGGK.exe File created C:\windows\FXOJP.exe VABXAI.exe File opened for modification C:\windows\VALVB.exe AMG.exe File created C:\windows\QSP.exe VELRTN.exe File created C:\windows\VYXKC.exe KGUS.exe File opened for modification C:\windows\system\UJBZH.exe KIZM.exe File created C:\windows\system\UJBZH.exe.bat KIZM.exe File created C:\windows\ZLQ.exe ZGQSNNK.exe File created C:\windows\system\VMWAGGK.exe VHWLFB.exe File opened for modification C:\windows\ICJLD.exe WUC.exe File created C:\windows\QQUIR.exe KDCAMZD.exe File created C:\windows\system\VELRTN.exe PJL.exe File opened for modification C:\windows\system\YIGJGRI.exe AMHIJW.exe File created C:\windows\system\YCIT.exe DODKZBW.exe File created C:\windows\system\ECQHSD.exe YCIT.exe File created C:\windows\LIXDHPA.exe BLSJ.exe File created C:\windows\HNK.exe.bat KISNU.exe File created C:\windows\system\TDDJCFU.exe.bat NCVWT.exe File created C:\windows\system\SJS.exe SGOTRX.exe File opened for modification C:\windows\FLYUG.exe ZLQ.exe File opened for modification C:\windows\UMIV.exe PMAHJR.exe File opened for modification C:\windows\system\YCIT.exe DODKZBW.exe File opened for modification C:\windows\ELBZNF.exe LIXDHPA.exe File created C:\windows\system\UGC.exe KXACWMJ.exe File created C:\windows\system\XUGC.exe.bat TERUCRX.exe File created C:\windows\OVBKSXM.exe WSX.exe File created C:\windows\system\EZOGSUR.exe.bat VQMBPP.exe File created C:\windows\VSYVX.exe.bat PSR.exe File created C:\windows\system\ZDMWI.exe.bat TCF.exe File created C:\windows\ZLQ.exe.bat ZGQSNNK.exe File created C:\windows\KIWLGV.exe.bat EIOX.exe File created C:\windows\system\AMG.exe AJCQMW.exe File created C:\windows\system\BSXEI.exe.bat 2026-08-08_bcb6db6498b2ce6461bf6c7877827e8b_elex_emotet_stop.exe File created C:\windows\DQTYV.exe.bat JVO.exe File created C:\windows\system\LGGGL.exe.bat YDYPXLY.exe File created C:\windows\system\JJU.exe HMGSV.exe File opened for modification C:\windows\system\KXACWMJ.exe FXSON.exe File created C:\windows\system\KGUS.exe GYNKHAN.exe File created C:\windows\DQTYV.exe JVO.exe File opened for modification C:\windows\HNK.exe KISNU.exe File opened for modification C:\windows\VABXAI.exe XZT.exe File created C:\windows\VJCGPG.exe PJU.exe File created C:\windows\FZDB.exe.bat FTL.exe File created C:\windows\PSR.exe JSJ.exe File created C:\windows\KISNU.exe BSXEI.exe File opened for modification C:\windows\system\VMWAGGK.exe VHWLFB.exe File opened for modification C:\windows\system\XZT.exe VMWAGGK.exe File created C:\windows\system\LGGGL.exe YDYPXLY.exe File created C:\windows\ICJLD.exe WUC.exe File created C:\windows\KDCAMZD.exe VALVB.exe File opened for modification C:\windows\TERUCRX.exe YRULS.exe File opened for modification C:\windows\OVBKSXM.exe WSX.exe File created C:\windows\VABXAI.exe.bat XZT.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5668 cmd.exe 1728 cmd.exe 4572 cmd.exe 3864 cmd.exe 2708 cmd.exe 5452 cmd.exe 3904 cmd.exe 3500 cmd.exe 4556 cmd.exe 1512 cmd.exe 3052 cmd.exe 4836 cmd.exe 3020 cmd.exe 4964 cmd.exe 704 cmd.exe 5808 cmd.exe 4596 cmd.exe 1796 cmd.exe 4400 cmd.exe 5684 cmd.exe 4500 cmd.exe 2600 cmd.exe 1748 cmd.exe 956 cmd.exe 2144 cmd.exe 3584 cmd.exe 2776 cmd.exe 4912 cmd.exe 2740 cmd.exe 3844 cmd.exe 5032 cmd.exe 5772 cmd.exe 4440 cmd.exe 2992 cmd.exe 4904 cmd.exe 5132 cmd.exe 5880 cmd.exe 2704 cmd.exe 5864 cmd.exe 4520 cmd.exe 1048 cmd.exe 5984 cmd.exe 4976 cmd.exe 3008 cmd.exe 4876 cmd.exe 5200 cmd.exe 5552 cmd.exe 4832 cmd.exe 3448 cmd.exe 3624 cmd.exe 5624 cmd.exe 3644 cmd.exe 6052 cmd.exe 2872 cmd.exe 4616 cmd.exe 3748 cmd.exe 5688 cmd.exe 4712 cmd.exe 5944 cmd.exe 2036 cmd.exe 1492 cmd.exe 2412 cmd.exe 3480 cmd.exe 2628 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 3012 1084 WerFault.exe 87 5100 3532 WerFault.exe 93 204 1664 WerFault.exe 99 6104 244 WerFault.exe 104 4812 1412 WerFault.exe 109 1952 4220 WerFault.exe 114 3992 3820 WerFault.exe 119 2748 4576 WerFault.exe 124 5780 1308 WerFault.exe 129 5600 8 WerFault.exe 134 3748 4748 WerFault.exe 139 4940 5348 WerFault.exe 144 5872 1388 WerFault.exe 149 6000 1316 WerFault.exe 154 1224 4280 WerFault.exe 159 1748 2148 WerFault.exe 164 2464 4860 WerFault.exe 169 1212 2288 WerFault.exe 174 1796 3296 WerFault.exe 179 2492 1508 WerFault.exe 184 1272 4688 WerFault.exe 189 5776 2080 WerFault.exe 194 4100 5936 WerFault.exe 199 4668 2236 WerFault.exe 204 3440 2440 WerFault.exe 209 3644 1116 WerFault.exe 214 1152 5916 WerFault.exe 219 3244 4568 WerFault.exe 224 5884 1532 WerFault.exe 229 3008 1156 WerFault.exe 234 1636 4844 WerFault.exe 239 4584 3752 WerFault.exe 244 2720 5472 WerFault.exe 249 2728 5600 WerFault.exe 254 3852 3460 WerFault.exe 259 1956 4620 WerFault.exe 264 4296 4344 WerFault.exe 269 3968 4504 WerFault.exe 274 5204 3816 WerFault.exe 279 1048 1180 WerFault.exe 284 5260 4000 WerFault.exe 289 4420 2000 WerFault.exe 294 4756 5240 WerFault.exe 299 5552 5848 WerFault.exe 304 2180 4364 WerFault.exe 309 2404 3056 WerFault.exe 314 240 2908 WerFault.exe 319 2568 2296 WerFault.exe 324 2024 4424 WerFault.exe 329 1648 4776 WerFault.exe 334 5652 2100 WerFault.exe 339 2144 3544 WerFault.exe 344 1068 3316 WerFault.exe 349 3112 2720 WerFault.exe 354 1448 4388 WerFault.exe 359 5720 4640 WerFault.exe 364 304 120 WerFault.exe 369 5332 4316 WerFault.exe 374 1604 2040 WerFault.exe 379 4328 3216 WerFault.exe 384 1188 1304 WerFault.exe 389 4648 4580 WerFault.exe 394 2912 3200 WerFault.exe 399 2004 5560 WerFault.exe 404 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ELBZNF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KXACWMJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NCVWT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WUHJYF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HMGSV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WSX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YIGJGRI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JVO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VALVB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BDROVJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AMHIJW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BEME.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DODKZBW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MQAFHU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZDMWI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KIZM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XNLO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PJU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UGC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZLQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VMWAGGK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XUGC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EAHXASN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PMAHJR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EJEL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TSERVT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KISNU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PQFO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UJBZH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FLYUG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OEN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NCXUQS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FZDB.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1084 2026-08-08_bcb6db6498b2ce6461bf6c7877827e8b_elex_emotet_stop.exe 1084 2026-08-08_bcb6db6498b2ce6461bf6c7877827e8b_elex_emotet_stop.exe 3532 BSXEI.exe 3532 BSXEI.exe 1664 KISNU.exe 1664 KISNU.exe 244 HNK.exe 244 HNK.exe 1412 QVMINTJ.exe 1412 QVMINTJ.exe 4220 CDSI.exe 4220 CDSI.exe 3820 VHWLFB.exe 3820 VHWLFB.exe 4576 VMWAGGK.exe 4576 VMWAGGK.exe 1308 XZT.exe 1308 XZT.exe 8 VABXAI.exe 8 VABXAI.exe 4748 FXOJP.exe 4748 FXOJP.exe 5348 ATTBZQX.exe 5348 ATTBZQX.exe 1388 PJU.exe 1388 PJU.exe 1316 VJCGPG.exe 1316 VJCGPG.exe 4280 EJEL.exe 4280 EJEL.exe 2148 TENXE.exe 2148 TENXE.exe 4860 JVO.exe 4860 JVO.exe 2288 DQTYV.exe 2288 DQTYV.exe 3296 YDYPXLY.exe 3296 YDYPXLY.exe 1508 LGGGL.exe 1508 LGGGL.exe 4688 HMGSV.exe 4688 HMGSV.exe 2080 JJU.exe 2080 JJU.exe 5936 WUC.exe 5936 WUC.exe 2236 ICJLD.exe 2236 ICJLD.exe 2440 RLLQGR.exe 2440 RLLQGR.exe 1116 SGP.exe 1116 SGP.exe 5916 MTUDW.exe 5916 MTUDW.exe 4568 HOYMGGC.exe 4568 HOYMGGC.exe 1532 AJCQMW.exe 1532 AJCQMW.exe 1156 AMG.exe 1156 AMG.exe 4844 VALVB.exe 4844 VALVB.exe 3752 KDCAMZD.exe 3752 KDCAMZD.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1084 2026-08-08_bcb6db6498b2ce6461bf6c7877827e8b_elex_emotet_stop.exe 1084 2026-08-08_bcb6db6498b2ce6461bf6c7877827e8b_elex_emotet_stop.exe 3532 BSXEI.exe 3532 BSXEI.exe 1664 KISNU.exe 1664 KISNU.exe 244 HNK.exe 244 HNK.exe 1412 QVMINTJ.exe 1412 QVMINTJ.exe 4220 CDSI.exe 4220 CDSI.exe 3820 VHWLFB.exe 3820 VHWLFB.exe 4576 VMWAGGK.exe 4576 VMWAGGK.exe 1308 XZT.exe 1308 XZT.exe 8 VABXAI.exe 8 VABXAI.exe 4748 FXOJP.exe 4748 FXOJP.exe 5348 ATTBZQX.exe 5348 ATTBZQX.exe 1388 PJU.exe 1388 PJU.exe 1316 VJCGPG.exe 1316 VJCGPG.exe 4280 EJEL.exe 4280 EJEL.exe 2148 TENXE.exe 2148 TENXE.exe 4860 JVO.exe 4860 JVO.exe 2288 DQTYV.exe 2288 DQTYV.exe 3296 YDYPXLY.exe 3296 YDYPXLY.exe 1508 LGGGL.exe 1508 LGGGL.exe 4688 HMGSV.exe 4688 HMGSV.exe 2080 JJU.exe 2080 JJU.exe 5936 WUC.exe 5936 WUC.exe 2236 ICJLD.exe 2236 ICJLD.exe 2440 RLLQGR.exe 2440 RLLQGR.exe 1116 SGP.exe 1116 SGP.exe 5916 MTUDW.exe 5916 MTUDW.exe 4568 HOYMGGC.exe 4568 HOYMGGC.exe 1532 AJCQMW.exe 1532 AJCQMW.exe 1156 AMG.exe 1156 AMG.exe 4844 VALVB.exe 4844 VALVB.exe 3752 KDCAMZD.exe 3752 KDCAMZD.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1084 wrote to memory of 5824 1084 2026-08-08_bcb6db6498b2ce6461bf6c7877827e8b_elex_emotet_stop.exe 89 PID 5824 wrote to memory of 3532 5824 cmd.exe 93 PID 3532 wrote to memory of 2016 3532 BSXEI.exe 95 PID 2016 wrote to memory of 1664 2016 cmd.exe 99 PID 1664 wrote to memory of 6052 1664 KISNU.exe 100 PID 6052 wrote to memory of 244 6052 cmd.exe 104 PID 244 wrote to memory of 4992 244 HNK.exe 105 PID 4992 wrote to memory of 1412 4992 cmd.exe 109 PID 1412 wrote to memory of 3500 1412 QVMINTJ.exe 110 PID 3500 wrote to memory of 4220 3500 cmd.exe 114 PID 4220 wrote to memory of 2628 4220 CDSI.exe 115 PID 2628 wrote to memory of 3820 2628 cmd.exe 119 PID 3820 wrote to memory of 1568 3820 VHWLFB.exe 120 PID 1568 wrote to memory of 4576 1568 cmd.exe 124 PID 4576 wrote to memory of 1728 4576 VMWAGGK.exe 125 PID 1728 wrote to memory of 1308 1728 cmd.exe 129 PID 1308 wrote to memory of 4556 1308 XZT.exe 130 PID 4556 wrote to memory of 8 4556 cmd.exe 134 PID 8 wrote to memory of 5200 8 VABXAI.exe 135 PID 5200 wrote to memory of 4748 5200 cmd.exe 139 PID 4748 wrote to memory of 2496 4748 FXOJP.exe 140 PID 2496 wrote to memory of 5348 2496 cmd.exe 144 PID 5348 wrote to memory of 3344 5348 ATTBZQX.exe 145 PID 3344 wrote to memory of 1388 3344 cmd.exe 149 PID 1388 wrote to memory of 2872 1388 PJU.exe 150 PID 2872 wrote to memory of 1316 2872 cmd.exe 154 PID 1316 wrote to memory of 1512 1316 VJCGPG.exe 155 PID 1512 wrote to memory of 4280 1512 cmd.exe 159 PID 4280 wrote to memory of 4616 4280 EJEL.exe 160 PID 4616 wrote to memory of 2148 4616 cmd.exe 164 PID 2148 wrote to memory of 5436 2148 TENXE.exe 165 PID 5436 wrote to memory of 4860 5436 cmd.exe 169 PID 4860 wrote to memory of 5248 4860 JVO.exe 170 PID 5248 wrote to memory of 2288 5248 cmd.exe 174 PID 2288 wrote to memory of 1492 2288 DQTYV.exe 175 PID 1492 wrote to memory of 3296 1492 cmd.exe 179 PID 3296 wrote to memory of 3976 3296 YDYPXLY.exe 180 PID 3976 wrote to memory of 1508 3976 cmd.exe 184 PID 1508 wrote to memory of 4240 1508 LGGGL.exe 185 PID 4240 wrote to memory of 4688 4240 cmd.exe 189 PID 4688 wrote to memory of 5772 4688 HMGSV.exe 190 PID 5772 wrote to memory of 2080 5772 cmd.exe 194 PID 2080 wrote to memory of 5864 2080 JJU.exe 195 PID 5864 wrote to memory of 5936 5864 cmd.exe 199 PID 5936 wrote to memory of 3748 5936 WUC.exe 200 PID 3748 wrote to memory of 2236 3748 cmd.exe 204 PID 2236 wrote to memory of 5868 2236 ICJLD.exe 205 PID 5868 wrote to memory of 2440 5868 cmd.exe 209 PID 2440 wrote to memory of 4440 2440 RLLQGR.exe 210 PID 4440 wrote to memory of 1116 4440 cmd.exe 214 PID 1116 wrote to memory of 1928 1116 SGP.exe 215 PID 1928 wrote to memory of 5916 1928 cmd.exe 219 PID 5916 wrote to memory of 3204 5916 MTUDW.exe 220 PID 3204 wrote to memory of 4568 3204 cmd.exe 224 PID 4568 wrote to memory of 1748 4568 HOYMGGC.exe 225 PID 1748 wrote to memory of 1532 1748 cmd.exe 229 PID 1532 wrote to memory of 704 1532 AJCQMW.exe 230 PID 704 wrote to memory of 1156 704 cmd.exe 234 PID 1156 wrote to memory of 1212 1156 AMG.exe 235 PID 1212 wrote to memory of 4844 1212 cmd.exe 239 PID 4844 wrote to memory of 4572 4844 VALVB.exe 240 PID 4572 wrote to memory of 3752 4572 cmd.exe 244 PID 3752 wrote to memory of 4244 3752 KDCAMZD.exe 245 PID 4244 wrote to memory of 5472 4244 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_bcb6db6498b2ce6461bf6c7877827e8b_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_bcb6db6498b2ce6461bf6c7877827e8b_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BSXEI.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:5824 -
C:\windows\system\BSXEI.exeC:\windows\system\BSXEI.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KISNU.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\windows\KISNU.exeC:\windows\KISNU.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HNK.exe.bat" "6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6052 -
C:\windows\HNK.exeC:\windows\HNK.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QVMINTJ.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\windows\SysWOW64\QVMINTJ.exeC:\windows\system32\QVMINTJ.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CDSI.exe.bat" "10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\windows\SysWOW64\CDSI.exeC:\windows\system32\CDSI.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VHWLFB.exe.bat" "12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\windows\SysWOW64\VHWLFB.exeC:\windows\system32\VHWLFB.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VMWAGGK.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\windows\system\VMWAGGK.exeC:\windows\system\VMWAGGK.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XZT.exe.bat" "16⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\windows\system\XZT.exeC:\windows\system\XZT.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VABXAI.exe.bat" "18⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\windows\VABXAI.exeC:\windows\VABXAI.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FXOJP.exe.bat" "20⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5200 -
C:\windows\FXOJP.exeC:\windows\FXOJP.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ATTBZQX.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\windows\SysWOW64\ATTBZQX.exeC:\windows\system32\ATTBZQX.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5348 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PJU.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\windows\SysWOW64\PJU.exeC:\windows\system32\PJU.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VJCGPG.exe.bat" "26⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\windows\VJCGPG.exeC:\windows\VJCGPG.exe27⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EJEL.exe.bat" "28⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\windows\EJEL.exeC:\windows\EJEL.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TENXE.exe.bat" "30⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\windows\SysWOW64\TENXE.exeC:\windows\system32\TENXE.exe31⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JVO.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:5436 -
C:\windows\SysWOW64\JVO.exeC:\windows\system32\JVO.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DQTYV.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:5248 -
C:\windows\DQTYV.exeC:\windows\DQTYV.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YDYPXLY.exe.bat" "36⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\windows\SysWOW64\YDYPXLY.exeC:\windows\system32\YDYPXLY.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LGGGL.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\windows\system\LGGGL.exeC:\windows\system\LGGGL.exe39⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HMGSV.exe.bat" "40⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\windows\HMGSV.exeC:\windows\HMGSV.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JJU.exe.bat" "42⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5772 -
C:\windows\system\JJU.exeC:\windows\system\JJU.exe43⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WUC.exe.bat" "44⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5864 -
C:\windows\WUC.exeC:\windows\WUC.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ICJLD.exe.bat" "46⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\windows\ICJLD.exeC:\windows\ICJLD.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RLLQGR.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:5868 -
C:\windows\SysWOW64\RLLQGR.exeC:\windows\system32\RLLQGR.exe49⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SGP.exe.bat" "50⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\windows\system\SGP.exeC:\windows\system\SGP.exe51⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MTUDW.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\windows\MTUDW.exeC:\windows\MTUDW.exe53⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HOYMGGC.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:3204 -
C:\windows\system\HOYMGGC.exeC:\windows\system\HOYMGGC.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AJCQMW.exe.bat" "56⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\windows\SysWOW64\AJCQMW.exeC:\windows\system32\AJCQMW.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AMG.exe.bat" "58⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:704 -
C:\windows\system\AMG.exeC:\windows\system\AMG.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VALVB.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\windows\VALVB.exeC:\windows\VALVB.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KDCAMZD.exe.bat" "62⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\windows\KDCAMZD.exeC:\windows\KDCAMZD.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QQUIR.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\windows\QQUIR.exeC:\windows\QQUIR.exe65⤵
- Executes dropped EXE
PID:5472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FTL.exe.bat" "66⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2992 -
C:\windows\SysWOW64\FTL.exeC:\windows\system32\FTL.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FZDB.exe.bat" "68⤵
- Executes a command shell one-liner
PID:956 -
C:\windows\FZDB.exeC:\windows\FZDB.exe69⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LZLPVE.exe.bat" "70⤵PID:4140
-
C:\windows\system\LZLPVE.exeC:\windows\system\LZLPVE.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4620 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EUP.exe.bat" "72⤵
- System Location Discovery: System Language Discovery
PID:4928 -
C:\windows\system\EUP.exeC:\windows\system\EUP.exe73⤵
- Executes dropped EXE
PID:4344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FXSON.exe.bat" "74⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3864 -
C:\windows\FXSON.exeC:\windows\FXSON.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KXACWMJ.exe.bat" "76⤵
- System Location Discovery: System Language Discovery
PID:5748 -
C:\windows\system\KXACWMJ.exeC:\windows\system\KXACWMJ.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UGC.exe.bat" "78⤵PID:2380
-
C:\windows\system\UGC.exeC:\windows\system\UGC.exe79⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1180 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MBGLFZV.exe.bat" "80⤵PID:5800
-
C:\windows\system\MBGLFZV.exeC:\windows\system\MBGLFZV.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YRULS.exe.bat" "82⤵
- System Location Discovery: System Language Discovery
PID:2012 -
C:\windows\SysWOW64\YRULS.exeC:\windows\system32\YRULS.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TERUCRX.exe.bat" "84⤵
- Executes a command shell one-liner
PID:2412 -
C:\windows\TERUCRX.exeC:\windows\TERUCRX.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XUGC.exe.bat" "86⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3480 -
C:\windows\system\XUGC.exeC:\windows\system\XUGC.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TSERVT.exe.bat" "88⤵
- System Location Discovery: System Language Discovery
PID:1208 -
C:\windows\SysWOW64\TSERVT.exeC:\windows\system32\TSERVT.exe89⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ONJJFTC.exe.bat" "90⤵
- System Location Discovery: System Language Discovery
PID:2108 -
C:\windows\SysWOW64\ONJJFTC.exeC:\windows\system32\ONJJFTC.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3056 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XNLO.exe.bat" "92⤵PID:5872
-
C:\windows\SysWOW64\XNLO.exeC:\windows\system32\XNLO.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BDROVJ.exe.bat" "94⤵
- Executes a command shell one-liner
PID:4904 -
C:\windows\SysWOW64\BDROVJ.exeC:\windows\system32\BDROVJ.exe95⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RLSN.exe.bat" "96⤵PID:248
-
C:\windows\system\RLSN.exeC:\windows\system\RLSN.exe97⤵
- Executes dropped EXE
PID:4424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PJL.exe.bat" "98⤵PID:1468
-
C:\windows\PJL.exeC:\windows\PJL.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VELRTN.exe.bat" "100⤵
- Executes a command shell one-liner
PID:5132 -
C:\windows\system\VELRTN.exeC:\windows\system\VELRTN.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QSP.exe.bat" "102⤵PID:3856
-
C:\windows\QSP.exeC:\windows\QSP.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WSX.exe.bat" "104⤵
- System Location Discovery: System Language Discovery
PID:1112 -
C:\windows\SysWOW64\WSX.exeC:\windows\system32\WSX.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3316 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OVBKSXM.exe.bat" "106⤵PID:6012
-
C:\windows\OVBKSXM.exeC:\windows\OVBKSXM.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PQFO.exe.bat" "108⤵PID:1012
-
C:\windows\SysWOW64\PQFO.exeC:\windows\system32\PQFO.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4388 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VQMBPP.exe.bat" "110⤵
- System Location Discovery: System Language Discovery
PID:3280 -
C:\windows\SysWOW64\VQMBPP.exeC:\windows\system32\VQMBPP.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EZOGSUR.exe.bat" "112⤵
- System Location Discovery: System Language Discovery
PID:5360 -
C:\windows\system\EZOGSUR.exeC:\windows\system\EZOGSUR.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:120 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BEME.exe.bat" "114⤵PID:3084
-
C:\windows\SysWOW64\BEME.exeC:\windows\system32\BEME.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4316 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JKZ.exe.bat" "116⤵
- Executes a command shell one-liner
PID:5880 -
C:\windows\SysWOW64\JKZ.exeC:\windows\system32\JKZ.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2040 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WUHJYF.exe.bat" "118⤵PID:1600
-
C:\windows\SysWOW64\WUHJYF.exeC:\windows\system32\WUHJYF.exe119⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3216 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EAHXASN.exe.bat" "120⤵PID:2952
-
C:\windows\SysWOW64\EAHXASN.exeC:\windows\system32\EAHXASN.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1304
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-