Analysis
- max time kernel
86s - max time network
132s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/08/2026, 16:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-08_58f28b4e69c2bf7548ba0b21bb4d49ef_elex_icedid.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
General
- Target 2026-08-08_58f28b4e69c2bf7548ba0b21bb4d49ef_elex_icedid.exe
- Size 208KB
- Sample260808-thfxkshq5v
- SHA256 04f05456b4af6677869685618d1a55f0fecd40feb32c71ebed78bcd2eb2b7c6f
- MD5 58f28b4e69c2bf7548ba0b21bb4d49ef
- SHA1 f28ab724d8f468223737c2832674ab13de65bbdc
- SHA512 8621aa9b60fc0d46e4a09fa5f52713feefe8b489b3617afb43b9e0e43ec9e02cc144d4803351895a08e0741349008ad9df2519eefb353d6493a8cdda00fa2649
- SSDEEP 3072:V/dVpcBJjLIGDjRh+zetJG9GRtJaXREij9N/wJ4T9ejMNn4NLthEjQT6j:dTpcXRhJGGRtEXnjo9+QEj1
- TLSH T175249EE2769DC106E06B47704CEB9BA49F2BFCA19BB6420F79A17F4E8C727644510363
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5752 GTSIYPI.exe 4904 YOKS.exe 2968 GBPZ.exe 5868 FMS.exe 3548 JSKE.exe 4528 TSMJV.exe 3292 XISJHYU.exe 2108 MYTJGT.exe 3964 BTD.exe 3804 RJMNXBH.exe 4544 LWJW.exe 2136 NUWQXK.exe 888 ZCDQ.exe 4332 BAI.exe 3576 SIKQ.exe 3520 LLO.exe 4276 RHA.exe 5764 GCJRZH.exe 3216 OHWXJ.exe 3652 EXXX.exe 3224 INEXUL.exe 2248 IIH.exe 472 MYOBU.exe 2792 EZQO.exe 5048 WCUJDP.exe 4532 CCB.exe 4780 VFNBZ.exe 4708 TQQJ.exe 2692 XYXRMF.exe 4608 ATB.exe 1524 EBIAJXJ.exe 5992 YONK.exe 5788 RSRNYN.exe 2460 IATTCLJ.exe 4272 MIZBO.exe 5612 SIHOXFY.exe 3972 YDGPC.exe 3036 NYQ.exe 5620 PWDOC.exe 4104 QZHR.exe 5988 XPIJO.exe 5152 TSQHC.exe 4496 VQE.exe 4652 KGFTRV.exe 1916 OWMB.exe 628 FWOGG.exe 1668 YZRC.exe 2836 IXXWBJ.exe 4732 BABAH.exe 4516 QVK.exe 3104 KIPOC.exe 2812 WZEOOEK.exe 5780 PUIS.exe 2684 YCK.exe 1292 BPGG.exe 5708 ZPOUQ.exe 3564 HVOIAHG.exe 4908 JTUDH.exe 3496 YOL.exe 5096 EJCQX.exe 2648 BPVF.exe 1560 HKUGSLX.exe 2068 UNCEY.exe 4396 LVRCL.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\OZMVL.exe LJFNHJ.exe File created C:\windows\SysWOW64\AIGDKD.exe BYDNCPW.exe File created C:\windows\SysWOW64\URM.exe.bat TOIVEC.exe File created C:\windows\SysWOW64\INEXUL.exe EXXX.exe File created C:\windows\SysWOW64\IMLT.exe.bat OZMVL.exe File created C:\windows\SysWOW64\SWG.exe.bat UYVQZ.exe File created C:\windows\SysWOW64\NMQUXIH.exe URM.exe File created C:\windows\SysWOW64\NUWQXK.exe LWJW.exe File created C:\windows\SysWOW64\WZEOOEK.exe KIPOC.exe File created C:\windows\SysWOW64\UYVQZ.exe FIU.exe File opened for modification C:\windows\SysWOW64\YRSTA.exe SWG.exe File created C:\windows\SysWOW64\XISJHYU.exe TSMJV.exe File opened for modification C:\windows\SysWOW64\OHWXJ.exe GCJRZH.exe File opened for modification C:\windows\SysWOW64\VFNBZ.exe CCB.exe File created C:\windows\SysWOW64\GYJI.exe FVTMDOG.exe File opened for modification C:\windows\SysWOW64\AIGDKD.exe BYDNCPW.exe File opened for modification C:\windows\SysWOW64\LLO.exe SIKQ.exe File created C:\windows\SysWOW64\ZPOUQ.exe.bat BPGG.exe File opened for modification C:\windows\SysWOW64\BPVF.exe EJCQX.exe File created C:\windows\SysWOW64\UJKJD.exe MWFCT.exe File opened for modification C:\windows\SysWOW64\UJKJD.exe MWFCT.exe File created C:\windows\SysWOW64\BAI.exe ZCDQ.exe File created C:\windows\SysWOW64\KGFTRV.exe.bat VQE.exe File created C:\windows\SysWOW64\BPVF.exe EJCQX.exe File created C:\windows\SysWOW64\LLO.exe.bat SIKQ.exe File created C:\windows\SysWOW64\CLTM.exe QDNMGB.exe File created C:\windows\SysWOW64\KZG.exe CLTM.exe File opened for modification C:\windows\SysWOW64\SWG.exe UYVQZ.exe File created C:\windows\SysWOW64\YRSTA.exe.bat SWG.exe File opened for modification C:\windows\SysWOW64\FMS.exe GBPZ.exe File opened for modification C:\windows\SysWOW64\CLTM.exe QDNMGB.exe File created C:\windows\SysWOW64\SWG.exe UYVQZ.exe File created C:\windows\SysWOW64\WEDZU.exe RDTXQ.exe File created C:\windows\SysWOW64\FMS.exe.bat GBPZ.exe File created C:\windows\SysWOW64\JSKE.exe.bat FMS.exe File created C:\windows\SysWOW64\MYTJGT.exe.bat XISJHYU.exe File opened for modification C:\windows\SysWOW64\IMLT.exe OZMVL.exe File created C:\windows\SysWOW64\GES.exe.bat AIGDKD.exe File opened for modification C:\windows\SysWOW64\ZPOUQ.exe BPGG.exe File created C:\windows\SysWOW64\YOL.exe JTUDH.exe File created C:\windows\SysWOW64\AKVZLEM.exe.bat JZL.exe File created C:\windows\SysWOW64\AIGDKD.exe.bat BYDNCPW.exe File opened for modification C:\windows\SysWOW64\MYTJGT.exe XISJHYU.exe File created C:\windows\SysWOW64\OHWXJ.exe GCJRZH.exe File created C:\windows\SysWOW64\KZG.exe.bat CLTM.exe File created C:\windows\SysWOW64\OYKABVN.exe KVMF.exe File created C:\windows\SysWOW64\BYDNCPW.exe MHCODC.exe File opened for modification C:\windows\SysWOW64\LWJW.exe RJMNXBH.exe File created C:\windows\SysWOW64\JSKE.exe FMS.exe File created C:\windows\SysWOW64\WZEOOEK.exe.bat KIPOC.exe File opened for modification C:\windows\SysWOW64\WEDZU.exe RDTXQ.exe File opened for modification C:\windows\SysWOW64\NMQUXIH.exe URM.exe File created C:\windows\SysWOW64\MYTJGT.exe XISJHYU.exe File created C:\windows\SysWOW64\INEXUL.exe.bat EXXX.exe File created C:\windows\SysWOW64\NYQ.exe YDGPC.exe File opened for modification C:\windows\SysWOW64\WZEOOEK.exe KIPOC.exe File created C:\windows\SysWOW64\YCK.exe PUIS.exe File opened for modification C:\windows\SysWOW64\YCK.exe PUIS.exe File opened for modification C:\windows\SysWOW64\UYVQZ.exe FIU.exe File opened for modification C:\windows\SysWOW64\ZCDQ.exe NUWQXK.exe File created C:\windows\SysWOW64\VFNBZ.exe CCB.exe File created C:\windows\SysWOW64\NYQ.exe.bat YDGPC.exe File created C:\windows\SysWOW64\TJDIV.exe.bat LVRCL.exe File created C:\windows\SysWOW64\OYKABVN.exe.bat KVMF.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\system\EBIAJXJ.exe ATB.exe File created C:\windows\RJMNXBH.exe.bat BTD.exe File created C:\windows\system\MWFCT.exe.bat RJA.exe File opened for modification C:\windows\system\NSWBP.exe XCVB.exe File created C:\windows\system\RDTXQ.exe VYJHA.exe File created C:\windows\WYKUU.exe NXIP.exe File opened for modification C:\windows\system\FEFMXQ.exe WEDZU.exe File created C:\windows\GBPZ.exe YOKS.exe File created C:\windows\system\RSRNYN.exe.bat YONK.exe File opened for modification C:\windows\OWMB.exe KGFTRV.exe File opened for modification C:\windows\system\RJA.exe WYKUU.exe File opened for modification C:\windows\system\MWFCT.exe RJA.exe File created C:\windows\system\FEFMXQ.exe.bat WEDZU.exe File created C:\windows\GTSIYPI.exe 2026-08-08_58f28b4e69c2bf7548ba0b21bb4d49ef_elex_icedid.exe File created C:\windows\GBPZ.exe.bat YOKS.exe File opened for modification C:\windows\IIH.exe INEXUL.exe File opened for modification C:\windows\system\IATTCLJ.exe RSRNYN.exe File created C:\windows\system\FEFMXQ.exe WEDZU.exe File created C:\windows\system\RHA.exe.bat LLO.exe File opened for modification C:\windows\EZQO.exe MYOBU.exe File created C:\windows\system\YONK.exe EBIAJXJ.exe File created C:\windows\XPIJO.exe QZHR.exe File opened for modification C:\windows\IXXWBJ.exe YZRC.exe File created C:\windows\KIPOC.exe QVK.exe File created C:\windows\BPGG.exe.bat YCK.exe File opened for modification C:\windows\system\HKUGSLX.exe BPVF.exe File created C:\windows\YOKS.exe GTSIYPI.exe File created C:\windows\YOKS.exe.bat GTSIYPI.exe File opened for modification C:\windows\system\GCJRZH.exe RHA.exe File created C:\windows\IIH.exe.bat INEXUL.exe File created C:\windows\system\EBIAJXJ.exe.bat ATB.exe File opened for modification C:\windows\system\YONK.exe EBIAJXJ.exe File created C:\windows\system\PWDOC.exe NYQ.exe File created C:\windows\OWMB.exe KGFTRV.exe File opened for modification C:\windows\GTSIYPI.exe 2026-08-08_58f28b4e69c2bf7548ba0b21bb4d49ef_elex_icedid.exe File opened for modification C:\windows\system\ATB.exe XYXRMF.exe File created C:\windows\system\ATB.exe.bat XYXRMF.exe File created C:\windows\system\QZHR.exe PWDOC.exe File created C:\windows\OWMB.exe.bat KGFTRV.exe File created C:\windows\system\YZRC.exe FWOGG.exe File opened for modification C:\windows\system\FWOGG.exe OWMB.exe File created C:\windows\PUIS.exe.bat WZEOOEK.exe File opened for modification C:\windows\system\BTD.exe MYTJGT.exe File created C:\windows\IIH.exe INEXUL.exe File opened for modification C:\windows\system\TQQJ.exe VFNBZ.exe File created C:\windows\system\QZHR.exe.bat PWDOC.exe File created C:\windows\IXXWBJ.exe.bat YZRC.exe File created C:\windows\PUIS.exe WZEOOEK.exe File created C:\windows\system\JTUDH.exe HVOIAHG.exe File opened for modification C:\windows\system\NXIP.exe QSY.exe File created C:\windows\system\MYOBU.exe IIH.exe File created C:\windows\WCUJDP.exe.bat EZQO.exe File opened for modification C:\windows\system\CCB.exe WCUJDP.exe File created C:\windows\SIHOXFY.exe MIZBO.exe File opened for modification C:\windows\system\PWDOC.exe NYQ.exe File opened for modification C:\windows\system\YZRC.exe FWOGG.exe File created C:\windows\QSY.exe.bat IMLT.exe File created C:\windows\system\MSPRY.exe XCORRD.exe File created C:\windows\WCUJDP.exe EZQO.exe File created C:\windows\system\ATB.exe XYXRMF.exe File created C:\windows\system\EBIAJXJ.exe ATB.exe File opened for modification C:\windows\FIU.exe GYJI.exe File created C:\windows\VYJHA.exe.bat NSWBP.exe File created C:\windows\system\RDTXQ.exe.bat VYJHA.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4980 cmd.exe 3764 cmd.exe 3020 cmd.exe 468 cmd.exe 5828 cmd.exe 484 cmd.exe 6136 cmd.exe 4172 cmd.exe 2400 cmd.exe 2900 cmd.exe 296 cmd.exe 4644 cmd.exe 1720 cmd.exe 6008 cmd.exe 5796 cmd.exe 1864 cmd.exe 5364 cmd.exe 2884 cmd.exe 3616 cmd.exe 5268 cmd.exe 5964 cmd.exe 3680 cmd.exe 3220 cmd.exe 3148 cmd.exe 4928 cmd.exe 4296 cmd.exe 2584 cmd.exe 3944 cmd.exe 1124 cmd.exe 3276 cmd.exe 4936 cmd.exe 688 cmd.exe 5972 cmd.exe 4316 cmd.exe 1648 cmd.exe 3156 cmd.exe 4820 cmd.exe 5244 cmd.exe 776 cmd.exe 2028 cmd.exe 3480 cmd.exe 1640 cmd.exe 4280 cmd.exe 3464 cmd.exe 4956 cmd.exe 3460 cmd.exe 5456 cmd.exe 2628 cmd.exe 4456 cmd.exe 6120 cmd.exe 4168 cmd.exe 5004 cmd.exe 5840 cmd.exe 4364 cmd.exe 5388 cmd.exe 4184 cmd.exe 1076 cmd.exe 5536 cmd.exe 3412 cmd.exe 1168 cmd.exe 3588 cmd.exe 1840 cmd.exe 3408 cmd.exe 1628 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 4964 2624 WerFault.exe 87 776 5752 WerFault.exe 93 1192 4904 WerFault.exe 99 5520 2968 WerFault.exe 104 856 5868 WerFault.exe 109 4932 3548 WerFault.exe 114 3668 4528 WerFault.exe 119 5132 3292 WerFault.exe 124 4248 2108 WerFault.exe 129 5152 3964 WerFault.exe 134 5356 3804 WerFault.exe 138 1996 4544 WerFault.exe 144 2188 2136 WerFault.exe 149 4452 888 WerFault.exe 154 1868 4332 WerFault.exe 159 2716 3576 WerFault.exe 164 3884 3520 WerFault.exe 169 4564 4276 WerFault.exe 174 876 5764 WerFault.exe 179 1524 3216 WerFault.exe 184 5152 3652 WerFault.exe 189 1740 3224 WerFault.exe 194 3132 2248 WerFault.exe 199 2188 472 WerFault.exe 204 5612 2792 WerFault.exe 209 5708 5048 WerFault.exe 214 4188 4532 WerFault.exe 219 616 4780 WerFault.exe 224 4384 4708 WerFault.exe 229 2844 2692 WerFault.exe 234 3616 4608 WerFault.exe 239 5500 1524 WerFault.exe 244 4832 5992 WerFault.exe 249 2928 5788 WerFault.exe 254 3936 2460 WerFault.exe 259 3388 4272 WerFault.exe 264 1076 5612 WerFault.exe 269 2672 3972 WerFault.exe 275 3668 3036 WerFault.exe 280 4624 5620 WerFault.exe 285 4248 4104 WerFault.exe 290 1708 5988 WerFault.exe 295 4804 5152 WerFault.exe 300 5080 4496 WerFault.exe 305 4072 4652 WerFault.exe 310 1452 1916 WerFault.exe 315 3940 628 WerFault.exe 320 3440 1668 WerFault.exe 325 1760 2836 WerFault.exe 330 4448 4732 WerFault.exe 335 484 4516 WerFault.exe 340 3200 3104 WerFault.exe 345 5452 2812 WerFault.exe 350 3640 5780 WerFault.exe 355 3468 2684 WerFault.exe 360 2312 1292 WerFault.exe 365 4228 5708 WerFault.exe 370 3668 3564 WerFault.exe 375 4444 4908 WerFault.exe 380 6092 3496 WerFault.exe 385 5348 5096 WerFault.exe 390 4140 2648 WerFault.exe 395 5424 1560 WerFault.exe 400 4116 2068 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LJFNHJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FMS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language INEXUL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EBIAJXJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EJCQX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TSMJV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GCJRZH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WCUJDP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JSKE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EZQO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QVK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TJDIV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FIU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language URM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OYKABVN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXXX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TQQJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RHA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OWMB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZPOUQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XYXRMF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KIPOC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BPGG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HKUGSLX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QSY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IATTCLJ.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2624 2026-08-08_58f28b4e69c2bf7548ba0b21bb4d49ef_elex_icedid.exe 2624 2026-08-08_58f28b4e69c2bf7548ba0b21bb4d49ef_elex_icedid.exe 5752 GTSIYPI.exe 5752 GTSIYPI.exe 4904 YOKS.exe 4904 YOKS.exe 2968 GBPZ.exe 2968 GBPZ.exe 5868 FMS.exe 5868 FMS.exe 3548 JSKE.exe 3548 JSKE.exe 4528 TSMJV.exe 4528 TSMJV.exe 3292 XISJHYU.exe 3292 XISJHYU.exe 2108 MYTJGT.exe 2108 MYTJGT.exe 3964 BTD.exe 3964 BTD.exe 3804 RJMNXBH.exe 3804 RJMNXBH.exe 4544 LWJW.exe 4544 LWJW.exe 2136 NUWQXK.exe 2136 NUWQXK.exe 888 ZCDQ.exe 888 ZCDQ.exe 4332 BAI.exe 4332 BAI.exe 3576 SIKQ.exe 3576 SIKQ.exe 3520 LLO.exe 3520 LLO.exe 4276 RHA.exe 4276 RHA.exe 5764 GCJRZH.exe 5764 GCJRZH.exe 3216 OHWXJ.exe 3216 OHWXJ.exe 3652 EXXX.exe 3652 EXXX.exe 3224 INEXUL.exe 3224 INEXUL.exe 2248 IIH.exe 2248 IIH.exe 472 MYOBU.exe 472 MYOBU.exe 2792 EZQO.exe 2792 EZQO.exe 5048 WCUJDP.exe 5048 WCUJDP.exe 4532 CCB.exe 4532 CCB.exe 4780 VFNBZ.exe 4780 VFNBZ.exe 4708 TQQJ.exe 4708 TQQJ.exe 2692 XYXRMF.exe 2692 XYXRMF.exe 4608 ATB.exe 4608 ATB.exe 1524 EBIAJXJ.exe 1524 EBIAJXJ.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2624 2026-08-08_58f28b4e69c2bf7548ba0b21bb4d49ef_elex_icedid.exe 2624 2026-08-08_58f28b4e69c2bf7548ba0b21bb4d49ef_elex_icedid.exe 5752 GTSIYPI.exe 5752 GTSIYPI.exe 4904 YOKS.exe 4904 YOKS.exe 2968 GBPZ.exe 2968 GBPZ.exe 5868 FMS.exe 5868 FMS.exe 3548 JSKE.exe 3548 JSKE.exe 4528 TSMJV.exe 4528 TSMJV.exe 3292 XISJHYU.exe 3292 XISJHYU.exe 2108 MYTJGT.exe 2108 MYTJGT.exe 3964 BTD.exe 3964 BTD.exe 3804 RJMNXBH.exe 3804 RJMNXBH.exe 4544 LWJW.exe 4544 LWJW.exe 2136 NUWQXK.exe 2136 NUWQXK.exe 888 ZCDQ.exe 888 ZCDQ.exe 4332 BAI.exe 4332 BAI.exe 3576 SIKQ.exe 3576 SIKQ.exe 3520 LLO.exe 3520 LLO.exe 4276 RHA.exe 4276 RHA.exe 5764 GCJRZH.exe 5764 GCJRZH.exe 3216 OHWXJ.exe 3216 OHWXJ.exe 3652 EXXX.exe 3652 EXXX.exe 3224 INEXUL.exe 3224 INEXUL.exe 2248 IIH.exe 2248 IIH.exe 472 MYOBU.exe 472 MYOBU.exe 2792 EZQO.exe 2792 EZQO.exe 5048 WCUJDP.exe 5048 WCUJDP.exe 4532 CCB.exe 4532 CCB.exe 4780 VFNBZ.exe 4780 VFNBZ.exe 4708 TQQJ.exe 4708 TQQJ.exe 2692 XYXRMF.exe 2692 XYXRMF.exe 4608 ATB.exe 4608 ATB.exe 1524 EBIAJXJ.exe 1524 EBIAJXJ.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2624 wrote to memory of 1468 2624 2026-08-08_58f28b4e69c2bf7548ba0b21bb4d49ef_elex_icedid.exe 89 PID 1468 wrote to memory of 5752 1468 cmd.exe 93 PID 5752 wrote to memory of 5440 5752 GTSIYPI.exe 95 PID 5440 wrote to memory of 4904 5440 cmd.exe 99 PID 4904 wrote to memory of 1484 4904 YOKS.exe 100 PID 1484 wrote to memory of 2968 1484 cmd.exe 104 PID 2968 wrote to memory of 4364 2968 GBPZ.exe 105 PID 4364 wrote to memory of 5868 4364 cmd.exe 109 PID 5868 wrote to memory of 6080 5868 FMS.exe 110 PID 6080 wrote to memory of 3548 6080 cmd.exe 114 PID 3548 wrote to memory of 2400 3548 JSKE.exe 115 PID 2400 wrote to memory of 4528 2400 cmd.exe 119 PID 4528 wrote to memory of 2748 4528 TSMJV.exe 120 PID 2748 wrote to memory of 3292 2748 cmd.exe 124 PID 3292 wrote to memory of 2900 3292 XISJHYU.exe 125 PID 2900 wrote to memory of 2108 2900 cmd.exe 129 PID 2108 wrote to memory of 3680 2108 MYTJGT.exe 130 PID 3680 wrote to memory of 3964 3680 cmd.exe 134 PID 3964 wrote to memory of 1204 3964 BTD.exe 135 PID 1204 wrote to memory of 3804 1204 cmd.exe 138 PID 3804 wrote to memory of 4336 3804 RJMNXBH.exe 140 PID 4336 wrote to memory of 4544 4336 cmd.exe 144 PID 4544 wrote to memory of 4108 4544 LWJW.exe 145 PID 4108 wrote to memory of 2136 4108 cmd.exe 149 PID 2136 wrote to memory of 5464 2136 NUWQXK.exe 150 PID 5464 wrote to memory of 888 5464 cmd.exe 154 PID 888 wrote to memory of 5972 888 ZCDQ.exe 155 PID 5972 wrote to memory of 4332 5972 cmd.exe 159 PID 4332 wrote to memory of 2540 4332 BAI.exe 160 PID 2540 wrote to memory of 3576 2540 cmd.exe 164 PID 3576 wrote to memory of 4912 3576 SIKQ.exe 165 PID 4912 wrote to memory of 3520 4912 cmd.exe 169 PID 3520 wrote to memory of 5564 3520 LLO.exe 170 PID 5564 wrote to memory of 4276 5564 cmd.exe 174 PID 4276 wrote to memory of 1608 4276 RHA.exe 175 PID 1608 wrote to memory of 5764 1608 cmd.exe 179 PID 5764 wrote to memory of 1516 5764 GCJRZH.exe 180 PID 1516 wrote to memory of 3216 1516 cmd.exe 184 PID 3216 wrote to memory of 4324 3216 OHWXJ.exe 185 PID 4324 wrote to memory of 3652 4324 cmd.exe 189 PID 3652 wrote to memory of 2984 3652 EXXX.exe 190 PID 2984 wrote to memory of 3224 2984 cmd.exe 194 PID 3224 wrote to memory of 6112 3224 INEXUL.exe 195 PID 6112 wrote to memory of 2248 6112 cmd.exe 199 PID 2248 wrote to memory of 5632 2248 IIH.exe 200 PID 5632 wrote to memory of 472 5632 cmd.exe 204 PID 472 wrote to memory of 5028 472 MYOBU.exe 205 PID 5028 wrote to memory of 2792 5028 cmd.exe 209 PID 2792 wrote to memory of 1132 2792 EZQO.exe 210 PID 1132 wrote to memory of 5048 1132 cmd.exe 214 PID 5048 wrote to memory of 3944 5048 WCUJDP.exe 215 PID 3944 wrote to memory of 4532 3944 cmd.exe 219 PID 4532 wrote to memory of 796 4532 CCB.exe 220 PID 796 wrote to memory of 4780 796 cmd.exe 224 PID 4780 wrote to memory of 3540 4780 VFNBZ.exe 225 PID 3540 wrote to memory of 4708 3540 cmd.exe 229 PID 4708 wrote to memory of 2040 4708 TQQJ.exe 230 PID 2040 wrote to memory of 2692 2040 cmd.exe 234 PID 2692 wrote to memory of 3220 2692 XYXRMF.exe 235 PID 3220 wrote to memory of 4608 3220 cmd.exe 239 PID 4608 wrote to memory of 1364 4608 ATB.exe 240 PID 1364 wrote to memory of 1524 1364 cmd.exe 244 PID 1524 wrote to memory of 5656 1524 EBIAJXJ.exe 245 PID 5656 wrote to memory of 5992 5656 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_58f28b4e69c2bf7548ba0b21bb4d49ef_elex_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_58f28b4e69c2bf7548ba0b21bb4d49ef_elex_icedid.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GTSIYPI.exe.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\windows\GTSIYPI.exeC:\windows\GTSIYPI.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YOKS.exe.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5440 -
C:\windows\YOKS.exeC:\windows\YOKS.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GBPZ.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\windows\GBPZ.exeC:\windows\GBPZ.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FMS.exe.bat" "8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\windows\SysWOW64\FMS.exeC:\windows\system32\FMS.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JSKE.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:6080 -
C:\windows\SysWOW64\JSKE.exeC:\windows\system32\JSKE.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TSMJV.exe.bat" "12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\windows\system\TSMJV.exeC:\windows\system\TSMJV.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XISJHYU.exe.bat" "14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\windows\SysWOW64\XISJHYU.exeC:\windows\system32\XISJHYU.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MYTJGT.exe.bat" "16⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\windows\SysWOW64\MYTJGT.exeC:\windows\system32\MYTJGT.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BTD.exe.bat" "18⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\windows\system\BTD.exeC:\windows\system\BTD.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RJMNXBH.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\windows\RJMNXBH.exeC:\windows\RJMNXBH.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LWJW.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\windows\SysWOW64\LWJW.exeC:\windows\system32\LWJW.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NUWQXK.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\windows\SysWOW64\NUWQXK.exeC:\windows\system32\NUWQXK.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZCDQ.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:5464 -
C:\windows\SysWOW64\ZCDQ.exeC:\windows\system32\ZCDQ.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BAI.exe.bat" "28⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5972 -
C:\windows\SysWOW64\BAI.exeC:\windows\system32\BAI.exe29⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SIKQ.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\windows\system\SIKQ.exeC:\windows\system\SIKQ.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LLO.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\windows\SysWOW64\LLO.exeC:\windows\system32\LLO.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RHA.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:5564 -
C:\windows\system\RHA.exeC:\windows\system\RHA.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GCJRZH.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\windows\system\GCJRZH.exeC:\windows\system\GCJRZH.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OHWXJ.exe.bat" "38⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\windows\SysWOW64\OHWXJ.exeC:\windows\system32\OHWXJ.exe39⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3216 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EXXX.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\windows\system\EXXX.exeC:\windows\system\EXXX.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\INEXUL.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\windows\SysWOW64\INEXUL.exeC:\windows\system32\INEXUL.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3224 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IIH.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:6112 -
C:\windows\IIH.exeC:\windows\IIH.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MYOBU.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:5632 -
C:\windows\system\MYOBU.exeC:\windows\system\MYOBU.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EZQO.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\windows\EZQO.exeC:\windows\EZQO.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WCUJDP.exe.bat" "50⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\windows\WCUJDP.exeC:\windows\WCUJDP.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CCB.exe.bat" "52⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\windows\system\CCB.exeC:\windows\system\CCB.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VFNBZ.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:796 -
C:\windows\SysWOW64\VFNBZ.exeC:\windows\system32\VFNBZ.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TQQJ.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:3540 -
C:\windows\system\TQQJ.exeC:\windows\system\TQQJ.exe57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XYXRMF.exe.bat" "58⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\windows\XYXRMF.exeC:\windows\XYXRMF.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ATB.exe.bat" "60⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\windows\system\ATB.exeC:\windows\system\ATB.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EBIAJXJ.exe.bat" "62⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\windows\system\EBIAJXJ.exeC:\windows\system\EBIAJXJ.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YONK.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:5656 -
C:\windows\system\YONK.exeC:\windows\system\YONK.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RSRNYN.exe.bat" "66⤵
- Executes a command shell one-liner
PID:1840 -
C:\windows\system\RSRNYN.exeC:\windows\system\RSRNYN.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IATTCLJ.exe.bat" "68⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1124 -
C:\windows\system\IATTCLJ.exeC:\windows\system\IATTCLJ.exe69⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MIZBO.exe.bat" "70⤵PID:6064
-
C:\windows\MIZBO.exeC:\windows\MIZBO.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4272 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SIHOXFY.exe.bat" "72⤵
- Executes a command shell one-liner
PID:296 -
C:\windows\SIHOXFY.exeC:\windows\SIHOXFY.exe73⤵
- Executes dropped EXE
PID:5612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YDGPC.exe.bat" "74⤵
- System Location Discovery: System Language Discovery
PID:1288 -
C:\windows\SysWOW64\YDGPC.exeC:\windows\system32\YDGPC.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NYQ.exe.bat" "76⤵PID:1552
-
C:\windows\SysWOW64\NYQ.exeC:\windows\system32\NYQ.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3036 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PWDOC.exe.bat" "78⤵
- Executes a command shell one-liner
PID:4644 -
C:\windows\system\PWDOC.exeC:\windows\system\PWDOC.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5620 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QZHR.exe.bat" "80⤵
- System Location Discovery: System Language Discovery
PID:3128 -
C:\windows\system\QZHR.exeC:\windows\system\QZHR.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4104 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XPIJO.exe.bat" "82⤵PID:4220
-
C:\windows\XPIJO.exeC:\windows\XPIJO.exe83⤵
- Executes dropped EXE
PID:5988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TSQHC.exe.bat" "84⤵
- Executes a command shell one-liner
PID:5456 -
C:\windows\TSQHC.exeC:\windows\TSQHC.exe85⤵
- Executes dropped EXE
PID:5152 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VQE.exe.bat" "86⤵PID:5352
-
C:\windows\VQE.exeC:\windows\VQE.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KGFTRV.exe.bat" "88⤵PID:2896
-
C:\windows\SysWOW64\KGFTRV.exeC:\windows\system32\KGFTRV.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OWMB.exe.bat" "90⤵
- Executes a command shell one-liner
PID:4980 -
C:\windows\OWMB.exeC:\windows\OWMB.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FWOGG.exe.bat" "92⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3276 -
C:\windows\system\FWOGG.exeC:\windows\system\FWOGG.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:628 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YZRC.exe.bat" "94⤵
- Executes a command shell one-liner
PID:3464 -
C:\windows\system\YZRC.exeC:\windows\system\YZRC.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IXXWBJ.exe.bat" "96⤵
- Executes a command shell one-liner
PID:2028 -
C:\windows\IXXWBJ.exeC:\windows\IXXWBJ.exe97⤵
- Executes dropped EXE
PID:2836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BABAH.exe.bat" "98⤵PID:3776
-
C:\windows\BABAH.exeC:\windows\BABAH.exe99⤵
- Executes dropped EXE
PID:4732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QVK.exe.bat" "100⤵
- Executes a command shell one-liner
PID:2628 -
C:\windows\QVK.exeC:\windows\QVK.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KIPOC.exe.bat" "102⤵PID:1644
-
C:\windows\KIPOC.exeC:\windows\KIPOC.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3104 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WZEOOEK.exe.bat" "104⤵
- Executes a command shell one-liner
PID:3764 -
C:\windows\SysWOW64\WZEOOEK.exeC:\windows\system32\WZEOOEK.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PUIS.exe.bat" "106⤵PID:4804
-
C:\windows\PUIS.exeC:\windows\PUIS.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YCK.exe.bat" "108⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3148 -
C:\windows\SysWOW64\YCK.exeC:\windows\system32\YCK.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2684 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BPGG.exe.bat" "110⤵PID:5812
-
C:\windows\BPGG.exeC:\windows\BPGG.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1292 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZPOUQ.exe.bat" "112⤵
- System Location Discovery: System Language Discovery
PID:1420 -
C:\windows\SysWOW64\ZPOUQ.exeC:\windows\system32\ZPOUQ.exe113⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HVOIAHG.exe.bat" "114⤵PID:2560
-
C:\windows\system\HVOIAHG.exeC:\windows\system\HVOIAHG.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JTUDH.exe.bat" "116⤵
- Executes a command shell one-liner
PID:5388 -
C:\windows\system\JTUDH.exeC:\windows\system\JTUDH.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YOL.exe.bat" "118⤵PID:4600
-
C:\windows\SysWOW64\YOL.exeC:\windows\system32\YOL.exe119⤵
- Executes dropped EXE
PID:3496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EJCQX.exe.bat" "120⤵PID:5132
-
C:\windows\system\EJCQX.exeC:\windows\system\EJCQX.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5096
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-