Analysis
- max time kernel
76s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/08/2026, 16:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-08_238f3cd045009c9bb6323fc3a4ca4293_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-08_238f3cd045009c9bb6323fc3a4ca4293_elex_emotet_stop.exe
- Size 208KB
- Sample260808-twp3eavtas
- SHA256 614dd1bdf44f2383734ef60798c8774a21e1eb72f902893ffc74723f5a34ff59
- MD5 238f3cd045009c9bb6323fc3a4ca4293
- SHA1 763959a51e07b6d1fe912c9ed290b3dd505d6af8
- SHA512 d814721ce2114fcb40935cecbf3ca6643d7ab06389cf7f1f43c0a628a4a92792429bbcf5cc1ec3855ec8d52f727bc2d43039f3681f81df316abd88808ff3da18
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlldL+LOfr4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFll5+LOzkEj1
- TLSH T137247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3412 KKBAA.exe 3476 RQV.exe 5224 DBF.exe 4580 GOX.exe 2560 VEYCQHZ.exe 2412 UPASYV.exe 5780 HZJR.exe 3328 RILWQDT.exe 3944 KAAHH.exe 5440 ZQB.exe 1744 BOH.exe 4124 NWNAI.exe 1064 VMWAGGK.exe 3576 FKCMWO.exe 5172 BPUBMSN.exe 4684 CSYF.exe 2296 RIZXYVL.exe 1252 KMDA.exe 2960 DEKL.exe 5672 WZWHAK.exe 2704 XCALG.exe 4136 KNI.exe 5332 ULOWCLK.exe 4876 MOAZ.exe 5008 NJEVUZ.exe 3012 VWI.exe 4456 XUWWN.exe 916 YPAA.exe 4948 CFGAEO.exe 5236 CIK.exe 5804 EGQ.exe 1832 DRAGISV.exe 3788 NOGA.exe 5772 WPIFTG.exe 2956 GNOAI.exe 3144 ODP.exe 2988 UAIUCHL.exe 1676 IYIGE.exe 1088 ABMJJJW.exe 3696 BWQFXG.exe 2816 FMEN.exe 4192 SXNEPCP.exe 2456 HNODW.exe 3216 NNVRFRF.exe 856 XOXW.exe 5100 VZA.exe 4280 FWOGG.exe 1164 YZRC.exe 6044 TNWLWB.exe 4404 YNE.exe 3376 ZQIDS.exe 2952 MBQ.exe 3388 CRRTFR.exe 4084 UMVXL.exe 1424 EKJ.exe 1344 IAPRM.exe 3004 MIWRRAS.exe 3252 SDVAV.exe 2912 RTGV.exe 4944 KGNT.exe 2592 OWUBACA.exe 4472 NHXRII.exe 4440 ASNH.exe 2216 TNRLCJ.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\WPIFTG.exe NOGA.exe File created C:\windows\SysWOW64\KGNT.exe.bat RTGV.exe File created C:\windows\SysWOW64\TNRLCJ.exe.bat ASNH.exe File created C:\windows\SysWOW64\MOAZ.exe ULOWCLK.exe File opened for modification C:\windows\SysWOW64\MOAZ.exe ULOWCLK.exe File created C:\windows\SysWOW64\ABMJJJW.exe.bat IYIGE.exe File opened for modification C:\windows\SysWOW64\VZRSGN.exe NUNLVP.exe File created C:\windows\SysWOW64\VZRSGN.exe.bat NUNLVP.exe File created C:\windows\SysWOW64\TQRFSXP.exe.bat RSM.exe File created C:\windows\SysWOW64\CQRJGFN.exe STE.exe File opened for modification C:\windows\SysWOW64\RIZXYVL.exe CSYF.exe File created C:\windows\SysWOW64\KNI.exe.bat XCALG.exe File created C:\windows\SysWOW64\DRAGISV.exe.bat EGQ.exe File opened for modification C:\windows\SysWOW64\IAPRM.exe EKJ.exe File opened for modification C:\windows\SysWOW64\KNI.exe XCALG.exe File created C:\windows\SysWOW64\UMVXL.exe CRRTFR.exe File created C:\windows\SysWOW64\IAPRM.exe EKJ.exe File created C:\windows\SysWOW64\KGNT.exe RTGV.exe File created C:\windows\SysWOW64\BFXDKTG.exe ACT.exe File created C:\windows\SysWOW64\VEYCQHZ.exe GOX.exe File opened for modification C:\windows\SysWOW64\ULOWCLK.exe KNI.exe File created C:\windows\SysWOW64\ABMJJJW.exe IYIGE.exe File opened for modification C:\windows\SysWOW64\TQRFSXP.exe RSM.exe File opened for modification C:\windows\SysWOW64\VEYCQHZ.exe GOX.exe File created C:\windows\SysWOW64\ULOWCLK.exe KNI.exe File created C:\windows\SysWOW64\WPIFTG.exe.bat NOGA.exe File created C:\windows\SysWOW64\VZA.exe XOXW.exe File opened for modification C:\windows\SysWOW64\DWZR.exe PYZFM.exe File opened for modification C:\windows\SysWOW64\SDVAV.exe MIWRRAS.exe File created C:\windows\SysWOW64\SDVAV.exe.bat MIWRRAS.exe File opened for modification C:\windows\SysWOW64\KGNT.exe RTGV.exe File opened for modification C:\windows\SysWOW64\DBF.exe RQV.exe File created C:\windows\SysWOW64\GNOAI.exe WPIFTG.exe File created C:\windows\SysWOW64\HNODW.exe.bat SXNEPCP.exe File created C:\windows\SysWOW64\DBF.exe RQV.exe File opened for modification C:\windows\SysWOW64\HNODW.exe SXNEPCP.exe File opened for modification C:\windows\SysWOW64\BFXDKTG.exe ACT.exe File created C:\windows\SysWOW64\VZA.exe.bat XOXW.exe File opened for modification C:\windows\SysWOW64\OWUBACA.exe KGNT.exe File created C:\windows\SysWOW64\TQRFSXP.exe RSM.exe File created C:\windows\SysWOW64\BFXDKTG.exe.bat ACT.exe File created C:\windows\SysWOW64\WPIFTG.exe NOGA.exe File opened for modification C:\windows\SysWOW64\ABMJJJW.exe IYIGE.exe File opened for modification C:\windows\SysWOW64\UMVXL.exe CRRTFR.exe File created C:\windows\SysWOW64\OWUBACA.exe.bat KGNT.exe File opened for modification C:\windows\SysWOW64\CQRJGFN.exe STE.exe File opened for modification C:\windows\SysWOW64\UPASYV.exe VEYCQHZ.exe File created C:\windows\SysWOW64\XCALG.exe WZWHAK.exe File created C:\windows\SysWOW64\GNOAI.exe.bat WPIFTG.exe File created C:\windows\SysWOW64\DWZR.exe.bat PYZFM.exe File created C:\windows\SysWOW64\OWUBACA.exe KGNT.exe File opened for modification C:\windows\SysWOW64\TNRLCJ.exe ASNH.exe File created C:\windows\SysWOW64\VZRSGN.exe NUNLVP.exe File created C:\windows\SysWOW64\CQRJGFN.exe.bat STE.exe File created C:\windows\SysWOW64\KNI.exe XCALG.exe File created C:\windows\SysWOW64\MOAZ.exe.bat ULOWCLK.exe File created C:\windows\SysWOW64\RIZXYVL.exe CSYF.exe File opened for modification C:\windows\SysWOW64\DEKL.exe KMDA.exe File created C:\windows\SysWOW64\DWZR.exe PYZFM.exe File created C:\windows\SysWOW64\UMVXL.exe.bat CRRTFR.exe File created C:\windows\SysWOW64\IAPRM.exe.bat EKJ.exe File created C:\windows\SysWOW64\DBF.exe.bat RQV.exe File created C:\windows\SysWOW64\UPASYV.exe.bat VEYCQHZ.exe File created C:\windows\SysWOW64\DEKL.exe.bat KMDA.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\CSYF.exe BPUBMSN.exe File opened for modification C:\windows\system\KMDA.exe RIZXYVL.exe File opened for modification C:\windows\IYIGE.exe UAIUCHL.exe File created C:\windows\XUQ.exe NWCGA.exe File created C:\windows\system\XAJQAMC.exe.bat IKIRUY.exe File opened for modification C:\windows\system\YAW.exe OCRGM.exe File created C:\windows\system\YPAA.exe XUWWN.exe File opened for modification C:\windows\CFGAEO.exe YPAA.exe File created C:\windows\JHBPF.exe.bat NFTRQBK.exe File opened for modification C:\windows\system\RBHDAB.exe HDBJTS.exe File opened for modification C:\windows\SBUVBD.exe TQRFSXP.exe File created C:\windows\system\NWNAI.exe BOH.exe File created C:\windows\system\RQV.exe.bat KKBAA.exe File created C:\windows\system\GOX.exe DBF.exe File opened for modification C:\windows\system\EGQ.exe CIK.exe File created C:\windows\MBQ.exe.bat ZQIDS.exe File opened for modification C:\windows\SBY.exe IDSD.exe File opened for modification C:\windows\system\XAJQAMC.exe IKIRUY.exe File created C:\windows\system\STE.exe.bat UIBZ.exe File opened for modification C:\windows\system\VWI.exe NJEVUZ.exe File created C:\windows\BWQFXG.exe ABMJJJW.exe File created C:\windows\EKJ.exe UMVXL.exe File created C:\windows\system\RTGV.exe.bat SDVAV.exe File created C:\windows\BWQFXG.exe.bat ABMJJJW.exe File created C:\windows\system\TNWLWB.exe YZRC.exe File opened for modification C:\windows\system\NFTRQBK.exe XUQ.exe File opened for modification C:\windows\FKCMWO.exe VMWAGGK.exe File created C:\windows\WZWHAK.exe.bat DEKL.exe File created C:\windows\system\CORPX.exe.bat LFPC.exe File created C:\windows\system\NUNLVP.exe DWZR.exe File created C:\windows\system\HDBJTS.exe ZYPCIUL.exe File created C:\windows\system\FMEN.exe BWQFXG.exe File created C:\windows\system\NNVRFRF.exe HNODW.exe File opened for modification C:\windows\system\MIWRRAS.exe IAPRM.exe File created C:\windows\system\MIWRRAS.exe.bat IAPRM.exe File created C:\windows\ASNH.exe NHXRII.exe File created C:\windows\system\NWCGA.exe.bat SBY.exe File opened for modification C:\windows\XUQ.exe NWCGA.exe File created C:\windows\XUQ.exe.bat NWCGA.exe File created C:\windows\XOXW.exe NNVRFRF.exe File created C:\windows\ASNH.exe.bat NHXRII.exe File created C:\windows\system\CORPX.exe LFPC.exe File created C:\windows\system\RBHDAB.exe HDBJTS.exe File created C:\windows\system\RBHDAB.exe.bat HDBJTS.exe File created C:\windows\SBUVBD.exe.bat TQRFSXP.exe File opened for modification C:\windows\XUEZS.exe HRV.exe File created C:\windows\IYIGE.exe UAIUCHL.exe File created C:\windows\system\NNVRFRF.exe.bat HNODW.exe File created C:\windows\system\IKIRUY.exe VZRSGN.exe File created C:\windows\HRV.exe.bat SBUVBD.exe File created C:\windows\system\FWOGG.exe VZA.exe File created C:\windows\IYIGE.exe.bat UAIUCHL.exe File created C:\windows\system\CRRTFR.exe.bat MBQ.exe File opened for modification C:\windows\system\IKIRUY.exe VZRSGN.exe File created C:\windows\BOH.exe ZQB.exe File created C:\windows\ODP.exe.bat GNOAI.exe File created C:\windows\SBY.exe.bat IDSD.exe File created C:\windows\HRV.exe SBUVBD.exe File opened for modification C:\windows\system\RTGV.exe SDVAV.exe File created C:\windows\system\XAJQAMC.exe IKIRUY.exe File opened for modification C:\windows\system\GOX.exe DBF.exe File created C:\windows\WZWHAK.exe DEKL.exe File created C:\windows\CIK.exe CFGAEO.exe File created C:\windows\system\YZRC.exe.bat FWOGG.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 240 cmd.exe 5020 cmd.exe 2404 cmd.exe 5808 cmd.exe 4860 cmd.exe 1260 cmd.exe 2408 cmd.exe 3436 cmd.exe 792 cmd.exe 4664 cmd.exe 4260 cmd.exe 3356 cmd.exe 5532 cmd.exe 4476 cmd.exe 5936 cmd.exe 2312 cmd.exe 2060 cmd.exe 4904 cmd.exe 5892 cmd.exe 1528 cmd.exe 6020 cmd.exe 2056 cmd.exe 596 cmd.exe 476 cmd.exe 1104 cmd.exe 2672 cmd.exe 4608 cmd.exe 5720 cmd.exe 4496 cmd.exe 6040 cmd.exe 4524 cmd.exe 4936 cmd.exe 6084 cmd.exe 5328 cmd.exe 3188 cmd.exe 4984 cmd.exe 3432 cmd.exe 4588 cmd.exe 3472 cmd.exe 2052 cmd.exe 4584 cmd.exe 4636 cmd.exe 2832 cmd.exe 4320 cmd.exe 5412 cmd.exe 2972 cmd.exe 2624 cmd.exe 4748 cmd.exe 4448 cmd.exe 4632 cmd.exe 4224 cmd.exe 1076 cmd.exe 2568 cmd.exe 3236 cmd.exe 4920 cmd.exe 6052 cmd.exe 4272 cmd.exe 1708 cmd.exe 6096 cmd.exe 5784 cmd.exe 1028 cmd.exe 5408 cmd.exe 5768 cmd.exe 3092 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 4288 4900 WerFault.exe 88 4856 3412 WerFault.exe 93 5768 3476 WerFault.exe 99 2552 5224 WerFault.exe 104 1376 4580 WerFault.exe 109 2488 2560 WerFault.exe 114 1692 2412 WerFault.exe 119 3236 5780 WerFault.exe 124 1940 3328 WerFault.exe 129 2652 3944 WerFault.exe 134 1336 5440 WerFault.exe 139 5384 1744 WerFault.exe 144 4416 4124 WerFault.exe 149 616 1064 WerFault.exe 154 5728 3576 WerFault.exe 159 4696 5172 WerFault.exe 164 3340 4684 WerFault.exe 169 5720 2296 WerFault.exe 174 5668 1252 WerFault.exe 179 4248 2960 WerFault.exe 184 2800 5672 WerFault.exe 189 1428 2704 WerFault.exe 194 4952 4136 WerFault.exe 199 2140 5332 WerFault.exe 204 4792 4876 WerFault.exe 209 5032 5008 WerFault.exe 214 2076 3012 WerFault.exe 219 1492 4456 WerFault.exe 224 4404 916 WerFault.exe 229 4372 4948 WerFault.exe 234 1408 5236 WerFault.exe 239 2036 5804 WerFault.exe 244 2392 1832 WerFault.exe 249 3256 3788 WerFault.exe 254 1480 5772 WerFault.exe 259 1320 2956 WerFault.exe 264 3472 3144 WerFault.exe 270 1756 2988 WerFault.exe 275 4128 1676 WerFault.exe 280 4404 1088 WerFault.exe 285 2400 3696 WerFault.exe 290 4756 2816 WerFault.exe 295 5248 4192 WerFault.exe 300 3564 2456 WerFault.exe 305 2092 3216 WerFault.exe 310 4116 856 WerFault.exe 315 4356 5100 WerFault.exe 320 3852 4280 WerFault.exe 325 1272 1164 WerFault.exe 330 1076 6044 WerFault.exe 335 5720 4404 WerFault.exe 340 2592 3376 WerFault.exe 345 3404 2952 WerFault.exe 350 5384 3388 WerFault.exe 355 2216 4084 WerFault.exe 360 4736 1424 WerFault.exe 365 4812 1344 WerFault.exe 370 3060 3004 WerFault.exe 375 3748 3252 WerFault.exe 380 2400 2912 WerFault.exe 385 1128 4944 WerFault.exe 390 5524 2592 WerFault.exe 395 2944 4472 WerFault.exe 400 4940 4440 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CSYF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SDVAV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HRV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EGQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CRRTFR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NWNAI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZQIDS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KKBAA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZQB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ODP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XOXW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KGNT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UPASYV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FKCMWO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OCRGM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RQV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DBF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GOX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CFGAEO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SXNEPCP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RIZXYVL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IAPRM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RBHDAB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DWZR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IKIRUY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UIBZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XAJQAMC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4900 2026-08-08_238f3cd045009c9bb6323fc3a4ca4293_elex_emotet_stop.exe 4900 2026-08-08_238f3cd045009c9bb6323fc3a4ca4293_elex_emotet_stop.exe 3412 KKBAA.exe 3412 KKBAA.exe 3476 RQV.exe 3476 RQV.exe 5224 DBF.exe 5224 DBF.exe 4580 GOX.exe 4580 GOX.exe 2560 VEYCQHZ.exe 2560 VEYCQHZ.exe 2412 UPASYV.exe 2412 UPASYV.exe 5780 HZJR.exe 5780 HZJR.exe 3328 RILWQDT.exe 3328 RILWQDT.exe 3944 KAAHH.exe 3944 KAAHH.exe 5440 ZQB.exe 5440 ZQB.exe 1744 BOH.exe 1744 BOH.exe 4124 NWNAI.exe 4124 NWNAI.exe 1064 VMWAGGK.exe 1064 VMWAGGK.exe 3576 FKCMWO.exe 3576 FKCMWO.exe 5172 BPUBMSN.exe 5172 BPUBMSN.exe 4684 CSYF.exe 4684 CSYF.exe 2296 RIZXYVL.exe 2296 RIZXYVL.exe 1252 KMDA.exe 1252 KMDA.exe 2960 DEKL.exe 2960 DEKL.exe 5672 WZWHAK.exe 5672 WZWHAK.exe 2704 XCALG.exe 2704 XCALG.exe 4136 KNI.exe 4136 KNI.exe 5332 ULOWCLK.exe 5332 ULOWCLK.exe 4876 MOAZ.exe 4876 MOAZ.exe 5008 NJEVUZ.exe 5008 NJEVUZ.exe 3012 VWI.exe 3012 VWI.exe 4456 XUWWN.exe 4456 XUWWN.exe 916 YPAA.exe 916 YPAA.exe 4948 CFGAEO.exe 4948 CFGAEO.exe 5236 CIK.exe 5236 CIK.exe 5804 EGQ.exe 5804 EGQ.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4900 2026-08-08_238f3cd045009c9bb6323fc3a4ca4293_elex_emotet_stop.exe 4900 2026-08-08_238f3cd045009c9bb6323fc3a4ca4293_elex_emotet_stop.exe 3412 KKBAA.exe 3412 KKBAA.exe 3476 RQV.exe 3476 RQV.exe 5224 DBF.exe 5224 DBF.exe 4580 GOX.exe 4580 GOX.exe 2560 VEYCQHZ.exe 2560 VEYCQHZ.exe 2412 UPASYV.exe 2412 UPASYV.exe 5780 HZJR.exe 5780 HZJR.exe 3328 RILWQDT.exe 3328 RILWQDT.exe 3944 KAAHH.exe 3944 KAAHH.exe 5440 ZQB.exe 5440 ZQB.exe 1744 BOH.exe 1744 BOH.exe 4124 NWNAI.exe 4124 NWNAI.exe 1064 VMWAGGK.exe 1064 VMWAGGK.exe 3576 FKCMWO.exe 3576 FKCMWO.exe 5172 BPUBMSN.exe 5172 BPUBMSN.exe 4684 CSYF.exe 4684 CSYF.exe 2296 RIZXYVL.exe 2296 RIZXYVL.exe 1252 KMDA.exe 1252 KMDA.exe 2960 DEKL.exe 2960 DEKL.exe 5672 WZWHAK.exe 5672 WZWHAK.exe 2704 XCALG.exe 2704 XCALG.exe 4136 KNI.exe 4136 KNI.exe 5332 ULOWCLK.exe 5332 ULOWCLK.exe 4876 MOAZ.exe 4876 MOAZ.exe 5008 NJEVUZ.exe 5008 NJEVUZ.exe 3012 VWI.exe 3012 VWI.exe 4456 XUWWN.exe 4456 XUWWN.exe 916 YPAA.exe 916 YPAA.exe 4948 CFGAEO.exe 4948 CFGAEO.exe 5236 CIK.exe 5236 CIK.exe 5804 EGQ.exe 5804 EGQ.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4900 wrote to memory of 2052 4900 2026-08-08_238f3cd045009c9bb6323fc3a4ca4293_elex_emotet_stop.exe 89 PID 2052 wrote to memory of 3412 2052 cmd.exe 93 PID 3412 wrote to memory of 2312 3412 KKBAA.exe 95 PID 2312 wrote to memory of 3476 2312 cmd.exe 99 PID 3476 wrote to memory of 4584 3476 RQV.exe 100 PID 4584 wrote to memory of 5224 4584 cmd.exe 104 PID 5224 wrote to memory of 5028 5224 DBF.exe 105 PID 5028 wrote to memory of 4580 5028 cmd.exe 109 PID 4580 wrote to memory of 4636 4580 GOX.exe 110 PID 4636 wrote to memory of 2560 4636 cmd.exe 114 PID 2560 wrote to memory of 5824 2560 VEYCQHZ.exe 115 PID 5824 wrote to memory of 2412 5824 cmd.exe 119 PID 2412 wrote to memory of 3752 2412 UPASYV.exe 120 PID 3752 wrote to memory of 5780 3752 cmd.exe 124 PID 5780 wrote to memory of 4984 5780 HZJR.exe 125 PID 4984 wrote to memory of 3328 4984 cmd.exe 129 PID 3328 wrote to memory of 2976 3328 RILWQDT.exe 130 PID 2976 wrote to memory of 3944 2976 cmd.exe 134 PID 3944 wrote to memory of 5424 3944 KAAHH.exe 135 PID 5424 wrote to memory of 5440 5424 cmd.exe 139 PID 5440 wrote to memory of 4564 5440 ZQB.exe 140 PID 4564 wrote to memory of 1744 4564 cmd.exe 144 PID 1744 wrote to memory of 3432 1744 BOH.exe 145 PID 3432 wrote to memory of 4124 3432 cmd.exe 149 PID 4124 wrote to memory of 4724 4124 NWNAI.exe 150 PID 4724 wrote to memory of 1064 4724 cmd.exe 154 PID 1064 wrote to memory of 2948 1064 VMWAGGK.exe 155 PID 2948 wrote to memory of 3576 2948 cmd.exe 159 PID 3576 wrote to memory of 3448 3576 FKCMWO.exe 160 PID 3448 wrote to memory of 5172 3448 cmd.exe 164 PID 5172 wrote to memory of 240 5172 BPUBMSN.exe 165 PID 240 wrote to memory of 4684 240 cmd.exe 169 PID 4684 wrote to memory of 6052 4684 CSYF.exe 170 PID 6052 wrote to memory of 2296 6052 cmd.exe 174 PID 2296 wrote to memory of 2856 2296 RIZXYVL.exe 175 PID 2856 wrote to memory of 1252 2856 cmd.exe 179 PID 1252 wrote to memory of 4476 1252 KMDA.exe 180 PID 4476 wrote to memory of 2960 4476 cmd.exe 184 PID 2960 wrote to memory of 792 2960 DEKL.exe 185 PID 792 wrote to memory of 5672 792 cmd.exe 189 PID 5672 wrote to memory of 5020 5672 WZWHAK.exe 190 PID 5020 wrote to memory of 2704 5020 cmd.exe 194 PID 2704 wrote to memory of 3484 2704 XCALG.exe 195 PID 3484 wrote to memory of 4136 3484 cmd.exe 199 PID 4136 wrote to memory of 2404 4136 KNI.exe 200 PID 2404 wrote to memory of 5332 2404 cmd.exe 204 PID 5332 wrote to memory of 1104 5332 ULOWCLK.exe 205 PID 1104 wrote to memory of 4876 1104 cmd.exe 209 PID 4876 wrote to memory of 1648 4876 MOAZ.exe 210 PID 1648 wrote to memory of 5008 1648 cmd.exe 214 PID 5008 wrote to memory of 5808 5008 NJEVUZ.exe 215 PID 5808 wrote to memory of 3012 5808 cmd.exe 219 PID 3012 wrote to memory of 5936 3012 VWI.exe 220 PID 5936 wrote to memory of 4456 5936 cmd.exe 224 PID 4456 wrote to memory of 2188 4456 XUWWN.exe 225 PID 2188 wrote to memory of 916 2188 cmd.exe 229 PID 916 wrote to memory of 5828 916 YPAA.exe 230 PID 5828 wrote to memory of 4948 5828 cmd.exe 234 PID 4948 wrote to memory of 3164 4948 CFGAEO.exe 235 PID 3164 wrote to memory of 5236 3164 cmd.exe 239 PID 5236 wrote to memory of 1528 5236 CIK.exe 240 PID 1528 wrote to memory of 5804 1528 cmd.exe 244 PID 5804 wrote to memory of 4716 5804 EGQ.exe 245 PID 4716 wrote to memory of 1832 4716 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_238f3cd045009c9bb6323fc3a4ca4293_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_238f3cd045009c9bb6323fc3a4ca4293_elex_emotet_stop.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KKBAA.exe.bat" "2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\windows\system\KKBAA.exeC:\windows\system\KKBAA.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RQV.exe.bat" "4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\windows\system\RQV.exeC:\windows\system\RQV.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DBF.exe.bat" "6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\windows\SysWOW64\DBF.exeC:\windows\system32\DBF.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5224 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GOX.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\windows\system\GOX.exeC:\windows\system\GOX.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VEYCQHZ.exe.bat" "10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\windows\SysWOW64\VEYCQHZ.exeC:\windows\system32\VEYCQHZ.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UPASYV.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:5824 -
C:\windows\SysWOW64\UPASYV.exeC:\windows\system32\UPASYV.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HZJR.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:3752 -
C:\windows\system\HZJR.exeC:\windows\system\HZJR.exe15⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RILWQDT.exe.bat" "16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\windows\system\RILWQDT.exeC:\windows\system\RILWQDT.exe17⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KAAHH.exe.bat" "18⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\windows\system\KAAHH.exeC:\windows\system\KAAHH.exe19⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZQB.exe.bat" "20⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5424 -
C:\windows\system\ZQB.exeC:\windows\system\ZQB.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BOH.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\windows\BOH.exeC:\windows\BOH.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NWNAI.exe.bat" "24⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\windows\system\NWNAI.exeC:\windows\system\NWNAI.exe25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VMWAGGK.exe.bat" "26⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\windows\system\VMWAGGK.exeC:\windows\system\VMWAGGK.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FKCMWO.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\windows\FKCMWO.exeC:\windows\FKCMWO.exe29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BPUBMSN.exe.bat" "30⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\windows\system\BPUBMSN.exeC:\windows\system\BPUBMSN.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5172 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CSYF.exe.bat" "32⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:240 -
C:\windows\CSYF.exeC:\windows\CSYF.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RIZXYVL.exe.bat" "34⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6052 -
C:\windows\SysWOW64\RIZXYVL.exeC:\windows\system32\RIZXYVL.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KMDA.exe.bat" "36⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\windows\system\KMDA.exeC:\windows\system\KMDA.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DEKL.exe.bat" "38⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\windows\SysWOW64\DEKL.exeC:\windows\system32\DEKL.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WZWHAK.exe.bat" "40⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:792 -
C:\windows\WZWHAK.exeC:\windows\WZWHAK.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5672 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XCALG.exe.bat" "42⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\windows\SysWOW64\XCALG.exeC:\windows\system32\XCALG.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KNI.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\windows\SysWOW64\KNI.exeC:\windows\system32\KNI.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ULOWCLK.exe.bat" "46⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\windows\SysWOW64\ULOWCLK.exeC:\windows\system32\ULOWCLK.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5332 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MOAZ.exe.bat" "48⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\windows\SysWOW64\MOAZ.exeC:\windows\system32\MOAZ.exe49⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NJEVUZ.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\windows\NJEVUZ.exeC:\windows\NJEVUZ.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VWI.exe.bat" "52⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5808 -
C:\windows\system\VWI.exeC:\windows\system\VWI.exe53⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XUWWN.exe.bat" "54⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5936 -
C:\windows\system\XUWWN.exeC:\windows\system\XUWWN.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YPAA.exe.bat" "56⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\windows\system\YPAA.exeC:\windows\system\YPAA.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CFGAEO.exe.bat" "58⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5828 -
C:\windows\CFGAEO.exeC:\windows\CFGAEO.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CIK.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\windows\CIK.exeC:\windows\CIK.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EGQ.exe.bat" "62⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\windows\system\EGQ.exeC:\windows\system\EGQ.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DRAGISV.exe.bat" "64⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\windows\SysWOW64\DRAGISV.exeC:\windows\system32\DRAGISV.exe65⤵
- Executes dropped EXE
PID:1832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NOGA.exe.bat" "66⤵PID:5444
-
C:\windows\NOGA.exeC:\windows\NOGA.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WPIFTG.exe.bat" "68⤵
- Executes a command shell one-liner
PID:6020 -
C:\windows\SysWOW64\WPIFTG.exeC:\windows\system32\WPIFTG.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5772 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GNOAI.exe.bat" "70⤵PID:6112
-
C:\windows\SysWOW64\GNOAI.exeC:\windows\system32\GNOAI.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ODP.exe.bat" "72⤵PID:5276
-
C:\windows\ODP.exeC:\windows\ODP.exe73⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UAIUCHL.exe.bat" "74⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2672 -
C:\windows\system\UAIUCHL.exeC:\windows\system\UAIUCHL.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IYIGE.exe.bat" "76⤵
- Executes a command shell one-liner
PID:2060 -
C:\windows\IYIGE.exeC:\windows\IYIGE.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1676 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ABMJJJW.exe.bat" "78⤵
- System Location Discovery: System Language Discovery
PID:4968 -
C:\windows\SysWOW64\ABMJJJW.exeC:\windows\system32\ABMJJJW.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BWQFXG.exe.bat" "80⤵
- System Location Discovery: System Language Discovery
PID:3836 -
C:\windows\BWQFXG.exeC:\windows\BWQFXG.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FMEN.exe.bat" "82⤵
- Executes a command shell one-liner
PID:4748 -
C:\windows\system\FMEN.exeC:\windows\system\FMEN.exe83⤵
- Executes dropped EXE
PID:2816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SXNEPCP.exe.bat" "84⤵
- Executes a command shell one-liner
PID:4664 -
C:\windows\SXNEPCP.exeC:\windows\SXNEPCP.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4192 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HNODW.exe.bat" "86⤵PID:976
-
C:\windows\SysWOW64\HNODW.exeC:\windows\system32\HNODW.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NNVRFRF.exe.bat" "88⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2832 -
C:\windows\system\NNVRFRF.exeC:\windows\system\NNVRFRF.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3216 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XOXW.exe.bat" "90⤵PID:5348
-
C:\windows\XOXW.exeC:\windows\XOXW.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VZA.exe.bat" "92⤵
- System Location Discovery: System Language Discovery
PID:2140 -
C:\windows\SysWOW64\VZA.exeC:\windows\system32\VZA.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FWOGG.exe.bat" "94⤵PID:1320
-
C:\windows\system\FWOGG.exeC:\windows\system\FWOGG.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YZRC.exe.bat" "96⤵PID:4792
-
C:\windows\system\YZRC.exeC:\windows\system\YZRC.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1164 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TNWLWB.exe.bat" "98⤵
- System Location Discovery: System Language Discovery
PID:4956 -
C:\windows\system\TNWLWB.exeC:\windows\system\TNWLWB.exe99⤵
- Executes dropped EXE
PID:6044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YNE.exe.bat" "100⤵PID:1244
-
C:\windows\system\YNE.exeC:\windows\system\YNE.exe101⤵
- Executes dropped EXE
PID:4404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZQIDS.exe.bat" "102⤵PID:6104
-
C:\windows\ZQIDS.exeC:\windows\ZQIDS.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MBQ.exe.bat" "104⤵PID:4928
-
C:\windows\MBQ.exeC:\windows\MBQ.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CRRTFR.exe.bat" "106⤵PID:4248
-
C:\windows\system\CRRTFR.exeC:\windows\system\CRRTFR.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3388 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UMVXL.exe.bat" "108⤵
- Executes a command shell one-liner
PID:4588 -
C:\windows\SysWOW64\UMVXL.exeC:\windows\system32\UMVXL.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EKJ.exe.bat" "110⤵
- Executes a command shell one-liner
PID:2056 -
C:\windows\EKJ.exeC:\windows\EKJ.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IAPRM.exe.bat" "112⤵PID:2288
-
C:\windows\SysWOW64\IAPRM.exeC:\windows\system32\IAPRM.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MIWRRAS.exe.bat" "114⤵PID:5844
-
C:\windows\system\MIWRRAS.exeC:\windows\system\MIWRRAS.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SDVAV.exe.bat" "116⤵
- System Location Discovery: System Language Discovery
PID:2876 -
C:\windows\SysWOW64\SDVAV.exeC:\windows\system32\SDVAV.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RTGV.exe.bat" "118⤵
- System Location Discovery: System Language Discovery
PID:4924 -
C:\windows\system\RTGV.exeC:\windows\system\RTGV.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KGNT.exe.bat" "120⤵
- System Location Discovery: System Language Discovery
PID:1200 -
C:\windows\SysWOW64\KGNT.exeC:\windows\system32\KGNT.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4944
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-