Analysis
- max time kernel
94s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/08/2026, 05:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-09_33e1272764317743738d66153a96d6fd_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-09_33e1272764317743738d66153a96d6fd_elex_emotet_stop.exe
- Size 208KB
- Sample260809-gdd6za1gja
- SHA256 217e4a3cbc488784b3bd4206675c8be16f658451bc5b1ba7e04c0d37b9610e8c
- MD5 33e1272764317743738d66153a96d6fd
- SHA1 d4c017ccd84f612b1d6780748f483ac2d61ba44c
- SHA512 559939530a40cbd09d3fa976ae25f7676f1229fb87114980816023d00734f138864df24c3c39f9082906903ce6829a66d66686cdead9ca66b3f74b3da4231042
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlFdL+LOfl4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFlF5+LOtkEj1
- TLSH T1ED247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3276 JDZIXQ.exe 2660 ADP.exe 5108 VJCGPG.exe 5976 ZRJ.exe 3008 SUMKHOL.exe 5740 DCTS.exe 4296 CYSSQKW.exe 2980 VQIDH.exe 6080 EYKI.exe 1292 HMGSV.exe 2560 BZLBXIK.exe 2568 RUDOQ.exe 4580 JXGJWKU.exe 124 KAKN.exe 6028 TAMSMGY.exe 1612 SYXNZL.exe 2904 SEYCBY.exe 1236 LWFMSR.exe 3592 MZJ.exe 2584 TPSQECP.exe 4904 ODP.exe 4892 DYGDAX.exe 6024 LLYSBCH.exe 2768 YOPQP.exe 576 VUNGXWE.exe 6116 EUP.exe 4552 PMSD.exe 1752 VNZRRD.exe 1904 BNHFIXY.exe 3528 BBHTKKT.exe 5692 FJOBWDP.exe 4332 ATWSC.exe 5612 VHBJNFZ.exe 5780 BCAKRIP.exe 3352 VPFU.exe 4508 EDPMJFR.exe 820 VNGJRZN.exe 6100 KIPOC.exe 3228 WBSHKB.exe 3016 BBAUTV.exe 5952 NUD.exe 3080 CKEFAY.exe 4284 NIPKVFK.exe 5092 VVHZWSM.exe 5016 KTNW.exe 3768 QTVKMW.exe 5428 WOUKRZF.exe 5924 SUSH.exe 3464 QUZV.exe 2840 HUCATIL.exe 3776 NVJ.exe 4380 IIOXM.exe 1756 MYVX.exe 3212 GLZPAV.exe 4256 QUBUMAO.exe 5372 WUJI.exe 2132 HNM.exe 5316 SFHLD.exe 2360 NIXKS.exe 2852 NVQYT.exe 1376 IJUIDHZ.exe 4584 MRJQQ.exe 1520 HEGZAZ.exe 5920 SUUZ.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\EYKI.exe VQIDH.exe File created C:\windows\SysWOW64\MZJ.exe LWFMSR.exe File created C:\windows\SysWOW64\PMSD.exe EUP.exe File created C:\windows\SysWOW64\ALOSCQ.exe GYJI.exe File created C:\windows\SysWOW64\SMDIACS.exe SHDCZP.exe File created C:\windows\SysWOW64\EPSLZBG.exe.bat DMO.exe File created C:\windows\SysWOW64\RHTHWO.exe OUPX.exe File created C:\windows\SysWOW64\JXGJWKU.exe.bat RUDOQ.exe File opened for modification C:\windows\SysWOW64\CKEFAY.exe NUD.exe File created C:\windows\SysWOW64\QUZV.exe SUSH.exe File opened for modification C:\windows\SysWOW64\QUZV.exe SUSH.exe File created C:\windows\SysWOW64\QUZV.exe.bat SUSH.exe File created C:\windows\SysWOW64\ZVTGHT.exe RQOAXU.exe File opened for modification C:\windows\SysWOW64\IXYTL.exe EPSLZBG.exe File created C:\windows\SysWOW64\APJ.exe.bat JCZJGB.exe File created C:\windows\SysWOW64\ALOSCQ.exe.bat GYJI.exe File created C:\windows\SysWOW64\JTLZ.exe.bat MWFC.exe File created C:\windows\SysWOW64\SUSH.exe.bat WOUKRZF.exe File created C:\windows\SysWOW64\CQDIFGU.exe HUYZV.exe File opened for modification C:\windows\SysWOW64\ZVTGHT.exe RQOAXU.exe File opened for modification C:\windows\SysWOW64\APJ.exe JCZJGB.exe File created C:\windows\SysWOW64\CFROU.exe.bat CKNKHT.exe File opened for modification C:\windows\SysWOW64\JTLZ.exe MWFC.exe File opened for modification C:\windows\SysWOW64\EYKI.exe VQIDH.exe File created C:\windows\SysWOW64\IXYTL.exe.bat EPSLZBG.exe File opened for modification C:\windows\SysWOW64\CFROU.exe CKNKHT.exe File created C:\windows\SysWOW64\JDZIXQ.exe 2026-08-09_33e1272764317743738d66153a96d6fd_elex_emotet_stop.exe File opened for modification C:\windows\SysWOW64\NVJ.exe HUCATIL.exe File created C:\windows\SysWOW64\RUYE.exe.bat VPFP.exe File created C:\windows\SysWOW64\RHTHWO.exe.bat OUPX.exe File created C:\windows\SysWOW64\CFROU.exe CKNKHT.exe File created C:\windows\SysWOW64\EYKI.exe.bat VQIDH.exe File opened for modification C:\windows\SysWOW64\VPFU.exe BCAKRIP.exe File created C:\windows\SysWOW64\KNXGDTO.exe.bat SANO.exe File opened for modification C:\windows\SysWOW64\PMSD.exe EUP.exe File opened for modification C:\windows\SysWOW64\WBSHKB.exe KIPOC.exe File created C:\windows\SysWOW64\SFHLD.exe.bat HNM.exe File created C:\windows\SysWOW64\PUFFRDB.exe OGFQPY.exe File created C:\windows\SysWOW64\ZRJ.exe VJCGPG.exe File opened for modification C:\windows\SysWOW64\MZJ.exe LWFMSR.exe File opened for modification C:\windows\SysWOW64\GYJI.exe CQDIFGU.exe File opened for modification C:\windows\SysWOW64\RHTHWO.exe OUPX.exe File created C:\windows\SysWOW64\VPFU.exe.bat BCAKRIP.exe File created C:\windows\SysWOW64\NVQYT.exe.bat NIXKS.exe File created C:\windows\SysWOW64\GYJI.exe.bat CQDIFGU.exe File created C:\windows\SysWOW64\SMDIACS.exe.bat SHDCZP.exe File opened for modification C:\windows\SysWOW64\KNXGDTO.exe SANO.exe File created C:\windows\SysWOW64\MOPW.exe.bat XLFRFE.exe File opened for modification C:\windows\SysWOW64\RUYE.exe VPFP.exe File created C:\windows\SysWOW64\NJOA.exe DLIGD.exe File created C:\windows\SysWOW64\VNGJRZN.exe.bat EDPMJFR.exe File created C:\windows\SysWOW64\WBSHKB.exe KIPOC.exe File created C:\windows\SysWOW64\HUCATIL.exe QUZV.exe File created C:\windows\SysWOW64\MYVX.exe.bat IIOXM.exe File created C:\windows\SysWOW64\HEO.exe SBEUU.exe File created C:\windows\SysWOW64\XNO.exe TFHBM.exe File created C:\windows\SysWOW64\VPFU.exe BCAKRIP.exe File created C:\windows\SysWOW64\NVJ.exe HUCATIL.exe File created C:\windows\SysWOW64\MYVX.exe IIOXM.exe File created C:\windows\SysWOW64\NJOA.exe.bat DLIGD.exe File created C:\windows\SysWOW64\JCZJGB.exe.bat RGVO.exe File created C:\windows\SysWOW64\JDZIXQ.exe.bat 2026-08-09_33e1272764317743738d66153a96d6fd_elex_emotet_stop.exe File created C:\windows\SysWOW64\VNGJRZN.exe EDPMJFR.exe File opened for modification C:\windows\SysWOW64\VNGJRZN.exe EDPMJFR.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\BWP.exe JTLZ.exe File opened for modification C:\windows\system\NPKN.exe BWP.exe File created C:\windows\system\VUNGXWE.exe.bat YOPQP.exe File created C:\windows\system\EUP.exe.bat VUNGXWE.exe File opened for modification C:\windows\EDPMJFR.exe VPFU.exe File created C:\windows\system\NIXKS.exe.bat SFHLD.exe File created C:\windows\system\XLFRFE.exe.bat KNXGDTO.exe File created C:\windows\system\SHDCZP.exe.bat DMTP.exe File created C:\windows\system\SBEUU.exe KVMF.exe File created C:\windows\system\BBHTKKT.exe BNHFIXY.exe File created C:\windows\system\NHT.exe HHMUCE.exe File created C:\windows\system\BLWZZEV.exe.bat NJOA.exe File opened for modification C:\windows\system\LGNCMX.exe OFG.exe File created C:\windows\KAKN.exe.bat JXGJWKU.exe File opened for modification C:\windows\SYXNZL.exe TAMSMGY.exe File created C:\windows\SYXNZL.exe.bat TAMSMGY.exe File created C:\windows\BBAUTV.exe.bat WBSHKB.exe File created C:\windows\NIPKVFK.exe.bat CKEFAY.exe File created C:\windows\system\VVHZWSM.exe.bat NIPKVFK.exe File opened for modification C:\windows\system\KTNW.exe VVHZWSM.exe File created C:\windows\system\VPFP.exe UMCTXJP.exe File created C:\windows\BCAKRIP.exe VHBJNFZ.exe File created C:\windows\XTWXWR.exe CFROU.exe File opened for modification C:\windows\LLYSBCH.exe DYGDAX.exe File opened for modification C:\windows\system\BBHTKKT.exe BNHFIXY.exe File created C:\windows\system\MRJQQ.exe.bat IJUIDHZ.exe File created C:\windows\system\HUYZV.exe.bat NHT.exe File created C:\windows\system\SUMKHOL.exe.bat ZRJ.exe File created C:\windows\HMGSV.exe EYKI.exe File opened for modification C:\windows\system\EUP.exe VUNGXWE.exe File opened for modification C:\windows\BNHFIXY.exe VNZRRD.exe File created C:\windows\NIPKVFK.exe CKEFAY.exe File opened for modification C:\windows\RQOAXU.exe HHMVL.exe File created C:\windows\system\SBEUU.exe.bat KVMF.exe File created C:\windows\XTWXWR.exe.bat CFROU.exe File created C:\windows\ATWSC.exe.bat FJOBWDP.exe File created C:\windows\system\KTNW.exe VVHZWSM.exe File opened for modification C:\windows\system\XLFRFE.exe KNXGDTO.exe File opened for modification C:\windows\system\DCTS.exe SUMKHOL.exe File created C:\windows\system\VUNGXWE.exe YOPQP.exe File created C:\windows\BNHFIXY.exe VNZRRD.exe File opened for modification C:\windows\system\HUYZV.exe NHT.exe File created C:\windows\ODP.exe.bat TPSQECP.exe File created C:\windows\system\VVHZWSM.exe NIPKVFK.exe File opened for modification C:\windows\DLIGD.exe QFAUBI.exe File created C:\windows\BNHFIXY.exe.bat VNZRRD.exe File opened for modification C:\windows\ATWSC.exe FJOBWDP.exe File opened for modification C:\windows\system\UMCTXJP.exe QEVLLQB.exe File created C:\windows\system\RGV.exe.bat LGNCMX.exe File created C:\windows\system\CYSSQKW.exe.bat DCTS.exe File created C:\windows\system\TPSQECP.exe MZJ.exe File opened for modification C:\windows\VNZRRD.exe PMSD.exe File created C:\windows\FJOBWDP.exe.bat BBHTKKT.exe File created C:\windows\ATWSC.exe FJOBWDP.exe File created C:\windows\WUJI.exe QUBUMAO.exe File created C:\windows\OFG.exe RAIZ.exe File created C:\windows\SYXNZL.exe TAMSMGY.exe File opened for modification C:\windows\system\TPSQECP.exe MZJ.exe File created C:\windows\LLYSBCH.exe DYGDAX.exe File created C:\windows\IIOXM.exe.bat NVJ.exe File created C:\windows\OFG.exe.bat RAIZ.exe File opened for modification C:\windows\RUDOQ.exe BZLBXIK.exe File created C:\windows\system\YOPQP.exe.bat LLYSBCH.exe File created C:\windows\QUBUMAO.exe.bat GLZPAV.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1632 cmd.exe 4492 cmd.exe 4832 cmd.exe 1416 cmd.exe 964 cmd.exe 4968 cmd.exe 1424 cmd.exe 5652 cmd.exe 5864 cmd.exe 2392 cmd.exe 6012 cmd.exe 1436 cmd.exe 4828 cmd.exe 6124 cmd.exe 5184 cmd.exe 4448 cmd.exe 1444 cmd.exe 2416 cmd.exe 2600 cmd.exe 3408 cmd.exe 3904 cmd.exe 704 cmd.exe 2168 cmd.exe 5756 cmd.exe 5980 cmd.exe 2940 cmd.exe 2596 cmd.exe 4104 cmd.exe 728 cmd.exe 868 cmd.exe 5824 cmd.exe 1244 cmd.exe 1140 cmd.exe 1912 cmd.exe 5784 cmd.exe 2632 cmd.exe 3348 cmd.exe 3412 cmd.exe 6040 cmd.exe 1284 cmd.exe 4936 cmd.exe 1204 cmd.exe 5676 cmd.exe 6072 cmd.exe 1996 cmd.exe 5664 cmd.exe 2108 cmd.exe 2348 cmd.exe 2804 cmd.exe 3240 cmd.exe 1288 cmd.exe 4276 cmd.exe 3012 cmd.exe 1348 cmd.exe 2244 cmd.exe 4908 cmd.exe 3036 cmd.exe 244 cmd.exe 4916 cmd.exe 4764 cmd.exe 4208 cmd.exe 1372 cmd.exe 3184 cmd.exe 236 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 1460 4232 WerFault.exe 88 4676 3276 WerFault.exe 93 4688 2660 WerFault.exe 99 3620 5108 WerFault.exe 104 4160 5976 WerFault.exe 109 4732 3008 WerFault.exe 114 3464 5740 WerFault.exe 119 2724 4296 WerFault.exe 124 3240 2980 WerFault.exe 129 4584 6080 WerFault.exe 134 2120 1292 WerFault.exe 139 2240 2560 WerFault.exe 144 2164 2568 WerFault.exe 149 4860 4580 WerFault.exe 154 1428 124 WerFault.exe 159 2816 6028 WerFault.exe 164 3448 1612 WerFault.exe 169 5856 2904 WerFault.exe 174 4472 1236 WerFault.exe 179 4196 3592 WerFault.exe 184 5952 2584 WerFault.exe 189 2620 4904 WerFault.exe 194 5148 4892 WerFault.exe 199 4900 6024 WerFault.exe 204 3260 2768 WerFault.exe 209 2152 576 WerFault.exe 214 5296 6116 WerFault.exe 219 1352 4552 WerFault.exe 224 4732 1752 WerFault.exe 229 4492 1904 WerFault.exe 234 5392 3528 WerFault.exe 239 580 5692 WerFault.exe 244 6040 4332 WerFault.exe 249 1140 5612 WerFault.exe 254 4676 5780 WerFault.exe 259 1528 3352 WerFault.exe 264 4592 4508 WerFault.exe 269 5096 820 WerFault.exe 274 2372 6100 WerFault.exe 280 1076 3228 WerFault.exe 285 1856 3016 WerFault.exe 290 2148 5952 WerFault.exe 295 3856 3080 WerFault.exe 300 3756 4284 WerFault.exe 305 3012 5092 WerFault.exe 310 4140 5016 WerFault.exe 315 4672 3768 WerFault.exe 320 4980 5428 WerFault.exe 325 700 5924 WerFault.exe 330 3240 3464 WerFault.exe 335 796 2840 WerFault.exe 340 3788 3776 WerFault.exe 345 4920 4380 WerFault.exe 350 4812 1756 WerFault.exe 355 236 3212 WerFault.exe 360 1092 4256 WerFault.exe 365 5096 5372 WerFault.exe 370 3480 2132 WerFault.exe 375 3476 5316 WerFault.exe 380 3416 2360 WerFault.exe 385 1816 2852 WerFault.exe 390 5024 1376 WerFault.exe 395 5252 4584 WerFault.exe 400 412 1520 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EDPMJFR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QFAUBI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WOUKRZF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KTNW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GYJI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language APJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NVJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WBSHKB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BNHFIXY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MOPW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XTWXWR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ADP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VNGJRZN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MTHK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BBHTKKT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SHDCZP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UMCTXJP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JZJGJLQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MZJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RUYE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BLWZZEV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JCZJGB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MYVX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VJCGPG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LGNCMX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VUNGXWE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HHMUCE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DMTP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QUBUMAO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HUYZV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RAIZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JDZIXQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EPSLZBG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SJZTI.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4232 2026-08-09_33e1272764317743738d66153a96d6fd_elex_emotet_stop.exe 4232 2026-08-09_33e1272764317743738d66153a96d6fd_elex_emotet_stop.exe 3276 JDZIXQ.exe 3276 JDZIXQ.exe 2660 ADP.exe 2660 ADP.exe 5108 VJCGPG.exe 5108 VJCGPG.exe 5976 ZRJ.exe 5976 ZRJ.exe 3008 SUMKHOL.exe 3008 SUMKHOL.exe 5740 DCTS.exe 5740 DCTS.exe 4296 CYSSQKW.exe 4296 CYSSQKW.exe 2980 VQIDH.exe 2980 VQIDH.exe 6080 EYKI.exe 6080 EYKI.exe 1292 HMGSV.exe 1292 HMGSV.exe 2560 BZLBXIK.exe 2560 BZLBXIK.exe 2568 RUDOQ.exe 2568 RUDOQ.exe 4580 JXGJWKU.exe 4580 JXGJWKU.exe 124 KAKN.exe 124 KAKN.exe 6028 TAMSMGY.exe 6028 TAMSMGY.exe 1612 SYXNZL.exe 1612 SYXNZL.exe 2904 SEYCBY.exe 2904 SEYCBY.exe 1236 LWFMSR.exe 1236 LWFMSR.exe 3592 MZJ.exe 3592 MZJ.exe 2584 TPSQECP.exe 2584 TPSQECP.exe 4904 ODP.exe 4904 ODP.exe 4892 DYGDAX.exe 4892 DYGDAX.exe 6024 LLYSBCH.exe 6024 LLYSBCH.exe 2768 YOPQP.exe 2768 YOPQP.exe 576 VUNGXWE.exe 576 VUNGXWE.exe 6116 EUP.exe 6116 EUP.exe 4552 PMSD.exe 4552 PMSD.exe 1752 VNZRRD.exe 1752 VNZRRD.exe 1904 BNHFIXY.exe 1904 BNHFIXY.exe 3528 BBHTKKT.exe 3528 BBHTKKT.exe 5692 FJOBWDP.exe 5692 FJOBWDP.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4232 2026-08-09_33e1272764317743738d66153a96d6fd_elex_emotet_stop.exe 4232 2026-08-09_33e1272764317743738d66153a96d6fd_elex_emotet_stop.exe 3276 JDZIXQ.exe 3276 JDZIXQ.exe 2660 ADP.exe 2660 ADP.exe 5108 VJCGPG.exe 5108 VJCGPG.exe 5976 ZRJ.exe 5976 ZRJ.exe 3008 SUMKHOL.exe 3008 SUMKHOL.exe 5740 DCTS.exe 5740 DCTS.exe 4296 CYSSQKW.exe 4296 CYSSQKW.exe 2980 VQIDH.exe 2980 VQIDH.exe 6080 EYKI.exe 6080 EYKI.exe 1292 HMGSV.exe 1292 HMGSV.exe 2560 BZLBXIK.exe 2560 BZLBXIK.exe 2568 RUDOQ.exe 2568 RUDOQ.exe 4580 JXGJWKU.exe 4580 JXGJWKU.exe 124 KAKN.exe 124 KAKN.exe 6028 TAMSMGY.exe 6028 TAMSMGY.exe 1612 SYXNZL.exe 1612 SYXNZL.exe 2904 SEYCBY.exe 2904 SEYCBY.exe 1236 LWFMSR.exe 1236 LWFMSR.exe 3592 MZJ.exe 3592 MZJ.exe 2584 TPSQECP.exe 2584 TPSQECP.exe 4904 ODP.exe 4904 ODP.exe 4892 DYGDAX.exe 4892 DYGDAX.exe 6024 LLYSBCH.exe 6024 LLYSBCH.exe 2768 YOPQP.exe 2768 YOPQP.exe 576 VUNGXWE.exe 576 VUNGXWE.exe 6116 EUP.exe 6116 EUP.exe 4552 PMSD.exe 4552 PMSD.exe 1752 VNZRRD.exe 1752 VNZRRD.exe 1904 BNHFIXY.exe 1904 BNHFIXY.exe 3528 BBHTKKT.exe 3528 BBHTKKT.exe 5692 FJOBWDP.exe 5692 FJOBWDP.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4232 wrote to memory of 3348 4232 2026-08-09_33e1272764317743738d66153a96d6fd_elex_emotet_stop.exe 89 PID 3348 wrote to memory of 3276 3348 cmd.exe 93 PID 3276 wrote to memory of 2600 3276 JDZIXQ.exe 95 PID 2600 wrote to memory of 2660 2600 cmd.exe 99 PID 2660 wrote to memory of 204 2660 ADP.exe 100 PID 204 wrote to memory of 5108 204 cmd.exe 104 PID 5108 wrote to memory of 4940 5108 VJCGPG.exe 105 PID 4940 wrote to memory of 5976 4940 cmd.exe 109 PID 5976 wrote to memory of 1080 5976 ZRJ.exe 110 PID 1080 wrote to memory of 3008 1080 cmd.exe 114 PID 3008 wrote to memory of 4348 3008 SUMKHOL.exe 115 PID 4348 wrote to memory of 5740 4348 cmd.exe 119 PID 5740 wrote to memory of 3164 5740 DCTS.exe 120 PID 3164 wrote to memory of 4296 3164 cmd.exe 124 PID 4296 wrote to memory of 3412 4296 CYSSQKW.exe 125 PID 3412 wrote to memory of 2980 3412 cmd.exe 129 PID 2980 wrote to memory of 3700 2980 VQIDH.exe 130 PID 3700 wrote to memory of 6080 3700 cmd.exe 134 PID 6080 wrote to memory of 3576 6080 EYKI.exe 135 PID 3576 wrote to memory of 1292 3576 cmd.exe 139 PID 1292 wrote to memory of 6048 1292 HMGSV.exe 140 PID 6048 wrote to memory of 2560 6048 cmd.exe 144 PID 2560 wrote to memory of 4144 2560 BZLBXIK.exe 145 PID 4144 wrote to memory of 2568 4144 cmd.exe 149 PID 2568 wrote to memory of 4908 2568 RUDOQ.exe 150 PID 4908 wrote to memory of 4580 4908 cmd.exe 154 PID 4580 wrote to memory of 1996 4580 JXGJWKU.exe 155 PID 1996 wrote to memory of 124 1996 cmd.exe 159 PID 124 wrote to memory of 2856 124 KAKN.exe 160 PID 2856 wrote to memory of 6028 2856 cmd.exe 164 PID 6028 wrote to memory of 4420 6028 TAMSMGY.exe 165 PID 4420 wrote to memory of 1612 4420 cmd.exe 169 PID 1612 wrote to memory of 5852 1612 SYXNZL.exe 170 PID 5852 wrote to memory of 2904 5852 cmd.exe 174 PID 2904 wrote to memory of 2484 2904 SEYCBY.exe 175 PID 2484 wrote to memory of 1236 2484 cmd.exe 179 PID 1236 wrote to memory of 1860 1236 LWFMSR.exe 180 PID 1860 wrote to memory of 3592 1860 cmd.exe 184 PID 3592 wrote to memory of 5820 3592 MZJ.exe 185 PID 5820 wrote to memory of 2584 5820 cmd.exe 189 PID 2584 wrote to memory of 732 2584 TPSQECP.exe 190 PID 732 wrote to memory of 4904 732 cmd.exe 194 PID 4904 wrote to memory of 4808 4904 ODP.exe 195 PID 4808 wrote to memory of 4892 4808 cmd.exe 199 PID 4892 wrote to memory of 4828 4892 DYGDAX.exe 200 PID 4828 wrote to memory of 6024 4828 cmd.exe 204 PID 6024 wrote to memory of 1892 6024 LLYSBCH.exe 205 PID 1892 wrote to memory of 2768 1892 cmd.exe 209 PID 2768 wrote to memory of 3056 2768 YOPQP.exe 210 PID 3056 wrote to memory of 576 3056 cmd.exe 214 PID 576 wrote to memory of 4416 576 VUNGXWE.exe 215 PID 4416 wrote to memory of 6116 4416 cmd.exe 219 PID 6116 wrote to memory of 5756 6116 EUP.exe 220 PID 5756 wrote to memory of 4552 5756 cmd.exe 224 PID 4552 wrote to memory of 2376 4552 PMSD.exe 225 PID 2376 wrote to memory of 1752 2376 cmd.exe 229 PID 1752 wrote to memory of 2488 1752 VNZRRD.exe 230 PID 2488 wrote to memory of 1904 2488 cmd.exe 234 PID 1904 wrote to memory of 3268 1904 BNHFIXY.exe 235 PID 3268 wrote to memory of 3528 3268 cmd.exe 239 PID 3528 wrote to memory of 1244 3528 BBHTKKT.exe 240 PID 1244 wrote to memory of 5692 1244 cmd.exe 244 PID 5692 wrote to memory of 4968 5692 FJOBWDP.exe 245 PID 4968 wrote to memory of 4332 4968 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_33e1272764317743738d66153a96d6fd_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_33e1272764317743738d66153a96d6fd_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JDZIXQ.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3348 -
C:\windows\SysWOW64\JDZIXQ.exeC:\windows\system32\JDZIXQ.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ADP.exe.bat" "4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\windows\system\ADP.exeC:\windows\system\ADP.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VJCGPG.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:204 -
C:\windows\VJCGPG.exeC:\windows\VJCGPG.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZRJ.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\windows\SysWOW64\ZRJ.exeC:\windows\system32\ZRJ.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SUMKHOL.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\windows\system\SUMKHOL.exeC:\windows\system\SUMKHOL.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DCTS.exe.bat" "12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\windows\system\DCTS.exeC:\windows\system\DCTS.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CYSSQKW.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\windows\system\CYSSQKW.exeC:\windows\system\CYSSQKW.exe15⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VQIDH.exe.bat" "16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\windows\system\VQIDH.exeC:\windows\system\VQIDH.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EYKI.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:3700 -
C:\windows\SysWOW64\EYKI.exeC:\windows\system32\EYKI.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HMGSV.exe.bat" "20⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\windows\HMGSV.exeC:\windows\HMGSV.exe21⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BZLBXIK.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:6048 -
C:\windows\BZLBXIK.exeC:\windows\BZLBXIK.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RUDOQ.exe.bat" "24⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\windows\RUDOQ.exeC:\windows\RUDOQ.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JXGJWKU.exe.bat" "26⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\windows\SysWOW64\JXGJWKU.exeC:\windows\system32\JXGJWKU.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KAKN.exe.bat" "28⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\windows\KAKN.exeC:\windows\KAKN.exe29⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TAMSMGY.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\windows\TAMSMGY.exeC:\windows\TAMSMGY.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6028 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SYXNZL.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\windows\SYXNZL.exeC:\windows\SYXNZL.exe33⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SEYCBY.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:5852 -
C:\windows\system\SEYCBY.exeC:\windows\system\SEYCBY.exe35⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LWFMSR.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\windows\system\LWFMSR.exeC:\windows\system\LWFMSR.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MZJ.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\windows\SysWOW64\MZJ.exeC:\windows\system32\MZJ.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TPSQECP.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:5820 -
C:\windows\system\TPSQECP.exeC:\windows\system\TPSQECP.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ODP.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:732 -
C:\windows\ODP.exeC:\windows\ODP.exe43⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DYGDAX.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\windows\DYGDAX.exeC:\windows\DYGDAX.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LLYSBCH.exe.bat" "46⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\windows\LLYSBCH.exeC:\windows\LLYSBCH.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6024 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YOPQP.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\windows\system\YOPQP.exeC:\windows\system\YOPQP.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VUNGXWE.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\windows\system\VUNGXWE.exeC:\windows\system\VUNGXWE.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EUP.exe.bat" "52⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\windows\system\EUP.exeC:\windows\system\EUP.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PMSD.exe.bat" "54⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5756 -
C:\windows\SysWOW64\PMSD.exeC:\windows\system32\PMSD.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VNZRRD.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\windows\VNZRRD.exeC:\windows\VNZRRD.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BNHFIXY.exe.bat" "58⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\windows\BNHFIXY.exeC:\windows\BNHFIXY.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BBHTKKT.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\windows\system\BBHTKKT.exeC:\windows\system\BBHTKKT.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FJOBWDP.exe.bat" "62⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\windows\FJOBWDP.exeC:\windows\FJOBWDP.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ATWSC.exe.bat" "64⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\windows\ATWSC.exeC:\windows\ATWSC.exe65⤵
- Executes dropped EXE
PID:4332 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VHBJNFZ.exe.bat" "66⤵PID:2620
-
C:\windows\SysWOW64\VHBJNFZ.exeC:\windows\system32\VHBJNFZ.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BCAKRIP.exe.bat" "68⤵
- Executes a command shell one-liner
PID:1424 -
C:\windows\BCAKRIP.exeC:\windows\BCAKRIP.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VPFU.exe.bat" "70⤵PID:5808
-
C:\windows\SysWOW64\VPFU.exeC:\windows\system32\VPFU.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EDPMJFR.exe.bat" "72⤵
- Executes a command shell one-liner
PID:5980 -
C:\windows\EDPMJFR.exeC:\windows\EDPMJFR.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VNGJRZN.exe.bat" "74⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1632 -
C:\windows\SysWOW64\VNGJRZN.exeC:\windows\system32\VNGJRZN.exe75⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KIPOC.exe.bat" "76⤵
- Executes a command shell one-liner
PID:3184 -
C:\windows\KIPOC.exeC:\windows\KIPOC.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WBSHKB.exe.bat" "78⤵
- System Location Discovery: System Language Discovery
PID:5540 -
C:\windows\SysWOW64\WBSHKB.exeC:\windows\system32\WBSHKB.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3228 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BBAUTV.exe.bat" "80⤵
- Executes a command shell one-liner
PID:4492 -
C:\windows\BBAUTV.exeC:\windows\BBAUTV.exe81⤵
- Executes dropped EXE
PID:3016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NUD.exe.bat" "82⤵
- System Location Discovery: System Language Discovery
PID:608 -
C:\windows\system\NUD.exeC:\windows\system\NUD.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CKEFAY.exe.bat" "84⤵PID:1568
-
C:\windows\SysWOW64\CKEFAY.exeC:\windows\system32\CKEFAY.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NIPKVFK.exe.bat" "86⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:6040 -
C:\windows\NIPKVFK.exeC:\windows\NIPKVFK.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VVHZWSM.exe.bat" "88⤵
- Executes a command shell one-liner
PID:1140 -
C:\windows\system\VVHZWSM.exeC:\windows\system\VVHZWSM.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KTNW.exe.bat" "90⤵
- Executes a command shell one-liner
PID:2940 -
C:\windows\system\KTNW.exeC:\windows\system\KTNW.exe91⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QTVKMW.exe.bat" "92⤵PID:3764
-
C:\windows\system\QTVKMW.exeC:\windows\system\QTVKMW.exe93⤵
- Executes dropped EXE
PID:3768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WOUKRZF.exe.bat" "94⤵PID:832
-
C:\windows\WOUKRZF.exeC:\windows\WOUKRZF.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SUSH.exe.bat" "96⤵PID:200
-
C:\windows\SysWOW64\SUSH.exeC:\windows\system32\SUSH.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QUZV.exe.bat" "98⤵
- Executes a command shell one-liner
PID:3408 -
C:\windows\SysWOW64\QUZV.exeC:\windows\system32\QUZV.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HUCATIL.exe.bat" "100⤵
- System Location Discovery: System Language Discovery
PID:2536 -
C:\windows\SysWOW64\HUCATIL.exeC:\windows\system32\HUCATIL.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NVJ.exe.bat" "102⤵PID:3616
-
C:\windows\SysWOW64\NVJ.exeC:\windows\system32\NVJ.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IIOXM.exe.bat" "104⤵
- Executes a command shell one-liner
PID:5824 -
C:\windows\IIOXM.exeC:\windows\IIOXM.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MYVX.exe.bat" "106⤵PID:3856
-
C:\windows\SysWOW64\MYVX.exeC:\windows\system32\MYVX.exe107⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GLZPAV.exe.bat" "108⤵
- System Location Discovery: System Language Discovery
PID:4924 -
C:\windows\system\GLZPAV.exeC:\windows\system\GLZPAV.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3212 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QUBUMAO.exe.bat" "110⤵
- Executes a command shell one-liner
PID:5664 -
C:\windows\QUBUMAO.exeC:\windows\QUBUMAO.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WUJI.exe.bat" "112⤵
- System Location Discovery: System Language Discovery
PID:2476 -
C:\windows\WUJI.exeC:\windows\WUJI.exe113⤵
- Executes dropped EXE
PID:5372 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HNM.exe.bat" "114⤵PID:6128
-
C:\windows\system\HNM.exeC:\windows\system\HNM.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SFHLD.exe.bat" "116⤵
- Executes a command shell one-liner
PID:5652 -
C:\windows\SysWOW64\SFHLD.exeC:\windows\system32\SFHLD.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5316 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NIXKS.exe.bat" "118⤵
- Executes a command shell one-liner
PID:2596 -
C:\windows\system\NIXKS.exeC:\windows\system\NIXKS.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NVQYT.exe.bat" "120⤵PID:3544
-
C:\windows\SysWOW64\NVQYT.exeC:\windows\system32\NVQYT.exe121⤵
- Executes dropped EXE
PID:2852
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-