Analysis
- max time kernel
150s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/08/2026, 05:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-09_30ef083dadee32c9e62f35c5e063095b_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-09_30ef083dadee32c9e62f35c5e063095b_elex_emotet_stop.exe
- Size 208KB
- Sample260809-gdxcjs1gkd
- SHA256 05cc0c3a944695572900dceade67ab9363a9d25d3b78d369bb45d9e0d5646236
- MD5 30ef083dadee32c9e62f35c5e063095b
- SHA1 9a3bed339a6263d0a02c580eebeae840c24590f8
- SHA512 e77c2eae3af11c41e3f57d54581d55a5f1d863aa3bf0b2fdad218e7e25e2f715214f977c021e3631a567e72926352c8c5cc55550a73e1376e400144eb2770ae6
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5Xb1lldL+LOfP4pLthEjQT6j:MlZtbLWIgd1LZ9oECZb1ll5+LO3kEj1
- TLSH T127247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4088 YGQL.exe 4568 DCQSIJT.exe 3544 CMTAJX.exe 5888 MKZ.exe 2784 OIM.exe 4964 SYTPS.exe 3672 AETETL.exe 3488 YTEG.exe 4836 RWI.exe 1132 EUIOWSJ.exe 2948 QKXW.exe 5552 ISDT.exe 724 KQRO.exe 3052 TOWIRS.exe 5704 HMWUT.exe 4376 NHIMZS.exe 4888 QUZWSEY.exe 3768 EQLPYAH.exe 5968 RVLBI.exe 2360 COAMS.exe 5796 UWPRE.exe 5964 XEPGLQX.exe 4428 QXFRVRF.exe 5100 WSQRIF.exe 1184 EYVYTE.exe 5912 OVJSB.exe 4300 LWKVE.exe 5936 YHBTTTW.exe 5656 XSEBBH.exe 4936 QKTULIA.exe 4604 NLVXWE.exe 4476 KDFZAIS.exe 5792 FONYP.exe 3260 AWWMWF.exe 4156 ECGCM.exe 3256 GZUW.exe 4844 KCSRTCP.exe 308 GNAIH.exe 2084 HLOC.exe 2660 RJUWEDB.exe 6108 QUWMNJ.exe 4480 BMMXWK.exe 6096 IHLYBNV.exe 3772 SFRSIW.exe 5928 JNFQVN.exe 844 LLLKKV.exe 5652 ABMJJJW.exe 4816 NECAXTS.exe 5148 SFEKJX.exe 3640 LII.exe 3680 MLUKUDM.exe 1304 GYQT.exe 4804 BLVDPD.exe 4868 SZGVEAD.exe 4628 BZIAI.exe 1364 LHKFLC.exe 2024 FUP.exe 4380 UPYBHP.exe 3944 CDLHR.exe 5200 KJDWTA.exe 5600 MGQQIJ.exe 3080 YOX.exe 3300 TKCZX.exe 5076 RKJNG.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\MKZ.exe.bat CMTAJX.exe File created C:\windows\SysWOW64\FONYP.exe KDFZAIS.exe File created C:\windows\SysWOW64\FONYP.exe.bat KDFZAIS.exe File created C:\windows\SysWOW64\NECAXTS.exe.bat ABMJJJW.exe File created C:\windows\SysWOW64\MLUKUDM.exe.bat LII.exe File created C:\windows\SysWOW64\WWISFD.exe.bat DDTHWK.exe File created C:\windows\SysWOW64\UFMYDI.exe LWKLA.exe File opened for modification C:\windows\SysWOW64\ROUGHHR.exe BYT.exe File created C:\windows\SysWOW64\MKZ.exe CMTAJX.exe File opened for modification C:\windows\SysWOW64\MKZ.exe CMTAJX.exe File created C:\windows\SysWOW64\QKXW.exe EUIOWSJ.exe File created C:\windows\SysWOW64\ISDT.exe.bat QKXW.exe File created C:\windows\SysWOW64\RVLBI.exe EQLPYAH.exe File created C:\windows\SysWOW64\XEPGLQX.exe.bat UWPRE.exe File created C:\windows\SysWOW64\BLVDPD.exe GYQT.exe File opened for modification C:\windows\SysWOW64\TKCZX.exe YOX.exe File created C:\windows\SysWOW64\QKXW.exe.bat EUIOWSJ.exe File opened for modification C:\windows\SysWOW64\ISDT.exe QKXW.exe File opened for modification C:\windows\SysWOW64\BLVDPD.exe GYQT.exe File opened for modification C:\windows\SysWOW64\SZGVEAD.exe BLVDPD.exe File created C:\windows\SysWOW64\SZGVEAD.exe.bat BLVDPD.exe File created C:\windows\SysWOW64\IDQ.exe.bat IYYPK.exe File opened for modification C:\windows\SysWOW64\SZE.exe HHBVAAN.exe File created C:\windows\SysWOW64\LWKLA.exe.bat WBAGHQA.exe File created C:\windows\SysWOW64\LLLKKV.exe.bat JNFQVN.exe File opened for modification C:\windows\SysWOW64\NECAXTS.exe ABMJJJW.exe File created C:\windows\SysWOW64\SZGVEAD.exe BLVDPD.exe File created C:\windows\SysWOW64\WWISFD.exe DDTHWK.exe File opened for modification C:\windows\SysWOW64\WBAGHQA.exe WWISFD.exe File opened for modification C:\windows\SysWOW64\UFMYDI.exe LWKLA.exe File opened for modification C:\windows\SysWOW64\TECDE.exe RHPJPCI.exe File created C:\windows\SysWOW64\PFHCAO.exe WCVG.exe File opened for modification C:\windows\SysWOW64\RVLBI.exe EQLPYAH.exe File opened for modification C:\windows\SysWOW64\EYVYTE.exe WSQRIF.exe File opened for modification C:\windows\SysWOW64\LWKVE.exe OVJSB.exe File opened for modification C:\windows\SysWOW64\JNFQVN.exe SFRSIW.exe File created C:\windows\SysWOW64\MGQQIJ.exe KJDWTA.exe File opened for modification C:\windows\SysWOW64\MGQQIJ.exe KJDWTA.exe File created C:\windows\SysWOW64\TKCZX.exe.bat YOX.exe File created C:\windows\SysWOW64\DDTHWK.exe RLQOOVI.exe File opened for modification C:\windows\SysWOW64\ABMJJJW.exe LLLKKV.exe File created C:\windows\SysWOW64\NECAXTS.exe ABMJJJW.exe File opened for modification C:\windows\SysWOW64\WWISFD.exe DDTHWK.exe File created C:\windows\SysWOW64\XYD.exe GXPIMQS.exe File created C:\windows\SysWOW64\QEL.exe MOENXU.exe File opened for modification C:\windows\SysWOW64\RHPJPCI.exe QEL.exe File created C:\windows\SysWOW64\ISDT.exe QKXW.exe File created C:\windows\SysWOW64\BMMXWK.exe QUWMNJ.exe File created C:\windows\SysWOW64\BMMXWK.exe.bat QUWMNJ.exe File created C:\windows\SysWOW64\KJDWTA.exe.bat CDLHR.exe File created C:\windows\SysWOW64\SZE.exe.bat HHBVAAN.exe File created C:\windows\SysWOW64\LWKLA.exe WBAGHQA.exe File created C:\windows\SysWOW64\LWKVE.exe.bat OVJSB.exe File created C:\windows\SysWOW64\JNFQVN.exe SFRSIW.exe File created C:\windows\SysWOW64\JNFQVN.exe.bat SFRSIW.exe File created C:\windows\SysWOW64\MLUKUDM.exe LII.exe File created C:\windows\SysWOW64\MGQQIJ.exe.bat KJDWTA.exe File created C:\windows\SysWOW64\IDQ.exe IYYPK.exe File created C:\windows\SysWOW64\RLQOOVI.exe VFSZH.exe File created C:\windows\SysWOW64\QEL.exe.bat MOENXU.exe File created C:\windows\SysWOW64\XEPGLQX.exe UWPRE.exe File created C:\windows\SysWOW64\LWKVE.exe OVJSB.exe File opened for modification C:\windows\SysWOW64\SFEKJX.exe NECAXTS.exe File opened for modification C:\windows\SysWOW64\MLUKUDM.exe LII.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\RWI.exe.bat YTEG.exe File created C:\windows\EUIOWSJ.exe RWI.exe File created C:\windows\TOWIRS.exe.bat KQRO.exe File created C:\windows\RJUWEDB.exe HLOC.exe File created C:\windows\system\TDGLR.exe.bat CDMGOL.exe File opened for modification C:\windows\IYYPK.exe TDGLR.exe File created C:\windows\DCQSIJT.exe YGQL.exe File opened for modification C:\windows\NHIMZS.exe HMWUT.exe File created C:\windows\QXFRVRF.exe XEPGLQX.exe File created C:\windows\XSEBBH.exe.bat YHBTTTW.exe File opened for modification C:\windows\KCSRTCP.exe GZUW.exe File created C:\windows\YOX.exe.bat MGQQIJ.exe File created C:\windows\VFSZH.exe.bat JNPG.exe File created C:\windows\system\OIM.exe MKZ.exe File opened for modification C:\windows\RWI.exe YTEG.exe File created C:\windows\KQRO.exe.bat ISDT.exe File opened for modification C:\windows\EQLPYAH.exe QUZWSEY.exe File created C:\windows\LHKFLC.exe.bat BZIAI.exe File created C:\windows\IYYPK.exe.bat TDGLR.exe File created C:\windows\MOENXU.exe.bat XYD.exe File opened for modification C:\windows\system\ZBHNRF.exe ROUGHHR.exe File created C:\windows\system\SYTPS.exe.bat OIM.exe File created C:\windows\system\UWPRE.exe.bat COAMS.exe File created C:\windows\QKTULIA.exe.bat XSEBBH.exe File opened for modification C:\windows\RKJNG.exe TKCZX.exe File created C:\windows\MTXMY.exe.bat IDQ.exe File created C:\windows\system\VSHNGKF.exe TECDE.exe File opened for modification C:\windows\system\VSHNGKF.exe TECDE.exe File opened for modification C:\windows\system\KDFZAIS.exe NLVXWE.exe File created C:\windows\GNAIH.exe KCSRTCP.exe File created C:\windows\GNAIH.exe.bat KCSRTCP.exe File created C:\windows\LII.exe SFEKJX.exe File opened for modification C:\windows\CDMGOL.exe RKJNG.exe File created C:\windows\system\TSHA.exe VSHNGKF.exe File created C:\windows\system\TSHA.exe.bat VSHNGKF.exe File opened for modification C:\windows\system\WCVG.exe OWQZ.exe File created C:\windows\KCSRTCP.exe.bat GZUW.exe File opened for modification C:\windows\LHKFLC.exe BZIAI.exe File created C:\windows\IYYPK.exe TDGLR.exe File created C:\windows\system\CMTAJX.exe DCQSIJT.exe File created C:\windows\system\KDFZAIS.exe NLVXWE.exe File opened for modification C:\windows\system\TSHA.exe VSHNGKF.exe File created C:\windows\QUZWSEY.exe.bat NHIMZS.exe File opened for modification C:\windows\system\WSQRIF.exe QXFRVRF.exe File opened for modification C:\windows\system\GZUW.exe ECGCM.exe File created C:\windows\system\QUWMNJ.exe.bat RJUWEDB.exe File created C:\windows\system\GXPIMQS.exe.bat UFMYDI.exe File opened for modification C:\windows\MOENXU.exe XYD.exe File opened for modification C:\windows\system\OWQZ.exe ZBHNRF.exe File opened for modification C:\windows\XSEBBH.exe YHBTTTW.exe File created C:\windows\system\ECGCM.exe AWWMWF.exe File opened for modification C:\windows\RJUWEDB.exe HLOC.exe File opened for modification C:\windows\system\BZIAI.exe SZGVEAD.exe File opened for modification C:\windows\YOX.exe MGQQIJ.exe File created C:\windows\RKJNG.exe.bat TKCZX.exe File created C:\windows\YHBTTTW.exe LWKVE.exe File created C:\windows\AWWMWF.exe.bat FONYP.exe File opened for modification C:\windows\SFRSIW.exe IHLYBNV.exe File created C:\windows\LHKFLC.exe BZIAI.exe File opened for modification C:\windows\EUIOWSJ.exe RWI.exe File created C:\windows\system\HMWUT.exe TOWIRS.exe File created C:\windows\EQLPYAH.exe QUZWSEY.exe File created C:\windows\system\ECGCM.exe.bat AWWMWF.exe File created C:\windows\system\CDLHR.exe UPYBHP.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4668 cmd.exe 5168 cmd.exe 3352 cmd.exe 1176 cmd.exe 1180 cmd.exe 1316 cmd.exe 2300 cmd.exe 3096 cmd.exe 4092 cmd.exe 2400 cmd.exe 2312 cmd.exe 1060 cmd.exe 3292 cmd.exe 3844 cmd.exe 3932 cmd.exe 264 cmd.exe 848 cmd.exe 1404 cmd.exe 4136 cmd.exe 1216 cmd.exe 5904 cmd.exe 2900 cmd.exe 4472 cmd.exe 5580 cmd.exe 1756 cmd.exe 2480 cmd.exe 5472 cmd.exe 5800 cmd.exe 1780 cmd.exe 5864 cmd.exe 4700 cmd.exe 3788 cmd.exe 2512 cmd.exe 1388 cmd.exe 5352 cmd.exe 1100 cmd.exe 4056 cmd.exe 1804 cmd.exe 4384 cmd.exe 4784 cmd.exe 692 cmd.exe 4072 cmd.exe 4492 cmd.exe 2404 cmd.exe 2880 cmd.exe 6072 cmd.exe 436 cmd.exe 4800 cmd.exe 2864 cmd.exe 5956 cmd.exe 1384 cmd.exe 2476 cmd.exe 4608 cmd.exe 4776 cmd.exe 644 cmd.exe 4304 cmd.exe 3180 cmd.exe 5544 cmd.exe 5424 cmd.exe 2064 cmd.exe 236 cmd.exe 3420 cmd.exe 3480 cmd.exe 1160 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 848 2812 WerFault.exe 88 2112 4088 WerFault.exe 93 1740 4568 WerFault.exe 99 5108 3544 WerFault.exe 104 3320 5888 WerFault.exe 109 4276 2784 WerFault.exe 114 5764 4964 WerFault.exe 119 6104 3672 WerFault.exe 124 3660 3488 WerFault.exe 129 2952 4836 WerFault.exe 134 2508 1132 WerFault.exe 138 2128 2948 WerFault.exe 144 2868 5552 WerFault.exe 149 1080 724 WerFault.exe 154 4424 3052 WerFault.exe 159 2400 5704 WerFault.exe 164 716 4376 WerFault.exe 169 4092 4888 WerFault.exe 174 1556 3768 WerFault.exe 179 4336 5968 WerFault.exe 184 5792 2360 WerFault.exe 189 2292 5796 WerFault.exe 194 5516 5964 WerFault.exe 199 5836 4428 WerFault.exe 204 5932 5100 WerFault.exe 209 964 1184 WerFault.exe 214 2720 5912 WerFault.exe 219 2296 4300 WerFault.exe 224 4384 5936 WerFault.exe 229 4968 5656 WerFault.exe 234 3816 4936 WerFault.exe 239 4804 4604 WerFault.exe 244 3156 4476 WerFault.exe 249 5672 5792 WerFault.exe 254 4120 3260 WerFault.exe 259 4720 4156 WerFault.exe 265 4932 3256 WerFault.exe 270 1944 4844 WerFault.exe 275 3788 308 WerFault.exe 280 372 2084 WerFault.exe 285 2376 2660 WerFault.exe 290 2800 6108 WerFault.exe 295 1084 4480 WerFault.exe 300 4924 6096 WerFault.exe 305 2164 3772 WerFault.exe 310 4340 5928 WerFault.exe 315 2064 844 WerFault.exe 320 2908 5652 WerFault.exe 325 4144 4816 WerFault.exe 330 5748 5148 WerFault.exe 335 4508 3640 WerFault.exe 340 5848 3680 WerFault.exe 345 2240 1304 WerFault.exe 350 5260 4804 WerFault.exe 355 3164 4868 WerFault.exe 360 6052 4628 WerFault.exe 365 200 1364 WerFault.exe 370 2356 2024 WerFault.exe 375 3880 4380 WerFault.exe 380 3244 3944 WerFault.exe 385 3444 5200 WerFault.exe 390 1676 5600 WerFault.exe 395 2608 3080 WerFault.exe 400 2860 3300 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XSEBBH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MLUKUDM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MOENXU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WCVG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EQLPYAH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SYTPS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KQRO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UWPRE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LHKFLC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RLQOOVI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RKJNG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HHBVAAN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SZE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SFEKJX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XEPGLQX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QXFRVRF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FONYP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DDTHWK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SZGVEAD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KJDWTA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XYD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WSQRIF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LII.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BZIAI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QUZWSEY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OVJSB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AETETL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YTEG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HMWUT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RJUWEDB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TKCZX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KCSRTCP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BMMXWK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FUP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IYYPK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UPYBHP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MTXMY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GYQT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2812 2026-08-09_30ef083dadee32c9e62f35c5e063095b_elex_emotet_stop.exe 2812 2026-08-09_30ef083dadee32c9e62f35c5e063095b_elex_emotet_stop.exe 4088 YGQL.exe 4088 YGQL.exe 4568 DCQSIJT.exe 4568 DCQSIJT.exe 3544 CMTAJX.exe 3544 CMTAJX.exe 5888 MKZ.exe 5888 MKZ.exe 2784 OIM.exe 2784 OIM.exe 4964 SYTPS.exe 4964 SYTPS.exe 3672 AETETL.exe 3672 AETETL.exe 3488 YTEG.exe 3488 YTEG.exe 4836 RWI.exe 4836 RWI.exe 1132 EUIOWSJ.exe 1132 EUIOWSJ.exe 2948 QKXW.exe 2948 QKXW.exe 5552 ISDT.exe 5552 ISDT.exe 724 KQRO.exe 724 KQRO.exe 3052 TOWIRS.exe 3052 TOWIRS.exe 5704 HMWUT.exe 5704 HMWUT.exe 4376 NHIMZS.exe 4376 NHIMZS.exe 4888 QUZWSEY.exe 4888 QUZWSEY.exe 3768 EQLPYAH.exe 3768 EQLPYAH.exe 5968 RVLBI.exe 5968 RVLBI.exe 2360 COAMS.exe 2360 COAMS.exe 5796 UWPRE.exe 5796 UWPRE.exe 5964 XEPGLQX.exe 5964 XEPGLQX.exe 4428 QXFRVRF.exe 4428 QXFRVRF.exe 5100 WSQRIF.exe 5100 WSQRIF.exe 1184 EYVYTE.exe 1184 EYVYTE.exe 5912 OVJSB.exe 5912 OVJSB.exe 4300 LWKVE.exe 4300 LWKVE.exe 5936 YHBTTTW.exe 5936 YHBTTTW.exe 5656 XSEBBH.exe 5656 XSEBBH.exe 4936 QKTULIA.exe 4936 QKTULIA.exe 4604 NLVXWE.exe 4604 NLVXWE.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2812 2026-08-09_30ef083dadee32c9e62f35c5e063095b_elex_emotet_stop.exe 2812 2026-08-09_30ef083dadee32c9e62f35c5e063095b_elex_emotet_stop.exe 4088 YGQL.exe 4088 YGQL.exe 4568 DCQSIJT.exe 4568 DCQSIJT.exe 3544 CMTAJX.exe 3544 CMTAJX.exe 5888 MKZ.exe 5888 MKZ.exe 2784 OIM.exe 2784 OIM.exe 4964 SYTPS.exe 4964 SYTPS.exe 3672 AETETL.exe 3672 AETETL.exe 3488 YTEG.exe 3488 YTEG.exe 4836 RWI.exe 4836 RWI.exe 1132 EUIOWSJ.exe 1132 EUIOWSJ.exe 2948 QKXW.exe 2948 QKXW.exe 5552 ISDT.exe 5552 ISDT.exe 724 KQRO.exe 724 KQRO.exe 3052 TOWIRS.exe 3052 TOWIRS.exe 5704 HMWUT.exe 5704 HMWUT.exe 4376 NHIMZS.exe 4376 NHIMZS.exe 4888 QUZWSEY.exe 4888 QUZWSEY.exe 3768 EQLPYAH.exe 3768 EQLPYAH.exe 5968 RVLBI.exe 5968 RVLBI.exe 2360 COAMS.exe 2360 COAMS.exe 5796 UWPRE.exe 5796 UWPRE.exe 5964 XEPGLQX.exe 5964 XEPGLQX.exe 4428 QXFRVRF.exe 4428 QXFRVRF.exe 5100 WSQRIF.exe 5100 WSQRIF.exe 1184 EYVYTE.exe 1184 EYVYTE.exe 5912 OVJSB.exe 5912 OVJSB.exe 4300 LWKVE.exe 4300 LWKVE.exe 5936 YHBTTTW.exe 5936 YHBTTTW.exe 5656 XSEBBH.exe 5656 XSEBBH.exe 4936 QKTULIA.exe 4936 QKTULIA.exe 4604 NLVXWE.exe 4604 NLVXWE.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2812 wrote to memory of 3352 2812 2026-08-09_30ef083dadee32c9e62f35c5e063095b_elex_emotet_stop.exe 89 PID 3352 wrote to memory of 4088 3352 cmd.exe 93 PID 4088 wrote to memory of 4136 4088 YGQL.exe 95 PID 4136 wrote to memory of 4568 4136 cmd.exe 99 PID 4568 wrote to memory of 952 4568 DCQSIJT.exe 100 PID 952 wrote to memory of 3544 952 cmd.exe 104 PID 3544 wrote to memory of 2592 3544 CMTAJX.exe 105 PID 2592 wrote to memory of 5888 2592 cmd.exe 109 PID 5888 wrote to memory of 644 5888 MKZ.exe 110 PID 644 wrote to memory of 2784 644 cmd.exe 114 PID 2784 wrote to memory of 820 2784 OIM.exe 115 PID 820 wrote to memory of 4964 820 cmd.exe 119 PID 4964 wrote to memory of 3480 4964 SYTPS.exe 120 PID 3480 wrote to memory of 3672 3480 cmd.exe 124 PID 3672 wrote to memory of 1160 3672 AETETL.exe 125 PID 1160 wrote to memory of 3488 1160 cmd.exe 129 PID 3488 wrote to memory of 1952 3488 YTEG.exe 130 PID 1952 wrote to memory of 4836 1952 cmd.exe 134 PID 4836 wrote to memory of 1680 4836 RWI.exe 135 PID 1680 wrote to memory of 1132 1680 cmd.exe 138 PID 1132 wrote to memory of 4304 1132 EUIOWSJ.exe 140 PID 4304 wrote to memory of 2948 4304 cmd.exe 144 PID 2948 wrote to memory of 3180 2948 QKXW.exe 145 PID 3180 wrote to memory of 5552 3180 cmd.exe 149 PID 5552 wrote to memory of 4620 5552 ISDT.exe 150 PID 4620 wrote to memory of 724 4620 cmd.exe 154 PID 724 wrote to memory of 5544 724 KQRO.exe 155 PID 5544 wrote to memory of 3052 5544 cmd.exe 159 PID 3052 wrote to memory of 5140 3052 TOWIRS.exe 160 PID 5140 wrote to memory of 5704 5140 cmd.exe 164 PID 5704 wrote to memory of 5352 5704 HMWUT.exe 165 PID 5352 wrote to memory of 4376 5352 cmd.exe 169 PID 4376 wrote to memory of 1324 4376 NHIMZS.exe 170 PID 1324 wrote to memory of 4888 1324 cmd.exe 174 PID 4888 wrote to memory of 4828 4888 QUZWSEY.exe 175 PID 4828 wrote to memory of 3768 4828 cmd.exe 179 PID 3768 wrote to memory of 4140 3768 EQLPYAH.exe 180 PID 4140 wrote to memory of 5968 4140 cmd.exe 184 PID 5968 wrote to memory of 5424 5968 RVLBI.exe 185 PID 5424 wrote to memory of 2360 5424 cmd.exe 189 PID 2360 wrote to memory of 1216 2360 COAMS.exe 190 PID 1216 wrote to memory of 5796 1216 cmd.exe 194 PID 5796 wrote to memory of 1100 5796 UWPRE.exe 195 PID 1100 wrote to memory of 5964 1100 cmd.exe 199 PID 5964 wrote to memory of 4792 5964 XEPGLQX.exe 200 PID 4792 wrote to memory of 4428 4792 cmd.exe 204 PID 4428 wrote to memory of 3276 4428 QXFRVRF.exe 205 PID 3276 wrote to memory of 5100 3276 cmd.exe 209 PID 5100 wrote to memory of 4548 5100 WSQRIF.exe 210 PID 4548 wrote to memory of 1184 4548 cmd.exe 214 PID 1184 wrote to memory of 2832 1184 EYVYTE.exe 215 PID 2832 wrote to memory of 5912 2832 cmd.exe 219 PID 5912 wrote to memory of 2596 5912 OVJSB.exe 220 PID 2596 wrote to memory of 4300 2596 cmd.exe 224 PID 4300 wrote to memory of 436 4300 LWKVE.exe 225 PID 436 wrote to memory of 5936 436 cmd.exe 229 PID 5936 wrote to memory of 716 5936 YHBTTTW.exe 230 PID 716 wrote to memory of 5656 716 cmd.exe 234 PID 5656 wrote to memory of 3268 5656 XSEBBH.exe 235 PID 3268 wrote to memory of 4936 3268 cmd.exe 239 PID 4936 wrote to memory of 4400 4936 QKTULIA.exe 240 PID 4400 wrote to memory of 4604 4400 cmd.exe 244 PID 4604 wrote to memory of 5860 4604 NLVXWE.exe 245 PID 5860 wrote to memory of 4476 5860 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_30ef083dadee32c9e62f35c5e063095b_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_30ef083dadee32c9e62f35c5e063095b_elex_emotet_stop.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YGQL.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\windows\YGQL.exeC:\windows\YGQL.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DCQSIJT.exe.bat" "4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\windows\DCQSIJT.exeC:\windows\DCQSIJT.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CMTAJX.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:952 -
C:\windows\system\CMTAJX.exeC:\windows\system\CMTAJX.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MKZ.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\windows\SysWOW64\MKZ.exeC:\windows\system32\MKZ.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OIM.exe.bat" "10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:644 -
C:\windows\system\OIM.exeC:\windows\system\OIM.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SYTPS.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:820 -
C:\windows\system\SYTPS.exeC:\windows\system\SYTPS.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AETETL.exe.bat" "14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3480 -
C:\windows\AETETL.exeC:\windows\AETETL.exe15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YTEG.exe.bat" "16⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\windows\system\YTEG.exeC:\windows\system\YTEG.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RWI.exe.bat" "18⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\windows\RWI.exeC:\windows\RWI.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EUIOWSJ.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\windows\EUIOWSJ.exeC:\windows\EUIOWSJ.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QKXW.exe.bat" "22⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\windows\SysWOW64\QKXW.exeC:\windows\system32\QKXW.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ISDT.exe.bat" "24⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\windows\SysWOW64\ISDT.exeC:\windows\system32\ISDT.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KQRO.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\windows\KQRO.exeC:\windows\KQRO.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TOWIRS.exe.bat" "28⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5544 -
C:\windows\TOWIRS.exeC:\windows\TOWIRS.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HMWUT.exe.bat" "30⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5140 -
C:\windows\system\HMWUT.exeC:\windows\system\HMWUT.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NHIMZS.exe.bat" "32⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5352 -
C:\windows\NHIMZS.exeC:\windows\NHIMZS.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QUZWSEY.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\windows\QUZWSEY.exeC:\windows\QUZWSEY.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EQLPYAH.exe.bat" "36⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\windows\EQLPYAH.exeC:\windows\EQLPYAH.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RVLBI.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\windows\SysWOW64\RVLBI.exeC:\windows\system32\RVLBI.exe39⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\COAMS.exe.bat" "40⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5424 -
C:\windows\system\COAMS.exeC:\windows\system\COAMS.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UWPRE.exe.bat" "42⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\windows\system\UWPRE.exeC:\windows\system\UWPRE.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XEPGLQX.exe.bat" "44⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\windows\SysWOW64\XEPGLQX.exeC:\windows\system32\XEPGLQX.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QXFRVRF.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\windows\QXFRVRF.exeC:\windows\QXFRVRF.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WSQRIF.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\windows\system\WSQRIF.exeC:\windows\system\WSQRIF.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EYVYTE.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\windows\SysWOW64\EYVYTE.exeC:\windows\system32\EYVYTE.exe51⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OVJSB.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\windows\system\OVJSB.exeC:\windows\system\OVJSB.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LWKVE.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\windows\SysWOW64\LWKVE.exeC:\windows\system32\LWKVE.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YHBTTTW.exe.bat" "56⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:436 -
C:\windows\YHBTTTW.exeC:\windows\YHBTTTW.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XSEBBH.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:716 -
C:\windows\XSEBBH.exeC:\windows\XSEBBH.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5656 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QKTULIA.exe.bat" "60⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\windows\QKTULIA.exeC:\windows\QKTULIA.exe61⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NLVXWE.exe.bat" "62⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\windows\NLVXWE.exeC:\windows\NLVXWE.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KDFZAIS.exe.bat" "64⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5860 -
C:\windows\system\KDFZAIS.exeC:\windows\system\KDFZAIS.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FONYP.exe.bat" "66⤵
- Executes a command shell one-liner
PID:5904 -
C:\windows\SysWOW64\FONYP.exeC:\windows\system32\FONYP.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5792 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AWWMWF.exe.bat" "68⤵
- System Location Discovery: System Language Discovery
PID:4228 -
C:\windows\AWWMWF.exeC:\windows\AWWMWF.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ECGCM.exe.bat" "70⤵PID:1760
-
C:\windows\system\ECGCM.exeC:\windows\system\ECGCM.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4156 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GZUW.exe.bat" "72⤵
- System Location Discovery: System Language Discovery
PID:3008 -
C:\windows\system\GZUW.exeC:\windows\system\GZUW.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KCSRTCP.exe.bat" "74⤵PID:4580
-
C:\windows\KCSRTCP.exeC:\windows\KCSRTCP.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GNAIH.exe.bat" "76⤵PID:4420
-
C:\windows\GNAIH.exeC:\windows\GNAIH.exe77⤵
- Executes dropped EXE
PID:308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HLOC.exe.bat" "78⤵
- System Location Discovery: System Language Discovery
PID:2364 -
C:\windows\HLOC.exeC:\windows\HLOC.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RJUWEDB.exe.bat" "80⤵PID:1596
-
C:\windows\RJUWEDB.exeC:\windows\RJUWEDB.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QUWMNJ.exe.bat" "82⤵
- Executes a command shell one-liner
PID:4384 -
C:\windows\system\QUWMNJ.exeC:\windows\system\QUWMNJ.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BMMXWK.exe.bat" "84⤵PID:1028
-
C:\windows\SysWOW64\BMMXWK.exeC:\windows\system32\BMMXWK.exe85⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IHLYBNV.exe.bat" "86⤵PID:5724
-
C:\windows\SysWOW64\IHLYBNV.exeC:\windows\system32\IHLYBNV.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6096 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SFRSIW.exe.bat" "88⤵PID:5524
-
C:\windows\SFRSIW.exeC:\windows\SFRSIW.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3772 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JNFQVN.exe.bat" "90⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2512 -
C:\windows\SysWOW64\JNFQVN.exeC:\windows\system32\JNFQVN.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LLLKKV.exe.bat" "92⤵PID:6120
-
C:\windows\SysWOW64\LLLKKV.exeC:\windows\system32\LLLKKV.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ABMJJJW.exe.bat" "94⤵PID:3748
-
C:\windows\SysWOW64\ABMJJJW.exeC:\windows\system32\ABMJJJW.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NECAXTS.exe.bat" "96⤵
- Executes a command shell one-liner
PID:1388 -
C:\windows\SysWOW64\NECAXTS.exeC:\windows\system32\NECAXTS.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SFEKJX.exe.bat" "98⤵PID:1908
-
C:\windows\SysWOW64\SFEKJX.exeC:\windows\system32\SFEKJX.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5148 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LII.exe.bat" "100⤵PID:1564
-
C:\windows\LII.exeC:\windows\LII.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MLUKUDM.exe.bat" "102⤵
- Executes a command shell one-liner
PID:4800 -
C:\windows\SysWOW64\MLUKUDM.exeC:\windows\system32\MLUKUDM.exe103⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3680 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GYQT.exe.bat" "104⤵PID:2208
-
C:\windows\GYQT.exeC:\windows\GYQT.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BLVDPD.exe.bat" "106⤵PID:5572
-
C:\windows\SysWOW64\BLVDPD.exeC:\windows\system32\BLVDPD.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SZGVEAD.exe.bat" "108⤵
- System Location Discovery: System Language Discovery
PID:4164 -
C:\windows\SysWOW64\SZGVEAD.exeC:\windows\system32\SZGVEAD.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BZIAI.exe.bat" "110⤵PID:4496
-
C:\windows\system\BZIAI.exeC:\windows\system\BZIAI.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4628 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LHKFLC.exe.bat" "112⤵PID:5836
-
C:\windows\LHKFLC.exeC:\windows\LHKFLC.exe113⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FUP.exe.bat" "114⤵
- Executes a command shell one-liner
PID:1176 -
C:\windows\system\FUP.exeC:\windows\system\FUP.exe115⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2024 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UPYBHP.exe.bat" "116⤵
- Executes a command shell one-liner
PID:4784 -
C:\windows\system\UPYBHP.exeC:\windows\system\UPYBHP.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CDLHR.exe.bat" "118⤵PID:5368
-
C:\windows\system\CDLHR.exeC:\windows\system\CDLHR.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KJDWTA.exe.bat" "120⤵PID:5480
-
C:\windows\SysWOW64\KJDWTA.exeC:\windows\system32\KJDWTA.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5200
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-