Analysis
- max time kernel
85s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/08/2026, 12:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-09_4de6e468baf83bd36e46ec81d387a45c_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-09_4de6e468baf83bd36e46ec81d387a45c_elex_emotet_stop.exe
- Size 208KB
- Sample260809-ptc8lsad92
- SHA256 c66068ef75eb8b5bc104369ccab6771bc8fcc94f3721f64d5a6b706eaf49b04d
- MD5 4de6e468baf83bd36e46ec81d387a45c
- SHA1 2bb852f675f0573a1b22e80b4ee19a674be5bc3e
- SHA512 050f5173734988f84f49e14fa9dd567779bf484234d7e95d3844e61be5b8df57ad06f536c11e11c84c82d43ce34ef95cf3087840b47f9b9cd04208c84dcd5251
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbclcdL+LOf64NLthEjQT6j:MlZtbLWIgd1LZ9oECZbclc5+LOSQEj1
- TLSH T16B247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 6176 MSRELJA.exe 6256 RTFYY.exe 3432 VJMGK.exe 1660 VEYCQHZ.exe 356 OHBGDX.exe 4740 DCLKOS.exe 6844 EFPOU.exe 2868 RDPZ.exe 1264 RVXT.exe 5852 COAMS.exe 5492 IOIZBHA.exe 3716 JRMD.exe 2188 SRO.exe 5672 EKJBAKT.exe 6848 IAXBEC.exe 5372 BTFM.exe 4960 KTH.exe 788 LWKVE.exe 908 YHBTTTW.exe 1748 NXCLZP.exe 6112 OSGPF.exe 1136 LXQ.exe 2852 WQTPD.exe 108 CQBKMJF.exe 5720 GTZXM.exe 3400 VWI.exe 3136 KMJB.exe 6656 HSBQU.exe 6308 NFBRZ.exe 1844 GIEV.exe 6016 BTNUSKM.exe 5936 ZTUHJ.exe 5932 DWTUJFY.exe 4084 BMMXWK.exe 572 TUOCAQI.exe 4436 IKPCGD.exe 4060 TDWN.exe 4212 POND.exe 4452 YOPQP.exe 5348 RHWBZ.exe 1552 VSU.exe 6184 JULNNJ.exe 5992 RIPUYI.exe 3092 RLTX.exe 6224 IWEGML.exe 3572 DYMEAO.exe 5812 CRXUJ.exe 6784 GZE.exe 3464 ONJJFTC.exe 6692 SVPJS.exe 2520 RGAZ.exe 2160 AOCEE.exe 5904 TGJPN.exe 1448 UJNTTGG.exe 6664 BAOKZ.exe 2240 XCF.exe 1452 ASLJAW.exe 6180 AYLX.exe 2864 DLDH.exe 2784 YGZQXU.exe 2940 NXIIEQA.exe 4440 MHLYMW.exe 2500 GVQ.exe 3060 KLXPBO.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\VEYCQHZ.exe VJMGK.exe File created C:\windows\SysWOW64\EFPOU.exe.bat DCLKOS.exe File created C:\windows\SysWOW64\ZTUHJ.exe BTNUSKM.exe File created C:\windows\SysWOW64\ONJJFTC.exe GZE.exe File opened for modification C:\windows\SysWOW64\ONJJFTC.exe GZE.exe File created C:\windows\SysWOW64\KMM.exe YWGOHR.exe File created C:\windows\SysWOW64\EFPOU.exe DCLKOS.exe File created C:\windows\SysWOW64\CQBKMJF.exe.bat WQTPD.exe File created C:\windows\SysWOW64\ASLJAW.exe XCF.exe File created C:\windows\SysWOW64\LITFZC.exe UIRAW.exe File created C:\windows\SysWOW64\RIPUYI.exe JULNNJ.exe File created C:\windows\SysWOW64\ONJJFTC.exe.bat GZE.exe File opened for modification C:\windows\SysWOW64\LITFZC.exe UIRAW.exe File created C:\windows\SysWOW64\RGFXAEF.exe FYYPW.exe File created C:\windows\SysWOW64\YWGOHR.exe.bat RGFXAEF.exe File opened for modification C:\windows\SysWOW64\KMM.exe YWGOHR.exe File created C:\windows\SysWOW64\SQISQOS.exe VPG.exe File opened for modification C:\windows\SysWOW64\SQISQOS.exe VPG.exe File opened for modification C:\windows\SysWOW64\EFPOU.exe DCLKOS.exe File created C:\windows\SysWOW64\FYCYLOW.exe KLXPBO.exe File created C:\windows\SysWOW64\JIDSXCA.exe.bat AZBFTF.exe File opened for modification C:\windows\SysWOW64\YWGOHR.exe RGFXAEF.exe File created C:\windows\SysWOW64\VJMGK.exe.bat RTFYY.exe File opened for modification C:\windows\SysWOW64\FYCYLOW.exe KLXPBO.exe File created C:\windows\SysWOW64\RXG.exe SANO.exe File created C:\windows\SysWOW64\RGFXAEF.exe.bat FYYPW.exe File created C:\windows\SysWOW64\LWKVE.exe KTH.exe File opened for modification C:\windows\SysWOW64\RIPUYI.exe JULNNJ.exe File created C:\windows\SysWOW64\DYMEAO.exe.bat IWEGML.exe File created C:\windows\SysWOW64\GVQ.exe.bat MHLYMW.exe File created C:\windows\SysWOW64\LITFZC.exe.bat UIRAW.exe File created C:\windows\SysWOW64\MBXYDX.exe.bat CDREWPQ.exe File opened for modification C:\windows\SysWOW64\JHZIA.exe BUNBPB.exe File created C:\windows\SysWOW64\JHZIA.exe.bat BUNBPB.exe File created C:\windows\SysWOW64\GIEV.exe NFBRZ.exe File created C:\windows\SysWOW64\RIPUYI.exe.bat JULNNJ.exe File created C:\windows\SysWOW64\KMM.exe.bat YWGOHR.exe File created C:\windows\SysWOW64\MBXYDX.exe CDREWPQ.exe File opened for modification C:\windows\SysWOW64\LUQRKZR.exe DODKZBW.exe File created C:\windows\SysWOW64\ZTUHJ.exe.bat BTNUSKM.exe File created C:\windows\SysWOW64\BMMXWK.exe DWTUJFY.exe File opened for modification C:\windows\SysWOW64\RGFXAEF.exe FYYPW.exe File created C:\windows\SysWOW64\YWGOHR.exe RGFXAEF.exe File opened for modification C:\windows\SysWOW64\VEYCQHZ.exe VJMGK.exe File created C:\windows\SysWOW64\JRMD.exe IOIZBHA.exe File opened for modification C:\windows\SysWOW64\JRMD.exe IOIZBHA.exe File opened for modification C:\windows\SysWOW64\LWKVE.exe KTH.exe File created C:\windows\SysWOW64\NXCLZP.exe YHBTTTW.exe File opened for modification C:\windows\SysWOW64\ASLJAW.exe XCF.exe File created C:\windows\SysWOW64\FYCYLOW.exe.bat KLXPBO.exe File created C:\windows\SysWOW64\RXG.exe.bat SANO.exe File created C:\windows\SysWOW64\VJMGK.exe RTFYY.exe File created C:\windows\SysWOW64\LWKVE.exe.bat KTH.exe File opened for modification C:\windows\SysWOW64\MBXYDX.exe CDREWPQ.exe File created C:\windows\SysWOW64\LUQRKZR.exe DODKZBW.exe File created C:\windows\SysWOW64\LUQRKZR.exe.bat DODKZBW.exe File opened for modification C:\windows\SysWOW64\BUNBPB.exe ORE.exe File created C:\windows\SysWOW64\SQISQOS.exe.bat VPG.exe File created C:\windows\SysWOW64\JRMD.exe.bat IOIZBHA.exe File created C:\windows\SysWOW64\CQBKMJF.exe WQTPD.exe File created C:\windows\SysWOW64\GIEV.exe.bat NFBRZ.exe File created C:\windows\SysWOW64\DYMEAO.exe IWEGML.exe File opened for modification C:\windows\SysWOW64\DYMEAO.exe IWEGML.exe File created C:\windows\SysWOW64\ASLJAW.exe.bat XCF.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\DWTUJFY.exe.bat ZTUHJ.exe File created C:\windows\system\RLTX.exe.bat RIPUYI.exe File created C:\windows\DHUC.exe DCBN.exe File opened for modification C:\windows\system\VPG.exe JHZIA.exe File created C:\windows\system\WQTPD.exe.bat LXQ.exe File created C:\windows\system\NFBRZ.exe HSBQU.exe File created C:\windows\system\VSU.exe RHWBZ.exe File opened for modification C:\windows\JULNNJ.exe VSU.exe File created C:\windows\YGZQXU.exe.bat DLDH.exe File created C:\windows\system\PWHTAWF.exe FYCYLOW.exe File created C:\windows\system\CDREWPQ.exe AFEKOGH.exe File opened for modification C:\windows\system\OSGPF.exe NXCLZP.exe File opened for modification C:\windows\system\BTNUSKM.exe GIEV.exe File created C:\windows\IKPCGD.exe.bat TUOCAQI.exe File created C:\windows\SVPJS.exe ONJJFTC.exe File opened for modification C:\windows\system\AYLX.exe ASLJAW.exe File created C:\windows\RTFYY.exe.bat MSRELJA.exe File created C:\windows\GTZXM.exe.bat CQBKMJF.exe File created C:\windows\YGZQXU.exe DLDH.exe File created C:\windows\UCG.exe.bat MXUU.exe File created C:\windows\system\YOPQP.exe.bat POND.exe File created C:\windows\AZBFTF.exe PHYUL.exe File created C:\windows\MSRELJA.exe.bat 2026-08-09_4de6e468baf83bd36e46ec81d387a45c_elex_emotet_stop.exe File opened for modification C:\windows\system\COAMS.exe RVXT.exe File opened for modification C:\windows\HSBQU.exe KMJB.exe File created C:\windows\FYYPW.exe.bat KDHN.exe File created C:\windows\YHBTTTW.exe.bat LWKVE.exe File opened for modification C:\windows\system\BAOKZ.exe UJNTTGG.exe File opened for modification C:\windows\system\PWHTAWF.exe FYCYLOW.exe File opened for modification C:\windows\system\ORE.exe RRVAXU.exe File created C:\windows\LXQ.exe.bat OSGPF.exe File created C:\windows\system\BTNUSKM.exe GIEV.exe File opened for modification C:\windows\IKPCGD.exe TUOCAQI.exe File opened for modification C:\windows\YGZQXU.exe DLDH.exe File opened for modification C:\windows\MHLYMW.exe NXIIEQA.exe File opened for modification C:\windows\system\KDHN.exe JIDSXCA.exe File created C:\windows\system\KDHN.exe.bat JIDSXCA.exe File created C:\windows\system\SRZ.exe KMM.exe File created C:\windows\system\IOIZBHA.exe.bat COAMS.exe File opened for modification C:\windows\system\KTH.exe BTFM.exe File opened for modification C:\windows\RVXT.exe RDPZ.exe File created C:\windows\HSBQU.exe KMJB.exe File created C:\windows\RGAZ.exe SVPJS.exe File created C:\windows\system\UJNTTGG.exe TGJPN.exe File opened for modification C:\windows\system\PHYUL.exe AMPHACA.exe File opened for modification C:\windows\system\CDREWPQ.exe AFEKOGH.exe File created C:\windows\system\BAOKZ.exe.bat UJNTTGG.exe File created C:\windows\system\AMPHACA.exe.bat ZJL.exe File opened for modification C:\windows\DLIGD.exe UCG.exe File created C:\windows\RVXT.exe.bat RDPZ.exe File created C:\windows\system\CRXUJ.exe.bat DYMEAO.exe File created C:\windows\system\DLDH.exe.bat AYLX.exe File opened for modification C:\windows\SRO.exe JRMD.exe File created C:\windows\UIRAW.exe QSKSKNR.exe File opened for modification C:\windows\system\TWX.exe LITFZC.exe File created C:\windows\JULNNJ.exe.bat VSU.exe File opened for modification C:\windows\system\UJNTTGG.exe TGJPN.exe File created C:\windows\MHLYMW.exe NXIIEQA.exe File opened for modification C:\windows\UIRAW.exe QSKSKNR.exe File opened for modification C:\windows\system\QIJHJPW.exe RXG.exe File opened for modification C:\windows\system\NFBRZ.exe HSBQU.exe File created C:\windows\system\AOCEE.exe RGAZ.exe File opened for modification C:\windows\QSKSKNR.exe DHUC.exe File created C:\windows\system\TWX.exe.bat LITFZC.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5368 cmd.exe 5876 cmd.exe 860 cmd.exe 6744 cmd.exe 1056 cmd.exe 3520 cmd.exe 5636 cmd.exe 2768 cmd.exe 2844 cmd.exe 4196 cmd.exe 1384 cmd.exe 6552 cmd.exe 5764 cmd.exe 5364 cmd.exe 3384 cmd.exe 4252 cmd.exe 3156 cmd.exe 4956 cmd.exe 4648 cmd.exe 5232 cmd.exe 2888 cmd.exe 5612 cmd.exe 1224 cmd.exe 6924 cmd.exe 3444 cmd.exe 4244 cmd.exe 5880 cmd.exe 5840 cmd.exe 6828 cmd.exe 3108 cmd.exe 6476 cmd.exe 4932 cmd.exe 1824 cmd.exe 2408 cmd.exe 2276 cmd.exe 4488 cmd.exe 6012 cmd.exe 4344 cmd.exe 4376 cmd.exe 2080 cmd.exe 6824 cmd.exe 3332 cmd.exe 4272 cmd.exe 352 cmd.exe 2964 cmd.exe 4456 cmd.exe 4424 cmd.exe 3260 cmd.exe 568 cmd.exe 3344 cmd.exe 3064 cmd.exe 6380 cmd.exe 2000 cmd.exe 6448 cmd.exe 6836 cmd.exe 4884 cmd.exe 4156 cmd.exe 2340 cmd.exe 1140 cmd.exe 3172 cmd.exe 5800 cmd.exe 7064 cmd.exe 4208 cmd.exe 2692 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 504 4540 WerFault.exe 88 4988 6176 WerFault.exe 94 1192 6256 WerFault.exe 100 5624 3432 WerFault.exe 105 6136 1660 WerFault.exe 110 4108 356 WerFault.exe 115 5728 4740 WerFault.exe 120 1916 6844 WerFault.exe 125 6764 2868 WerFault.exe 130 3524 1264 WerFault.exe 135 4044 5852 WerFault.exe 140 1780 5492 WerFault.exe 145 4104 3716 WerFault.exe 150 6412 2188 WerFault.exe 155 5460 5672 WerFault.exe 160 2668 6848 WerFault.exe 165 2444 5372 WerFault.exe 170 3060 4960 WerFault.exe 175 5532 788 WerFault.exe 180 1444 908 WerFault.exe 185 6720 1748 WerFault.exe 190 4636 6112 WerFault.exe 195 5440 1136 WerFault.exe 200 6056 2852 WerFault.exe 205 4204 108 WerFault.exe 210 5104 5720 WerFault.exe 215 5224 3400 WerFault.exe 220 6508 3136 WerFault.exe 225 6000 6656 WerFault.exe 230 5816 6308 WerFault.exe 235 4892 1844 WerFault.exe 240 5336 6016 WerFault.exe 245 4744 5936 WerFault.exe 250 3464 5932 WerFault.exe 255 2636 4084 WerFault.exe 260 2592 572 WerFault.exe 265 4316 4436 WerFault.exe 270 4672 4060 WerFault.exe 275 6128 4212 WerFault.exe 281 3044 4452 WerFault.exe 286 5860 5348 WerFault.exe 291 4996 1552 WerFault.exe 296 5956 6184 WerFault.exe 301 7012 5992 WerFault.exe 306 7164 3092 WerFault.exe 311 6412 6224 WerFault.exe 316 3112 3572 WerFault.exe 321 1512 5812 WerFault.exe 326 2504 6784 WerFault.exe 331 2404 3464 WerFault.exe 336 4676 6692 WerFault.exe 341 3004 2520 WerFault.exe 346 6572 2160 WerFault.exe 351 1936 5904 WerFault.exe 356 3460 1448 WerFault.exe 361 5124 6664 WerFault.exe 366 7148 2240 WerFault.exe 371 5448 1452 WerFault.exe 376 2692 6180 WerFault.exe 381 3732 2864 WerFault.exe 386 6344 2784 WerFault.exe 391 1892 2940 WerFault.exe 396 6120 4440 WerFault.exe 401 2956 2500 WerFault.exe 406 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OJCV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SRO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YWGOHR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CDREWPQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SQISQOS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TDWN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LITFZC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RORFR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TGJPN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RTFYY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VEYCQHZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZTUHJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YGZQXU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LUQRKZR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RVXT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BTFM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AMPHACA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IOIZBHA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OSGPF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BMMXWK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SRJDZTO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MXUU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UIRAW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KDHN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EKJBAKT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GTZXM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VPG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RRVAXU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DYMEAO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4540 2026-08-09_4de6e468baf83bd36e46ec81d387a45c_elex_emotet_stop.exe 4540 2026-08-09_4de6e468baf83bd36e46ec81d387a45c_elex_emotet_stop.exe 6176 MSRELJA.exe 6176 MSRELJA.exe 6256 RTFYY.exe 6256 RTFYY.exe 3432 VJMGK.exe 3432 VJMGK.exe 1660 VEYCQHZ.exe 1660 VEYCQHZ.exe 356 OHBGDX.exe 356 OHBGDX.exe 4740 DCLKOS.exe 4740 DCLKOS.exe 6844 EFPOU.exe 6844 EFPOU.exe 2868 RDPZ.exe 2868 RDPZ.exe 1264 RVXT.exe 1264 RVXT.exe 5852 COAMS.exe 5852 COAMS.exe 5492 IOIZBHA.exe 5492 IOIZBHA.exe 3716 JRMD.exe 3716 JRMD.exe 2188 SRO.exe 2188 SRO.exe 5672 EKJBAKT.exe 5672 EKJBAKT.exe 6848 IAXBEC.exe 6848 IAXBEC.exe 5372 BTFM.exe 5372 BTFM.exe 4960 KTH.exe 4960 KTH.exe 788 LWKVE.exe 788 LWKVE.exe 908 YHBTTTW.exe 908 YHBTTTW.exe 1748 NXCLZP.exe 1748 NXCLZP.exe 6112 OSGPF.exe 6112 OSGPF.exe 1136 LXQ.exe 1136 LXQ.exe 2852 WQTPD.exe 2852 WQTPD.exe 108 CQBKMJF.exe 108 CQBKMJF.exe 5720 GTZXM.exe 5720 GTZXM.exe 3400 VWI.exe 3400 VWI.exe 3136 KMJB.exe 3136 KMJB.exe 6656 HSBQU.exe 6656 HSBQU.exe 6308 NFBRZ.exe 6308 NFBRZ.exe 1844 GIEV.exe 1844 GIEV.exe 6016 BTNUSKM.exe 6016 BTNUSKM.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4540 2026-08-09_4de6e468baf83bd36e46ec81d387a45c_elex_emotet_stop.exe 4540 2026-08-09_4de6e468baf83bd36e46ec81d387a45c_elex_emotet_stop.exe 6176 MSRELJA.exe 6176 MSRELJA.exe 6256 RTFYY.exe 6256 RTFYY.exe 3432 VJMGK.exe 3432 VJMGK.exe 1660 VEYCQHZ.exe 1660 VEYCQHZ.exe 356 OHBGDX.exe 356 OHBGDX.exe 4740 DCLKOS.exe 4740 DCLKOS.exe 6844 EFPOU.exe 6844 EFPOU.exe 2868 RDPZ.exe 2868 RDPZ.exe 1264 RVXT.exe 1264 RVXT.exe 5852 COAMS.exe 5852 COAMS.exe 5492 IOIZBHA.exe 5492 IOIZBHA.exe 3716 JRMD.exe 3716 JRMD.exe 2188 SRO.exe 2188 SRO.exe 5672 EKJBAKT.exe 5672 EKJBAKT.exe 6848 IAXBEC.exe 6848 IAXBEC.exe 5372 BTFM.exe 5372 BTFM.exe 4960 KTH.exe 4960 KTH.exe 788 LWKVE.exe 788 LWKVE.exe 908 YHBTTTW.exe 908 YHBTTTW.exe 1748 NXCLZP.exe 1748 NXCLZP.exe 6112 OSGPF.exe 6112 OSGPF.exe 1136 LXQ.exe 1136 LXQ.exe 2852 WQTPD.exe 2852 WQTPD.exe 108 CQBKMJF.exe 108 CQBKMJF.exe 5720 GTZXM.exe 5720 GTZXM.exe 3400 VWI.exe 3400 VWI.exe 3136 KMJB.exe 3136 KMJB.exe 6656 HSBQU.exe 6656 HSBQU.exe 6308 NFBRZ.exe 6308 NFBRZ.exe 1844 GIEV.exe 1844 GIEV.exe 6016 BTNUSKM.exe 6016 BTNUSKM.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4540 wrote to memory of 3296 4540 2026-08-09_4de6e468baf83bd36e46ec81d387a45c_elex_emotet_stop.exe 90 PID 3296 wrote to memory of 6176 3296 cmd.exe 94 PID 6176 wrote to memory of 1488 6176 MSRELJA.exe 96 PID 1488 wrote to memory of 6256 1488 cmd.exe 100 PID 6256 wrote to memory of 4196 6256 RTFYY.exe 101 PID 4196 wrote to memory of 3432 4196 cmd.exe 105 PID 3432 wrote to memory of 6496 3432 VJMGK.exe 106 PID 6496 wrote to memory of 1660 6496 cmd.exe 110 PID 1660 wrote to memory of 4136 1660 VEYCQHZ.exe 111 PID 4136 wrote to memory of 356 4136 cmd.exe 115 PID 356 wrote to memory of 4396 356 OHBGDX.exe 116 PID 4396 wrote to memory of 4740 4396 cmd.exe 120 PID 4740 wrote to memory of 7128 4740 DCLKOS.exe 121 PID 7128 wrote to memory of 6844 7128 cmd.exe 125 PID 6844 wrote to memory of 3108 6844 EFPOU.exe 126 PID 3108 wrote to memory of 2868 3108 cmd.exe 130 PID 2868 wrote to memory of 3344 2868 RDPZ.exe 131 PID 3344 wrote to memory of 1264 3344 cmd.exe 135 PID 1264 wrote to memory of 2028 1264 RVXT.exe 136 PID 2028 wrote to memory of 5852 2028 cmd.exe 140 PID 5852 wrote to memory of 1068 5852 COAMS.exe 141 PID 1068 wrote to memory of 5492 1068 cmd.exe 145 PID 5492 wrote to memory of 6512 5492 IOIZBHA.exe 146 PID 6512 wrote to memory of 3716 6512 cmd.exe 150 PID 3716 wrote to memory of 1752 3716 JRMD.exe 151 PID 1752 wrote to memory of 2188 1752 cmd.exe 155 PID 2188 wrote to memory of 4564 2188 SRO.exe 156 PID 4564 wrote to memory of 5672 4564 cmd.exe 160 PID 5672 wrote to memory of 4080 5672 EKJBAKT.exe 161 PID 4080 wrote to memory of 6848 4080 cmd.exe 165 PID 6848 wrote to memory of 5612 6848 IAXBEC.exe 166 PID 5612 wrote to memory of 5372 5612 cmd.exe 170 PID 5372 wrote to memory of 4864 5372 BTFM.exe 171 PID 4864 wrote to memory of 4960 4864 cmd.exe 175 PID 4960 wrote to memory of 7064 4960 KTH.exe 176 PID 7064 wrote to memory of 788 7064 cmd.exe 180 PID 788 wrote to memory of 6516 788 LWKVE.exe 181 PID 6516 wrote to memory of 908 6516 cmd.exe 185 PID 908 wrote to memory of 2440 908 YHBTTTW.exe 186 PID 2440 wrote to memory of 1748 2440 cmd.exe 190 PID 1748 wrote to memory of 4884 1748 NXCLZP.exe 191 PID 4884 wrote to memory of 6112 4884 cmd.exe 195 PID 6112 wrote to memory of 4528 6112 OSGPF.exe 196 PID 4528 wrote to memory of 1136 4528 cmd.exe 200 PID 1136 wrote to memory of 3384 1136 LXQ.exe 201 PID 3384 wrote to memory of 2852 3384 cmd.exe 205 PID 2852 wrote to memory of 6240 2852 WQTPD.exe 206 PID 6240 wrote to memory of 108 6240 cmd.exe 210 PID 108 wrote to memory of 4824 108 CQBKMJF.exe 211 PID 4824 wrote to memory of 5720 4824 cmd.exe 215 PID 5720 wrote to memory of 5500 5720 GTZXM.exe 216 PID 5500 wrote to memory of 3400 5500 cmd.exe 220 PID 3400 wrote to memory of 4596 3400 VWI.exe 221 PID 4596 wrote to memory of 3136 4596 cmd.exe 225 PID 3136 wrote to memory of 4208 3136 KMJB.exe 226 PID 4208 wrote to memory of 6656 4208 cmd.exe 230 PID 6656 wrote to memory of 1436 6656 HSBQU.exe 231 PID 1436 wrote to memory of 6308 1436 cmd.exe 235 PID 6308 wrote to memory of 1384 6308 NFBRZ.exe 236 PID 1384 wrote to memory of 1844 1384 cmd.exe 240 PID 1844 wrote to memory of 4336 1844 GIEV.exe 241 PID 4336 wrote to memory of 6016 4336 cmd.exe 245 PID 6016 wrote to memory of 2224 6016 BTNUSKM.exe 246 PID 2224 wrote to memory of 5936 2224 cmd.exe 250
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_4de6e468baf83bd36e46ec81d387a45c_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_4de6e468baf83bd36e46ec81d387a45c_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MSRELJA.exe.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3296 -
C:\windows\MSRELJA.exeC:\windows\MSRELJA.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6176 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RTFYY.exe.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\windows\RTFYY.exeC:\windows\RTFYY.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VJMGK.exe.bat" "6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\windows\SysWOW64\VJMGK.exeC:\windows\system32\VJMGK.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VEYCQHZ.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:6496 -
C:\windows\SysWOW64\VEYCQHZ.exeC:\windows\system32\VEYCQHZ.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OHBGDX.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\windows\system\OHBGDX.exeC:\windows\system\OHBGDX.exe11⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:356 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DCLKOS.exe.bat" "12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\windows\system\DCLKOS.exeC:\windows\system\DCLKOS.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EFPOU.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:7128 -
C:\windows\SysWOW64\EFPOU.exeC:\windows\system32\EFPOU.exe15⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RDPZ.exe.bat" "16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3108 -
C:\windows\system\RDPZ.exeC:\windows\system\RDPZ.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RVXT.exe.bat" "18⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\windows\RVXT.exeC:\windows\RVXT.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\COAMS.exe.bat" "20⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\windows\system\COAMS.exeC:\windows\system\COAMS.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IOIZBHA.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:1068 -
C:\windows\system\IOIZBHA.exeC:\windows\system\IOIZBHA.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JRMD.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:6512 -
C:\windows\SysWOW64\JRMD.exeC:\windows\system32\JRMD.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SRO.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\windows\SRO.exeC:\windows\SRO.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EKJBAKT.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\windows\EKJBAKT.exeC:\windows\EKJBAKT.exe29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5672 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IAXBEC.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\windows\IAXBEC.exeC:\windows\IAXBEC.exe31⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BTFM.exe.bat" "32⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5612 -
C:\windows\system\BTFM.exeC:\windows\system\BTFM.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5372 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KTH.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\windows\system\KTH.exeC:\windows\system\KTH.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LWKVE.exe.bat" "36⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:7064 -
C:\windows\SysWOW64\LWKVE.exeC:\windows\system32\LWKVE.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YHBTTTW.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:6516 -
C:\windows\YHBTTTW.exeC:\windows\YHBTTTW.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NXCLZP.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\windows\SysWOW64\NXCLZP.exeC:\windows\system32\NXCLZP.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OSGPF.exe.bat" "42⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\windows\system\OSGPF.exeC:\windows\system\OSGPF.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LXQ.exe.bat" "44⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\windows\LXQ.exeC:\windows\LXQ.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WQTPD.exe.bat" "46⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\windows\system\WQTPD.exeC:\windows\system\WQTPD.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CQBKMJF.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:6240 -
C:\windows\SysWOW64\CQBKMJF.exeC:\windows\system32\CQBKMJF.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GTZXM.exe.bat" "50⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\windows\GTZXM.exeC:\windows\GTZXM.exe51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VWI.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:5500 -
C:\windows\system\VWI.exeC:\windows\system\VWI.exe53⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KMJB.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\windows\KMJB.exeC:\windows\KMJB.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HSBQU.exe.bat" "56⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\windows\HSBQU.exeC:\windows\HSBQU.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6656 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NFBRZ.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\windows\system\NFBRZ.exeC:\windows\system\NFBRZ.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GIEV.exe.bat" "60⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\windows\SysWOW64\GIEV.exeC:\windows\system32\GIEV.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BTNUSKM.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\windows\system\BTNUSKM.exeC:\windows\system\BTNUSKM.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZTUHJ.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\windows\SysWOW64\ZTUHJ.exeC:\windows\system32\ZTUHJ.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DWTUJFY.exe.bat" "66⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:6552 -
C:\windows\system\DWTUJFY.exeC:\windows\system\DWTUJFY.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BMMXWK.exe.bat" "68⤵
- System Location Discovery: System Language Discovery
PID:3312 -
C:\windows\SysWOW64\BMMXWK.exeC:\windows\system32\BMMXWK.exe69⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TUOCAQI.exe.bat" "70⤵PID:524
-
C:\windows\TUOCAQI.exeC:\windows\TUOCAQI.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IKPCGD.exe.bat" "72⤵
- System Location Discovery: System Language Discovery
PID:3596 -
C:\windows\IKPCGD.exeC:\windows\IKPCGD.exe73⤵
- Executes dropped EXE
PID:4436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TDWN.exe.bat" "74⤵
- System Location Discovery: System Language Discovery
PID:3660 -
C:\windows\system\TDWN.exeC:\windows\system\TDWN.exe75⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\POND.exe.bat" "76⤵
- System Location Discovery: System Language Discovery
PID:5680 -
C:\windows\POND.exeC:\windows\POND.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4212 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YOPQP.exe.bat" "78⤵PID:7060
-
C:\windows\system\YOPQP.exeC:\windows\system\YOPQP.exe79⤵
- Executes dropped EXE
PID:4452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RHWBZ.exe.bat" "80⤵PID:2788
-
C:\windows\system\RHWBZ.exeC:\windows\system\RHWBZ.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5348 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VSU.exe.bat" "82⤵
- Executes a command shell one-liner
PID:4272 -
C:\windows\system\VSU.exeC:\windows\system\VSU.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JULNNJ.exe.bat" "84⤵
- Executes a command shell one-liner
PID:6476 -
C:\windows\JULNNJ.exeC:\windows\JULNNJ.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6184 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RIPUYI.exe.bat" "86⤵PID:1360
-
C:\windows\SysWOW64\RIPUYI.exeC:\windows\system32\RIPUYI.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RLTX.exe.bat" "88⤵PID:6752
-
C:\windows\system\RLTX.exeC:\windows\system\RLTX.exe89⤵
- Executes dropped EXE
PID:3092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IWEGML.exe.bat" "90⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:6744 -
C:\windows\IWEGML.exeC:\windows\IWEGML.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6224 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DYMEAO.exe.bat" "92⤵
- Executes a command shell one-liner
PID:2276 -
C:\windows\SysWOW64\DYMEAO.exeC:\windows\system32\DYMEAO.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CRXUJ.exe.bat" "94⤵PID:5648
-
C:\windows\system\CRXUJ.exeC:\windows\system\CRXUJ.exe95⤵
- Executes dropped EXE
PID:5812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GZE.exe.bat" "96⤵
- Executes a command shell one-liner
PID:4156 -
C:\windows\GZE.exeC:\windows\GZE.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6784 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ONJJFTC.exe.bat" "98⤵PID:6472
-
C:\windows\SysWOW64\ONJJFTC.exeC:\windows\system32\ONJJFTC.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SVPJS.exe.bat" "100⤵
- Executes a command shell one-liner
PID:3444 -
C:\windows\SVPJS.exeC:\windows\SVPJS.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RGAZ.exe.bat" "102⤵
- Executes a command shell one-liner
PID:4932 -
C:\windows\RGAZ.exeC:\windows\RGAZ.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AOCEE.exe.bat" "104⤵
- Executes a command shell one-liner
PID:2408 -
C:\windows\system\AOCEE.exeC:\windows\system\AOCEE.exe105⤵
- Executes dropped EXE
PID:2160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TGJPN.exe.bat" "106⤵
- Executes a command shell one-liner
PID:1224 -
C:\windows\system\TGJPN.exeC:\windows\system\TGJPN.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UJNTTGG.exe.bat" "108⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:568 -
C:\windows\system\UJNTTGG.exeC:\windows\system\UJNTTGG.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BAOKZ.exe.bat" "110⤵PID:6704
-
C:\windows\system\BAOKZ.exeC:\windows\system\BAOKZ.exe111⤵
- Executes dropped EXE
PID:6664 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XCF.exe.bat" "112⤵PID:1636
-
C:\windows\XCF.exeC:\windows\XCF.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ASLJAW.exe.bat" "114⤵
- Executes a command shell one-liner
PID:352 -
C:\windows\SysWOW64\ASLJAW.exeC:\windows\system32\ASLJAW.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AYLX.exe.bat" "116⤵
- System Location Discovery: System Language Discovery
PID:5224 -
C:\windows\system\AYLX.exeC:\windows\system\AYLX.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6180 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DLDH.exe.bat" "118⤵PID:3940
-
C:\windows\system\DLDH.exeC:\windows\system\DLDH.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YGZQXU.exe.bat" "120⤵PID:6060
-
C:\windows\YGZQXU.exeC:\windows\YGZQXU.exe121⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2784
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-