Analysis
- max time kernel
84s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/08/2026, 14:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-09_0bf9ba1b5e91c0cf10ae22e395fbbbf3_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-09_0bf9ba1b5e91c0cf10ae22e395fbbbf3_elex_emotet_stop.exe
- Size 208KB
- Sample260809-sbhbdstsdw
- SHA256 6e6a12d95853e94b1087dd46a869edde6e012acb324869bf986572fe3571d071
- MD5 0bf9ba1b5e91c0cf10ae22e395fbbbf3
- SHA1 c5bded08da37c20420b15eca479fa2e6da0cb692
- SHA512 8b4eb54c247db00411eeba3de25acc778e6cb77e2df1f4567068db4587805a620db52543f5735ec26f5ec5476dc31968db83d6bdf2e205294015bc141a9a0da8
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlldL+LOf24pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFll5+LOukEj1
- TLSH T16F247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4672 SEGJGMG.exe 2304 KXCBT.exe 5708 JIFRCHK.exe 3864 HIMF.exe 5956 HLY.exe 3552 VWHZFK.exe 4488 MWJEIHL.exe 4780 FZMIVX.exe 596 SKVG.exe 2864 APVVL.exe 5716 UDAEVVZ.exe 2004 WAFRDD.exe 4896 IQMZ.exe 1224 SROET.exe 4972 AWBKD.exe 5532 SZE.exe 4520 TCIKO.exe 5300 DAOEE.exe 1560 FYCYLOW.exe 5640 GBFUQE.exe 6120 YWJ.exe 2608 DCBN.exe 3752 VFFJZN.exe 4456 WIJNFDM.exe 2180 RVOW.exe 5784 ZASD.exe 5976 BYG.exe 5644 VMLGS.exe 4900 UEOW.exe 1880 ECTR.exe 4284 ZPYAS.exe 620 IQAFVDI.exe 4180 UGHF.exe 5228 WEUA.exe 3860 LUVZW.exe 996 VRBL.exe 6116 XPPGTQL.exe 5808 SSXEHTG.exe 2052 QNW.exe 3920 UDDNQOS.exe 4600 JYM.exe 948 VRPK.exe 688 VUT.exe 3600 ZCAOB.exe 1060 RCCTMWH.exe 1264 JFGPSM.exe 1336 KIJ.exe 4472 RDTXQ.exe 4848 XZSYNR.exe 3292 WOLBIXQ.exe 3856 CKK.exe 1952 RFUOX.exe 3268 PATOCP.exe 1012 SNY.exe 1868 MBVHPPA.exe 1332 ZLLGD.exe 5780 UZQPNAK.exe 3312 FRL.exe 5848 GUXEB.exe 776 RNEPK.exe 6124 JVGCOD.exe 5916 YQQG.exe 2936 JJTZH.exe 2296 SRVESD.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\YNNVUUH.exe.bat NFHVI.exe File created C:\windows\SysWOW64\EVXX.exe WPKR.exe File opened for modification C:\windows\SysWOW64\EVXX.exe WPKR.exe File opened for modification C:\windows\SysWOW64\AWBKD.exe SROET.exe File opened for modification C:\windows\SysWOW64\WMTFL.exe DJQ.exe File created C:\windows\SysWOW64\PATOCP.exe.bat RFUOX.exe File opened for modification C:\windows\SysWOW64\GXRFOHC.exe HMO.exe File created C:\windows\SysWOW64\JKQPNM.exe TUP.exe File created C:\windows\SysWOW64\WWHHTB.exe.bat MWFC.exe File created C:\windows\SysWOW64\HIMF.exe JIFRCHK.exe File opened for modification C:\windows\SysWOW64\HIMF.exe JIFRCHK.exe File created C:\windows\SysWOW64\VWHZFK.exe HLY.exe File created C:\windows\SysWOW64\SKVG.exe FZMIVX.exe File created C:\windows\SysWOW64\AWBKD.exe SROET.exe File opened for modification C:\windows\SysWOW64\ZCAOB.exe VUT.exe File opened for modification C:\windows\SysWOW64\WOLBIXQ.exe XZSYNR.exe File created C:\windows\SysWOW64\KXCBT.exe.bat SEGJGMG.exe File opened for modification C:\windows\SysWOW64\FZMIVX.exe MWJEIHL.exe File created C:\windows\SysWOW64\TCIKO.exe.bat SZE.exe File created C:\windows\SysWOW64\WIJNFDM.exe VFFJZN.exe File opened for modification C:\windows\SysWOW64\WIJNFDM.exe VFFJZN.exe File created C:\windows\SysWOW64\KIJ.exe JFGPSM.exe File created C:\windows\SysWOW64\XFXCVC.exe.bat DJSTL.exe File opened for modification C:\windows\SysWOW64\XKXRXOK.exe XFXCVC.exe File created C:\windows\SysWOW64\UDAEVVZ.exe.bat APVVL.exe File created C:\windows\SysWOW64\VRPK.exe.bat JYM.exe File created C:\windows\SysWOW64\CZJSOP.exe.bat WZBE.exe File opened for modification C:\windows\SysWOW64\YNNVUUH.exe NFHVI.exe File opened for modification C:\windows\SysWOW64\GNHLIN.exe HUFVAHV.exe File opened for modification C:\windows\SysWOW64\UDAEVVZ.exe APVVL.exe File opened for modification C:\windows\SysWOW64\VMLGS.exe BYG.exe File created C:\windows\SysWOW64\XMQAEMY.exe.bat IWPI.exe File opened for modification C:\windows\SysWOW64\WWHHTB.exe MWFC.exe File opened for modification C:\windows\SysWOW64\QNW.exe SSXEHTG.exe File created C:\windows\SysWOW64\GNHLIN.exe.bat HUFVAHV.exe File opened for modification C:\windows\SysWOW64\MSEWQ.exe NZUGIF.exe File created C:\windows\SysWOW64\DRP.exe KOLVRQT.exe File created C:\windows\SysWOW64\SZE.exe AWBKD.exe File created C:\windows\SysWOW64\CZJSOP.exe WZBE.exe File created C:\windows\SysWOW64\GXRFOHC.exe.bat HMO.exe File created C:\windows\SysWOW64\VWHZFK.exe.bat HLY.exe File opened for modification C:\windows\SysWOW64\PATOCP.exe RFUOX.exe File opened for modification C:\windows\SysWOW64\SKVG.exe FZMIVX.exe File created C:\windows\SysWOW64\FYCYLOW.exe.bat DAOEE.exe File opened for modification C:\windows\SysWOW64\MBVHPPA.exe SNY.exe File opened for modification C:\windows\SysWOW64\XFXCVC.exe DJSTL.exe File created C:\windows\SysWOW64\NZUGIF.exe HMQNCI.exe File created C:\windows\SysWOW64\WMTFL.exe DJQ.exe File created C:\windows\SysWOW64\KXCBT.exe SEGJGMG.exe File created C:\windows\SysWOW64\WIJNFDM.exe.bat VFFJZN.exe File opened for modification C:\windows\SysWOW64\XZSYNR.exe RDTXQ.exe File created C:\windows\SysWOW64\XPXJ.exe WMTFL.exe File opened for modification C:\windows\SysWOW64\DRP.exe KOLVRQT.exe File created C:\windows\SysWOW64\AWBKD.exe.bat SROET.exe File created C:\windows\SysWOW64\XFXCVC.exe DJSTL.exe File created C:\windows\SysWOW64\XKXRXOK.exe XFXCVC.exe File created C:\windows\SysWOW64\XPXJ.exe.bat WMTFL.exe File created C:\windows\SysWOW64\DRP.exe.bat KOLVRQT.exe File opened for modification C:\windows\SysWOW64\KIJ.exe JFGPSM.exe File created C:\windows\SysWOW64\EVXX.exe.bat WPKR.exe File created C:\windows\SysWOW64\SKVG.exe.bat FZMIVX.exe File created C:\windows\SysWOW64\UDAEVVZ.exe APVVL.exe File opened for modification C:\windows\SysWOW64\VRPK.exe JYM.exe File opened for modification C:\windows\SysWOW64\NZUGIF.exe HMQNCI.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\system\UGHF.exe IQAFVDI.exe File opened for modification C:\windows\system\RFUOX.exe CKK.exe File created C:\windows\RNEPK.exe GUXEB.exe File created C:\windows\GMM.exe.bat AMFIVY.exe File created C:\windows\system\TQYC.exe.bat GNHLIN.exe File opened for modification C:\windows\MWFC.exe XTWXWR.exe File opened for modification C:\windows\system\DJQ.exe PNEIATK.exe File created C:\windows\HLY.exe HIMF.exe File created C:\windows\MWJEIHL.exe VWHZFK.exe File opened for modification C:\windows\MWJEIHL.exe VWHZFK.exe File created C:\windows\SROET.exe.bat IQMZ.exe File created C:\windows\DCBN.exe YWJ.exe File created C:\windows\DCBN.exe.bat YWJ.exe File opened for modification C:\windows\LUVZW.exe WEUA.exe File created C:\windows\system\UDDNQOS.exe QNW.exe File created C:\windows\ZASD.exe.bat RVOW.exe File opened for modification C:\windows\system\WAFRDD.exe UDAEVVZ.exe File opened for modification C:\windows\system\DAOEE.exe TCIKO.exe File created C:\windows\system\JYM.exe UDDNQOS.exe File opened for modification C:\windows\system\JYM.exe UDDNQOS.exe File created C:\windows\YQQG.exe JVGCOD.exe File opened for modification C:\windows\system\JJTZH.exe YQQG.exe File opened for modification C:\windows\system\NFHVI.exe XKXRXOK.exe File opened for modification C:\windows\system\BYG.exe ZASD.exe File created C:\windows\system\BYG.exe.bat ZASD.exe File created C:\windows\IQAFVDI.exe ZPYAS.exe File created C:\windows\system\IQMZ.exe WAFRDD.exe File created C:\windows\system\YWJ.exe.bat GBFUQE.exe File created C:\windows\XTWXWR.exe TQYC.exe File created C:\windows\WQVKK.exe KABS.exe File opened for modification C:\windows\system\TQEM.exe WQVKK.exe File opened for modification C:\windows\JIFRCHK.exe KXCBT.exe File created C:\windows\system\UZQPNAK.exe ZLLGD.exe File created C:\windows\AMFIVY.exe WYQRZVL.exe File opened for modification C:\windows\AMFIVY.exe WYQRZVL.exe File opened for modification C:\windows\IWPI.exe YNNVUUH.exe File opened for modification C:\windows\system\HUFVAHV.exe MHAMX.exe File created C:\windows\KABS.exe.bat GXRFOHC.exe File created C:\windows\UYK.exe HVTFW.exe File created C:\windows\system\APVVL.exe SKVG.exe File created C:\windows\RVOW.exe.bat WIJNFDM.exe File created C:\windows\ECTR.exe UEOW.exe File created C:\windows\LUVZW.exe.bat WEUA.exe File created C:\windows\VUT.exe VRPK.exe File created C:\windows\system\TUP.exe.bat XPXJ.exe File created C:\windows\FRL.exe UZQPNAK.exe File opened for modification C:\windows\system\WPKR.exe MSEWQ.exe File created C:\windows\HLY.exe.bat HIMF.exe File opened for modification C:\windows\RVOW.exe WIJNFDM.exe File created C:\windows\YQQG.exe.bat JVGCOD.exe File created C:\windows\WZBE.exe SRVESD.exe File created C:\windows\system\UALFRNC.exe.bat CZJSOP.exe File created C:\windows\KABS.exe GXRFOHC.exe File created C:\windows\system\WPKR.exe.bat MSEWQ.exe File opened for modification C:\windows\system\SEGJGMG.exe 2026-08-09_0bf9ba1b5e91c0cf10ae22e395fbbbf3_elex_emotet_stop.exe File created C:\windows\ECTR.exe.bat UEOW.exe File created C:\windows\IQAFVDI.exe.bat ZPYAS.exe File created C:\windows\system\HUFVAHV.exe MHAMX.exe File created C:\windows\MWFC.exe.bat XTWXWR.exe File created C:\windows\system\HMO.exe WWHHTB.exe File opened for modification C:\windows\system\HMO.exe WWHHTB.exe File created C:\windows\system\KOLVRQT.exe.bat UYK.exe File created C:\windows\system\UGHF.exe.bat IQAFVDI.exe File created C:\windows\system\VRBL.exe.bat LUVZW.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3456 cmd.exe 5216 cmd.exe 5112 cmd.exe 1448 cmd.exe 4352 cmd.exe 3336 cmd.exe 1516 cmd.exe 1416 cmd.exe 2288 cmd.exe 4336 cmd.exe 4964 cmd.exe 1360 cmd.exe 5884 cmd.exe 5420 cmd.exe 3036 cmd.exe 5964 cmd.exe 1760 cmd.exe 2336 cmd.exe 5728 cmd.exe 3520 cmd.exe 5596 cmd.exe 4572 cmd.exe 3788 cmd.exe 5676 cmd.exe 3004 cmd.exe 1032 cmd.exe 4556 cmd.exe 4752 cmd.exe 6088 cmd.exe 5776 cmd.exe 8 cmd.exe 4652 cmd.exe 2616 cmd.exe 2868 cmd.exe 700 cmd.exe 3656 cmd.exe 940 cmd.exe 2016 cmd.exe 5240 cmd.exe 828 cmd.exe 4124 cmd.exe 3452 cmd.exe 5280 cmd.exe 3376 cmd.exe 5732 cmd.exe 5592 cmd.exe 1992 cmd.exe 1180 cmd.exe 3024 cmd.exe 2540 cmd.exe 4552 cmd.exe 1680 cmd.exe 2956 cmd.exe 5988 cmd.exe 4988 cmd.exe 3288 cmd.exe 4464 cmd.exe 5008 cmd.exe 2192 cmd.exe 2404 cmd.exe 2492 cmd.exe 600 cmd.exe 3648 cmd.exe 5756 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 2016 5856 WerFault.exe 86 4588 4672 WerFault.exe 92 1240 2304 WerFault.exe 98 2616 5708 WerFault.exe 103 5756 3864 WerFault.exe 108 1180 5956 WerFault.exe 113 1336 3552 WerFault.exe 118 4772 4488 WerFault.exe 123 4840 4780 WerFault.exe 128 6128 596 WerFault.exe 133 828 2864 WerFault.exe 138 6012 5716 WerFault.exe 143 904 2004 WerFault.exe 148 4300 4896 WerFault.exe 153 3900 1224 WerFault.exe 158 5268 4972 WerFault.exe 163 5412 5532 WerFault.exe 168 4436 4520 WerFault.exe 173 5808 5300 WerFault.exe 178 1880 1560 WerFault.exe 183 1980 5640 WerFault.exe 188 620 6120 WerFault.exe 193 4180 2608 WerFault.exe 198 5128 3752 WerFault.exe 203 5860 4456 WerFault.exe 208 5836 2180 WerFault.exe 213 4276 5784 WerFault.exe 218 1304 5976 WerFault.exe 223 4992 5644 WerFault.exe 228 5636 4900 WerFault.exe 233 2576 1880 WerFault.exe 238 4732 4284 WerFault.exe 243 2356 620 WerFault.exe 248 944 4180 WerFault.exe 253 1564 5228 WerFault.exe 258 2152 3860 WerFault.exe 263 1400 996 WerFault.exe 268 3092 6116 WerFault.exe 274 2984 5808 WerFault.exe 279 4228 2052 WerFault.exe 284 3324 3920 WerFault.exe 289 1936 4600 WerFault.exe 294 4624 948 WerFault.exe 299 2536 688 WerFault.exe 304 108 3600 WerFault.exe 309 2888 1060 WerFault.exe 314 2600 1264 WerFault.exe 319 3632 1336 WerFault.exe 324 1016 4472 WerFault.exe 329 4092 4848 WerFault.exe 334 1800 3292 WerFault.exe 339 6124 3856 WerFault.exe 344 4640 1952 WerFault.exe 349 5400 3268 WerFault.exe 354 5280 1012 WerFault.exe 359 5748 1868 WerFault.exe 364 1836 1332 WerFault.exe 369 3456 5780 WerFault.exe 374 4552 3312 WerFault.exe 379 5428 5848 WerFault.exe 384 3356 776 WerFault.exe 389 1132 6124 WerFault.exe 394 5400 5916 WerFault.exe 399 5560 2936 WerFault.exe 404 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VWHZFK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RDTXQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JJTZH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XMQAEMY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HMO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XFXCVC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WWHHTB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PNEIATK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SKVG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SROET.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IQAFVDI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HUFVAHV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MWJEIHL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JYM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VRPK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSEWQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TQEM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZPYAS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DJQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FZMIVX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RVOW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZASD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HMQNCI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HVTFW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UYK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RFUOX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MHAMX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KABS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language APVVL.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5856 2026-08-09_0bf9ba1b5e91c0cf10ae22e395fbbbf3_elex_emotet_stop.exe 5856 2026-08-09_0bf9ba1b5e91c0cf10ae22e395fbbbf3_elex_emotet_stop.exe 4672 SEGJGMG.exe 4672 SEGJGMG.exe 2304 KXCBT.exe 2304 KXCBT.exe 5708 JIFRCHK.exe 5708 JIFRCHK.exe 3864 HIMF.exe 3864 HIMF.exe 5956 HLY.exe 5956 HLY.exe 3552 VWHZFK.exe 3552 VWHZFK.exe 4488 MWJEIHL.exe 4488 MWJEIHL.exe 4780 FZMIVX.exe 4780 FZMIVX.exe 596 SKVG.exe 596 SKVG.exe 2864 APVVL.exe 2864 APVVL.exe 5716 UDAEVVZ.exe 5716 UDAEVVZ.exe 2004 WAFRDD.exe 2004 WAFRDD.exe 4896 IQMZ.exe 4896 IQMZ.exe 1224 SROET.exe 1224 SROET.exe 4972 AWBKD.exe 4972 AWBKD.exe 5532 SZE.exe 5532 SZE.exe 4520 TCIKO.exe 4520 TCIKO.exe 5300 DAOEE.exe 5300 DAOEE.exe 1560 FYCYLOW.exe 1560 FYCYLOW.exe 5640 GBFUQE.exe 5640 GBFUQE.exe 6120 YWJ.exe 6120 YWJ.exe 2608 DCBN.exe 2608 DCBN.exe 3752 VFFJZN.exe 3752 VFFJZN.exe 4456 WIJNFDM.exe 4456 WIJNFDM.exe 2180 RVOW.exe 2180 RVOW.exe 5784 ZASD.exe 5784 ZASD.exe 5976 BYG.exe 5976 BYG.exe 5644 VMLGS.exe 5644 VMLGS.exe 4900 UEOW.exe 4900 UEOW.exe 1880 ECTR.exe 1880 ECTR.exe 4284 ZPYAS.exe 4284 ZPYAS.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 5856 2026-08-09_0bf9ba1b5e91c0cf10ae22e395fbbbf3_elex_emotet_stop.exe 5856 2026-08-09_0bf9ba1b5e91c0cf10ae22e395fbbbf3_elex_emotet_stop.exe 4672 SEGJGMG.exe 4672 SEGJGMG.exe 2304 KXCBT.exe 2304 KXCBT.exe 5708 JIFRCHK.exe 5708 JIFRCHK.exe 3864 HIMF.exe 3864 HIMF.exe 5956 HLY.exe 5956 HLY.exe 3552 VWHZFK.exe 3552 VWHZFK.exe 4488 MWJEIHL.exe 4488 MWJEIHL.exe 4780 FZMIVX.exe 4780 FZMIVX.exe 596 SKVG.exe 596 SKVG.exe 2864 APVVL.exe 2864 APVVL.exe 5716 UDAEVVZ.exe 5716 UDAEVVZ.exe 2004 WAFRDD.exe 2004 WAFRDD.exe 4896 IQMZ.exe 4896 IQMZ.exe 1224 SROET.exe 1224 SROET.exe 4972 AWBKD.exe 4972 AWBKD.exe 5532 SZE.exe 5532 SZE.exe 4520 TCIKO.exe 4520 TCIKO.exe 5300 DAOEE.exe 5300 DAOEE.exe 1560 FYCYLOW.exe 1560 FYCYLOW.exe 5640 GBFUQE.exe 5640 GBFUQE.exe 6120 YWJ.exe 6120 YWJ.exe 2608 DCBN.exe 2608 DCBN.exe 3752 VFFJZN.exe 3752 VFFJZN.exe 4456 WIJNFDM.exe 4456 WIJNFDM.exe 2180 RVOW.exe 2180 RVOW.exe 5784 ZASD.exe 5784 ZASD.exe 5976 BYG.exe 5976 BYG.exe 5644 VMLGS.exe 5644 VMLGS.exe 4900 UEOW.exe 4900 UEOW.exe 1880 ECTR.exe 1880 ECTR.exe 4284 ZPYAS.exe 4284 ZPYAS.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5856 wrote to memory of 940 5856 2026-08-09_0bf9ba1b5e91c0cf10ae22e395fbbbf3_elex_emotet_stop.exe 88 PID 940 wrote to memory of 4672 940 cmd.exe 92 PID 4672 wrote to memory of 4828 4672 SEGJGMG.exe 94 PID 4828 wrote to memory of 2304 4828 cmd.exe 98 PID 2304 wrote to memory of 3544 2304 KXCBT.exe 99 PID 3544 wrote to memory of 5708 3544 cmd.exe 103 PID 5708 wrote to memory of 2956 5708 JIFRCHK.exe 104 PID 2956 wrote to memory of 3864 2956 cmd.exe 108 PID 3864 wrote to memory of 460 3864 HIMF.exe 109 PID 460 wrote to memory of 5956 460 cmd.exe 113 PID 5956 wrote to memory of 3004 5956 HLY.exe 114 PID 3004 wrote to memory of 3552 3004 cmd.exe 118 PID 3552 wrote to memory of 3336 3552 VWHZFK.exe 119 PID 3336 wrote to memory of 4488 3336 cmd.exe 123 PID 4488 wrote to memory of 2688 4488 MWJEIHL.exe 124 PID 2688 wrote to memory of 4780 2688 cmd.exe 128 PID 4780 wrote to memory of 4204 4780 FZMIVX.exe 129 PID 4204 wrote to memory of 596 4204 cmd.exe 133 PID 596 wrote to memory of 3024 596 SKVG.exe 134 PID 3024 wrote to memory of 2864 3024 cmd.exe 138 PID 2864 wrote to memory of 4108 2864 APVVL.exe 139 PID 4108 wrote to memory of 5716 4108 cmd.exe 143 PID 5716 wrote to memory of 2016 5716 UDAEVVZ.exe 144 PID 2016 wrote to memory of 2004 2016 cmd.exe 148 PID 2004 wrote to memory of 4440 2004 WAFRDD.exe 149 PID 4440 wrote to memory of 4896 4440 cmd.exe 153 PID 4896 wrote to memory of 3556 4896 IQMZ.exe 154 PID 3556 wrote to memory of 1224 3556 cmd.exe 158 PID 1224 wrote to memory of 2868 1224 SROET.exe 159 PID 2868 wrote to memory of 4972 2868 cmd.exe 163 PID 4972 wrote to memory of 4700 4972 AWBKD.exe 164 PID 4700 wrote to memory of 5532 4700 cmd.exe 168 PID 5532 wrote to memory of 1032 5532 SZE.exe 169 PID 1032 wrote to memory of 4520 1032 cmd.exe 173 PID 4520 wrote to memory of 1516 4520 TCIKO.exe 174 PID 1516 wrote to memory of 5300 1516 cmd.exe 178 PID 5300 wrote to memory of 5696 5300 DAOEE.exe 179 PID 5696 wrote to memory of 1560 5696 cmd.exe 183 PID 1560 wrote to memory of 5220 1560 FYCYLOW.exe 184 PID 5220 wrote to memory of 5640 5220 cmd.exe 188 PID 5640 wrote to memory of 4596 5640 GBFUQE.exe 189 PID 4596 wrote to memory of 6120 4596 cmd.exe 193 PID 6120 wrote to memory of 5988 6120 YWJ.exe 194 PID 5988 wrote to memory of 2608 5988 cmd.exe 198 PID 2608 wrote to memory of 2340 2608 DCBN.exe 199 PID 2340 wrote to memory of 3752 2340 cmd.exe 203 PID 3752 wrote to memory of 5740 3752 VFFJZN.exe 204 PID 5740 wrote to memory of 4456 5740 cmd.exe 208 PID 4456 wrote to memory of 2616 4456 WIJNFDM.exe 209 PID 2616 wrote to memory of 2180 2616 cmd.exe 213 PID 2180 wrote to memory of 2492 2180 RVOW.exe 214 PID 2492 wrote to memory of 5784 2492 cmd.exe 218 PID 5784 wrote to memory of 1180 5784 ZASD.exe 219 PID 1180 wrote to memory of 5976 1180 cmd.exe 223 PID 5976 wrote to memory of 4504 5976 BYG.exe 224 PID 4504 wrote to memory of 5644 4504 cmd.exe 228 PID 5644 wrote to memory of 1416 5644 VMLGS.exe 229 PID 1416 wrote to memory of 4900 1416 cmd.exe 233 PID 4900 wrote to memory of 5800 4900 UEOW.exe 234 PID 5800 wrote to memory of 1880 5800 cmd.exe 238 PID 1880 wrote to memory of 4556 1880 ECTR.exe 239 PID 4556 wrote to memory of 4284 4556 cmd.exe 243 PID 4284 wrote to memory of 4664 4284 ZPYAS.exe 244 PID 4664 wrote to memory of 620 4664 cmd.exe 248
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_0bf9ba1b5e91c0cf10ae22e395fbbbf3_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_0bf9ba1b5e91c0cf10ae22e395fbbbf3_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SEGJGMG.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:940 -
C:\windows\system\SEGJGMG.exeC:\windows\system\SEGJGMG.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KXCBT.exe.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\windows\SysWOW64\KXCBT.exeC:\windows\system32\KXCBT.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JIFRCHK.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\windows\JIFRCHK.exeC:\windows\JIFRCHK.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HIMF.exe.bat" "8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\windows\SysWOW64\HIMF.exeC:\windows\system32\HIMF.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HLY.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:460 -
C:\windows\HLY.exeC:\windows\HLY.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VWHZFK.exe.bat" "12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\windows\SysWOW64\VWHZFK.exeC:\windows\system32\VWHZFK.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MWJEIHL.exe.bat" "14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\windows\MWJEIHL.exeC:\windows\MWJEIHL.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FZMIVX.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\windows\SysWOW64\FZMIVX.exeC:\windows\system32\FZMIVX.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SKVG.exe.bat" "18⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\windows\SysWOW64\SKVG.exeC:\windows\system32\SKVG.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\APVVL.exe.bat" "20⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\windows\system\APVVL.exeC:\windows\system\APVVL.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UDAEVVZ.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\windows\SysWOW64\UDAEVVZ.exeC:\windows\system32\UDAEVVZ.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WAFRDD.exe.bat" "24⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\windows\system\WAFRDD.exeC:\windows\system\WAFRDD.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IQMZ.exe.bat" "26⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\windows\system\IQMZ.exeC:\windows\system\IQMZ.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SROET.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:3556 -
C:\windows\SROET.exeC:\windows\SROET.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AWBKD.exe.bat" "30⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\windows\SysWOW64\AWBKD.exeC:\windows\system32\AWBKD.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SZE.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\windows\SysWOW64\SZE.exeC:\windows\system32\SZE.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TCIKO.exe.bat" "34⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1032 -
C:\windows\SysWOW64\TCIKO.exeC:\windows\system32\TCIKO.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DAOEE.exe.bat" "36⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\windows\system\DAOEE.exeC:\windows\system\DAOEE.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FYCYLOW.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:5696 -
C:\windows\SysWOW64\FYCYLOW.exeC:\windows\system32\FYCYLOW.exe39⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GBFUQE.exe.bat" "40⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5220 -
C:\windows\system\GBFUQE.exeC:\windows\system\GBFUQE.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YWJ.exe.bat" "42⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\windows\system\YWJ.exeC:\windows\system\YWJ.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6120 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DCBN.exe.bat" "44⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5988 -
C:\windows\DCBN.exeC:\windows\DCBN.exe45⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VFFJZN.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\windows\SysWOW64\VFFJZN.exeC:\windows\system32\VFFJZN.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WIJNFDM.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:5740 -
C:\windows\SysWOW64\WIJNFDM.exeC:\windows\system32\WIJNFDM.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RVOW.exe.bat" "50⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\windows\RVOW.exeC:\windows\RVOW.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZASD.exe.bat" "52⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\windows\ZASD.exeC:\windows\ZASD.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5784 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BYG.exe.bat" "54⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\windows\system\BYG.exeC:\windows\system\BYG.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VMLGS.exe.bat" "56⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\windows\SysWOW64\VMLGS.exeC:\windows\system32\VMLGS.exe57⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UEOW.exe.bat" "58⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\windows\UEOW.exeC:\windows\UEOW.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ECTR.exe.bat" "60⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5800 -
C:\windows\ECTR.exeC:\windows\ECTR.exe61⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZPYAS.exe.bat" "62⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\windows\system\ZPYAS.exeC:\windows\system\ZPYAS.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IQAFVDI.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\windows\IQAFVDI.exeC:\windows\IQAFVDI.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:620 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UGHF.exe.bat" "66⤵PID:2104
-
C:\windows\system\UGHF.exeC:\windows\system\UGHF.exe67⤵
- Executes dropped EXE
PID:4180 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WEUA.exe.bat" "68⤵
- Executes a command shell one-liner
PID:4988 -
C:\windows\SysWOW64\WEUA.exeC:\windows\system32\WEUA.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5228 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LUVZW.exe.bat" "70⤵PID:3212
-
C:\windows\LUVZW.exeC:\windows\LUVZW.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VRBL.exe.bat" "72⤵
- System Location Discovery: System Language Discovery
PID:3192 -
C:\windows\system\VRBL.exeC:\windows\system\VRBL.exe73⤵
- Executes dropped EXE
PID:996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XPPGTQL.exe.bat" "74⤵
- Executes a command shell one-liner
PID:600 -
C:\windows\system\XPPGTQL.exeC:\windows\system\XPPGTQL.exe75⤵
- Executes dropped EXE
PID:6116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SSXEHTG.exe.bat" "76⤵PID:1064
-
C:\windows\SSXEHTG.exeC:\windows\SSXEHTG.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QNW.exe.bat" "78⤵PID:3028
-
C:\windows\SysWOW64\QNW.exeC:\windows\system32\QNW.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UDDNQOS.exe.bat" "80⤵PID:4696
-
C:\windows\system\UDDNQOS.exeC:\windows\system\UDDNQOS.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JYM.exe.bat" "82⤵
- System Location Discovery: System Language Discovery
PID:5700 -
C:\windows\system\JYM.exeC:\windows\system\JYM.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VRPK.exe.bat" "84⤵
- Executes a command shell one-liner
PID:5240 -
C:\windows\SysWOW64\VRPK.exeC:\windows\system32\VRPK.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VUT.exe.bat" "86⤵PID:1436
-
C:\windows\VUT.exeC:\windows\VUT.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZCAOB.exe.bat" "88⤵PID:2912
-
C:\windows\SysWOW64\ZCAOB.exeC:\windows\system32\ZCAOB.exe89⤵
- Executes dropped EXE
PID:3600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RCCTMWH.exe.bat" "90⤵
- System Location Discovery: System Language Discovery
PID:3476 -
C:\windows\RCCTMWH.exeC:\windows\RCCTMWH.exe91⤵
- Executes dropped EXE
PID:1060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JFGPSM.exe.bat" "92⤵PID:5412
-
C:\windows\system\JFGPSM.exeC:\windows\system\JFGPSM.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KIJ.exe.bat" "94⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4752 -
C:\windows\SysWOW64\KIJ.exeC:\windows\system32\KIJ.exe95⤵
- Executes dropped EXE
PID:1336 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RDTXQ.exe.bat" "96⤵PID:3040
-
C:\windows\system\RDTXQ.exeC:\windows\system\RDTXQ.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XZSYNR.exe.bat" "98⤵PID:4468
-
C:\windows\SysWOW64\XZSYNR.exeC:\windows\system32\XZSYNR.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WOLBIXQ.exe.bat" "100⤵PID:3408
-
C:\windows\SysWOW64\WOLBIXQ.exeC:\windows\system32\WOLBIXQ.exe101⤵
- Executes dropped EXE
PID:3292 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CKK.exe.bat" "102⤵PID:6000
-
C:\windows\CKK.exeC:\windows\CKK.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RFUOX.exe.bat" "104⤵
- Executes a command shell one-liner
PID:828 -
C:\windows\system\RFUOX.exeC:\windows\system\RFUOX.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PATOCP.exe.bat" "106⤵
- System Location Discovery: System Language Discovery
PID:3872 -
C:\windows\SysWOW64\PATOCP.exeC:\windows\system32\PATOCP.exe107⤵
- Executes dropped EXE
PID:3268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SNY.exe.bat" "108⤵PID:4300
-
C:\windows\SNY.exeC:\windows\SNY.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MBVHPPA.exe.bat" "110⤵PID:4084
-
C:\windows\SysWOW64\MBVHPPA.exeC:\windows\system32\MBVHPPA.exe111⤵
- Executes dropped EXE
PID:1868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZLLGD.exe.bat" "112⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3648 -
C:\windows\system\ZLLGD.exeC:\windows\system\ZLLGD.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1332 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UZQPNAK.exe.bat" "114⤵PID:1392
-
C:\windows\system\UZQPNAK.exeC:\windows\system\UZQPNAK.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FRL.exe.bat" "116⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5732 -
C:\windows\FRL.exeC:\windows\FRL.exe117⤵
- Executes dropped EXE
PID:3312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GUXEB.exe.bat" "118⤵PID:5636
-
C:\windows\GUXEB.exeC:\windows\GUXEB.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RNEPK.exe.bat" "120⤵
- System Location Discovery: System Language Discovery
PID:4608 -
C:\windows\RNEPK.exeC:\windows\RNEPK.exe121⤵
- Executes dropped EXE
PID:776
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-