Analysis
- max time kernel
59s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/08/2026, 16:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-09_5798d59a222b0952d76734aac688b428_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-09_5798d59a222b0952d76734aac688b428_elex_emotet_stop.exe
- Size 208KB
- Sample260809-vbamnavwet
- SHA256 b821443787a66e9ae894662e3e0c5b4b3319ecee2f4bcba205b222d047965c68
- MD5 5798d59a222b0952d76734aac688b428
- SHA1 34326600802f30c74fd5024e093f3608d1a89ab9
- SHA512 00a30088152d6624c0ec818e0a93faafcafd56e9d43023645dd83910f4d85ed67a23b1bf5f3e917a28e27af02baade4a897e171ef1abaaa5cf5427e73400df4a
- SSDEEP 3072:ILQaL9tbLkRIgd1Lye9yjE2hWAN5XbxlUKL+LOfC4pLthEjQT6j:slZtbLWIgd1LZ9oECZbxlUS+LOqkEj1
- TLSH T1FB247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3796 ROIJQ.exe 1248 KHAJ.exe 3236 ECFSFI.exe 5144 VSEVRC.exe 2592 UDMWXG.exe 3648 TNDUWB.exe 3580 TGLOKF.exe 4488 VEEQQCS.exe 4692 MJPI.exe 2712 XCSB.exe 5980 DCAOXI.exe 3708 UNQEXC.exe 2744 ISW.exe 2868 ZGG.exe 1384 NIKSZ.exe 3284 STGY.exe 2324 OZMVL.exe 2360 QPFQ.exe 5764 CHIIZ.exe 2060 BARKF.exe 3312 AQQNRVA.exe 3784 CORPX.exe 6124 QTPEFUK.exe 4952 EWTKKL.exe 1792 LOB.exe 2556 WKTPCU.exe 2300 GMUWMQE.exe 4796 WCBHQB.exe 4920 YAUBXYB.exe 5660 ELYICP.exe 2492 LVZ.exe 4232 EYYNUY.exe 4524 EJZ.exe 4896 APF.exe 1416 ORJC.exe 2608 CXHZ.exe 3420 NQKSJ.exe 3660 FYMXNS.exe 4716 LYT.exe 1744 WRODE.exe 1580 YPCY.exe 1740 XZFOUY.exe 1856 RNJ.exe 3824 GITBPK.exe 1500 GVTQRX.exe 6032 DTZ.exe 2516 JTHBP.exe 1208 UMCTXJP.exe 2004 HWSKD.exe 3012 IZWORJT.exe 3188 BUAJW.exe 620 SDCXAFX.exe 4500 SNKQNJM.exe 1432 DGF.exe 4908 JGNWF.exe 1648 UZQPNAK.exe 4376 YPWP.exe 204 TCBHCS.exe 4600 ISCY.exe 1424 SQISQOS.exe 5320 PVO.exe 5888 WMPHDTJ.exe 2204 IUVP.exe 1312 TMLA.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\OZMVL.exe STGY.exe File created C:\windows\SysWOW64\CHIIZ.exe.bat QPFQ.exe File created C:\windows\SysWOW64\RNJ.exe XZFOUY.exe File opened for modification C:\windows\SysWOW64\YPWP.exe UZQPNAK.exe File created C:\windows\SysWOW64\WRODE.exe LYT.exe File created C:\windows\SysWOW64\CJUSI.exe.bat XJN.exe File created C:\windows\SysWOW64\VSEVRC.exe ECFSFI.exe File opened for modification C:\windows\SysWOW64\VSEVRC.exe ECFSFI.exe File created C:\windows\SysWOW64\EWTKKL.exe QTPEFUK.exe File created C:\windows\SysWOW64\EWTKKL.exe.bat QTPEFUK.exe File created C:\windows\SysWOW64\WRODE.exe.bat LYT.exe File created C:\windows\SysWOW64\GVTQRX.exe.bat GITBPK.exe File created C:\windows\SysWOW64\BUAJW.exe IZWORJT.exe File created C:\windows\SysWOW64\MRIMUA.exe CQGHQ.exe File created C:\windows\SysWOW64\TCBHCS.exe YPWP.exe File created C:\windows\SysWOW64\SQISQOS.exe ISCY.exe File created C:\windows\SysWOW64\CHIIZ.exe QPFQ.exe File opened for modification C:\windows\SysWOW64\EWTKKL.exe QTPEFUK.exe File opened for modification C:\windows\SysWOW64\LVZ.exe ELYICP.exe File created C:\windows\SysWOW64\YPWP.exe UZQPNAK.exe File created C:\windows\SysWOW64\MRIMUA.exe.bat CQGHQ.exe File created C:\windows\SysWOW64\CJUSI.exe XJN.exe File opened for modification C:\windows\SysWOW64\WCBHQB.exe GMUWMQE.exe File created C:\windows\SysWOW64\LVZ.exe.bat ELYICP.exe File created C:\windows\SysWOW64\IZWORJT.exe HWSKD.exe File created C:\windows\SysWOW64\YPWP.exe.bat UZQPNAK.exe File created C:\windows\SysWOW64\TCBHCS.exe.bat YPWP.exe File opened for modification C:\windows\SysWOW64\CJUSI.exe XJN.exe File created C:\windows\SysWOW64\KHAJ.exe ROIJQ.exe File opened for modification C:\windows\SysWOW64\BUAJW.exe IZWORJT.exe File opened for modification C:\windows\SysWOW64\SQISQOS.exe ISCY.exe File created C:\windows\SysWOW64\SQISQOS.exe.bat ISCY.exe File opened for modification C:\windows\SysWOW64\HWSKD.exe UMCTXJP.exe File opened for modification C:\windows\SysWOW64\DCAOXI.exe XCSB.exe File created C:\windows\SysWOW64\QPFQ.exe OZMVL.exe File opened for modification C:\windows\SysWOW64\WRODE.exe LYT.exe File created C:\windows\SysWOW64\RNJ.exe.bat XZFOUY.exe File created C:\windows\SysWOW64\GITBPK.exe RNJ.exe File created C:\windows\SysWOW64\GITBPK.exe.bat RNJ.exe File created C:\windows\SysWOW64\WCBHQB.exe.bat GMUWMQE.exe File opened for modification C:\windows\SysWOW64\GVTQRX.exe GITBPK.exe File created C:\windows\SysWOW64\KHAJ.exe.bat ROIJQ.exe File created C:\windows\SysWOW64\QPFQ.exe.bat OZMVL.exe File opened for modification C:\windows\SysWOW64\CHIIZ.exe QPFQ.exe File created C:\windows\SysWOW64\SZTKSX.exe HHQSK.exe File created C:\windows\SysWOW64\DCAOXI.exe.bat XCSB.exe File opened for modification C:\windows\SysWOW64\GITBPK.exe RNJ.exe File opened for modification C:\windows\SysWOW64\TCBHCS.exe YPWP.exe File created C:\windows\SysWOW64\SZTKSX.exe.bat HHQSK.exe File created C:\windows\SysWOW64\OZMVL.exe STGY.exe File created C:\windows\SysWOW64\OZMVL.exe.bat STGY.exe File created C:\windows\SysWOW64\WCBHQB.exe GMUWMQE.exe File created C:\windows\SysWOW64\HWSKD.exe UMCTXJP.exe File opened for modification C:\windows\SysWOW64\QPFQ.exe OZMVL.exe File opened for modification C:\windows\SysWOW64\RNJ.exe XZFOUY.exe File opened for modification C:\windows\SysWOW64\IZWORJT.exe HWSKD.exe File created C:\windows\SysWOW64\IZWORJT.exe.bat HWSKD.exe File created C:\windows\SysWOW64\BUAJW.exe.bat IZWORJT.exe File created C:\windows\SysWOW64\VSEVRC.exe.bat ECFSFI.exe File created C:\windows\SysWOW64\LVZ.exe ELYICP.exe File created C:\windows\SysWOW64\HWSKD.exe.bat UMCTXJP.exe File opened for modification C:\windows\SysWOW64\KHAJ.exe ROIJQ.exe File created C:\windows\SysWOW64\GVTQRX.exe GITBPK.exe File created C:\windows\SysWOW64\DCAOXI.exe XCSB.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\AQQNRVA.exe BARKF.exe File created C:\windows\system\FYMXNS.exe NQKSJ.exe File created C:\windows\system\WDMQXKU.exe RDFCGPS.exe File created C:\windows\system\ISW.exe.bat UNQEXC.exe File opened for modification C:\windows\system\AQQNRVA.exe BARKF.exe File created C:\windows\DGF.exe.bat SNKQNJM.exe File created C:\windows\system\IUVP.exe WMPHDTJ.exe File created C:\windows\system\CQGHQ.exe.bat IDJ.exe File opened for modification C:\windows\DZKSXYE.exe MRIMUA.exe File created C:\windows\system\ROIJQ.exe.bat 2026-08-09_5798d59a222b0952d76734aac688b428_elex_emotet_stop.exe File opened for modification C:\windows\UDMWXG.exe VSEVRC.exe File created C:\windows\system\UZQPNAK.exe.bat JGNWF.exe File created C:\windows\system\IDJ.exe WNUQUD.exe File created C:\windows\system\ZGG.exe.bat ISW.exe File created C:\windows\system\NIKSZ.exe.bat ZGG.exe File created C:\windows\system\QTPEFUK.exe.bat CORPX.exe File created C:\windows\ELYICP.exe.bat YAUBXYB.exe File created C:\windows\system\APF.exe.bat EJZ.exe File created C:\windows\system\LYT.exe.bat FYMXNS.exe File created C:\windows\MJPI.exe VEEQQCS.exe File opened for modification C:\windows\system\YAUBXYB.exe WCBHQB.exe File created C:\windows\PVO.exe SQISQOS.exe File opened for modification C:\windows\TMLA.exe IUVP.exe File created C:\windows\system\CQGHQ.exe IDJ.exe File created C:\windows\system\WDOOU.exe.bat SNI.exe File created C:\windows\system\VEEQQCS.exe TGLOKF.exe File opened for modification C:\windows\ELYICP.exe YAUBXYB.exe File opened for modification C:\windows\system\IUVP.exe WMPHDTJ.exe File opened for modification C:\windows\system\CQGHQ.exe IDJ.exe File opened for modification C:\windows\system\HHQSK.exe DZKSXYE.exe File created C:\windows\BMGBE.exe XWZBSZN.exe File created C:\windows\system\ROIJQ.exe 2026-08-09_5798d59a222b0952d76734aac688b428_elex_emotet_stop.exe File created C:\windows\system\UNQEXC.exe DCAOXI.exe File created C:\windows\system\STGY.exe NIKSZ.exe File opened for modification C:\windows\JGNWF.exe DGF.exe File created C:\windows\system\IUVP.exe.bat WMPHDTJ.exe File created C:\windows\DZKSXYE.exe.bat MRIMUA.exe File created C:\windows\system\HHQSK.exe.bat DZKSXYE.exe File created C:\windows\system\TGLOKF.exe TNDUWB.exe File created C:\windows\system\UNQEXC.exe.bat DCAOXI.exe File created C:\windows\NQKSJ.exe CXHZ.exe File created C:\windows\TNDUWB.exe UDMWXG.exe File opened for modification C:\windows\SDCXAFX.exe BUAJW.exe File created C:\windows\system\WDOOU.exe SNI.exe File created C:\windows\system\LOB.exe.bat EWTKKL.exe File created C:\windows\system\ORJC.exe APF.exe File created C:\windows\system\XJN.exe.bat WDMQXKU.exe File created C:\windows\XWZBSZN.exe.bat CJUSI.exe File opened for modification C:\windows\system\STGY.exe NIKSZ.exe File created C:\windows\system\APF.exe EJZ.exe File created C:\windows\system\FYMXNS.exe.bat NQKSJ.exe File created C:\windows\SDCXAFX.exe BUAJW.exe File created C:\windows\JGNWF.exe DGF.exe File opened for modification C:\windows\MJPI.exe VEEQQCS.exe File created C:\windows\system\CORPX.exe AQQNRVA.exe File created C:\windows\GMUWMQE.exe WKTPCU.exe File created C:\windows\CXHZ.exe.bat ORJC.exe File created C:\windows\DTZ.exe.bat GVTQRX.exe File opened for modification C:\windows\system\SNKQNJM.exe SDCXAFX.exe File created C:\windows\TMLA.exe IUVP.exe File created C:\windows\SNI.exe.bat BMGBE.exe File opened for modification C:\windows\TNDUWB.exe UDMWXG.exe File opened for modification C:\windows\system\UNQEXC.exe DCAOXI.exe File created C:\windows\system\BARKF.exe CHIIZ.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4576 cmd.exe 3676 cmd.exe 8 cmd.exe 3032 cmd.exe 248 cmd.exe 4708 cmd.exe 5672 cmd.exe 2748 cmd.exe 5196 cmd.exe 3192 cmd.exe 4432 cmd.exe 4408 cmd.exe 2876 cmd.exe 1780 cmd.exe 4128 cmd.exe 4080 cmd.exe 6088 cmd.exe 2700 cmd.exe 2828 cmd.exe 4048 cmd.exe 872 cmd.exe 4572 cmd.exe 4400 cmd.exe 5300 cmd.exe 5784 cmd.exe 4272 cmd.exe 4784 cmd.exe 1292 cmd.exe 2996 cmd.exe 5924 cmd.exe 4864 cmd.exe 2436 cmd.exe 1548 cmd.exe 1720 cmd.exe 1504 cmd.exe 2524 cmd.exe 4888 cmd.exe 4152 cmd.exe 996 cmd.exe 1684 cmd.exe 5444 cmd.exe 3372 cmd.exe 1516 cmd.exe 4648 cmd.exe 4332 cmd.exe 2384 cmd.exe 3248 cmd.exe 2720 cmd.exe 3628 cmd.exe 5404 cmd.exe 6108 cmd.exe 4984 cmd.exe 5556 cmd.exe 5988 cmd.exe 3016 cmd.exe 2136 cmd.exe 4828 cmd.exe 5240 cmd.exe 4104 cmd.exe 3896 cmd.exe 3528 cmd.exe 5968 cmd.exe 4508 cmd.exe 1124 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 5708 5768 WerFault.exe 86 928 3796 WerFault.exe 92 4316 1248 WerFault.exe 98 1196 3236 WerFault.exe 102 4228 5144 WerFault.exe 108 5136 2592 WerFault.exe 112 5480 3648 WerFault.exe 117 5092 3580 WerFault.exe 122 3096 4488 WerFault.exe 127 4172 4692 WerFault.exe 132 1920 2712 WerFault.exe 138 928 5980 WerFault.exe 143 5820 3708 WerFault.exe 147 3132 2744 WerFault.exe 153 4448 2868 WerFault.exe 157 1220 1384 WerFault.exe 163 5852 3284 WerFault.exe 167 1396 2324 WerFault.exe 173 1624 2360 WerFault.exe 177 1424 5764 WerFault.exe 183 1056 2060 WerFault.exe 187 3060 3312 WerFault.exe 192 5996 3784 WerFault.exe 197 4760 6124 WerFault.exe 203 1504 4952 WerFault.exe 207 4324 1792 WerFault.exe 212 1380 2556 WerFault.exe 217 1548 2300 WerFault.exe 222 2624 4796 WerFault.exe 227 1040 4920 WerFault.exe 233 3040 5660 WerFault.exe 237 5956 2492 WerFault.exe 242 4304 4232 WerFault.exe 247 4996 4524 WerFault.exe 252 1648 4896 WerFault.exe 258 4184 1416 WerFault.exe 262 4912 2608 WerFault.exe 268 976 3420 WerFault.exe 273 4504 3660 WerFault.exe 278 2720 4716 WerFault.exe 283 3424 1744 WerFault.exe 288 5708 1580 WerFault.exe 293 4592 1740 WerFault.exe 298 4996 1856 WerFault.exe 303 4760 3824 WerFault.exe 308 2652 1500 WerFault.exe 313 4324 6032 WerFault.exe 318 1220 2516 WerFault.exe 323 1808 1208 WerFault.exe 328 5284 2004 WerFault.exe 333 5444 3012 WerFault.exe 338 1348 3188 WerFault.exe 343 4828 620 WerFault.exe 348 4608 4500 WerFault.exe 353 4240 1432 WerFault.exe 358 3292 4908 WerFault.exe 363 5872 1648 WerFault.exe 368 1212 4376 WerFault.exe 373 696 204 WerFault.exe 378 6008 4600 WerFault.exe 383 2908 1424 WerFault.exe 388 4872 5320 WerFault.exe 393 2452 5888 WerFault.exe 398 5256 2204 WerFault.exe 403 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IZWORJT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TNDUWB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CHIIZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NQKSJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SQISQOS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WMPHDTJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UZQPNAK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MJPI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VEEQQCS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CORPX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language APF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WKTPCU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HSL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WDMQXKU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ISW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YPWP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FKCJGI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LVZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SNKQNJM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XJN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BUAJW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TMLA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ECFSFI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TCBHCS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RDFCGPS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BARKF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IDJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CJUSI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language STGY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HWSKD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LOB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5768 2026-08-09_5798d59a222b0952d76734aac688b428_elex_emotet_stop.exe 5768 2026-08-09_5798d59a222b0952d76734aac688b428_elex_emotet_stop.exe 3796 ROIJQ.exe 3796 ROIJQ.exe 1248 KHAJ.exe 1248 KHAJ.exe 3236 ECFSFI.exe 3236 ECFSFI.exe 5144 VSEVRC.exe 5144 VSEVRC.exe 2592 UDMWXG.exe 2592 UDMWXG.exe 3648 TNDUWB.exe 3648 TNDUWB.exe 3580 TGLOKF.exe 3580 TGLOKF.exe 4488 VEEQQCS.exe 4488 VEEQQCS.exe 4692 MJPI.exe 4692 MJPI.exe 2712 XCSB.exe 2712 XCSB.exe 5980 DCAOXI.exe 5980 DCAOXI.exe 3708 UNQEXC.exe 3708 UNQEXC.exe 2744 ISW.exe 2744 ISW.exe 2868 ZGG.exe 2868 ZGG.exe 1384 NIKSZ.exe 1384 NIKSZ.exe 3284 STGY.exe 3284 STGY.exe 2324 OZMVL.exe 2324 OZMVL.exe 2360 QPFQ.exe 2360 QPFQ.exe 5764 CHIIZ.exe 5764 CHIIZ.exe 2060 BARKF.exe 2060 BARKF.exe 3312 AQQNRVA.exe 3312 AQQNRVA.exe 3784 CORPX.exe 3784 CORPX.exe 6124 QTPEFUK.exe 6124 QTPEFUK.exe 4952 EWTKKL.exe 4952 EWTKKL.exe 1792 LOB.exe 1792 LOB.exe 2556 WKTPCU.exe 2556 WKTPCU.exe 2300 GMUWMQE.exe 2300 GMUWMQE.exe 4796 WCBHQB.exe 4796 WCBHQB.exe 4920 YAUBXYB.exe 4920 YAUBXYB.exe 5660 ELYICP.exe 5660 ELYICP.exe 2492 LVZ.exe 2492 LVZ.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 5768 2026-08-09_5798d59a222b0952d76734aac688b428_elex_emotet_stop.exe 5768 2026-08-09_5798d59a222b0952d76734aac688b428_elex_emotet_stop.exe 3796 ROIJQ.exe 3796 ROIJQ.exe 1248 KHAJ.exe 1248 KHAJ.exe 3236 ECFSFI.exe 3236 ECFSFI.exe 5144 VSEVRC.exe 5144 VSEVRC.exe 2592 UDMWXG.exe 2592 UDMWXG.exe 3648 TNDUWB.exe 3648 TNDUWB.exe 3580 TGLOKF.exe 3580 TGLOKF.exe 4488 VEEQQCS.exe 4488 VEEQQCS.exe 4692 MJPI.exe 4692 MJPI.exe 2712 XCSB.exe 2712 XCSB.exe 5980 DCAOXI.exe 5980 DCAOXI.exe 3708 UNQEXC.exe 3708 UNQEXC.exe 2744 ISW.exe 2744 ISW.exe 2868 ZGG.exe 2868 ZGG.exe 1384 NIKSZ.exe 1384 NIKSZ.exe 3284 STGY.exe 3284 STGY.exe 2324 OZMVL.exe 2324 OZMVL.exe 2360 QPFQ.exe 2360 QPFQ.exe 5764 CHIIZ.exe 5764 CHIIZ.exe 2060 BARKF.exe 2060 BARKF.exe 3312 AQQNRVA.exe 3312 AQQNRVA.exe 3784 CORPX.exe 3784 CORPX.exe 6124 QTPEFUK.exe 6124 QTPEFUK.exe 4952 EWTKKL.exe 4952 EWTKKL.exe 1792 LOB.exe 1792 LOB.exe 2556 WKTPCU.exe 2556 WKTPCU.exe 2300 GMUWMQE.exe 2300 GMUWMQE.exe 4796 WCBHQB.exe 4796 WCBHQB.exe 4920 YAUBXYB.exe 4920 YAUBXYB.exe 5660 ELYICP.exe 5660 ELYICP.exe 2492 LVZ.exe 2492 LVZ.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5768 wrote to memory of 4576 5768 2026-08-09_5798d59a222b0952d76734aac688b428_elex_emotet_stop.exe 88 PID 4576 wrote to memory of 3796 4576 cmd.exe 92 PID 3796 wrote to memory of 1124 3796 ROIJQ.exe 94 PID 1124 wrote to memory of 1248 1124 cmd.exe 98 PID 1248 wrote to memory of 4900 1248 KHAJ.exe 99 PID 4900 wrote to memory of 3236 4900 cmd.exe 102 PID 3236 wrote to memory of 4976 3236 ECFSFI.exe 104 PID 4976 wrote to memory of 5144 4976 cmd.exe 108 PID 5144 wrote to memory of 1520 5144 VSEVRC.exe 109 PID 1520 wrote to memory of 2592 1520 cmd.exe 112 PID 2592 wrote to memory of 1956 2592 UDMWXG.exe 114 PID 1956 wrote to memory of 3648 1956 cmd.exe 117 PID 3648 wrote to memory of 5952 3648 TNDUWB.exe 119 PID 5952 wrote to memory of 3580 5952 cmd.exe 122 PID 3580 wrote to memory of 6088 3580 TGLOKF.exe 124 PID 6088 wrote to memory of 4488 6088 cmd.exe 127 PID 4488 wrote to memory of 2800 4488 VEEQQCS.exe 129 PID 2800 wrote to memory of 4692 2800 cmd.exe 132 PID 4692 wrote to memory of 5084 4692 MJPI.exe 134 PID 5084 wrote to memory of 2712 5084 cmd.exe 138 PID 2712 wrote to memory of 1232 2712 XCSB.exe 139 PID 1232 wrote to memory of 5980 1232 cmd.exe 143 PID 5980 wrote to memory of 5784 5980 DCAOXI.exe 144 PID 5784 wrote to memory of 3708 5784 cmd.exe 147 PID 3708 wrote to memory of 3248 3708 UNQEXC.exe 149 PID 3248 wrote to memory of 2744 3248 cmd.exe 153 PID 2744 wrote to memory of 5240 2744 ISW.exe 154 PID 5240 wrote to memory of 2868 5240 cmd.exe 157 PID 2868 wrote to memory of 3056 2868 ZGG.exe 159 PID 3056 wrote to memory of 1384 3056 cmd.exe 163 PID 1384 wrote to memory of 5280 1384 NIKSZ.exe 164 PID 5280 wrote to memory of 3284 5280 cmd.exe 167 PID 3284 wrote to memory of 3216 3284 STGY.exe 169 PID 3216 wrote to memory of 2324 3216 cmd.exe 173 PID 2324 wrote to memory of 5760 2324 OZMVL.exe 174 PID 5760 wrote to memory of 2360 5760 cmd.exe 177 PID 2360 wrote to memory of 6116 2360 QPFQ.exe 179 PID 6116 wrote to memory of 5764 6116 cmd.exe 183 PID 5764 wrote to memory of 5196 5764 CHIIZ.exe 184 PID 5196 wrote to memory of 2060 5196 cmd.exe 187 PID 2060 wrote to memory of 1296 2060 BARKF.exe 189 PID 1296 wrote to memory of 3312 1296 cmd.exe 192 PID 3312 wrote to memory of 1260 3312 AQQNRVA.exe 194 PID 1260 wrote to memory of 3784 1260 cmd.exe 197 PID 3784 wrote to memory of 4580 3784 CORPX.exe 199 PID 4580 wrote to memory of 6124 4580 cmd.exe 203 PID 6124 wrote to memory of 4272 6124 QTPEFUK.exe 204 PID 4272 wrote to memory of 4952 4272 cmd.exe 207 PID 4952 wrote to memory of 5988 4952 EWTKKL.exe 209 PID 5988 wrote to memory of 1792 5988 cmd.exe 212 PID 1792 wrote to memory of 3516 1792 LOB.exe 214 PID 3516 wrote to memory of 2556 3516 cmd.exe 217 PID 2556 wrote to memory of 4840 2556 WKTPCU.exe 219 PID 4840 wrote to memory of 2300 4840 cmd.exe 222 PID 2300 wrote to memory of 3372 2300 GMUWMQE.exe 224 PID 3372 wrote to memory of 4796 3372 cmd.exe 227 PID 4796 wrote to memory of 3676 4796 WCBHQB.exe 229 PID 3676 wrote to memory of 4920 3676 cmd.exe 233 PID 4920 wrote to memory of 5092 4920 YAUBXYB.exe 234 PID 5092 wrote to memory of 5660 5092 cmd.exe 237 PID 5660 wrote to memory of 5340 5660 ELYICP.exe 239 PID 5340 wrote to memory of 2492 5340 cmd.exe 242 PID 2492 wrote to memory of 3816 2492 LVZ.exe 244 PID 3816 wrote to memory of 4232 3816 cmd.exe 247
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_5798d59a222b0952d76734aac688b428_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_5798d59a222b0952d76734aac688b428_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ROIJQ.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\windows\system\ROIJQ.exeC:\windows\system\ROIJQ.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KHAJ.exe.bat" "4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\windows\SysWOW64\KHAJ.exeC:\windows\system32\KHAJ.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ECFSFI.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\windows\ECFSFI.exeC:\windows\ECFSFI.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VSEVRC.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\windows\SysWOW64\VSEVRC.exeC:\windows\system32\VSEVRC.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UDMWXG.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\windows\UDMWXG.exeC:\windows\UDMWXG.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TNDUWB.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\windows\TNDUWB.exeC:\windows\TNDUWB.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TGLOKF.exe.bat" "14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5952 -
C:\windows\system\TGLOKF.exeC:\windows\system\TGLOKF.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VEEQQCS.exe.bat" "16⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6088 -
C:\windows\system\VEEQQCS.exeC:\windows\system\VEEQQCS.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MJPI.exe.bat" "18⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\windows\MJPI.exeC:\windows\MJPI.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XCSB.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\windows\system\XCSB.exeC:\windows\system\XCSB.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DCAOXI.exe.bat" "22⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\windows\SysWOW64\DCAOXI.exeC:\windows\system32\DCAOXI.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UNQEXC.exe.bat" "24⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5784 -
C:\windows\system\UNQEXC.exeC:\windows\system\UNQEXC.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ISW.exe.bat" "26⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\windows\system\ISW.exeC:\windows\system\ISW.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZGG.exe.bat" "28⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5240 -
C:\windows\system\ZGG.exeC:\windows\system\ZGG.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NIKSZ.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\windows\system\NIKSZ.exeC:\windows\system\NIKSZ.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\STGY.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:5280 -
C:\windows\system\STGY.exeC:\windows\system\STGY.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OZMVL.exe.bat" "34⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3216 -
C:\windows\SysWOW64\OZMVL.exeC:\windows\system32\OZMVL.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QPFQ.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:5760 -
C:\windows\SysWOW64\QPFQ.exeC:\windows\system32\QPFQ.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CHIIZ.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:6116 -
C:\windows\SysWOW64\CHIIZ.exeC:\windows\system32\CHIIZ.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BARKF.exe.bat" "40⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5196 -
C:\windows\system\BARKF.exeC:\windows\system\BARKF.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AQQNRVA.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:1296 -
C:\windows\system\AQQNRVA.exeC:\windows\system\AQQNRVA.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CORPX.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\windows\system\CORPX.exeC:\windows\system\CORPX.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3784 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QTPEFUK.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\windows\system\QTPEFUK.exeC:\windows\system\QTPEFUK.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EWTKKL.exe.bat" "48⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\windows\SysWOW64\EWTKKL.exeC:\windows\system32\EWTKKL.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LOB.exe.bat" "50⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5988 -
C:\windows\system\LOB.exeC:\windows\system\LOB.exe51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WKTPCU.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:3516 -
C:\windows\system\WKTPCU.exeC:\windows\system\WKTPCU.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GMUWMQE.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\windows\GMUWMQE.exeC:\windows\GMUWMQE.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WCBHQB.exe.bat" "56⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\windows\SysWOW64\WCBHQB.exeC:\windows\system32\WCBHQB.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YAUBXYB.exe.bat" "58⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3676 -
C:\windows\system\YAUBXYB.exeC:\windows\system\YAUBXYB.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ELYICP.exe.bat" "60⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\windows\ELYICP.exeC:\windows\ELYICP.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LVZ.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:5340 -
C:\windows\SysWOW64\LVZ.exeC:\windows\system32\LVZ.exe63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EYYNUY.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\windows\EYYNUY.exeC:\windows\EYYNUY.exe65⤵
- Executes dropped EXE
PID:4232 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EJZ.exe.bat" "66⤵
- System Location Discovery: System Language Discovery
PID:1560 -
C:\windows\EJZ.exeC:\windows\EJZ.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\APF.exe.bat" "68⤵
- System Location Discovery: System Language Discovery
PID:2764 -
C:\windows\system\APF.exeC:\windows\system\APF.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4896 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ORJC.exe.bat" "70⤵PID:1768
-
C:\windows\system\ORJC.exeC:\windows\system\ORJC.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CXHZ.exe.bat" "72⤵PID:4880
-
C:\windows\CXHZ.exeC:\windows\CXHZ.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2608 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NQKSJ.exe.bat" "74⤵
- System Location Discovery: System Language Discovery
PID:4832 -
C:\windows\NQKSJ.exeC:\windows\NQKSJ.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FYMXNS.exe.bat" "76⤵
- System Location Discovery: System Language Discovery
PID:1948 -
C:\windows\system\FYMXNS.exeC:\windows\system\FYMXNS.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LYT.exe.bat" "78⤵
- System Location Discovery: System Language Discovery
PID:4044 -
C:\windows\system\LYT.exeC:\windows\system\LYT.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WRODE.exe.bat" "80⤵PID:3008
-
C:\windows\SysWOW64\WRODE.exeC:\windows\system32\WRODE.exe81⤵
- Executes dropped EXE
PID:1744 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YPCY.exe.bat" "82⤵PID:5740
-
C:\windows\system\YPCY.exeC:\windows\system\YPCY.exe83⤵
- Executes dropped EXE
PID:1580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XZFOUY.exe.bat" "84⤵PID:4932
-
C:\windows\XZFOUY.exeC:\windows\XZFOUY.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RNJ.exe.bat" "86⤵PID:4612
-
C:\windows\SysWOW64\RNJ.exeC:\windows\system32\RNJ.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GITBPK.exe.bat" "88⤵
- System Location Discovery: System Language Discovery
PID:4120 -
C:\windows\SysWOW64\GITBPK.exeC:\windows\system32\GITBPK.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GVTQRX.exe.bat" "90⤵
- System Location Discovery: System Language Discovery
PID:2972 -
C:\windows\SysWOW64\GVTQRX.exeC:\windows\system32\GVTQRX.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DTZ.exe.bat" "92⤵PID:1096
-
C:\windows\DTZ.exeC:\windows\DTZ.exe93⤵
- Executes dropped EXE
PID:6032 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JTHBP.exe.bat" "94⤵PID:2588
-
C:\windows\JTHBP.exeC:\windows\JTHBP.exe95⤵
- Executes dropped EXE
PID:2516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UMCTXJP.exe.bat" "96⤵PID:3348
-
C:\windows\system\UMCTXJP.exeC:\windows\system\UMCTXJP.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HWSKD.exe.bat" "98⤵PID:3196
-
C:\windows\SysWOW64\HWSKD.exeC:\windows\system32\HWSKD.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IZWORJT.exe.bat" "100⤵PID:2128
-
C:\windows\SysWOW64\IZWORJT.exeC:\windows\system32\IZWORJT.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BUAJW.exe.bat" "102⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4784 -
C:\windows\SysWOW64\BUAJW.exeC:\windows\system32\BUAJW.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SDCXAFX.exe.bat" "104⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3192 -
C:\windows\SDCXAFX.exeC:\windows\SDCXAFX.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:620 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SNKQNJM.exe.bat" "106⤵
- Executes a command shell one-liner
PID:2700 -
C:\windows\system\SNKQNJM.exeC:\windows\system\SNKQNJM.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DGF.exe.bat" "108⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4432 -
C:\windows\DGF.exeC:\windows\DGF.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JGNWF.exe.bat" "110⤵PID:1816
-
C:\windows\JGNWF.exeC:\windows\JGNWF.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UZQPNAK.exe.bat" "112⤵PID:4792
-
C:\windows\system\UZQPNAK.exeC:\windows\system\UZQPNAK.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1648 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YPWP.exe.bat" "114⤵PID:4472
-
C:\windows\SysWOW64\YPWP.exeC:\windows\system32\YPWP.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TCBHCS.exe.bat" "116⤵
- System Location Discovery: System Language Discovery
PID:4108 -
C:\windows\SysWOW64\TCBHCS.exeC:\windows\system32\TCBHCS.exe117⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:204 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ISCY.exe.bat" "118⤵
- Executes a command shell one-liner
PID:1292 -
C:\windows\ISCY.exeC:\windows\ISCY.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SQISQOS.exe.bat" "120⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2720 -
C:\windows\SysWOW64\SQISQOS.exeC:\windows\system32\SQISQOS.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1424
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-