Analysis
- max time kernel
91s - max time network
134s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/08/2026, 18:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-09_50d0d460ef93ab1d3d7ef82a40ce5230_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-09_50d0d460ef93ab1d3d7ef82a40ce5230_elex_emotet_stop.exe
- Size 208KB
- Sample260809-w812jstdqh
- SHA256 fe21c2c2c325d4587d2be6801b04841a29a00d8a542aa3de37325e49149d401b
- MD5 50d0d460ef93ab1d3d7ef82a40ce5230
- SHA1 82c7480b0024894edc03a5df2226517d7702187c
- SHA512 f34945790aa0b35121af380d693f471bed5689a3291ffd76bba271358dfa4f63e15120639cebc61907191ef84e08f5668c2e534d10220847f650d01b24b0cd3a
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFledL+LOfh4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFle5+LOJkEj1
- TLSH T16B247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2812 LZBRT.exe 4312 YUB.exe 52 PFEGLQH.exe 4908 ULOWCLK.exe 5816 DLQJ.exe 3104 YGVSP.exe 6040 IWIEF.exe 4732 SUOZMHK.exe 2164 QPNIR.exe 5244 ONYD.exe 4140 GNAIH.exe 3552 NDB.exe 5952 CYLLZV.exe 4824 DBX.exe 6072 SRYGLG.exe 5604 RHJJG.exe 3012 CAMCOT.exe 544 BTP.exe 2116 FBV.exe 4844 FGW.exe 4328 IWCHPW.exe 3348 JZGKCMG.exe 3132 YUPPN.exe 4112 OKYO.exe 2356 MLYCDP.exe 5172 DLAHHUG.exe 4224 HBHHT.exe 1072 HWSL.exe 5060 LMZLLV.exe 2032 BCAKRIP.exe 4240 DAGFZRQ.exe 4268 NYTROZ.exe 5104 HLY.exe 5872 BDGTIA.exe 6052 KMIYL.exe 5768 FZMIVX.exe 5532 BAOKZ.exe 5744 QVG.exe 5160 ASLJAW.exe 2204 VGQ.exe 2844 OJUWPM.exe 4796 WOUKRZF.exe 2088 UEFFEE.exe 4848 SZE.exe 2808 VNJXT.exe 1204 KQT.exe 2092 TQVH.exe 4160 XGBPURQ.exe 5956 XMC.exe 1096 DMJRM.exe 3160 PUQRYRI.exe 3388 ANT.exe 6092 KVNPK.exe 1168 ZQE.exe 2708 DYLBH.exe 5580 DLDQJO.exe 3436 PTSQV.exe 1720 TKYYHYB.exe 2392 CKAD.exe 1760 TSCIO.exe 4284 OFZRZTC.exe 5456 SNOZ.exe 1440 MJTJNL.exe 820 QRZJZ.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\TQVH.exe.bat KQT.exe File created C:\windows\SysWOW64\TKYYHYB.exe.bat PTSQV.exe File created C:\windows\SysWOW64\GEA.exe.bat EJVFKA.exe File created C:\windows\SysWOW64\XLEOKFF.exe LDXOX.exe File created C:\windows\SysWOW64\FZMIVX.exe.bat KMIYL.exe File created C:\windows\SysWOW64\DLAHHUG.exe.bat MLYCDP.exe File created C:\windows\SysWOW64\NYTROZ.exe.bat DAGFZRQ.exe File created C:\windows\SysWOW64\SZE.exe.bat UEFFEE.exe File opened for modification C:\windows\SysWOW64\OFZRZTC.exe TSCIO.exe File created C:\windows\SysWOW64\GEA.exe EJVFKA.exe File created C:\windows\SysWOW64\OPHI.exe.bat IUI.exe File created C:\windows\SysWOW64\YUPPN.exe.bat JZGKCMG.exe File created C:\windows\SysWOW64\OKYO.exe YUPPN.exe File opened for modification C:\windows\SysWOW64\VNJXT.exe SZE.exe File created C:\windows\SysWOW64\TQVH.exe KQT.exe File opened for modification C:\windows\SysWOW64\MJTJNL.exe SNOZ.exe File opened for modification C:\windows\SysWOW64\FAPH.exe KPHI.exe File created C:\windows\SysWOW64\VRPK.exe.bat NDDEY.exe File opened for modification C:\windows\SysWOW64\XKMIVVZ.exe DWPZS.exe File created C:\windows\SysWOW64\OIRMK.exe FAPH.exe File created C:\windows\SysWOW64\GKA.exe GEA.exe File created C:\windows\SysWOW64\XLEOKFF.exe.bat LDXOX.exe File opened for modification C:\windows\SysWOW64\CYLLZV.exe NDB.exe File opened for modification C:\windows\SysWOW64\DLAHHUG.exe MLYCDP.exe File opened for modification C:\windows\SysWOW64\NYTROZ.exe DAGFZRQ.exe File opened for modification C:\windows\SysWOW64\FZMIVX.exe KMIYL.exe File opened for modification C:\windows\SysWOW64\ASLJAW.exe QVG.exe File created C:\windows\SysWOW64\ZQE.exe KVNPK.exe File opened for modification C:\windows\SysWOW64\ZQE.exe KVNPK.exe File opened for modification C:\windows\SysWOW64\TKYYHYB.exe PTSQV.exe File created C:\windows\SysWOW64\ULOWCLK.exe PFEGLQH.exe File created C:\windows\SysWOW64\CYLLZV.exe.bat NDB.exe File opened for modification C:\windows\SysWOW64\OKYO.exe YUPPN.exe File created C:\windows\SysWOW64\NYTROZ.exe DAGFZRQ.exe File created C:\windows\SysWOW64\VNJXT.exe SZE.exe File created C:\windows\SysWOW64\OFZRZTC.exe TSCIO.exe File created C:\windows\SysWOW64\TKYYHYB.exe PTSQV.exe File created C:\windows\SysWOW64\OFZRZTC.exe.bat TSCIO.exe File created C:\windows\SysWOW64\YUB.exe LZBRT.exe File opened for modification C:\windows\SysWOW64\YUB.exe LZBRT.exe File created C:\windows\SysWOW64\OKYO.exe.bat YUPPN.exe File created C:\windows\SysWOW64\ASLJAW.exe.bat QVG.exe File created C:\windows\SysWOW64\ZQE.exe.bat KVNPK.exe File opened for modification C:\windows\SysWOW64\VRPK.exe NDDEY.exe File created C:\windows\SysWOW64\EJVFKA.exe GJOR.exe File opened for modification C:\windows\SysWOW64\EJVFKA.exe GJOR.exe File opened for modification C:\windows\SysWOW64\VGQ.exe ASLJAW.exe File opened for modification C:\windows\SysWOW64\TQVH.exe KQT.exe File opened for modification C:\windows\SysWOW64\OIRMK.exe FAPH.exe File created C:\windows\SysWOW64\KLOVQY.exe.bat ELHH.exe File opened for modification C:\windows\SysWOW64\YUPPN.exe JZGKCMG.exe File created C:\windows\SysWOW64\ASLJAW.exe QVG.exe File created C:\windows\SysWOW64\VGQ.exe.bat ASLJAW.exe File created C:\windows\SysWOW64\XGBPURQ.exe TQVH.exe File opened for modification C:\windows\SysWOW64\ANT.exe PUQRYRI.exe File created C:\windows\SysWOW64\XKMIVVZ.exe.bat DWPZS.exe File created C:\windows\SysWOW64\EJVFKA.exe.bat GJOR.exe File opened for modification C:\windows\SysWOW64\GEA.exe EJVFKA.exe File opened for modification C:\windows\SysWOW64\ULOWCLK.exe PFEGLQH.exe File created C:\windows\SysWOW64\JZGKCMG.exe.bat IWCHPW.exe File created C:\windows\SysWOW64\YUPPN.exe JZGKCMG.exe File opened for modification C:\windows\SysWOW64\SZE.exe UEFFEE.exe File created C:\windows\SysWOW64\ANT.exe PUQRYRI.exe File created C:\windows\SysWOW64\MJTJNL.exe SNOZ.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\MLYCDP.exe OKYO.exe File created C:\windows\LMZLLV.exe HWSL.exe File created C:\windows\GJOR.exe.bat UQTYTQM.exe File created C:\windows\system\KQT.exe VNJXT.exe File created C:\windows\XMC.exe.bat XGBPURQ.exe File created C:\windows\system\PDXPM.exe.bat SFR.exe File created C:\windows\system\XPJF.exe.bat TZDXMY.exe File created C:\windows\system\FBYREZN.exe ZARD.exe File opened for modification C:\windows\system\EOVSV.exe XLEOKFF.exe File created C:\windows\EVOYLD.exe.bat ANA.exe File opened for modification C:\windows\system\FBV.exe BTP.exe File created C:\windows\BCAKRIP.exe LMZLLV.exe File opened for modification C:\windows\system\XPJF.exe TZDXMY.exe File created C:\windows\GJOR.exe UQTYTQM.exe File created C:\windows\system\CAMCOT.exe.bat RHJJG.exe File created C:\windows\system\TQYC.exe.bat EVOYLD.exe File created C:\windows\system\GWC.exe FBYREZN.exe File created C:\windows\system\BTP.exe CAMCOT.exe File opened for modification C:\windows\system\AYNUM.exe IDJ.exe File created C:\windows\system\ZEEG.exe.bat KBMBZV.exe File opened for modification C:\windows\KVNPK.exe ANT.exe File created C:\windows\CZG.exe.bat QRZJZ.exe File created C:\windows\system\PDXPM.exe SFR.exe File created C:\windows\ELHH.exe JQCYWEX.exe File opened for modification C:\windows\QVG.exe BAOKZ.exe File opened for modification C:\windows\system\MPZCO.exe NRJFVU.exe File created C:\windows\system\DLDQJO.exe DYLBH.exe File created C:\windows\TSCIO.exe CKAD.exe File created C:\windows\QVG.exe BAOKZ.exe File opened for modification C:\windows\system\MLYCDP.exe OKYO.exe File created C:\windows\KVNPK.exe.bat ANT.exe File opened for modification C:\windows\system\QRZJZ.exe MJTJNL.exe File opened for modification C:\windows\RHJJG.exe SRYGLG.exe File opened for modification C:\windows\system\BTP.exe CAMCOT.exe File created C:\windows\IWCHPW.exe FGW.exe File created C:\windows\HLY.exe NYTROZ.exe File created C:\windows\system\JQCYWEX.exe.bat PDXPM.exe File created C:\windows\HSL.exe.bat OPHI.exe File created C:\windows\NDB.exe GNAIH.exe File created C:\windows\PFEGLQH.exe.bat YUB.exe File created C:\windows\YGVSP.exe.bat DLQJ.exe File created C:\windows\system\ZEEG.exe KBMBZV.exe File opened for modification C:\windows\system\ANA.exe ZKWU.exe File opened for modification C:\windows\IWCHPW.exe FGW.exe File created C:\windows\system\DLQJ.exe.bat ULOWCLK.exe File created C:\windows\system\DAGFZRQ.exe.bat BCAKRIP.exe File opened for modification C:\windows\HSL.exe OPHI.exe File created C:\windows\system\FBV.exe BTP.exe File created C:\windows\system\HBHHT.exe DLAHHUG.exe File created C:\windows\BDGTIA.exe.bat HLY.exe File created C:\windows\TSCIO.exe.bat CKAD.exe File created C:\windows\KPHI.exe CZG.exe File created C:\windows\system\GWC.exe.bat FBYREZN.exe File created C:\windows\LDXOX.exe LXFA.exe File opened for modification C:\windows\system\ONYD.exe QPNIR.exe File created C:\windows\BCAKRIP.exe.bat LMZLLV.exe File created C:\windows\system\SNOZ.exe OFZRZTC.exe File opened for modification C:\windows\KPHI.exe CZG.exe File opened for modification C:\windows\DZKSXYE.exe VTRDWLJ.exe File created C:\windows\LXFA.exe.bat HHQSK.exe File created C:\windows\system\SAB.exe TQYC.exe File created C:\windows\system\CAMCOT.exe RHJJG.exe File opened for modification C:\windows\system\DMJRM.exe XMC.exe File created C:\windows\system\SFR.exe.bat XKMIVVZ.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 6132 cmd.exe 4704 cmd.exe 1544 cmd.exe 2340 cmd.exe 4640 cmd.exe 2364 cmd.exe 1128 cmd.exe 2888 cmd.exe 5008 cmd.exe 616 cmd.exe 2124 cmd.exe 896 cmd.exe 2684 cmd.exe 4876 cmd.exe 4520 cmd.exe 204 cmd.exe 1140 cmd.exe 4948 cmd.exe 1608 cmd.exe 4440 cmd.exe 1420 cmd.exe 1380 cmd.exe 472 cmd.exe 2112 cmd.exe 4668 cmd.exe 1296 cmd.exe 1120 cmd.exe 2576 cmd.exe 4896 cmd.exe 3108 cmd.exe 1664 cmd.exe 5276 cmd.exe 5740 cmd.exe 3660 cmd.exe 2028 cmd.exe 1364 cmd.exe 4364 cmd.exe 2580 cmd.exe 3944 cmd.exe 2484 cmd.exe 4472 cmd.exe 2904 cmd.exe 4560 cmd.exe 3528 cmd.exe 5852 cmd.exe 3996 cmd.exe 3964 cmd.exe 5092 cmd.exe 1672 cmd.exe 256 cmd.exe 2752 cmd.exe 3060 cmd.exe 5268 cmd.exe 3284 cmd.exe 3712 cmd.exe 4132 cmd.exe 4316 cmd.exe 4476 cmd.exe 5880 cmd.exe 4588 cmd.exe 2432 cmd.exe 4604 cmd.exe 1736 cmd.exe 2084 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 1388 3600 WerFault.exe 87 2200 2812 WerFault.exe 93 5484 4312 WerFault.exe 99 2796 52 WerFault.exe 104 3140 4908 WerFault.exe 109 6036 5816 WerFault.exe 114 544 3104 WerFault.exe 119 1912 6040 WerFault.exe 124 3016 4732 WerFault.exe 129 5584 2164 WerFault.exe 134 5228 5244 WerFault.exe 139 2504 4140 WerFault.exe 144 2028 3552 WerFault.exe 149 2604 5952 WerFault.exe 154 1956 4824 WerFault.exe 159 4600 6072 WerFault.exe 164 1840 5604 WerFault.exe 169 1628 3012 WerFault.exe 174 2720 544 WerFault.exe 179 1544 2116 WerFault.exe 184 1260 4844 WerFault.exe 189 5468 4328 WerFault.exe 194 2788 3348 WerFault.exe 199 1060 3132 WerFault.exe 204 3596 4112 WerFault.exe 209 2456 2356 WerFault.exe 214 1636 5172 WerFault.exe 219 1192 4224 WerFault.exe 224 2392 1072 WerFault.exe 229 2072 5060 WerFault.exe 234 5732 2032 WerFault.exe 239 5648 4240 WerFault.exe 244 4760 4268 WerFault.exe 249 5252 5104 WerFault.exe 254 820 5872 WerFault.exe 259 4344 6052 WerFault.exe 264 2984 5768 WerFault.exe 269 5496 5532 WerFault.exe 275 4928 5744 WerFault.exe 280 1628 5160 WerFault.exe 285 5032 2204 WerFault.exe 290 1848 2844 WerFault.exe 295 5456 4796 WerFault.exe 300 3500 2088 WerFault.exe 305 4980 4848 WerFault.exe 310 896 2808 WerFault.exe 315 200 1204 WerFault.exe 320 5972 2092 WerFault.exe 325 1084 4160 WerFault.exe 330 3904 5956 WerFault.exe 335 2428 1096 WerFault.exe 340 5732 3160 WerFault.exe 345 4200 3388 WerFault.exe 350 5828 6092 WerFault.exe 355 2556 1168 WerFault.exe 360 4560 2708 WerFault.exe 365 4832 5580 WerFault.exe 370 1300 3436 WerFault.exe 375 3896 1720 WerFault.exe 380 2720 2392 WerFault.exe 385 4368 1760 WerFault.exe 390 4436 4284 WerFault.exe 395 4184 5456 WerFault.exe 400 5584 1440 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NRJFVU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QSP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IUI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FZMIVX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UIZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZQE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GJOR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HSL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AYNUM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VNJXT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MJTJNL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KBMBZV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SNOZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VRPK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EJVFKA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FGW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PDXPM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SRYGLG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UEFFEE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XPJF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZMYOK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EOVSV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IWCHPW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GNAIH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LXFA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RHJJG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QPNIR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XGBPURQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3600 2026-08-09_50d0d460ef93ab1d3d7ef82a40ce5230_elex_emotet_stop.exe 3600 2026-08-09_50d0d460ef93ab1d3d7ef82a40ce5230_elex_emotet_stop.exe 2812 LZBRT.exe 2812 LZBRT.exe 4312 YUB.exe 4312 YUB.exe 52 PFEGLQH.exe 52 PFEGLQH.exe 4908 ULOWCLK.exe 4908 ULOWCLK.exe 5816 DLQJ.exe 5816 DLQJ.exe 3104 YGVSP.exe 3104 YGVSP.exe 6040 IWIEF.exe 6040 IWIEF.exe 4732 SUOZMHK.exe 4732 SUOZMHK.exe 2164 QPNIR.exe 2164 QPNIR.exe 5244 ONYD.exe 5244 ONYD.exe 4140 GNAIH.exe 4140 GNAIH.exe 3552 NDB.exe 3552 NDB.exe 5952 CYLLZV.exe 5952 CYLLZV.exe 4824 DBX.exe 4824 DBX.exe 6072 SRYGLG.exe 6072 SRYGLG.exe 5604 RHJJG.exe 5604 RHJJG.exe 3012 CAMCOT.exe 3012 CAMCOT.exe 544 BTP.exe 544 BTP.exe 2116 FBV.exe 2116 FBV.exe 4844 FGW.exe 4844 FGW.exe 4328 IWCHPW.exe 4328 IWCHPW.exe 3348 JZGKCMG.exe 3348 JZGKCMG.exe 3132 YUPPN.exe 3132 YUPPN.exe 4112 OKYO.exe 4112 OKYO.exe 2356 MLYCDP.exe 2356 MLYCDP.exe 5172 DLAHHUG.exe 5172 DLAHHUG.exe 4224 HBHHT.exe 4224 HBHHT.exe 1072 HWSL.exe 1072 HWSL.exe 5060 LMZLLV.exe 5060 LMZLLV.exe 2032 BCAKRIP.exe 2032 BCAKRIP.exe 4240 DAGFZRQ.exe 4240 DAGFZRQ.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 3600 2026-08-09_50d0d460ef93ab1d3d7ef82a40ce5230_elex_emotet_stop.exe 3600 2026-08-09_50d0d460ef93ab1d3d7ef82a40ce5230_elex_emotet_stop.exe 2812 LZBRT.exe 2812 LZBRT.exe 4312 YUB.exe 4312 YUB.exe 52 PFEGLQH.exe 52 PFEGLQH.exe 4908 ULOWCLK.exe 4908 ULOWCLK.exe 5816 DLQJ.exe 5816 DLQJ.exe 3104 YGVSP.exe 3104 YGVSP.exe 6040 IWIEF.exe 6040 IWIEF.exe 4732 SUOZMHK.exe 4732 SUOZMHK.exe 2164 QPNIR.exe 2164 QPNIR.exe 5244 ONYD.exe 5244 ONYD.exe 4140 GNAIH.exe 4140 GNAIH.exe 3552 NDB.exe 3552 NDB.exe 5952 CYLLZV.exe 5952 CYLLZV.exe 4824 DBX.exe 4824 DBX.exe 6072 SRYGLG.exe 6072 SRYGLG.exe 5604 RHJJG.exe 5604 RHJJG.exe 3012 CAMCOT.exe 3012 CAMCOT.exe 544 BTP.exe 544 BTP.exe 2116 FBV.exe 2116 FBV.exe 4844 FGW.exe 4844 FGW.exe 4328 IWCHPW.exe 4328 IWCHPW.exe 3348 JZGKCMG.exe 3348 JZGKCMG.exe 3132 YUPPN.exe 3132 YUPPN.exe 4112 OKYO.exe 4112 OKYO.exe 2356 MLYCDP.exe 2356 MLYCDP.exe 5172 DLAHHUG.exe 5172 DLAHHUG.exe 4224 HBHHT.exe 4224 HBHHT.exe 1072 HWSL.exe 1072 HWSL.exe 5060 LMZLLV.exe 5060 LMZLLV.exe 2032 BCAKRIP.exe 2032 BCAKRIP.exe 4240 DAGFZRQ.exe 4240 DAGFZRQ.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3600 wrote to memory of 1928 3600 2026-08-09_50d0d460ef93ab1d3d7ef82a40ce5230_elex_emotet_stop.exe 89 PID 1928 wrote to memory of 2812 1928 cmd.exe 93 PID 2812 wrote to memory of 2548 2812 LZBRT.exe 95 PID 2548 wrote to memory of 4312 2548 cmd.exe 99 PID 4312 wrote to memory of 5748 4312 YUB.exe 100 PID 5748 wrote to memory of 52 5748 cmd.exe 104 PID 52 wrote to memory of 5736 52 PFEGLQH.exe 105 PID 5736 wrote to memory of 4908 5736 cmd.exe 109 PID 4908 wrote to memory of 1432 4908 ULOWCLK.exe 110 PID 1432 wrote to memory of 5816 1432 cmd.exe 114 PID 5816 wrote to memory of 1724 5816 DLQJ.exe 115 PID 1724 wrote to memory of 3104 1724 cmd.exe 119 PID 3104 wrote to memory of 972 3104 YGVSP.exe 120 PID 972 wrote to memory of 6040 972 cmd.exe 124 PID 6040 wrote to memory of 4444 6040 IWIEF.exe 125 PID 4444 wrote to memory of 4732 4444 cmd.exe 129 PID 4732 wrote to memory of 2112 4732 SUOZMHK.exe 130 PID 2112 wrote to memory of 2164 2112 cmd.exe 134 PID 2164 wrote to memory of 4392 2164 QPNIR.exe 135 PID 4392 wrote to memory of 5244 4392 cmd.exe 139 PID 5244 wrote to memory of 2060 5244 ONYD.exe 140 PID 2060 wrote to memory of 4140 2060 cmd.exe 144 PID 4140 wrote to memory of 4280 4140 GNAIH.exe 145 PID 4280 wrote to memory of 3552 4280 cmd.exe 149 PID 3552 wrote to memory of 4568 3552 NDB.exe 150 PID 4568 wrote to memory of 5952 4568 cmd.exe 154 PID 5952 wrote to memory of 204 5952 CYLLZV.exe 155 PID 204 wrote to memory of 4824 204 cmd.exe 159 PID 4824 wrote to memory of 5592 4824 DBX.exe 160 PID 5592 wrote to memory of 6072 5592 cmd.exe 164 PID 6072 wrote to memory of 4936 6072 SRYGLG.exe 165 PID 4936 wrote to memory of 5604 4936 cmd.exe 169 PID 5604 wrote to memory of 2484 5604 RHJJG.exe 170 PID 2484 wrote to memory of 3012 2484 cmd.exe 174 PID 3012 wrote to memory of 3964 3012 CAMCOT.exe 175 PID 3964 wrote to memory of 544 3964 cmd.exe 179 PID 544 wrote to memory of 1492 544 BTP.exe 180 PID 1492 wrote to memory of 2116 1492 cmd.exe 184 PID 2116 wrote to memory of 3704 2116 FBV.exe 185 PID 3704 wrote to memory of 4844 3704 cmd.exe 189 PID 4844 wrote to memory of 1612 4844 FGW.exe 190 PID 1612 wrote to memory of 4328 1612 cmd.exe 194 PID 4328 wrote to memory of 2432 4328 IWCHPW.exe 195 PID 2432 wrote to memory of 3348 2432 cmd.exe 199 PID 3348 wrote to memory of 6116 3348 JZGKCMG.exe 200 PID 6116 wrote to memory of 3132 6116 cmd.exe 204 PID 3132 wrote to memory of 5008 3132 YUPPN.exe 205 PID 5008 wrote to memory of 4112 5008 cmd.exe 209 PID 4112 wrote to memory of 3576 4112 OKYO.exe 210 PID 3576 wrote to memory of 2356 3576 cmd.exe 214 PID 2356 wrote to memory of 2360 2356 MLYCDP.exe 215 PID 2360 wrote to memory of 5172 2360 cmd.exe 219 PID 5172 wrote to memory of 616 5172 DLAHHUG.exe 220 PID 616 wrote to memory of 4224 616 cmd.exe 224 PID 4224 wrote to memory of 5776 4224 HBHHT.exe 225 PID 5776 wrote to memory of 1072 5776 cmd.exe 229 PID 1072 wrote to memory of 2124 1072 HWSL.exe 230 PID 2124 wrote to memory of 5060 2124 cmd.exe 234 PID 5060 wrote to memory of 4000 5060 LMZLLV.exe 235 PID 4000 wrote to memory of 2032 4000 cmd.exe 239 PID 2032 wrote to memory of 4472 2032 BCAKRIP.exe 240 PID 4472 wrote to memory of 4240 4472 cmd.exe 244 PID 4240 wrote to memory of 3628 4240 DAGFZRQ.exe 245 PID 3628 wrote to memory of 4268 3628 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_50d0d460ef93ab1d3d7ef82a40ce5230_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_50d0d460ef93ab1d3d7ef82a40ce5230_elex_emotet_stop.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LZBRT.exe.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\windows\LZBRT.exeC:\windows\LZBRT.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YUB.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\windows\SysWOW64\YUB.exeC:\windows\system32\YUB.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PFEGLQH.exe.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5748 -
C:\windows\PFEGLQH.exeC:\windows\PFEGLQH.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:52 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ULOWCLK.exe.bat" "8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5736 -
C:\windows\SysWOW64\ULOWCLK.exeC:\windows\system32\ULOWCLK.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DLQJ.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\windows\system\DLQJ.exeC:\windows\system\DLQJ.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YGVSP.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\windows\YGVSP.exeC:\windows\YGVSP.exe13⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IWIEF.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:972 -
C:\windows\system\IWIEF.exeC:\windows\system\IWIEF.exe15⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6040 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SUOZMHK.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\windows\SUOZMHK.exeC:\windows\SUOZMHK.exe17⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QPNIR.exe.bat" "18⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\windows\QPNIR.exeC:\windows\QPNIR.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ONYD.exe.bat" "20⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\windows\system\ONYD.exeC:\windows\system\ONYD.exe21⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GNAIH.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\windows\GNAIH.exeC:\windows\GNAIH.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NDB.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\windows\NDB.exeC:\windows\NDB.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CYLLZV.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\windows\SysWOW64\CYLLZV.exeC:\windows\system32\CYLLZV.exe27⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DBX.exe.bat" "28⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:204 -
C:\windows\system\DBX.exeC:\windows\system\DBX.exe29⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SRYGLG.exe.bat" "30⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5592 -
C:\windows\SRYGLG.exeC:\windows\SRYGLG.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6072 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RHJJG.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\windows\RHJJG.exeC:\windows\RHJJG.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5604 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CAMCOT.exe.bat" "34⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\windows\system\CAMCOT.exeC:\windows\system\CAMCOT.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BTP.exe.bat" "36⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\windows\system\BTP.exeC:\windows\system\BTP.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FBV.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\windows\system\FBV.exeC:\windows\system\FBV.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FGW.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\windows\FGW.exeC:\windows\FGW.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IWCHPW.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\windows\IWCHPW.exeC:\windows\IWCHPW.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JZGKCMG.exe.bat" "44⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\windows\SysWOW64\JZGKCMG.exeC:\windows\system32\JZGKCMG.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3348 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YUPPN.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:6116 -
C:\windows\SysWOW64\YUPPN.exeC:\windows\system32\YUPPN.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OKYO.exe.bat" "48⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\windows\SysWOW64\OKYO.exeC:\windows\system32\OKYO.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MLYCDP.exe.bat" "50⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\windows\system\MLYCDP.exeC:\windows\system\MLYCDP.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DLAHHUG.exe.bat" "52⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\windows\SysWOW64\DLAHHUG.exeC:\windows\system32\DLAHHUG.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5172 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HBHHT.exe.bat" "54⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:616 -
C:\windows\system\HBHHT.exeC:\windows\system\HBHHT.exe55⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HWSL.exe.bat" "56⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5776 -
C:\windows\system\HWSL.exeC:\windows\system\HWSL.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LMZLLV.exe.bat" "58⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\windows\LMZLLV.exeC:\windows\LMZLLV.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BCAKRIP.exe.bat" "60⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\windows\BCAKRIP.exeC:\windows\BCAKRIP.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DAGFZRQ.exe.bat" "62⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\windows\system\DAGFZRQ.exeC:\windows\system\DAGFZRQ.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NYTROZ.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\windows\SysWOW64\NYTROZ.exeC:\windows\system32\NYTROZ.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HLY.exe.bat" "66⤵
- System Location Discovery: System Language Discovery
PID:2268 -
C:\windows\HLY.exeC:\windows\HLY.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5104 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BDGTIA.exe.bat" "68⤵PID:1596
-
C:\windows\BDGTIA.exeC:\windows\BDGTIA.exe69⤵
- Executes dropped EXE
PID:5872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KMIYL.exe.bat" "70⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2888 -
C:\windows\KMIYL.exeC:\windows\KMIYL.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FZMIVX.exe.bat" "72⤵
- Executes a command shell one-liner
PID:4668 -
C:\windows\SysWOW64\FZMIVX.exeC:\windows\system32\FZMIVX.exe73⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BAOKZ.exe.bat" "74⤵
- Executes a command shell one-liner
PID:5268 -
C:\windows\system\BAOKZ.exeC:\windows\system\BAOKZ.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QVG.exe.bat" "76⤵
- Executes a command shell one-liner
PID:5276 -
C:\windows\QVG.exeC:\windows\QVG.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5744 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ASLJAW.exe.bat" "78⤵
- Executes a command shell one-liner
PID:2904 -
C:\windows\SysWOW64\ASLJAW.exeC:\windows\system32\ASLJAW.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VGQ.exe.bat" "80⤵
- System Location Discovery: System Language Discovery
PID:3192 -
C:\windows\SysWOW64\VGQ.exeC:\windows\system32\VGQ.exe81⤵
- Executes dropped EXE
PID:2204 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OJUWPM.exe.bat" "82⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3284 -
C:\windows\OJUWPM.exeC:\windows\OJUWPM.exe83⤵
- Executes dropped EXE
PID:2844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WOUKRZF.exe.bat" "84⤵
- Executes a command shell one-liner
PID:1544 -
C:\windows\WOUKRZF.exeC:\windows\WOUKRZF.exe85⤵
- Executes dropped EXE
PID:4796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UEFFEE.exe.bat" "86⤵
- Executes a command shell one-liner
PID:2340 -
C:\windows\UEFFEE.exeC:\windows\UEFFEE.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SZE.exe.bat" "88⤵
- System Location Discovery: System Language Discovery
PID:4408 -
C:\windows\SysWOW64\SZE.exeC:\windows\system32\SZE.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VNJXT.exe.bat" "90⤵PID:2200
-
C:\windows\SysWOW64\VNJXT.exeC:\windows\system32\VNJXT.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KQT.exe.bat" "92⤵
- System Location Discovery: System Language Discovery
PID:6056 -
C:\windows\system\KQT.exeC:\windows\system\KQT.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1204 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TQVH.exe.bat" "94⤵PID:4412
-
C:\windows\SysWOW64\TQVH.exeC:\windows\system32\TQVH.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XGBPURQ.exe.bat" "96⤵
- System Location Discovery: System Language Discovery
PID:2700 -
C:\windows\SysWOW64\XGBPURQ.exeC:\windows\system32\XGBPURQ.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XMC.exe.bat" "98⤵PID:2912
-
C:\windows\XMC.exeC:\windows\XMC.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DMJRM.exe.bat" "100⤵PID:5044
-
C:\windows\system\DMJRM.exeC:\windows\system\DMJRM.exe101⤵
- Executes dropped EXE
PID:1096 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PUQRYRI.exe.bat" "102⤵
- System Location Discovery: System Language Discovery
PID:1796 -
C:\windows\PUQRYRI.exeC:\windows\PUQRYRI.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ANT.exe.bat" "104⤵PID:3608
-
C:\windows\SysWOW64\ANT.exeC:\windows\system32\ANT.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3388 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KVNPK.exe.bat" "106⤵PID:3172
-
C:\windows\KVNPK.exeC:\windows\KVNPK.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZQE.exe.bat" "108⤵PID:5860
-
C:\windows\SysWOW64\ZQE.exeC:\windows\system32\ZQE.exe109⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1168 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DYLBH.exe.bat" "110⤵PID:4552
-
C:\windows\system\DYLBH.exeC:\windows\system\DYLBH.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DLDQJO.exe.bat" "112⤵PID:3252
-
C:\windows\system\DLDQJO.exeC:\windows\system\DLDQJO.exe113⤵
- Executes dropped EXE
PID:5580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PTSQV.exe.bat" "114⤵
- System Location Discovery: System Language Discovery
PID:200 -
C:\windows\system\PTSQV.exeC:\windows\system\PTSQV.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TKYYHYB.exe.bat" "116⤵PID:3036
-
C:\windows\SysWOW64\TKYYHYB.exeC:\windows\system32\TKYYHYB.exe117⤵
- Executes dropped EXE
PID:1720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CKAD.exe.bat" "118⤵PID:4456
-
C:\windows\CKAD.exeC:\windows\CKAD.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TSCIO.exe.bat" "120⤵PID:3392
-
C:\windows\TSCIO.exeC:\windows\TSCIO.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1760
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-