Analysis
- max time kernel
76s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/08/2026, 19:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-09_43b921009f83e005dc329f7c9f9cf3af_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-09_43b921009f83e005dc329f7c9f9cf3af_elex_emotet_stop.exe
- Size 208KB
- Sample260809-ym8klsvdmd
- SHA256 e3e9a3fd9e05604e816b7956e4231fd6cbd0d1991e88d97afac258828b39c196
- MD5 43b921009f83e005dc329f7c9f9cf3af
- SHA1 66bfe12793e850fa941d2f202f484683468b3da7
- SHA512 b6cdd9dc15c941b855c5e6c829cd047bd47436a7116b7dcdf972e924c7a09ec03f3f145e1fff4029049a82870d392b12c54bd89725dc05171922b4a31f0d7b74
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlcKL+LOfT4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFlcS+LO7kEj1
- TLSH T1CE247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1812 QZXLG.exe 408 XFQHVB.exe 5596 HYAGHEY.exe 2960 OJPOR.exe 916 AWWMWF.exe 5656 ECGCM.exe 5808 MPTI.exe 4676 ANT.exe 1936 TFI.exe 5972 OWRB.exe 2288 WBW.exe 1004 GZJCPM.exe 3904 IMTEAGG.exe 2784 SVV.exe 5412 AAH.exe 840 UNMH.exe 3788 YDTH.exe 3504 MBTTNFQ.exe 4384 HMJSB.exe 2132 LCQ.exe 2524 ASRRUW.exe 1236 CQWLB.exe 52 BBHTKKT.exe 512 CWLXPA.exe 2764 XBXB.exe 2716 WZJENKN.exe 2152 OUMA.exe 4604 PXY.exe 2084 JLVNQ.exe 4880 EYAWBQB.exe 5372 IOOW.exe 5652 DBLGPI.exe 3276 DHLURV.exe 3968 SKVG.exe 1932 NID.exe 1424 IVMU.exe 6064 ZDOZI.exe 5740 BBCT.exe 3480 JHUIR.exe 3360 EUZRCXB.exe 4972 PZKXOEC.exe 5940 EPLOVZ.exe 2712 XKP.exe 4268 MNYWTC.exe 1288 DOABXID.exe 2728 WREFCX.exe 3688 REJ.exe 4552 LROY.exe 4232 WKRRXE.exe 1400 OXBJNB.exe 5392 GAFEA.exe 4204 AOMK.exe 2640 ROSI.exe 1844 SRJDZTO.exe 3728 RCTTHH.exe 944 NCVWT.exe 904 QYNXEW.exe 2688 TGVUL.exe 3588 RRL.exe 5272 WRUEHMC.exe 4824 CMY.exe 4860 IIK.exe 4732 SFX.exe 2740 MYF.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\CQWLB.exe ASRRUW.exe File created C:\windows\SysWOW64\PXY.exe.bat OUMA.exe File opened for modification C:\windows\SysWOW64\EPLOVZ.exe PZKXOEC.exe File opened for modification C:\windows\SysWOW64\GAFEA.exe OXBJNB.exe File created C:\windows\SysWOW64\TGVUL.exe.bat QYNXEW.exe File opened for modification C:\windows\SysWOW64\HYAGHEY.exe XFQHVB.exe File opened for modification C:\windows\SysWOW64\QZXLG.exe 2026-08-09_43b921009f83e005dc329f7c9f9cf3af_elex_emotet_stop.exe File created C:\windows\SysWOW64\OWRB.exe.bat TFI.exe File created C:\windows\SysWOW64\AAH.exe.bat SVV.exe File opened for modification C:\windows\SysWOW64\PXY.exe OUMA.exe File created C:\windows\SysWOW64\KGS.exe GVU.exe File created C:\windows\SysWOW64\PCKYN.exe OMCQ.exe File created C:\windows\SysWOW64\BIBVDX.exe LSS.exe File created C:\windows\SysWOW64\IMEI.exe.bat CMWVUNK.exe File opened for modification C:\windows\SysWOW64\IVMU.exe NID.exe File created C:\windows\SysWOW64\QZXLG.exe.bat 2026-08-09_43b921009f83e005dc329f7c9f9cf3af_elex_emotet_stop.exe File created C:\windows\SysWOW64\SVV.exe IMTEAGG.exe File created C:\windows\SysWOW64\SVV.exe.bat IMTEAGG.exe File created C:\windows\SysWOW64\SKVG.exe DHLURV.exe File created C:\windows\SysWOW64\NID.exe.bat SKVG.exe File created C:\windows\SysWOW64\RCTTHH.exe.bat SRJDZTO.exe File created C:\windows\SysWOW64\IMTEAGG.exe GZJCPM.exe File created C:\windows\SysWOW64\IMTEAGG.exe.bat GZJCPM.exe File created C:\windows\SysWOW64\MNYWTC.exe XKP.exe File opened for modification C:\windows\SysWOW64\MNYWTC.exe XKP.exe File created C:\windows\SysWOW64\TGVUL.exe QYNXEW.exe File opened for modification C:\windows\SysWOW64\PCKYN.exe OMCQ.exe File created C:\windows\SysWOW64\DEXFEOI.exe HTPG.exe File created C:\windows\SysWOW64\HYAGHEY.exe XFQHVB.exe File created C:\windows\SysWOW64\HMJSB.exe MBTTNFQ.exe File created C:\windows\SysWOW64\NID.exe SKVG.exe File created C:\windows\SysWOW64\XKP.exe.bat EPLOVZ.exe File created C:\windows\SysWOW64\WRUEHMC.exe RRL.exe File created C:\windows\SysWOW64\PCKYN.exe.bat OMCQ.exe File created C:\windows\SysWOW64\LSS.exe DMO.exe File created C:\windows\SysWOW64\HYAGHEY.exe.bat XFQHVB.exe File opened for modification C:\windows\SysWOW64\SVV.exe IMTEAGG.exe File opened for modification C:\windows\SysWOW64\AAH.exe SVV.exe File created C:\windows\SysWOW64\PXY.exe OUMA.exe File created C:\windows\SysWOW64\PZKXOEC.exe.bat EUZRCXB.exe File opened for modification C:\windows\SysWOW64\LSS.exe DMO.exe File created C:\windows\SysWOW64\CQWLB.exe.bat ASRRUW.exe File opened for modification C:\windows\SysWOW64\MBTTNFQ.exe YDTH.exe File created C:\windows\SysWOW64\HMJSB.exe.bat MBTTNFQ.exe File opened for modification C:\windows\SysWOW64\NID.exe SKVG.exe File created C:\windows\SysWOW64\IVMU.exe.bat NID.exe File created C:\windows\SysWOW64\MNYWTC.exe.bat XKP.exe File created C:\windows\SysWOW64\OXBJNB.exe WKRRXE.exe File opened for modification C:\windows\SysWOW64\RCTTHH.exe SRJDZTO.exe File opened for modification C:\windows\SysWOW64\OWRB.exe TFI.exe File opened for modification C:\windows\SysWOW64\OXBJNB.exe WKRRXE.exe File created C:\windows\SysWOW64\XQUPJZ.exe MYF.exe File opened for modification C:\windows\SysWOW64\XQUPJZ.exe MYF.exe File created C:\windows\SysWOW64\XQUPJZ.exe.bat MYF.exe File created C:\windows\SysWOW64\KGS.exe.bat GVU.exe File opened for modification C:\windows\SysWOW64\DEXFEOI.exe HTPG.exe File opened for modification C:\windows\SysWOW64\IMTEAGG.exe GZJCPM.exe File opened for modification C:\windows\SysWOW64\CQWLB.exe ASRRUW.exe File opened for modification C:\windows\SysWOW64\CWLXPA.exe BBHTKKT.exe File created C:\windows\SysWOW64\GAFEA.exe OXBJNB.exe File created C:\windows\SysWOW64\GAFEA.exe.bat OXBJNB.exe File opened for modification C:\windows\SysWOW64\TGVUL.exe QYNXEW.exe File created C:\windows\SysWOW64\WRUEHMC.exe.bat RRL.exe File created C:\windows\SysWOW64\DEXFEOI.exe.bat HTPG.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\system\WBW.exe OWRB.exe File created C:\windows\system\MYF.exe SFX.exe File opened for modification C:\windows\system\YQH.exe ZAWEPWW.exe File opened for modification C:\windows\system\SPKR.exe RMGVHN.exe File created C:\windows\system\WYQRZVL.exe SPKR.exe File created C:\windows\system\UNMH.exe.bat AAH.exe File created C:\windows\ZWHHIS.exe DEXFEOI.exe File created C:\windows\system\SFX.exe IIK.exe File opened for modification C:\windows\HXKIBG.exe CXIYYC.exe File created C:\windows\system\ANT.exe MPTI.exe File opened for modification C:\windows\system\XBXB.exe CWLXPA.exe File created C:\windows\DBLGPI.exe.bat IOOW.exe File created C:\windows\system\DOABXID.exe.bat MNYWTC.exe File opened for modification C:\windows\NCVWT.exe RCTTHH.exe File created C:\windows\system\GVU.exe YQH.exe File created C:\windows\ZWHHIS.exe.bat DEXFEOI.exe File created C:\windows\QLLZ.exe.bat BIBVDX.exe File created C:\windows\system\ASRRUW.exe.bat LCQ.exe File created C:\windows\system\WZJENKN.exe XBXB.exe File opened for modification C:\windows\WREFCX.exe DOABXID.exe File opened for modification C:\windows\CMY.exe WRUEHMC.exe File created C:\windows\system\YQH.exe.bat ZAWEPWW.exe File created C:\windows\DMO.exe ZWHHIS.exe File created C:\windows\system\BYYN.exe.bat WYQRZVL.exe File created C:\windows\YDTH.exe UNMH.exe File created C:\windows\system\MYF.exe.bat SFX.exe File created C:\windows\PVO.exe QLLZ.exe File opened for modification C:\windows\system\TFI.exe ANT.exe File created C:\windows\system\DOABXID.exe MNYWTC.exe File created C:\windows\CMY.exe WRUEHMC.exe File opened for modification C:\windows\CXIYYC.exe FWZVU.exe File opened for modification C:\windows\RRL.exe TGVUL.exe File created C:\windows\system\MPTI.exe ECGCM.exe File opened for modification C:\windows\system\DOABXID.exe MNYWTC.exe File opened for modification C:\windows\WKRRXE.exe LROY.exe File opened for modification C:\windows\system\SFX.exe IIK.exe File created C:\windows\system\FWZVU.exe.bat XQUPJZ.exe File created C:\windows\PVO.exe.bat QLLZ.exe File created C:\windows\YWQVI.exe PVO.exe File created C:\windows\system\XFQHVB.exe QZXLG.exe File opened for modification C:\windows\system\BBHTKKT.exe CQWLB.exe File opened for modification C:\windows\REJ.exe WREFCX.exe File opened for modification C:\windows\system\AOMK.exe GAFEA.exe File created C:\windows\SRJDZTO.exe.bat ROSI.exe File created C:\windows\CXIYYC.exe FWZVU.exe File opened for modification C:\windows\PVO.exe QLLZ.exe File created C:\windows\system\OJPOR.exe.bat HYAGHEY.exe File created C:\windows\LCQ.exe HMJSB.exe File created C:\windows\system\JLVNQ.exe.bat PXY.exe File opened for modification C:\windows\system\JHUIR.exe BBCT.exe File created C:\windows\WREFCX.exe.bat DOABXID.exe File opened for modification C:\windows\LROY.exe REJ.exe File created C:\windows\system\AOMK.exe GAFEA.exe File created C:\windows\system\AOMK.exe.bat GAFEA.exe File created C:\windows\system\ASRRUW.exe LCQ.exe File created C:\windows\system\JHUIR.exe BBCT.exe File created C:\windows\NCVWT.exe RCTTHH.exe File created C:\windows\HXKIBG.exe.bat CXIYYC.exe File created C:\windows\ZNCZ.exe CNB.exe File created C:\windows\system\HTPG.exe.bat ZNCZ.exe File created C:\windows\YWQVI.exe.bat PVO.exe File opened for modification C:\windows\CMWVUNK.exe YWQVI.exe File created C:\windows\system\XFQHVB.exe.bat QZXLG.exe File created C:\windows\system\BBHTKKT.exe.bat CQWLB.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2620 cmd.exe 5452 cmd.exe 3388 cmd.exe 4464 cmd.exe 1864 cmd.exe 5592 cmd.exe 404 cmd.exe 4224 cmd.exe 760 cmd.exe 3136 cmd.exe 1964 cmd.exe 1320 cmd.exe 2572 cmd.exe 5576 cmd.exe 5284 cmd.exe 2428 cmd.exe 2700 cmd.exe 5352 cmd.exe 1832 cmd.exe 4756 cmd.exe 3872 cmd.exe 8 cmd.exe 2612 cmd.exe 200 cmd.exe 5724 cmd.exe 1984 cmd.exe 1948 cmd.exe 792 cmd.exe 5960 cmd.exe 2452 cmd.exe 6128 cmd.exe 6032 cmd.exe 4236 cmd.exe 3408 cmd.exe 1740 cmd.exe 2356 cmd.exe 4788 cmd.exe 2456 cmd.exe 6140 cmd.exe 1184 cmd.exe 948 cmd.exe 2400 cmd.exe 3540 cmd.exe 952 cmd.exe 4296 cmd.exe 3144 cmd.exe 1488 cmd.exe 1272 cmd.exe 2868 cmd.exe 3080 cmd.exe 5992 cmd.exe 2568 cmd.exe 5292 cmd.exe 4656 cmd.exe 1296 cmd.exe 4952 cmd.exe 4896 cmd.exe 2108 cmd.exe 3068 cmd.exe 2964 cmd.exe 6028 cmd.exe 1120 cmd.exe 5380 cmd.exe 5036 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 2180 2560 WerFault.exe 88 4300 1812 WerFault.exe 93 1164 408 WerFault.exe 99 2716 5596 WerFault.exe 104 5812 2960 WerFault.exe 109 984 916 WerFault.exe 114 2688 5656 WerFault.exe 119 2208 5808 WerFault.exe 124 2652 4676 WerFault.exe 129 1656 1936 WerFault.exe 134 1344 5972 WerFault.exe 139 5984 2288 WerFault.exe 144 512 1004 WerFault.exe 149 2172 3904 WerFault.exe 153 380 2784 WerFault.exe 159 5764 5412 WerFault.exe 164 4904 840 WerFault.exe 169 5820 3788 WerFault.exe 174 2868 3504 WerFault.exe 179 1864 4384 WerFault.exe 184 1228 2132 WerFault.exe 189 1572 2524 WerFault.exe 194 2820 1236 WerFault.exe 199 1928 52 WerFault.exe 204 628 512 WerFault.exe 209 380 2764 WerFault.exe 214 5580 2716 WerFault.exe 219 4904 2152 WerFault.exe 224 836 4604 WerFault.exe 229 3584 2084 WerFault.exe 234 5088 4880 WerFault.exe 239 3664 5372 WerFault.exe 244 5984 5652 WerFault.exe 249 4592 3276 WerFault.exe 254 5128 3968 WerFault.exe 259 1948 1932 WerFault.exe 264 5620 1424 WerFault.exe 270 5692 6064 WerFault.exe 275 4492 5740 WerFault.exe 280 5536 3480 WerFault.exe 285 4944 3360 WerFault.exe 289 5648 4972 WerFault.exe 295 1788 5940 WerFault.exe 300 1764 2712 WerFault.exe 305 5128 4268 WerFault.exe 310 2352 1288 WerFault.exe 315 1364 2728 WerFault.exe 320 3944 3688 WerFault.exe 325 2336 4552 WerFault.exe 330 4648 4232 WerFault.exe 335 4216 1400 WerFault.exe 340 2528 5392 WerFault.exe 345 4716 4204 WerFault.exe 350 3796 2640 WerFault.exe 355 720 1844 WerFault.exe 360 5788 3728 WerFault.exe 365 704 944 WerFault.exe 370 2684 904 WerFault.exe 375 1808 2688 WerFault.exe 380 3824 3588 WerFault.exe 385 4216 5272 WerFault.exe 390 4528 4824 WerFault.exe 395 3172 4860 WerFault.exe 400 2428 4732 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WBW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SKVG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GVU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NID.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SPKR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WREFCX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IIK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BBHTKKT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BIBVDX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XBXB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GZJCPM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NCVWT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AWWMWF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OWRB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PZKXOEC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WYQRZVL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_43b921009f83e005dc329f7c9f9cf3af_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JHUIR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XKP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TFI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QYNXEW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HTPG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QLLZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MBTTNFQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MNYWTC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DEXFEOI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PXY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JLVNQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IVMU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KGS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XFQHVB.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2560 2026-08-09_43b921009f83e005dc329f7c9f9cf3af_elex_emotet_stop.exe 2560 2026-08-09_43b921009f83e005dc329f7c9f9cf3af_elex_emotet_stop.exe 1812 QZXLG.exe 1812 QZXLG.exe 408 XFQHVB.exe 408 XFQHVB.exe 5596 HYAGHEY.exe 5596 HYAGHEY.exe 2960 OJPOR.exe 2960 OJPOR.exe 916 AWWMWF.exe 916 AWWMWF.exe 5656 ECGCM.exe 5656 ECGCM.exe 5808 MPTI.exe 5808 MPTI.exe 4676 ANT.exe 4676 ANT.exe 1936 TFI.exe 1936 TFI.exe 5972 OWRB.exe 5972 OWRB.exe 2288 WBW.exe 2288 WBW.exe 1004 GZJCPM.exe 1004 GZJCPM.exe 3904 IMTEAGG.exe 3904 IMTEAGG.exe 2784 SVV.exe 2784 SVV.exe 5412 AAH.exe 5412 AAH.exe 840 UNMH.exe 840 UNMH.exe 3788 YDTH.exe 3788 YDTH.exe 3504 MBTTNFQ.exe 3504 MBTTNFQ.exe 4384 HMJSB.exe 4384 HMJSB.exe 2132 LCQ.exe 2132 LCQ.exe 2524 ASRRUW.exe 2524 ASRRUW.exe 1236 CQWLB.exe 1236 CQWLB.exe 52 BBHTKKT.exe 52 BBHTKKT.exe 512 CWLXPA.exe 512 CWLXPA.exe 2764 XBXB.exe 2764 XBXB.exe 2716 WZJENKN.exe 2716 WZJENKN.exe 2152 OUMA.exe 2152 OUMA.exe 4604 PXY.exe 4604 PXY.exe 2084 JLVNQ.exe 2084 JLVNQ.exe 4880 EYAWBQB.exe 4880 EYAWBQB.exe 5372 IOOW.exe 5372 IOOW.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2560 2026-08-09_43b921009f83e005dc329f7c9f9cf3af_elex_emotet_stop.exe 2560 2026-08-09_43b921009f83e005dc329f7c9f9cf3af_elex_emotet_stop.exe 1812 QZXLG.exe 1812 QZXLG.exe 408 XFQHVB.exe 408 XFQHVB.exe 5596 HYAGHEY.exe 5596 HYAGHEY.exe 2960 OJPOR.exe 2960 OJPOR.exe 916 AWWMWF.exe 916 AWWMWF.exe 5656 ECGCM.exe 5656 ECGCM.exe 5808 MPTI.exe 5808 MPTI.exe 4676 ANT.exe 4676 ANT.exe 1936 TFI.exe 1936 TFI.exe 5972 OWRB.exe 5972 OWRB.exe 2288 WBW.exe 2288 WBW.exe 1004 GZJCPM.exe 1004 GZJCPM.exe 3904 IMTEAGG.exe 3904 IMTEAGG.exe 2784 SVV.exe 2784 SVV.exe 5412 AAH.exe 5412 AAH.exe 840 UNMH.exe 840 UNMH.exe 3788 YDTH.exe 3788 YDTH.exe 3504 MBTTNFQ.exe 3504 MBTTNFQ.exe 4384 HMJSB.exe 4384 HMJSB.exe 2132 LCQ.exe 2132 LCQ.exe 2524 ASRRUW.exe 2524 ASRRUW.exe 1236 CQWLB.exe 1236 CQWLB.exe 52 BBHTKKT.exe 52 BBHTKKT.exe 512 CWLXPA.exe 512 CWLXPA.exe 2764 XBXB.exe 2764 XBXB.exe 2716 WZJENKN.exe 2716 WZJENKN.exe 2152 OUMA.exe 2152 OUMA.exe 4604 PXY.exe 4604 PXY.exe 2084 JLVNQ.exe 2084 JLVNQ.exe 4880 EYAWBQB.exe 4880 EYAWBQB.exe 5372 IOOW.exe 5372 IOOW.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2560 wrote to memory of 760 2560 2026-08-09_43b921009f83e005dc329f7c9f9cf3af_elex_emotet_stop.exe 89 PID 760 wrote to memory of 1812 760 cmd.exe 93 PID 1812 wrote to memory of 1488 1812 QZXLG.exe 95 PID 1488 wrote to memory of 408 1488 cmd.exe 99 PID 408 wrote to memory of 4304 408 XFQHVB.exe 100 PID 4304 wrote to memory of 5596 4304 cmd.exe 104 PID 5596 wrote to memory of 4644 5596 HYAGHEY.exe 105 PID 4644 wrote to memory of 2960 4644 cmd.exe 109 PID 2960 wrote to memory of 4756 2960 OJPOR.exe 110 PID 4756 wrote to memory of 916 4756 cmd.exe 114 PID 916 wrote to memory of 5020 916 AWWMWF.exe 115 PID 5020 wrote to memory of 5656 5020 cmd.exe 119 PID 5656 wrote to memory of 940 5656 ECGCM.exe 120 PID 940 wrote to memory of 5808 940 cmd.exe 124 PID 5808 wrote to memory of 5728 5808 MPTI.exe 125 PID 5728 wrote to memory of 4676 5728 cmd.exe 129 PID 4676 wrote to memory of 1484 4676 ANT.exe 130 PID 1484 wrote to memory of 1936 1484 cmd.exe 134 PID 1936 wrote to memory of 3116 1936 TFI.exe 135 PID 3116 wrote to memory of 5972 3116 cmd.exe 139 PID 5972 wrote to memory of 3736 5972 OWRB.exe 140 PID 3736 wrote to memory of 2288 3736 cmd.exe 144 PID 2288 wrote to memory of 5552 2288 WBW.exe 145 PID 5552 wrote to memory of 1004 5552 cmd.exe 149 PID 1004 wrote to memory of 3144 1004 GZJCPM.exe 150 PID 3144 wrote to memory of 3904 3144 cmd.exe 153 PID 3904 wrote to memory of 4108 3904 IMTEAGG.exe 155 PID 4108 wrote to memory of 2784 4108 cmd.exe 159 PID 2784 wrote to memory of 3340 2784 SVV.exe 160 PID 3340 wrote to memory of 5412 3340 cmd.exe 164 PID 5412 wrote to memory of 4360 5412 AAH.exe 165 PID 4360 wrote to memory of 840 4360 cmd.exe 169 PID 840 wrote to memory of 5524 840 UNMH.exe 170 PID 5524 wrote to memory of 3788 5524 cmd.exe 174 PID 3788 wrote to memory of 3800 3788 YDTH.exe 175 PID 3800 wrote to memory of 3504 3800 cmd.exe 179 PID 3504 wrote to memory of 4480 3504 MBTTNFQ.exe 180 PID 4480 wrote to memory of 4384 4480 cmd.exe 184 PID 4384 wrote to memory of 2208 4384 HMJSB.exe 185 PID 2208 wrote to memory of 2132 2208 cmd.exe 189 PID 2132 wrote to memory of 2800 2132 LCQ.exe 190 PID 2800 wrote to memory of 2524 2800 cmd.exe 194 PID 2524 wrote to memory of 3068 2524 ASRRUW.exe 195 PID 3068 wrote to memory of 1236 3068 cmd.exe 199 PID 1236 wrote to memory of 4616 1236 CQWLB.exe 200 PID 4616 wrote to memory of 52 4616 cmd.exe 204 PID 52 wrote to memory of 5340 52 BBHTKKT.exe 205 PID 5340 wrote to memory of 512 5340 cmd.exe 209 PID 512 wrote to memory of 5344 512 CWLXPA.exe 210 PID 5344 wrote to memory of 2764 5344 cmd.exe 214 PID 2764 wrote to memory of 2148 2764 XBXB.exe 215 PID 2148 wrote to memory of 2716 2148 cmd.exe 219 PID 2716 wrote to memory of 2076 2716 WZJENKN.exe 220 PID 2076 wrote to memory of 2152 2076 cmd.exe 224 PID 2152 wrote to memory of 2952 2152 OUMA.exe 225 PID 2952 wrote to memory of 4604 2952 cmd.exe 229 PID 4604 wrote to memory of 5860 4604 PXY.exe 230 PID 5860 wrote to memory of 2084 5860 cmd.exe 234 PID 2084 wrote to memory of 2700 2084 JLVNQ.exe 235 PID 2700 wrote to memory of 4880 2700 cmd.exe 239 PID 4880 wrote to memory of 1940 4880 EYAWBQB.exe 240 PID 1940 wrote to memory of 5372 1940 cmd.exe 244 PID 5372 wrote to memory of 4132 5372 IOOW.exe 245 PID 4132 wrote to memory of 5652 4132 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_43b921009f83e005dc329f7c9f9cf3af_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_43b921009f83e005dc329f7c9f9cf3af_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QZXLG.exe.bat" "2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:760 -
C:\windows\SysWOW64\QZXLG.exeC:\windows\system32\QZXLG.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XFQHVB.exe.bat" "4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\windows\system\XFQHVB.exeC:\windows\system\XFQHVB.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HYAGHEY.exe.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\windows\SysWOW64\HYAGHEY.exeC:\windows\system32\HYAGHEY.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OJPOR.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\windows\system\OJPOR.exeC:\windows\system\OJPOR.exe9⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AWWMWF.exe.bat" "10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\windows\AWWMWF.exeC:\windows\AWWMWF.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ECGCM.exe.bat" "12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\windows\system\ECGCM.exeC:\windows\system\ECGCM.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5656 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MPTI.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:940 -
C:\windows\system\MPTI.exeC:\windows\system\MPTI.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ANT.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:5728 -
C:\windows\system\ANT.exeC:\windows\system\ANT.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TFI.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\windows\system\TFI.exeC:\windows\system\TFI.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OWRB.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\windows\SysWOW64\OWRB.exeC:\windows\system32\OWRB.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WBW.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:3736 -
C:\windows\system\WBW.exeC:\windows\system\WBW.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GZJCPM.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:5552 -
C:\windows\GZJCPM.exeC:\windows\GZJCPM.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IMTEAGG.exe.bat" "26⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\windows\SysWOW64\IMTEAGG.exeC:\windows\system32\IMTEAGG.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SVV.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\windows\SysWOW64\SVV.exeC:\windows\system32\SVV.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AAH.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\windows\SysWOW64\AAH.exeC:\windows\system32\AAH.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UNMH.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\windows\system\UNMH.exeC:\windows\system\UNMH.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YDTH.exe.bat" "34⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5524 -
C:\windows\YDTH.exeC:\windows\YDTH.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MBTTNFQ.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:3800 -
C:\windows\SysWOW64\MBTTNFQ.exeC:\windows\system32\MBTTNFQ.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HMJSB.exe.bat" "38⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\windows\SysWOW64\HMJSB.exeC:\windows\system32\HMJSB.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LCQ.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\windows\LCQ.exeC:\windows\LCQ.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ASRRUW.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\windows\system\ASRRUW.exeC:\windows\system\ASRRUW.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CQWLB.exe.bat" "44⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\windows\SysWOW64\CQWLB.exeC:\windows\system32\CQWLB.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BBHTKKT.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\windows\system\BBHTKKT.exeC:\windows\system\BBHTKKT.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:52 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CWLXPA.exe.bat" "48⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5340 -
C:\windows\SysWOW64\CWLXPA.exeC:\windows\system32\CWLXPA.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XBXB.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:5344 -
C:\windows\system\XBXB.exeC:\windows\system\XBXB.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WZJENKN.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\windows\system\WZJENKN.exeC:\windows\system\WZJENKN.exe53⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OUMA.exe.bat" "54⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\windows\system\OUMA.exeC:\windows\system\OUMA.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PXY.exe.bat" "56⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\windows\SysWOW64\PXY.exeC:\windows\system32\PXY.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JLVNQ.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:5860 -
C:\windows\system\JLVNQ.exeC:\windows\system\JLVNQ.exe59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EYAWBQB.exe.bat" "60⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\windows\system\EYAWBQB.exeC:\windows\system\EYAWBQB.exe61⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IOOW.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\windows\IOOW.exeC:\windows\IOOW.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5372 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DBLGPI.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\windows\DBLGPI.exeC:\windows\DBLGPI.exe65⤵
- Executes dropped EXE
PID:5652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DHLURV.exe.bat" "66⤵
- Executes a command shell one-liner
PID:2356 -
C:\windows\DHLURV.exeC:\windows\DHLURV.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3276 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SKVG.exe.bat" "68⤵
- Executes a command shell one-liner
PID:1184 -
C:\windows\SysWOW64\SKVG.exeC:\windows\system32\SKVG.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NID.exe.bat" "70⤵
- System Location Discovery: System Language Discovery
PID:2060 -
C:\windows\SysWOW64\NID.exeC:\windows\system32\NID.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IVMU.exe.bat" "72⤵PID:1312
-
C:\windows\SysWOW64\IVMU.exeC:\windows\system32\IVMU.exe73⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZDOZI.exe.bat" "74⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3872 -
C:\windows\ZDOZI.exeC:\windows\ZDOZI.exe75⤵
- Executes dropped EXE
PID:6064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BBCT.exe.bat" "76⤵PID:2072
-
C:\windows\system\BBCT.exeC:\windows\system\BBCT.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JHUIR.exe.bat" "78⤵
- System Location Discovery: System Language Discovery
PID:2968 -
C:\windows\system\JHUIR.exeC:\windows\system\JHUIR.exe79⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EUZRCXB.exe.bat" "80⤵
- System Location Discovery: System Language Discovery
PID:4852 -
C:\windows\EUZRCXB.exeC:\windows\EUZRCXB.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PZKXOEC.exe.bat" "82⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5352 -
C:\windows\SysWOW64\PZKXOEC.exeC:\windows\system32\PZKXOEC.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EPLOVZ.exe.bat" "84⤵
- System Location Discovery: System Language Discovery
PID:4740 -
C:\windows\SysWOW64\EPLOVZ.exeC:\windows\system32\EPLOVZ.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XKP.exe.bat" "86⤵PID:1344
-
C:\windows\SysWOW64\XKP.exeC:\windows\system32\XKP.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MNYWTC.exe.bat" "88⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5992 -
C:\windows\SysWOW64\MNYWTC.exeC:\windows\system32\MNYWTC.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DOABXID.exe.bat" "90⤵PID:5868
-
C:\windows\system\DOABXID.exeC:\windows\system\DOABXID.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1288 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WREFCX.exe.bat" "92⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2964 -
C:\windows\WREFCX.exeC:\windows\WREFCX.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2728 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\REJ.exe.bat" "94⤵
- Executes a command shell one-liner
PID:8 -
C:\windows\REJ.exeC:\windows\REJ.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LROY.exe.bat" "96⤵
- System Location Discovery: System Language Discovery
PID:2824 -
C:\windows\LROY.exeC:\windows\LROY.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WKRRXE.exe.bat" "98⤵PID:3448
-
C:\windows\WKRRXE.exeC:\windows\WKRRXE.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4232 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OXBJNB.exe.bat" "100⤵PID:2732
-
C:\windows\SysWOW64\OXBJNB.exeC:\windows\system32\OXBJNB.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GAFEA.exe.bat" "102⤵PID:4696
-
C:\windows\SysWOW64\GAFEA.exeC:\windows\system32\GAFEA.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AOMK.exe.bat" "104⤵PID:4624
-
C:\windows\system\AOMK.exeC:\windows\system\AOMK.exe105⤵
- Executes dropped EXE
PID:4204 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ROSI.exe.bat" "106⤵PID:3288
-
C:\windows\system\ROSI.exeC:\windows\system\ROSI.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SRJDZTO.exe.bat" "108⤵
- System Location Discovery: System Language Discovery
PID:1976 -
C:\windows\SRJDZTO.exeC:\windows\SRJDZTO.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RCTTHH.exe.bat" "110⤵
- Executes a command shell one-liner
PID:2612 -
C:\windows\SysWOW64\RCTTHH.exeC:\windows\system32\RCTTHH.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3728 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NCVWT.exe.bat" "112⤵PID:2352
-
C:\windows\NCVWT.exeC:\windows\NCVWT.exe113⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QYNXEW.exe.bat" "114⤵
- System Location Discovery: System Language Discovery
PID:3396 -
C:\windows\QYNXEW.exeC:\windows\QYNXEW.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TGVUL.exe.bat" "116⤵PID:1056
-
C:\windows\SysWOW64\TGVUL.exeC:\windows\system32\TGVUL.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RRL.exe.bat" "118⤵
- System Location Discovery: System Language Discovery
PID:5692 -
C:\windows\RRL.exeC:\windows\RRL.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3588 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WRUEHMC.exe.bat" "120⤵PID:424
-
C:\windows\SysWOW64\WRUEHMC.exeC:\windows\system32\WRUEHMC.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5272
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-