Analysis
- max time kernel
86s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/08/2026, 20:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-09_1c3f599912cb3f1959d6eb95393a101e_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-09_1c3f599912cb3f1959d6eb95393a101e_elex_emotet_stop.exe
- Size 208KB
- Sample260809-yspppax1g1
- SHA256 b11d3088e198ba0b99ddc1c741590aecdba83043363004e58dbc31072fbf372e
- MD5 1c3f599912cb3f1959d6eb95393a101e
- SHA1 da5f706ef01a6a1791dc668b6868f992b8381755
- SHA512 43aeff33e8444323f84f3b309d949d3cbddc6a63dfeefd95896b05b434bae25686b58bee89a61c930b3f70ade81065fdfd734acb558f1194e5f6cde4be78df82
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbclcdL+LOfJ4NLthEjQT6j:MlZtbLWIgd1LZ9oECZbclc5+LOxQEj1
- TLSH T11B247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5036 OJPOR.exe 4880 IRESCLQ.exe 4032 UHTSO.exe 3092 WFZM.exe 5892 EKLT.exe 5724 XDTE.exe 2328 WWD.exe 1544 YTJOF.exe 4316 RHIMKB.exe 5740 LZYX.exe 1132 WSNI.exe 2104 RQN.exe 5900 KTRXBE.exe 4412 IRCSO.exe 3236 NUI.exe 1792 LJTQII.exe 1044 FXSON.exe 6080 SIJNU.exe 2432 ANNU.exe 4852 PDWLLO.exe 2072 RBCFS.exe 2900 JJQLFO.exe 2648 THWXU.exe 2784 WPDFHGW.exe 3580 XSHB.exe 5564 SFLKWW.exe 944 OGVUAAV.exe 6008 NRYKJG.exe 5776 ACOB.exe 2516 MKVJJJB.exe 4116 WSX.exe 4984 QFUYX.exe 4444 UVIYBZN.exe 4328 FOD.exe 4836 LOLET.exe 264 ZMTQ.exe 2500 LCAYHE.exe 2632 PKGYTX.exe 2264 NFGZYAF.exe 2816 CAPL.exe 4416 WOUUTM.exe 1260 ZBZ.exe 4972 UWDNN.exe 3856 YEKNSEC.exe 5140 CHIIZ.exe 5364 GXPIMQS.exe 2808 KFVQQ.exe 828 ZVW.exe 4768 OQGUIQ.exe 3408 WESBSP.exe 3312 AMZ.exe 6088 PCAALUK.exe 6004 HKC.exe 5452 FLKTY.exe 2600 FOOXLKX.exe 868 UJXBW.exe 860 NEJX.exe 4284 VRBL.exe 1540 KMKYWUL.exe 720 FAPH.exe 4100 YDTDMK.exe 2348 SQY.exe 3600 NDDEY.exe 108 EMF.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\UWDNN.exe.bat ZBZ.exe File created C:\windows\SysWOW64\NEJX.exe UJXBW.exe File created C:\windows\SysWOW64\NEJX.exe.bat UJXBW.exe File created C:\windows\SysWOW64\YDTDMK.exe.bat FAPH.exe File opened for modification C:\windows\SysWOW64\LHMTNU.exe DTHMDO.exe File created C:\windows\SysWOW64\LHMTNU.exe.bat DTHMDO.exe File created C:\windows\SysWOW64\BWDC.exe.bat MGCLUW.exe File opened for modification C:\windows\SysWOW64\FOOXLKX.exe FLKTY.exe File created C:\windows\SysWOW64\YTJOF.exe WWD.exe File created C:\windows\SysWOW64\RBCFS.exe.bat PDWLLO.exe File created C:\windows\SysWOW64\ACOB.exe NRYKJG.exe File opened for modification C:\windows\SysWOW64\KFVQQ.exe GXPIMQS.exe File created C:\windows\SysWOW64\SQY.exe YDTDMK.exe File opened for modification C:\windows\SysWOW64\KGAOYM.exe QNTDO.exe File opened for modification C:\windows\SysWOW64\HQT.exe XQRFDFY.exe File created C:\windows\SysWOW64\XDTE.exe.bat EKLT.exe File created C:\windows\SysWOW64\IRCSO.exe.bat KTRXBE.exe File opened for modification C:\windows\SysWOW64\WSX.exe MKVJJJB.exe File opened for modification C:\windows\SysWOW64\CVF.exe LUDZJGN.exe File created C:\windows\SysWOW64\VALANWA.exe UXZFZ.exe File opened for modification C:\windows\SysWOW64\VALANWA.exe UXZFZ.exe File opened for modification C:\windows\SysWOW64\BWDC.exe MGCLUW.exe File created C:\windows\SysWOW64\RBCFS.exe PDWLLO.exe File opened for modification C:\windows\SysWOW64\YTJOF.exe WWD.exe File created C:\windows\SysWOW64\XSHB.exe.bat WPDFHGW.exe File created C:\windows\SysWOW64\PCAALUK.exe.bat AMZ.exe File opened for modification C:\windows\SysWOW64\EMF.exe NDDEY.exe File created C:\windows\SysWOW64\EMF.exe.bat NDDEY.exe File created C:\windows\SysWOW64\BMB.exe XPIEP.exe File created C:\windows\SysWOW64\CVF.exe.bat LUDZJGN.exe File created C:\windows\SysWOW64\CHIIZ.exe.bat YEKNSEC.exe File created C:\windows\SysWOW64\FAPH.exe KMKYWUL.exe File created C:\windows\SysWOW64\YDTDMK.exe FAPH.exe File opened for modification C:\windows\SysWOW64\IUBQTO.exe JUNLGX.exe File created C:\windows\SysWOW64\IUBQTO.exe.bat JUNLGX.exe File created C:\windows\SysWOW64\HQT.exe XQRFDFY.exe File created C:\windows\SysWOW64\VEGEB.exe ROZEOT.exe File opened for modification C:\windows\SysWOW64\MGCLUW.exe HANUYUH.exe File created C:\windows\SysWOW64\WSX.exe.bat MKVJJJB.exe File created C:\windows\SysWOW64\JJQLFO.exe.bat RBCFS.exe File opened for modification C:\windows\SysWOW64\WESBSP.exe OQGUIQ.exe File created C:\windows\SysWOW64\FOOXLKX.exe FLKTY.exe File created C:\windows\SysWOW64\MGCLUW.exe.bat HANUYUH.exe File created C:\windows\SysWOW64\BWDC.exe MGCLUW.exe File created C:\windows\SysWOW64\PDWLLO.exe.bat ANNU.exe File created C:\windows\SysWOW64\ACOB.exe.bat NRYKJG.exe File created C:\windows\SysWOW64\WSX.exe MKVJJJB.exe File opened for modification C:\windows\SysWOW64\ZMTQ.exe LOLET.exe File created C:\windows\SysWOW64\HKC.exe PCAALUK.exe File created C:\windows\SysWOW64\EMF.exe NDDEY.exe File created C:\windows\SysWOW64\MGCLUW.exe HANUYUH.exe File created C:\windows\SysWOW64\IRCSO.exe KTRXBE.exe File opened for modification C:\windows\SysWOW64\CHIIZ.exe YEKNSEC.exe File opened for modification C:\windows\SysWOW64\PCAALUK.exe AMZ.exe File created C:\windows\SysWOW64\VEGEB.exe.bat ROZEOT.exe File opened for modification C:\windows\SysWOW64\XSHB.exe WPDFHGW.exe File opened for modification C:\windows\SysWOW64\NEJX.exe UJXBW.exe File opened for modification C:\windows\SysWOW64\SQY.exe YDTDMK.exe File created C:\windows\SysWOW64\KGAOYM.exe.bat QNTDO.exe File created C:\windows\SysWOW64\FNIKV.exe GPPPAPL.exe File created C:\windows\SysWOW64\ZMTQ.exe LOLET.exe File opened for modification C:\windows\SysWOW64\IRCSO.exe KTRXBE.exe File opened for modification C:\windows\SysWOW64\ACOB.exe NRYKJG.exe File created C:\windows\SysWOW64\PCAALUK.exe AMZ.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\NFKXFMY.exe XPJF.exe File created C:\windows\system\RRC.exe.bat AMSQU.exe File created C:\windows\RHIMKB.exe.bat YTJOF.exe File opened for modification C:\windows\WPDFHGW.exe THWXU.exe File opened for modification C:\windows\MKVJJJB.exe ACOB.exe File created C:\windows\KMKYWUL.exe.bat VRBL.exe File opened for modification C:\windows\DLNO.exe TDT.exe File created C:\windows\system\DUS.exe FEFMXQ.exe File created C:\windows\BEM.exe.bat EOZCSDT.exe File created C:\windows\system\AMSQU.exe LHMTNU.exe File opened for modification C:\windows\LZYX.exe RHIMKB.exe File created C:\windows\system\RQN.exe.bat WSNI.exe File created C:\windows\KTRXBE.exe RQN.exe File created C:\windows\LJTQII.exe NUI.exe File created C:\windows\NRYKJG.exe.bat OGVUAAV.exe File opened for modification C:\windows\system\RRC.exe AMSQU.exe File created C:\windows\system\ICO.exe VEGEB.exe File created C:\windows\system\ICO.exe.bat VEGEB.exe File opened for modification C:\windows\system\WFZM.exe UHTSO.exe File created C:\windows\system\FOD.exe UVIYBZN.exe File created C:\windows\PKGYTX.exe LCAYHE.exe File created C:\windows\PBJWML.exe.bat SJZTI.exe File created C:\windows\OQGUIQ.exe.bat ZVW.exe File created C:\windows\system\UXZFZ.exe.bat HZZTXUP.exe File created C:\windows\SJZTI.exe RGV.exe File created C:\windows\PBJWML.exe SJZTI.exe File created C:\windows\system\GPPPAPL.exe.bat PEM.exe File created C:\windows\FXSON.exe LJTQII.exe File created C:\windows\PKGYTX.exe.bat LCAYHE.exe File created C:\windows\system\AMZ.exe.bat WESBSP.exe File opened for modification C:\windows\KMKYWUL.exe VRBL.exe File opened for modification C:\windows\THWXU.exe JJQLFO.exe File created C:\windows\system\UVIYBZN.exe.bat QFUYX.exe File opened for modification C:\windows\LOLET.exe FOD.exe File opened for modification C:\windows\NFGZYAF.exe PKGYTX.exe File opened for modification C:\windows\TDT.exe CVF.exe File created C:\windows\system\IIGXEV.exe IUBQTO.exe File opened for modification C:\windows\HZZTXUP.exe ICO.exe File created C:\windows\SJZTI.exe.bat RGV.exe File opened for modification C:\windows\FXSON.exe LJTQII.exe File created C:\windows\WPDFHGW.exe.bat THWXU.exe File created C:\windows\system\HANUYUH.exe FNIKV.exe File opened for modification C:\windows\ZVW.exe KFVQQ.exe File created C:\windows\KMKYWUL.exe VRBL.exe File created C:\windows\JUNLGX.exe.bat BEM.exe File opened for modification C:\windows\system\XQRFDFY.exe EXCUMEQ.exe File created C:\windows\system\EKLT.exe WFZM.exe File created C:\windows\system\RQN.exe WSNI.exe File created C:\windows\NUI.exe.bat IRCSO.exe File opened for modification C:\windows\LJTQII.exe NUI.exe File created C:\windows\SIJNU.exe FXSON.exe File created C:\windows\system\OGVUAAV.exe.bat SFLKWW.exe File created C:\windows\LOLET.exe.bat FOD.exe File created C:\windows\system\YEKNSEC.exe UWDNN.exe File opened for modification C:\windows\RHIMKB.exe YTJOF.exe File opened for modification C:\windows\system\OGVUAAV.exe SFLKWW.exe File created C:\windows\NFGZYAF.exe.bat PKGYTX.exe File created C:\windows\ZVW.exe.bat KFVQQ.exe File opened for modification C:\windows\UJXBW.exe FOOXLKX.exe File opened for modification C:\windows\system\NDDEY.exe SQY.exe File created C:\windows\system\NDDEY.exe.bat SQY.exe File created C:\windows\system\LUDZJGN.exe BMB.exe File opened for modification C:\windows\system\EKLT.exe WFZM.exe File created C:\windows\system\WWD.exe XDTE.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 912 cmd.exe 2860 cmd.exe 5468 cmd.exe 5844 cmd.exe 3716 cmd.exe 4844 cmd.exe 4296 cmd.exe 2040 cmd.exe 1516 cmd.exe 5040 cmd.exe 2276 cmd.exe 2356 cmd.exe 3488 cmd.exe 3412 cmd.exe 3592 cmd.exe 1128 cmd.exe 5160 cmd.exe 5356 cmd.exe 5752 cmd.exe 4740 cmd.exe 3512 cmd.exe 756 cmd.exe 3848 cmd.exe 3496 cmd.exe 364 cmd.exe 5436 cmd.exe 5104 cmd.exe 6064 cmd.exe 4640 cmd.exe 716 cmd.exe 1976 cmd.exe 5448 cmd.exe 52 cmd.exe 5096 cmd.exe 1328 cmd.exe 1636 cmd.exe 5688 cmd.exe 2580 cmd.exe 1796 cmd.exe 4512 cmd.exe 6120 cmd.exe 1340 cmd.exe 4564 cmd.exe 4200 cmd.exe 4932 cmd.exe 1356 cmd.exe 1496 cmd.exe 4404 cmd.exe 5700 cmd.exe 3528 cmd.exe 4916 cmd.exe 5088 cmd.exe 1108 cmd.exe 4560 cmd.exe 4308 cmd.exe 1344 cmd.exe 5064 cmd.exe 1256 cmd.exe 6124 cmd.exe 4372 cmd.exe 5240 cmd.exe 4764 cmd.exe 4928 cmd.exe 3364 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 4544 4644 WerFault.exe 87 5592 5036 WerFault.exe 93 5536 4880 WerFault.exe 99 3792 4032 WerFault.exe 104 480 3092 WerFault.exe 109 4152 5892 WerFault.exe 114 5560 5724 WerFault.exe 119 1268 2328 WerFault.exe 124 4100 1544 WerFault.exe 129 4308 4316 WerFault.exe 134 3652 5740 WerFault.exe 139 4216 1132 WerFault.exe 144 5932 2104 WerFault.exe 149 2676 5900 WerFault.exe 154 828 4412 WerFault.exe 159 5748 3236 WerFault.exe 164 2632 1792 WerFault.exe 169 5224 1044 WerFault.exe 174 2504 6080 WerFault.exe 179 5472 2432 WerFault.exe 184 5096 4852 WerFault.exe 189 4588 2072 WerFault.exe 194 5484 2900 WerFault.exe 199 4904 2648 WerFault.exe 204 6024 2784 WerFault.exe 209 408 3580 WerFault.exe 214 3792 5564 WerFault.exe 219 4888 944 WerFault.exe 224 2264 6008 WerFault.exe 229 1304 5776 WerFault.exe 234 720 2516 WerFault.exe 239 1260 4116 WerFault.exe 244 4588 4984 WerFault.exe 249 1440 4444 WerFault.exe 254 4336 4328 WerFault.exe 259 1112 4836 WerFault.exe 264 3800 264 WerFault.exe 269 4476 2500 WerFault.exe 274 1612 2632 WerFault.exe 279 2636 2264 WerFault.exe 284 3512 2816 WerFault.exe 289 1664 4416 WerFault.exe 294 2788 1260 WerFault.exe 299 3216 4972 WerFault.exe 304 3168 3856 WerFault.exe 309 4752 5140 WerFault.exe 314 3896 5364 WerFault.exe 319 4304 2808 WerFault.exe 324 5624 828 WerFault.exe 329 1304 4768 WerFault.exe 334 2568 3408 WerFault.exe 339 6092 3312 WerFault.exe 344 5100 6088 WerFault.exe 349 4928 6004 WerFault.exe 354 4200 5452 WerFault.exe 359 236 2600 WerFault.exe 364 128 868 WerFault.exe 369 6072 860 WerFault.exe 374 1428 4284 WerFault.exe 379 5984 1540 WerFault.exe 384 2248 720 WerFault.exe 389 4784 4100 WerFault.exe 394 2604 2348 WerFault.exe 399 5948 3600 WerFault.exe 404 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZBZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FAPH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BMB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KGAOYM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NUI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NFGZYAF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CAPL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HKC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UXZFZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UWDNN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UJXBW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YDTDMK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EMF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RQN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PDWLLO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MKVJJJB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LJTQII.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LOLET.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FOOXLKX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OGVUAAV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WESBSP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QNTDO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXCUMEQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PEM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WFZM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KTRXBE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SIJNU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XPIEP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FOD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PKGYTX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DLNO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EKLT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XDTE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JJQLFO.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4644 2026-08-09_1c3f599912cb3f1959d6eb95393a101e_elex_emotet_stop.exe 4644 2026-08-09_1c3f599912cb3f1959d6eb95393a101e_elex_emotet_stop.exe 5036 OJPOR.exe 5036 OJPOR.exe 4880 IRESCLQ.exe 4880 IRESCLQ.exe 4032 UHTSO.exe 4032 UHTSO.exe 3092 WFZM.exe 3092 WFZM.exe 5892 EKLT.exe 5892 EKLT.exe 5724 XDTE.exe 5724 XDTE.exe 2328 WWD.exe 2328 WWD.exe 1544 YTJOF.exe 1544 YTJOF.exe 4316 RHIMKB.exe 4316 RHIMKB.exe 5740 LZYX.exe 5740 LZYX.exe 1132 WSNI.exe 1132 WSNI.exe 2104 RQN.exe 2104 RQN.exe 5900 KTRXBE.exe 5900 KTRXBE.exe 4412 IRCSO.exe 4412 IRCSO.exe 3236 NUI.exe 3236 NUI.exe 1792 LJTQII.exe 1792 LJTQII.exe 1044 FXSON.exe 1044 FXSON.exe 6080 SIJNU.exe 6080 SIJNU.exe 2432 ANNU.exe 2432 ANNU.exe 4852 PDWLLO.exe 4852 PDWLLO.exe 2072 RBCFS.exe 2072 RBCFS.exe 2900 JJQLFO.exe 2900 JJQLFO.exe 2648 THWXU.exe 2648 THWXU.exe 2784 WPDFHGW.exe 2784 WPDFHGW.exe 3580 XSHB.exe 3580 XSHB.exe 5564 SFLKWW.exe 5564 SFLKWW.exe 944 OGVUAAV.exe 944 OGVUAAV.exe 6008 NRYKJG.exe 6008 NRYKJG.exe 5776 ACOB.exe 5776 ACOB.exe 2516 MKVJJJB.exe 2516 MKVJJJB.exe 4116 WSX.exe 4116 WSX.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4644 2026-08-09_1c3f599912cb3f1959d6eb95393a101e_elex_emotet_stop.exe 4644 2026-08-09_1c3f599912cb3f1959d6eb95393a101e_elex_emotet_stop.exe 5036 OJPOR.exe 5036 OJPOR.exe 4880 IRESCLQ.exe 4880 IRESCLQ.exe 4032 UHTSO.exe 4032 UHTSO.exe 3092 WFZM.exe 3092 WFZM.exe 5892 EKLT.exe 5892 EKLT.exe 5724 XDTE.exe 5724 XDTE.exe 2328 WWD.exe 2328 WWD.exe 1544 YTJOF.exe 1544 YTJOF.exe 4316 RHIMKB.exe 4316 RHIMKB.exe 5740 LZYX.exe 5740 LZYX.exe 1132 WSNI.exe 1132 WSNI.exe 2104 RQN.exe 2104 RQN.exe 5900 KTRXBE.exe 5900 KTRXBE.exe 4412 IRCSO.exe 4412 IRCSO.exe 3236 NUI.exe 3236 NUI.exe 1792 LJTQII.exe 1792 LJTQII.exe 1044 FXSON.exe 1044 FXSON.exe 6080 SIJNU.exe 6080 SIJNU.exe 2432 ANNU.exe 2432 ANNU.exe 4852 PDWLLO.exe 4852 PDWLLO.exe 2072 RBCFS.exe 2072 RBCFS.exe 2900 JJQLFO.exe 2900 JJQLFO.exe 2648 THWXU.exe 2648 THWXU.exe 2784 WPDFHGW.exe 2784 WPDFHGW.exe 3580 XSHB.exe 3580 XSHB.exe 5564 SFLKWW.exe 5564 SFLKWW.exe 944 OGVUAAV.exe 944 OGVUAAV.exe 6008 NRYKJG.exe 6008 NRYKJG.exe 5776 ACOB.exe 5776 ACOB.exe 2516 MKVJJJB.exe 2516 MKVJJJB.exe 4116 WSX.exe 4116 WSX.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4644 wrote to memory of 2924 4644 2026-08-09_1c3f599912cb3f1959d6eb95393a101e_elex_emotet_stop.exe 89 PID 2924 wrote to memory of 5036 2924 cmd.exe 93 PID 5036 wrote to memory of 5844 5036 OJPOR.exe 95 PID 5844 wrote to memory of 4880 5844 cmd.exe 99 PID 4880 wrote to memory of 5080 4880 IRESCLQ.exe 100 PID 5080 wrote to memory of 4032 5080 cmd.exe 104 PID 4032 wrote to memory of 4168 4032 UHTSO.exe 105 PID 4168 wrote to memory of 3092 4168 cmd.exe 109 PID 3092 wrote to memory of 4932 3092 WFZM.exe 110 PID 4932 wrote to memory of 5892 4932 cmd.exe 114 PID 5892 wrote to memory of 3700 5892 EKLT.exe 115 PID 3700 wrote to memory of 5724 3700 cmd.exe 119 PID 5724 wrote to memory of 4816 5724 XDTE.exe 120 PID 4816 wrote to memory of 2328 4816 cmd.exe 124 PID 2328 wrote to memory of 5176 2328 WWD.exe 125 PID 5176 wrote to memory of 1544 5176 cmd.exe 129 PID 1544 wrote to memory of 4224 1544 YTJOF.exe 130 PID 4224 wrote to memory of 4316 4224 cmd.exe 134 PID 4316 wrote to memory of 5752 4316 RHIMKB.exe 135 PID 5752 wrote to memory of 5740 5752 cmd.exe 139 PID 5740 wrote to memory of 2276 5740 LZYX.exe 140 PID 2276 wrote to memory of 1132 2276 cmd.exe 144 PID 1132 wrote to memory of 5468 1132 WSNI.exe 145 PID 5468 wrote to memory of 2104 5468 cmd.exe 149 PID 2104 wrote to memory of 768 2104 RQN.exe 150 PID 768 wrote to memory of 5900 768 cmd.exe 154 PID 5900 wrote to memory of 2848 5900 KTRXBE.exe 155 PID 2848 wrote to memory of 4412 2848 cmd.exe 159 PID 4412 wrote to memory of 5416 4412 IRCSO.exe 160 PID 5416 wrote to memory of 3236 5416 cmd.exe 164 PID 3236 wrote to memory of 3904 3236 NUI.exe 165 PID 3904 wrote to memory of 1792 3904 cmd.exe 169 PID 1792 wrote to memory of 480 1792 LJTQII.exe 170 PID 480 wrote to memory of 1044 480 cmd.exe 174 PID 1044 wrote to memory of 2796 1044 FXSON.exe 175 PID 2796 wrote to memory of 6080 2796 cmd.exe 179 PID 6080 wrote to memory of 1080 6080 SIJNU.exe 180 PID 1080 wrote to memory of 2432 1080 cmd.exe 184 PID 2432 wrote to memory of 2608 2432 ANNU.exe 185 PID 2608 wrote to memory of 4852 2608 cmd.exe 189 PID 4852 wrote to memory of 3496 4852 PDWLLO.exe 190 PID 3496 wrote to memory of 2072 3496 cmd.exe 194 PID 2072 wrote to memory of 4372 2072 RBCFS.exe 195 PID 4372 wrote to memory of 2900 4372 cmd.exe 199 PID 2900 wrote to memory of 2356 2900 JJQLFO.exe 200 PID 2356 wrote to memory of 2648 2356 cmd.exe 204 PID 2648 wrote to memory of 3716 2648 THWXU.exe 205 PID 3716 wrote to memory of 2784 3716 cmd.exe 209 PID 2784 wrote to memory of 2092 2784 WPDFHGW.exe 210 PID 2092 wrote to memory of 3580 2092 cmd.exe 214 PID 3580 wrote to memory of 2700 3580 XSHB.exe 215 PID 2700 wrote to memory of 5564 2700 cmd.exe 219 PID 5564 wrote to memory of 1828 5564 SFLKWW.exe 220 PID 1828 wrote to memory of 944 1828 cmd.exe 224 PID 944 wrote to memory of 5756 944 OGVUAAV.exe 225 PID 5756 wrote to memory of 6008 5756 cmd.exe 229 PID 6008 wrote to memory of 5520 6008 NRYKJG.exe 230 PID 5520 wrote to memory of 5776 5520 cmd.exe 234 PID 5776 wrote to memory of 620 5776 ACOB.exe 235 PID 620 wrote to memory of 2516 620 cmd.exe 239 PID 2516 wrote to memory of 5552 2516 MKVJJJB.exe 240 PID 5552 wrote to memory of 4116 5552 cmd.exe 244 PID 4116 wrote to memory of 4844 4116 WSX.exe 245 PID 4844 wrote to memory of 4984 4844 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_1c3f599912cb3f1959d6eb95393a101e_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_1c3f599912cb3f1959d6eb95393a101e_elex_emotet_stop.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OJPOR.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\windows\system\OJPOR.exeC:\windows\system\OJPOR.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IRESCLQ.exe.bat" "4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5844 -
C:\windows\IRESCLQ.exeC:\windows\IRESCLQ.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UHTSO.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\windows\UHTSO.exeC:\windows\UHTSO.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4032 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WFZM.exe.bat" "8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\windows\system\WFZM.exeC:\windows\system\WFZM.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EKLT.exe.bat" "10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\windows\system\EKLT.exeC:\windows\system\EKLT.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5892 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XDTE.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:3700 -
C:\windows\SysWOW64\XDTE.exeC:\windows\system32\XDTE.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WWD.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\windows\system\WWD.exeC:\windows\system\WWD.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YTJOF.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:5176 -
C:\windows\SysWOW64\YTJOF.exeC:\windows\system32\YTJOF.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RHIMKB.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\windows\RHIMKB.exeC:\windows\RHIMKB.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LZYX.exe.bat" "20⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5752 -
C:\windows\LZYX.exeC:\windows\LZYX.exe21⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WSNI.exe.bat" "22⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\windows\system\WSNI.exeC:\windows\system\WSNI.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RQN.exe.bat" "24⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5468 -
C:\windows\system\RQN.exeC:\windows\system\RQN.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KTRXBE.exe.bat" "26⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:768 -
C:\windows\KTRXBE.exeC:\windows\KTRXBE.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IRCSO.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\windows\SysWOW64\IRCSO.exeC:\windows\system32\IRCSO.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NUI.exe.bat" "30⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5416 -
C:\windows\NUI.exeC:\windows\NUI.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LJTQII.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\windows\LJTQII.exeC:\windows\LJTQII.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FXSON.exe.bat" "34⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:480 -
C:\windows\FXSON.exeC:\windows\FXSON.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SIJNU.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\windows\SIJNU.exeC:\windows\SIJNU.exe37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ANNU.exe.bat" "38⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\windows\ANNU.exeC:\windows\ANNU.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PDWLLO.exe.bat" "40⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\windows\SysWOW64\PDWLLO.exeC:\windows\system32\PDWLLO.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RBCFS.exe.bat" "42⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\windows\SysWOW64\RBCFS.exeC:\windows\system32\RBCFS.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JJQLFO.exe.bat" "44⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\windows\SysWOW64\JJQLFO.exeC:\windows\system32\JJQLFO.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\THWXU.exe.bat" "46⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\windows\THWXU.exeC:\windows\THWXU.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WPDFHGW.exe.bat" "48⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\windows\WPDFHGW.exeC:\windows\WPDFHGW.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XSHB.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\windows\SysWOW64\XSHB.exeC:\windows\system32\XSHB.exe51⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SFLKWW.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\windows\system\SFLKWW.exeC:\windows\system\SFLKWW.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OGVUAAV.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\windows\system\OGVUAAV.exeC:\windows\system\OGVUAAV.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NRYKJG.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:5756 -
C:\windows\NRYKJG.exeC:\windows\NRYKJG.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6008 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ACOB.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:5520 -
C:\windows\SysWOW64\ACOB.exeC:\windows\system32\ACOB.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MKVJJJB.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:620 -
C:\windows\MKVJJJB.exeC:\windows\MKVJJJB.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WSX.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:5552 -
C:\windows\SysWOW64\WSX.exeC:\windows\system32\WSX.exe63⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QFUYX.exe.bat" "64⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\windows\system\QFUYX.exeC:\windows\system\QFUYX.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UVIYBZN.exe.bat" "66⤵PID:4820
-
C:\windows\system\UVIYBZN.exeC:\windows\system\UVIYBZN.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FOD.exe.bat" "68⤵
- Executes a command shell one-liner
PID:5448 -
C:\windows\system\FOD.exeC:\windows\system\FOD.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4328 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LOLET.exe.bat" "70⤵
- System Location Discovery: System Language Discovery
PID:2128 -
C:\windows\LOLET.exeC:\windows\LOLET.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZMTQ.exe.bat" "72⤵
- Executes a command shell one-liner
PID:364 -
C:\windows\SysWOW64\ZMTQ.exeC:\windows\system32\ZMTQ.exe73⤵
- Executes dropped EXE
PID:264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LCAYHE.exe.bat" "74⤵
- System Location Discovery: System Language Discovery
PID:4164 -
C:\windows\SysWOW64\LCAYHE.exeC:\windows\system32\LCAYHE.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PKGYTX.exe.bat" "76⤵
- System Location Discovery: System Language Discovery
PID:5116 -
C:\windows\PKGYTX.exeC:\windows\PKGYTX.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2632 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NFGZYAF.exe.bat" "78⤵PID:1672
-
C:\windows\NFGZYAF.exeC:\windows\NFGZYAF.exe79⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CAPL.exe.bat" "80⤵
- System Location Discovery: System Language Discovery
PID:416 -
C:\windows\CAPL.exeC:\windows\CAPL.exe81⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WOUUTM.exe.bat" "82⤵
- Executes a command shell one-liner
PID:4740 -
C:\windows\WOUUTM.exeC:\windows\WOUUTM.exe83⤵
- Executes dropped EXE
PID:4416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZBZ.exe.bat" "84⤵PID:1588
-
C:\windows\ZBZ.exeC:\windows\ZBZ.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UWDNN.exe.bat" "86⤵
- Executes a command shell one-liner
PID:5240 -
C:\windows\SysWOW64\UWDNN.exeC:\windows\system32\UWDNN.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YEKNSEC.exe.bat" "88⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4296 -
C:\windows\system\YEKNSEC.exeC:\windows\system\YEKNSEC.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CHIIZ.exe.bat" "90⤵
- Executes a command shell one-liner
PID:4512 -
C:\windows\SysWOW64\CHIIZ.exeC:\windows\system32\CHIIZ.exe91⤵
- Executes dropped EXE
PID:5140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GXPIMQS.exe.bat" "92⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1108 -
C:\windows\system\GXPIMQS.exeC:\windows\system\GXPIMQS.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KFVQQ.exe.bat" "94⤵PID:976
-
C:\windows\SysWOW64\KFVQQ.exeC:\windows\system32\KFVQQ.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZVW.exe.bat" "96⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4560 -
C:\windows\ZVW.exeC:\windows\ZVW.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OQGUIQ.exe.bat" "98⤵PID:2672
-
C:\windows\OQGUIQ.exeC:\windows\OQGUIQ.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WESBSP.exe.bat" "100⤵PID:1536
-
C:\windows\SysWOW64\WESBSP.exeC:\windows\system32\WESBSP.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AMZ.exe.bat" "102⤵
- System Location Discovery: System Language Discovery
PID:5788 -
C:\windows\system\AMZ.exeC:\windows\system\AMZ.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PCAALUK.exe.bat" "104⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1356 -
C:\windows\SysWOW64\PCAALUK.exeC:\windows\system32\PCAALUK.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HKC.exe.bat" "106⤵PID:4260
-
C:\windows\SysWOW64\HKC.exeC:\windows\system32\HKC.exe107⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FLKTY.exe.bat" "108⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:6124 -
C:\windows\FLKTY.exeC:\windows\FLKTY.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FOOXLKX.exe.bat" "110⤵PID:4540
-
C:\windows\SysWOW64\FOOXLKX.exeC:\windows\system32\FOOXLKX.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UJXBW.exe.bat" "112⤵PID:408
-
C:\windows\UJXBW.exeC:\windows\UJXBW.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NEJX.exe.bat" "114⤵
- Executes a command shell one-liner
PID:6120 -
C:\windows\SysWOW64\NEJX.exeC:\windows\system32\NEJX.exe115⤵
- Executes dropped EXE
PID:860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VRBL.exe.bat" "116⤵PID:6112
-
C:\windows\system\VRBL.exeC:\windows\system\VRBL.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KMKYWUL.exe.bat" "118⤵
- System Location Discovery: System Language Discovery
PID:4432 -
C:\windows\KMKYWUL.exeC:\windows\KMKYWUL.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FAPH.exe.bat" "120⤵PID:5076
-
C:\windows\SysWOW64\FAPH.exeC:\windows\system32\FAPH.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:720
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-