Analysis
- max time kernel
62s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/08/2026, 21:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-10_ed6175e04ec8ac1aeaaa7767d9b6e581_elex_icedid.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-10_ed6175e04ec8ac1aeaaa7767d9b6e581_elex_icedid.exe
- Size 208KB
- Sample260810-1cqcdstxet
- SHA256 105046186f69404fe1b79ce12923c0bfec1bf00120ae32b8e4902edfbd5be9cb
- MD5 ed6175e04ec8ac1aeaaa7767d9b6e581
- SHA1 8ee11424d6a8356fa16a2c29cce03aef7e205198
- SHA512 abcdb64e359ae0074808e3e011d88edae1d8851608778cb944734193b9d48a4e2c826975b5fac3b1ee901926fa50b9dc2449cb56a4be5aef17c85365833973af
- SSDEEP 3072:plVD7XzshBL1lsOd5LgKBIZsQIh5fm/SrM5ZHlnb2rG4pLthEjQT6j:l7XwBL8Od5Ws/fuGM5rb2KkEj1
- TLSH T17D248D857B81D003F5372A3094F5DAAC1E26BC636BA5868F3390378E7D327D46A163B5
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3984 ZQE.exe 2484 JTK.exe 1480 RHPJPCI.exe 4476 ZMBXZJD.exe 4600 MXKOO.exe 3704 LIVE.exe 1900 IIW.exe 464 QOJ.exe 2604 AMPHACA.exe 3672 RUDNFTD.exe 5336 IURKRKX.exe 2572 MKYSE.exe 4024 UQDZ.exe 2996 ALCZTEF.exe 3908 XQUPJZ.exe 4752 WBXFS.exe 3188 UMIV.exe 4908 RNJ.exe 3224 UIBZ.exe 1768 CNF.exe 5644 CQRJGFN.exe 1484 ZJTLRB.exe 800 KJIWBC.exe 2576 AAJ.exe 5652 KPPQPYC.exe 2960 SDCXAFX.exe 3824 WLIX.exe 6008 VEL.exe 2144 IGBLJG.exe 5104 XWCD.exe 4040 QZG.exe 984 AXMTCA.exe 4556 EDEISV.exe 1888 KYQJGR.exe 6048 UYSOKPP.exe 3476 NRZZTQX.exe 3128 CHAYAL.exe 924 BALOI.exe 1488 MSS.exe 4284 NVWVFIZ.exe 992 PTKP.exe 1944 BBQP.exe 5560 UEUTEZ.exe 6120 LEJQRQ.exe 4044 TSNXC.exe 3812 BXAMM.exe 1088 VLZKRO.exe 4336 IWPI.exe 4900 QBU.exe 3780 AZI.exe 5816 HPJB.exe 1756 AIQM.exe 5680 QYZ.exe 3632 DIHCJ.exe 4400 AJJMM.exe 3728 KHXY.exe 240 UECT.exe 3892 LFRY.exe 5400 KXU.exe 1168 BIEWFYI.exe 1320 MQLE.exe 3324 OORYZRF.exe 4780 GWTDK.exe 5840 TZB.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\CQRJGFN.exe.bat CNF.exe File created C:\windows\SysWOW64\KPPQPYC.exe AAJ.exe File created C:\windows\SysWOW64\WLIX.exe SDCXAFX.exe File opened for modification C:\windows\SysWOW64\WLIX.exe SDCXAFX.exe File opened for modification C:\windows\SysWOW64\BNOJBYY.exe TZB.exe File created C:\windows\SysWOW64\QOJ.exe.bat IIW.exe File opened for modification C:\windows\SysWOW64\KPPQPYC.exe AAJ.exe File created C:\windows\SysWOW64\KPPQPYC.exe.bat AAJ.exe File created C:\windows\SysWOW64\QZG.exe.bat XWCD.exe File created C:\windows\SysWOW64\BBQP.exe.bat PTKP.exe File created C:\windows\SysWOW64\DIHCJ.exe.bat QYZ.exe File opened for modification C:\windows\SysWOW64\AXRRKM.exe BNOJBYY.exe File created C:\windows\SysWOW64\NVWVFIZ.exe MSS.exe File created C:\windows\SysWOW64\BALOI.exe CHAYAL.exe File created C:\windows\SysWOW64\JTK.exe ZQE.exe File created C:\windows\SysWOW64\QOJ.exe IIW.exe File opened for modification C:\windows\SysWOW64\QOJ.exe IIW.exe File created C:\windows\SysWOW64\IURKRKX.exe.bat RUDNFTD.exe File opened for modification C:\windows\SysWOW64\MKYSE.exe IURKRKX.exe File opened for modification C:\windows\SysWOW64\IGBLJG.exe VEL.exe File created C:\windows\SysWOW64\MKYSE.exe IURKRKX.exe File created C:\windows\SysWOW64\MKYSE.exe.bat IURKRKX.exe File opened for modification C:\windows\SysWOW64\XQUPJZ.exe ALCZTEF.exe File created C:\windows\SysWOW64\XWCD.exe IGBLJG.exe File created C:\windows\SysWOW64\KYQJGR.exe EDEISV.exe File created C:\windows\SysWOW64\BNOJBYY.exe TZB.exe File created C:\windows\SysWOW64\MXKOO.exe.bat ZMBXZJD.exe File opened for modification C:\windows\SysWOW64\RNJ.exe UMIV.exe File created C:\windows\SysWOW64\BBQP.exe PTKP.exe File opened for modification C:\windows\SysWOW64\KHXY.exe AJJMM.exe File created C:\windows\SysWOW64\ZQE.exe.bat 2026-08-10_ed6175e04ec8ac1aeaaa7767d9b6e581_elex_icedid.exe File opened for modification C:\windows\SysWOW64\CQRJGFN.exe CNF.exe File created C:\windows\SysWOW64\DIHCJ.exe QYZ.exe File created C:\windows\SysWOW64\CQRJGFN.exe CNF.exe File created C:\windows\SysWOW64\KYQJGR.exe.bat EDEISV.exe File created C:\windows\SysWOW64\HPJB.exe AZI.exe File opened for modification C:\windows\SysWOW64\GUVJFY.exe HJSSWSC.exe File created C:\windows\SysWOW64\BKQGEI.exe NPNN.exe File created C:\windows\SysWOW64\RNJ.exe UMIV.exe File created C:\windows\SysWOW64\BNOJBYY.exe.bat TZB.exe File opened for modification C:\windows\SysWOW64\BKQGEI.exe NPNN.exe File created C:\windows\SysWOW64\RHPJPCI.exe JTK.exe File created C:\windows\SysWOW64\IGBLJG.exe VEL.exe File created C:\windows\SysWOW64\IGBLJG.exe.bat VEL.exe File created C:\windows\SysWOW64\XWCD.exe.bat IGBLJG.exe File opened for modification C:\windows\SysWOW64\QZG.exe XWCD.exe File created C:\windows\SysWOW64\KHXY.exe.bat AJJMM.exe File created C:\windows\SysWOW64\AXRRKM.exe.bat BNOJBYY.exe File opened for modification C:\windows\SysWOW64\RHPJPCI.exe JTK.exe File created C:\windows\SysWOW64\RHPJPCI.exe.bat JTK.exe File opened for modification C:\windows\SysWOW64\ALCZTEF.exe UQDZ.exe File created C:\windows\SysWOW64\XQUPJZ.exe ALCZTEF.exe File created C:\windows\SysWOW64\GUVJFY.exe HJSSWSC.exe File opened for modification C:\windows\SysWOW64\MXKOO.exe ZMBXZJD.exe File created C:\windows\SysWOW64\IWMZIO.exe SBU.exe File opened for modification C:\windows\SysWOW64\IWMZIO.exe SBU.exe File created C:\windows\SysWOW64\IWMZIO.exe.bat SBU.exe File opened for modification C:\windows\SysWOW64\BALOI.exe CHAYAL.exe File created C:\windows\SysWOW64\QZG.exe XWCD.exe File opened for modification C:\windows\SysWOW64\BBQP.exe PTKP.exe File created C:\windows\SysWOW64\KHXY.exe AJJMM.exe File created C:\windows\SysWOW64\GUVJFY.exe.bat HJSSWSC.exe File opened for modification C:\windows\SysWOW64\ZQE.exe 2026-08-10_ed6175e04ec8ac1aeaaa7767d9b6e581_elex_icedid.exe File created C:\windows\SysWOW64\MXKOO.exe ZMBXZJD.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\LIVE.exe MXKOO.exe File opened for modification C:\windows\MSS.exe BALOI.exe File opened for modification C:\windows\system\LIVE.exe MXKOO.exe File created C:\windows\system\RUDNFTD.exe.bat AMPHACA.exe File created C:\windows\IWPI.exe VLZKRO.exe File created C:\windows\AIQM.exe.bat HPJB.exe File created C:\windows\system\QYZ.exe AIQM.exe File created C:\windows\AJJMM.exe.bat DIHCJ.exe File created C:\windows\system\SBU.exe AXRRKM.exe File created C:\windows\system\SBU.exe.bat AXRRKM.exe File created C:\windows\UIBZ.exe RNJ.exe File opened for modification C:\windows\SDCXAFX.exe KPPQPYC.exe File opened for modification C:\windows\EDEISV.exe AXMTCA.exe File created C:\windows\AZI.exe QBU.exe File created C:\windows\system\NPNN.exe GUVJFY.exe File created C:\windows\system\WBXFS.exe XQUPJZ.exe File created C:\windows\UYSOKPP.exe.bat KYQJGR.exe File created C:\windows\system\NRZZTQX.exe.bat UYSOKPP.exe File created C:\windows\PTKP.exe.bat NVWVFIZ.exe File opened for modification C:\windows\LEJQRQ.exe UEUTEZ.exe File opened for modification C:\windows\system\VLZKRO.exe BXAMM.exe File created C:\windows\system\KJIWBC.exe ZJTLRB.exe File created C:\windows\system\QBU.exe.bat IWPI.exe File opened for modification C:\windows\HJSSWSC.exe GGPPR.exe File created C:\windows\UYSOKPP.exe KYQJGR.exe File opened for modification C:\windows\PTKP.exe NVWVFIZ.exe File created C:\windows\system\KJIWBC.exe.bat ZJTLRB.exe File created C:\windows\VEL.exe.bat WLIX.exe File created C:\windows\system\AXMTCA.exe QZG.exe File opened for modification C:\windows\TZB.exe GWTDK.exe File created C:\windows\HJSSWSC.exe.bat GGPPR.exe File created C:\windows\system\UQDZ.exe MKYSE.exe File opened for modification C:\windows\UYSOKPP.exe KYQJGR.exe File opened for modification C:\windows\system\CHAYAL.exe NRZZTQX.exe File created C:\windows\MSS.exe.bat BALOI.exe File created C:\windows\PTKP.exe NVWVFIZ.exe File opened for modification C:\windows\system\TSNXC.exe LEJQRQ.exe File opened for modification C:\windows\system\UECT.exe KHXY.exe File created C:\windows\BIEWFYI.exe KXU.exe File opened for modification C:\windows\system\AMPHACA.exe QOJ.exe File created C:\windows\system\TSNXC.exe LEJQRQ.exe File opened for modification C:\windows\BIEWFYI.exe KXU.exe File opened for modification C:\windows\system\OORYZRF.exe MQLE.exe File created C:\windows\UMIV.exe.bat WBXFS.exe File created C:\windows\system\UEUTEZ.exe.bat BBQP.exe File created C:\windows\LEJQRQ.exe.bat UEUTEZ.exe File created C:\windows\system\UECT.exe.bat KHXY.exe File created C:\windows\GGPPR.exe.bat IWMZIO.exe File created C:\windows\LEJQRQ.exe UEUTEZ.exe File created C:\windows\BXAMM.exe TSNXC.exe File opened for modification C:\windows\system\LFRY.exe UECT.exe File created C:\windows\system\LIVE.exe.bat MXKOO.exe File created C:\windows\UMIV.exe WBXFS.exe File created C:\windows\system\UEUTEZ.exe BBQP.exe File opened for modification C:\windows\AJJMM.exe DIHCJ.exe File created C:\windows\system\GWTDK.exe OORYZRF.exe File created C:\windows\system\AMPHACA.exe.bat QOJ.exe File created C:\windows\system\RUDNFTD.exe AMPHACA.exe File created C:\windows\UIBZ.exe.bat RNJ.exe File opened for modification C:\windows\IWPI.exe VLZKRO.exe File created C:\windows\system\QBU.exe IWPI.exe File created C:\windows\system\LFRY.exe UECT.exe File opened for modification C:\windows\system\RUDNFTD.exe AMPHACA.exe File created C:\windows\MQLE.exe.bat BIEWFYI.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2740 cmd.exe 3960 cmd.exe 2240 cmd.exe 5144 cmd.exe 3852 cmd.exe 4000 cmd.exe 1304 cmd.exe 3836 cmd.exe 2588 cmd.exe 4756 cmd.exe 4100 cmd.exe 6080 cmd.exe 4608 cmd.exe 4312 cmd.exe 2712 cmd.exe 1468 cmd.exe 2200 cmd.exe 3744 cmd.exe 4228 cmd.exe 1156 cmd.exe 456 cmd.exe 2412 cmd.exe 2948 cmd.exe 4088 cmd.exe 4264 cmd.exe 4416 cmd.exe 5900 cmd.exe 4892 cmd.exe 3688 cmd.exe 3988 cmd.exe 1520 cmd.exe 5304 cmd.exe 5296 cmd.exe 1800 cmd.exe 1312 cmd.exe 3452 cmd.exe 3496 cmd.exe 4772 cmd.exe 4520 cmd.exe 2620 cmd.exe 3000 cmd.exe 4224 cmd.exe 4512 cmd.exe 5732 cmd.exe 4616 cmd.exe 5760 cmd.exe 424 cmd.exe 3532 cmd.exe 1224 cmd.exe 3288 cmd.exe 4124 cmd.exe 784 cmd.exe 2372 cmd.exe 2564 cmd.exe 4048 cmd.exe 5116 cmd.exe 2056 cmd.exe 200 cmd.exe 4076 cmd.exe 4428 cmd.exe 1372 cmd.exe 260 cmd.exe 824 cmd.exe 2536 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 1620 4340 WerFault.exe 86 892 3984 WerFault.exe 92 3116 2484 WerFault.exe 98 6092 1480 WerFault.exe 103 3048 4476 WerFault.exe 108 3188 4600 WerFault.exe 113 1808 3704 WerFault.exe 118 5732 1900 WerFault.exe 123 1768 464 WerFault.exe 128 2060 2604 WerFault.exe 133 2024 3672 WerFault.exe 138 3548 5336 WerFault.exe 143 5520 2572 WerFault.exe 148 1452 4024 WerFault.exe 153 2948 2996 WerFault.exe 158 2408 3908 WerFault.exe 163 3728 4752 WerFault.exe 168 4900 3188 WerFault.exe 173 5188 4908 WerFault.exe 178 4396 3224 WerFault.exe 183 2012 1768 WerFault.exe 188 5276 5644 WerFault.exe 193 5612 1484 WerFault.exe 198 4144 800 WerFault.exe 203 1272 2576 WerFault.exe 208 4516 5652 WerFault.exe 213 6092 2960 WerFault.exe 218 4208 3824 WerFault.exe 223 4900 6008 WerFault.exe 228 1168 2144 WerFault.exe 233 5936 5104 WerFault.exe 238 2012 4040 WerFault.exe 243 5052 984 WerFault.exe 248 2684 4556 WerFault.exe 253 4144 1888 WerFault.exe 258 3864 6048 WerFault.exe 264 2408 3476 WerFault.exe 269 5724 3128 WerFault.exe 274 3392 924 WerFault.exe 279 1696 1488 WerFault.exe 284 2516 4284 WerFault.exe 289 5664 992 WerFault.exe 294 2912 1944 WerFault.exe 299 4072 5560 WerFault.exe 304 5716 6120 WerFault.exe 309 4808 4044 WerFault.exe 314 1988 3812 WerFault.exe 319 6088 1088 WerFault.exe 324 1636 4336 WerFault.exe 329 4224 4900 WerFault.exe 334 4348 3780 WerFault.exe 339 5256 5816 WerFault.exe 344 4800 1756 WerFault.exe 349 3504 5680 WerFault.exe 354 5076 3632 WerFault.exe 359 6004 4400 WerFault.exe 364 6064 3728 WerFault.exe 369 4844 240 WerFault.exe 374 3148 3892 WerFault.exe 379 5936 5400 WerFault.exe 384 1720 1168 WerFault.exe 389 4976 1320 WerFault.exe 394 4012 3324 WerFault.exe 399 3192 4780 WerFault.exe 404 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UEUTEZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GGPPR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WBXFS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CQRJGFN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EDEISV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AIQM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IWPI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UECT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AMPHACA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KHXY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VEL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KYQJGR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AXRRKM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WLIX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UYSOKPP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NRZZTQX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SDCXAFX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RNJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KJIWBC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BNOJBYY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LFRY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KPPQPYC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QOJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XWCD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PTKP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HJSSWSC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BIEWFYI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SBU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4340 2026-08-10_ed6175e04ec8ac1aeaaa7767d9b6e581_elex_icedid.exe 4340 2026-08-10_ed6175e04ec8ac1aeaaa7767d9b6e581_elex_icedid.exe 3984 ZQE.exe 3984 ZQE.exe 2484 JTK.exe 2484 JTK.exe 1480 RHPJPCI.exe 1480 RHPJPCI.exe 4476 ZMBXZJD.exe 4476 ZMBXZJD.exe 4600 MXKOO.exe 4600 MXKOO.exe 3704 LIVE.exe 3704 LIVE.exe 1900 IIW.exe 1900 IIW.exe 464 QOJ.exe 464 QOJ.exe 2604 AMPHACA.exe 2604 AMPHACA.exe 3672 RUDNFTD.exe 3672 RUDNFTD.exe 5336 IURKRKX.exe 5336 IURKRKX.exe 2572 MKYSE.exe 2572 MKYSE.exe 4024 UQDZ.exe 4024 UQDZ.exe 2996 ALCZTEF.exe 2996 ALCZTEF.exe 3908 XQUPJZ.exe 3908 XQUPJZ.exe 4752 WBXFS.exe 4752 WBXFS.exe 3188 UMIV.exe 3188 UMIV.exe 4908 RNJ.exe 4908 RNJ.exe 3224 UIBZ.exe 3224 UIBZ.exe 1768 CNF.exe 1768 CNF.exe 5644 CQRJGFN.exe 5644 CQRJGFN.exe 1484 ZJTLRB.exe 1484 ZJTLRB.exe 800 KJIWBC.exe 800 KJIWBC.exe 2576 AAJ.exe 2576 AAJ.exe 5652 KPPQPYC.exe 5652 KPPQPYC.exe 2960 SDCXAFX.exe 2960 SDCXAFX.exe 3824 WLIX.exe 3824 WLIX.exe 6008 VEL.exe 6008 VEL.exe 2144 IGBLJG.exe 2144 IGBLJG.exe 5104 XWCD.exe 5104 XWCD.exe 4040 QZG.exe 4040 QZG.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4340 2026-08-10_ed6175e04ec8ac1aeaaa7767d9b6e581_elex_icedid.exe 4340 2026-08-10_ed6175e04ec8ac1aeaaa7767d9b6e581_elex_icedid.exe 3984 ZQE.exe 3984 ZQE.exe 2484 JTK.exe 2484 JTK.exe 1480 RHPJPCI.exe 1480 RHPJPCI.exe 4476 ZMBXZJD.exe 4476 ZMBXZJD.exe 4600 MXKOO.exe 4600 MXKOO.exe 3704 LIVE.exe 3704 LIVE.exe 1900 IIW.exe 1900 IIW.exe 464 QOJ.exe 464 QOJ.exe 2604 AMPHACA.exe 2604 AMPHACA.exe 3672 RUDNFTD.exe 3672 RUDNFTD.exe 5336 IURKRKX.exe 5336 IURKRKX.exe 2572 MKYSE.exe 2572 MKYSE.exe 4024 UQDZ.exe 4024 UQDZ.exe 2996 ALCZTEF.exe 2996 ALCZTEF.exe 3908 XQUPJZ.exe 3908 XQUPJZ.exe 4752 WBXFS.exe 4752 WBXFS.exe 3188 UMIV.exe 3188 UMIV.exe 4908 RNJ.exe 4908 RNJ.exe 3224 UIBZ.exe 3224 UIBZ.exe 1768 CNF.exe 1768 CNF.exe 5644 CQRJGFN.exe 5644 CQRJGFN.exe 1484 ZJTLRB.exe 1484 ZJTLRB.exe 800 KJIWBC.exe 800 KJIWBC.exe 2576 AAJ.exe 2576 AAJ.exe 5652 KPPQPYC.exe 5652 KPPQPYC.exe 2960 SDCXAFX.exe 2960 SDCXAFX.exe 3824 WLIX.exe 3824 WLIX.exe 6008 VEL.exe 6008 VEL.exe 2144 IGBLJG.exe 2144 IGBLJG.exe 5104 XWCD.exe 5104 XWCD.exe 4040 QZG.exe 4040 QZG.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4340 wrote to memory of 2260 4340 2026-08-10_ed6175e04ec8ac1aeaaa7767d9b6e581_elex_icedid.exe 88 PID 2260 wrote to memory of 3984 2260 cmd.exe 92 PID 3984 wrote to memory of 424 3984 ZQE.exe 94 PID 424 wrote to memory of 2484 424 cmd.exe 98 PID 2484 wrote to memory of 3212 2484 JTK.exe 99 PID 3212 wrote to memory of 1480 3212 cmd.exe 103 PID 1480 wrote to memory of 5788 1480 RHPJPCI.exe 104 PID 5788 wrote to memory of 4476 5788 cmd.exe 108 PID 4476 wrote to memory of 2928 4476 ZMBXZJD.exe 109 PID 2928 wrote to memory of 4600 2928 cmd.exe 113 PID 4600 wrote to memory of 2080 4600 MXKOO.exe 114 PID 2080 wrote to memory of 3704 2080 cmd.exe 118 PID 3704 wrote to memory of 5736 3704 LIVE.exe 119 PID 5736 wrote to memory of 1900 5736 cmd.exe 123 PID 1900 wrote to memory of 200 1900 IIW.exe 124 PID 200 wrote to memory of 464 200 cmd.exe 128 PID 464 wrote to memory of 5296 464 QOJ.exe 129 PID 5296 wrote to memory of 2604 5296 cmd.exe 133 PID 2604 wrote to memory of 2972 2604 AMPHACA.exe 134 PID 2972 wrote to memory of 3672 2972 cmd.exe 138 PID 3672 wrote to memory of 6056 3672 RUDNFTD.exe 139 PID 6056 wrote to memory of 5336 6056 cmd.exe 143 PID 5336 wrote to memory of 2904 5336 IURKRKX.exe 144 PID 2904 wrote to memory of 2572 2904 cmd.exe 148 PID 2572 wrote to memory of 2648 2572 MKYSE.exe 149 PID 2648 wrote to memory of 4024 2648 cmd.exe 153 PID 4024 wrote to memory of 4572 4024 UQDZ.exe 154 PID 4572 wrote to memory of 2996 4572 cmd.exe 158 PID 2996 wrote to memory of 1800 2996 ALCZTEF.exe 159 PID 1800 wrote to memory of 3908 1800 cmd.exe 163 PID 3908 wrote to memory of 3524 3908 XQUPJZ.exe 164 PID 3524 wrote to memory of 4752 3524 cmd.exe 168 PID 4752 wrote to memory of 1984 4752 WBXFS.exe 169 PID 1984 wrote to memory of 3188 1984 cmd.exe 173 PID 3188 wrote to memory of 2416 3188 UMIV.exe 174 PID 2416 wrote to memory of 4908 2416 cmd.exe 178 PID 4908 wrote to memory of 4076 4908 RNJ.exe 179 PID 4076 wrote to memory of 3224 4076 cmd.exe 183 PID 3224 wrote to memory of 4896 3224 UIBZ.exe 184 PID 4896 wrote to memory of 1768 4896 cmd.exe 188 PID 1768 wrote to memory of 2412 1768 CNF.exe 189 PID 2412 wrote to memory of 5644 2412 cmd.exe 193 PID 5644 wrote to memory of 4768 5644 CQRJGFN.exe 194 PID 4768 wrote to memory of 1484 4768 cmd.exe 198 PID 1484 wrote to memory of 4236 1484 ZJTLRB.exe 199 PID 4236 wrote to memory of 800 4236 cmd.exe 203 PID 800 wrote to memory of 3656 800 KJIWBC.exe 204 PID 3656 wrote to memory of 2576 3656 cmd.exe 208 PID 2576 wrote to memory of 1312 2576 AAJ.exe 209 PID 1312 wrote to memory of 5652 1312 cmd.exe 213 PID 5652 wrote to memory of 4840 5652 KPPQPYC.exe 214 PID 4840 wrote to memory of 2960 4840 cmd.exe 218 PID 2960 wrote to memory of 5008 2960 SDCXAFX.exe 219 PID 5008 wrote to memory of 3824 5008 cmd.exe 223 PID 3824 wrote to memory of 2352 3824 WLIX.exe 224 PID 2352 wrote to memory of 6008 2352 cmd.exe 228 PID 6008 wrote to memory of 3960 6008 VEL.exe 229 PID 3960 wrote to memory of 2144 3960 cmd.exe 233 PID 2144 wrote to memory of 616 2144 IGBLJG.exe 234 PID 616 wrote to memory of 5104 616 cmd.exe 238 PID 5104 wrote to memory of 6108 5104 XWCD.exe 239 PID 6108 wrote to memory of 4040 6108 cmd.exe 243 PID 4040 wrote to memory of 2552 4040 QZG.exe 244 PID 2552 wrote to memory of 984 2552 cmd.exe 248
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_ed6175e04ec8ac1aeaaa7767d9b6e581_elex_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_ed6175e04ec8ac1aeaaa7767d9b6e581_elex_icedid.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZQE.exe.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\windows\SysWOW64\ZQE.exeC:\windows\system32\ZQE.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JTK.exe.bat" "4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:424 -
C:\windows\SysWOW64\JTK.exeC:\windows\system32\JTK.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RHPJPCI.exe.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\windows\SysWOW64\RHPJPCI.exeC:\windows\system32\RHPJPCI.exe7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZMBXZJD.exe.bat" "8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5788 -
C:\windows\ZMBXZJD.exeC:\windows\ZMBXZJD.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MXKOO.exe.bat" "10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\windows\SysWOW64\MXKOO.exeC:\windows\system32\MXKOO.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LIVE.exe.bat" "12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\windows\system\LIVE.exeC:\windows\system\LIVE.exe13⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IIW.exe.bat" "14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5736 -
C:\windows\IIW.exeC:\windows\IIW.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QOJ.exe.bat" "16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:200 -
C:\windows\SysWOW64\QOJ.exeC:\windows\system32\QOJ.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AMPHACA.exe.bat" "18⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5296 -
C:\windows\system\AMPHACA.exeC:\windows\system\AMPHACA.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RUDNFTD.exe.bat" "20⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\windows\system\RUDNFTD.exeC:\windows\system\RUDNFTD.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IURKRKX.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:6056 -
C:\windows\SysWOW64\IURKRKX.exeC:\windows\system32\IURKRKX.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5336 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MKYSE.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\windows\SysWOW64\MKYSE.exeC:\windows\system32\MKYSE.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UQDZ.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\windows\system\UQDZ.exeC:\windows\system\UQDZ.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ALCZTEF.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\windows\SysWOW64\ALCZTEF.exeC:\windows\system32\ALCZTEF.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XQUPJZ.exe.bat" "30⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\windows\SysWOW64\XQUPJZ.exeC:\windows\system32\XQUPJZ.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WBXFS.exe.bat" "32⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3524 -
C:\windows\system\WBXFS.exeC:\windows\system\WBXFS.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UMIV.exe.bat" "34⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\windows\UMIV.exeC:\windows\UMIV.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RNJ.exe.bat" "36⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\windows\SysWOW64\RNJ.exeC:\windows\system32\RNJ.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UIBZ.exe.bat" "38⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\windows\UIBZ.exeC:\windows\UIBZ.exe39⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3224 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CNF.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\windows\CNF.exeC:\windows\CNF.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CQRJGFN.exe.bat" "42⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\windows\SysWOW64\CQRJGFN.exeC:\windows\system32\CQRJGFN.exe43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZJTLRB.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\windows\system\ZJTLRB.exeC:\windows\system\ZJTLRB.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KJIWBC.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\windows\system\KJIWBC.exeC:\windows\system\KJIWBC.exe47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AAJ.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\windows\system\AAJ.exeC:\windows\system\AAJ.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KPPQPYC.exe.bat" "50⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\windows\SysWOW64\KPPQPYC.exeC:\windows\system32\KPPQPYC.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SDCXAFX.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\windows\SDCXAFX.exeC:\windows\SDCXAFX.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WLIX.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\windows\SysWOW64\WLIX.exeC:\windows\system32\WLIX.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VEL.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\windows\VEL.exeC:\windows\VEL.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6008 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IGBLJG.exe.bat" "58⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\windows\SysWOW64\IGBLJG.exeC:\windows\system32\IGBLJG.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XWCD.exe.bat" "60⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:616 -
C:\windows\SysWOW64\XWCD.exeC:\windows\system32\XWCD.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QZG.exe.bat" "62⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6108 -
C:\windows\SysWOW64\QZG.exeC:\windows\system32\QZG.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4040 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AXMTCA.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\windows\system\AXMTCA.exeC:\windows\system\AXMTCA.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EDEISV.exe.bat" "66⤵PID:1708
-
C:\windows\EDEISV.exeC:\windows\EDEISV.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KYQJGR.exe.bat" "68⤵PID:3400
-
C:\windows\SysWOW64\KYQJGR.exeC:\windows\system32\KYQJGR.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UYSOKPP.exe.bat" "70⤵PID:2840
-
C:\windows\UYSOKPP.exeC:\windows\UYSOKPP.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6048 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NRZZTQX.exe.bat" "72⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2948 -
C:\windows\system\NRZZTQX.exeC:\windows\system\NRZZTQX.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CHAYAL.exe.bat" "74⤵PID:1508
-
C:\windows\system\CHAYAL.exeC:\windows\system\CHAYAL.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BALOI.exe.bat" "76⤵PID:3048
-
C:\windows\SysWOW64\BALOI.exeC:\windows\system32\BALOI.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MSS.exe.bat" "78⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3452 -
C:\windows\MSS.exeC:\windows\MSS.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NVWVFIZ.exe.bat" "80⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3744 -
C:\windows\SysWOW64\NVWVFIZ.exeC:\windows\system32\NVWVFIZ.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PTKP.exe.bat" "82⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4892 -
C:\windows\PTKP.exeC:\windows\PTKP.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BBQP.exe.bat" "84⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2240 -
C:\windows\SysWOW64\BBQP.exeC:\windows\system32\BBQP.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UEUTEZ.exe.bat" "86⤵
- Executes a command shell one-liner
PID:3532 -
C:\windows\system\UEUTEZ.exeC:\windows\system\UEUTEZ.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LEJQRQ.exe.bat" "88⤵
- System Location Discovery: System Language Discovery
PID:5328 -
C:\windows\LEJQRQ.exeC:\windows\LEJQRQ.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6120 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TSNXC.exe.bat" "90⤵PID:3968
-
C:\windows\system\TSNXC.exeC:\windows\system\TSNXC.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BXAMM.exe.bat" "92⤵PID:1460
-
C:\windows\BXAMM.exeC:\windows\BXAMM.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VLZKRO.exe.bat" "94⤵
- System Location Discovery: System Language Discovery
PID:4884 -
C:\windows\system\VLZKRO.exeC:\windows\system\VLZKRO.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IWPI.exe.bat" "96⤵
- System Location Discovery: System Language Discovery
PID:2460 -
C:\windows\IWPI.exeC:\windows\IWPI.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4336 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QBU.exe.bat" "98⤵
- System Location Discovery: System Language Discovery
PID:712 -
C:\windows\system\QBU.exeC:\windows\system\QBU.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AZI.exe.bat" "100⤵PID:4540
-
C:\windows\AZI.exeC:\windows\AZI.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HPJB.exe.bat" "102⤵PID:3964
-
C:\windows\SysWOW64\HPJB.exeC:\windows\system32\HPJB.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AIQM.exe.bat" "104⤵PID:3264
-
C:\windows\AIQM.exeC:\windows\AIQM.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QYZ.exe.bat" "106⤵PID:5360
-
C:\windows\system\QYZ.exeC:\windows\system\QYZ.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5680 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DIHCJ.exe.bat" "108⤵
- System Location Discovery: System Language Discovery
PID:5080 -
C:\windows\SysWOW64\DIHCJ.exeC:\windows\system32\DIHCJ.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3632 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AJJMM.exe.bat" "110⤵
- System Location Discovery: System Language Discovery
PID:2464 -
C:\windows\AJJMM.exeC:\windows\AJJMM.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KHXY.exe.bat" "112⤵PID:3652
-
C:\windows\SysWOW64\KHXY.exeC:\windows\system32\KHXY.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3728 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UECT.exe.bat" "114⤵
- System Location Discovery: System Language Discovery
PID:256 -
C:\windows\system\UECT.exeC:\windows\system\UECT.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LFRY.exe.bat" "116⤵PID:1772
-
C:\windows\system\LFRY.exeC:\windows\system\LFRY.exe117⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3892 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KXU.exe.bat" "118⤵PID:3200
-
C:\windows\system\KXU.exeC:\windows\system\KXU.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BIEWFYI.exe.bat" "120⤵
- Executes a command shell one-liner
PID:4520 -
C:\windows\BIEWFYI.exeC:\windows\BIEWFYI.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1168
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-