Analysis
- max time kernel
71s - max time network
133s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/08/2026, 18:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-10_7f1ffe289cf89891d052814bff7f3a69_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-10_7f1ffe289cf89891d052814bff7f3a69_elex_emotet_stop.exe
- Size 208KB
- Sample260810-w7cbsszzfs
- SHA256 c6f7a31adebcd192e1b90e4d99a2726dc0e0426b02a9be35de7deab513deca0d
- MD5 7f1ffe289cf89891d052814bff7f3a69
- SHA1 b2a81c018fe0d57a76d7a2e43dc39a2dd39962b7
- SHA512 a2965e3db9b463004af339b719271f6c5ffac54d2b2f633978d901e67c904b894b99ef50f1d92aea9043b8511bd52aeaa7da9780f8ffd39ec31d7b9c9388f6d6
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFl1dL+LOfn4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFl15+LO/kEj1
- TLSH T15A247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4724 IVRY.exe 4760 IYBJ.exe 4484 PEVE.exe 4948 XSHL.exe 3548 QKXW.exe 3460 DVFVWNA.exe 5116 JIEVB.exe 3060 NYLVFJE.exe 5712 XZN.exe 5340 SJV.exe 3048 NXAJH.exe 3660 UNBIOMF.exe 2776 ELPCVV.exe 5940 OIUPLD.exe 2036 SYB.exe 5132 WGIXB.exe 704 WJTAOWI.exe 5532 PMXWUT.exe 3940 EUYVBHG.exe 2848 SFHMPSC.exe 696 HVIL.exe 2752 GTBO.exe 5020 YOFKOI.exe 5544 UUFWQ.exe 4692 MXJA.exe 1276 LNCVQPT.exe 3004 LQGY.exe 4252 ZOGKGRM.exe 1356 SGV.exe 4952 WWCVB.exe 6140 ECGCM.exe 2956 GZUW.exe 4876 OFMKV.exe 3228 ZFBVM.exe 5476 LYEO.exe 2560 WRZHV.exe 2864 EBIAJXJ.exe 1780 AHOXQZK.exe 3428 TKSBVX.exe 3028 QHYQKZ.exe 3836 BATJKOD.exe 5612 XFYG.exe 1232 DQU.exe 5196 OJXX.exe 3508 UJFLWR.exe 4576 DJHYZWT.exe 1100 LCQ.exe 1836 NSJ.exe 4296 YKMN.exe 1120 JQXKG.exe 1092 LGQMNA.exe 3352 ILWCU.exe 1416 TERUCRX.exe 4804 YPVBHI.exe 2976 GZE.exe 3440 CFCRCWJ.exe 4556 OXFK.exe 5572 ILKTU.exe 4392 KJDWTA.exe 3084 QJK.exe 3896 BBNCK.exe 3068 QHTR.exe 4992 YSCT.exe 1784 APHN.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\SYB.exe OIUPLD.exe File created C:\windows\SysWOW64\SYB.exe.bat OIUPLD.exe File created C:\windows\SysWOW64\YOFKOI.exe GTBO.exe File created C:\windows\SysWOW64\QKXW.exe XSHL.exe File created C:\windows\SysWOW64\JIEVB.exe.bat DVFVWNA.exe File created C:\windows\SysWOW64\EUYVBHG.exe PMXWUT.exe File created C:\windows\SysWOW64\OJXX.exe DQU.exe File created C:\windows\SysWOW64\YKMN.exe NSJ.exe File opened for modification C:\windows\SysWOW64\BBNCK.exe QJK.exe File created C:\windows\SysWOW64\OXFK.exe CFCRCWJ.exe File opened for modification C:\windows\SysWOW64\ZFKRNNS.exe GCYVI.exe File created C:\windows\SysWOW64\RRYK.exe CBXLNBD.exe File created C:\windows\SysWOW64\DVFVWNA.exe.bat QKXW.exe File opened for modification C:\windows\SysWOW64\QHYQKZ.exe TKSBVX.exe File created C:\windows\SysWOW64\KJDWTA.exe.bat ILKTU.exe File opened for modification C:\windows\SysWOW64\DVFVWNA.exe QKXW.exe File created C:\windows\SysWOW64\AHOXQZK.exe.bat EBIAJXJ.exe File created C:\windows\SysWOW64\TKSBVX.exe.bat AHOXQZK.exe File opened for modification C:\windows\SysWOW64\KJDWTA.exe ILKTU.exe File created C:\windows\SysWOW64\YKMN.exe.bat NSJ.exe File created C:\windows\SysWOW64\XZN.exe NYLVFJE.exe File opened for modification C:\windows\SysWOW64\JIEVB.exe DVFVWNA.exe File created C:\windows\SysWOW64\SGV.exe ZOGKGRM.exe File opened for modification C:\windows\SysWOW64\TKSBVX.exe AHOXQZK.exe File created C:\windows\SysWOW64\JIEVB.exe DVFVWNA.exe File created C:\windows\SysWOW64\NXAJH.exe SJV.exe File created C:\windows\SysWOW64\YOFKOI.exe.bat GTBO.exe File created C:\windows\SysWOW64\QYIIPLP.exe ANY.exe File opened for modification C:\windows\SysWOW64\KIZM.exe ALUA.exe File created C:\windows\SysWOW64\TKSBVX.exe AHOXQZK.exe File created C:\windows\SysWOW64\SYB.exe OIUPLD.exe File created C:\windows\SysWOW64\XZN.exe.bat NYLVFJE.exe File created C:\windows\SysWOW64\AHOXQZK.exe EBIAJXJ.exe File created C:\windows\SysWOW64\KJDWTA.exe ILKTU.exe File created C:\windows\SysWOW64\ANY.exe ZSUW.exe File created C:\windows\SysWOW64\ANY.exe.bat ZSUW.exe File opened for modification C:\windows\SysWOW64\QYIIPLP.exe ANY.exe File opened for modification C:\windows\SysWOW64\YOFKOI.exe GTBO.exe File created C:\windows\SysWOW64\NSJ.exe LCQ.exe File opened for modification C:\windows\SysWOW64\CFCRCWJ.exe GZE.exe File created C:\windows\SysWOW64\OXFK.exe.bat CFCRCWJ.exe File created C:\windows\SysWOW64\BBNCK.exe QJK.exe File created C:\windows\SysWOW64\RRYK.exe.bat CBXLNBD.exe File created C:\windows\SysWOW64\WWCVB.exe.bat SGV.exe File opened for modification C:\windows\SysWOW64\NSJ.exe LCQ.exe File opened for modification C:\windows\SysWOW64\YKMN.exe NSJ.exe File created C:\windows\SysWOW64\CFCRCWJ.exe.bat GZE.exe File opened for modification C:\windows\SysWOW64\RRYK.exe CBXLNBD.exe File created C:\windows\SysWOW64\NYLVFJE.exe JIEVB.exe File created C:\windows\SysWOW64\DJHYZWT.exe UJFLWR.exe File created C:\windows\SysWOW64\CFCRCWJ.exe GZE.exe File created C:\windows\SysWOW64\KIZM.exe ALUA.exe File created C:\windows\SysWOW64\QKXW.exe.bat XSHL.exe File created C:\windows\SysWOW64\DVFVWNA.exe QKXW.exe File opened for modification C:\windows\SysWOW64\OXFK.exe CFCRCWJ.exe File created C:\windows\SysWOW64\QYIIPLP.exe.bat ANY.exe File created C:\windows\SysWOW64\EUYVBHG.exe.bat PMXWUT.exe File created C:\windows\SysWOW64\QHYQKZ.exe.bat TKSBVX.exe File created C:\windows\SysWOW64\DJHYZWT.exe.bat UJFLWR.exe File created C:\windows\SysWOW64\NSJ.exe.bat LCQ.exe File created C:\windows\SysWOW64\BBNCK.exe.bat QJK.exe File opened for modification C:\windows\SysWOW64\ANY.exe ZSUW.exe File created C:\windows\SysWOW64\KIZM.exe.bat ALUA.exe File created C:\windows\SysWOW64\ZFKRNNS.exe GCYVI.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\YSCT.exe QHTR.exe File created C:\windows\system\PEVE.exe.bat IYBJ.exe File created C:\windows\system\OIUPLD.exe.bat ELPCVV.exe File created C:\windows\LNCVQPT.exe.bat MXJA.exe File created C:\windows\system\ECGCM.exe WWCVB.exe File opened for modification C:\windows\TERUCRX.exe ILWCU.exe File created C:\windows\system\ESGAUZN.exe APHN.exe File opened for modification C:\windows\VCNOOOE.exe VWNINJ.exe File created C:\windows\EMVCIDM.exe.bat RBMM.exe File opened for modification C:\windows\ELPCVV.exe UNBIOMF.exe File created C:\windows\system\GZUW.exe.bat ECGCM.exe File created C:\windows\ZFBVM.exe.bat OFMKV.exe File opened for modification C:\windows\system\EBIAJXJ.exe WRZHV.exe File created C:\windows\APHN.exe YSCT.exe File created C:\windows\ZDOZI.exe ESGAUZN.exe File created C:\windows\system\FPYGOB.exe.bat EMVCIDM.exe File created C:\windows\system\LRQWT.exe UGN.exe File opened for modification C:\windows\system\SFHMPSC.exe EUYVBHG.exe File created C:\windows\LCQ.exe DJHYZWT.exe File created C:\windows\CEFPVI.exe.bat YOZP.exe File opened for modification C:\windows\EMVCIDM.exe RBMM.exe File created C:\windows\system\LRQWT.exe.bat UGN.exe File created C:\windows\system\GCYVI.exe LRQWT.exe File created C:\windows\system\OCRGM.exe QGRFHCI.exe File opened for modification C:\windows\system\PMXWUT.exe WJTAOWI.exe File created C:\windows\LQGY.exe LNCVQPT.exe File opened for modification C:\windows\OFMKV.exe GZUW.exe File created C:\windows\system\LYEO.exe.bat ZFBVM.exe File opened for modification C:\windows\system\LRQWT.exe UGN.exe File created C:\windows\system\OCRGM.exe.bat QGRFHCI.exe File opened for modification C:\windows\JPNXWFM.exe OCRGM.exe File created C:\windows\system\PMXWUT.exe.bat WJTAOWI.exe File opened for modification C:\windows\APHN.exe YSCT.exe File created C:\windows\CEFPVI.exe YOZP.exe File created C:\windows\VCNOOOE.exe.bat VWNINJ.exe File created C:\windows\ZSUW.exe VCNOOOE.exe File created C:\windows\XQNHWT.exe.bat ZFKRNNS.exe File created C:\windows\system\XSHL.exe PEVE.exe File created C:\windows\WJTAOWI.exe.bat WGIXB.exe File created C:\windows\system\SFHMPSC.exe EUYVBHG.exe File created C:\windows\VWNINJ.exe.bat CEFPVI.exe File created C:\windows\system\IYBJ.exe.bat IVRY.exe File opened for modification C:\windows\system\PEVE.exe IYBJ.exe File created C:\windows\GTBO.exe HVIL.exe File created C:\windows\system\WRZHV.exe.bat LYEO.exe File opened for modification C:\windows\system\DQU.exe XFYG.exe File created C:\windows\system\ILKTU.exe.bat OXFK.exe File opened for modification C:\windows\system\ESGAUZN.exe APHN.exe File created C:\windows\YOZP.exe ZDOZI.exe File created C:\windows\system\SJV.exe.bat XZN.exe File created C:\windows\UUFWQ.exe YOFKOI.exe File created C:\windows\system\PQPMZYQ.exe XQNHWT.exe File created C:\windows\CBXLNBD.exe.bat PQPMZYQ.exe File opened for modification C:\windows\system\QGRFHCI.exe RRYK.exe File created C:\windows\JPNXWFM.exe OCRGM.exe File created C:\windows\JPNXWFM.exe.bat OCRGM.exe File created C:\windows\IVRY.exe.bat 2026-08-10_7f1ffe289cf89891d052814bff7f3a69_elex_emotet_stop.exe File created C:\windows\system\WGIXB.exe SYB.exe File created C:\windows\system\ZOGKGRM.exe.bat LQGY.exe File created C:\windows\system\UJFLWR.exe OJXX.exe File opened for modification C:\windows\system\ILKTU.exe OXFK.exe File created C:\windows\system\ESGAUZN.exe.bat APHN.exe File created C:\windows\VCNOOOE.exe VWNINJ.exe File opened for modification C:\windows\UNBIOMF.exe NXAJH.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2408 cmd.exe 900 cmd.exe 1632 cmd.exe 4304 cmd.exe 5112 cmd.exe 5796 cmd.exe 5752 cmd.exe 5576 cmd.exe 1228 cmd.exe 2544 cmd.exe 4168 cmd.exe 4856 cmd.exe 3532 cmd.exe 3328 cmd.exe 2744 cmd.exe 4624 cmd.exe 5912 cmd.exe 4260 cmd.exe 1544 cmd.exe 1428 cmd.exe 5264 cmd.exe 3268 cmd.exe 2932 cmd.exe 5380 cmd.exe 4460 cmd.exe 4924 cmd.exe 3032 cmd.exe 4652 cmd.exe 540 cmd.exe 2368 cmd.exe 5616 cmd.exe 6132 cmd.exe 1932 cmd.exe 5336 cmd.exe 2712 cmd.exe 4708 cmd.exe 5416 cmd.exe 3312 cmd.exe 4236 cmd.exe 3356 cmd.exe 5244 cmd.exe 4080 cmd.exe 5440 cmd.exe 5520 cmd.exe 1424 cmd.exe 560 cmd.exe 5032 cmd.exe 2308 cmd.exe 6128 cmd.exe 6072 cmd.exe 2476 cmd.exe 4132 cmd.exe 2972 cmd.exe 5568 cmd.exe 6008 cmd.exe 2588 cmd.exe 5680 cmd.exe 4684 cmd.exe 2620 cmd.exe 5812 cmd.exe 4328 cmd.exe 3420 cmd.exe 3272 cmd.exe 248 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 5844 4224 WerFault.exe 87 3532 4724 WerFault.exe 93 4828 4760 WerFault.exe 99 3544 4484 WerFault.exe 104 5132 4948 WerFault.exe 109 4252 3548 WerFault.exe 114 2136 3460 WerFault.exe 119 1352 5116 WerFault.exe 124 1576 3060 WerFault.exe 129 3788 5712 WerFault.exe 134 4804 5340 WerFault.exe 139 4664 3048 WerFault.exe 144 4136 3660 WerFault.exe 149 2076 2776 WerFault.exe 154 2356 5940 WerFault.exe 159 1684 2036 WerFault.exe 164 4232 5132 WerFault.exe 169 6100 704 WerFault.exe 174 1352 5532 WerFault.exe 179 5696 3940 WerFault.exe 184 4116 2848 WerFault.exe 189 1228 696 WerFault.exe 194 4892 2752 WerFault.exe 199 3440 5020 WerFault.exe 204 2152 5544 WerFault.exe 209 1652 4692 WerFault.exe 214 1408 1276 WerFault.exe 219 4392 3004 WerFault.exe 224 5344 4252 WerFault.exe 229 4368 1356 WerFault.exe 234 1496 4952 WerFault.exe 239 5240 6140 WerFault.exe 244 4956 2956 WerFault.exe 249 2456 4876 WerFault.exe 254 5956 3228 WerFault.exe 259 5904 5476 WerFault.exe 264 4764 2560 WerFault.exe 269 5816 2864 WerFault.exe 275 4812 1780 WerFault.exe 280 1832 3428 WerFault.exe 285 5876 3028 WerFault.exe 290 4332 3836 WerFault.exe 295 2004 5612 WerFault.exe 299 1428 1232 WerFault.exe 305 5824 5196 WerFault.exe 310 2984 3508 WerFault.exe 315 2076 4576 WerFault.exe 320 2364 1100 WerFault.exe 325 5572 1836 WerFault.exe 330 5220 4296 WerFault.exe 335 5688 1120 WerFault.exe 340 5868 1092 WerFault.exe 345 2004 3352 WerFault.exe 349 3312 1416 WerFault.exe 355 1544 4804 WerFault.exe 360 4132 2976 WerFault.exe 365 4428 3440 WerFault.exe 370 1740 4556 WerFault.exe 375 6060 5572 WerFault.exe 380 3224 4392 WerFault.exe 385 4332 3084 WerFault.exe 390 540 3896 WerFault.exe 395 2916 3068 WerFault.exe 400 1544 4992 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEFPVI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EBIAJXJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OJXX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OXFK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RRYK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TERUCRX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OIUPLD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QHTR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YOZP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YKC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HVIL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YOFKOI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MXJA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WRZHV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZDOZI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FPYGOB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DQU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CBXLNBD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QGRFHCI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QKXW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YSCT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QYIIPLP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PQPMZYQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XZN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SJV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LRQWT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GCYVI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WGIXB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4224 2026-08-10_7f1ffe289cf89891d052814bff7f3a69_elex_emotet_stop.exe 4224 2026-08-10_7f1ffe289cf89891d052814bff7f3a69_elex_emotet_stop.exe 4724 IVRY.exe 4724 IVRY.exe 4760 IYBJ.exe 4760 IYBJ.exe 4484 PEVE.exe 4484 PEVE.exe 4948 XSHL.exe 4948 XSHL.exe 3548 QKXW.exe 3548 QKXW.exe 3460 DVFVWNA.exe 3460 DVFVWNA.exe 5116 JIEVB.exe 5116 JIEVB.exe 3060 NYLVFJE.exe 3060 NYLVFJE.exe 5712 XZN.exe 5712 XZN.exe 5340 SJV.exe 5340 SJV.exe 3048 NXAJH.exe 3048 NXAJH.exe 3660 UNBIOMF.exe 3660 UNBIOMF.exe 2776 ELPCVV.exe 2776 ELPCVV.exe 5940 OIUPLD.exe 5940 OIUPLD.exe 2036 SYB.exe 2036 SYB.exe 5132 WGIXB.exe 5132 WGIXB.exe 704 WJTAOWI.exe 704 WJTAOWI.exe 5532 PMXWUT.exe 5532 PMXWUT.exe 3940 EUYVBHG.exe 3940 EUYVBHG.exe 2848 SFHMPSC.exe 2848 SFHMPSC.exe 696 HVIL.exe 696 HVIL.exe 2752 GTBO.exe 2752 GTBO.exe 5020 YOFKOI.exe 5020 YOFKOI.exe 5544 UUFWQ.exe 5544 UUFWQ.exe 4692 MXJA.exe 4692 MXJA.exe 1276 LNCVQPT.exe 1276 LNCVQPT.exe 3004 LQGY.exe 3004 LQGY.exe 4252 ZOGKGRM.exe 4252 ZOGKGRM.exe 1356 SGV.exe 1356 SGV.exe 4952 WWCVB.exe 4952 WWCVB.exe 6140 ECGCM.exe 6140 ECGCM.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4224 2026-08-10_7f1ffe289cf89891d052814bff7f3a69_elex_emotet_stop.exe 4224 2026-08-10_7f1ffe289cf89891d052814bff7f3a69_elex_emotet_stop.exe 4724 IVRY.exe 4724 IVRY.exe 4760 IYBJ.exe 4760 IYBJ.exe 4484 PEVE.exe 4484 PEVE.exe 4948 XSHL.exe 4948 XSHL.exe 3548 QKXW.exe 3548 QKXW.exe 3460 DVFVWNA.exe 3460 DVFVWNA.exe 5116 JIEVB.exe 5116 JIEVB.exe 3060 NYLVFJE.exe 3060 NYLVFJE.exe 5712 XZN.exe 5712 XZN.exe 5340 SJV.exe 5340 SJV.exe 3048 NXAJH.exe 3048 NXAJH.exe 3660 UNBIOMF.exe 3660 UNBIOMF.exe 2776 ELPCVV.exe 2776 ELPCVV.exe 5940 OIUPLD.exe 5940 OIUPLD.exe 2036 SYB.exe 2036 SYB.exe 5132 WGIXB.exe 5132 WGIXB.exe 704 WJTAOWI.exe 704 WJTAOWI.exe 5532 PMXWUT.exe 5532 PMXWUT.exe 3940 EUYVBHG.exe 3940 EUYVBHG.exe 2848 SFHMPSC.exe 2848 SFHMPSC.exe 696 HVIL.exe 696 HVIL.exe 2752 GTBO.exe 2752 GTBO.exe 5020 YOFKOI.exe 5020 YOFKOI.exe 5544 UUFWQ.exe 5544 UUFWQ.exe 4692 MXJA.exe 4692 MXJA.exe 1276 LNCVQPT.exe 1276 LNCVQPT.exe 3004 LQGY.exe 3004 LQGY.exe 4252 ZOGKGRM.exe 4252 ZOGKGRM.exe 1356 SGV.exe 1356 SGV.exe 4952 WWCVB.exe 4952 WWCVB.exe 6140 ECGCM.exe 6140 ECGCM.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4224 wrote to memory of 4864 4224 2026-08-10_7f1ffe289cf89891d052814bff7f3a69_elex_emotet_stop.exe 89 PID 4864 wrote to memory of 4724 4864 cmd.exe 93 PID 4724 wrote to memory of 4816 4724 IVRY.exe 95 PID 4816 wrote to memory of 4760 4816 cmd.exe 99 PID 4760 wrote to memory of 2540 4760 IYBJ.exe 100 PID 2540 wrote to memory of 4484 2540 cmd.exe 104 PID 4484 wrote to memory of 6132 4484 PEVE.exe 105 PID 6132 wrote to memory of 4948 6132 cmd.exe 109 PID 4948 wrote to memory of 5264 4948 XSHL.exe 110 PID 5264 wrote to memory of 3548 5264 cmd.exe 114 PID 3548 wrote to memory of 4688 3548 QKXW.exe 115 PID 4688 wrote to memory of 3460 4688 cmd.exe 119 PID 3460 wrote to memory of 5784 3460 DVFVWNA.exe 120 PID 5784 wrote to memory of 5116 5784 cmd.exe 124 PID 5116 wrote to memory of 4460 5116 JIEVB.exe 125 PID 4460 wrote to memory of 3060 4460 cmd.exe 129 PID 3060 wrote to memory of 1392 3060 NYLVFJE.exe 130 PID 1392 wrote to memory of 5712 1392 cmd.exe 134 PID 5712 wrote to memory of 1932 5712 XZN.exe 135 PID 1932 wrote to memory of 5340 1932 cmd.exe 139 PID 5340 wrote to memory of 5952 5340 SJV.exe 140 PID 5952 wrote to memory of 3048 5952 cmd.exe 144 PID 3048 wrote to memory of 5336 3048 NXAJH.exe 145 PID 5336 wrote to memory of 3660 5336 cmd.exe 149 PID 3660 wrote to memory of 4520 3660 UNBIOMF.exe 150 PID 4520 wrote to memory of 2776 4520 cmd.exe 154 PID 2776 wrote to memory of 2368 2776 ELPCVV.exe 155 PID 2368 wrote to memory of 5940 2368 cmd.exe 159 PID 5940 wrote to memory of 256 5940 OIUPLD.exe 160 PID 256 wrote to memory of 2036 256 cmd.exe 164 PID 2036 wrote to memory of 4256 2036 SYB.exe 165 PID 4256 wrote to memory of 5132 4256 cmd.exe 169 PID 5132 wrote to memory of 4924 5132 WGIXB.exe 170 PID 4924 wrote to memory of 704 4924 cmd.exe 174 PID 704 wrote to memory of 3664 704 WJTAOWI.exe 175 PID 3664 wrote to memory of 5532 3664 cmd.exe 179 PID 5532 wrote to memory of 5520 5532 PMXWUT.exe 180 PID 5520 wrote to memory of 3940 5520 cmd.exe 184 PID 3940 wrote to memory of 5744 3940 EUYVBHG.exe 185 PID 5744 wrote to memory of 2848 5744 cmd.exe 189 PID 2848 wrote to memory of 4320 2848 SFHMPSC.exe 190 PID 4320 wrote to memory of 696 4320 cmd.exe 194 PID 696 wrote to memory of 4900 696 HVIL.exe 195 PID 4900 wrote to memory of 2752 4900 cmd.exe 199 PID 2752 wrote to memory of 3272 2752 GTBO.exe 200 PID 3272 wrote to memory of 5020 3272 cmd.exe 204 PID 5020 wrote to memory of 6008 5020 YOFKOI.exe 205 PID 6008 wrote to memory of 5544 6008 cmd.exe 209 PID 5544 wrote to memory of 3756 5544 UUFWQ.exe 210 PID 3756 wrote to memory of 4692 3756 cmd.exe 214 PID 4692 wrote to memory of 248 4692 MXJA.exe 215 PID 248 wrote to memory of 1276 248 cmd.exe 219 PID 1276 wrote to memory of 2996 1276 LNCVQPT.exe 220 PID 2996 wrote to memory of 3004 2996 cmd.exe 224 PID 3004 wrote to memory of 2296 3004 LQGY.exe 225 PID 2296 wrote to memory of 4252 2296 cmd.exe 229 PID 4252 wrote to memory of 3008 4252 ZOGKGRM.exe 230 PID 3008 wrote to memory of 1356 3008 cmd.exe 234 PID 1356 wrote to memory of 1424 1356 SGV.exe 235 PID 1424 wrote to memory of 4952 1424 cmd.exe 239 PID 4952 wrote to memory of 2632 4952 WWCVB.exe 240 PID 2632 wrote to memory of 6140 2632 cmd.exe 244 PID 6140 wrote to memory of 1532 6140 ECGCM.exe 245 PID 1532 wrote to memory of 2956 1532 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_7f1ffe289cf89891d052814bff7f3a69_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_7f1ffe289cf89891d052814bff7f3a69_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IVRY.exe.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\windows\IVRY.exeC:\windows\IVRY.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IYBJ.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\windows\system\IYBJ.exeC:\windows\system\IYBJ.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PEVE.exe.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\windows\system\PEVE.exeC:\windows\system\PEVE.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XSHL.exe.bat" "8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6132 -
C:\windows\system\XSHL.exeC:\windows\system\XSHL.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QKXW.exe.bat" "10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5264 -
C:\windows\SysWOW64\QKXW.exeC:\windows\system32\QKXW.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DVFVWNA.exe.bat" "12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\windows\SysWOW64\DVFVWNA.exeC:\windows\system32\DVFVWNA.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JIEVB.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:5784 -
C:\windows\SysWOW64\JIEVB.exeC:\windows\system32\JIEVB.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NYLVFJE.exe.bat" "16⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\windows\SysWOW64\NYLVFJE.exeC:\windows\system32\NYLVFJE.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XZN.exe.bat" "18⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\windows\SysWOW64\XZN.exeC:\windows\system32\XZN.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SJV.exe.bat" "20⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\windows\system\SJV.exeC:\windows\system\SJV.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5340 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NXAJH.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:5952 -
C:\windows\SysWOW64\NXAJH.exeC:\windows\system32\NXAJH.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UNBIOMF.exe.bat" "24⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5336 -
C:\windows\UNBIOMF.exeC:\windows\UNBIOMF.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ELPCVV.exe.bat" "26⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\windows\ELPCVV.exeC:\windows\ELPCVV.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OIUPLD.exe.bat" "28⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\windows\system\OIUPLD.exeC:\windows\system\OIUPLD.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SYB.exe.bat" "30⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:256 -
C:\windows\SysWOW64\SYB.exeC:\windows\system32\SYB.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WGIXB.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\windows\system\WGIXB.exeC:\windows\system\WGIXB.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WJTAOWI.exe.bat" "34⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\windows\WJTAOWI.exeC:\windows\WJTAOWI.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PMXWUT.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:3664 -
C:\windows\system\PMXWUT.exeC:\windows\system\PMXWUT.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EUYVBHG.exe.bat" "38⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5520 -
C:\windows\SysWOW64\EUYVBHG.exeC:\windows\system32\EUYVBHG.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SFHMPSC.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:5744 -
C:\windows\system\SFHMPSC.exeC:\windows\system\SFHMPSC.exe41⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HVIL.exe.bat" "42⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\windows\HVIL.exeC:\windows\HVIL.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GTBO.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\windows\GTBO.exeC:\windows\GTBO.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YOFKOI.exe.bat" "46⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3272 -
C:\windows\SysWOW64\YOFKOI.exeC:\windows\system32\YOFKOI.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UUFWQ.exe.bat" "48⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6008 -
C:\windows\UUFWQ.exeC:\windows\UUFWQ.exe49⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MXJA.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:3756 -
C:\windows\system\MXJA.exeC:\windows\system\MXJA.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LNCVQPT.exe.bat" "52⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:248 -
C:\windows\LNCVQPT.exeC:\windows\LNCVQPT.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LQGY.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\windows\LQGY.exeC:\windows\LQGY.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZOGKGRM.exe.bat" "56⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\windows\system\ZOGKGRM.exeC:\windows\system\ZOGKGRM.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SGV.exe.bat" "58⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\windows\SysWOW64\SGV.exeC:\windows\system32\SGV.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WWCVB.exe.bat" "60⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\windows\SysWOW64\WWCVB.exeC:\windows\system32\WWCVB.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ECGCM.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\windows\system\ECGCM.exeC:\windows\system\ECGCM.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GZUW.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\windows\system\GZUW.exeC:\windows\system\GZUW.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OFMKV.exe.bat" "66⤵
- Executes a command shell one-liner
PID:5616 -
C:\windows\OFMKV.exeC:\windows\OFMKV.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZFBVM.exe.bat" "68⤵PID:3316
-
C:\windows\ZFBVM.exeC:\windows\ZFBVM.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3228 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LYEO.exe.bat" "70⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5380 -
C:\windows\system\LYEO.exeC:\windows\system\LYEO.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WRZHV.exe.bat" "72⤵PID:6044
-
C:\windows\system\WRZHV.exeC:\windows\system\WRZHV.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EBIAJXJ.exe.bat" "74⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5032 -
C:\windows\system\EBIAJXJ.exeC:\windows\system\EBIAJXJ.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AHOXQZK.exe.bat" "76⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2588 -
C:\windows\SysWOW64\AHOXQZK.exeC:\windows\system32\AHOXQZK.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TKSBVX.exe.bat" "78⤵
- Executes a command shell one-liner
PID:3268 -
C:\windows\SysWOW64\TKSBVX.exeC:\windows\system32\TKSBVX.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QHYQKZ.exe.bat" "80⤵
- Executes a command shell one-liner
PID:5416 -
C:\windows\SysWOW64\QHYQKZ.exeC:\windows\system32\QHYQKZ.exe81⤵
- Executes dropped EXE
PID:3028 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BATJKOD.exe.bat" "82⤵
- Executes a command shell one-liner
PID:2408 -
C:\windows\BATJKOD.exeC:\windows\BATJKOD.exe83⤵
- Executes dropped EXE
PID:3836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XFYG.exe.bat" "84⤵PID:2880
-
C:\windows\XFYG.exeC:\windows\XFYG.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DQU.exe.bat" "86⤵PID:4904
-
C:\windows\system\DQU.exeC:\windows\system\DQU.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1232 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OJXX.exe.bat" "88⤵
- System Location Discovery: System Language Discovery
PID:968 -
C:\windows\SysWOW64\OJXX.exeC:\windows\system32\OJXX.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5196 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UJFLWR.exe.bat" "90⤵
- System Location Discovery: System Language Discovery
PID:5748 -
C:\windows\system\UJFLWR.exeC:\windows\system\UJFLWR.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DJHYZWT.exe.bat" "92⤵
- System Location Discovery: System Language Discovery
PID:5060 -
C:\windows\SysWOW64\DJHYZWT.exeC:\windows\system32\DJHYZWT.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LCQ.exe.bat" "94⤵PID:2088
-
C:\windows\LCQ.exeC:\windows\LCQ.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NSJ.exe.bat" "96⤵
- System Location Discovery: System Language Discovery
PID:2824 -
C:\windows\SysWOW64\NSJ.exeC:\windows\system32\NSJ.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YKMN.exe.bat" "98⤵PID:5816
-
C:\windows\SysWOW64\YKMN.exeC:\windows\system32\YKMN.exe99⤵
- Executes dropped EXE
PID:4296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JQXKG.exe.bat" "100⤵PID:5720
-
C:\windows\JQXKG.exeC:\windows\JQXKG.exe101⤵
- Executes dropped EXE
PID:1120 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LGQMNA.exe.bat" "102⤵
- System Location Discovery: System Language Discovery
PID:3748 -
C:\windows\LGQMNA.exeC:\windows\LGQMNA.exe103⤵
- Executes dropped EXE
PID:1092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ILWCU.exe.bat" "104⤵
- System Location Discovery: System Language Discovery
PID:2256 -
C:\windows\ILWCU.exeC:\windows\ILWCU.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TERUCRX.exe.bat" "106⤵PID:2904
-
C:\windows\TERUCRX.exeC:\windows\TERUCRX.exe107⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YPVBHI.exe.bat" "108⤵PID:2788
-
C:\windows\system\YPVBHI.exeC:\windows\system\YPVBHI.exe109⤵
- Executes dropped EXE
PID:4804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GZE.exe.bat" "110⤵PID:5004
-
C:\windows\GZE.exeC:\windows\GZE.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CFCRCWJ.exe.bat" "112⤵PID:1848
-
C:\windows\SysWOW64\CFCRCWJ.exeC:\windows\system32\CFCRCWJ.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OXFK.exe.bat" "114⤵
- Executes a command shell one-liner
PID:3532 -
C:\windows\SysWOW64\OXFK.exeC:\windows\system32\OXFK.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ILKTU.exe.bat" "116⤵PID:3544
-
C:\windows\system\ILKTU.exeC:\windows\system\ILKTU.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KJDWTA.exe.bat" "118⤵
- Executes a command shell one-liner
PID:2712 -
C:\windows\SysWOW64\KJDWTA.exeC:\windows\system32\KJDWTA.exe119⤵
- Executes dropped EXE
PID:4392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QJK.exe.bat" "120⤵PID:3204
-
C:\windows\system\QJK.exeC:\windows\system\QJK.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3084
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-