Analysis
- max time kernel
84s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
12/08/2026, 22:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-12_651b369fca0f64b9abf2fa37fa949ea0_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-12_651b369fca0f64b9abf2fa37fa949ea0_elex_emotet_stop.exe
- Size 208KB
- Sample260812-2ba2rafk6y
- SHA256 d3315b9766a1ee08979b188eb559a5396c4842cd5e47c76c4376620999bb72c7
- MD5 651b369fca0f64b9abf2fa37fa949ea0
- SHA1 d1123ecf4f7fad44ff0894c5bc9ae5b18adbba98
- SHA512 73ccacd2e4ff23064433c4259ede428ff91228e77b661b26ff6a075b3d3da906ebd4fa79ac50ba224c64c6ec400d81f58926d83ac49cd7371a2aa8f3a3149e8f
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFledL+LOfj4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFle5+LO7kEj1
- TLSH T192247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3160 FYVCHN.exe 3204 JEUYBDB.exe 3244 YUVXHZ.exe 1756 CCB.exe 2664 GSQXY.exe 1688 HNUB.exe 2052 PBYI.exe 5416 VWK.exe 1932 OOAT.exe 4628 BMAFVZF.exe 5384 TUOCAQI.exe 4400 BATJKOD.exe 3172 SIHOXFY.exe 2460 EWO.exe 5160 IBYCSC.exe 1516 UEJ.exe 1456 CUKGIC.exe 1692 MSXB.exe 3776 MVOWEUS.exe 2548 HIS.exe 3004 RGYAWC.exe 1360 GWZS.exe 5580 KMGAPIA.exe 5036 OUMA.exe 2072 UQMAXDE.exe 4220 PDQS.exe 3880 NBKNDIA.exe 5024 IOOW.exe 4536 JRSASY.exe 1240 ZCVQT.exe 5008 JZBC.exe 3652 TADPMS.exe 3408 YAK.exe 928 QIMI.exe 5196 SGSC.exe 2472 WOGCAS.exe 1192 YCL.exe 3380 YPDA.exe 3644 EPLOVZ.exe 124 IXS.exe 2060 DLXGR.exe 4552 SBY.exe 6096 HEPJJA.exe 1400 REJ.exe 1976 RHVK.exe 4212 TFAE.exe 4872 BKFL.exe 1968 GLP.exe 3840 IJUIDHZ.exe 1780 JEYL.exe 3104 NUNLVP.exe 2216 AFVKJS.exe 5568 GSULOVZ.exe 4696 EQGOBA.exe 5808 XTKKO.exe 6060 OTMPSV.exe 2424 CECN.exe 5132 LEESJDQ.exe 4248 REMGTGR.exe 5932 ZKE.exe 1176 XKLIL.exe 3744 ZGQSNNK.exe 2000 UTVJ.exe 5652 NWZ.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\CUKGIC.exe UEJ.exe File created C:\windows\SysWOW64\MVOWEUS.exe.bat MSXB.exe File opened for modification C:\windows\SysWOW64\YAK.exe TADPMS.exe File created C:\windows\SysWOW64\CECN.exe.bat OTMPSV.exe File created C:\windows\SysWOW64\LEESJDQ.exe.bat CECN.exe File created C:\windows\SysWOW64\YQVG.exe.bat ZFSYS.exe File opened for modification C:\windows\SysWOW64\WZDLBKE.exe IYFDD.exe File created C:\windows\SysWOW64\OCVE.exe EEIREJ.exe File created C:\windows\SysWOW64\JEYL.exe IJUIDHZ.exe File created C:\windows\SysWOW64\GSULOVZ.exe.bat AFVKJS.exe File opened for modification C:\windows\SysWOW64\ZDVVNL.exe ESM.exe File created C:\windows\SysWOW64\YNN.exe.bat OPHI.exe File created C:\windows\SysWOW64\JRSASY.exe.bat IOOW.exe File opened for modification C:\windows\SysWOW64\PBYI.exe HNUB.exe File opened for modification C:\windows\SysWOW64\MVOWEUS.exe MSXB.exe File created C:\windows\SysWOW64\YNN.exe OPHI.exe File opened for modification C:\windows\SysWOW64\YNN.exe OPHI.exe File created C:\windows\SysWOW64\IYFDD.exe.bat GAZ.exe File opened for modification C:\windows\SysWOW64\EEIREJ.exe WZDLBKE.exe File created C:\windows\SysWOW64\BDC.exe.bat XNWJVE.exe File created C:\windows\SysWOW64\YPDA.exe.bat YCL.exe File created C:\windows\SysWOW64\EPLOVZ.exe.bat YPDA.exe File opened for modification C:\windows\SysWOW64\GLP.exe BKFL.exe File created C:\windows\SysWOW64\JEYL.exe.bat IJUIDHZ.exe File created C:\windows\SysWOW64\VWK.exe PBYI.exe File created C:\windows\SysWOW64\EWO.exe.bat SIHOXFY.exe File created C:\windows\SysWOW64\YAK.exe.bat TADPMS.exe File created C:\windows\SysWOW64\YPDA.exe YCL.exe File created C:\windows\SysWOW64\PDQS.exe UQMAXDE.exe File opened for modification C:\windows\SysWOW64\EPLOVZ.exe YPDA.exe File created C:\windows\SysWOW64\GLP.exe.bat BKFL.exe File created C:\windows\SysWOW64\ZFSYS.exe PHEEDT.exe File opened for modification C:\windows\SysWOW64\YQVG.exe ZFSYS.exe File created C:\windows\SysWOW64\ZDVVNL.exe ESM.exe File opened for modification C:\windows\SysWOW64\PPYCD.exe FRL.exe File created C:\windows\SysWOW64\NPQONW.exe JHKO.exe File opened for modification C:\windows\SysWOW64\PDQS.exe UQMAXDE.exe File opened for modification C:\windows\SysWOW64\NWZ.exe UTVJ.exe File created C:\windows\SysWOW64\ZFSYS.exe.bat PHEEDT.exe File created C:\windows\SysWOW64\EEIREJ.exe WZDLBKE.exe File opened for modification C:\windows\SysWOW64\OCVE.exe EEIREJ.exe File created C:\windows\SysWOW64\PBYI.exe HNUB.exe File opened for modification C:\windows\SysWOW64\EWO.exe SIHOXFY.exe File created C:\windows\SysWOW64\RHVK.exe REJ.exe File opened for modification C:\windows\SysWOW64\AFVKJS.exe NUNLVP.exe File created C:\windows\SysWOW64\CECN.exe OTMPSV.exe File created C:\windows\SysWOW64\LEESJDQ.exe CECN.exe File opened for modification C:\windows\SysWOW64\LEESJDQ.exe CECN.exe File created C:\windows\SysWOW64\ZKE.exe REMGTGR.exe File created C:\windows\SysWOW64\AFVKJS.exe.bat NUNLVP.exe File created C:\windows\SysWOW64\NWZ.exe UTVJ.exe File opened for modification C:\windows\SysWOW64\SWG.exe NWZ.exe File created C:\windows\SysWOW64\VOF.exe.bat DLBEZW.exe File created C:\windows\SysWOW64\IYFDD.exe GAZ.exe File created C:\windows\SysWOW64\EWO.exe SIHOXFY.exe File created C:\windows\SysWOW64\IBYCSC.exe.bat EWO.exe File created C:\windows\SysWOW64\SWG.exe NWZ.exe File created C:\windows\SysWOW64\ZDVVNL.exe.bat ESM.exe File opened for modification C:\windows\SysWOW64\VOF.exe DLBEZW.exe File opened for modification C:\windows\SysWOW64\BMAFVZF.exe OOAT.exe File created C:\windows\SysWOW64\JRSASY.exe IOOW.exe File opened for modification C:\windows\SysWOW64\YPDA.exe YCL.exe File created C:\windows\SysWOW64\GSULOVZ.exe AFVKJS.exe File created C:\windows\SysWOW64\YQVG.exe ZFSYS.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\HNUB.exe GSQXY.exe File opened for modification C:\windows\REJ.exe HEPJJA.exe File created C:\windows\XTKKO.exe.bat EQGOBA.exe File opened for modification C:\windows\system\ZGQSNNK.exe XKLIL.exe File created C:\windows\system\UTVJ.exe.bat ZGQSNNK.exe File opened for modification C:\windows\system\PHEEDT.exe JHX.exe File created C:\windows\DDLXWQF.exe.bat ZXAH.exe File created C:\windows\system\YUVXHZ.exe.bat JEUYBDB.exe File created C:\windows\NBKNDIA.exe PDQS.exe File created C:\windows\system\OTMPSV.exe.bat XTKKO.exe File opened for modification C:\windows\PEESV.exe WMPHDTJ.exe File created C:\windows\HNUB.exe GSQXY.exe File created C:\windows\system\ZCVQT.exe JRSASY.exe File created C:\windows\system\SGSC.exe.bat QIMI.exe File created C:\windows\REMGTGR.exe.bat LEESJDQ.exe File created C:\windows\DJL.exe DDLXWQF.exe File created C:\windows\MTNHEF.exe.bat IDH.exe File opened for modification C:\windows\SIHOXFY.exe BATJKOD.exe File created C:\windows\SIHOXFY.exe.bat BATJKOD.exe File created C:\windows\IOOW.exe.bat NBKNDIA.exe File created C:\windows\system\HEPJJA.exe SBY.exe File created C:\windows\IJUIDHZ.exe.bat GLP.exe File created C:\windows\system\IWRLY.exe YZLRRE.exe File created C:\windows\WRRD.exe VOF.exe File created C:\windows\WRRD.exe.bat VOF.exe File created C:\windows\TUOCAQI.exe BMAFVZF.exe File opened for modification C:\windows\system\SGSC.exe QIMI.exe File created C:\windows\XTKKO.exe EQGOBA.exe File created C:\windows\system\PHEEDT.exe JHX.exe File created C:\windows\system\PHEEDT.exe.bat JHX.exe File created C:\windows\system\IWRLY.exe.bat YZLRRE.exe File opened for modification C:\windows\CQIGNK.exe BNEC.exe File created C:\windows\AZI.exe.bat ZEEG.exe File created C:\windows\YCL.exe.bat WOGCAS.exe File opened for modification C:\windows\system\OUMA.exe KMGAPIA.exe File opened for modification C:\windows\system\GWZS.exe RGYAWC.exe File created C:\windows\system\ZGQSNNK.exe.bat XKLIL.exe File created C:\windows\XNWJVE.exe.bat NPQONW.exe File created C:\windows\GSQXY.exe CCB.exe File opened for modification C:\windows\GSQXY.exe CCB.exe File opened for modification C:\windows\EQGOBA.exe GSULOVZ.exe File created C:\windows\AZI.exe ZEEG.exe File opened for modification C:\windows\JHKO.exe AZI.exe File opened for modification C:\windows\FYVCHN.exe 2026-08-12_651b369fca0f64b9abf2fa37fa949ea0_elex_emotet_stop.exe File opened for modification C:\windows\RGYAWC.exe HIS.exe File created C:\windows\system\ZCVQT.exe.bat JRSASY.exe File created C:\windows\JHKO.exe AZI.exe File created C:\windows\FYVCHN.exe.bat 2026-08-12_651b369fca0f64b9abf2fa37fa949ea0_elex_emotet_stop.exe File created C:\windows\JEUYBDB.exe.bat FYVCHN.exe File created C:\windows\SBY.exe DLXGR.exe File opened for modification C:\windows\JHX.exe SWG.exe File created C:\windows\IDH.exe CQIGNK.exe File created C:\windows\system\GWZS.exe RGYAWC.exe File created C:\windows\KMGAPIA.exe.bat GWZS.exe File opened for modification C:\windows\UQMAXDE.exe OUMA.exe File opened for modification C:\windows\YCL.exe WOGCAS.exe File opened for modification C:\windows\system\TFAE.exe RHVK.exe File created C:\windows\system\TFAE.exe.bat RHVK.exe File created C:\windows\EQGOBA.exe.bat GSULOVZ.exe File opened for modification C:\windows\system\GAZ.exe YNN.exe File created C:\windows\system\HEPJJA.exe.bat SBY.exe File created C:\windows\PEESV.exe WMPHDTJ.exe File opened for modification C:\windows\BNEC.exe OCVE.exe File opened for modification C:\windows\MTNHEF.exe IDH.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 6052 cmd.exe 5856 cmd.exe 4080 cmd.exe 5828 cmd.exe 5576 cmd.exe 3856 cmd.exe 2372 cmd.exe 1736 cmd.exe 2516 cmd.exe 1308 cmd.exe 2820 cmd.exe 5380 cmd.exe 1284 cmd.exe 2748 cmd.exe 3420 cmd.exe 5688 cmd.exe 1892 cmd.exe 4516 cmd.exe 2752 cmd.exe 4500 cmd.exe 2464 cmd.exe 4344 cmd.exe 3224 cmd.exe 2148 cmd.exe 5412 cmd.exe 2160 cmd.exe 2896 cmd.exe 4724 cmd.exe 4188 cmd.exe 4736 cmd.exe 2796 cmd.exe 5948 cmd.exe 4504 cmd.exe 4388 cmd.exe 4392 cmd.exe 4424 cmd.exe 2616 cmd.exe 5408 cmd.exe 1744 cmd.exe 5096 cmd.exe 5756 cmd.exe 3716 cmd.exe 4164 cmd.exe 5272 cmd.exe 5704 cmd.exe 3416 cmd.exe 5892 cmd.exe 3500 cmd.exe 1956 cmd.exe 2068 cmd.exe 2872 cmd.exe 5052 cmd.exe 2376 cmd.exe 4264 cmd.exe 4940 cmd.exe 2952 cmd.exe 436 cmd.exe 4484 cmd.exe 1184 cmd.exe 2552 cmd.exe 5728 cmd.exe 3100 cmd.exe 5804 cmd.exe 4128 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 4336 4596 WerFault.exe 88 4152 3160 WerFault.exe 93 4056 3204 WerFault.exe 99 3312 3244 WerFault.exe 104 1824 1756 WerFault.exe 109 1568 2664 WerFault.exe 114 4492 1688 WerFault.exe 119 4284 2052 WerFault.exe 124 2148 5416 WerFault.exe 129 3360 1932 WerFault.exe 134 5420 4628 WerFault.exe 139 1812 5384 WerFault.exe 144 2428 4400 WerFault.exe 149 4056 3172 WerFault.exe 154 1904 2460 WerFault.exe 159 6072 5160 WerFault.exe 164 1168 1516 WerFault.exe 169 1792 1456 WerFault.exe 174 4140 1692 WerFault.exe 179 4356 3776 WerFault.exe 184 5852 2548 WerFault.exe 189 1324 3004 WerFault.exe 194 3408 1360 WerFault.exe 199 5148 5580 WerFault.exe 204 5272 5036 WerFault.exe 209 2948 2072 WerFault.exe 214 1168 4220 WerFault.exe 219 1744 3880 WerFault.exe 224 5844 5024 WerFault.exe 229 5004 4536 WerFault.exe 234 5852 1240 WerFault.exe 239 5664 5008 WerFault.exe 244 6084 3652 WerFault.exe 249 4056 3408 WerFault.exe 254 5272 928 WerFault.exe 259 4452 5196 WerFault.exe 264 6060 2472 WerFault.exe 270 3716 1192 WerFault.exe 275 4384 3380 WerFault.exe 280 2340 3644 WerFault.exe 285 4260 124 WerFault.exe 290 2980 2060 WerFault.exe 295 5728 4552 WerFault.exe 300 5676 6096 WerFault.exe 305 3000 1400 WerFault.exe 310 4236 1976 WerFault.exe 315 1608 4212 WerFault.exe 320 5540 4872 WerFault.exe 325 5708 1968 WerFault.exe 330 4924 3840 WerFault.exe 335 2280 1780 WerFault.exe 340 6084 3104 WerFault.exe 345 3888 2216 WerFault.exe 350 3548 5568 WerFault.exe 355 3096 4696 WerFault.exe 360 5220 5808 WerFault.exe 365 4768 6060 WerFault.exe 370 2584 2424 WerFault.exe 375 5140 5132 WerFault.exe 380 5692 4248 WerFault.exe 385 2684 5932 WerFault.exe 390 4896 1176 WerFault.exe 395 3548 3744 WerFault.exe 400 2896 2000 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YAK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AFVKJS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JHX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GAZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HNUB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REMGTGR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EEIREJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OCVE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OOAT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XTKKO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XKLIL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BATJKOD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BMAFVZF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CUKGIC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JEYL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ESM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OUMA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UQMAXDE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZEEG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JHKO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PBYI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RHVK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IJUIDHZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PHEEDT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YZLRRE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EPLOVZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DLBEZW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WRRD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZXAH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MVOWEUS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GLP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BKFL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AZI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SGSC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EQGOBA.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4596 2026-08-12_651b369fca0f64b9abf2fa37fa949ea0_elex_emotet_stop.exe 4596 2026-08-12_651b369fca0f64b9abf2fa37fa949ea0_elex_emotet_stop.exe 3160 FYVCHN.exe 3160 FYVCHN.exe 3204 JEUYBDB.exe 3204 JEUYBDB.exe 3244 YUVXHZ.exe 3244 YUVXHZ.exe 1756 CCB.exe 1756 CCB.exe 2664 GSQXY.exe 2664 GSQXY.exe 1688 HNUB.exe 1688 HNUB.exe 2052 PBYI.exe 2052 PBYI.exe 5416 VWK.exe 5416 VWK.exe 1932 OOAT.exe 1932 OOAT.exe 4628 BMAFVZF.exe 4628 BMAFVZF.exe 5384 TUOCAQI.exe 5384 TUOCAQI.exe 4400 BATJKOD.exe 4400 BATJKOD.exe 3172 SIHOXFY.exe 3172 SIHOXFY.exe 2460 EWO.exe 2460 EWO.exe 5160 IBYCSC.exe 5160 IBYCSC.exe 1516 UEJ.exe 1516 UEJ.exe 1456 CUKGIC.exe 1456 CUKGIC.exe 1692 MSXB.exe 1692 MSXB.exe 3776 MVOWEUS.exe 3776 MVOWEUS.exe 2548 HIS.exe 2548 HIS.exe 3004 RGYAWC.exe 3004 RGYAWC.exe 1360 GWZS.exe 1360 GWZS.exe 5580 KMGAPIA.exe 5580 KMGAPIA.exe 5036 OUMA.exe 5036 OUMA.exe 2072 UQMAXDE.exe 2072 UQMAXDE.exe 4220 PDQS.exe 4220 PDQS.exe 3880 NBKNDIA.exe 3880 NBKNDIA.exe 5024 IOOW.exe 5024 IOOW.exe 4536 JRSASY.exe 4536 JRSASY.exe 1240 ZCVQT.exe 1240 ZCVQT.exe 5008 JZBC.exe 5008 JZBC.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4596 2026-08-12_651b369fca0f64b9abf2fa37fa949ea0_elex_emotet_stop.exe 4596 2026-08-12_651b369fca0f64b9abf2fa37fa949ea0_elex_emotet_stop.exe 3160 FYVCHN.exe 3160 FYVCHN.exe 3204 JEUYBDB.exe 3204 JEUYBDB.exe 3244 YUVXHZ.exe 3244 YUVXHZ.exe 1756 CCB.exe 1756 CCB.exe 2664 GSQXY.exe 2664 GSQXY.exe 1688 HNUB.exe 1688 HNUB.exe 2052 PBYI.exe 2052 PBYI.exe 5416 VWK.exe 5416 VWK.exe 1932 OOAT.exe 1932 OOAT.exe 4628 BMAFVZF.exe 4628 BMAFVZF.exe 5384 TUOCAQI.exe 5384 TUOCAQI.exe 4400 BATJKOD.exe 4400 BATJKOD.exe 3172 SIHOXFY.exe 3172 SIHOXFY.exe 2460 EWO.exe 2460 EWO.exe 5160 IBYCSC.exe 5160 IBYCSC.exe 1516 UEJ.exe 1516 UEJ.exe 1456 CUKGIC.exe 1456 CUKGIC.exe 1692 MSXB.exe 1692 MSXB.exe 3776 MVOWEUS.exe 3776 MVOWEUS.exe 2548 HIS.exe 2548 HIS.exe 3004 RGYAWC.exe 3004 RGYAWC.exe 1360 GWZS.exe 1360 GWZS.exe 5580 KMGAPIA.exe 5580 KMGAPIA.exe 5036 OUMA.exe 5036 OUMA.exe 2072 UQMAXDE.exe 2072 UQMAXDE.exe 4220 PDQS.exe 4220 PDQS.exe 3880 NBKNDIA.exe 3880 NBKNDIA.exe 5024 IOOW.exe 5024 IOOW.exe 4536 JRSASY.exe 4536 JRSASY.exe 1240 ZCVQT.exe 1240 ZCVQT.exe 5008 JZBC.exe 5008 JZBC.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4596 wrote to memory of 4344 4596 2026-08-12_651b369fca0f64b9abf2fa37fa949ea0_elex_emotet_stop.exe 89 PID 4344 wrote to memory of 3160 4344 cmd.exe 93 PID 3160 wrote to memory of 3412 3160 FYVCHN.exe 95 PID 3412 wrote to memory of 3204 3412 cmd.exe 99 PID 3204 wrote to memory of 3960 3204 JEUYBDB.exe 100 PID 3960 wrote to memory of 3244 3960 cmd.exe 104 PID 3244 wrote to memory of 5428 3244 YUVXHZ.exe 105 PID 5428 wrote to memory of 1756 5428 cmd.exe 109 PID 1756 wrote to memory of 2296 1756 CCB.exe 110 PID 2296 wrote to memory of 2664 2296 cmd.exe 114 PID 2664 wrote to memory of 5952 2664 GSQXY.exe 115 PID 5952 wrote to memory of 1688 5952 cmd.exe 119 PID 1688 wrote to memory of 6128 1688 HNUB.exe 120 PID 6128 wrote to memory of 2052 6128 cmd.exe 124 PID 2052 wrote to memory of 4264 2052 PBYI.exe 125 PID 4264 wrote to memory of 5416 4264 cmd.exe 129 PID 5416 wrote to memory of 3856 5416 VWK.exe 130 PID 3856 wrote to memory of 1932 3856 cmd.exe 134 PID 1932 wrote to memory of 2912 1932 OOAT.exe 135 PID 2912 wrote to memory of 4628 2912 cmd.exe 139 PID 4628 wrote to memory of 5788 4628 BMAFVZF.exe 140 PID 5788 wrote to memory of 5384 5788 cmd.exe 144 PID 5384 wrote to memory of 552 5384 TUOCAQI.exe 145 PID 552 wrote to memory of 4400 552 cmd.exe 149 PID 4400 wrote to memory of 1724 4400 BATJKOD.exe 150 PID 1724 wrote to memory of 3172 1724 cmd.exe 154 PID 3172 wrote to memory of 2748 3172 SIHOXFY.exe 155 PID 2748 wrote to memory of 2460 2748 cmd.exe 159 PID 2460 wrote to memory of 2372 2460 EWO.exe 160 PID 2372 wrote to memory of 5160 2372 cmd.exe 164 PID 5160 wrote to memory of 5884 5160 IBYCSC.exe 165 PID 5884 wrote to memory of 1516 5884 cmd.exe 169 PID 1516 wrote to memory of 1776 1516 UEJ.exe 170 PID 1776 wrote to memory of 1456 1776 cmd.exe 174 PID 1456 wrote to memory of 1704 1456 CUKGIC.exe 175 PID 1704 wrote to memory of 1692 1704 cmd.exe 179 PID 1692 wrote to memory of 5612 1692 MSXB.exe 180 PID 5612 wrote to memory of 3776 5612 cmd.exe 184 PID 3776 wrote to memory of 3932 3776 MVOWEUS.exe 185 PID 3932 wrote to memory of 2548 3932 cmd.exe 189 PID 2548 wrote to memory of 2840 2548 HIS.exe 190 PID 2840 wrote to memory of 3004 2840 cmd.exe 194 PID 3004 wrote to memory of 2528 3004 RGYAWC.exe 195 PID 2528 wrote to memory of 1360 2528 cmd.exe 199 PID 1360 wrote to memory of 1288 1360 GWZS.exe 200 PID 1288 wrote to memory of 5580 1288 cmd.exe 204 PID 5580 wrote to memory of 3416 5580 KMGAPIA.exe 205 PID 3416 wrote to memory of 5036 3416 cmd.exe 209 PID 5036 wrote to memory of 5484 5036 OUMA.exe 210 PID 5484 wrote to memory of 2072 5484 cmd.exe 214 PID 2072 wrote to memory of 4940 2072 UQMAXDE.exe 215 PID 4940 wrote to memory of 4220 4940 cmd.exe 219 PID 4220 wrote to memory of 1396 4220 PDQS.exe 220 PID 1396 wrote to memory of 3880 1396 cmd.exe 224 PID 3880 wrote to memory of 3636 3880 NBKNDIA.exe 225 PID 3636 wrote to memory of 5024 3636 cmd.exe 229 PID 5024 wrote to memory of 4480 5024 IOOW.exe 230 PID 4480 wrote to memory of 4536 4480 cmd.exe 234 PID 4536 wrote to memory of 1736 4536 JRSASY.exe 235 PID 1736 wrote to memory of 1240 1736 cmd.exe 239 PID 1240 wrote to memory of 4424 1240 ZCVQT.exe 240 PID 4424 wrote to memory of 5008 4424 cmd.exe 244 PID 5008 wrote to memory of 4724 5008 JZBC.exe 245 PID 4724 wrote to memory of 3652 4724 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-12_651b369fca0f64b9abf2fa37fa949ea0_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-12_651b369fca0f64b9abf2fa37fa949ea0_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FYVCHN.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\windows\FYVCHN.exeC:\windows\FYVCHN.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JEUYBDB.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\windows\JEUYBDB.exeC:\windows\JEUYBDB.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3204 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YUVXHZ.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\windows\system\YUVXHZ.exeC:\windows\system\YUVXHZ.exe7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CCB.exe.bat" "8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5428 -
C:\windows\system\CCB.exeC:\windows\system\CCB.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GSQXY.exe.bat" "10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\windows\GSQXY.exeC:\windows\GSQXY.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HNUB.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:5952 -
C:\windows\HNUB.exeC:\windows\HNUB.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PBYI.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:6128 -
C:\windows\SysWOW64\PBYI.exeC:\windows\system32\PBYI.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VWK.exe.bat" "16⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\windows\SysWOW64\VWK.exeC:\windows\system32\VWK.exe17⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OOAT.exe.bat" "18⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\windows\OOAT.exeC:\windows\OOAT.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BMAFVZF.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\windows\SysWOW64\BMAFVZF.exeC:\windows\system32\BMAFVZF.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TUOCAQI.exe.bat" "22⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5788 -
C:\windows\TUOCAQI.exeC:\windows\TUOCAQI.exe23⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BATJKOD.exe.bat" "24⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:552 -
C:\windows\BATJKOD.exeC:\windows\BATJKOD.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SIHOXFY.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\windows\SIHOXFY.exeC:\windows\SIHOXFY.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EWO.exe.bat" "28⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\windows\SysWOW64\EWO.exeC:\windows\system32\EWO.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IBYCSC.exe.bat" "30⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\windows\SysWOW64\IBYCSC.exeC:\windows\system32\IBYCSC.exe31⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UEJ.exe.bat" "32⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5884 -
C:\windows\system\UEJ.exeC:\windows\system\UEJ.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CUKGIC.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\windows\SysWOW64\CUKGIC.exeC:\windows\system32\CUKGIC.exe35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MSXB.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\windows\system\MSXB.exeC:\windows\system\MSXB.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MVOWEUS.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:5612 -
C:\windows\SysWOW64\MVOWEUS.exeC:\windows\system32\MVOWEUS.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HIS.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\windows\HIS.exeC:\windows\HIS.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RGYAWC.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\windows\RGYAWC.exeC:\windows\RGYAWC.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GWZS.exe.bat" "44⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\windows\system\GWZS.exeC:\windows\system\GWZS.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KMGAPIA.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\windows\KMGAPIA.exeC:\windows\KMGAPIA.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OUMA.exe.bat" "48⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\windows\system\OUMA.exeC:\windows\system\OUMA.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UQMAXDE.exe.bat" "50⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5484 -
C:\windows\UQMAXDE.exeC:\windows\UQMAXDE.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PDQS.exe.bat" "52⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\windows\SysWOW64\PDQS.exeC:\windows\system32\PDQS.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NBKNDIA.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\windows\NBKNDIA.exeC:\windows\NBKNDIA.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IOOW.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:3636 -
C:\windows\IOOW.exeC:\windows\IOOW.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JRSASY.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\windows\SysWOW64\JRSASY.exeC:\windows\system32\JRSASY.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZCVQT.exe.bat" "60⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\windows\system\ZCVQT.exeC:\windows\system\ZCVQT.exe61⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JZBC.exe.bat" "62⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\windows\JZBC.exeC:\windows\JZBC.exe63⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TADPMS.exe.bat" "64⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\windows\TADPMS.exeC:\windows\TADPMS.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YAK.exe.bat" "66⤵
- Executes a command shell one-liner
PID:4188 -
C:\windows\SysWOW64\YAK.exeC:\windows\system32\YAK.exe67⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QIMI.exe.bat" "68⤵
- Executes a command shell one-liner
PID:1184 -
C:\windows\system\QIMI.exeC:\windows\system\QIMI.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SGSC.exe.bat" "70⤵PID:5528
-
C:\windows\system\SGSC.exeC:\windows\system\SGSC.exe71⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5196 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WOGCAS.exe.bat" "72⤵
- Executes a command shell one-liner
PID:3224 -
C:\windows\system\WOGCAS.exeC:\windows\system\WOGCAS.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YCL.exe.bat" "74⤵PID:3752
-
C:\windows\YCL.exeC:\windows\YCL.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1192 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YPDA.exe.bat" "76⤵PID:4764
-
C:\windows\SysWOW64\YPDA.exeC:\windows\system32\YPDA.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EPLOVZ.exe.bat" "78⤵
- System Location Discovery: System Language Discovery
PID:1280 -
C:\windows\SysWOW64\EPLOVZ.exeC:\windows\system32\EPLOVZ.exe79⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IXS.exe.bat" "80⤵
- Executes a command shell one-liner
PID:2148 -
C:\windows\IXS.exeC:\windows\IXS.exe81⤵
- Executes dropped EXE
PID:124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DLXGR.exe.bat" "82⤵PID:2692
-
C:\windows\SysWOW64\DLXGR.exeC:\windows\system32\DLXGR.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SBY.exe.bat" "84⤵
- Executes a command shell one-liner
PID:4736 -
C:\windows\SBY.exeC:\windows\SBY.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HEPJJA.exe.bat" "86⤵
- System Location Discovery: System Language Discovery
PID:5088 -
C:\windows\system\HEPJJA.exeC:\windows\system\HEPJJA.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6096 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\REJ.exe.bat" "88⤵PID:1204
-
C:\windows\REJ.exeC:\windows\REJ.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RHVK.exe.bat" "90⤵
- System Location Discovery: System Language Discovery
PID:2348 -
C:\windows\SysWOW64\RHVK.exeC:\windows\system32\RHVK.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TFAE.exe.bat" "92⤵PID:3232
-
C:\windows\system\TFAE.exeC:\windows\system\TFAE.exe93⤵
- Executes dropped EXE
PID:4212 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BKFL.exe.bat" "94⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5412 -
C:\windows\BKFL.exeC:\windows\BKFL.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GLP.exe.bat" "96⤵PID:3868
-
C:\windows\SysWOW64\GLP.exeC:\windows\system32\GLP.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IJUIDHZ.exe.bat" "98⤵PID:1332
-
C:\windows\IJUIDHZ.exeC:\windows\IJUIDHZ.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JEYL.exe.bat" "100⤵PID:2756
-
C:\windows\SysWOW64\JEYL.exeC:\windows\system32\JEYL.exe101⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NUNLVP.exe.bat" "102⤵PID:2408
-
C:\windows\system\NUNLVP.exeC:\windows\system\NUNLVP.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3104 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AFVKJS.exe.bat" "104⤵PID:2724
-
C:\windows\SysWOW64\AFVKJS.exeC:\windows\system32\AFVKJS.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2216 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GSULOVZ.exe.bat" "106⤵PID:1172
-
C:\windows\SysWOW64\GSULOVZ.exeC:\windows\system32\GSULOVZ.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EQGOBA.exe.bat" "108⤵PID:4448
-
C:\windows\EQGOBA.exeC:\windows\EQGOBA.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XTKKO.exe.bat" "110⤵
- System Location Discovery: System Language Discovery
PID:4200 -
C:\windows\XTKKO.exeC:\windows\XTKKO.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OTMPSV.exe.bat" "112⤵
- System Location Discovery: System Language Discovery
PID:2768 -
C:\windows\system\OTMPSV.exeC:\windows\system\OTMPSV.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CECN.exe.bat" "114⤵PID:2036
-
C:\windows\SysWOW64\CECN.exeC:\windows\system32\CECN.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LEESJDQ.exe.bat" "116⤵
- Executes a command shell one-liner
PID:2516 -
C:\windows\SysWOW64\LEESJDQ.exeC:\windows\system32\LEESJDQ.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\REMGTGR.exe.bat" "118⤵PID:2040
-
C:\windows\REMGTGR.exeC:\windows\REMGTGR.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZKE.exe.bat" "120⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2616 -
C:\windows\SysWOW64\ZKE.exeC:\windows\system32\ZKE.exe121⤵
- Executes dropped EXE
PID:5932
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-