Analysis
- max time kernel
148s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
13/08/2026, 22:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-13_d986718e5e2321ca35ffa4a7f6043787_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
General
- Target 2026-08-13_d986718e5e2321ca35ffa4a7f6043787_elex_emotet_stop.exe
- Size 208KB
- Sample260813-13ectadf73
- SHA256 0c58fa39767bd15c0eb250f22bd49068ac0df0d3ebd6c1486ffa2b51d6afe284
- MD5 d986718e5e2321ca35ffa4a7f6043787
- SHA1 401c54813ad72c874d6c94e9bfc47ee0c32390a4
- SHA512 28b1b4154a117584ce2a8ee073bb732b809c706083b444009931c871dc37ac93238b6449445c47d0191ffb0b37998408aea553f2be731e5cb7410f41497954a9
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbclcdL+LOfQ4NLthEjQT6E:MlZtbLWIgd1LZ9oECZbclc5+LOoQEjK
- TLSH T14E247D2236D2C073E4B7123188F6C7787BB6BD919B36928B77C03B4D6E315A68A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2672 RVH.exe 2932 QRGQY.exe 2396 YETXJ.exe 1480 WUE.exe 2020 EHR.exe 5320 CVQH.exe 5812 HAAX.exe 3216 QICCF.exe 2996 AGQWM.exe 5416 TBUAAMR.exe 4804 IRVRY.exe 5196 LNMBST.exe 4080 NKR.exe 1380 KAFFPI.exe 3692 QWQGV.exe 3368 YBVMF.exe 5104 ORW.exe 4020 QMNN.exe 4816 CAU.exe 5172 CDLHR.exe 3244 YBLT.exe 916 AZQ.exe 4652 TRGYSI.exe 5956 OZO.exe 5964 APHN.exe 2656 VVHZWSM.exe 6104 XLVTEAV.exe 4328 ULXVPW.exe 3760 NEMGZX.exe 952 FMBELO.exe 696 SKBPN.exe 3420 XPLFE.exe 4636 IDSD.exe 2004 HBDGWCQ.exe 5060 UZLRFN.exe 1500 VCPVL.exe 3720 DHUC.exe 4820 QSKSKNR.exe 6024 FILSQI.exe 2956 JYS.exe 3620 KTVVI.exe 1300 MRJQQ.exe 608 YHQQCJJ.exe 1136 RCTTHH.exe 1624 AKVZLEM.exe 4300 BNZU.exe 5668 OQIT.exe 3004 FYWQ.exe 1444 PWCKGFV.exe 2292 VRBL.exe 4048 SXT.exe 1356 YKSJYG.exe 3476 LVBA.exe 5292 MYF.exe 2196 EBIZF.exe 3356 FWM.exe 2520 YZYZQ.exe 4872 IXETF.exe 5768 KVJNNTV.exe 5632 KYNJSJ.exe 4472 ZTFW.exe 1308 ZYXKN.exe 4840 FZEYW.exe 3792 VPFP.exe - Drops file in System32 directory 60 IoCs
description ioc Process File created C:\windows\SysWOW64\LNMBST.exe.bat IRVRY.exe File created C:\windows\SysWOW64\KVJNNTV.exe.bat IXETF.exe File created C:\windows\SysWOW64\YETXJ.exe QRGQY.exe File opened for modification C:\windows\SysWOW64\JYS.exe FILSQI.exe File created C:\windows\SysWOW64\JYS.exe.bat FILSQI.exe File opened for modification C:\windows\SysWOW64\KVJNNTV.exe IXETF.exe File created C:\windows\SysWOW64\HBDGWCQ.exe IDSD.exe File opened for modification C:\windows\SysWOW64\LNMBST.exe IRVRY.exe File created C:\windows\SysWOW64\TBUAAMR.exe.bat AGQWM.exe File created C:\windows\SysWOW64\XLVTEAV.exe.bat VVHZWSM.exe File opened for modification C:\windows\SysWOW64\HBDGWCQ.exe IDSD.exe File created C:\windows\SysWOW64\CAU.exe.bat QMNN.exe File created C:\windows\SysWOW64\NEMGZX.exe.bat ULXVPW.exe File created C:\windows\SysWOW64\RCTTHH.exe.bat YHQQCJJ.exe File opened for modification C:\windows\SysWOW64\FYWQ.exe OQIT.exe File opened for modification C:\windows\SysWOW64\XLVTEAV.exe VVHZWSM.exe File created C:\windows\SysWOW64\PWCKGFV.exe.bat FYWQ.exe File opened for modification C:\windows\SysWOW64\IXETF.exe YZYZQ.exe File created C:\windows\SysWOW64\OIZ.exe.bat MNDCEHK.exe File created C:\windows\SysWOW64\QICCF.exe HAAX.exe File created C:\windows\SysWOW64\TBUAAMR.exe AGQWM.exe File created C:\windows\SysWOW64\NEMGZX.exe ULXVPW.exe File created C:\windows\SysWOW64\RCTTHH.exe YHQQCJJ.exe File created C:\windows\SysWOW64\AKVZLEM.exe.bat RCTTHH.exe File created C:\windows\SysWOW64\FYWQ.exe OQIT.exe File created C:\windows\SysWOW64\FYWQ.exe.bat OQIT.exe File created C:\windows\SysWOW64\KVJNNTV.exe IXETF.exe File created C:\windows\SysWOW64\XLVTEAV.exe VVHZWSM.exe File opened for modification C:\windows\SysWOW64\YETXJ.exe QRGQY.exe File created C:\windows\SysWOW64\IXETF.exe.bat YZYZQ.exe File created C:\windows\SysWOW64\KYNJSJ.exe KVJNNTV.exe File opened for modification C:\windows\SysWOW64\KYNJSJ.exe KVJNNTV.exe File created C:\windows\SysWOW64\QICCF.exe.bat HAAX.exe File created C:\windows\SysWOW64\IRVRY.exe TBUAAMR.exe File opened for modification C:\windows\SysWOW64\CAU.exe QMNN.exe File opened for modification C:\windows\SysWOW64\NEMGZX.exe ULXVPW.exe File opened for modification C:\windows\SysWOW64\SKBPN.exe FMBELO.exe File created C:\windows\SysWOW64\PWCKGFV.exe FYWQ.exe File opened for modification C:\windows\SysWOW64\OIZ.exe MNDCEHK.exe File created C:\windows\SysWOW64\ULXVPW.exe.bat XLVTEAV.exe File created C:\windows\SysWOW64\SKBPN.exe FMBELO.exe File created C:\windows\SysWOW64\IXETF.exe YZYZQ.exe File opened for modification C:\windows\SysWOW64\QICCF.exe HAAX.exe File created C:\windows\SysWOW64\SKBPN.exe.bat FMBELO.exe File created C:\windows\SysWOW64\AKVZLEM.exe RCTTHH.exe File opened for modification C:\windows\SysWOW64\AKVZLEM.exe RCTTHH.exe File created C:\windows\SysWOW64\OIZ.exe MNDCEHK.exe File opened for modification C:\windows\SysWOW64\IRVRY.exe TBUAAMR.exe File created C:\windows\SysWOW64\CAU.exe QMNN.exe File created C:\windows\SysWOW64\ULXVPW.exe XLVTEAV.exe File opened for modification C:\windows\SysWOW64\ULXVPW.exe XLVTEAV.exe File created C:\windows\SysWOW64\YETXJ.exe.bat QRGQY.exe File created C:\windows\SysWOW64\LNMBST.exe IRVRY.exe File created C:\windows\SysWOW64\JYS.exe FILSQI.exe File opened for modification C:\windows\SysWOW64\RCTTHH.exe YHQQCJJ.exe File opened for modification C:\windows\SysWOW64\TBUAAMR.exe AGQWM.exe File created C:\windows\SysWOW64\HBDGWCQ.exe.bat IDSD.exe File opened for modification C:\windows\SysWOW64\PWCKGFV.exe FYWQ.exe File created C:\windows\SysWOW64\KYNJSJ.exe.bat KVJNNTV.exe File created C:\windows\SysWOW64\IRVRY.exe.bat TBUAAMR.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\system\WUE.exe YETXJ.exe File created C:\windows\system\AZQ.exe.bat YBLT.exe File created C:\windows\XPLFE.exe SKBPN.exe File opened for modification C:\windows\IDSD.exe XPLFE.exe File opened for modification C:\windows\system\IFOCSWO.exe ZXUXPR.exe File created C:\windows\system\WUE.exe YETXJ.exe File created C:\windows\system\WUE.exe.bat YETXJ.exe File opened for modification C:\windows\system\AGQWM.exe QICCF.exe File created C:\windows\NKR.exe LNMBST.exe File created C:\windows\system\YBVMF.exe.bat QWQGV.exe File created C:\windows\system\CVQH.exe.bat EHR.exe File opened for modification C:\windows\HAAX.exe CVQH.exe File opened for modification C:\windows\VCPVL.exe UZLRFN.exe File created C:\windows\OQIT.exe BNZU.exe File created C:\windows\system\MYF.exe LVBA.exe File created C:\windows\EHR.exe.bat WUE.exe File created C:\windows\system\ORW.exe.bat YBVMF.exe File created C:\windows\system\CDLHR.exe CAU.exe File created C:\windows\TRGYSI.exe.bat AZQ.exe File opened for modification C:\windows\system\EBIZF.exe MYF.exe File opened for modification C:\windows\QRGQY.exe RVH.exe File created C:\windows\QSKSKNR.exe DHUC.exe File created C:\windows\system\AZQ.exe YBLT.exe File created C:\windows\system\UZLRFN.exe.bat HBDGWCQ.exe File created C:\windows\system\VPFP.exe.bat FZEYW.exe File created C:\windows\DHUC.exe.bat VCPVL.exe File created C:\windows\system\ZTFW.exe.bat KYNJSJ.exe File opened for modification C:\windows\system\KAFFPI.exe NKR.exe File created C:\windows\system\QWQGV.exe KAFFPI.exe File created C:\windows\OZO.exe.bat TRGYSI.exe File opened for modification C:\windows\system\YHQQCJJ.exe MRJQQ.exe File created C:\windows\system\SXT.exe.bat VRBL.exe File opened for modification C:\windows\system\YKSJYG.exe SXT.exe File created C:\windows\FZEYW.exe ZYXKN.exe File created C:\windows\system\IFOCSWO.exe.bat ZXUXPR.exe File created C:\windows\RVH.exe 2026-08-13_d986718e5e2321ca35ffa4a7f6043787_elex_emotet_stop.exe File created C:\windows\QRGQY.exe RVH.exe File created C:\windows\system\KAFFPI.exe.bat NKR.exe File created C:\windows\system\ORW.exe YBVMF.exe File opened for modification C:\windows\system\FMBELO.exe NEMGZX.exe File created C:\windows\system\FMBELO.exe.bat NEMGZX.exe File opened for modification C:\windows\system\MRJQQ.exe KTVVI.exe File created C:\windows\system\ZTFW.exe KYNJSJ.exe File opened for modification C:\windows\system\QMNN.exe ORW.exe File opened for modification C:\windows\FILSQI.exe QSKSKNR.exe File created C:\windows\system\BNZU.exe.bat AKVZLEM.exe File created C:\windows\system\FWM.exe EBIZF.exe File created C:\windows\system\VRBL.exe.bat PWCKGFV.exe File created C:\windows\system\ZYXKN.exe.bat ZTFW.exe File created C:\windows\system\MNDCEHK.exe IFOCSWO.exe File opened for modification C:\windows\system\YBVMF.exe QWQGV.exe File opened for modification C:\windows\OZO.exe TRGYSI.exe File created C:\windows\FILSQI.exe.bat QSKSKNR.exe File created C:\windows\KTVVI.exe JYS.exe File created C:\windows\system\MRJQQ.exe KTVVI.exe File created C:\windows\system\LVBA.exe.bat YKSJYG.exe File created C:\windows\system\AGQWM.exe QICCF.exe File created C:\windows\YBLT.exe.bat CDLHR.exe File opened for modification C:\windows\system\MYF.exe LVBA.exe File created C:\windows\system\EBIZF.exe MYF.exe File created C:\windows\WDRYAB.exe OIZ.exe File opened for modification C:\windows\system\CVQH.exe EHR.exe File created C:\windows\VCPVL.exe.bat UZLRFN.exe File opened for modification C:\windows\QSKSKNR.exe DHUC.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3708 cmd.exe 4148 cmd.exe 1988 cmd.exe 2848 cmd.exe 1216 cmd.exe 3716 cmd.exe 3828 cmd.exe 4100 cmd.exe 1616 cmd.exe 2892 cmd.exe 1108 cmd.exe 4216 cmd.exe 4888 cmd.exe 5148 cmd.exe 2760 cmd.exe 876 cmd.exe 2548 cmd.exe 1368 cmd.exe 1564 cmd.exe 4464 cmd.exe 3584 cmd.exe 2600 cmd.exe 1288 cmd.exe 2536 cmd.exe 2416 cmd.exe 4196 cmd.exe 2576 cmd.exe 4724 cmd.exe 5420 cmd.exe 5656 cmd.exe 3364 cmd.exe 2296 cmd.exe 1836 cmd.exe 2108 cmd.exe 1456 cmd.exe 2804 cmd.exe 1968 cmd.exe 3284 cmd.exe 2708 cmd.exe 4524 cmd.exe 4440 cmd.exe 692 cmd.exe 1360 cmd.exe 2676 cmd.exe 5660 cmd.exe 4732 cmd.exe 3456 cmd.exe 4388 cmd.exe 4088 cmd.exe 3048 cmd.exe 6088 cmd.exe 4600 cmd.exe 1292 cmd.exe 1664 cmd.exe 4344 cmd.exe 4944 cmd.exe 3872 cmd.exe 1420 cmd.exe 4228 cmd.exe 792 cmd.exe 5832 cmd.exe 2688 cmd.exe 3172 cmd.exe 4512 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 4100 2624 WerFault.exe 88 4796 2672 WerFault.exe 93 4720 2932 WerFault.exe 99 2108 2396 WerFault.exe 104 2984 1480 WerFault.exe 109 4232 2020 WerFault.exe 114 4264 5320 WerFault.exe 119 1076 5812 WerFault.exe 124 5988 3216 WerFault.exe 129 4148 2996 WerFault.exe 134 3828 5416 WerFault.exe 139 4276 4804 WerFault.exe 144 3008 5196 WerFault.exe 149 4888 4080 WerFault.exe 154 3836 1380 WerFault.exe 159 3720 3692 WerFault.exe 164 5908 3368 WerFault.exe 168 3032 5104 WerFault.exe 174 888 4020 WerFault.exe 179 1528 4816 WerFault.exe 184 2744 5172 WerFault.exe 188 4560 3244 WerFault.exe 194 2752 916 WerFault.exe 199 4796 4652 WerFault.exe 204 1256 5956 WerFault.exe 209 2628 5964 WerFault.exe 214 5340 2656 WerFault.exe 219 5928 6104 WerFault.exe 224 5236 4328 WerFault.exe 229 2732 3760 WerFault.exe 234 4360 952 WerFault.exe 239 692 696 WerFault.exe 244 4540 3420 WerFault.exe 249 3648 4636 WerFault.exe 254 1532 2004 WerFault.exe 260 3436 5060 WerFault.exe 265 5604 1500 WerFault.exe 270 3028 3720 WerFault.exe 275 6064 4820 WerFault.exe 280 4792 6024 WerFault.exe 285 4236 2956 WerFault.exe 290 3240 3620 WerFault.exe 295 4860 1300 WerFault.exe 300 240 608 WerFault.exe 305 5796 1136 WerFault.exe 310 2676 1624 WerFault.exe 315 5628 4300 WerFault.exe 320 4264 5668 WerFault.exe 325 2704 3004 WerFault.exe 330 5096 1444 WerFault.exe 335 4960 2292 WerFault.exe 340 4180 4048 WerFault.exe 345 2980 1356 WerFault.exe 350 1188 3476 WerFault.exe 355 3792 5292 WerFault.exe 360 6012 2196 WerFault.exe 365 472 3356 WerFault.exe 370 5072 2520 WerFault.exe 375 2552 4872 WerFault.exe 380 2140 5768 WerFault.exe 385 204 5632 WerFault.exe 390 2740 4472 WerFault.exe 395 4664 1308 WerFault.exe 400 1364 4840 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AKVZLEM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LVBA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YETXJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CDLHR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OZO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VCPVL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KTVVI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IRVRY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FWM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KVJNNTV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WDRYAB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EHR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CVQH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AGQWM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BNZU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PWCKGFV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QWQGV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QMNN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XLVTEAV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SXT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DHUC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JYS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HAAX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KAFFPI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RCTTHH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IFOCSWO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OQIT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CAU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YHQQCJJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OIZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EBIZF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FMBELO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QSKSKNR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FZEYW.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2624 2026-08-13_d986718e5e2321ca35ffa4a7f6043787_elex_emotet_stop.exe 2624 2026-08-13_d986718e5e2321ca35ffa4a7f6043787_elex_emotet_stop.exe 2672 RVH.exe 2672 RVH.exe 2932 QRGQY.exe 2932 QRGQY.exe 2396 YETXJ.exe 2396 YETXJ.exe 1480 WUE.exe 1480 WUE.exe 2020 EHR.exe 2020 EHR.exe 5320 CVQH.exe 5320 CVQH.exe 5812 HAAX.exe 5812 HAAX.exe 3216 QICCF.exe 3216 QICCF.exe 2996 AGQWM.exe 2996 AGQWM.exe 5416 TBUAAMR.exe 5416 TBUAAMR.exe 4804 IRVRY.exe 4804 IRVRY.exe 5196 LNMBST.exe 5196 LNMBST.exe 4080 NKR.exe 4080 NKR.exe 1380 KAFFPI.exe 1380 KAFFPI.exe 3692 QWQGV.exe 3692 QWQGV.exe 3368 YBVMF.exe 3368 YBVMF.exe 5104 ORW.exe 5104 ORW.exe 4020 QMNN.exe 4020 QMNN.exe 4816 CAU.exe 4816 CAU.exe 5172 CDLHR.exe 5172 CDLHR.exe 3244 YBLT.exe 3244 YBLT.exe 916 AZQ.exe 916 AZQ.exe 4652 TRGYSI.exe 4652 TRGYSI.exe 5956 OZO.exe 5956 OZO.exe 5964 APHN.exe 5964 APHN.exe 2656 VVHZWSM.exe 2656 VVHZWSM.exe 6104 XLVTEAV.exe 6104 XLVTEAV.exe 4328 ULXVPW.exe 4328 ULXVPW.exe 3760 NEMGZX.exe 3760 NEMGZX.exe 952 FMBELO.exe 952 FMBELO.exe 696 SKBPN.exe 696 SKBPN.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2624 2026-08-13_d986718e5e2321ca35ffa4a7f6043787_elex_emotet_stop.exe 2624 2026-08-13_d986718e5e2321ca35ffa4a7f6043787_elex_emotet_stop.exe 2672 RVH.exe 2672 RVH.exe 2932 QRGQY.exe 2932 QRGQY.exe 2396 YETXJ.exe 2396 YETXJ.exe 1480 WUE.exe 1480 WUE.exe 2020 EHR.exe 2020 EHR.exe 5320 CVQH.exe 5320 CVQH.exe 5812 HAAX.exe 5812 HAAX.exe 3216 QICCF.exe 3216 QICCF.exe 2996 AGQWM.exe 2996 AGQWM.exe 5416 TBUAAMR.exe 5416 TBUAAMR.exe 4804 IRVRY.exe 4804 IRVRY.exe 5196 LNMBST.exe 5196 LNMBST.exe 4080 NKR.exe 4080 NKR.exe 1380 KAFFPI.exe 1380 KAFFPI.exe 3692 QWQGV.exe 3692 QWQGV.exe 3368 YBVMF.exe 3368 YBVMF.exe 5104 ORW.exe 5104 ORW.exe 4020 QMNN.exe 4020 QMNN.exe 4816 CAU.exe 4816 CAU.exe 5172 CDLHR.exe 5172 CDLHR.exe 3244 YBLT.exe 3244 YBLT.exe 916 AZQ.exe 916 AZQ.exe 4652 TRGYSI.exe 4652 TRGYSI.exe 5956 OZO.exe 5956 OZO.exe 5964 APHN.exe 5964 APHN.exe 2656 VVHZWSM.exe 2656 VVHZWSM.exe 6104 XLVTEAV.exe 6104 XLVTEAV.exe 4328 ULXVPW.exe 4328 ULXVPW.exe 3760 NEMGZX.exe 3760 NEMGZX.exe 952 FMBELO.exe 952 FMBELO.exe 696 SKBPN.exe 696 SKBPN.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2624 wrote to memory of 1968 2624 2026-08-13_d986718e5e2321ca35ffa4a7f6043787_elex_emotet_stop.exe 89 PID 1968 wrote to memory of 2672 1968 cmd.exe 93 PID 2672 wrote to memory of 1288 2672 RVH.exe 95 PID 1288 wrote to memory of 2932 1288 cmd.exe 99 PID 2932 wrote to memory of 4372 2932 QRGQY.exe 100 PID 4372 wrote to memory of 2396 4372 cmd.exe 104 PID 2396 wrote to memory of 2536 2396 YETXJ.exe 105 PID 2536 wrote to memory of 1480 2536 cmd.exe 109 PID 1480 wrote to memory of 5660 1480 WUE.exe 110 PID 5660 wrote to memory of 2020 5660 cmd.exe 114 PID 2020 wrote to memory of 3160 2020 EHR.exe 115 PID 3160 wrote to memory of 5320 3160 cmd.exe 119 PID 5320 wrote to memory of 4732 5320 CVQH.exe 120 PID 4732 wrote to memory of 5812 4732 cmd.exe 124 PID 5812 wrote to memory of 3872 5812 HAAX.exe 125 PID 3872 wrote to memory of 3216 3872 cmd.exe 129 PID 3216 wrote to memory of 2576 3216 QICCF.exe 130 PID 2576 wrote to memory of 2996 2576 cmd.exe 134 PID 2996 wrote to memory of 2892 2996 AGQWM.exe 135 PID 2892 wrote to memory of 5416 2892 cmd.exe 139 PID 5416 wrote to memory of 2416 5416 TBUAAMR.exe 140 PID 2416 wrote to memory of 4804 2416 cmd.exe 144 PID 4804 wrote to memory of 3048 4804 IRVRY.exe 145 PID 3048 wrote to memory of 5196 3048 cmd.exe 149 PID 5196 wrote to memory of 4724 5196 LNMBST.exe 150 PID 4724 wrote to memory of 4080 4724 cmd.exe 154 PID 4080 wrote to memory of 1108 4080 NKR.exe 155 PID 1108 wrote to memory of 1380 1108 cmd.exe 159 PID 1380 wrote to memory of 2156 1380 KAFFPI.exe 160 PID 2156 wrote to memory of 3692 2156 cmd.exe 164 PID 3692 wrote to memory of 3284 3692 QWQGV.exe 165 PID 3284 wrote to memory of 3368 3284 cmd.exe 168 PID 3368 wrote to memory of 1960 3368 YBVMF.exe 170 PID 1960 wrote to memory of 5104 1960 cmd.exe 174 PID 5104 wrote to memory of 4344 5104 ORW.exe 175 PID 4344 wrote to memory of 4020 4344 cmd.exe 179 PID 4020 wrote to memory of 3708 4020 QMNN.exe 180 PID 3708 wrote to memory of 4816 3708 cmd.exe 184 PID 4816 wrote to memory of 2848 4816 CAU.exe 185 PID 2848 wrote to memory of 5172 2848 cmd.exe 188 PID 5172 wrote to memory of 6088 5172 CDLHR.exe 190 PID 6088 wrote to memory of 3244 6088 cmd.exe 194 PID 3244 wrote to memory of 2688 3244 YBLT.exe 195 PID 2688 wrote to memory of 916 2688 cmd.exe 199 PID 916 wrote to memory of 4216 916 AZQ.exe 200 PID 4216 wrote to memory of 4652 4216 cmd.exe 204 PID 4652 wrote to memory of 5656 4652 TRGYSI.exe 205 PID 5656 wrote to memory of 5956 5656 cmd.exe 209 PID 5956 wrote to memory of 4888 5956 OZO.exe 210 PID 4888 wrote to memory of 5964 4888 cmd.exe 214 PID 5964 wrote to memory of 3364 5964 APHN.exe 215 PID 3364 wrote to memory of 2656 3364 cmd.exe 219 PID 2656 wrote to memory of 876 2656 VVHZWSM.exe 220 PID 876 wrote to memory of 6104 876 cmd.exe 224 PID 6104 wrote to memory of 5420 6104 XLVTEAV.exe 225 PID 5420 wrote to memory of 4328 5420 cmd.exe 229 PID 4328 wrote to memory of 2548 4328 ULXVPW.exe 230 PID 2548 wrote to memory of 3760 2548 cmd.exe 234 PID 3760 wrote to memory of 4600 3760 NEMGZX.exe 235 PID 4600 wrote to memory of 952 4600 cmd.exe 239 PID 952 wrote to memory of 4148 952 FMBELO.exe 240 PID 4148 wrote to memory of 696 4148 cmd.exe 244 PID 696 wrote to memory of 2296 696 SKBPN.exe 245 PID 2296 wrote to memory of 3420 2296 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-13_d986718e5e2321ca35ffa4a7f6043787_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-13_d986718e5e2321ca35ffa4a7f6043787_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RVH.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\windows\RVH.exeC:\windows\RVH.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QRGQY.exe.bat" "4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\windows\QRGQY.exeC:\windows\QRGQY.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YETXJ.exe.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\windows\SysWOW64\YETXJ.exeC:\windows\system32\YETXJ.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WUE.exe.bat" "8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\windows\system\WUE.exeC:\windows\system\WUE.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EHR.exe.bat" "10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5660 -
C:\windows\EHR.exeC:\windows\EHR.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CVQH.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\windows\system\CVQH.exeC:\windows\system\CVQH.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HAAX.exe.bat" "14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\windows\HAAX.exeC:\windows\HAAX.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QICCF.exe.bat" "16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\windows\SysWOW64\QICCF.exeC:\windows\system32\QICCF.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3216 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AGQWM.exe.bat" "18⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\windows\system\AGQWM.exeC:\windows\system\AGQWM.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TBUAAMR.exe.bat" "20⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\windows\SysWOW64\TBUAAMR.exeC:\windows\system32\TBUAAMR.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IRVRY.exe.bat" "22⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\windows\SysWOW64\IRVRY.exeC:\windows\system32\IRVRY.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LNMBST.exe.bat" "24⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\windows\SysWOW64\LNMBST.exeC:\windows\system32\LNMBST.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5196 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NKR.exe.bat" "26⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\windows\NKR.exeC:\windows\NKR.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KAFFPI.exe.bat" "28⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\windows\system\KAFFPI.exeC:\windows\system\KAFFPI.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QWQGV.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\windows\system\QWQGV.exeC:\windows\system\QWQGV.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YBVMF.exe.bat" "32⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3284 -
C:\windows\system\YBVMF.exeC:\windows\system\YBVMF.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ORW.exe.bat" "34⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\windows\system\ORW.exeC:\windows\system\ORW.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QMNN.exe.bat" "36⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\windows\system\QMNN.exeC:\windows\system\QMNN.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4020 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CAU.exe.bat" "38⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\windows\SysWOW64\CAU.exeC:\windows\system32\CAU.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CDLHR.exe.bat" "40⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\windows\system\CDLHR.exeC:\windows\system\CDLHR.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5172 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YBLT.exe.bat" "42⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6088 -
C:\windows\YBLT.exeC:\windows\YBLT.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AZQ.exe.bat" "44⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\windows\system\AZQ.exeC:\windows\system\AZQ.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TRGYSI.exe.bat" "46⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\windows\TRGYSI.exeC:\windows\TRGYSI.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OZO.exe.bat" "48⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5656 -
C:\windows\OZO.exeC:\windows\OZO.exe49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\APHN.exe.bat" "50⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\windows\APHN.exeC:\windows\APHN.exe51⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VVHZWSM.exe.bat" "52⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\windows\system\VVHZWSM.exeC:\windows\system\VVHZWSM.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XLVTEAV.exe.bat" "54⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:876 -
C:\windows\SysWOW64\XLVTEAV.exeC:\windows\system32\XLVTEAV.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6104 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ULXVPW.exe.bat" "56⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5420 -
C:\windows\SysWOW64\ULXVPW.exeC:\windows\system32\ULXVPW.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NEMGZX.exe.bat" "58⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\windows\SysWOW64\NEMGZX.exeC:\windows\system32\NEMGZX.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FMBELO.exe.bat" "60⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\windows\system\FMBELO.exeC:\windows\system\FMBELO.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SKBPN.exe.bat" "62⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\windows\SysWOW64\SKBPN.exeC:\windows\system32\SKBPN.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XPLFE.exe.bat" "64⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\windows\XPLFE.exeC:\windows\XPLFE.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IDSD.exe.bat" "66⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2708 -
C:\windows\IDSD.exeC:\windows\IDSD.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4636 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HBDGWCQ.exe.bat" "68⤵
- Executes a command shell one-liner
PID:4524 -
C:\windows\SysWOW64\HBDGWCQ.exeC:\windows\system32\HBDGWCQ.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UZLRFN.exe.bat" "70⤵
- Executes a command shell one-liner
PID:5148 -
C:\windows\system\UZLRFN.exeC:\windows\system\UZLRFN.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VCPVL.exe.bat" "72⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1368 -
C:\windows\VCPVL.exeC:\windows\VCPVL.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DHUC.exe.bat" "74⤵
- Executes a command shell one-liner
PID:1216 -
C:\windows\DHUC.exeC:\windows\DHUC.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QSKSKNR.exe.bat" "76⤵
- Executes a command shell one-liner
PID:2760 -
C:\windows\QSKSKNR.exeC:\windows\QSKSKNR.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FILSQI.exe.bat" "78⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3716 -
C:\windows\FILSQI.exeC:\windows\FILSQI.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6024 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JYS.exe.bat" "80⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1564 -
C:\windows\SysWOW64\JYS.exeC:\windows\system32\JYS.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KTVVI.exe.bat" "82⤵
- Executes a command shell one-liner
PID:4440 -
C:\windows\KTVVI.exeC:\windows\KTVVI.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3620 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MRJQQ.exe.bat" "84⤵
- Executes a command shell one-liner
PID:3828 -
C:\windows\system\MRJQQ.exeC:\windows\system\MRJQQ.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YHQQCJJ.exe.bat" "86⤵
- Executes a command shell one-liner
PID:3172 -
C:\windows\system\YHQQCJJ.exeC:\windows\system\YHQQCJJ.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:608 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RCTTHH.exe.bat" "88⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4464 -
C:\windows\SysWOW64\RCTTHH.exeC:\windows\system32\RCTTHH.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1136 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AKVZLEM.exe.bat" "90⤵
- Executes a command shell one-liner
PID:1420 -
C:\windows\SysWOW64\AKVZLEM.exeC:\windows\system32\AKVZLEM.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BNZU.exe.bat" "92⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1292 -
C:\windows\system\BNZU.exeC:\windows\system\BNZU.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OQIT.exe.bat" "94⤵
- Executes a command shell one-liner
PID:4228 -
C:\windows\OQIT.exeC:\windows\OQIT.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FYWQ.exe.bat" "96⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:792 -
C:\windows\SysWOW64\FYWQ.exeC:\windows\system32\FYWQ.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PWCKGFV.exe.bat" "98⤵PID:3712
-
C:\windows\SysWOW64\PWCKGFV.exeC:\windows\system32\PWCKGFV.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VRBL.exe.bat" "100⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3456 -
C:\windows\system\VRBL.exeC:\windows\system\VRBL.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2292 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SXT.exe.bat" "102⤵
- Executes a command shell one-liner
PID:1836 -
C:\windows\system\SXT.exeC:\windows\system\SXT.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4048 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YKSJYG.exe.bat" "104⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:692 -
C:\windows\system\YKSJYG.exeC:\windows\system\YKSJYG.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1356 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LVBA.exe.bat" "106⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1988 -
C:\windows\system\LVBA.exeC:\windows\system\LVBA.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MYF.exe.bat" "108⤵
- Executes a command shell one-liner
PID:4100 -
C:\windows\system\MYF.exeC:\windows\system\MYF.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5292 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EBIZF.exe.bat" "110⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1664 -
C:\windows\system\EBIZF.exeC:\windows\system\EBIZF.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2196 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FWM.exe.bat" "112⤵
- Executes a command shell one-liner
PID:2108 -
C:\windows\system\FWM.exeC:\windows\system\FWM.exe113⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3356 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YZYZQ.exe.bat" "114⤵
- Executes a command shell one-liner
PID:4944 -
C:\windows\system\YZYZQ.exeC:\windows\system\YZYZQ.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IXETF.exe.bat" "116⤵
- Executes a command shell one-liner
PID:1360 -
C:\windows\SysWOW64\IXETF.exeC:\windows\system32\IXETF.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KVJNNTV.exe.bat" "118⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1616 -
C:\windows\SysWOW64\KVJNNTV.exeC:\windows\system32\KVJNNTV.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KYNJSJ.exe.bat" "120⤵
- Executes a command shell one-liner
PID:3584 -
C:\windows\SysWOW64\KYNJSJ.exeC:\windows\system32\KYNJSJ.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5632
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-