Analysis
- max time kernel
80s - max time network
130s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
13/08/2026, 01:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-12_61560852a8a4f491463cd0917aaced10_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-12_61560852a8a4f491463cd0917aaced10_elex_emotet_stop.exe
- Size 208KB
- Sample260813-be148sydrc
- SHA256 877449e20c532ce837753196331a88035778e377f1ddc75dcf2c3d32716a2d0f
- MD5 61560852a8a4f491463cd0917aaced10
- SHA1 2a4ac5f8598655f730837ed84f90a3f95e85c417
- SHA512 55a78187467c0d5a8975370aee32a9f73b0de7dff55b58d6cc61ae425d247e5d8c9d5521d9d2812b1770c5704c4d07d0c171a0dfe1646e2dec93fc3e616e48b3
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlJdL+LOfJ4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFlJ5+LOxkEj1
- TLSH T128247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2236 ZULHGB.exe 2828 JXDIY.exe 2684 KVDRJS.exe 4404 DNSCST.exe 3420 VWHZFK.exe 4824 DBLGPI.exe 3720 ZCVQT.exe 200 NXHJHBD.exe 1152 VCLPRZ.exe 4556 UVIYBZN.exe 5700 XDJ.exe 4600 QWZ.exe 6056 HHBVAAN.exe 2244 MHLYMW.exe 2940 INWNCZR.exe 4536 YDF.exe 2440 RVM.exe 2588 STUGV.exe 1080 OZMVL.exe 3320 VMYOZ.exe 5724 DACVJ.exe 5672 NXIP.exe 3912 AVQ.exe 948 TWX.exe 1652 SGUU.exe 5368 RRX.exe 3612 PCAALUK.exe 1424 WXMTRR.exe 4136 PQBMIK.exe 3024 XDGTTI.exe 1100 LZR.exe 6060 CJUCI.exe 472 ORJC.exe 5708 XADPX.exe 1224 KKT.exe 5412 WTAOYE.exe 1160 DJBF.exe 4840 CTE.exe 4552 XEUUTI.exe 3048 FUVL.exe 2304 JAN.exe 5228 RQOAXU.exe 2956 BOUUED.exe 5112 UGJFOE.exe 3552 YJIAVXW.exe 4464 GXMHGV.exe 2908 FMFCTAZ.exe 4992 XPJF.exe 4212 DLIGD.exe 5316 NJOA.exe 1544 PGUV.exe 3488 ORE.exe 2540 BUNBPB.exe 1956 VUCMGC.exe 1836 DAHTR.exe 2404 WNOZ.exe 6068 PQS.exe 4336 IJZGLT.exe 2876 HUKWU.exe 2024 UFSUI.exe 5240 ECGPPSJ.exe 6124 BVIRBO.exe 2428 JLLU.exe 4568 QHW.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\KVDRJS.exe JXDIY.exe File created C:\windows\SysWOW64\NJOA.exe DLIGD.exe File created C:\windows\SysWOW64\QHW.exe JLLU.exe File opened for modification C:\windows\SysWOW64\EKQQKVL.exe GAN.exe File created C:\windows\SysWOW64\XCBGN.exe.bat EKMVD.exe File created C:\windows\SysWOW64\EKMVD.exe HJKLSD.exe File created C:\windows\SysWOW64\XCBGN.exe EKMVD.exe File created C:\windows\SysWOW64\UFSUI.exe HUKWU.exe File created C:\windows\SysWOW64\KVDRJS.exe.bat JXDIY.exe File created C:\windows\SysWOW64\OZMVL.exe.bat STUGV.exe File created C:\windows\SysWOW64\CJUCI.exe LZR.exe File opened for modification C:\windows\SysWOW64\XADPX.exe ORJC.exe File created C:\windows\SysWOW64\XADPX.exe.bat ORJC.exe File created C:\windows\SysWOW64\BUNBPB.exe ORE.exe File opened for modification C:\windows\SysWOW64\UFSUI.exe HUKWU.exe File created C:\windows\SysWOW64\YJYPVJW.exe ZYV.exe File created C:\windows\SysWOW64\UFSUI.exe.bat HUKWU.exe File created C:\windows\SysWOW64\KERE.exe YMCT.exe File created C:\windows\SysWOW64\FLFZKVE.exe KAOA.exe File created C:\windows\SysWOW64\VWHZFK.exe DNSCST.exe File created C:\windows\SysWOW64\PCAALUK.exe.bat RRX.exe File opened for modification C:\windows\SysWOW64\DJBF.exe WTAOYE.exe File created C:\windows\SysWOW64\WNOZ.exe DAHTR.exe File created C:\windows\SysWOW64\WNOZ.exe.bat DAHTR.exe File created C:\windows\SysWOW64\PCAALUK.exe RRX.exe File opened for modification C:\windows\SysWOW64\PCAALUK.exe RRX.exe File opened for modification C:\windows\SysWOW64\BUNBPB.exe ORE.exe File created C:\windows\SysWOW64\BUNBPB.exe.bat ORE.exe File created C:\windows\SysWOW64\YJYPVJW.exe.bat ZYV.exe File created C:\windows\SysWOW64\FLFZKVE.exe.bat KAOA.exe File opened for modification C:\windows\SysWOW64\XCBGN.exe EKMVD.exe File opened for modification C:\windows\SysWOW64\OZMVL.exe STUGV.exe File created C:\windows\SysWOW64\XADPX.exe ORJC.exe File created C:\windows\SysWOW64\EKQQKVL.exe.bat GAN.exe File opened for modification C:\windows\SysWOW64\FLFZKVE.exe KAOA.exe File opened for modification C:\windows\SysWOW64\EKMVD.exe HJKLSD.exe File created C:\windows\SysWOW64\VWHZFK.exe.bat DNSCST.exe File created C:\windows\SysWOW64\EKMVD.exe.bat HJKLSD.exe File opened for modification C:\windows\SysWOW64\VWHZFK.exe DNSCST.exe File created C:\windows\SysWOW64\VCLPRZ.exe NXHJHBD.exe File created C:\windows\SysWOW64\DJBF.exe WTAOYE.exe File created C:\windows\SysWOW64\JAN.exe FUVL.exe File opened for modification C:\windows\SysWOW64\JAN.exe FUVL.exe File created C:\windows\SysWOW64\JAN.exe.bat FUVL.exe File created C:\windows\SysWOW64\NJOA.exe.bat DLIGD.exe File created C:\windows\SysWOW64\JLLU.exe BVIRBO.exe File opened for modification C:\windows\SysWOW64\VCLPRZ.exe NXHJHBD.exe File opened for modification C:\windows\SysWOW64\DAHTR.exe VUCMGC.exe File created C:\windows\SysWOW64\JLLU.exe.bat BVIRBO.exe File opened for modification C:\windows\SysWOW64\QHW.exe JLLU.exe File created C:\windows\SysWOW64\QHW.exe.bat JLLU.exe File opened for modification C:\windows\SysWOW64\YJYPVJW.exe ZYV.exe File created C:\windows\SysWOW64\DAHTR.exe VUCMGC.exe File opened for modification C:\windows\SysWOW64\KVDRJS.exe JXDIY.exe File created C:\windows\SysWOW64\OZMVL.exe STUGV.exe File created C:\windows\SysWOW64\DJBF.exe.bat WTAOYE.exe File opened for modification C:\windows\SysWOW64\NJOA.exe DLIGD.exe File opened for modification C:\windows\SysWOW64\JLLU.exe BVIRBO.exe File opened for modification C:\windows\SysWOW64\CJUCI.exe LZR.exe File opened for modification C:\windows\SysWOW64\WNOZ.exe DAHTR.exe File created C:\windows\SysWOW64\EKQQKVL.exe GAN.exe File created C:\windows\SysWOW64\KERE.exe.bat YMCT.exe File created C:\windows\SysWOW64\VCLPRZ.exe.bat NXHJHBD.exe File created C:\windows\SysWOW64\DAHTR.exe.bat VUCMGC.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\XDJ.exe UVIYBZN.exe File created C:\windows\system\XDJ.exe.bat UVIYBZN.exe File created C:\windows\system\YDF.exe INWNCZR.exe File opened for modification C:\windows\system\LZR.exe XDGTTI.exe File opened for modification C:\windows\BOUUED.exe RQOAXU.exe File created C:\windows\system\XPJF.exe FMFCTAZ.exe File opened for modification C:\windows\system\BVIRBO.exe ECGPPSJ.exe File opened for modification C:\windows\system\STUGV.exe RVM.exe File created C:\windows\system\PQBMIK.exe WXMTRR.exe File created C:\windows\CTE.exe DJBF.exe File created C:\windows\RQOAXU.exe JAN.exe File opened for modification C:\windows\ZYV.exe EKQQKVL.exe File created C:\windows\system\CHDH.exe.bat LZXC.exe File opened for modification C:\windows\SCVLNRN.exe CHDH.exe File created C:\windows\JLP.exe SCVLNRN.exe File created C:\windows\system\NXHJHBD.exe ZCVQT.exe File created C:\windows\system\PGUV.exe NJOA.exe File created C:\windows\system\ECGPPSJ.exe UFSUI.exe File opened for modification C:\windows\system\UKNBP.exe HIFKJMY.exe File created C:\windows\system\ZULHGB.exe 2026-08-12_61560852a8a4f491463cd0917aaced10_elex_emotet_stop.exe File opened for modification C:\windows\RRX.exe SGUU.exe File created C:\windows\system\PQBMIK.exe.bat WXMTRR.exe File opened for modification C:\windows\system\HJKLSD.exe FLFZKVE.exe File created C:\windows\system\RGDX.exe JTZR.exe File created C:\windows\system\CHDH.exe LZXC.exe File opened for modification C:\windows\system\ZULHGB.exe 2026-08-12_61560852a8a4f491463cd0917aaced10_elex_emotet_stop.exe File created C:\windows\system\QWZ.exe XDJ.exe File created C:\windows\system\YDF.exe.bat INWNCZR.exe File created C:\windows\system\ORJC.exe CJUCI.exe File created C:\windows\RQB.exe.bat JLP.exe File opened for modification C:\windows\NBMB.exe TOHSREU.exe File created C:\windows\system\NXIP.exe.bat DACVJ.exe File created C:\windows\system\FUVL.exe.bat XEUUTI.exe File created C:\windows\system\ORE.exe PGUV.exe File opened for modification C:\windows\system\HAH.exe XCBGN.exe File opened for modification C:\windows\system\RGDX.exe JTZR.exe File created C:\windows\system\OHNAE.exe.bat RGDX.exe File created C:\windows\DNSCST.exe.bat KVDRJS.exe File created C:\windows\WTAOYE.exe KKT.exe File opened for modification C:\windows\RQOAXU.exe JAN.exe File opened for modification C:\windows\system\HUKWU.exe IJZGLT.exe File opened for modification C:\windows\system\ORZDPYU.exe QHW.exe File opened for modification C:\windows\GAN.exe ORZDPYU.exe File created C:\windows\system\YMCT.exe YJYPVJW.exe File created C:\windows\GLSJDXA.exe.bat HAH.exe File opened for modification C:\windows\YJIAVXW.exe UGJFOE.exe File created C:\windows\system\FMFCTAZ.exe.bat GXMHGV.exe File opened for modification C:\windows\system\YMCT.exe YJYPVJW.exe File opened for modification C:\windows\system\KAOA.exe UKNBP.exe File created C:\windows\system\LZXC.exe OHNAE.exe File created C:\windows\NBMB.exe TOHSREU.exe File created C:\windows\system\WPYI.exe NBMB.exe File created C:\windows\YJIAVXW.exe UGJFOE.exe File opened for modification C:\windows\system\AVQ.exe NXIP.exe File created C:\windows\INWNCZR.exe MHLYMW.exe File opened for modification C:\windows\INWNCZR.exe MHLYMW.exe File created C:\windows\system\VMYOZ.exe OZMVL.exe File created C:\windows\system\LZR.exe XDGTTI.exe File created C:\windows\system\ORE.exe.bat PGUV.exe File opened for modification C:\windows\VUCMGC.exe BUNBPB.exe File created C:\windows\UGJFOE.exe.bat BOUUED.exe File opened for modification C:\windows\system\GXMHGV.exe YJIAVXW.exe File created C:\windows\system\VMYOZ.exe.bat OZMVL.exe File created C:\windows\system\TWX.exe AVQ.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 696 cmd.exe 2248 cmd.exe 3248 cmd.exe 3164 cmd.exe 3544 cmd.exe 5552 cmd.exe 3348 cmd.exe 5440 cmd.exe 4300 cmd.exe 5220 cmd.exe 4772 cmd.exe 2028 cmd.exe 5968 cmd.exe 3268 cmd.exe 4328 cmd.exe 2576 cmd.exe 4148 cmd.exe 4436 cmd.exe 5248 cmd.exe 5836 cmd.exe 3724 cmd.exe 4848 cmd.exe 5424 cmd.exe 3628 cmd.exe 4200 cmd.exe 4984 cmd.exe 5832 cmd.exe 5596 cmd.exe 2324 cmd.exe 4944 cmd.exe 1600 cmd.exe 3780 cmd.exe 3232 cmd.exe 2640 cmd.exe 3556 cmd.exe 1228 cmd.exe 4852 cmd.exe 5268 cmd.exe 4500 cmd.exe 3432 cmd.exe 5684 cmd.exe 5984 cmd.exe 2460 cmd.exe 5972 cmd.exe 2932 cmd.exe 5556 cmd.exe 6016 cmd.exe 4924 cmd.exe 5872 cmd.exe 3364 cmd.exe 5720 cmd.exe 4548 cmd.exe 1796 cmd.exe 5976 cmd.exe 4452 cmd.exe 5904 cmd.exe 4532 cmd.exe 3196 cmd.exe 3864 cmd.exe 2068 cmd.exe 5932 cmd.exe 1208 cmd.exe 1960 cmd.exe 4784 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 2532 5856 WerFault.exe 86 616 2236 WerFault.exe 92 2920 2828 WerFault.exe 98 2912 2684 WerFault.exe 103 3192 4404 WerFault.exe 108 4276 3420 WerFault.exe 113 6008 4824 WerFault.exe 118 1360 3720 WerFault.exe 123 4892 200 WerFault.exe 128 5848 1152 WerFault.exe 133 1092 4556 WerFault.exe 138 1048 5700 WerFault.exe 143 3912 4600 WerFault.exe 148 2904 6056 WerFault.exe 153 2384 2244 WerFault.exe 158 852 2940 WerFault.exe 163 4504 4536 WerFault.exe 168 1276 2440 WerFault.exe 173 3408 2588 WerFault.exe 178 5732 1080 WerFault.exe 183 5160 3320 WerFault.exe 188 2760 5724 WerFault.exe 193 5916 5672 WerFault.exe 198 864 3912 WerFault.exe 203 4324 948 WerFault.exe 208 2296 1652 WerFault.exe 213 2560 5368 WerFault.exe 218 5504 3612 WerFault.exe 223 5800 1424 WerFault.exe 228 5628 4136 WerFault.exe 233 5704 3024 WerFault.exe 238 5740 1100 WerFault.exe 243 3544 6060 WerFault.exe 248 2452 472 WerFault.exe 254 2904 5708 WerFault.exe 259 1460 1224 WerFault.exe 264 4072 5412 WerFault.exe 269 5340 1160 WerFault.exe 274 4336 4840 WerFault.exe 279 2892 4552 WerFault.exe 284 3368 3048 WerFault.exe 289 2248 2304 WerFault.exe 294 4084 5228 WerFault.exe 299 2492 2956 WerFault.exe 304 1132 5112 WerFault.exe 309 2888 3552 WerFault.exe 314 3336 4464 WerFault.exe 319 4780 2908 WerFault.exe 324 1712 4992 WerFault.exe 329 3148 4212 WerFault.exe 334 6112 5316 WerFault.exe 339 4828 1544 WerFault.exe 344 4156 3488 WerFault.exe 349 2428 2540 WerFault.exe 354 2384 1956 WerFault.exe 359 960 1836 WerFault.exe 364 1812 2404 WerFault.exe 369 1568 6068 WerFault.exe 374 4144 4336 WerFault.exe 379 5912 2876 WerFault.exe 384 3728 2024 WerFault.exe 389 3496 5240 WerFault.exe 394 600 6124 WerFault.exe 399 2300 2428 WerFault.exe 404 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UKNBP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HJKLSD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XCBGN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LZXC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FUVL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NJOA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BVIRBO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YMCT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NBMB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XADPX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RQOAXU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JLP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PQBMIK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FMFCTAZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UGJFOE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NXIP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UCXY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OHNAE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DAHTR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PQS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EKQQKVL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RGDX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZCVQT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DACVJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PCAALUK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EKMVD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KERE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UVIYBZN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VWHZFK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NXHJHBD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HHBVAAN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language INWNCZR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TOHSREU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DBLGPI.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5856 2026-08-12_61560852a8a4f491463cd0917aaced10_elex_emotet_stop.exe 5856 2026-08-12_61560852a8a4f491463cd0917aaced10_elex_emotet_stop.exe 2236 ZULHGB.exe 2236 ZULHGB.exe 2828 JXDIY.exe 2828 JXDIY.exe 2684 KVDRJS.exe 2684 KVDRJS.exe 4404 DNSCST.exe 4404 DNSCST.exe 3420 VWHZFK.exe 3420 VWHZFK.exe 4824 DBLGPI.exe 4824 DBLGPI.exe 3720 ZCVQT.exe 3720 ZCVQT.exe 200 NXHJHBD.exe 200 NXHJHBD.exe 1152 VCLPRZ.exe 1152 VCLPRZ.exe 4556 UVIYBZN.exe 4556 UVIYBZN.exe 5700 XDJ.exe 5700 XDJ.exe 4600 QWZ.exe 4600 QWZ.exe 6056 HHBVAAN.exe 6056 HHBVAAN.exe 2244 MHLYMW.exe 2244 MHLYMW.exe 2940 INWNCZR.exe 2940 INWNCZR.exe 4536 YDF.exe 4536 YDF.exe 2440 RVM.exe 2440 RVM.exe 2588 STUGV.exe 2588 STUGV.exe 1080 OZMVL.exe 1080 OZMVL.exe 3320 VMYOZ.exe 3320 VMYOZ.exe 5724 DACVJ.exe 5724 DACVJ.exe 5672 NXIP.exe 5672 NXIP.exe 3912 AVQ.exe 3912 AVQ.exe 948 TWX.exe 948 TWX.exe 1652 SGUU.exe 1652 SGUU.exe 5368 RRX.exe 5368 RRX.exe 3612 PCAALUK.exe 3612 PCAALUK.exe 1424 WXMTRR.exe 1424 WXMTRR.exe 4136 PQBMIK.exe 4136 PQBMIK.exe 3024 XDGTTI.exe 3024 XDGTTI.exe 1100 LZR.exe 1100 LZR.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 5856 2026-08-12_61560852a8a4f491463cd0917aaced10_elex_emotet_stop.exe 5856 2026-08-12_61560852a8a4f491463cd0917aaced10_elex_emotet_stop.exe 2236 ZULHGB.exe 2236 ZULHGB.exe 2828 JXDIY.exe 2828 JXDIY.exe 2684 KVDRJS.exe 2684 KVDRJS.exe 4404 DNSCST.exe 4404 DNSCST.exe 3420 VWHZFK.exe 3420 VWHZFK.exe 4824 DBLGPI.exe 4824 DBLGPI.exe 3720 ZCVQT.exe 3720 ZCVQT.exe 200 NXHJHBD.exe 200 NXHJHBD.exe 1152 VCLPRZ.exe 1152 VCLPRZ.exe 4556 UVIYBZN.exe 4556 UVIYBZN.exe 5700 XDJ.exe 5700 XDJ.exe 4600 QWZ.exe 4600 QWZ.exe 6056 HHBVAAN.exe 6056 HHBVAAN.exe 2244 MHLYMW.exe 2244 MHLYMW.exe 2940 INWNCZR.exe 2940 INWNCZR.exe 4536 YDF.exe 4536 YDF.exe 2440 RVM.exe 2440 RVM.exe 2588 STUGV.exe 2588 STUGV.exe 1080 OZMVL.exe 1080 OZMVL.exe 3320 VMYOZ.exe 3320 VMYOZ.exe 5724 DACVJ.exe 5724 DACVJ.exe 5672 NXIP.exe 5672 NXIP.exe 3912 AVQ.exe 3912 AVQ.exe 948 TWX.exe 948 TWX.exe 1652 SGUU.exe 1652 SGUU.exe 5368 RRX.exe 5368 RRX.exe 3612 PCAALUK.exe 3612 PCAALUK.exe 1424 WXMTRR.exe 1424 WXMTRR.exe 4136 PQBMIK.exe 4136 PQBMIK.exe 3024 XDGTTI.exe 3024 XDGTTI.exe 1100 LZR.exe 1100 LZR.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5856 wrote to memory of 3248 5856 2026-08-12_61560852a8a4f491463cd0917aaced10_elex_emotet_stop.exe 88 PID 3248 wrote to memory of 2236 3248 cmd.exe 92 PID 2236 wrote to memory of 1796 2236 ZULHGB.exe 94 PID 1796 wrote to memory of 2828 1796 cmd.exe 98 PID 2828 wrote to memory of 1240 2828 JXDIY.exe 99 PID 1240 wrote to memory of 2684 1240 cmd.exe 103 PID 2684 wrote to memory of 2536 2684 KVDRJS.exe 104 PID 2536 wrote to memory of 4404 2536 cmd.exe 108 PID 4404 wrote to memory of 5756 4404 DNSCST.exe 109 PID 5756 wrote to memory of 3420 5756 cmd.exe 113 PID 3420 wrote to memory of 2068 3420 VWHZFK.exe 114 PID 2068 wrote to memory of 4824 2068 cmd.exe 118 PID 4824 wrote to memory of 1120 4824 DBLGPI.exe 119 PID 1120 wrote to memory of 3720 1120 cmd.exe 123 PID 3720 wrote to memory of 4772 3720 ZCVQT.exe 124 PID 4772 wrote to memory of 200 4772 cmd.exe 128 PID 200 wrote to memory of 244 200 NXHJHBD.exe 129 PID 244 wrote to memory of 1152 244 cmd.exe 133 PID 1152 wrote to memory of 6128 1152 VCLPRZ.exe 134 PID 6128 wrote to memory of 4556 6128 cmd.exe 138 PID 4556 wrote to memory of 4148 4556 UVIYBZN.exe 139 PID 4148 wrote to memory of 5700 4148 cmd.exe 143 PID 5700 wrote to memory of 4632 5700 XDJ.exe 144 PID 4632 wrote to memory of 4600 4632 cmd.exe 148 PID 4600 wrote to memory of 3856 4600 QWZ.exe 149 PID 3856 wrote to memory of 6056 3856 cmd.exe 153 PID 6056 wrote to memory of 5880 6056 HHBVAAN.exe 154 PID 5880 wrote to memory of 2244 5880 cmd.exe 158 PID 2244 wrote to memory of 5884 2244 MHLYMW.exe 159 PID 5884 wrote to memory of 2940 5884 cmd.exe 163 PID 2940 wrote to memory of 5976 2940 INWNCZR.exe 164 PID 5976 wrote to memory of 4536 5976 cmd.exe 168 PID 4536 wrote to memory of 3056 4536 YDF.exe 169 PID 3056 wrote to memory of 2440 3056 cmd.exe 173 PID 2440 wrote to memory of 4436 2440 RVM.exe 174 PID 4436 wrote to memory of 2588 4436 cmd.exe 178 PID 2588 wrote to memory of 3296 2588 STUGV.exe 179 PID 3296 wrote to memory of 1080 3296 cmd.exe 183 PID 1080 wrote to memory of 5248 1080 OZMVL.exe 184 PID 5248 wrote to memory of 3320 5248 cmd.exe 188 PID 3320 wrote to memory of 2524 3320 VMYOZ.exe 189 PID 2524 wrote to memory of 5724 2524 cmd.exe 193 PID 5724 wrote to memory of 236 5724 DACVJ.exe 194 PID 236 wrote to memory of 5672 236 cmd.exe 198 PID 5672 wrote to memory of 5932 5672 NXIP.exe 199 PID 5932 wrote to memory of 3912 5932 cmd.exe 203 PID 3912 wrote to memory of 6076 3912 AVQ.exe 204 PID 6076 wrote to memory of 948 6076 cmd.exe 208 PID 948 wrote to memory of 4972 948 TWX.exe 209 PID 4972 wrote to memory of 1652 4972 cmd.exe 213 PID 1652 wrote to memory of 3432 1652 SGUU.exe 214 PID 3432 wrote to memory of 5368 3432 cmd.exe 218 PID 5368 wrote to memory of 4628 5368 RRX.exe 219 PID 4628 wrote to memory of 3612 4628 cmd.exe 223 PID 3612 wrote to memory of 3364 3612 PCAALUK.exe 224 PID 3364 wrote to memory of 1424 3364 cmd.exe 228 PID 1424 wrote to memory of 6000 1424 WXMTRR.exe 229 PID 6000 wrote to memory of 4136 6000 cmd.exe 233 PID 4136 wrote to memory of 1704 4136 PQBMIK.exe 234 PID 1704 wrote to memory of 3024 1704 cmd.exe 238 PID 3024 wrote to memory of 4924 3024 XDGTTI.exe 239 PID 4924 wrote to memory of 1100 4924 cmd.exe 243 PID 1100 wrote to memory of 700 1100 LZR.exe 244 PID 700 wrote to memory of 6060 700 cmd.exe 248
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-12_61560852a8a4f491463cd0917aaced10_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-12_61560852a8a4f491463cd0917aaced10_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZULHGB.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\windows\system\ZULHGB.exeC:\windows\system\ZULHGB.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JXDIY.exe.bat" "4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\windows\JXDIY.exeC:\windows\JXDIY.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KVDRJS.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\windows\SysWOW64\KVDRJS.exeC:\windows\system32\KVDRJS.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DNSCST.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\windows\DNSCST.exeC:\windows\DNSCST.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VWHZFK.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:5756 -
C:\windows\SysWOW64\VWHZFK.exeC:\windows\system32\VWHZFK.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DBLGPI.exe.bat" "12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\windows\DBLGPI.exeC:\windows\DBLGPI.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZCVQT.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\windows\system\ZCVQT.exeC:\windows\system\ZCVQT.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NXHJHBD.exe.bat" "16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\windows\system\NXHJHBD.exeC:\windows\system\NXHJHBD.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VCLPRZ.exe.bat" "18⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:244 -
C:\windows\SysWOW64\VCLPRZ.exeC:\windows\system32\VCLPRZ.exe19⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UVIYBZN.exe.bat" "20⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6128 -
C:\windows\system\UVIYBZN.exeC:\windows\system\UVIYBZN.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XDJ.exe.bat" "22⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\windows\system\XDJ.exeC:\windows\system\XDJ.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QWZ.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\windows\system\QWZ.exeC:\windows\system\QWZ.exe25⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HHBVAAN.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\windows\system\HHBVAAN.exeC:\windows\system\HHBVAAN.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6056 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MHLYMW.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:5880 -
C:\windows\MHLYMW.exeC:\windows\MHLYMW.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\INWNCZR.exe.bat" "30⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5884 -
C:\windows\INWNCZR.exeC:\windows\INWNCZR.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YDF.exe.bat" "32⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5976 -
C:\windows\system\YDF.exeC:\windows\system\YDF.exe33⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RVM.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\windows\system\RVM.exeC:\windows\system\RVM.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\STUGV.exe.bat" "36⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\windows\system\STUGV.exeC:\windows\system\STUGV.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OZMVL.exe.bat" "38⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3296 -
C:\windows\SysWOW64\OZMVL.exeC:\windows\system32\OZMVL.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VMYOZ.exe.bat" "40⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5248 -
C:\windows\system\VMYOZ.exeC:\windows\system\VMYOZ.exe41⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DACVJ.exe.bat" "42⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\windows\DACVJ.exeC:\windows\DACVJ.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NXIP.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:236 -
C:\windows\system\NXIP.exeC:\windows\system\NXIP.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5672 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AVQ.exe.bat" "46⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5932 -
C:\windows\system\AVQ.exeC:\windows\system\AVQ.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TWX.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:6076 -
C:\windows\system\TWX.exeC:\windows\system\TWX.exe49⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SGUU.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\windows\system\SGUU.exeC:\windows\system\SGUU.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RRX.exe.bat" "52⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\windows\RRX.exeC:\windows\RRX.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PCAALUK.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\windows\SysWOW64\PCAALUK.exeC:\windows\system32\PCAALUK.exe55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WXMTRR.exe.bat" "56⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\windows\system\WXMTRR.exeC:\windows\system\WXMTRR.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PQBMIK.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:6000 -
C:\windows\system\PQBMIK.exeC:\windows\system\PQBMIK.exe59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XDGTTI.exe.bat" "60⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\windows\XDGTTI.exeC:\windows\XDGTTI.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LZR.exe.bat" "62⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\windows\system\LZR.exeC:\windows\system\LZR.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CJUCI.exe.bat" "64⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:700 -
C:\windows\SysWOW64\CJUCI.exeC:\windows\system32\CJUCI.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ORJC.exe.bat" "66⤵PID:3356
-
C:\windows\system\ORJC.exeC:\windows\system\ORJC.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XADPX.exe.bat" "68⤵PID:5736
-
C:\windows\SysWOW64\XADPX.exeC:\windows\system32\XADPX.exe69⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KKT.exe.bat" "70⤵PID:2188
-
C:\windows\KKT.exeC:\windows\KKT.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1224 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WTAOYE.exe.bat" "72⤵
- Executes a command shell one-liner
PID:4452 -
C:\windows\WTAOYE.exeC:\windows\WTAOYE.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DJBF.exe.bat" "74⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1228 -
C:\windows\SysWOW64\DJBF.exeC:\windows\system32\DJBF.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CTE.exe.bat" "76⤵
- Executes a command shell one-liner
PID:5904 -
C:\windows\CTE.exeC:\windows\CTE.exe77⤵
- Executes dropped EXE
PID:4840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XEUUTI.exe.bat" "78⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4852 -
C:\windows\system\XEUUTI.exeC:\windows\system\XEUUTI.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FUVL.exe.bat" "80⤵PID:4688
-
C:\windows\system\FUVL.exeC:\windows\system\FUVL.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3048 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JAN.exe.bat" "82⤵PID:5048
-
C:\windows\SysWOW64\JAN.exeC:\windows\system32\JAN.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RQOAXU.exe.bat" "84⤵
- Executes a command shell one-liner
PID:3164 -
C:\windows\RQOAXU.exeC:\windows\RQOAXU.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5228 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BOUUED.exe.bat" "86⤵
- Executes a command shell one-liner
PID:3544 -
C:\windows\BOUUED.exeC:\windows\BOUUED.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UGJFOE.exe.bat" "88⤵
- Executes a command shell one-liner
PID:2028 -
C:\windows\UGJFOE.exeC:\windows\UGJFOE.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YJIAVXW.exe.bat" "90⤵
- System Location Discovery: System Language Discovery
PID:4220 -
C:\windows\YJIAVXW.exeC:\windows\YJIAVXW.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GXMHGV.exe.bat" "92⤵
- System Location Discovery: System Language Discovery
PID:3520 -
C:\windows\system\GXMHGV.exeC:\windows\system\GXMHGV.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FMFCTAZ.exe.bat" "94⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4532 -
C:\windows\system\FMFCTAZ.exeC:\windows\system\FMFCTAZ.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XPJF.exe.bat" "96⤵PID:552
-
C:\windows\system\XPJF.exeC:\windows\system\XPJF.exe97⤵
- Executes dropped EXE
PID:4992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DLIGD.exe.bat" "98⤵PID:5960
-
C:\windows\DLIGD.exeC:\windows\DLIGD.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4212 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NJOA.exe.bat" "100⤵
- Executes a command shell one-liner
PID:2324 -
C:\windows\SysWOW64\NJOA.exeC:\windows\system32\NJOA.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5316 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PGUV.exe.bat" "102⤵
- Executes a command shell one-liner
PID:5684 -
C:\windows\system\PGUV.exeC:\windows\system\PGUV.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ORE.exe.bat" "104⤵PID:4192
-
C:\windows\system\ORE.exeC:\windows\system\ORE.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BUNBPB.exe.bat" "106⤵PID:4140
-
C:\windows\SysWOW64\BUNBPB.exeC:\windows\system32\BUNBPB.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VUCMGC.exe.bat" "108⤵
- Executes a command shell one-liner
PID:3724 -
C:\windows\VUCMGC.exeC:\windows\VUCMGC.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DAHTR.exe.bat" "110⤵PID:460
-
C:\windows\SysWOW64\DAHTR.exeC:\windows\system32\DAHTR.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WNOZ.exe.bat" "112⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:6016 -
C:\windows\SysWOW64\WNOZ.exeC:\windows\system32\WNOZ.exe113⤵
- Executes dropped EXE
PID:2404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PQS.exe.bat" "114⤵PID:4504
-
C:\windows\system\PQS.exeC:\windows\system\PQS.exe115⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IJZGLT.exe.bat" "116⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4784 -
C:\windows\IJZGLT.exeC:\windows\IJZGLT.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4336 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HUKWU.exe.bat" "118⤵
- Executes a command shell one-liner
PID:4848 -
C:\windows\system\HUKWU.exeC:\windows\system\HUKWU.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UFSUI.exe.bat" "120⤵
- Executes a command shell one-liner
PID:5424 -
C:\windows\SysWOW64\UFSUI.exeC:\windows\system32\UFSUI.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2024
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-