Analysis
- max time kernel
83s - max time network
138s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/08/2026, 23:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-14_a4d099df7cde6db67e201f06ac3db8d8_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-14_a4d099df7cde6db67e201f06ac3db8d8_elex_emotet_stop.exe
- Size 208KB
- Sample260814-28yt3stdqf
- SHA256 63be256389d205ac89317e20980a1d3c71359e46c1cdcbaa56f053ff9bcff1e4
- MD5 a4d099df7cde6db67e201f06ac3db8d8
- SHA1 27488750617182c0b1b593391161571cc031fa32
- SHA512 41b0f83cbfb0f46213a5a8d21fa6b7955070075e2842beff596b1c5824300633958a30a52d48e056418cda360efbe4e3dec72a592c29d9e31cce0fe7742e87e3
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlldL+LOf34pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFll5+LO/kEj1
- TLSH T182247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 416 CEJ.exe 5504 MXFQGZ.exe 2288 NSJ.exe 4256 CVSYEK.exe 3268 XIX.exe 4276 PLBLU.exe 3140 ZBOY.exe 6120 JJQLFO.exe 4816 URX.exe 5896 TNWLWB.exe 5348 IIGY.exe 4128 ILKTU.exe 5892 MBQ.exe 4720 CRRTFR.exe 1848 ACCJO.exe 5648 ZRNM.exe 1072 DULZJEE.exe 4668 CSFCW.exe 996 KYJJG.exe 1796 OJH.exe 1044 KGA.exe 3196 YMAFYHO.exe 4224 PUOCLYJ.exe 4352 YXE.exe 3188 JDD.exe 3484 DDTHWK.exe 2240 STUGV.exe 2512 HOD.exe 1952 LWKLA.exe 3688 EZWO.exe 936 CKYEOH.exe 2736 KYLLZ.exe 6068 SDQSBEY.exe 5420 KMEXOVS.exe 1200 ZCFO.exe 2536 YMI.exe 3492 CUOEP.exe 4356 CXAI.exe 1248 EVGCCN.exe 5356 ILNCPF.exe 3172 SJS.exe 3432 CZG.exe 4268 EXLDT.exe 1936 DPWT.exe 1368 MQQYFQ.exe 4140 LBBOO.exe 3656 EBIZF.exe 3088 ORWU.exe 5632 HUAXSV.exe 4756 IXETF.exe 2708 CKIDILB.exe 4300 RFS.exe 1280 BOUUED.exe 5736 FWB.exe 2412 FZEYW.exe 2820 AMJHGLQ.exe 1496 ECQHSD.exe 1532 KPPQPYC.exe 4732 XAFHD.exe 2864 WLIX.exe 5944 ABPXYH.exe 2276 NZPIATR.exe 204 ZPDQ.exe 3076 KHYJUS.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\SDQSBEY.exe KYLLZ.exe File created C:\windows\SysWOW64\KPPQPYC.exe ECQHSD.exe File opened for modification C:\windows\SysWOW64\KPPQPYC.exe ECQHSD.exe File created C:\windows\SysWOW64\WLIX.exe.bat XAFHD.exe File opened for modification C:\windows\SysWOW64\NSG.exe UPCOFW.exe File created C:\windows\SysWOW64\KVO.exe KHV.exe File created C:\windows\SysWOW64\CSFCW.exe.bat DULZJEE.exe File created C:\windows\SysWOW64\LWKLA.exe HOD.exe File created C:\windows\SysWOW64\NSG.exe.bat UPCOFW.exe File created C:\windows\SysWOW64\IFKBV.exe NSG.exe File created C:\windows\SysWOW64\DVOGZ.exe JIRW.exe File created C:\windows\SysWOW64\IWMZIO.exe.bat ENFZ.exe File opened for modification C:\windows\SysWOW64\JDD.exe YXE.exe File created C:\windows\SysWOW64\SDQSBEY.exe KYLLZ.exe File created C:\windows\SysWOW64\KVO.exe.bat KHV.exe File opened for modification C:\windows\SysWOW64\NSJ.exe MXFQGZ.exe File created C:\windows\SysWOW64\IIGY.exe TNWLWB.exe File created C:\windows\SysWOW64\ACCJO.exe CRRTFR.exe File opened for modification C:\windows\SysWOW64\KMEXOVS.exe SDQSBEY.exe File opened for modification C:\windows\SysWOW64\ABXE.exe FOS.exe File created C:\windows\SysWOW64\GXRFOHC.exe EKMVD.exe File created C:\windows\SysWOW64\JJQLFO.exe ZBOY.exe File opened for modification C:\windows\SysWOW64\OJH.exe KYJJG.exe File created C:\windows\SysWOW64\CUOEP.exe YMI.exe File opened for modification C:\windows\SysWOW64\IXETF.exe HUAXSV.exe File opened for modification C:\windows\SysWOW64\WLIX.exe XAFHD.exe File opened for modification C:\windows\SysWOW64\EBFYIMO.exe TAYNYTG.exe File opened for modification C:\windows\SysWOW64\VRUIR.exe RBNAMCE.exe File opened for modification C:\windows\SysWOW64\EKMVD.exe JOH.exe File opened for modification C:\windows\SysWOW64\ACCJO.exe CRRTFR.exe File opened for modification C:\windows\SysWOW64\CSFCW.exe DULZJEE.exe File opened for modification C:\windows\SysWOW64\HUAXSV.exe ORWU.exe File created C:\windows\SysWOW64\KPPQPYC.exe.bat ECQHSD.exe File opened for modification C:\windows\SysWOW64\XAFHD.exe KPPQPYC.exe File created C:\windows\SysWOW64\UPCOFW.exe.bat ABXE.exe File opened for modification C:\windows\SysWOW64\ENFZ.exe PKOULJ.exe File created C:\windows\SysWOW64\IXETF.exe.bat HUAXSV.exe File opened for modification C:\windows\SysWOW64\AMJHGLQ.exe FZEYW.exe File opened for modification C:\windows\SysWOW64\IIGY.exe TNWLWB.exe File created C:\windows\SysWOW64\KMEXOVS.exe.bat SDQSBEY.exe File created C:\windows\SysWOW64\HUAXSV.exe.bat ORWU.exe File created C:\windows\SysWOW64\UFSUI.exe.bat ZRO.exe File opened for modification C:\windows\SysWOW64\DDTHWK.exe JDD.exe File created C:\windows\SysWOW64\SDQSBEY.exe.bat KYLLZ.exe File created C:\windows\SysWOW64\ZPDQ.exe NZPIATR.exe File created C:\windows\SysWOW64\EBFYIMO.exe.bat TAYNYTG.exe File opened for modification C:\windows\SysWOW64\UFSUI.exe ZRO.exe File created C:\windows\SysWOW64\NSG.exe UPCOFW.exe File opened for modification C:\windows\SysWOW64\IFKBV.exe NSG.exe File created C:\windows\SysWOW64\VRUIR.exe RBNAMCE.exe File opened for modification C:\windows\SysWOW64\CUOEP.exe YMI.exe File created C:\windows\SysWOW64\ZPDQ.exe.bat NZPIATR.exe File created C:\windows\SysWOW64\EBFYIMO.exe TAYNYTG.exe File created C:\windows\SysWOW64\IFKBV.exe.bat NSG.exe File created C:\windows\SysWOW64\VRUIR.exe.bat RBNAMCE.exe File created C:\windows\SysWOW64\DVOGZ.exe.bat JIRW.exe File opened for modification C:\windows\SysWOW64\IWMZIO.exe ENFZ.exe File created C:\windows\SysWOW64\NSJ.exe.bat MXFQGZ.exe File created C:\windows\SysWOW64\JJQLFO.exe.bat ZBOY.exe File created C:\windows\SysWOW64\CSFCW.exe DULZJEE.exe File created C:\windows\SysWOW64\OJH.exe KYJJG.exe File created C:\windows\SysWOW64\DDTHWK.exe.bat JDD.exe File created C:\windows\SysWOW64\RFS.exe CKIDILB.exe File created C:\windows\SysWOW64\ABXE.exe.bat FOS.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\YDGBTWT.exe.bat DQBRJ.exe File created C:\windows\system\EXYS.exe GXRFOHC.exe File created C:\windows\system\EXYS.exe.bat GXRFOHC.exe File created C:\windows\system\JIRW.exe VXAXAH.exe File created C:\windows\ZBOY.exe.bat PLBLU.exe File created C:\windows\ORWU.exe EBIZF.exe File opened for modification C:\windows\system\OGYIPZ.exe CYXPU.exe File created C:\windows\MWFC.exe.bat SAB.exe File created C:\windows\KGA.exe.bat OJH.exe File created C:\windows\CKYEOH.exe.bat EZWO.exe File created C:\windows\system\ZCFO.exe.bat KMEXOVS.exe File created C:\windows\system\EBIZF.exe LBBOO.exe File created C:\windows\KHV.exe VRUIR.exe File opened for modification C:\windows\MBQ.exe ILKTU.exe File opened for modification C:\windows\DPWT.exe EXLDT.exe File created C:\windows\system\NZPIATR.exe ABPXYH.exe File created C:\windows\system\JOH.exe MWFC.exe File created C:\windows\CVSYEK.exe NSJ.exe File opened for modification C:\windows\ZBOY.exe PLBLU.exe File created C:\windows\system\SJS.exe ILNCPF.exe File created C:\windows\system\FWJCNK.exe EBFYIMO.exe File opened for modification C:\windows\system\WOJRCC.exe YDGBTWT.exe File created C:\windows\system\KYJJG.exe CSFCW.exe File created C:\windows\system\PUOCLYJ.exe.bat YMAFYHO.exe File opened for modification C:\windows\HOD.exe STUGV.exe File created C:\windows\CKIDILB.exe.bat IXETF.exe File opened for modification C:\windows\FZEYW.exe FWB.exe File opened for modification C:\windows\system\VIWQNZC.exe UFSUI.exe File created C:\windows\DQBRJ.exe.bat IFKBV.exe File opened for modification C:\windows\BOUUED.exe RFS.exe File created C:\windows\CEJ.exe.bat 2026-08-14_a4d099df7cde6db67e201f06ac3db8d8_elex_emotet_stop.exe File opened for modification C:\windows\CVSYEK.exe NSJ.exe File opened for modification C:\windows\EVGCCN.exe CXAI.exe File created C:\windows\MQQYFQ.exe DPWT.exe File created C:\windows\CKIDILB.exe IXETF.exe File created C:\windows\CVSYEK.exe.bat NSJ.exe File opened for modification C:\windows\system\CRRTFR.exe MBQ.exe File created C:\windows\system\YMI.exe.bat ZCFO.exe File created C:\windows\EVGCCN.exe.bat CXAI.exe File opened for modification C:\windows\system\IIGXEV.exe KHYJUS.exe File created C:\windows\system\OGYIPZ.exe.bat CYXPU.exe File created C:\windows\system\WOJRCC.exe.bat YDGBTWT.exe File opened for modification C:\windows\PKOULJ.exe ZUN.exe File opened for modification C:\windows\system\STUGV.exe DDTHWK.exe File created C:\windows\CKYEOH.exe EZWO.exe File created C:\windows\system\OGYIPZ.exe CYXPU.exe File created C:\windows\VXAXAH.exe.bat EXYS.exe File opened for modification C:\windows\system\ABPXYH.exe WLIX.exe File opened for modification C:\windows\system\EXYS.exe GXRFOHC.exe File created C:\windows\system\ZUN.exe QULQBQ.exe File opened for modification C:\windows\CEJ.exe 2026-08-14_a4d099df7cde6db67e201f06ac3db8d8_elex_emotet_stop.exe File created C:\windows\ZBOY.exe PLBLU.exe File opened for modification C:\windows\system\URX.exe JJQLFO.exe File created C:\windows\system\STUGV.exe DDTHWK.exe File created C:\windows\FWB.exe BOUUED.exe File created C:\windows\system\IIGXEV.exe.bat KHYJUS.exe File created C:\windows\system\BAWINO.exe IIGXEV.exe File opened for modification C:\windows\system\JIRW.exe VXAXAH.exe File created C:\windows\MBQ.exe.bat ILKTU.exe File created C:\windows\system\ILNCPF.exe.bat EVGCCN.exe File opened for modification C:\windows\system\EXLDT.exe CZG.exe File created C:\windows\system\VIWQNZC.exe UFSUI.exe File created C:\windows\system\JIRW.exe.bat VXAXAH.exe File created C:\windows\MEEI.exe.bat JRN.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3848 cmd.exe 4416 cmd.exe 5212 cmd.exe 5920 cmd.exe 4680 cmd.exe 2472 cmd.exe 236 cmd.exe 4856 cmd.exe 1112 cmd.exe 5900 cmd.exe 5236 cmd.exe 3752 cmd.exe 4060 cmd.exe 4260 cmd.exe 1596 cmd.exe 4852 cmd.exe 5204 cmd.exe 6116 cmd.exe 5664 cmd.exe 1360 cmd.exe 4840 cmd.exe 1120 cmd.exe 3300 cmd.exe 1620 cmd.exe 5108 cmd.exe 5368 cmd.exe 4664 cmd.exe 4496 cmd.exe 4712 cmd.exe 5724 cmd.exe 1380 cmd.exe 5312 cmd.exe 1940 cmd.exe 4252 cmd.exe 972 cmd.exe 2968 cmd.exe 4384 cmd.exe 2396 cmd.exe 5812 cmd.exe 3868 cmd.exe 4232 cmd.exe 5692 cmd.exe 6128 cmd.exe 4904 cmd.exe 6124 cmd.exe 2888 cmd.exe 4604 cmd.exe 4100 cmd.exe 6008 cmd.exe 1944 cmd.exe 2312 cmd.exe 5456 cmd.exe 5264 cmd.exe 824 cmd.exe 2644 cmd.exe 248 cmd.exe 3136 cmd.exe 6080 cmd.exe 3676 cmd.exe 2908 cmd.exe 2332 cmd.exe 1192 cmd.exe 1544 cmd.exe 2432 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 6080 5032 WerFault.exe 87 2404 416 WerFault.exe 93 5652 5504 WerFault.exe 98 4612 2288 WerFault.exe 104 812 4256 WerFault.exe 109 4112 3268 WerFault.exe 114 4444 4276 WerFault.exe 119 1360 3140 WerFault.exe 124 5888 6120 WerFault.exe 129 4492 4816 WerFault.exe 134 5532 5896 WerFault.exe 139 2736 5348 WerFault.exe 144 2932 4128 WerFault.exe 149 4604 5892 WerFault.exe 154 4852 4720 WerFault.exe 159 4828 1848 WerFault.exe 164 4556 5648 WerFault.exe 169 5580 1072 WerFault.exe 174 4368 4668 WerFault.exe 179 3688 996 WerFault.exe 184 2348 1796 WerFault.exe 189 2736 1044 WerFault.exe 194 572 3196 WerFault.exe 199 2104 4224 WerFault.exe 204 2276 4352 WerFault.exe 209 1356 3188 WerFault.exe 214 3532 3484 WerFault.exe 219 1480 2240 WerFault.exe 224 3304 2512 WerFault.exe 229 4228 1952 WerFault.exe 234 5112 3688 WerFault.exe 239 5360 936 WerFault.exe 244 5628 2736 WerFault.exe 249 5260 6068 WerFault.exe 254 3668 5420 WerFault.exe 259 1008 1200 WerFault.exe 264 4856 2536 WerFault.exe 270 5984 3492 WerFault.exe 275 4464 4356 WerFault.exe 280 1920 1248 WerFault.exe 285 1080 5356 WerFault.exe 290 3536 3172 WerFault.exe 295 5900 3432 WerFault.exe 300 4852 4268 WerFault.exe 305 5480 1936 WerFault.exe 310 2280 1368 WerFault.exe 315 5688 4140 WerFault.exe 320 1496 3656 WerFault.exe 325 2016 3088 WerFault.exe 330 1196 5632 WerFault.exe 335 1304 4756 WerFault.exe 340 2640 2708 WerFault.exe 345 5964 4300 WerFault.exe 350 2880 1280 WerFault.exe 355 2556 5736 WerFault.exe 360 1092 2412 WerFault.exe 365 1244 2820 WerFault.exe 370 5680 1496 WerFault.exe 375 4456 1532 WerFault.exe 380 3808 4732 WerFault.exe 385 5836 2864 WerFault.exe 390 2924 5944 WerFault.exe 395 4604 2276 WerFault.exe 400 5924 204 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZRO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ABXE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ILNCPF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IXETF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ACCJO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PUOCLYJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CRRTFR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KGA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EBIZF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ECQHSD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IIGXEV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VIWQNZC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NSJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KYJJG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ORWU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CYXPU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZPDQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IFKBV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SDQSBEY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EBFYIMO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WOJRCC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RBNAMCE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VRUIR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EVGCCN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JOH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ENFZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JJQLFO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LBBOO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BOUUED.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FOS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YDGBTWT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JRN.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5032 2026-08-14_a4d099df7cde6db67e201f06ac3db8d8_elex_emotet_stop.exe 5032 2026-08-14_a4d099df7cde6db67e201f06ac3db8d8_elex_emotet_stop.exe 416 CEJ.exe 416 CEJ.exe 5504 MXFQGZ.exe 5504 MXFQGZ.exe 2288 NSJ.exe 2288 NSJ.exe 4256 CVSYEK.exe 4256 CVSYEK.exe 3268 XIX.exe 3268 XIX.exe 4276 PLBLU.exe 4276 PLBLU.exe 3140 ZBOY.exe 3140 ZBOY.exe 6120 JJQLFO.exe 6120 JJQLFO.exe 4816 URX.exe 4816 URX.exe 5896 TNWLWB.exe 5896 TNWLWB.exe 5348 IIGY.exe 5348 IIGY.exe 4128 ILKTU.exe 4128 ILKTU.exe 5892 MBQ.exe 5892 MBQ.exe 4720 CRRTFR.exe 4720 CRRTFR.exe 1848 ACCJO.exe 1848 ACCJO.exe 5648 ZRNM.exe 5648 ZRNM.exe 1072 DULZJEE.exe 1072 DULZJEE.exe 4668 CSFCW.exe 4668 CSFCW.exe 996 KYJJG.exe 996 KYJJG.exe 1796 OJH.exe 1796 OJH.exe 1044 KGA.exe 1044 KGA.exe 3196 YMAFYHO.exe 3196 YMAFYHO.exe 4224 PUOCLYJ.exe 4224 PUOCLYJ.exe 4352 YXE.exe 4352 YXE.exe 3188 JDD.exe 3188 JDD.exe 3484 DDTHWK.exe 3484 DDTHWK.exe 2240 STUGV.exe 2240 STUGV.exe 2512 HOD.exe 2512 HOD.exe 1952 LWKLA.exe 1952 LWKLA.exe 3688 EZWO.exe 3688 EZWO.exe 936 CKYEOH.exe 936 CKYEOH.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 5032 2026-08-14_a4d099df7cde6db67e201f06ac3db8d8_elex_emotet_stop.exe 5032 2026-08-14_a4d099df7cde6db67e201f06ac3db8d8_elex_emotet_stop.exe 416 CEJ.exe 416 CEJ.exe 5504 MXFQGZ.exe 5504 MXFQGZ.exe 2288 NSJ.exe 2288 NSJ.exe 4256 CVSYEK.exe 4256 CVSYEK.exe 3268 XIX.exe 3268 XIX.exe 4276 PLBLU.exe 4276 PLBLU.exe 3140 ZBOY.exe 3140 ZBOY.exe 6120 JJQLFO.exe 6120 JJQLFO.exe 4816 URX.exe 4816 URX.exe 5896 TNWLWB.exe 5896 TNWLWB.exe 5348 IIGY.exe 5348 IIGY.exe 4128 ILKTU.exe 4128 ILKTU.exe 5892 MBQ.exe 5892 MBQ.exe 4720 CRRTFR.exe 4720 CRRTFR.exe 1848 ACCJO.exe 1848 ACCJO.exe 5648 ZRNM.exe 5648 ZRNM.exe 1072 DULZJEE.exe 1072 DULZJEE.exe 4668 CSFCW.exe 4668 CSFCW.exe 996 KYJJG.exe 996 KYJJG.exe 1796 OJH.exe 1796 OJH.exe 1044 KGA.exe 1044 KGA.exe 3196 YMAFYHO.exe 3196 YMAFYHO.exe 4224 PUOCLYJ.exe 4224 PUOCLYJ.exe 4352 YXE.exe 4352 YXE.exe 3188 JDD.exe 3188 JDD.exe 3484 DDTHWK.exe 3484 DDTHWK.exe 2240 STUGV.exe 2240 STUGV.exe 2512 HOD.exe 2512 HOD.exe 1952 LWKLA.exe 1952 LWKLA.exe 3688 EZWO.exe 3688 EZWO.exe 936 CKYEOH.exe 936 CKYEOH.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5032 wrote to memory of 4664 5032 2026-08-14_a4d099df7cde6db67e201f06ac3db8d8_elex_emotet_stop.exe 89 PID 4664 wrote to memory of 416 4664 cmd.exe 93 PID 416 wrote to memory of 1756 416 CEJ.exe 95 PID 1756 wrote to memory of 5504 1756 cmd.exe 98 PID 5504 wrote to memory of 4680 5504 MXFQGZ.exe 100 PID 4680 wrote to memory of 2288 4680 cmd.exe 104 PID 2288 wrote to memory of 5664 2288 NSJ.exe 105 PID 5664 wrote to memory of 4256 5664 cmd.exe 109 PID 4256 wrote to memory of 4416 4256 CVSYEK.exe 110 PID 4416 wrote to memory of 3268 4416 cmd.exe 114 PID 3268 wrote to memory of 6128 3268 XIX.exe 115 PID 6128 wrote to memory of 4276 6128 cmd.exe 119 PID 4276 wrote to memory of 4208 4276 PLBLU.exe 120 PID 4208 wrote to memory of 3140 4208 cmd.exe 124 PID 3140 wrote to memory of 3232 3140 ZBOY.exe 125 PID 3232 wrote to memory of 6120 3232 cmd.exe 129 PID 6120 wrote to memory of 3032 6120 JJQLFO.exe 130 PID 3032 wrote to memory of 4816 3032 cmd.exe 134 PID 4816 wrote to memory of 2376 4816 URX.exe 135 PID 2376 wrote to memory of 5896 2376 cmd.exe 139 PID 5896 wrote to memory of 1040 5896 TNWLWB.exe 140 PID 1040 wrote to memory of 5348 1040 cmd.exe 144 PID 5348 wrote to memory of 2472 5348 IIGY.exe 145 PID 2472 wrote to memory of 4128 2472 cmd.exe 149 PID 4128 wrote to memory of 5768 4128 ILKTU.exe 150 PID 5768 wrote to memory of 5892 5768 cmd.exe 154 PID 5892 wrote to memory of 4964 5892 MBQ.exe 155 PID 4964 wrote to memory of 4720 4964 cmd.exe 159 PID 4720 wrote to memory of 236 4720 CRRTFR.exe 160 PID 236 wrote to memory of 1848 236 cmd.exe 164 PID 1848 wrote to memory of 4496 1848 ACCJO.exe 165 PID 4496 wrote to memory of 5648 4496 cmd.exe 169 PID 5648 wrote to memory of 4924 5648 ZRNM.exe 170 PID 4924 wrote to memory of 1072 4924 cmd.exe 174 PID 1072 wrote to memory of 5236 1072 DULZJEE.exe 175 PID 5236 wrote to memory of 4668 5236 cmd.exe 179 PID 4668 wrote to memory of 716 4668 CSFCW.exe 180 PID 716 wrote to memory of 996 716 cmd.exe 184 PID 996 wrote to memory of 972 996 KYJJG.exe 185 PID 972 wrote to memory of 1796 972 cmd.exe 189 PID 1796 wrote to memory of 1944 1796 OJH.exe 190 PID 1944 wrote to memory of 1044 1944 cmd.exe 194 PID 1044 wrote to memory of 4512 1044 KGA.exe 195 PID 4512 wrote to memory of 3196 4512 cmd.exe 199 PID 3196 wrote to memory of 2628 3196 YMAFYHO.exe 200 PID 2628 wrote to memory of 4224 2628 cmd.exe 204 PID 4224 wrote to memory of 5188 4224 PUOCLYJ.exe 205 PID 5188 wrote to memory of 4352 5188 cmd.exe 209 PID 4352 wrote to memory of 4712 4352 YXE.exe 210 PID 4712 wrote to memory of 3188 4712 cmd.exe 214 PID 3188 wrote to memory of 3676 3188 JDD.exe 215 PID 3676 wrote to memory of 3484 3676 cmd.exe 219 PID 3484 wrote to memory of 2892 3484 DDTHWK.exe 220 PID 2892 wrote to memory of 2240 2892 cmd.exe 224 PID 2240 wrote to memory of 4600 2240 STUGV.exe 225 PID 4600 wrote to memory of 2512 4600 cmd.exe 229 PID 2512 wrote to memory of 5724 2512 HOD.exe 230 PID 5724 wrote to memory of 1952 5724 cmd.exe 234 PID 1952 wrote to memory of 3752 1952 LWKLA.exe 235 PID 3752 wrote to memory of 3688 3752 cmd.exe 239 PID 3688 wrote to memory of 1568 3688 EZWO.exe 240 PID 1568 wrote to memory of 936 1568 cmd.exe 244 PID 936 wrote to memory of 5524 936 CKYEOH.exe 245 PID 5524 wrote to memory of 2736 5524 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-14_a4d099df7cde6db67e201f06ac3db8d8_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-14_a4d099df7cde6db67e201f06ac3db8d8_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CEJ.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\windows\CEJ.exeC:\windows\CEJ.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MXFQGZ.exe.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\windows\MXFQGZ.exeC:\windows\MXFQGZ.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NSJ.exe.bat" "6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\windows\SysWOW64\NSJ.exeC:\windows\system32\NSJ.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CVSYEK.exe.bat" "8⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5664 -
C:\windows\CVSYEK.exeC:\windows\CVSYEK.exe9⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XIX.exe.bat" "10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\windows\system\XIX.exeC:\windows\system\XIX.exe11⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PLBLU.exe.bat" "12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6128 -
C:\windows\system\PLBLU.exeC:\windows\system\PLBLU.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZBOY.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\windows\ZBOY.exeC:\windows\ZBOY.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JJQLFO.exe.bat" "16⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3232 -
C:\windows\SysWOW64\JJQLFO.exeC:\windows\system32\JJQLFO.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6120 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\URX.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\windows\system\URX.exeC:\windows\system\URX.exe19⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TNWLWB.exe.bat" "20⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\windows\system\TNWLWB.exeC:\windows\system\TNWLWB.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5896 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IIGY.exe.bat" "22⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1040 -
C:\windows\SysWOW64\IIGY.exeC:\windows\system32\IIGY.exe23⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5348 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ILKTU.exe.bat" "24⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\windows\system\ILKTU.exeC:\windows\system\ILKTU.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MBQ.exe.bat" "26⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5768 -
C:\windows\MBQ.exeC:\windows\MBQ.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5892 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CRRTFR.exe.bat" "28⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\windows\system\CRRTFR.exeC:\windows\system\CRRTFR.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ACCJO.exe.bat" "30⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:236 -
C:\windows\SysWOW64\ACCJO.exeC:\windows\system32\ACCJO.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZRNM.exe.bat" "32⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\windows\system\ZRNM.exeC:\windows\system\ZRNM.exe33⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5648 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DULZJEE.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\windows\SysWOW64\DULZJEE.exeC:\windows\system32\DULZJEE.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CSFCW.exe.bat" "36⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5236 -
C:\windows\SysWOW64\CSFCW.exeC:\windows\system32\CSFCW.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KYJJG.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:716 -
C:\windows\system\KYJJG.exeC:\windows\system\KYJJG.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OJH.exe.bat" "40⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:972 -
C:\windows\SysWOW64\OJH.exeC:\windows\system32\OJH.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KGA.exe.bat" "42⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\windows\KGA.exeC:\windows\KGA.exe43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YMAFYHO.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\windows\system\YMAFYHO.exeC:\windows\system\YMAFYHO.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PUOCLYJ.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\windows\system\PUOCLYJ.exeC:\windows\system\PUOCLYJ.exe47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YXE.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:5188 -
C:\windows\system\YXE.exeC:\windows\system\YXE.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JDD.exe.bat" "50⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\windows\SysWOW64\JDD.exeC:\windows\system32\JDD.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DDTHWK.exe.bat" "52⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3676 -
C:\windows\SysWOW64\DDTHWK.exeC:\windows\system32\DDTHWK.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\STUGV.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\windows\system\STUGV.exeC:\windows\system\STUGV.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HOD.exe.bat" "56⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\windows\HOD.exeC:\windows\HOD.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LWKLA.exe.bat" "58⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5724 -
C:\windows\SysWOW64\LWKLA.exeC:\windows\system32\LWKLA.exe59⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EZWO.exe.bat" "60⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3752 -
C:\windows\system\EZWO.exeC:\windows\system\EZWO.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CKYEOH.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\windows\CKYEOH.exeC:\windows\CKYEOH.exe63⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KYLLZ.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:5524 -
C:\windows\SysWOW64\KYLLZ.exeC:\windows\system32\KYLLZ.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SDQSBEY.exe.bat" "66⤵
- System Location Discovery: System Language Discovery
PID:5224 -
C:\windows\SysWOW64\SDQSBEY.exeC:\windows\system32\SDQSBEY.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:6068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KMEXOVS.exe.bat" "68⤵PID:4184
-
C:\windows\SysWOW64\KMEXOVS.exeC:\windows\system32\KMEXOVS.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZCFO.exe.bat" "70⤵
- Executes a command shell one-liner
PID:2908 -
C:\windows\system\ZCFO.exeC:\windows\system\ZCFO.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YMI.exe.bat" "72⤵PID:5780
-
C:\windows\system\YMI.exeC:\windows\system\YMI.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CUOEP.exe.bat" "74⤵PID:1632
-
C:\windows\SysWOW64\CUOEP.exeC:\windows\system32\CUOEP.exe75⤵
- Executes dropped EXE
PID:3492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CXAI.exe.bat" "76⤵
- System Location Discovery: System Language Discovery
PID:796 -
C:\windows\system\CXAI.exeC:\windows\system\CXAI.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4356 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EVGCCN.exe.bat" "78⤵
- Executes a command shell one-liner
PID:1360 -
C:\windows\EVGCCN.exeC:\windows\EVGCCN.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ILNCPF.exe.bat" "80⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2968 -
C:\windows\system\ILNCPF.exeC:\windows\system\ILNCPF.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5356 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SJS.exe.bat" "82⤵PID:4328
-
C:\windows\system\SJS.exeC:\windows\system\SJS.exe83⤵
- Executes dropped EXE
PID:3172 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CZG.exe.bat" "84⤵PID:2564
-
C:\windows\CZG.exeC:\windows\CZG.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EXLDT.exe.bat" "86⤵PID:1684
-
C:\windows\system\EXLDT.exeC:\windows\system\EXLDT.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DPWT.exe.bat" "88⤵PID:5260
-
C:\windows\DPWT.exeC:\windows\DPWT.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MQQYFQ.exe.bat" "90⤵
- Executes a command shell one-liner
PID:1380 -
C:\windows\MQQYFQ.exeC:\windows\MQQYFQ.exe91⤵
- Executes dropped EXE
PID:1368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LBBOO.exe.bat" "92⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4840 -
C:\windows\LBBOO.exeC:\windows\LBBOO.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EBIZF.exe.bat" "94⤵
- System Location Discovery: System Language Discovery
PID:4112 -
C:\windows\system\EBIZF.exeC:\windows\system\EBIZF.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3656 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ORWU.exe.bat" "96⤵PID:2244
-
C:\windows\ORWU.exeC:\windows\ORWU.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HUAXSV.exe.bat" "98⤵PID:2460
-
C:\windows\SysWOW64\HUAXSV.exeC:\windows\system32\HUAXSV.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5632 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IXETF.exe.bat" "100⤵
- Executes a command shell one-liner
PID:2312 -
C:\windows\SysWOW64\IXETF.exeC:\windows\system32\IXETF.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CKIDILB.exe.bat" "102⤵PID:2348
-
C:\windows\CKIDILB.exeC:\windows\CKIDILB.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RFS.exe.bat" "104⤵
- System Location Discovery: System Language Discovery
PID:1284 -
C:\windows\SysWOW64\RFS.exeC:\windows\system32\RFS.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BOUUED.exe.bat" "106⤵
- Executes a command shell one-liner
PID:248 -
C:\windows\BOUUED.exeC:\windows\BOUUED.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FWB.exe.bat" "108⤵
- Executes a command shell one-liner
PID:5456 -
C:\windows\FWB.exeC:\windows\FWB.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FZEYW.exe.bat" "110⤵
- Executes a command shell one-liner
PID:5212 -
C:\windows\FZEYW.exeC:\windows\FZEYW.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AMJHGLQ.exe.bat" "112⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4060 -
C:\windows\SysWOW64\AMJHGLQ.exeC:\windows\system32\AMJHGLQ.exe113⤵
- Executes dropped EXE
PID:2820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ECQHSD.exe.bat" "114⤵
- System Location Discovery: System Language Discovery
PID:5936 -
C:\windows\system\ECQHSD.exeC:\windows\system\ECQHSD.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KPPQPYC.exe.bat" "116⤵
- Executes a command shell one-liner
PID:4260 -
C:\windows\SysWOW64\KPPQPYC.exeC:\windows\system32\KPPQPYC.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XAFHD.exe.bat" "118⤵PID:4296
-
C:\windows\SysWOW64\XAFHD.exeC:\windows\system32\XAFHD.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WLIX.exe.bat" "120⤵
- System Location Discovery: System Language Discovery
PID:2268 -
C:\windows\SysWOW64\WLIX.exeC:\windows\system32\WLIX.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2864
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-