Analysis
- max time kernel
79s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
15/08/2026, 03:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-15_ec8b8083ade71ece973a778b60c4f39b_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-15_ec8b8083ade71ece973a778b60c4f39b_elex_emotet_stop.exe
- Size 208KB
- Sample260815-dl46ksde63
- SHA256 5d878644f15ff239cc6b878453a76b742d722d387df1ddf75c9a638cb49d3ff9
- MD5 ec8b8083ade71ece973a778b60c4f39b
- SHA1 2fd5fa8e375e021aa37fa491cc3fa0c5a0b60ded
- SHA512 1296bfb45860d518de3d80b051611eab4d2da7b24ea050bd2042e5271977027cbafbdecd450d55c41b522c7d5541017f8c83d25feef46121b5b6000ffeaf29e3
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlcKL+LOfX4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFlcS+LOfkEj1
- TLSH T150247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3184 OMDB.exe 732 PKXC.exe 1000 NUA.exe 6060 XSF.exe 3680 BAMMG.exe 2736 UBBXX.exe 1564 WQH.exe 5344 DMGSKR.exe 2240 GCN.exe 5144 HXZWB.exe 4504 NXGKKCL.exe 3336 UNHJRP.exe 5328 GDO.exe 2428 BRTTN.exe 5108 ZRAGWKM.exe 3684 FMS.exe 4632 JUGPFXY.exe 1348 CNOAX.exe 2248 BFYQ.exe 5024 OIHPMPP.exe 2952 ZBKA.exe 4132 RJMNXBH.exe 3824 WJTAOWI.exe 3960 AFSPCBZ.exe 5140 QACTN.exe 1220 KNGDXNW.exe 3612 FBLU.exe 4400 QTO.exe 1424 HCQSLA.exe 5200 NCYGCU.exe 5272 GXCBI.exe 4916 PFEGLQH.exe 2680 ZDJBBY.exe 5932 OYTF.exe 308 OETUN.exe 4424 SUACAQP.exe 5912 ECGCM.exe 3932 OKIHPG.exe 2280 RSPPB.exe 3668 SVBKHOD.exe 592 LYEO.exe 4084 FLJYXE.exe 4176 RTQYJ.exe 2928 TRW.exe 1228 LZYX.exe 5052 UAAKFHC.exe 6064 OVET.exe 2752 CYNKEKM.exe 2480 OOTS.exe 4948 GJX.exe 3816 KZMWAK.exe 5968 NMRFKKN.exe 1492 LII.exe 3156 FVNPZ.exe 1512 VQE.exe 1508 DDWI.exe 1944 QGNH.exe 3404 BZIAI.exe 3432 MRLS.exe 2300 SSSGZH.exe 2396 YSAU.exe 4476 RVEQO.exe 1952 RBEEXM.exe 416 TOBOZ.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\BRTTN.exe GDO.exe File created C:\windows\SysWOW64\FMS.exe ZRAGWKM.exe File opened for modification C:\windows\SysWOW64\FMS.exe ZRAGWKM.exe File created C:\windows\SysWOW64\KNGDXNW.exe QACTN.exe File created C:\windows\SysWOW64\KNGDXNW.exe.bat QACTN.exe File created C:\windows\SysWOW64\OYTF.exe ZDJBBY.exe File created C:\windows\SysWOW64\SVBKHOD.exe.bat RSPPB.exe File created C:\windows\SysWOW64\CYNKEKM.exe OVET.exe File opened for modification C:\windows\SysWOW64\OYTF.exe ZDJBBY.exe File created C:\windows\SysWOW64\OVET.exe.bat UAAKFHC.exe File created C:\windows\SysWOW64\KZMWAK.exe GJX.exe File opened for modification C:\windows\SysWOW64\KZMWAK.exe GJX.exe File created C:\windows\SysWOW64\NMRFKKN.exe KZMWAK.exe File created C:\windows\SysWOW64\ZKE.exe EXZLSL.exe File opened for modification C:\windows\SysWOW64\BRTTN.exe GDO.exe File created C:\windows\SysWOW64\ZDJBBY.exe PFEGLQH.exe File created C:\windows\SysWOW64\OYTF.exe.bat ZDJBBY.exe File opened for modification C:\windows\SysWOW64\SUACAQP.exe OETUN.exe File opened for modification C:\windows\SysWOW64\YSAU.exe SSSGZH.exe File created C:\windows\SysWOW64\FMS.exe.bat ZRAGWKM.exe File created C:\windows\SysWOW64\CNOAX.exe.bat JUGPFXY.exe File opened for modification C:\windows\SysWOW64\ZDJBBY.exe PFEGLQH.exe File created C:\windows\SysWOW64\FLJYXE.exe.bat LYEO.exe File created C:\windows\SysWOW64\OVET.exe UAAKFHC.exe File created C:\windows\SysWOW64\NMRFKKN.exe.bat KZMWAK.exe File created C:\windows\SysWOW64\RVEQO.exe YSAU.exe File created C:\windows\SysWOW64\MVSUM.exe XAJQAMC.exe File opened for modification C:\windows\SysWOW64\XSF.exe NUA.exe File created C:\windows\SysWOW64\SUACAQP.exe OETUN.exe File opened for modification C:\windows\SysWOW64\RSPPB.exe OKIHPG.exe File opened for modification C:\windows\SysWOW64\OVET.exe UAAKFHC.exe File created C:\windows\SysWOW64\YSAU.exe SSSGZH.exe File opened for modification C:\windows\SysWOW64\CYXQXO.exe HKSH.exe File created C:\windows\SysWOW64\CJUCI.exe JGQ.exe File created C:\windows\SysWOW64\ZKE.exe.bat EXZLSL.exe File created C:\windows\SysWOW64\NCYGCU.exe.bat HCQSLA.exe File created C:\windows\SysWOW64\SVBKHOD.exe RSPPB.exe File created C:\windows\SysWOW64\FVNPZ.exe LII.exe File opened for modification C:\windows\SysWOW64\FVNPZ.exe LII.exe File created C:\windows\SysWOW64\GAHDXO.exe.bat CKAD.exe File created C:\windows\SysWOW64\GCN.exe.bat DMGSKR.exe File created C:\windows\SysWOW64\BRTTN.exe.bat GDO.exe File opened for modification C:\windows\SysWOW64\OIHPMPP.exe BFYQ.exe File opened for modification C:\windows\SysWOW64\OOTS.exe CYNKEKM.exe File opened for modification C:\windows\SysWOW64\WERCW.exe REJ.exe File created C:\windows\SysWOW64\XSF.exe NUA.exe File opened for modification C:\windows\SysWOW64\BAMMG.exe XSF.exe File created C:\windows\SysWOW64\BAMMG.exe.bat XSF.exe File created C:\windows\SysWOW64\RSPPB.exe OKIHPG.exe File opened for modification C:\windows\SysWOW64\CYNKEKM.exe OVET.exe File created C:\windows\SysWOW64\CYNKEKM.exe.bat OVET.exe File created C:\windows\SysWOW64\OOTS.exe CYNKEKM.exe File opened for modification C:\windows\SysWOW64\NMRFKKN.exe KZMWAK.exe File opened for modification C:\windows\SysWOW64\FBLU.exe KNGDXNW.exe File created C:\windows\SysWOW64\NCYGCU.exe HCQSLA.exe File created C:\windows\SysWOW64\KZMWAK.exe.bat GJX.exe File created C:\windows\SysWOW64\DDWI.exe VQE.exe File opened for modification C:\windows\SysWOW64\RVEQO.exe YSAU.exe File opened for modification C:\windows\SysWOW64\ZKE.exe EXZLSL.exe File created C:\windows\SysWOW64\ZDJBBY.exe.bat PFEGLQH.exe File created C:\windows\SysWOW64\YSAU.exe.bat SSSGZH.exe File created C:\windows\SysWOW64\CYXQXO.exe.bat HKSH.exe File created C:\windows\SysWOW64\WERCW.exe.bat REJ.exe File opened for modification C:\windows\SysWOW64\GCN.exe DMGSKR.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\ECGCM.exe SUACAQP.exe File opened for modification C:\windows\system\ECGCM.exe SUACAQP.exe File created C:\windows\system\EDZKLR.exe TKWZD.exe File created C:\windows\system\MAMI.exe RNIYHAW.exe File opened for modification C:\windows\TEY.exe QQTIWT.exe File opened for modification C:\windows\PKXC.exe OMDB.exe File created C:\windows\system\UBBXX.exe.bat BAMMG.exe File opened for modification C:\windows\WQH.exe UBBXX.exe File created C:\windows\UNHJRP.exe NXGKKCL.exe File opened for modification C:\windows\WJTAOWI.exe RJMNXBH.exe File created C:\windows\system\LYEO.exe SVBKHOD.exe File created C:\windows\system\TOBOZ.exe.bat RBEEXM.exe File opened for modification C:\windows\system\EJCQX.exe CLJOR.exe File created C:\windows\ZRAGWKM.exe.bat BRTTN.exe File opened for modification C:\windows\system\OETUN.exe OYTF.exe File created C:\windows\system\OETUN.exe.bat OYTF.exe File created C:\windows\system\TGJPN.exe TOBOZ.exe File created C:\windows\system\CLJOR.exe.bat HYE.exe File created C:\windows\system\GPQTNRQ.exe.bat APIFE.exe File opened for modification C:\windows\KLXPBO.exe SITL.exe File opened for modification C:\windows\REJ.exe UZLRFN.exe File created C:\windows\system\UBBXX.exe BAMMG.exe File opened for modification C:\windows\system\RTQYJ.exe FLJYXE.exe File created C:\windows\system\ZLGI.exe.bat ZGG.exe File created C:\windows\system\SOM.exe.bat STIXBG.exe File created C:\windows\system\XAJQAMC.exe GAHDXO.exe File created C:\windows\system\XAJQAMC.exe.bat GAHDXO.exe File created C:\windows\EXZLSL.exe CJUCI.exe File opened for modification C:\windows\system\MAMI.exe RNIYHAW.exe File created C:\windows\PKXC.exe.bat OMDB.exe File created C:\windows\WJTAOWI.exe RJMNXBH.exe File created C:\windows\system\OETUN.exe OYTF.exe File created C:\windows\TRW.exe RTQYJ.exe File created C:\windows\LZYX.exe TRW.exe File created C:\windows\UAAKFHC.exe.bat LZYX.exe File opened for modification C:\windows\system\TOBOZ.exe RBEEXM.exe File created C:\windows\system\EJCQX.exe CLJOR.exe File opened for modification C:\windows\ZRAGWKM.exe BRTTN.exe File created C:\windows\WJTAOWI.exe.bat RJMNXBH.exe File opened for modification C:\windows\GJX.exe OOTS.exe File created C:\windows\system\ZGG.exe.bat KLXPBO.exe File opened for modification C:\windows\system\EDZKLR.exe TKWZD.exe File created C:\windows\system\ODBXOOO.exe EDZKLR.exe File opened for modification C:\windows\STIXBG.exe ODBXOOO.exe File created C:\windows\system\NJRKQ.exe SOM.exe File opened for modification C:\windows\NUA.exe PKXC.exe File created C:\windows\system\RTQYJ.exe FLJYXE.exe File created C:\windows\LZYX.exe.bat TRW.exe File opened for modification C:\windows\QGNH.exe DDWI.exe File created C:\windows\system\MRLS.exe.bat BZIAI.exe File created C:\windows\system\SOM.exe STIXBG.exe File created C:\windows\EXZLSL.exe.bat CJUCI.exe File created C:\windows\UNHJRP.exe.bat NXGKKCL.exe File opened for modification C:\windows\ZBKA.exe OIHPMPP.exe File opened for modification C:\windows\system\AFSPCBZ.exe GKNFS.exe File created C:\windows\system\AFSPCBZ.exe.bat GKNFS.exe File created C:\windows\system\RBEEXM.exe.bat RVEQO.exe File created C:\windows\system\TGJPN.exe.bat TOBOZ.exe File created C:\windows\system\CLJOR.exe HYE.exe File created C:\windows\SITL.exe GPQTNRQ.exe File created C:\windows\OMDB.exe.bat 2026-08-15_ec8b8083ade71ece973a778b60c4f39b_elex_emotet_stop.exe File created C:\windows\PFEGLQH.exe.bat GXCBI.exe File opened for modification C:\windows\system\ZLGI.exe ZGG.exe File opened for modification C:\windows\system\NJRKQ.exe SOM.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2580 cmd.exe 4640 cmd.exe 3244 cmd.exe 1312 cmd.exe 5020 cmd.exe 720 cmd.exe 4816 cmd.exe 4212 cmd.exe 1596 cmd.exe 3544 cmd.exe 4628 cmd.exe 5532 cmd.exe 5704 cmd.exe 4364 cmd.exe 5568 cmd.exe 4204 cmd.exe 5676 cmd.exe 1380 cmd.exe 2592 cmd.exe 844 cmd.exe 820 cmd.exe 4620 cmd.exe 2108 cmd.exe 5756 cmd.exe 3480 cmd.exe 740 cmd.exe 4224 cmd.exe 1920 cmd.exe 436 cmd.exe 5488 cmd.exe 1192 cmd.exe 1404 cmd.exe 5072 cmd.exe 2080 cmd.exe 1152 cmd.exe 4776 cmd.exe 3320 cmd.exe 3692 cmd.exe 4580 cmd.exe 3424 cmd.exe 1188 cmd.exe 1560 cmd.exe 5960 cmd.exe 3396 cmd.exe 864 cmd.exe 4600 cmd.exe 4432 cmd.exe 4964 cmd.exe 1848 cmd.exe 1612 cmd.exe 2356 cmd.exe 4428 cmd.exe 3380 cmd.exe 2788 cmd.exe 4172 cmd.exe 3688 cmd.exe 5972 cmd.exe 5656 cmd.exe 4828 cmd.exe 6140 cmd.exe 1084 cmd.exe 3880 cmd.exe 2720 cmd.exe 5988 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 4344 4840 WerFault.exe 88 1824 3184 WerFault.exe 93 4744 732 WerFault.exe 99 4380 1000 WerFault.exe 104 1316 6060 WerFault.exe 109 692 3680 WerFault.exe 114 2576 2736 WerFault.exe 119 1424 1564 WerFault.exe 124 5996 5344 WerFault.exe 129 1132 2240 WerFault.exe 134 1148 5144 WerFault.exe 139 1388 4504 WerFault.exe 144 1228 3336 WerFault.exe 149 3472 5328 WerFault.exe 154 2720 2428 WerFault.exe 159 1944 5108 WerFault.exe 164 2280 3684 WerFault.exe 169 5424 4632 WerFault.exe 174 1836 1348 WerFault.exe 179 4280 2248 WerFault.exe 184 5964 5024 WerFault.exe 189 4492 2952 WerFault.exe 194 4332 4132 WerFault.exe 199 1856 3824 WerFault.exe 204 4472 4088 WerFault.exe 209 964 3960 WerFault.exe 214 2596 5140 WerFault.exe 219 1176 1220 WerFault.exe 224 1224 3612 WerFault.exe 229 4384 4400 WerFault.exe 234 1332 1424 WerFault.exe 239 4668 5200 WerFault.exe 244 5840 5272 WerFault.exe 249 2412 4916 WerFault.exe 254 1740 2680 WerFault.exe 259 4452 5932 WerFault.exe 264 1612 308 WerFault.exe 269 4740 4424 WerFault.exe 274 2772 5912 WerFault.exe 280 1164 3932 WerFault.exe 285 1836 2280 WerFault.exe 290 5824 3668 WerFault.exe 295 3948 592 WerFault.exe 300 2916 4084 WerFault.exe 305 2812 4176 WerFault.exe 310 3052 2928 WerFault.exe 315 1344 1228 WerFault.exe 320 4420 5052 WerFault.exe 325 3876 6064 WerFault.exe 330 2476 2752 WerFault.exe 335 4764 2480 WerFault.exe 340 4968 4948 WerFault.exe 345 5880 3816 WerFault.exe 350 5796 5968 WerFault.exe 355 5792 1492 WerFault.exe 360 5952 3156 WerFault.exe 365 5728 1512 WerFault.exe 370 2380 1508 WerFault.exe 375 2580 1944 WerFault.exe 380 3244 3404 WerFault.exe 385 5012 3432 WerFault.exe 390 1216 2300 WerFault.exe 395 3268 2396 WerFault.exe 400 2812 4476 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NMRFKKN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KNGDXNW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GXCBI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OYTF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SOM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OOTS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QGNH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WQH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BFYQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TMKDPD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UBBXX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZDJBBY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HKSH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JUGPFXY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OKIHPG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FLJYXE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OIHPMPP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TRW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RVEQO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GAHDXO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MAMI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BZIAI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXZLSL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RSPPB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LII.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KLXPBO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HYE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CLJOR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language STIXBG.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4840 2026-08-15_ec8b8083ade71ece973a778b60c4f39b_elex_emotet_stop.exe 4840 2026-08-15_ec8b8083ade71ece973a778b60c4f39b_elex_emotet_stop.exe 3184 OMDB.exe 3184 OMDB.exe 732 PKXC.exe 732 PKXC.exe 1000 NUA.exe 1000 NUA.exe 6060 XSF.exe 6060 XSF.exe 3680 BAMMG.exe 3680 BAMMG.exe 2736 UBBXX.exe 2736 UBBXX.exe 1564 WQH.exe 1564 WQH.exe 5344 DMGSKR.exe 5344 DMGSKR.exe 2240 GCN.exe 2240 GCN.exe 5144 HXZWB.exe 5144 HXZWB.exe 4504 NXGKKCL.exe 4504 NXGKKCL.exe 3336 UNHJRP.exe 3336 UNHJRP.exe 5328 GDO.exe 5328 GDO.exe 2428 BRTTN.exe 2428 BRTTN.exe 5108 ZRAGWKM.exe 5108 ZRAGWKM.exe 3684 FMS.exe 3684 FMS.exe 4632 JUGPFXY.exe 4632 JUGPFXY.exe 1348 CNOAX.exe 1348 CNOAX.exe 2248 BFYQ.exe 2248 BFYQ.exe 5024 OIHPMPP.exe 5024 OIHPMPP.exe 2952 ZBKA.exe 2952 ZBKA.exe 4132 RJMNXBH.exe 4132 RJMNXBH.exe 4088 GKNFS.exe 4088 GKNFS.exe 3960 AFSPCBZ.exe 3960 AFSPCBZ.exe 5140 QACTN.exe 5140 QACTN.exe 1220 KNGDXNW.exe 1220 KNGDXNW.exe 3612 FBLU.exe 3612 FBLU.exe 4400 QTO.exe 4400 QTO.exe 1424 HCQSLA.exe 1424 HCQSLA.exe 5200 NCYGCU.exe 5200 NCYGCU.exe 5272 GXCBI.exe 5272 GXCBI.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4840 2026-08-15_ec8b8083ade71ece973a778b60c4f39b_elex_emotet_stop.exe 4840 2026-08-15_ec8b8083ade71ece973a778b60c4f39b_elex_emotet_stop.exe 3184 OMDB.exe 3184 OMDB.exe 732 PKXC.exe 732 PKXC.exe 1000 NUA.exe 1000 NUA.exe 6060 XSF.exe 6060 XSF.exe 3680 BAMMG.exe 3680 BAMMG.exe 2736 UBBXX.exe 2736 UBBXX.exe 1564 WQH.exe 1564 WQH.exe 5344 DMGSKR.exe 5344 DMGSKR.exe 2240 GCN.exe 2240 GCN.exe 5144 HXZWB.exe 5144 HXZWB.exe 4504 NXGKKCL.exe 4504 NXGKKCL.exe 3336 UNHJRP.exe 3336 UNHJRP.exe 5328 GDO.exe 5328 GDO.exe 2428 BRTTN.exe 2428 BRTTN.exe 5108 ZRAGWKM.exe 5108 ZRAGWKM.exe 3684 FMS.exe 3684 FMS.exe 4632 JUGPFXY.exe 4632 JUGPFXY.exe 1348 CNOAX.exe 1348 CNOAX.exe 2248 BFYQ.exe 2248 BFYQ.exe 5024 OIHPMPP.exe 5024 OIHPMPP.exe 2952 ZBKA.exe 2952 ZBKA.exe 4132 RJMNXBH.exe 4132 RJMNXBH.exe 4088 GKNFS.exe 4088 GKNFS.exe 3960 AFSPCBZ.exe 3960 AFSPCBZ.exe 5140 QACTN.exe 5140 QACTN.exe 1220 KNGDXNW.exe 1220 KNGDXNW.exe 3612 FBLU.exe 3612 FBLU.exe 4400 QTO.exe 4400 QTO.exe 1424 HCQSLA.exe 1424 HCQSLA.exe 5200 NCYGCU.exe 5200 NCYGCU.exe 5272 GXCBI.exe 5272 GXCBI.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4840 wrote to memory of 4120 4840 2026-08-15_ec8b8083ade71ece973a778b60c4f39b_elex_emotet_stop.exe 89 PID 4120 wrote to memory of 3184 4120 cmd.exe 93 PID 3184 wrote to memory of 2608 3184 OMDB.exe 95 PID 2608 wrote to memory of 732 2608 cmd.exe 99 PID 732 wrote to memory of 4204 732 PKXC.exe 100 PID 4204 wrote to memory of 1000 4204 cmd.exe 104 PID 1000 wrote to memory of 1192 1000 NUA.exe 105 PID 1192 wrote to memory of 6060 1192 cmd.exe 109 PID 6060 wrote to memory of 3324 6060 XSF.exe 110 PID 3324 wrote to memory of 3680 3324 cmd.exe 114 PID 3680 wrote to memory of 5784 3680 BAMMG.exe 115 PID 5784 wrote to memory of 2736 5784 cmd.exe 119 PID 2736 wrote to memory of 960 2736 UBBXX.exe 120 PID 960 wrote to memory of 1564 960 cmd.exe 124 PID 1564 wrote to memory of 1596 1564 WQH.exe 125 PID 1596 wrote to memory of 5344 1596 cmd.exe 129 PID 5344 wrote to memory of 5124 5344 DMGSKR.exe 130 PID 5124 wrote to memory of 2240 5124 cmd.exe 134 PID 2240 wrote to memory of 5916 2240 GCN.exe 135 PID 5916 wrote to memory of 5144 5916 cmd.exe 139 PID 5144 wrote to memory of 5412 5144 HXZWB.exe 140 PID 5412 wrote to memory of 4504 5412 cmd.exe 144 PID 4504 wrote to memory of 4776 4504 NXGKKCL.exe 145 PID 4776 wrote to memory of 3336 4776 cmd.exe 149 PID 3336 wrote to memory of 2776 3336 UNHJRP.exe 150 PID 2776 wrote to memory of 5328 2776 cmd.exe 154 PID 5328 wrote to memory of 3544 5328 GDO.exe 155 PID 3544 wrote to memory of 2428 3544 cmd.exe 159 PID 2428 wrote to memory of 3604 2428 BRTTN.exe 160 PID 3604 wrote to memory of 5108 3604 cmd.exe 164 PID 5108 wrote to memory of 2788 5108 ZRAGWKM.exe 165 PID 2788 wrote to memory of 3684 2788 cmd.exe 169 PID 3684 wrote to memory of 4172 3684 FMS.exe 170 PID 4172 wrote to memory of 4632 4172 cmd.exe 174 PID 4632 wrote to memory of 5132 4632 JUGPFXY.exe 175 PID 5132 wrote to memory of 1348 5132 cmd.exe 179 PID 1348 wrote to memory of 2244 1348 CNOAX.exe 180 PID 2244 wrote to memory of 2248 2244 cmd.exe 184 PID 2248 wrote to memory of 5844 2248 BFYQ.exe 185 PID 5844 wrote to memory of 5024 5844 cmd.exe 189 PID 5024 wrote to memory of 1500 5024 OIHPMPP.exe 190 PID 1500 wrote to memory of 2952 1500 cmd.exe 194 PID 2952 wrote to memory of 4912 2952 ZBKA.exe 195 PID 4912 wrote to memory of 4132 4912 cmd.exe 199 PID 4132 wrote to memory of 5676 4132 RJMNXBH.exe 200 PID 5676 wrote to memory of 3824 5676 cmd.exe 204 PID 4876 wrote to memory of 4088 4876 cmd.exe 209 PID 4088 wrote to memory of 2112 4088 GKNFS.exe 210 PID 2112 wrote to memory of 3960 2112 cmd.exe 214 PID 3960 wrote to memory of 3380 3960 AFSPCBZ.exe 215 PID 3380 wrote to memory of 5140 3380 cmd.exe 219 PID 5140 wrote to memory of 3416 5140 QACTN.exe 220 PID 3416 wrote to memory of 1220 3416 cmd.exe 224 PID 1220 wrote to memory of 1412 1220 KNGDXNW.exe 225 PID 1412 wrote to memory of 3612 1412 cmd.exe 229 PID 3612 wrote to memory of 1908 3612 FBLU.exe 230 PID 1908 wrote to memory of 4400 1908 cmd.exe 234 PID 4400 wrote to memory of 5956 4400 QTO.exe 235 PID 5956 wrote to memory of 1424 5956 cmd.exe 239 PID 1424 wrote to memory of 2092 1424 HCQSLA.exe 240 PID 2092 wrote to memory of 5200 2092 cmd.exe 244 PID 5200 wrote to memory of 4600 5200 NCYGCU.exe 245 PID 4600 wrote to memory of 5272 4600 cmd.exe 249 PID 5272 wrote to memory of 4500 5272 GXCBI.exe 250
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-15_ec8b8083ade71ece973a778b60c4f39b_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-15_ec8b8083ade71ece973a778b60c4f39b_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OMDB.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\windows\OMDB.exeC:\windows\OMDB.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PKXC.exe.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\windows\PKXC.exeC:\windows\PKXC.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NUA.exe.bat" "6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\windows\NUA.exeC:\windows\NUA.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XSF.exe.bat" "8⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\windows\SysWOW64\XSF.exeC:\windows\system32\XSF.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BAMMG.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\windows\SysWOW64\BAMMG.exeC:\windows\system32\BAMMG.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UBBXX.exe.bat" "12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5784 -
C:\windows\system\UBBXX.exeC:\windows\system\UBBXX.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WQH.exe.bat" "14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:960 -
C:\windows\WQH.exeC:\windows\WQH.exe15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DMGSKR.exe.bat" "16⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\windows\DMGSKR.exeC:\windows\DMGSKR.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GCN.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:5124 -
C:\windows\SysWOW64\GCN.exeC:\windows\system32\GCN.exe19⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HXZWB.exe.bat" "20⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5916 -
C:\windows\HXZWB.exeC:\windows\HXZWB.exe21⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NXGKKCL.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:5412 -
C:\windows\NXGKKCL.exeC:\windows\NXGKKCL.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UNHJRP.exe.bat" "24⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\windows\UNHJRP.exeC:\windows\UNHJRP.exe25⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GDO.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\windows\GDO.exeC:\windows\GDO.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5328 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BRTTN.exe.bat" "28⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\windows\SysWOW64\BRTTN.exeC:\windows\system32\BRTTN.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZRAGWKM.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\windows\ZRAGWKM.exeC:\windows\ZRAGWKM.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FMS.exe.bat" "32⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\windows\SysWOW64\FMS.exeC:\windows\system32\FMS.exe33⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3684 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JUGPFXY.exe.bat" "34⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\windows\system\JUGPFXY.exeC:\windows\system\JUGPFXY.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CNOAX.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:5132 -
C:\windows\SysWOW64\CNOAX.exeC:\windows\system32\CNOAX.exe37⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BFYQ.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\windows\system\BFYQ.exeC:\windows\system\BFYQ.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OIHPMPP.exe.bat" "40⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5844 -
C:\windows\SysWOW64\OIHPMPP.exeC:\windows\system32\OIHPMPP.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZBKA.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\windows\ZBKA.exeC:\windows\ZBKA.exe43⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RJMNXBH.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\windows\RJMNXBH.exeC:\windows\RJMNXBH.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WJTAOWI.exe.bat" "46⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5676 -
C:\windows\WJTAOWI.exeC:\windows\WJTAOWI.exe47⤵
- Executes dropped EXE
PID:3824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GKNFS.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\windows\system\GKNFS.exeC:\windows\system\GKNFS.exe49⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AFSPCBZ.exe.bat" "50⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\windows\system\AFSPCBZ.exeC:\windows\system\AFSPCBZ.exe51⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QACTN.exe.bat" "52⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\windows\QACTN.exeC:\windows\QACTN.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KNGDXNW.exe.bat" "54⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\windows\SysWOW64\KNGDXNW.exeC:\windows\system32\KNGDXNW.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FBLU.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\windows\SysWOW64\FBLU.exeC:\windows\system32\FBLU.exe57⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QTO.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\windows\QTO.exeC:\windows\QTO.exe59⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HCQSLA.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:5956 -
C:\windows\HCQSLA.exeC:\windows\HCQSLA.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NCYGCU.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\windows\SysWOW64\NCYGCU.exeC:\windows\system32\NCYGCU.exe63⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GXCBI.exe.bat" "64⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\windows\system\GXCBI.exeC:\windows\system\GXCBI.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5272 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PFEGLQH.exe.bat" "66⤵PID:4500
-
C:\windows\PFEGLQH.exeC:\windows\PFEGLQH.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZDJBBY.exe.bat" "68⤵
- System Location Discovery: System Language Discovery
PID:1488 -
C:\windows\SysWOW64\ZDJBBY.exeC:\windows\system32\ZDJBBY.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2680 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OYTF.exe.bat" "70⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1380 -
C:\windows\SysWOW64\OYTF.exeC:\windows\system32\OYTF.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OETUN.exe.bat" "72⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2592 -
C:\windows\system\OETUN.exeC:\windows\system\OETUN.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SUACAQP.exe.bat" "74⤵
- Executes a command shell one-liner
PID:4432 -
C:\windows\SysWOW64\SUACAQP.exeC:\windows\system32\SUACAQP.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ECGCM.exe.bat" "76⤵
- System Location Discovery: System Language Discovery
PID:952 -
C:\windows\system\ECGCM.exeC:\windows\system\ECGCM.exe77⤵
- Executes dropped EXE
PID:5912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OKIHPG.exe.bat" "78⤵PID:4688
-
C:\windows\system\OKIHPG.exeC:\windows\system\OKIHPG.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RSPPB.exe.bat" "80⤵PID:2660
-
C:\windows\SysWOW64\RSPPB.exeC:\windows\system32\RSPPB.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SVBKHOD.exe.bat" "82⤵PID:5860
-
C:\windows\SysWOW64\SVBKHOD.exeC:\windows\system32\SVBKHOD.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LYEO.exe.bat" "84⤵PID:3436
-
C:\windows\system\LYEO.exeC:\windows\system\LYEO.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FLJYXE.exe.bat" "86⤵PID:3644
-
C:\windows\SysWOW64\FLJYXE.exeC:\windows\system32\FLJYXE.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RTQYJ.exe.bat" "88⤵PID:1924
-
C:\windows\system\RTQYJ.exeC:\windows\system\RTQYJ.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4176 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TRW.exe.bat" "90⤵
- Executes a command shell one-liner
PID:4628 -
C:\windows\TRW.exeC:\windows\TRW.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LZYX.exe.bat" "92⤵
- Executes a command shell one-liner
PID:844 -
C:\windows\LZYX.exeC:\windows\LZYX.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1228 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UAAKFHC.exe.bat" "94⤵PID:1364
-
C:\windows\UAAKFHC.exeC:\windows\UAAKFHC.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OVET.exe.bat" "96⤵
- System Location Discovery: System Language Discovery
PID:4576 -
C:\windows\SysWOW64\OVET.exeC:\windows\system32\OVET.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CYNKEKM.exe.bat" "98⤵PID:4468
-
C:\windows\SysWOW64\CYNKEKM.exeC:\windows\system32\CYNKEKM.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OOTS.exe.bat" "100⤵
- Executes a command shell one-liner
PID:4964 -
C:\windows\SysWOW64\OOTS.exeC:\windows\system32\OOTS.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GJX.exe.bat" "102⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:820 -
C:\windows\GJX.exeC:\windows\GJX.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KZMWAK.exe.bat" "104⤵
- Executes a command shell one-liner
PID:864 -
C:\windows\SysWOW64\KZMWAK.exeC:\windows\system32\KZMWAK.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NMRFKKN.exe.bat" "106⤵
- System Location Discovery: System Language Discovery
PID:6072 -
C:\windows\SysWOW64\NMRFKKN.exeC:\windows\system32\NMRFKKN.exe107⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LII.exe.bat" "108⤵PID:2800
-
C:\windows\LII.exeC:\windows\LII.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FVNPZ.exe.bat" "110⤵PID:3904
-
C:\windows\SysWOW64\FVNPZ.exeC:\windows\system32\FVNPZ.exe111⤵
- Executes dropped EXE
PID:3156 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VQE.exe.bat" "112⤵
- System Location Discovery: System Language Discovery
PID:1376 -
C:\windows\VQE.exeC:\windows\VQE.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DDWI.exe.bat" "114⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4620 -
C:\windows\SysWOW64\DDWI.exeC:\windows\system32\DDWI.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QGNH.exe.bat" "116⤵PID:2388
-
C:\windows\QGNH.exeC:\windows\QGNH.exe117⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BZIAI.exe.bat" "118⤵PID:4456
-
C:\windows\system\BZIAI.exeC:\windows\system\BZIAI.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MRLS.exe.bat" "120⤵
- System Location Discovery: System Language Discovery
PID:244 -
C:\windows\system\MRLS.exeC:\windows\system\MRLS.exe121⤵
- Executes dropped EXE
PID:3432
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-