Analysis
- max time kernel
84s - max time network
116s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
15/08/2026, 14:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-15_1613d14535b6d1d07ca7765b08109364_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-15_1613d14535b6d1d07ca7765b08109364_elex_emotet_stop.exe
- Size 208KB
- Sample260815-rsnn3ayblh
- SHA256 8313d3ffbe199ae35a1a9dae038e6925833466cbe60f15a76255aa5d0fbe1dff
- MD5 1613d14535b6d1d07ca7765b08109364
- SHA1 071be287a765ba8d576d112f458d22322cc876bc
- SHA512 759495ad8574b370bcc1d7598bcf3cbd02484804b066849fe622a07e1819f8207785291a3b8bac1313eb56918fe6ae1abed6cf16a3c51589d04fd6d56e11ca2c
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlldL+LOfG4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFll5+LOOkEj1
- TLSH T1F9247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1456 TIEJ.exe 1240 NWPZEI.exe 4856 AGGYTK.exe 3344 BJK.exe 4984 KKMZ.exe 2388 XUUX.exe 1048 LSU.exe 1580 ANDNLP.exe 1668 GJDWHS.exe 4084 VEMA.exe 4972 DRZH.exe 5748 WUC.exe 6140 NVEQ.exe 4672 BFNPIBP.exe 2496 ZQYXRP.exe 5840 JODRYY.exe 1332 TOFWCVW.exe 1996 WEME.exe 3420 MUN.exe 4700 FNCGEC.exe 3340 OVET.exe 3712 JIJDSH.exe 4112 ROOKC.exe 4820 GJX.exe 4544 BECXY.exe 1348 SFEKJX.exe 5724 YFMY.exe 4572 ADZKAA.exe 1888 RLTX.exe 2500 FOKORII.exe 1844 DYMEAO.exe 1528 HOTM.exe 2784 CCYWWG.exe 3432 WPDFHGW.exe 2832 IIGY.exe 3184 CDLHR.exe 1152 KJDWTA.exe 1084 FWI.exe 6072 JMWFP.exe 4852 IXZV.exe 5368 XSIZJTC.exe 4844 PVMD.exe 352 QQQ.exe 4248 DBGYIK.exe 4504 XOFWNM.exe 2484 TUYLD.exe 468 SEBB.exe 1784 RPD.exe 1232 TNRLCJ.exe 2488 KVTQ.exe 4192 QRFR.exe 828 PGQMGIL.exe 5308 NRTCPO.exe 1188 ACD.exe 792 SFHLD.exe 5344 CDVF.exe 1516 BOX.exe 768 DBPX.exe 4100 FZURUH.exe 3744 KCSM.exe 1584 MXKOO.exe 2056 HKPXYLN.exe 2428 PQBMIK.exe 4296 PTFIO.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\SEBB.exe.bat TUYLD.exe File created C:\windows\SysWOW64\HKPXYLN.exe MXKOO.exe File opened for modification C:\windows\SysWOW64\BALOI.exe ZEG.exe File created C:\windows\SysWOW64\PGQMGIL.exe.bat QRFR.exe File created C:\windows\SysWOW64\MXKOO.exe KCSM.exe File created C:\windows\SysWOW64\TNRLCJ.exe.bat RPD.exe File opened for modification C:\windows\SysWOW64\CCYWWG.exe HOTM.exe File opened for modification C:\windows\SysWOW64\DMRRJN.exe JZNH.exe File created C:\windows\SysWOW64\ANDNLP.exe.bat LSU.exe File opened for modification C:\windows\SysWOW64\YFMY.exe SFEKJX.exe File opened for modification C:\windows\SysWOW64\DBGYIK.exe QQQ.exe File created C:\windows\SysWOW64\DPG.exe GKA.exe File created C:\windows\SysWOW64\BFNPIBP.exe.bat NVEQ.exe File created C:\windows\SysWOW64\JIJDSH.exe.bat OVET.exe File opened for modification C:\windows\SysWOW64\PTFIO.exe PQBMIK.exe File created C:\windows\SysWOW64\PMAHJR.exe.bat DTXOBKB.exe File opened for modification C:\windows\SysWOW64\LUQRKZR.exe FUIDT.exe File opened for modification C:\windows\SysWOW64\EJVFKA.exe JWRV.exe File created C:\windows\SysWOW64\DYMEAO.exe FOKORII.exe File created C:\windows\SysWOW64\CCYWWG.exe.bat HOTM.exe File created C:\windows\SysWOW64\IIGY.exe.bat WPDFHGW.exe File created C:\windows\SysWOW64\PGQMGIL.exe QRFR.exe File created C:\windows\SysWOW64\QTZKGG.exe.bat KYA.exe File created C:\windows\SysWOW64\JZNH.exe.bat TJM.exe File created C:\windows\SysWOW64\PMAHJR.exe DTXOBKB.exe File opened for modification C:\windows\SysWOW64\PVMD.exe XSIZJTC.exe File opened for modification C:\windows\SysWOW64\SFHLD.exe ACD.exe File opened for modification C:\windows\SysWOW64\RNJ.exe TRKWZUL.exe File opened for modification C:\windows\SysWOW64\GTM.exe YLVS.exe File created C:\windows\SysWOW64\PVMD.exe XSIZJTC.exe File created C:\windows\SysWOW64\KKMZ.exe.bat BJK.exe File created C:\windows\SysWOW64\OVET.exe.bat FNCGEC.exe File opened for modification C:\windows\SysWOW64\IIGY.exe WPDFHGW.exe File created C:\windows\SysWOW64\KJDWTA.exe CDLHR.exe File created C:\windows\SysWOW64\KJDWTA.exe.bat CDLHR.exe File opened for modification C:\windows\SysWOW64\BECXY.exe GJX.exe File opened for modification C:\windows\SysWOW64\DYMEAO.exe FOKORII.exe File created C:\windows\SysWOW64\DBPX.exe.bat BOX.exe File opened for modification C:\windows\SysWOW64\QTZKGG.exe KYA.exe File opened for modification C:\windows\SysWOW64\LGE.exe QTZKGG.exe File opened for modification C:\windows\SysWOW64\TNRLCJ.exe RPD.exe File created C:\windows\SysWOW64\EJVFKA.exe JWRV.exe File created C:\windows\SysWOW64\KKMZ.exe BJK.exe File created C:\windows\SysWOW64\OVET.exe FNCGEC.exe File created C:\windows\SysWOW64\DBGYIK.exe.bat QQQ.exe File created C:\windows\SysWOW64\LUQRKZR.exe.bat FUIDT.exe File created C:\windows\SysWOW64\BALOI.exe.bat ZEG.exe File created C:\windows\SysWOW64\MXKOO.exe.bat KCSM.exe File opened for modification C:\windows\SysWOW64\PMAHJR.exe DTXOBKB.exe File created C:\windows\SysWOW64\LUQRKZR.exe FUIDT.exe File opened for modification C:\windows\SysWOW64\OVET.exe FNCGEC.exe File created C:\windows\SysWOW64\CCYWWG.exe HOTM.exe File opened for modification C:\windows\SysWOW64\GKA.exe MWWTMMY.exe File opened for modification C:\windows\SysWOW64\ADZKAA.exe YFMY.exe File created C:\windows\SysWOW64\DBPX.exe BOX.exe File created C:\windows\SysWOW64\HKPXYLN.exe.bat MXKOO.exe File created C:\windows\SysWOW64\JZNH.exe TJM.exe File created C:\windows\SysWOW64\XNRLN.exe RNJ.exe File opened for modification C:\windows\SysWOW64\DPG.exe GKA.exe File created C:\windows\SysWOW64\ANDNLP.exe LSU.exe File opened for modification C:\windows\SysWOW64\JIJDSH.exe OVET.exe File created C:\windows\SysWOW64\ADZKAA.exe.bat YFMY.exe File opened for modification C:\windows\SysWOW64\SEBB.exe TUYLD.exe File created C:\windows\SysWOW64\GKA.exe.bat MWWTMMY.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\QQQ.exe.bat PVMD.exe File opened for modification C:\windows\system\TUYLD.exe XOFWNM.exe File created C:\windows\system\QRFR.exe KVTQ.exe File created C:\windows\system\NRTCPO.exe.bat PGQMGIL.exe File created C:\windows\BOX.exe CDVF.exe File opened for modification C:\windows\system\FNCGEC.exe MUN.exe File opened for modification C:\windows\system\CDLHR.exe IIGY.exe File opened for modification C:\windows\system\TJM.exe PTFIO.exe File created C:\windows\system\RXAPXQ.exe.bat DMRRJN.exe File opened for modification C:\windows\XKZQCTV.exe RXAPXQ.exe File opened for modification C:\windows\system\KYA.exe XNRLN.exe File created C:\windows\system\JWRV.exe OIMMQAS.exe File created C:\windows\OIBS.exe DPG.exe File opened for modification C:\windows\system\TIEJ.exe 2026-08-15_1613d14535b6d1d07ca7765b08109364_elex_emotet_stop.exe File opened for modification C:\windows\JMWFP.exe FWI.exe File created C:\windows\KCSM.exe FZURUH.exe File created C:\windows\system\KYA.exe XNRLN.exe File opened for modification C:\windows\ZNCZ.exe VXWZT.exe File created C:\windows\DRZH.exe.bat VEMA.exe File opened for modification C:\windows\KVPPQEQ.exe XKZQCTV.exe File opened for modification C:\windows\UOWNFW.exe LNUIC.exe File created C:\windows\YFV.exe BALOI.exe File opened for modification C:\windows\system\JODRYY.exe ZQYXRP.exe File created C:\windows\system\FNCGEC.exe MUN.exe File created C:\windows\system\XSIZJTC.exe.bat IXZV.exe File created C:\windows\system\KVTQ.exe.bat TNRLCJ.exe File created C:\windows\system\KBSCC.exe.bat GTM.exe File created C:\windows\system\FNCGEC.exe.bat MUN.exe File opened for modification C:\windows\GJX.exe ROOKC.exe File created C:\windows\system\TCJG.exe EHACVM.exe File created C:\windows\system\TCJG.exe.bat EHACVM.exe File opened for modification C:\windows\system\ZQYXRP.exe BFNPIBP.exe File created C:\windows\TOFWCVW.exe JODRYY.exe File created C:\windows\GJX.exe.bat ROOKC.exe File created C:\windows\system\HOTM.exe DYMEAO.exe File created C:\windows\system\QQQ.exe PVMD.exe File created C:\windows\system\RPD.exe SEBB.exe File created C:\windows\system\KVTQ.exe TNRLCJ.exe File created C:\windows\system\DUS.exe.bat LUQRKZR.exe File created C:\windows\system\HOTM.exe.bat DYMEAO.exe File opened for modification C:\windows\system\QRFR.exe KVTQ.exe File created C:\windows\system\QRFR.exe.bat KVTQ.exe File opened for modification C:\windows\system\KBSCC.exe GTM.exe File opened for modification C:\windows\TOFWCVW.exe JODRYY.exe File created C:\windows\system\TUYLD.exe XOFWNM.exe File opened for modification C:\windows\system\CDVF.exe SFHLD.exe File created C:\windows\LNUIC.exe.bat OIBS.exe File created C:\windows\YLVS.exe YFV.exe File opened for modification C:\windows\VEMA.exe GJDWHS.exe File created C:\windows\system\XSIZJTC.exe IXZV.exe File opened for modification C:\windows\system\QQQ.exe PVMD.exe File created C:\windows\system\VXWZT.exe DUS.exe File opened for modification C:\windows\MWWTMMY.exe EJVFKA.exe File created C:\windows\OIBS.exe.bat DPG.exe File created C:\windows\system\ORZDPYU.exe KBSCC.exe File opened for modification C:\windows\system\KVTQ.exe TNRLCJ.exe File created C:\windows\TOFWCVW.exe.bat JODRYY.exe File created C:\windows\WEME.exe.bat TOFWCVW.exe File opened for modification C:\windows\system\NWPZEI.exe TIEJ.exe File created C:\windows\system\NWPZEI.exe.bat TIEJ.exe File created C:\windows\system\LSU.exe.bat XUUX.exe File created C:\windows\system\ZQYXRP.exe BFNPIBP.exe File created C:\windows\system\RLTX.exe ADZKAA.exe File created C:\windows\GJDWHS.exe ANDNLP.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4196 cmd.exe 200 cmd.exe 5872 cmd.exe 6120 cmd.exe 940 cmd.exe 5848 cmd.exe 3876 cmd.exe 2576 cmd.exe 2916 cmd.exe 4884 cmd.exe 520 cmd.exe 3436 cmd.exe 764 cmd.exe 5400 cmd.exe 1872 cmd.exe 240 cmd.exe 2304 cmd.exe 6100 cmd.exe 5824 cmd.exe 2644 cmd.exe 1728 cmd.exe 2288 cmd.exe 5416 cmd.exe 1096 cmd.exe 2152 cmd.exe 4128 cmd.exe 1192 cmd.exe 2328 cmd.exe 1408 cmd.exe 6032 cmd.exe 6132 cmd.exe 5804 cmd.exe 3156 cmd.exe 4340 cmd.exe 1576 cmd.exe 1496 cmd.exe 3888 cmd.exe 4076 cmd.exe 2172 cmd.exe 6036 cmd.exe 988 cmd.exe 5484 cmd.exe 696 cmd.exe 4444 cmd.exe 3696 cmd.exe 3808 cmd.exe 3772 cmd.exe 3380 cmd.exe 5292 cmd.exe 5820 cmd.exe 1076 cmd.exe 5924 cmd.exe 1432 cmd.exe 4488 cmd.exe 6024 cmd.exe 4056 cmd.exe 5192 cmd.exe 1416 cmd.exe 4624 cmd.exe 1056 cmd.exe 6056 cmd.exe 5220 cmd.exe 5964 cmd.exe 256 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 396 4420 WerFault.exe 88 400 1456 WerFault.exe 93 1952 1240 WerFault.exe 99 2936 4856 WerFault.exe 104 4640 3344 WerFault.exe 109 1520 4984 WerFault.exe 114 4744 2388 WerFault.exe 119 4496 1048 WerFault.exe 124 2464 1580 WerFault.exe 129 5352 1668 WerFault.exe 134 4772 4084 WerFault.exe 139 4136 4972 WerFault.exe 144 4580 5748 WerFault.exe 149 2840 6140 WerFault.exe 154 5888 4672 WerFault.exe 159 5604 2496 WerFault.exe 164 1872 5840 WerFault.exe 169 2908 1332 WerFault.exe 174 3772 1996 WerFault.exe 179 5488 3420 WerFault.exe 184 5360 4700 WerFault.exe 189 4140 3340 WerFault.exe 193 5336 3712 WerFault.exe 199 3796 4112 WerFault.exe 204 4248 4820 WerFault.exe 209 2424 4544 WerFault.exe 214 3496 1348 WerFault.exe 219 2292 5724 WerFault.exe 224 6040 4572 WerFault.exe 229 4416 1888 WerFault.exe 234 1156 2500 WerFault.exe 239 1756 1844 WerFault.exe 244 4616 1528 WerFault.exe 249 3272 2784 WerFault.exe 254 3152 3432 WerFault.exe 259 5776 2832 WerFault.exe 264 6032 3184 WerFault.exe 269 1204 1152 WerFault.exe 274 4144 1084 WerFault.exe 280 356 6072 WerFault.exe 285 4668 4852 WerFault.exe 290 692 5368 WerFault.exe 295 2300 4844 WerFault.exe 300 5564 352 WerFault.exe 305 3876 4248 WerFault.exe 310 2044 4504 WerFault.exe 315 940 2484 WerFault.exe 320 5568 468 WerFault.exe 325 1956 1784 WerFault.exe 330 3144 1232 WerFault.exe 335 2172 2488 WerFault.exe 340 5876 4192 WerFault.exe 345 3540 828 WerFault.exe 350 3488 5308 WerFault.exe 355 3040 1188 WerFault.exe 360 5888 792 WerFault.exe 365 4204 5344 WerFault.exe 370 5976 1516 WerFault.exe 375 2772 768 WerFault.exe 380 2580 4100 WerFault.exe 385 5936 3744 WerFault.exe 390 236 1584 WerFault.exe 395 2068 2056 WerFault.exe 400 1532 2428 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HOTM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PTFIO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZEG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BFNPIBP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KYA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DRZH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LSU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GKA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XSIZJTC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ORZDPYU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TOFWCVW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HKPXYLN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JWRV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JODRYY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DBGYIK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NRTCPO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SFEKJX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YFMY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CDLHR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QTZKGG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LUQRKZR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UTVJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LNUIC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YFV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RPD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MXKOO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WEME.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FNCGEC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OVET.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ROOKC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ADZKAA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4420 2026-08-15_1613d14535b6d1d07ca7765b08109364_elex_emotet_stop.exe 4420 2026-08-15_1613d14535b6d1d07ca7765b08109364_elex_emotet_stop.exe 1456 TIEJ.exe 1456 TIEJ.exe 1240 NWPZEI.exe 1240 NWPZEI.exe 4856 AGGYTK.exe 4856 AGGYTK.exe 3344 BJK.exe 3344 BJK.exe 4984 KKMZ.exe 4984 KKMZ.exe 2388 XUUX.exe 2388 XUUX.exe 1048 LSU.exe 1048 LSU.exe 1580 ANDNLP.exe 1580 ANDNLP.exe 1668 GJDWHS.exe 1668 GJDWHS.exe 4084 VEMA.exe 4084 VEMA.exe 4972 DRZH.exe 4972 DRZH.exe 5748 WUC.exe 5748 WUC.exe 6140 NVEQ.exe 6140 NVEQ.exe 4672 BFNPIBP.exe 4672 BFNPIBP.exe 2496 ZQYXRP.exe 2496 ZQYXRP.exe 5840 JODRYY.exe 5840 JODRYY.exe 1332 TOFWCVW.exe 1332 TOFWCVW.exe 1996 WEME.exe 1996 WEME.exe 3420 MUN.exe 3420 MUN.exe 4700 FNCGEC.exe 4700 FNCGEC.exe 3340 OVET.exe 3340 OVET.exe 3712 JIJDSH.exe 3712 JIJDSH.exe 4112 ROOKC.exe 4112 ROOKC.exe 4820 GJX.exe 4820 GJX.exe 4544 BECXY.exe 4544 BECXY.exe 1348 SFEKJX.exe 1348 SFEKJX.exe 5724 YFMY.exe 5724 YFMY.exe 4572 ADZKAA.exe 4572 ADZKAA.exe 1888 RLTX.exe 1888 RLTX.exe 2500 FOKORII.exe 2500 FOKORII.exe 1844 DYMEAO.exe 1844 DYMEAO.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4420 2026-08-15_1613d14535b6d1d07ca7765b08109364_elex_emotet_stop.exe 4420 2026-08-15_1613d14535b6d1d07ca7765b08109364_elex_emotet_stop.exe 1456 TIEJ.exe 1456 TIEJ.exe 1240 NWPZEI.exe 1240 NWPZEI.exe 4856 AGGYTK.exe 4856 AGGYTK.exe 3344 BJK.exe 3344 BJK.exe 4984 KKMZ.exe 4984 KKMZ.exe 2388 XUUX.exe 2388 XUUX.exe 1048 LSU.exe 1048 LSU.exe 1580 ANDNLP.exe 1580 ANDNLP.exe 1668 GJDWHS.exe 1668 GJDWHS.exe 4084 VEMA.exe 4084 VEMA.exe 4972 DRZH.exe 4972 DRZH.exe 5748 WUC.exe 5748 WUC.exe 6140 NVEQ.exe 6140 NVEQ.exe 4672 BFNPIBP.exe 4672 BFNPIBP.exe 2496 ZQYXRP.exe 2496 ZQYXRP.exe 5840 JODRYY.exe 5840 JODRYY.exe 1332 TOFWCVW.exe 1332 TOFWCVW.exe 1996 WEME.exe 1996 WEME.exe 3420 MUN.exe 3420 MUN.exe 4700 FNCGEC.exe 4700 FNCGEC.exe 3340 OVET.exe 3340 OVET.exe 3712 JIJDSH.exe 3712 JIJDSH.exe 4112 ROOKC.exe 4112 ROOKC.exe 4820 GJX.exe 4820 GJX.exe 4544 BECXY.exe 4544 BECXY.exe 1348 SFEKJX.exe 1348 SFEKJX.exe 5724 YFMY.exe 5724 YFMY.exe 4572 ADZKAA.exe 4572 ADZKAA.exe 1888 RLTX.exe 1888 RLTX.exe 2500 FOKORII.exe 2500 FOKORII.exe 1844 DYMEAO.exe 1844 DYMEAO.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4420 wrote to memory of 6024 4420 2026-08-15_1613d14535b6d1d07ca7765b08109364_elex_emotet_stop.exe 89 PID 6024 wrote to memory of 1456 6024 cmd.exe 93 PID 1456 wrote to memory of 4336 1456 TIEJ.exe 95 PID 4336 wrote to memory of 1240 4336 cmd.exe 99 PID 1240 wrote to memory of 4412 1240 NWPZEI.exe 100 PID 4412 wrote to memory of 4856 4412 cmd.exe 104 PID 4856 wrote to memory of 2676 4856 AGGYTK.exe 105 PID 2676 wrote to memory of 3344 2676 cmd.exe 109 PID 3344 wrote to memory of 1908 3344 BJK.exe 110 PID 1908 wrote to memory of 4984 1908 cmd.exe 114 PID 4984 wrote to memory of 5720 4984 KKMZ.exe 115 PID 5720 wrote to memory of 2388 5720 cmd.exe 119 PID 2388 wrote to memory of 5872 2388 XUUX.exe 120 PID 5872 wrote to memory of 1048 5872 cmd.exe 124 PID 1048 wrote to memory of 2480 1048 LSU.exe 125 PID 2480 wrote to memory of 1580 2480 cmd.exe 129 PID 1580 wrote to memory of 4056 1580 ANDNLP.exe 130 PID 4056 wrote to memory of 1668 4056 cmd.exe 134 PID 1668 wrote to memory of 3684 1668 GJDWHS.exe 135 PID 3684 wrote to memory of 4084 3684 cmd.exe 139 PID 4084 wrote to memory of 5484 4084 VEMA.exe 140 PID 5484 wrote to memory of 4972 5484 cmd.exe 144 PID 4972 wrote to memory of 5964 4972 DRZH.exe 145 PID 5964 wrote to memory of 5748 5964 cmd.exe 149 PID 5748 wrote to memory of 4208 5748 WUC.exe 150 PID 4208 wrote to memory of 6140 4208 cmd.exe 154 PID 6140 wrote to memory of 256 6140 NVEQ.exe 155 PID 256 wrote to memory of 4672 256 cmd.exe 159 PID 4672 wrote to memory of 5804 4672 BFNPIBP.exe 160 PID 5804 wrote to memory of 2496 5804 cmd.exe 164 PID 2496 wrote to memory of 3156 2496 ZQYXRP.exe 165 PID 3156 wrote to memory of 5840 3156 cmd.exe 169 PID 5840 wrote to memory of 1120 5840 JODRYY.exe 170 PID 1120 wrote to memory of 1332 1120 cmd.exe 174 PID 1332 wrote to memory of 2164 1332 TOFWCVW.exe 175 PID 2164 wrote to memory of 1996 2164 cmd.exe 179 PID 1996 wrote to memory of 3108 1996 WEME.exe 180 PID 3108 wrote to memory of 3420 3108 cmd.exe 184 PID 3420 wrote to memory of 3392 3420 MUN.exe 185 PID 3392 wrote to memory of 4700 3392 cmd.exe 189 PID 4700 wrote to memory of 4300 4700 FNCGEC.exe 190 PID 4300 wrote to memory of 3340 4300 cmd.exe 193 PID 3340 wrote to memory of 3564 3340 OVET.exe 195 PID 3564 wrote to memory of 3712 3564 cmd.exe 199 PID 3712 wrote to memory of 4148 3712 JIJDSH.exe 200 PID 4148 wrote to memory of 4112 4148 cmd.exe 204 PID 4112 wrote to memory of 4340 4112 ROOKC.exe 205 PID 4340 wrote to memory of 4820 4340 cmd.exe 209 PID 4820 wrote to memory of 4452 4820 GJX.exe 210 PID 4452 wrote to memory of 4544 4452 cmd.exe 214 PID 4544 wrote to memory of 1028 4544 BECXY.exe 215 PID 1028 wrote to memory of 1348 1028 cmd.exe 219 PID 1348 wrote to memory of 3808 1348 SFEKJX.exe 220 PID 3808 wrote to memory of 5724 3808 cmd.exe 224 PID 5724 wrote to memory of 4396 5724 YFMY.exe 225 PID 4396 wrote to memory of 4572 4396 cmd.exe 229 PID 4572 wrote to memory of 4048 4572 ADZKAA.exe 230 PID 4048 wrote to memory of 1888 4048 cmd.exe 234 PID 1888 wrote to memory of 3772 1888 RLTX.exe 235 PID 3772 wrote to memory of 2500 3772 cmd.exe 239 PID 2500 wrote to memory of 5836 2500 FOKORII.exe 240 PID 5836 wrote to memory of 1844 5836 cmd.exe 244 PID 1844 wrote to memory of 696 1844 DYMEAO.exe 245 PID 696 wrote to memory of 1528 696 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-15_1613d14535b6d1d07ca7765b08109364_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-15_1613d14535b6d1d07ca7765b08109364_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TIEJ.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6024 -
C:\windows\system\TIEJ.exeC:\windows\system\TIEJ.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NWPZEI.exe.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\windows\system\NWPZEI.exeC:\windows\system\NWPZEI.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AGGYTK.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\windows\AGGYTK.exeC:\windows\AGGYTK.exe7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BJK.exe.bat" "8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\windows\BJK.exeC:\windows\BJK.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KKMZ.exe.bat" "10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\windows\SysWOW64\KKMZ.exeC:\windows\system32\KKMZ.exe11⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XUUX.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:5720 -
C:\windows\system\XUUX.exeC:\windows\system\XUUX.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LSU.exe.bat" "14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5872 -
C:\windows\system\LSU.exeC:\windows\system\LSU.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ANDNLP.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\windows\SysWOW64\ANDNLP.exeC:\windows\system32\ANDNLP.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GJDWHS.exe.bat" "18⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\windows\GJDWHS.exeC:\windows\GJDWHS.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VEMA.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:3684 -
C:\windows\VEMA.exeC:\windows\VEMA.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DRZH.exe.bat" "22⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5484 -
C:\windows\DRZH.exeC:\windows\DRZH.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WUC.exe.bat" "24⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5964 -
C:\windows\WUC.exeC:\windows\WUC.exe25⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NVEQ.exe.bat" "26⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\windows\system\NVEQ.exeC:\windows\system\NVEQ.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BFNPIBP.exe.bat" "28⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:256 -
C:\windows\SysWOW64\BFNPIBP.exeC:\windows\system32\BFNPIBP.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZQYXRP.exe.bat" "30⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5804 -
C:\windows\system\ZQYXRP.exeC:\windows\system\ZQYXRP.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JODRYY.exe.bat" "32⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\windows\system\JODRYY.exeC:\windows\system\JODRYY.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TOFWCVW.exe.bat" "34⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\windows\TOFWCVW.exeC:\windows\TOFWCVW.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WEME.exe.bat" "36⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\windows\WEME.exeC:\windows\WEME.exe37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MUN.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:3108 -
C:\windows\MUN.exeC:\windows\MUN.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FNCGEC.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\windows\system\FNCGEC.exeC:\windows\system\FNCGEC.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OVET.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\windows\SysWOW64\OVET.exeC:\windows\system32\OVET.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JIJDSH.exe.bat" "44⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\windows\SysWOW64\JIJDSH.exeC:\windows\system32\JIJDSH.exe45⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ROOKC.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\windows\ROOKC.exeC:\windows\ROOKC.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GJX.exe.bat" "48⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\windows\GJX.exeC:\windows\GJX.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BECXY.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\windows\SysWOW64\BECXY.exeC:\windows\system32\BECXY.exe51⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SFEKJX.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\windows\SysWOW64\SFEKJX.exeC:\windows\system32\SFEKJX.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YFMY.exe.bat" "54⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3808 -
C:\windows\SysWOW64\YFMY.exeC:\windows\system32\YFMY.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ADZKAA.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\windows\SysWOW64\ADZKAA.exeC:\windows\system32\ADZKAA.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RLTX.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\windows\system\RLTX.exeC:\windows\system\RLTX.exe59⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FOKORII.exe.bat" "60⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\windows\system\FOKORII.exeC:\windows\system\FOKORII.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DYMEAO.exe.bat" "62⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5836 -
C:\windows\SysWOW64\DYMEAO.exeC:\windows\system32\DYMEAO.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HOTM.exe.bat" "64⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:696 -
C:\windows\system\HOTM.exeC:\windows\system\HOTM.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1528 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CCYWWG.exe.bat" "66⤵PID:4532
-
C:\windows\SysWOW64\CCYWWG.exeC:\windows\system32\CCYWWG.exe67⤵
- Executes dropped EXE
PID:2784 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WPDFHGW.exe.bat" "68⤵PID:52
-
C:\windows\WPDFHGW.exeC:\windows\WPDFHGW.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IIGY.exe.bat" "70⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3436 -
C:\windows\SysWOW64\IIGY.exeC:\windows\system32\IIGY.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CDLHR.exe.bat" "72⤵PID:4320
-
C:\windows\system\CDLHR.exeC:\windows\system\CDLHR.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3184 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KJDWTA.exe.bat" "74⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1576 -
C:\windows\SysWOW64\KJDWTA.exeC:\windows\system32\KJDWTA.exe75⤵
- Executes dropped EXE
PID:1152 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FWI.exe.bat" "76⤵
- Executes a command shell one-liner
PID:5192 -
C:\windows\FWI.exeC:\windows\FWI.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JMWFP.exe.bat" "78⤵PID:432
-
C:\windows\JMWFP.exeC:\windows\JMWFP.exe79⤵
- Executes dropped EXE
PID:6072 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IXZV.exe.bat" "80⤵
- System Location Discovery: System Language Discovery
PID:4172 -
C:\windows\SysWOW64\IXZV.exeC:\windows\system32\IXZV.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XSIZJTC.exe.bat" "82⤵PID:1156
-
C:\windows\system\XSIZJTC.exeC:\windows\system\XSIZJTC.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PVMD.exe.bat" "84⤵
- System Location Discovery: System Language Discovery
PID:556 -
C:\windows\SysWOW64\PVMD.exeC:\windows\system32\PVMD.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QQQ.exe.bat" "86⤵
- System Location Discovery: System Language Discovery
PID:4224 -
C:\windows\system\QQQ.exeC:\windows\system\QQQ.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DBGYIK.exe.bat" "88⤵PID:2996
-
C:\windows\SysWOW64\DBGYIK.exeC:\windows\system32\DBGYIK.exe89⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XOFWNM.exe.bat" "90⤵PID:5028
-
C:\windows\system\XOFWNM.exeC:\windows\system\XOFWNM.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TUYLD.exe.bat" "92⤵PID:4480
-
C:\windows\system\TUYLD.exeC:\windows\system\TUYLD.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2484 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SEBB.exe.bat" "94⤵
- System Location Discovery: System Language Discovery
PID:1352 -
C:\windows\SysWOW64\SEBB.exeC:\windows\system32\SEBB.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RPD.exe.bat" "96⤵PID:3424
-
C:\windows\system\RPD.exeC:\windows\system\RPD.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1784 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TNRLCJ.exe.bat" "98⤵
- Executes a command shell one-liner
PID:1496 -
C:\windows\SysWOW64\TNRLCJ.exeC:\windows\system32\TNRLCJ.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1232 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KVTQ.exe.bat" "100⤵PID:3444
-
C:\windows\system\KVTQ.exeC:\windows\system\KVTQ.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QRFR.exe.bat" "102⤵PID:3384
-
C:\windows\system\QRFR.exeC:\windows\system\QRFR.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4192 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PGQMGIL.exe.bat" "104⤵
- Executes a command shell one-liner
PID:1192 -
C:\windows\SysWOW64\PGQMGIL.exeC:\windows\system32\PGQMGIL.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NRTCPO.exe.bat" "106⤵PID:1924
-
C:\windows\system\NRTCPO.exeC:\windows\system\NRTCPO.exe107⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ACD.exe.bat" "108⤵PID:5564
-
C:\windows\system\ACD.exeC:\windows\system\ACD.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SFHLD.exe.bat" "110⤵PID:4724
-
C:\windows\SysWOW64\SFHLD.exeC:\windows\system32\SFHLD.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:792 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CDVF.exe.bat" "112⤵PID:3416
-
C:\windows\system\CDVF.exeC:\windows\system\CDVF.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BOX.exe.bat" "114⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:764 -
C:\windows\BOX.exeC:\windows\BOX.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DBPX.exe.bat" "116⤵
- System Location Discovery: System Language Discovery
PID:4556 -
C:\windows\SysWOW64\DBPX.exeC:\windows\system32\DBPX.exe117⤵
- Executes dropped EXE
PID:768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FZURUH.exe.bat" "118⤵
- System Location Discovery: System Language Discovery
PID:3508 -
C:\windows\system\FZURUH.exeC:\windows\system\FZURUH.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KCSM.exe.bat" "120⤵
- Executes a command shell one-liner
PID:5924 -
C:\windows\KCSM.exeC:\windows\KCSM.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3744
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-