Analysis
- max time kernel
148s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
15/08/2026, 20:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-15_72e04b1bd1282055e637101cb081dc92_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-15_72e04b1bd1282055e637101cb081dc92_elex_emotet_stop.exe
- Size 208KB
- Sample260815-zey7msgm41
- SHA256 9620c2a92487d6857161a19c26749eb24f756934d97a306e99c8066a92e928ae
- MD5 72e04b1bd1282055e637101cb081dc92
- SHA1 ce1f357685b6b8d00e67f304644283f139356889
- SHA512 be099e76f64b9934f31bcc44a8a972fbef3d545264b256d42fb39de772975a26b3da1d8414fdd2dc8c9d75c301e3f47b2b8e43977bc479e75af1ff71db6ef050
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFl1dL+LOfo4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFl15+LOQkEj1
- TLSH T1CE247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2896 COXA.exe 908 XUWWN.exe 4832 UKJOCNH.exe 3212 KAKN.exe 2804 CDO.exe 1608 QGWHDB.exe 2852 ORHXD.exe 2808 EHI.exe 1288 XHQABD.exe 5056 KKGYIO.exe 3024 QFSZVD.exe 3940 GVTR.exe 604 GYXUIO.exe 5744 PMOTT.exe 4724 PHR.exe 1436 FXSON.exe 2760 BCLEW.exe 4952 JQXKG.exe 6052 XOXW.exe 2376 BEEECH.exe 2216 UWTPMI.exe 4348 RPVRQ.exe 5812 GFW.exe 6024 BABAH.exe 1832 WDR.exe 2420 OGVUAAV.exe 4304 SWCUM.exe 2916 TRGYSI.exe 264 XHMY.exe 3412 HFA.exe 2100 LIYGTC.exe 5940 ADHS.exe 3884 CBNM.exe 2120 DERIZ.exe 2904 QCZU.exe 428 YPDA.exe 912 OKNFXS.exe 2408 BIVQZ.exe 260 LGBL.exe 2520 WYQ.exe 3232 MORVEA.exe 704 IUBKUW.exe 5384 YKC.exe 2872 WDNSCXT.exe 5768 VSYVX.exe 2656 IQGG.exe 4564 WLKZMC.exe 3356 XOAVBM.exe 6080 ZMOQIU.exe 5764 JKT.exe 1708 WQTOAOO.exe 6016 ZDLXLAW.exe 2924 DGJKL.exe 4208 QRZJZ.exe 1580 IZBODBD.exe 5952 QFGDNH.exe 4976 BXVOFA.exe 3812 NNCO.exe 4680 NTCC.exe 4280 GWGYYV.exe 5724 LWNM.exe 2056 DWPZS.exe 3476 QHYPZ.exe 4648 LUDZJGN.exe - Drops file in System32 directory 51 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\UGDEKTR.exe KIYJDKQ.exe File opened for modification C:\windows\SysWOW64\MJHZ.exe UGDEKTR.exe File opened for modification C:\windows\SysWOW64\GFW.exe RPVRQ.exe File opened for modification C:\windows\SysWOW64\SWCUM.exe OGVUAAV.exe File created C:\windows\SysWOW64\YPDA.exe QCZU.exe File created C:\windows\SysWOW64\LGBL.exe BIVQZ.exe File created C:\windows\SysWOW64\MORVEA.exe WYQ.exe File created C:\windows\SysWOW64\BXVOFA.exe.bat QFGDNH.exe File created C:\windows\SysWOW64\COXA.exe 2026-08-15_72e04b1bd1282055e637101cb081dc92_elex_emotet_stop.exe File created C:\windows\SysWOW64\HFA.exe.bat XHMY.exe File created C:\windows\SysWOW64\LGBL.exe.bat BIVQZ.exe File opened for modification C:\windows\SysWOW64\LWNM.exe GWGYYV.exe File created C:\windows\SysWOW64\CVF.exe LUDZJGN.exe File created C:\windows\SysWOW64\UGDEKTR.exe.bat KIYJDKQ.exe File created C:\windows\SysWOW64\MJHZ.exe UGDEKTR.exe File created C:\windows\SysWOW64\MJHZ.exe.bat UGDEKTR.exe File opened for modification C:\windows\SysWOW64\COXA.exe 2026-08-15_72e04b1bd1282055e637101cb081dc92_elex_emotet_stop.exe File created C:\windows\SysWOW64\SWCUM.exe OGVUAAV.exe File opened for modification C:\windows\SysWOW64\QCZU.exe DERIZ.exe File created C:\windows\SysWOW64\WYQ.exe.bat LGBL.exe File created C:\windows\SysWOW64\MORVEA.exe.bat WYQ.exe File created C:\windows\SysWOW64\XOAVBM.exe.bat WLKZMC.exe File created C:\windows\SysWOW64\QFGDNH.exe IZBODBD.exe File created C:\windows\SysWOW64\BXVOFA.exe QFGDNH.exe File created C:\windows\SysWOW64\GFW.exe RPVRQ.exe File created C:\windows\SysWOW64\YPDA.exe.bat QCZU.exe File opened for modification C:\windows\SysWOW64\LGBL.exe BIVQZ.exe File created C:\windows\SysWOW64\XOAVBM.exe WLKZMC.exe File opened for modification C:\windows\SysWOW64\BXVOFA.exe QFGDNH.exe File created C:\windows\SysWOW64\NNCO.exe BXVOFA.exe File opened for modification C:\windows\SysWOW64\NNCO.exe BXVOFA.exe File created C:\windows\SysWOW64\LWNM.exe GWGYYV.exe File created C:\windows\SysWOW64\COXA.exe.bat 2026-08-15_72e04b1bd1282055e637101cb081dc92_elex_emotet_stop.exe File opened for modification C:\windows\SysWOW64\HFA.exe XHMY.exe File created C:\windows\SysWOW64\QCZU.exe.bat DERIZ.exe File opened for modification C:\windows\SysWOW64\YPDA.exe QCZU.exe File opened for modification C:\windows\SysWOW64\WYQ.exe LGBL.exe File created C:\windows\SysWOW64\LWNM.exe.bat GWGYYV.exe File created C:\windows\SysWOW64\GFW.exe.bat RPVRQ.exe File created C:\windows\SysWOW64\QCZU.exe DERIZ.exe File created C:\windows\SysWOW64\WYQ.exe LGBL.exe File opened for modification C:\windows\SysWOW64\XOAVBM.exe WLKZMC.exe File created C:\windows\SysWOW64\NNCO.exe.bat BXVOFA.exe File opened for modification C:\windows\SysWOW64\CVF.exe LUDZJGN.exe File created C:\windows\SysWOW64\CVF.exe.bat LUDZJGN.exe File created C:\windows\SysWOW64\UGDEKTR.exe KIYJDKQ.exe File created C:\windows\SysWOW64\SWCUM.exe.bat OGVUAAV.exe File created C:\windows\SysWOW64\HFA.exe XHMY.exe File opened for modification C:\windows\SysWOW64\MORVEA.exe WYQ.exe File opened for modification C:\windows\SysWOW64\QFGDNH.exe IZBODBD.exe File created C:\windows\SysWOW64\QFGDNH.exe.bat IZBODBD.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\GVTR.exe.bat QFSZVD.exe File opened for modification C:\windows\system\GLLMZ.exe CVF.exe File created C:\windows\system\WXPL.exe NXN.exe File opened for modification C:\windows\UKJOCNH.exe XUWWN.exe File opened for modification C:\windows\OKNFXS.exe YPDA.exe File created C:\windows\GWGYYV.exe.bat NTCC.exe File created C:\windows\GYXUIO.exe.bat GVTR.exe File opened for modification C:\windows\WDNSCXT.exe YKC.exe File created C:\windows\system\LUDZJGN.exe.bat QHYPZ.exe File created C:\windows\XHQABD.exe.bat EHI.exe File created C:\windows\PMOTT.exe GYXUIO.exe File created C:\windows\XOXW.exe JQXKG.exe File opened for modification C:\windows\BEEECH.exe XOXW.exe File created C:\windows\BABAH.exe GFW.exe File created C:\windows\BIVQZ.exe.bat OKNFXS.exe File opened for modification C:\windows\system\DWPZS.exe LWNM.exe File created C:\windows\FXSON.exe.bat PHR.exe File created C:\windows\system\LIYGTC.exe.bat HFA.exe File opened for modification C:\windows\NTCC.exe NNCO.exe File created C:\windows\system\DWPZS.exe LWNM.exe File created C:\windows\UKJOCNH.exe.bat XUWWN.exe File opened for modification C:\windows\KAKN.exe UKJOCNH.exe File created C:\windows\system\PHR.exe PMOTT.exe File opened for modification C:\windows\XOXW.exe JQXKG.exe File created C:\windows\IQGG.exe VSYVX.exe File created C:\windows\system\LUDZJGN.exe QHYPZ.exe File opened for modification C:\windows\IJRGO.exe GLLMZ.exe File created C:\windows\BEEECH.exe XOXW.exe File created C:\windows\VSYVX.exe WDNSCXT.exe File created C:\windows\system\DWPZS.exe.bat LWNM.exe File created C:\windows\system\XUWWN.exe.bat COXA.exe File created C:\windows\EHI.exe ORHXD.exe File opened for modification C:\windows\system\QFSZVD.exe KKGYIO.exe File created C:\windows\JQXKG.exe BCLEW.exe File created C:\windows\system\ADHS.exe LIYGTC.exe File created C:\windows\OKNFXS.exe YPDA.exe File opened for modification C:\windows\system\YKC.exe IUBKUW.exe File created C:\windows\QGWHDB.exe CDO.exe File created C:\windows\BEEECH.exe.bat XOXW.exe File opened for modification C:\windows\system\CBNM.exe ADHS.exe File created C:\windows\NTCC.exe.bat NNCO.exe File created C:\windows\system\ORHXD.exe.bat QGWHDB.exe File created C:\windows\system\QFSZVD.exe.bat KKGYIO.exe File created C:\windows\GVTR.exe QFSZVD.exe File created C:\windows\UKJOCNH.exe XUWWN.exe File created C:\windows\QGWHDB.exe.bat CDO.exe File created C:\windows\EHI.exe.bat ORHXD.exe File opened for modification C:\windows\XHQABD.exe EHI.exe File opened for modification C:\windows\system\BCLEW.exe FXSON.exe File created C:\windows\system\RPVRQ.exe.bat UWTPMI.exe File opened for modification C:\windows\WDR.exe BABAH.exe File created C:\windows\system\QRZJZ.exe.bat DGJKL.exe File created C:\windows\system\CDO.exe KAKN.exe File opened for modification C:\windows\system\OGVUAAV.exe WDR.exe File created C:\windows\system\OGVUAAV.exe.bat WDR.exe File created C:\windows\IQGG.exe.bat VSYVX.exe File created C:\windows\BIVQZ.exe OKNFXS.exe File opened for modification C:\windows\GWGYYV.exe NTCC.exe File created C:\windows\system\GLLMZ.exe CVF.exe File created C:\windows\system\BCLEW.exe.bat FXSON.exe File created C:\windows\TRGYSI.exe.bat SWCUM.exe File opened for modification C:\windows\DGJKL.exe ZDLXLAW.exe File created C:\windows\system\ZJTLRB.exe.bat IJRGO.exe File created C:\windows\UWTPMI.exe.bat BEEECH.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 6012 cmd.exe 4540 cmd.exe 2180 cmd.exe 4820 cmd.exe 2464 cmd.exe 1488 cmd.exe 1788 cmd.exe 4684 cmd.exe 1028 cmd.exe 5416 cmd.exe 2368 cmd.exe 3452 cmd.exe 4652 cmd.exe 5860 cmd.exe 4272 cmd.exe 3128 cmd.exe 4168 cmd.exe 2352 cmd.exe 5880 cmd.exe 2372 cmd.exe 4212 cmd.exe 1048 cmd.exe 4892 cmd.exe 4916 cmd.exe 5688 cmd.exe 3656 cmd.exe 4596 cmd.exe 1856 cmd.exe 1648 cmd.exe 2688 cmd.exe 2920 cmd.exe 3716 cmd.exe 3280 cmd.exe 2768 cmd.exe 1988 cmd.exe 4184 cmd.exe 5996 cmd.exe 3408 cmd.exe 756 cmd.exe 5596 cmd.exe 2964 cmd.exe 2848 cmd.exe 3372 cmd.exe 4884 cmd.exe 4608 cmd.exe 3432 cmd.exe 2404 cmd.exe 1148 cmd.exe 4268 cmd.exe 1660 cmd.exe 1504 cmd.exe 4700 cmd.exe 2000 cmd.exe 5568 cmd.exe 5800 cmd.exe 3488 cmd.exe 4576 cmd.exe 1180 cmd.exe 4980 cmd.exe 4464 cmd.exe 3000 cmd.exe 4432 cmd.exe 2876 cmd.exe 4804 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 4904 4372 WerFault.exe 87 2672 2896 WerFault.exe 92 6024 908 WerFault.exe 99 4408 4832 WerFault.exe 104 5276 3212 WerFault.exe 109 5136 2804 WerFault.exe 114 5156 1608 WerFault.exe 119 4328 2852 WerFault.exe 124 3948 2808 WerFault.exe 129 952 1288 WerFault.exe 134 3220 5056 WerFault.exe 139 2132 3024 WerFault.exe 144 5128 3940 WerFault.exe 149 940 604 WerFault.exe 154 5024 5744 WerFault.exe 159 3336 4724 WerFault.exe 164 3040 1436 WerFault.exe 169 6080 2760 WerFault.exe 174 2956 4952 WerFault.exe 179 5008 6052 WerFault.exe 184 5820 2376 WerFault.exe 189 4676 2216 WerFault.exe 194 4996 4348 WerFault.exe 199 1292 5812 WerFault.exe 204 1348 6024 WerFault.exe 209 2900 1832 WerFault.exe 214 1128 2420 WerFault.exe 219 1796 4304 WerFault.exe 224 5684 2916 WerFault.exe 229 5392 264 WerFault.exe 234 3264 3412 WerFault.exe 239 5704 2100 WerFault.exe 244 6128 5940 WerFault.exe 249 4616 3884 WerFault.exe 254 3436 2120 WerFault.exe 259 5060 2904 WerFault.exe 264 2600 428 WerFault.exe 270 4888 912 WerFault.exe 275 2860 2408 WerFault.exe 280 6008 260 WerFault.exe 285 4448 2520 WerFault.exe 290 5724 3232 WerFault.exe 295 6128 704 WerFault.exe 300 200 5384 WerFault.exe 305 5052 2872 WerFault.exe 310 5276 5768 WerFault.exe 315 5460 2656 WerFault.exe 320 6020 4564 WerFault.exe 325 1200 3356 WerFault.exe 330 4076 6080 WerFault.exe 335 2744 5764 WerFault.exe 340 5724 1708 WerFault.exe 345 5704 6016 WerFault.exe 350 3804 2924 WerFault.exe 355 2940 4208 WerFault.exe 360 4556 1580 WerFault.exe 365 1356 5952 WerFault.exe 370 4328 4976 WerFault.exe 375 680 3812 WerFault.exe 380 5676 4680 WerFault.exe 385 1792 4280 WerFault.exe 390 2612 5724 WerFault.exe 395 1172 2056 WerFault.exe 400 6048 3476 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YKC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XOXW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CDO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QGWHDB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QFSZVD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BIVQZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BXVOFA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HFA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KIYJDKQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language COXA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PMOTT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LUDZJGN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JQXKG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WDNSCXT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XUWWN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EHI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OKNFXS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZJTLRB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KKGYIO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YPDA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LGBL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XOAVBM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UKJOCNH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BEEECH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UWTPMI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MJHZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GWGYYV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CVF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LIYGTC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CBNM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IUBKUW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NTCC.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4372 2026-08-15_72e04b1bd1282055e637101cb081dc92_elex_emotet_stop.exe 4372 2026-08-15_72e04b1bd1282055e637101cb081dc92_elex_emotet_stop.exe 2896 COXA.exe 2896 COXA.exe 908 XUWWN.exe 908 XUWWN.exe 4832 UKJOCNH.exe 4832 UKJOCNH.exe 3212 KAKN.exe 3212 KAKN.exe 2804 CDO.exe 2804 CDO.exe 1608 QGWHDB.exe 1608 QGWHDB.exe 2852 ORHXD.exe 2852 ORHXD.exe 2808 EHI.exe 2808 EHI.exe 1288 XHQABD.exe 1288 XHQABD.exe 5056 KKGYIO.exe 5056 KKGYIO.exe 3024 QFSZVD.exe 3024 QFSZVD.exe 3940 GVTR.exe 3940 GVTR.exe 604 GYXUIO.exe 604 GYXUIO.exe 5744 PMOTT.exe 5744 PMOTT.exe 4724 PHR.exe 4724 PHR.exe 1436 FXSON.exe 1436 FXSON.exe 2760 BCLEW.exe 2760 BCLEW.exe 4952 JQXKG.exe 4952 JQXKG.exe 6052 XOXW.exe 6052 XOXW.exe 2376 BEEECH.exe 2376 BEEECH.exe 2216 UWTPMI.exe 2216 UWTPMI.exe 4348 RPVRQ.exe 4348 RPVRQ.exe 5812 GFW.exe 5812 GFW.exe 6024 BABAH.exe 6024 BABAH.exe 1832 WDR.exe 1832 WDR.exe 2420 OGVUAAV.exe 2420 OGVUAAV.exe 4304 SWCUM.exe 4304 SWCUM.exe 2916 TRGYSI.exe 2916 TRGYSI.exe 264 XHMY.exe 264 XHMY.exe 3412 HFA.exe 3412 HFA.exe 2100 LIYGTC.exe 2100 LIYGTC.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4372 2026-08-15_72e04b1bd1282055e637101cb081dc92_elex_emotet_stop.exe 4372 2026-08-15_72e04b1bd1282055e637101cb081dc92_elex_emotet_stop.exe 2896 COXA.exe 2896 COXA.exe 908 XUWWN.exe 908 XUWWN.exe 4832 UKJOCNH.exe 4832 UKJOCNH.exe 3212 KAKN.exe 3212 KAKN.exe 2804 CDO.exe 2804 CDO.exe 1608 QGWHDB.exe 1608 QGWHDB.exe 2852 ORHXD.exe 2852 ORHXD.exe 2808 EHI.exe 2808 EHI.exe 1288 XHQABD.exe 1288 XHQABD.exe 5056 KKGYIO.exe 5056 KKGYIO.exe 3024 QFSZVD.exe 3024 QFSZVD.exe 3940 GVTR.exe 3940 GVTR.exe 604 GYXUIO.exe 604 GYXUIO.exe 5744 PMOTT.exe 5744 PMOTT.exe 4724 PHR.exe 4724 PHR.exe 1436 FXSON.exe 1436 FXSON.exe 2760 BCLEW.exe 2760 BCLEW.exe 4952 JQXKG.exe 4952 JQXKG.exe 6052 XOXW.exe 6052 XOXW.exe 2376 BEEECH.exe 2376 BEEECH.exe 2216 UWTPMI.exe 2216 UWTPMI.exe 4348 RPVRQ.exe 4348 RPVRQ.exe 5812 GFW.exe 5812 GFW.exe 6024 BABAH.exe 6024 BABAH.exe 1832 WDR.exe 1832 WDR.exe 2420 OGVUAAV.exe 2420 OGVUAAV.exe 4304 SWCUM.exe 4304 SWCUM.exe 2916 TRGYSI.exe 2916 TRGYSI.exe 264 XHMY.exe 264 XHMY.exe 3412 HFA.exe 3412 HFA.exe 2100 LIYGTC.exe 2100 LIYGTC.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4372 wrote to memory of 3128 4372 2026-08-15_72e04b1bd1282055e637101cb081dc92_elex_emotet_stop.exe 89 PID 3128 wrote to memory of 2896 3128 cmd.exe 92 PID 2896 wrote to memory of 1180 2896 COXA.exe 95 PID 1180 wrote to memory of 908 1180 cmd.exe 99 PID 908 wrote to memory of 5996 908 XUWWN.exe 100 PID 5996 wrote to memory of 4832 5996 cmd.exe 104 PID 4832 wrote to memory of 6012 4832 UKJOCNH.exe 105 PID 6012 wrote to memory of 3212 6012 cmd.exe 109 PID 3212 wrote to memory of 1648 3212 KAKN.exe 110 PID 1648 wrote to memory of 2804 1648 cmd.exe 114 PID 2804 wrote to memory of 4168 2804 CDO.exe 115 PID 4168 wrote to memory of 1608 4168 cmd.exe 119 PID 1608 wrote to memory of 5688 1608 QGWHDB.exe 120 PID 5688 wrote to memory of 2852 5688 cmd.exe 124 PID 2852 wrote to memory of 4540 2852 ORHXD.exe 125 PID 4540 wrote to memory of 2808 4540 cmd.exe 129 PID 2808 wrote to memory of 3452 2808 EHI.exe 130 PID 3452 wrote to memory of 1288 3452 cmd.exe 134 PID 1288 wrote to memory of 4652 1288 XHQABD.exe 135 PID 4652 wrote to memory of 5056 4652 cmd.exe 139 PID 5056 wrote to memory of 2688 5056 KKGYIO.exe 140 PID 2688 wrote to memory of 3024 2688 cmd.exe 144 PID 3024 wrote to memory of 2352 3024 QFSZVD.exe 145 PID 2352 wrote to memory of 3940 2352 cmd.exe 149 PID 3940 wrote to memory of 4980 3940 GVTR.exe 150 PID 4980 wrote to memory of 604 4980 cmd.exe 154 PID 604 wrote to memory of 4684 604 GYXUIO.exe 155 PID 4684 wrote to memory of 5744 4684 cmd.exe 159 PID 5744 wrote to memory of 3656 5744 PMOTT.exe 160 PID 3656 wrote to memory of 4724 3656 cmd.exe 164 PID 4724 wrote to memory of 2920 4724 PHR.exe 165 PID 2920 wrote to memory of 1436 2920 cmd.exe 169 PID 1436 wrote to memory of 3000 1436 FXSON.exe 170 PID 3000 wrote to memory of 2760 3000 cmd.exe 174 PID 2760 wrote to memory of 1148 2760 BCLEW.exe 175 PID 1148 wrote to memory of 4952 1148 cmd.exe 179 PID 4952 wrote to memory of 3408 4952 JQXKG.exe 180 PID 3408 wrote to memory of 6052 3408 cmd.exe 184 PID 6052 wrote to memory of 756 6052 XOXW.exe 185 PID 756 wrote to memory of 2376 756 cmd.exe 189 PID 2376 wrote to memory of 3716 2376 BEEECH.exe 190 PID 3716 wrote to memory of 2216 3716 cmd.exe 194 PID 2216 wrote to memory of 4432 2216 UWTPMI.exe 195 PID 4432 wrote to memory of 4348 4432 cmd.exe 199 PID 4348 wrote to memory of 3432 4348 RPVRQ.exe 200 PID 3432 wrote to memory of 5812 3432 cmd.exe 204 PID 5812 wrote to memory of 4972 5812 GFW.exe 205 PID 4972 wrote to memory of 6024 4972 cmd.exe 209 PID 6024 wrote to memory of 2180 6024 BABAH.exe 210 PID 2180 wrote to memory of 1832 2180 cmd.exe 214 PID 1832 wrote to memory of 2000 1832 WDR.exe 215 PID 2000 wrote to memory of 2420 2000 cmd.exe 219 PID 2420 wrote to memory of 1028 2420 OGVUAAV.exe 220 PID 1028 wrote to memory of 4304 1028 cmd.exe 224 PID 4304 wrote to memory of 3372 4304 SWCUM.exe 225 PID 3372 wrote to memory of 2916 3372 cmd.exe 229 PID 2916 wrote to memory of 2372 2916 TRGYSI.exe 230 PID 2372 wrote to memory of 264 2372 cmd.exe 234 PID 264 wrote to memory of 4596 264 XHMY.exe 235 PID 4596 wrote to memory of 3412 4596 cmd.exe 239 PID 3412 wrote to memory of 3756 3412 HFA.exe 240 PID 3756 wrote to memory of 2100 3756 cmd.exe 244 PID 2100 wrote to memory of 4212 2100 LIYGTC.exe 245 PID 4212 wrote to memory of 5940 4212 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-15_72e04b1bd1282055e637101cb081dc92_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-15_72e04b1bd1282055e637101cb081dc92_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\COXA.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\windows\SysWOW64\COXA.exeC:\windows\system32\COXA.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XUWWN.exe.bat" "4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\windows\system\XUWWN.exeC:\windows\system\XUWWN.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UKJOCNH.exe.bat" "6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5996 -
C:\windows\UKJOCNH.exeC:\windows\UKJOCNH.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KAKN.exe.bat" "8⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6012 -
C:\windows\KAKN.exeC:\windows\KAKN.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CDO.exe.bat" "10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\windows\system\CDO.exeC:\windows\system\CDO.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QGWHDB.exe.bat" "12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\windows\QGWHDB.exeC:\windows\QGWHDB.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ORHXD.exe.bat" "14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5688 -
C:\windows\system\ORHXD.exeC:\windows\system\ORHXD.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EHI.exe.bat" "16⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\windows\EHI.exeC:\windows\EHI.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XHQABD.exe.bat" "18⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\windows\XHQABD.exeC:\windows\XHQABD.exe19⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KKGYIO.exe.bat" "20⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\windows\system\KKGYIO.exeC:\windows\system\KKGYIO.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QFSZVD.exe.bat" "22⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\windows\system\QFSZVD.exeC:\windows\system\QFSZVD.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GVTR.exe.bat" "24⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\windows\GVTR.exeC:\windows\GVTR.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GYXUIO.exe.bat" "26⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\windows\GYXUIO.exeC:\windows\GYXUIO.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:604 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PMOTT.exe.bat" "28⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\windows\PMOTT.exeC:\windows\PMOTT.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5744 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PHR.exe.bat" "30⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\windows\system\PHR.exeC:\windows\system\PHR.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FXSON.exe.bat" "32⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\windows\FXSON.exeC:\windows\FXSON.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BCLEW.exe.bat" "34⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\windows\system\BCLEW.exeC:\windows\system\BCLEW.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JQXKG.exe.bat" "36⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\windows\JQXKG.exeC:\windows\JQXKG.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XOXW.exe.bat" "38⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\windows\XOXW.exeC:\windows\XOXW.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BEEECH.exe.bat" "40⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:756 -
C:\windows\BEEECH.exeC:\windows\BEEECH.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UWTPMI.exe.bat" "42⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\windows\UWTPMI.exeC:\windows\UWTPMI.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RPVRQ.exe.bat" "44⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\windows\system\RPVRQ.exeC:\windows\system\RPVRQ.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GFW.exe.bat" "46⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\windows\SysWOW64\GFW.exeC:\windows\system32\GFW.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BABAH.exe.bat" "48⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\windows\BABAH.exeC:\windows\BABAH.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6024 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WDR.exe.bat" "50⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\windows\WDR.exeC:\windows\WDR.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OGVUAAV.exe.bat" "52⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\windows\system\OGVUAAV.exeC:\windows\system\OGVUAAV.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SWCUM.exe.bat" "54⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\windows\SysWOW64\SWCUM.exeC:\windows\system32\SWCUM.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TRGYSI.exe.bat" "56⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\windows\TRGYSI.exeC:\windows\TRGYSI.exe57⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XHMY.exe.bat" "58⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\windows\system\XHMY.exeC:\windows\system\XHMY.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HFA.exe.bat" "60⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\windows\SysWOW64\HFA.exeC:\windows\system32\HFA.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LIYGTC.exe.bat" "62⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3756 -
C:\windows\system\LIYGTC.exeC:\windows\system\LIYGTC.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ADHS.exe.bat" "64⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\windows\system\ADHS.exeC:\windows\system\ADHS.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CBNM.exe.bat" "66⤵
- Executes a command shell one-liner
PID:1048 -
C:\windows\system\CBNM.exeC:\windows\system\CBNM.exe67⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DERIZ.exe.bat" "68⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4268 -
C:\windows\system\DERIZ.exeC:\windows\system\DERIZ.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2120 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QCZU.exe.bat" "70⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5860 -
C:\windows\SysWOW64\QCZU.exeC:\windows\system32\QCZU.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YPDA.exe.bat" "72⤵
- Executes a command shell one-liner
PID:5568 -
C:\windows\SysWOW64\YPDA.exeC:\windows\system32\YPDA.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OKNFXS.exe.bat" "74⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3280 -
C:\windows\OKNFXS.exeC:\windows\OKNFXS.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BIVQZ.exe.bat" "76⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4884 -
C:\windows\BIVQZ.exeC:\windows\BIVQZ.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LGBL.exe.bat" "78⤵PID:4748
-
C:\windows\SysWOW64\LGBL.exeC:\windows\system32\LGBL.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WYQ.exe.bat" "80⤵
- Executes a command shell one-liner
PID:4820 -
C:\windows\SysWOW64\WYQ.exeC:\windows\system32\WYQ.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MORVEA.exe.bat" "82⤵
- Executes a command shell one-liner
PID:1660 -
C:\windows\SysWOW64\MORVEA.exeC:\windows\system32\MORVEA.exe83⤵
- Executes dropped EXE
PID:3232 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IUBKUW.exe.bat" "84⤵PID:2796
-
C:\windows\IUBKUW.exeC:\windows\IUBKUW.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YKC.exe.bat" "86⤵
- Executes a command shell one-liner
PID:1504 -
C:\windows\system\YKC.exeC:\windows\system\YKC.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WDNSCXT.exe.bat" "88⤵
- Executes a command shell one-liner
PID:5800 -
C:\windows\WDNSCXT.exeC:\windows\WDNSCXT.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VSYVX.exe.bat" "90⤵
- Executes a command shell one-liner
PID:5880 -
C:\windows\VSYVX.exeC:\windows\VSYVX.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IQGG.exe.bat" "92⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2876 -
C:\windows\IQGG.exeC:\windows\IQGG.exe93⤵
- Executes dropped EXE
PID:2656 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WLKZMC.exe.bat" "94⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4892 -
C:\windows\WLKZMC.exeC:\windows\WLKZMC.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XOAVBM.exe.bat" "96⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4272 -
C:\windows\SysWOW64\XOAVBM.exeC:\windows\system32\XOAVBM.exe97⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3356 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZMOQIU.exe.bat" "98⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4608 -
C:\windows\system\ZMOQIU.exeC:\windows\system\ZMOQIU.exe99⤵
- Executes dropped EXE
PID:6080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JKT.exe.bat" "100⤵
- Executes a command shell one-liner
PID:4700 -
C:\windows\JKT.exeC:\windows\JKT.exe101⤵
- Executes dropped EXE
PID:5764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WQTOAOO.exe.bat" "102⤵
- Executes a command shell one-liner
PID:3488 -
C:\windows\WQTOAOO.exeC:\windows\WQTOAOO.exe103⤵
- Executes dropped EXE
PID:1708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZDLXLAW.exe.bat" "104⤵
- Executes a command shell one-liner
PID:2768 -
C:\windows\system\ZDLXLAW.exeC:\windows\system\ZDLXLAW.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DGJKL.exe.bat" "106⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5416 -
C:\windows\DGJKL.exeC:\windows\DGJKL.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QRZJZ.exe.bat" "108⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2464 -
C:\windows\system\QRZJZ.exeC:\windows\system\QRZJZ.exe109⤵
- Executes dropped EXE
PID:4208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IZBODBD.exe.bat" "110⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5596 -
C:\windows\system\IZBODBD.exeC:\windows\system\IZBODBD.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QFGDNH.exe.bat" "112⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2404 -
C:\windows\SysWOW64\QFGDNH.exeC:\windows\system32\QFGDNH.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BXVOFA.exe.bat" "114⤵
- Executes a command shell one-liner
PID:1488 -
C:\windows\SysWOW64\BXVOFA.exeC:\windows\system32\BXVOFA.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NNCO.exe.bat" "116⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4804 -
C:\windows\SysWOW64\NNCO.exeC:\windows\system32\NNCO.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NTCC.exe.bat" "118⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4916 -
C:\windows\NTCC.exeC:\windows\NTCC.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4680 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GWGYYV.exe.bat" "120⤵
- Executes a command shell one-liner
PID:4464 -
C:\windows\GWGYYV.exeC:\windows\GWGYYV.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4280
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-