Analysis
- max time kernel
58s - max time network
129s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/08/2026, 07:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-16_71254583bdf19a605285ce5e9e5bfdc5_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-16_71254583bdf19a605285ce5e9e5bfdc5_elex_emotet_stop.exe
- Size 208KB
- Sample260816-jbx76ssend
- SHA256 ababa981ecf3ba9790f6ed36ba33efe5688eac41e7cb307ca294a8b41e55483a
- MD5 71254583bdf19a605285ce5e9e5bfdc5
- SHA1 f1537aa341411da228d82bbcfaf02814c2132285
- SHA512 ffc0a8a73f9457ebf040023e0cd5d6f9f2b3ce251d37cacf3049ff39bbeb2bc6ba6acc125f2780f48e54c089472b072a8bb32d4abee2cf6419f28041e63fa142
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFliKL+LOfw4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFliS+LOokEj1
- TLSH T13A247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4716 QUZWSEY.exe 3360 NYNUC.exe 3380 COAMS.exe 1288 HOCO.exe 3748 CCTYP.exe 1764 MZHK.exe 3940 ZXH.exe 5736 CSYF.exe 5948 IOC.exe 3628 ZOQDKN.exe 1416 EOAGW.exe 2788 VXODI.exe 3452 XUUX.exe 3352 WFXNYW.exe 5876 GDKIGF.exe 1284 DEMKS.exe 4444 AWWMWF.exe 3256 CRNWHYY.exe 4956 KXSDSX.exe 5180 CFGAEO.exe 4368 YGQCQ.exe 1008 SYXNZL.exe 4252 AEKCK.exe 1992 PULTRFY.exe 4212 RSRNYN.exe 1588 KKGYIO.exe 3928 LNK.exe 2508 YLKGXQA.exe 2052 GYXUIO.exe 5452 UJFLWR.exe 3520 AERMCN.exe 2260 OSCFPCH.exe 4896 ZSKQZD.exe 2064 TGRWEE.exe 5532 BLVDPD.exe 1228 STKABU.exe 2632 TWAWQDM.exe 5272 RHLMYJ.exe 2208 BFQGG.exe 3132 IACZM.exe 996 RYIT.exe 3964 YTTM.exe 2760 NJUMOZF.exe 3776 KHMBEC.exe 2516 DULZJEE.exe 4920 OVBKSXM.exe 4364 KYJJG.exe 3204 GYTL.exe 4420 WOUKRZF.exe 6076 YMAFYHO.exe 3408 CSSUP.exe 2256 ANR.exe 4656 KLXPBO.exe 952 LGBL.exe 5068 AJKPZZR.exe 3792 OHSBBK.exe 1424 QEY.exe 4644 HNM.exe 5264 BARKF.exe 4736 RQSB.exe 5380 GLBOFKI.exe 5384 HOFJK.exe 3868 YOTOXY.exe 888 XHWWG.exe - Drops file in System32 directory 51 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\AEKCK.exe SYXNZL.exe File created C:\windows\SysWOW64\BLVDPD.exe TGRWEE.exe File created C:\windows\SysWOW64\BLVDPD.exe.bat TGRWEE.exe File created C:\windows\SysWOW64\CSSUP.exe.bat YMAFYHO.exe File opened for modification C:\windows\SysWOW64\AJKPZZR.exe LGBL.exe File opened for modification C:\windows\SysWOW64\QEY.exe OHSBBK.exe File created C:\windows\SysWOW64\HOFJK.exe GLBOFKI.exe File created C:\windows\SysWOW64\YOTOXY.exe.bat HOFJK.exe File created C:\windows\SysWOW64\ZOQDKN.exe.bat IOC.exe File opened for modification C:\windows\SysWOW64\KXSDSX.exe CRNWHYY.exe File opened for modification C:\windows\SysWOW64\DULZJEE.exe KHMBEC.exe File opened for modification C:\windows\SysWOW64\HOFJK.exe GLBOFKI.exe File created C:\windows\SysWOW64\VXODI.exe EOAGW.exe File created C:\windows\SysWOW64\BFQGG.exe RHLMYJ.exe File created C:\windows\SysWOW64\LGBL.exe.bat KLXPBO.exe File created C:\windows\SysWOW64\AJKPZZR.exe LGBL.exe File opened for modification C:\windows\SysWOW64\IAM.exe XHWWG.exe File created C:\windows\SysWOW64\IAM.exe.bat XHWWG.exe File created C:\windows\SysWOW64\AEKCK.exe SYXNZL.exe File created C:\windows\SysWOW64\ZSKQZD.exe OSCFPCH.exe File created C:\windows\SysWOW64\LGBL.exe KLXPBO.exe File opened for modification C:\windows\SysWOW64\OHSBBK.exe AJKPZZR.exe File created C:\windows\SysWOW64\OHSBBK.exe.bat AJKPZZR.exe File created C:\windows\SysWOW64\YOTOXY.exe HOFJK.exe File created C:\windows\SysWOW64\IAM.exe XHWWG.exe File created C:\windows\SysWOW64\ZOQDKN.exe IOC.exe File created C:\windows\SysWOW64\EOAGW.exe ZOQDKN.exe File opened for modification C:\windows\SysWOW64\EOAGW.exe ZOQDKN.exe File created C:\windows\SysWOW64\KXSDSX.exe CRNWHYY.exe File opened for modification C:\windows\SysWOW64\BLVDPD.exe TGRWEE.exe File created C:\windows\SysWOW64\BFQGG.exe.bat RHLMYJ.exe File created C:\windows\SysWOW64\CSSUP.exe YMAFYHO.exe File opened for modification C:\windows\SysWOW64\CSSUP.exe YMAFYHO.exe File created C:\windows\SysWOW64\AEKCK.exe.bat SYXNZL.exe File created C:\windows\SysWOW64\ZSKQZD.exe.bat OSCFPCH.exe File created C:\windows\SysWOW64\DULZJEE.exe KHMBEC.exe File created C:\windows\SysWOW64\AJKPZZR.exe.bat LGBL.exe File created C:\windows\SysWOW64\OHSBBK.exe AJKPZZR.exe File created C:\windows\SysWOW64\HOFJK.exe.bat GLBOFKI.exe File opened for modification C:\windows\SysWOW64\YOTOXY.exe HOFJK.exe File opened for modification C:\windows\SysWOW64\ZOQDKN.exe IOC.exe File created C:\windows\SysWOW64\EOAGW.exe.bat ZOQDKN.exe File opened for modification C:\windows\SysWOW64\BFQGG.exe RHLMYJ.exe File opened for modification C:\windows\SysWOW64\VXODI.exe EOAGW.exe File created C:\windows\SysWOW64\VXODI.exe.bat EOAGW.exe File created C:\windows\SysWOW64\KXSDSX.exe.bat CRNWHYY.exe File opened for modification C:\windows\SysWOW64\ZSKQZD.exe OSCFPCH.exe File created C:\windows\SysWOW64\DULZJEE.exe.bat KHMBEC.exe File opened for modification C:\windows\SysWOW64\LGBL.exe KLXPBO.exe File created C:\windows\SysWOW64\QEY.exe OHSBBK.exe File created C:\windows\SysWOW64\QEY.exe.bat OHSBBK.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\IACZM.exe.bat BFQGG.exe File created C:\windows\system\KYJJG.exe OVBKSXM.exe File created C:\windows\GYTL.exe KYJJG.exe File created C:\windows\system\YMAFYHO.exe WOUKRZF.exe File created C:\windows\CCTYP.exe.bat HOCO.exe File created C:\windows\system\ZXH.exe.bat MZHK.exe File created C:\windows\CSYF.exe.bat ZXH.exe File created C:\windows\DEMKS.exe GDKIGF.exe File opened for modification C:\windows\WOUKRZF.exe GYTL.exe File created C:\windows\system\ANR.exe CSSUP.exe File opened for modification C:\windows\TGRWEE.exe ZSKQZD.exe File opened for modification C:\windows\system\TWAWQDM.exe STKABU.exe File created C:\windows\system\BARKF.exe.bat HNM.exe File created C:\windows\system\NSOS.exe.bat IAM.exe File created C:\windows\system\NYNUC.exe QUZWSEY.exe File created C:\windows\WFXNYW.exe.bat XUUX.exe File opened for modification C:\windows\system\BARKF.exe HNM.exe File opened for modification C:\windows\system\XUUX.exe VXODI.exe File created C:\windows\YGQCQ.exe.bat CFGAEO.exe File created C:\windows\LNK.exe.bat KKGYIO.exe File created C:\windows\GYXUIO.exe.bat YLKGXQA.exe File created C:\windows\system\RYIT.exe IACZM.exe File opened for modification C:\windows\system\HOCO.exe COAMS.exe File opened for modification C:\windows\YTTM.exe RYIT.exe File opened for modification C:\windows\RIUSFU.exe NSOS.exe File created C:\windows\system\NJUMOZF.exe YTTM.exe File opened for modification C:\windows\GDKIGF.exe WFXNYW.exe File created C:\windows\QUZWSEY.exe.bat 2026-08-16_71254583bdf19a605285ce5e9e5bfdc5_elex_emotet_stop.exe File created C:\windows\system\CRNWHYY.exe.bat AWWMWF.exe File created C:\windows\system\UJFLWR.exe.bat GYXUIO.exe File created C:\windows\system\RHLMYJ.exe.bat TWAWQDM.exe File opened for modification C:\windows\system\KYJJG.exe OVBKSXM.exe File opened for modification C:\windows\RQSB.exe BARKF.exe File created C:\windows\RIUSFU.exe NSOS.exe File opened for modification C:\windows\CSYF.exe ZXH.exe File created C:\windows\system\UJFLWR.exe GYXUIO.exe File created C:\windows\TGRWEE.exe ZSKQZD.exe File created C:\windows\CCTYP.exe HOCO.exe File created C:\windows\system\RHLMYJ.exe TWAWQDM.exe File opened for modification C:\windows\system\NJUMOZF.exe YTTM.exe File opened for modification C:\windows\system\ANR.exe CSSUP.exe File created C:\windows\AWWMWF.exe.bat DEMKS.exe File opened for modification C:\windows\system\YLKGXQA.exe LNK.exe File created C:\windows\XHWWG.exe.bat YOTOXY.exe File created C:\windows\YGQCQ.exe CFGAEO.exe File opened for modification C:\windows\GYXUIO.exe YLKGXQA.exe File created C:\windows\WOUKRZF.exe.bat GYTL.exe File created C:\windows\QUZWSEY.exe 2026-08-16_71254583bdf19a605285ce5e9e5bfdc5_elex_emotet_stop.exe File created C:\windows\system\NYNUC.exe.bat QUZWSEY.exe File created C:\windows\CSYF.exe ZXH.exe File created C:\windows\system\RSRNYN.exe.bat PULTRFY.exe File opened for modification C:\windows\OSCFPCH.exe AERMCN.exe File opened for modification C:\windows\system\KHMBEC.exe NJUMOZF.exe File created C:\windows\system\HNM.exe.bat QEY.exe File created C:\windows\MZHK.exe.bat CCTYP.exe File created C:\windows\system\KYJJG.exe.bat OVBKSXM.exe File opened for modification C:\windows\system\YMAFYHO.exe WOUKRZF.exe File created C:\windows\RQSB.exe.bat BARKF.exe File created C:\windows\GLBOFKI.exe RQSB.exe File opened for modification C:\windows\system\NSOS.exe IAM.exe File opened for modification C:\windows\system\RYIT.exe IACZM.exe File opened for modification C:\windows\MZHK.exe CCTYP.exe File opened for modification C:\windows\YGQCQ.exe CFGAEO.exe File created C:\windows\STKABU.exe.bat BLVDPD.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2636 cmd.exe 2456 cmd.exe 2976 cmd.exe 2840 cmd.exe 2520 cmd.exe 1316 cmd.exe 4544 cmd.exe 2784 cmd.exe 5164 cmd.exe 4360 cmd.exe 4588 cmd.exe 2028 cmd.exe 4708 cmd.exe 5000 cmd.exe 3864 cmd.exe 4912 cmd.exe 4468 cmd.exe 5008 cmd.exe 5188 cmd.exe 1924 cmd.exe 4296 cmd.exe 2948 cmd.exe 5608 cmd.exe 3492 cmd.exe 1372 cmd.exe 5576 cmd.exe 1460 cmd.exe 4884 cmd.exe 6032 cmd.exe 5052 cmd.exe 5760 cmd.exe 4724 cmd.exe 1980 cmd.exe 2024 cmd.exe 3620 cmd.exe 2000 cmd.exe 1564 cmd.exe 5696 cmd.exe 4652 cmd.exe 3336 cmd.exe 5344 cmd.exe 5720 cmd.exe 1636 cmd.exe 4540 cmd.exe 4340 cmd.exe 5212 cmd.exe 5456 cmd.exe 1888 cmd.exe 4280 cmd.exe 2472 cmd.exe 4128 cmd.exe 4152 cmd.exe 4664 cmd.exe 5888 cmd.exe 4692 cmd.exe 5620 cmd.exe 2908 cmd.exe 1392 cmd.exe 5588 cmd.exe 6128 cmd.exe 3524 cmd.exe 3836 cmd.exe 1696 cmd.exe 2712 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 2760 2576 WerFault.exe 87 1824 4716 WerFault.exe 93 4208 3360 WerFault.exe 99 5768 3380 WerFault.exe 104 2008 1288 WerFault.exe 109 804 3748 WerFault.exe 114 5092 1764 WerFault.exe 119 6028 3940 WerFault.exe 124 3040 5736 WerFault.exe 129 5724 5948 WerFault.exe 134 5552 3628 WerFault.exe 139 5936 1416 WerFault.exe 144 1280 2788 WerFault.exe 149 384 3452 WerFault.exe 154 4092 3352 WerFault.exe 159 2392 5876 WerFault.exe 164 3112 1284 WerFault.exe 169 3272 4444 WerFault.exe 174 5744 3256 WerFault.exe 179 1368 4956 WerFault.exe 184 6116 5180 WerFault.exe 189 5016 4368 WerFault.exe 194 1580 1008 WerFault.exe 199 2452 4252 WerFault.exe 204 5992 1992 WerFault.exe 209 6084 4212 WerFault.exe 214 4844 1588 WerFault.exe 219 3624 3928 WerFault.exe 224 5888 2508 WerFault.exe 229 6128 2052 WerFault.exe 234 4284 5452 WerFault.exe 239 1192 3520 WerFault.exe 244 940 2260 WerFault.exe 249 6072 4896 WerFault.exe 255 4348 2064 WerFault.exe 260 3404 5532 WerFault.exe 265 2656 1228 WerFault.exe 270 1464 2632 WerFault.exe 275 3460 5272 WerFault.exe 280 5168 2208 WerFault.exe 285 1324 3132 WerFault.exe 290 4204 996 WerFault.exe 295 5384 3964 WerFault.exe 300 5624 2760 WerFault.exe 305 5580 3776 WerFault.exe 310 4372 2516 WerFault.exe 315 2648 4920 WerFault.exe 320 936 4364 WerFault.exe 325 4696 3204 WerFault.exe 330 1408 4420 WerFault.exe 335 5260 6076 WerFault.exe 340 2608 3408 WerFault.exe 345 2844 2256 WerFault.exe 350 2560 4656 WerFault.exe 355 3184 952 WerFault.exe 360 1576 5068 WerFault.exe 365 5768 3792 WerFault.exe 370 1516 1424 WerFault.exe 375 2732 4644 WerFault.exe 380 3308 5264 WerFault.exe 385 2816 4736 WerFault.exe 390 2940 5380 WerFault.exe 395 3960 5384 WerFault.exe 400 3284 3868 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SYXNZL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NSOS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KKGYIO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GYXUIO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XHWWG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IOC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YTTM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CFGAEO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KYJJG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MZHK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VXODI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PULTRFY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XUUX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CRNWHYY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OSCFPCH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GLBOFKI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language STKABU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-16_71254583bdf19a605285ce5e9e5bfdc5_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZSKQZD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZOQDKN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RHLMYJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HNM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BARKF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IAM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NYNUC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GDKIGF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LNK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DEMKS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GYTL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language COAMS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KXSDSX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RQSB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YGQCQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CSYF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TWAWQDM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CSSUP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2576 2026-08-16_71254583bdf19a605285ce5e9e5bfdc5_elex_emotet_stop.exe 2576 2026-08-16_71254583bdf19a605285ce5e9e5bfdc5_elex_emotet_stop.exe 4716 QUZWSEY.exe 4716 QUZWSEY.exe 3360 NYNUC.exe 3360 NYNUC.exe 3380 COAMS.exe 3380 COAMS.exe 1288 HOCO.exe 1288 HOCO.exe 3748 CCTYP.exe 3748 CCTYP.exe 1764 MZHK.exe 1764 MZHK.exe 3940 ZXH.exe 3940 ZXH.exe 5736 CSYF.exe 5736 CSYF.exe 5948 IOC.exe 5948 IOC.exe 3628 ZOQDKN.exe 3628 ZOQDKN.exe 1416 EOAGW.exe 1416 EOAGW.exe 2788 VXODI.exe 2788 VXODI.exe 3452 XUUX.exe 3452 XUUX.exe 3352 WFXNYW.exe 3352 WFXNYW.exe 5876 GDKIGF.exe 5876 GDKIGF.exe 1284 DEMKS.exe 1284 DEMKS.exe 4444 AWWMWF.exe 4444 AWWMWF.exe 3256 CRNWHYY.exe 3256 CRNWHYY.exe 4956 KXSDSX.exe 4956 KXSDSX.exe 5180 CFGAEO.exe 5180 CFGAEO.exe 4368 YGQCQ.exe 4368 YGQCQ.exe 1008 SYXNZL.exe 1008 SYXNZL.exe 4252 AEKCK.exe 4252 AEKCK.exe 1992 PULTRFY.exe 1992 PULTRFY.exe 4212 RSRNYN.exe 4212 RSRNYN.exe 1588 KKGYIO.exe 1588 KKGYIO.exe 3928 LNK.exe 3928 LNK.exe 2508 YLKGXQA.exe 2508 YLKGXQA.exe 2052 GYXUIO.exe 2052 GYXUIO.exe 5452 UJFLWR.exe 5452 UJFLWR.exe 3520 AERMCN.exe 3520 AERMCN.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2576 2026-08-16_71254583bdf19a605285ce5e9e5bfdc5_elex_emotet_stop.exe 2576 2026-08-16_71254583bdf19a605285ce5e9e5bfdc5_elex_emotet_stop.exe 4716 QUZWSEY.exe 4716 QUZWSEY.exe 3360 NYNUC.exe 3360 NYNUC.exe 3380 COAMS.exe 3380 COAMS.exe 1288 HOCO.exe 1288 HOCO.exe 3748 CCTYP.exe 3748 CCTYP.exe 1764 MZHK.exe 1764 MZHK.exe 3940 ZXH.exe 3940 ZXH.exe 5736 CSYF.exe 5736 CSYF.exe 5948 IOC.exe 5948 IOC.exe 3628 ZOQDKN.exe 3628 ZOQDKN.exe 1416 EOAGW.exe 1416 EOAGW.exe 2788 VXODI.exe 2788 VXODI.exe 3452 XUUX.exe 3452 XUUX.exe 3352 WFXNYW.exe 3352 WFXNYW.exe 5876 GDKIGF.exe 5876 GDKIGF.exe 1284 DEMKS.exe 1284 DEMKS.exe 4444 AWWMWF.exe 4444 AWWMWF.exe 3256 CRNWHYY.exe 3256 CRNWHYY.exe 4956 KXSDSX.exe 4956 KXSDSX.exe 5180 CFGAEO.exe 5180 CFGAEO.exe 4368 YGQCQ.exe 4368 YGQCQ.exe 1008 SYXNZL.exe 1008 SYXNZL.exe 4252 AEKCK.exe 4252 AEKCK.exe 1992 PULTRFY.exe 1992 PULTRFY.exe 4212 RSRNYN.exe 4212 RSRNYN.exe 1588 KKGYIO.exe 1588 KKGYIO.exe 3928 LNK.exe 3928 LNK.exe 2508 YLKGXQA.exe 2508 YLKGXQA.exe 2052 GYXUIO.exe 2052 GYXUIO.exe 5452 UJFLWR.exe 5452 UJFLWR.exe 3520 AERMCN.exe 3520 AERMCN.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2576 wrote to memory of 4280 2576 2026-08-16_71254583bdf19a605285ce5e9e5bfdc5_elex_emotet_stop.exe 89 PID 4280 wrote to memory of 4716 4280 cmd.exe 93 PID 4716 wrote to memory of 5576 4716 QUZWSEY.exe 95 PID 5576 wrote to memory of 3360 5576 cmd.exe 99 PID 3360 wrote to memory of 1204 3360 NYNUC.exe 100 PID 1204 wrote to memory of 3380 1204 cmd.exe 104 PID 3380 wrote to memory of 716 3380 COAMS.exe 105 PID 716 wrote to memory of 1288 716 cmd.exe 109 PID 1288 wrote to memory of 2976 1288 HOCO.exe 110 PID 2976 wrote to memory of 3748 2976 cmd.exe 114 PID 3748 wrote to memory of 2424 3748 CCTYP.exe 115 PID 2424 wrote to memory of 1764 2424 cmd.exe 119 PID 1764 wrote to memory of 1340 1764 MZHK.exe 120 PID 1340 wrote to memory of 3940 1340 cmd.exe 124 PID 3940 wrote to memory of 1460 3940 ZXH.exe 125 PID 1460 wrote to memory of 5736 1460 cmd.exe 129 PID 5736 wrote to memory of 436 5736 CSYF.exe 130 PID 436 wrote to memory of 5948 436 cmd.exe 134 PID 5948 wrote to memory of 2908 5948 IOC.exe 135 PID 2908 wrote to memory of 3628 2908 cmd.exe 139 PID 3628 wrote to memory of 2572 3628 ZOQDKN.exe 140 PID 2572 wrote to memory of 1416 2572 cmd.exe 144 PID 1416 wrote to memory of 5652 1416 EOAGW.exe 145 PID 5652 wrote to memory of 2788 5652 cmd.exe 149 PID 2788 wrote to memory of 4228 2788 VXODI.exe 150 PID 4228 wrote to memory of 3452 4228 cmd.exe 154 PID 3452 wrote to memory of 1104 3452 XUUX.exe 155 PID 1104 wrote to memory of 3352 1104 cmd.exe 159 PID 3352 wrote to memory of 1980 3352 WFXNYW.exe 160 PID 1980 wrote to memory of 5876 1980 cmd.exe 164 PID 5876 wrote to memory of 2472 5876 GDKIGF.exe 165 PID 2472 wrote to memory of 1284 2472 cmd.exe 169 PID 1284 wrote to memory of 4128 1284 DEMKS.exe 170 PID 4128 wrote to memory of 4444 4128 cmd.exe 174 PID 4444 wrote to memory of 2840 4444 AWWMWF.exe 175 PID 2840 wrote to memory of 3256 2840 cmd.exe 179 PID 3256 wrote to memory of 4708 3256 CRNWHYY.exe 180 PID 4708 wrote to memory of 4956 4708 cmd.exe 184 PID 4956 wrote to memory of 1392 4956 KXSDSX.exe 185 PID 1392 wrote to memory of 5180 1392 cmd.exe 189 PID 5180 wrote to memory of 4544 5180 CFGAEO.exe 190 PID 4368 wrote to memory of 5000 4368 YGQCQ.exe 195 PID 5000 wrote to memory of 1008 5000 cmd.exe 199 PID 1008 wrote to memory of 5416 1008 SYXNZL.exe 200 PID 5416 wrote to memory of 4252 5416 cmd.exe 204 PID 4252 wrote to memory of 3224 4252 AEKCK.exe 205 PID 3224 wrote to memory of 1992 3224 cmd.exe 209 PID 1992 wrote to memory of 3608 1992 PULTRFY.exe 210 PID 3608 wrote to memory of 4212 3608 cmd.exe 214 PID 4212 wrote to memory of 3844 4212 RSRNYN.exe 215 PID 3844 wrote to memory of 1588 3844 cmd.exe 219 PID 1588 wrote to memory of 6136 1588 KKGYIO.exe 220 PID 6136 wrote to memory of 3928 6136 cmd.exe 224 PID 3928 wrote to memory of 4796 3928 LNK.exe 225 PID 4796 wrote to memory of 2508 4796 cmd.exe 229 PID 2508 wrote to memory of 4652 2508 YLKGXQA.exe 230 PID 4652 wrote to memory of 2052 4652 cmd.exe 234 PID 2052 wrote to memory of 4512 2052 GYXUIO.exe 235 PID 4512 wrote to memory of 5452 4512 cmd.exe 239 PID 5452 wrote to memory of 2520 5452 UJFLWR.exe 240 PID 2520 wrote to memory of 3520 2520 cmd.exe 244 PID 3520 wrote to memory of 1368 3520 AERMCN.exe 245 PID 1368 wrote to memory of 2260 1368 cmd.exe 249 PID 2260 wrote to memory of 5784 2260 OSCFPCH.exe 251
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-16_71254583bdf19a605285ce5e9e5bfdc5_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-16_71254583bdf19a605285ce5e9e5bfdc5_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QUZWSEY.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\windows\QUZWSEY.exeC:\windows\QUZWSEY.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NYNUC.exe.bat" "4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5576 -
C:\windows\system\NYNUC.exeC:\windows\system\NYNUC.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\COAMS.exe.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\windows\system\COAMS.exeC:\windows\system\COAMS.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HOCO.exe.bat" "8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:716 -
C:\windows\system\HOCO.exeC:\windows\system\HOCO.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CCTYP.exe.bat" "10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\windows\CCTYP.exeC:\windows\CCTYP.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MZHK.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\windows\MZHK.exeC:\windows\MZHK.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZXH.exe.bat" "14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\windows\system\ZXH.exeC:\windows\system\ZXH.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CSYF.exe.bat" "16⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\windows\CSYF.exeC:\windows\CSYF.exe17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IOC.exe.bat" "18⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:436 -
C:\windows\system\IOC.exeC:\windows\system\IOC.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZOQDKN.exe.bat" "20⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\windows\SysWOW64\ZOQDKN.exeC:\windows\system32\ZOQDKN.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EOAGW.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\windows\SysWOW64\EOAGW.exeC:\windows\system32\EOAGW.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VXODI.exe.bat" "24⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5652 -
C:\windows\SysWOW64\VXODI.exeC:\windows\system32\VXODI.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XUUX.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\windows\system\XUUX.exeC:\windows\system\XUUX.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WFXNYW.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\windows\WFXNYW.exeC:\windows\WFXNYW.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GDKIGF.exe.bat" "30⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\windows\GDKIGF.exeC:\windows\GDKIGF.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DEMKS.exe.bat" "32⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\windows\DEMKS.exeC:\windows\DEMKS.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AWWMWF.exe.bat" "34⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\windows\AWWMWF.exeC:\windows\AWWMWF.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CRNWHYY.exe.bat" "36⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\windows\system\CRNWHYY.exeC:\windows\system\CRNWHYY.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KXSDSX.exe.bat" "38⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\windows\SysWOW64\KXSDSX.exeC:\windows\system32\KXSDSX.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CFGAEO.exe.bat" "40⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\windows\CFGAEO.exeC:\windows\CFGAEO.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5180 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YGQCQ.exe.bat" "42⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4544 -
C:\windows\YGQCQ.exeC:\windows\YGQCQ.exe43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SYXNZL.exe.bat" "44⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\windows\SYXNZL.exeC:\windows\SYXNZL.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1008 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AEKCK.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:5416 -
C:\windows\SysWOW64\AEKCK.exeC:\windows\system32\AEKCK.exe47⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PULTRFY.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:3224 -
C:\windows\system\PULTRFY.exeC:\windows\system\PULTRFY.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RSRNYN.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:3608 -
C:\windows\system\RSRNYN.exeC:\windows\system\RSRNYN.exe51⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KKGYIO.exe.bat" "52⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\windows\system\KKGYIO.exeC:\windows\system\KKGYIO.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LNK.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:6136 -
C:\windows\LNK.exeC:\windows\LNK.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YLKGXQA.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\windows\system\YLKGXQA.exeC:\windows\system\YLKGXQA.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GYXUIO.exe.bat" "58⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\windows\GYXUIO.exeC:\windows\GYXUIO.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UJFLWR.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\windows\system\UJFLWR.exeC:\windows\system\UJFLWR.exe61⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AERMCN.exe.bat" "62⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\windows\system\AERMCN.exeC:\windows\system\AERMCN.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OSCFPCH.exe.bat" "64⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\windows\OSCFPCH.exeC:\windows\OSCFPCH.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZSKQZD.exe.bat" "66⤵PID:5784
-
C:\windows\SysWOW64\ZSKQZD.exeC:\windows\system32\ZSKQZD.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4896 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TGRWEE.exe.bat" "68⤵
- System Location Discovery: System Language Discovery
PID:3056 -
C:\windows\TGRWEE.exeC:\windows\TGRWEE.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BLVDPD.exe.bat" "70⤵
- Executes a command shell one-liner
PID:5588 -
C:\windows\SysWOW64\BLVDPD.exeC:\windows\system32\BLVDPD.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\STKABU.exe.bat" "72⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4152 -
C:\windows\STKABU.exeC:\windows\STKABU.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1228 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TWAWQDM.exe.bat" "74⤵PID:2068
-
C:\windows\system\TWAWQDM.exeC:\windows\system\TWAWQDM.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2632 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RHLMYJ.exe.bat" "76⤵
- System Location Discovery: System Language Discovery
PID:4980 -
C:\windows\system\RHLMYJ.exeC:\windows\system\RHLMYJ.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5272 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BFQGG.exe.bat" "78⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5696 -
C:\windows\SysWOW64\BFQGG.exeC:\windows\system32\BFQGG.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IACZM.exe.bat" "80⤵
- System Location Discovery: System Language Discovery
PID:2548 -
C:\windows\system\IACZM.exeC:\windows\system\IACZM.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RYIT.exe.bat" "82⤵PID:4148
-
C:\windows\system\RYIT.exeC:\windows\system\RYIT.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YTTM.exe.bat" "84⤵
- Executes a command shell one-liner
PID:2456 -
C:\windows\YTTM.exeC:\windows\YTTM.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NJUMOZF.exe.bat" "86⤵
- System Location Discovery: System Language Discovery
PID:3196 -
C:\windows\system\NJUMOZF.exeC:\windows\system\NJUMOZF.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KHMBEC.exe.bat" "88⤵PID:3240
-
C:\windows\system\KHMBEC.exeC:\windows\system\KHMBEC.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DULZJEE.exe.bat" "90⤵
- System Location Discovery: System Language Discovery
PID:3392 -
C:\windows\SysWOW64\DULZJEE.exeC:\windows\system32\DULZJEE.exe91⤵
- Executes dropped EXE
PID:2516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OVBKSXM.exe.bat" "92⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4912 -
C:\windows\OVBKSXM.exeC:\windows\OVBKSXM.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KYJJG.exe.bat" "94⤵
- Executes a command shell one-liner
PID:4664 -
C:\windows\system\KYJJG.exeC:\windows\system\KYJJG.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GYTL.exe.bat" "96⤵
- System Location Discovery: System Language Discovery
PID:440 -
C:\windows\GYTL.exeC:\windows\GYTL.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3204 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WOUKRZF.exe.bat" "98⤵
- System Location Discovery: System Language Discovery
PID:3168 -
C:\windows\WOUKRZF.exeC:\windows\WOUKRZF.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YMAFYHO.exe.bat" "100⤵
- System Location Discovery: System Language Discovery
PID:4408 -
C:\windows\system\YMAFYHO.exeC:\windows\system\YMAFYHO.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CSSUP.exe.bat" "102⤵PID:920
-
C:\windows\SysWOW64\CSSUP.exeC:\windows\system32\CSSUP.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ANR.exe.bat" "104⤵PID:6112
-
C:\windows\system\ANR.exeC:\windows\system\ANR.exe105⤵
- Executes dropped EXE
PID:2256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KLXPBO.exe.bat" "106⤵
- System Location Discovery: System Language Discovery
PID:5508 -
C:\windows\KLXPBO.exeC:\windows\KLXPBO.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4656 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LGBL.exe.bat" "108⤵
- Executes a command shell one-liner
PID:4884 -
C:\windows\SysWOW64\LGBL.exeC:\windows\system32\LGBL.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AJKPZZR.exe.bat" "110⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4588 -
C:\windows\SysWOW64\AJKPZZR.exeC:\windows\system32\AJKPZZR.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OHSBBK.exe.bat" "112⤵
- System Location Discovery: System Language Discovery
PID:4580 -
C:\windows\SysWOW64\OHSBBK.exeC:\windows\system32\OHSBBK.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3792 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QEY.exe.bat" "114⤵PID:6056
-
C:\windows\SysWOW64\QEY.exeC:\windows\system32\QEY.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HNM.exe.bat" "116⤵
- Executes a command shell one-liner
PID:6032 -
C:\windows\system\HNM.exeC:\windows\system\HNM.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BARKF.exe.bat" "118⤵
- System Location Discovery: System Language Discovery
PID:1692 -
C:\windows\system\BARKF.exeC:\windows\system\BARKF.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RQSB.exe.bat" "120⤵
- Executes a command shell one-liner
PID:2024 -
C:\windows\RQSB.exeC:\windows\RQSB.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4736
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-