Analysis
- max time kernel
83s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/08/2026, 17:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-16_8ba0b1cc044574d298eead58a3c401d3_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-16_8ba0b1cc044574d298eead58a3c401d3_elex_emotet_stop.exe
- Size 208KB
- Sample260816-v2h2qashqa
- SHA256 6aee0d20569cd391103db91668d20056b3a51e0e633a4862349c1ea6d2aa8699
- MD5 8ba0b1cc044574d298eead58a3c401d3
- SHA1 6b9d9470c6b4b6dab6fc3a5effd17033e5474cca
- SHA512 d2001b6a0c427dad4493a676625e596c7933fe1a240a372edf55ec1c377510158d5c1d83c9797eaeb9354d7c6191c24a5a6851213a90ab5e9adcfafe50ce601c
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5Xb1lldL+LOfb4pLthEjQT6j:MlZtbLWIgd1LZ9oECZb1ll5+LOjkEj1
- TLSH T1D1247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5868 DDB.exe 4932 YACLWK.exe 3640 RTKWGL.exe 4944 ZGWLQK.exe 2060 BECXY.exe 3188 SFEKJX.exe 2072 FPUB.exe 4580 PNAV.exe 708 OYD.exe 5048 XYFQ.exe 4608 BOLYDMR.exe 2772 GZE.exe 2716 KPLCH.exe 476 KVDRJS.exe 5340 WDR.exe 5728 HWMK.exe 824 AZQ.exe 1344 EPFNVA.exe 5996 EKJ.exe 1196 IAPRM.exe 4868 HKSH.exe 2116 CYXQXO.exe 4472 CBBML.exe 1796 RWK.exe 1616 MJPI.exe 3108 KEOJD.exe 3520 DXEUU.exe 4684 HNK.exe 4844 CAPL.exe 4060 DDTHWK.exe 4480 GLZPAV.exe 6136 SECAJ.exe 2412 MRHRTKI.exe 3248 YKC.exe 2244 SFHLD.exe 3320 NSMDOR.exe 5028 ZASD.exe 3944 BYG.exe 4552 LWM.exe 2368 FJQBZ.exe 4776 RCTTHH.exe 3508 GSULOVZ.exe 4772 PFFDE.exe 5316 ZDLXLAW.exe 5636 UQPH.exe 1160 JGQ.exe 1776 CJUCI.exe 2672 XULAW.exe 3056 VHKBA.exe 624 HYQ.exe 4604 ABUFSHR.exe 4516 FBCT.exe 6032 PZHNJK.exe 5648 THON.exe 4152 DPQSYZR.exe 4588 IPYGPCS.exe 2832 SQATTZ.exe 4296 JQCYWEX.exe 6020 SDMQM.exe 1960 ITNHTX.exe 2424 SRTCAF.exe 1908 HHCBHSF.exe 5436 CUZL.exe 1680 ASSF.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\HUDX.exe KFP.exe File created C:\windows\SysWOW64\BECXY.exe.bat ZGWLQK.exe File created C:\windows\SysWOW64\IAPRM.exe EKJ.exe File created C:\windows\SysWOW64\HKSH.exe IAPRM.exe File created C:\windows\SysWOW64\DDTHWK.exe.bat CAPL.exe File created C:\windows\SysWOW64\GSULOVZ.exe.bat RCTTHH.exe File created C:\windows\SysWOW64\XULAW.exe CJUCI.exe File created C:\windows\SysWOW64\HHCBHSF.exe SRTCAF.exe File created C:\windows\SysWOW64\HHCBHSF.exe.bat SRTCAF.exe File opened for modification C:\windows\SysWOW64\SFEKJX.exe BECXY.exe File opened for modification C:\windows\SysWOW64\CYXQXO.exe HKSH.exe File created C:\windows\SysWOW64\THON.exe.bat PZHNJK.exe File created C:\windows\SysWOW64\LXDBZL.exe.bat SFOQIS.exe File created C:\windows\SysWOW64\HUDX.exe.bat KFP.exe File opened for modification C:\windows\SysWOW64\SEDZ.exe MJRG.exe File created C:\windows\SysWOW64\OGGPMOD.exe.bat RFXW.exe File created C:\windows\SysWOW64\EKMVD.exe CMGBOZ.exe File created C:\windows\SysWOW64\BECXY.exe ZGWLQK.exe File opened for modification C:\windows\SysWOW64\BECXY.exe ZGWLQK.exe File opened for modification C:\windows\SysWOW64\FPUB.exe SFEKJX.exe File created C:\windows\SysWOW64\SFHLD.exe.bat YKC.exe File opened for modification C:\windows\SysWOW64\HYQ.exe VHKBA.exe File created C:\windows\SysWOW64\EAHXF.exe.bat LXDBZL.exe File created C:\windows\SysWOW64\MJRG.exe.bat NQOQR.exe File created C:\windows\SysWOW64\AJPN.exe.bat SEDZ.exe File created C:\windows\SysWOW64\ZGWLQK.exe.bat RTKWGL.exe File created C:\windows\SysWOW64\FPUB.exe SFEKJX.exe File created C:\windows\SysWOW64\EPFNVA.exe.bat AZQ.exe File opened for modification C:\windows\SysWOW64\IAPRM.exe EKJ.exe File opened for modification C:\windows\SysWOW64\HKSH.exe IAPRM.exe File created C:\windows\SysWOW64\CYXQXO.exe.bat HKSH.exe File opened for modification C:\windows\SysWOW64\RWK.exe CBBML.exe File created C:\windows\SysWOW64\YNROJ.exe ASSF.exe File created C:\windows\SysWOW64\LXDBZL.exe SFOQIS.exe File opened for modification C:\windows\SysWOW64\LXDBZL.exe SFOQIS.exe File opened for modification C:\windows\SysWOW64\HUDX.exe KFP.exe File created C:\windows\SysWOW64\AJPN.exe SEDZ.exe File created C:\windows\SysWOW64\OGGPMOD.exe RFXW.exe File created C:\windows\SysWOW64\VLCBX.exe.bat BTMQGWW.exe File created C:\windows\SysWOW64\UQPH.exe ZDLXLAW.exe File opened for modification C:\windows\SysWOW64\UQPH.exe ZDLXLAW.exe File opened for modification C:\windows\SysWOW64\XULAW.exe CJUCI.exe File created C:\windows\SysWOW64\XULAW.exe.bat CJUCI.exe File opened for modification C:\windows\SysWOW64\HHCBHSF.exe SRTCAF.exe File created C:\windows\SysWOW64\CLKNNPP.exe EAHXF.exe File opened for modification C:\windows\SysWOW64\CLKNNPP.exe EAHXF.exe File created C:\windows\SysWOW64\VLCBX.exe BTMQGWW.exe File created C:\windows\SysWOW64\EPFNVA.exe AZQ.exe File created C:\windows\SysWOW64\OYD.exe PNAV.exe File created C:\windows\SysWOW64\RWK.exe CBBML.exe File created C:\windows\SysWOW64\RWK.exe.bat CBBML.exe File opened for modification C:\windows\SysWOW64\IXMDE.exe GJCB.exe File created C:\windows\SysWOW64\NQOQR.exe.bat HUDX.exe File opened for modification C:\windows\SysWOW64\AJPN.exe SEDZ.exe File created C:\windows\SysWOW64\EKMVD.exe.bat CMGBOZ.exe File created C:\windows\SysWOW64\CJUCI.exe JGQ.exe File opened for modification C:\windows\SysWOW64\CJUCI.exe JGQ.exe File opened for modification C:\windows\SysWOW64\OYD.exe PNAV.exe File opened for modification C:\windows\SysWOW64\KVDRJS.exe KPLCH.exe File created C:\windows\SysWOW64\IAPRM.exe.bat EKJ.exe File created C:\windows\SysWOW64\EAHXF.exe LXDBZL.exe File created C:\windows\SysWOW64\IVERVQL.exe PSB.exe File opened for modification C:\windows\SysWOW64\IVERVQL.exe PSB.exe File created C:\windows\SysWOW64\SFEKJX.exe.bat BECXY.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\UCXY.exe.bat AJPN.exe File created C:\windows\AXIR.exe.bat UCXY.exe File opened for modification C:\windows\system\DXEUU.exe KEOJD.exe File opened for modification C:\windows\system\ZDLXLAW.exe PFFDE.exe File created C:\windows\JGQ.exe.bat UQPH.exe File created C:\windows\system\DPQSYZR.exe THON.exe File created C:\windows\system\CUZL.exe HHCBHSF.exe File created C:\windows\system\XMG.exe DZBSAJ.exe File created C:\windows\system\SFOQIS.exe.bat IXMDE.exe File created C:\windows\MJXHVXQ.exe CLKNNPP.exe File created C:\windows\KPLCH.exe.bat GZE.exe File created C:\windows\system\SDMQM.exe JQCYWEX.exe File created C:\windows\system\SFOQIS.exe IXMDE.exe File created C:\windows\EJEEHOS.exe MJXHVXQ.exe File created C:\windows\AXIR.exe UCXY.exe File created C:\windows\system\CMGBOZ.exe.bat OGGPMOD.exe File opened for modification C:\windows\CAPL.exe HNK.exe File opened for modification C:\windows\SECAJ.exe GLZPAV.exe File created C:\windows\JGQ.exe UQPH.exe File created C:\windows\system\ABUFSHR.exe.bat HYQ.exe File opened for modification C:\windows\system\FBYREZN.exe XNMCTAS.exe File opened for modification C:\windows\system\BTMQGWW.exe SSKL.exe File created C:\windows\XJHWF.exe VLCBX.exe File created C:\windows\system\GLZPAV.exe DDTHWK.exe File created C:\windows\FJQBZ.exe.bat LWM.exe File created C:\windows\system\JQCYWEX.exe SQATTZ.exe File created C:\windows\system\SDMQM.exe.bat JQCYWEX.exe File opened for modification C:\windows\system\CUZL.exe HHCBHSF.exe File opened for modification C:\windows\system\SFOQIS.exe IXMDE.exe File created C:\windows\system\YACLWK.exe.bat DDB.exe File opened for modification C:\windows\system\BOLYDMR.exe XYFQ.exe File created C:\windows\GZE.exe.bat FWAY.exe File created C:\windows\ZASD.exe.bat NSMDOR.exe File opened for modification C:\windows\LWM.exe BYG.exe File created C:\windows\system\PFFDE.exe GSULOVZ.exe File created C:\windows\UCXY.exe AJPN.exe File opened for modification C:\windows\CBBML.exe CYXQXO.exe File created C:\windows\MJPI.exe.bat RWK.exe File opened for modification C:\windows\system\KEOJD.exe MJPI.exe File created C:\windows\system\MRHRTKI.exe.bat SECAJ.exe File opened for modification C:\windows\WXJRLPA.exe XMG.exe File created C:\windows\XNMCTAS.exe ZXAH.exe File created C:\windows\system\GWC.exe.bat FBYREZN.exe File opened for modification C:\windows\MJPI.exe RWK.exe File created C:\windows\CAPL.exe HNK.exe File opened for modification C:\windows\JGQ.exe UQPH.exe File opened for modification C:\windows\SSKL.exe IVERVQL.exe File created C:\windows\system\VCKM.exe.bat XJHWF.exe File opened for modification C:\windows\XYFQ.exe OYD.exe File created C:\windows\ZASD.exe NSMDOR.exe File opened for modification C:\windows\DZBSAJ.exe TQZ.exe File opened for modification C:\windows\XJHWF.exe VLCBX.exe File created C:\windows\system\DDB.exe.bat 2026-08-16_8ba0b1cc044574d298eead58a3c401d3_elex_emotet_stop.exe File opened for modification C:\windows\PZHNJK.exe FBCT.exe File opened for modification C:\windows\system\SDMQM.exe JQCYWEX.exe File created C:\windows\TQZ.exe YNROJ.exe File opened for modification C:\windows\system\GJCB.exe GWC.exe File opened for modification C:\windows\KPLCH.exe GZE.exe File created C:\windows\system\HNK.exe DXEUU.exe File created C:\windows\system\HNK.exe.bat DXEUU.exe File opened for modification C:\windows\system\NSMDOR.exe SFHLD.exe File opened for modification C:\windows\ZASD.exe NSMDOR.exe File created C:\windows\system\CUZL.exe.bat HHCBHSF.exe File created C:\windows\system\GJCB.exe GWC.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5944 cmd.exe 900 cmd.exe 5076 cmd.exe 4244 cmd.exe 4980 cmd.exe 1120 cmd.exe 856 cmd.exe 2648 cmd.exe 5672 cmd.exe 5012 cmd.exe 5176 cmd.exe 1732 cmd.exe 4576 cmd.exe 5680 cmd.exe 5980 cmd.exe 1900 cmd.exe 5208 cmd.exe 976 cmd.exe 3608 cmd.exe 1700 cmd.exe 4344 cmd.exe 2612 cmd.exe 5984 cmd.exe 4880 cmd.exe 1124 cmd.exe 200 cmd.exe 5936 cmd.exe 2708 cmd.exe 3316 cmd.exe 4156 cmd.exe 2076 cmd.exe 1308 cmd.exe 4088 cmd.exe 52 cmd.exe 4564 cmd.exe 2436 cmd.exe 4264 cmd.exe 5504 cmd.exe 5884 cmd.exe 260 cmd.exe 6116 cmd.exe 4204 cmd.exe 1020 cmd.exe 5664 cmd.exe 4364 cmd.exe 2252 cmd.exe 4644 cmd.exe 4780 cmd.exe 6092 cmd.exe 5952 cmd.exe 1292 cmd.exe 3264 cmd.exe 2680 cmd.exe 5916 cmd.exe 3872 cmd.exe 1224 cmd.exe 2948 cmd.exe 1204 cmd.exe 3948 cmd.exe 5628 cmd.exe 4640 cmd.exe 1232 cmd.exe 5464 cmd.exe 2848 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 2744 3680 WerFault.exe 87 5168 5868 WerFault.exe 93 3900 4932 WerFault.exe 99 4248 3640 WerFault.exe 104 3212 4944 WerFault.exe 109 4064 2060 WerFault.exe 114 5644 3188 WerFault.exe 119 5156 2072 WerFault.exe 124 2372 4580 WerFault.exe 129 5456 708 WerFault.exe 134 6080 5048 WerFault.exe 139 6132 4608 WerFault.exe 144 4936 4700 WerFault.exe 149 3300 2772 WerFault.exe 154 3600 2716 WerFault.exe 159 4644 476 WerFault.exe 164 2872 5340 WerFault.exe 169 5484 5728 WerFault.exe 174 4204 824 WerFault.exe 179 4424 1344 WerFault.exe 184 5068 5996 WerFault.exe 189 2336 1196 WerFault.exe 194 5948 4868 WerFault.exe 199 4108 2116 WerFault.exe 204 4588 4472 WerFault.exe 209 5264 1796 WerFault.exe 214 4116 1616 WerFault.exe 219 5644 3108 WerFault.exe 224 4104 3520 WerFault.exe 229 5256 4684 WerFault.exe 234 2980 4844 WerFault.exe 239 2620 4060 WerFault.exe 244 2744 4480 WerFault.exe 249 3232 6136 WerFault.exe 254 1980 2412 WerFault.exe 259 1432 3248 WerFault.exe 264 1936 2244 WerFault.exe 269 5464 3320 WerFault.exe 274 5676 5028 WerFault.exe 280 3056 3944 WerFault.exe 285 3224 4552 WerFault.exe 290 3736 2368 WerFault.exe 295 2868 4776 WerFault.exe 300 6132 3508 WerFault.exe 305 1528 4772 WerFault.exe 310 4920 5316 WerFault.exe 315 3592 5636 WerFault.exe 320 4136 1160 WerFault.exe 325 5608 1776 WerFault.exe 330 5828 2672 WerFault.exe 335 2636 3056 WerFault.exe 340 5352 624 WerFault.exe 345 5852 4604 WerFault.exe 350 2776 4516 WerFault.exe 355 4564 6032 WerFault.exe 360 5876 5648 WerFault.exe 365 1936 4152 WerFault.exe 370 4856 4588 WerFault.exe 375 3872 2832 WerFault.exe 380 4908 4296 WerFault.exe 385 4952 6020 WerFault.exe 390 5280 1960 WerFault.exe 395 5600 2424 WerFault.exe 400 4248 1908 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XNMCTAS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NQOQR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMGBOZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZGWLQK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SFHLD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NSMDOR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KFP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SEDZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IAPRM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CUZL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SFOQIS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GLZPAV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SQATTZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ITNHTX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HWMK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JQCYWEX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SECAJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBYREZN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BTMQGWW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XJHWF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OYD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SDMQM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SSKL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PNAV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WDR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RWK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBCT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DPQSYZR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DZBSAJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EKWYWVV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EKMVD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KVDRJS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CAPL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ASSF.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3680 2026-08-16_8ba0b1cc044574d298eead58a3c401d3_elex_emotet_stop.exe 3680 2026-08-16_8ba0b1cc044574d298eead58a3c401d3_elex_emotet_stop.exe 5868 DDB.exe 5868 DDB.exe 4932 YACLWK.exe 4932 YACLWK.exe 3640 RTKWGL.exe 3640 RTKWGL.exe 4944 ZGWLQK.exe 4944 ZGWLQK.exe 2060 BECXY.exe 2060 BECXY.exe 3188 SFEKJX.exe 3188 SFEKJX.exe 2072 FPUB.exe 2072 FPUB.exe 4580 PNAV.exe 4580 PNAV.exe 708 OYD.exe 708 OYD.exe 5048 XYFQ.exe 5048 XYFQ.exe 4700 FWAY.exe 4700 FWAY.exe 2772 GZE.exe 2772 GZE.exe 2716 KPLCH.exe 2716 KPLCH.exe 476 KVDRJS.exe 476 KVDRJS.exe 5340 WDR.exe 5340 WDR.exe 5728 HWMK.exe 5728 HWMK.exe 824 AZQ.exe 824 AZQ.exe 1344 EPFNVA.exe 1344 EPFNVA.exe 5996 EKJ.exe 5996 EKJ.exe 1196 IAPRM.exe 1196 IAPRM.exe 4868 HKSH.exe 4868 HKSH.exe 2116 CYXQXO.exe 2116 CYXQXO.exe 4472 CBBML.exe 4472 CBBML.exe 1796 RWK.exe 1796 RWK.exe 1616 MJPI.exe 1616 MJPI.exe 3108 KEOJD.exe 3108 KEOJD.exe 3520 DXEUU.exe 3520 DXEUU.exe 4684 HNK.exe 4684 HNK.exe 4844 CAPL.exe 4844 CAPL.exe 4060 DDTHWK.exe 4060 DDTHWK.exe 4480 GLZPAV.exe 4480 GLZPAV.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 3680 2026-08-16_8ba0b1cc044574d298eead58a3c401d3_elex_emotet_stop.exe 3680 2026-08-16_8ba0b1cc044574d298eead58a3c401d3_elex_emotet_stop.exe 5868 DDB.exe 5868 DDB.exe 4932 YACLWK.exe 4932 YACLWK.exe 3640 RTKWGL.exe 3640 RTKWGL.exe 4944 ZGWLQK.exe 4944 ZGWLQK.exe 2060 BECXY.exe 2060 BECXY.exe 3188 SFEKJX.exe 3188 SFEKJX.exe 2072 FPUB.exe 2072 FPUB.exe 4580 PNAV.exe 4580 PNAV.exe 708 OYD.exe 708 OYD.exe 5048 XYFQ.exe 5048 XYFQ.exe 4700 FWAY.exe 4700 FWAY.exe 2772 GZE.exe 2772 GZE.exe 2716 KPLCH.exe 2716 KPLCH.exe 476 KVDRJS.exe 476 KVDRJS.exe 5340 WDR.exe 5340 WDR.exe 5728 HWMK.exe 5728 HWMK.exe 824 AZQ.exe 824 AZQ.exe 1344 EPFNVA.exe 1344 EPFNVA.exe 5996 EKJ.exe 5996 EKJ.exe 1196 IAPRM.exe 1196 IAPRM.exe 4868 HKSH.exe 4868 HKSH.exe 2116 CYXQXO.exe 2116 CYXQXO.exe 4472 CBBML.exe 4472 CBBML.exe 1796 RWK.exe 1796 RWK.exe 1616 MJPI.exe 1616 MJPI.exe 3108 KEOJD.exe 3108 KEOJD.exe 3520 DXEUU.exe 3520 DXEUU.exe 4684 HNK.exe 4684 HNK.exe 4844 CAPL.exe 4844 CAPL.exe 4060 DDTHWK.exe 4060 DDTHWK.exe 4480 GLZPAV.exe 4480 GLZPAV.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3680 wrote to memory of 1020 3680 2026-08-16_8ba0b1cc044574d298eead58a3c401d3_elex_emotet_stop.exe 89 PID 1020 wrote to memory of 5868 1020 cmd.exe 93 PID 5868 wrote to memory of 916 5868 DDB.exe 95 PID 916 wrote to memory of 4932 916 cmd.exe 99 PID 4932 wrote to memory of 3388 4932 YACLWK.exe 100 PID 3388 wrote to memory of 3640 3388 cmd.exe 104 PID 3640 wrote to memory of 5176 3640 RTKWGL.exe 105 PID 5176 wrote to memory of 4944 5176 cmd.exe 109 PID 4944 wrote to memory of 3968 4944 ZGWLQK.exe 110 PID 3968 wrote to memory of 2060 3968 cmd.exe 114 PID 2060 wrote to memory of 4072 2060 BECXY.exe 115 PID 4072 wrote to memory of 3188 4072 cmd.exe 119 PID 3188 wrote to memory of 5864 3188 SFEKJX.exe 120 PID 5864 wrote to memory of 2072 5864 cmd.exe 124 PID 2072 wrote to memory of 5628 2072 FPUB.exe 125 PID 5628 wrote to memory of 4580 5628 cmd.exe 129 PID 4580 wrote to memory of 5800 4580 PNAV.exe 130 PID 5800 wrote to memory of 708 5800 cmd.exe 134 PID 708 wrote to memory of 5720 708 OYD.exe 135 PID 5720 wrote to memory of 5048 5720 cmd.exe 139 PID 5048 wrote to memory of 5624 5048 XYFQ.exe 140 PID 5624 wrote to memory of 4608 5624 cmd.exe 144 PID 4636 wrote to memory of 4700 4636 cmd.exe 149 PID 4700 wrote to memory of 1224 4700 FWAY.exe 150 PID 1224 wrote to memory of 2772 1224 cmd.exe 154 PID 2772 wrote to memory of 1944 2772 GZE.exe 155 PID 1944 wrote to memory of 2716 1944 cmd.exe 159 PID 2716 wrote to memory of 5116 2716 KPLCH.exe 160 PID 5116 wrote to memory of 476 5116 cmd.exe 164 PID 476 wrote to memory of 4880 476 KVDRJS.exe 165 PID 4880 wrote to memory of 5340 4880 cmd.exe 169 PID 5340 wrote to memory of 1732 5340 WDR.exe 170 PID 1732 wrote to memory of 5728 1732 cmd.exe 174 PID 5728 wrote to memory of 1240 5728 HWMK.exe 175 PID 1240 wrote to memory of 824 1240 cmd.exe 179 PID 824 wrote to memory of 2184 824 AZQ.exe 180 PID 2184 wrote to memory of 1344 2184 cmd.exe 184 PID 1344 wrote to memory of 2844 1344 EPFNVA.exe 185 PID 2844 wrote to memory of 5996 2844 cmd.exe 189 PID 5996 wrote to memory of 4704 5996 EKJ.exe 190 PID 4704 wrote to memory of 1196 4704 cmd.exe 194 PID 1196 wrote to memory of 120 1196 IAPRM.exe 195 PID 120 wrote to memory of 4868 120 cmd.exe 199 PID 4868 wrote to memory of 1956 4868 HKSH.exe 200 PID 1956 wrote to memory of 2116 1956 cmd.exe 204 PID 2116 wrote to memory of 2168 2116 CYXQXO.exe 205 PID 2168 wrote to memory of 4472 2168 cmd.exe 209 PID 4472 wrote to memory of 4620 4472 CBBML.exe 210 PID 4620 wrote to memory of 1796 4620 cmd.exe 214 PID 1796 wrote to memory of 5396 1796 RWK.exe 215 PID 5396 wrote to memory of 1616 5396 cmd.exe 219 PID 1616 wrote to memory of 3212 1616 MJPI.exe 220 PID 3212 wrote to memory of 3108 3212 cmd.exe 224 PID 3108 wrote to memory of 1124 3108 KEOJD.exe 225 PID 1124 wrote to memory of 3520 1124 cmd.exe 229 PID 3520 wrote to memory of 3132 3520 DXEUU.exe 230 PID 3132 wrote to memory of 4684 3132 cmd.exe 234 PID 4684 wrote to memory of 2436 4684 HNK.exe 235 PID 2436 wrote to memory of 4844 2436 cmd.exe 239 PID 4844 wrote to memory of 5952 4844 CAPL.exe 240 PID 5952 wrote to memory of 4060 5952 cmd.exe 244 PID 4060 wrote to memory of 4640 4060 DDTHWK.exe 245 PID 4640 wrote to memory of 4480 4640 cmd.exe 249 PID 4480 wrote to memory of 5084 4480 GLZPAV.exe 250
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-16_8ba0b1cc044574d298eead58a3c401d3_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-16_8ba0b1cc044574d298eead58a3c401d3_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DDB.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1020 -
C:\windows\system\DDB.exeC:\windows\system\DDB.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YACLWK.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:916 -
C:\windows\system\YACLWK.exeC:\windows\system\YACLWK.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RTKWGL.exe.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\windows\system\RTKWGL.exeC:\windows\system\RTKWGL.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZGWLQK.exe.bat" "8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5176 -
C:\windows\SysWOW64\ZGWLQK.exeC:\windows\system32\ZGWLQK.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BECXY.exe.bat" "10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\windows\SysWOW64\BECXY.exeC:\windows\system32\BECXY.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SFEKJX.exe.bat" "12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\windows\SysWOW64\SFEKJX.exeC:\windows\system32\SFEKJX.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FPUB.exe.bat" "14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5864 -
C:\windows\SysWOW64\FPUB.exeC:\windows\system32\FPUB.exe15⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PNAV.exe.bat" "16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5628 -
C:\windows\SysWOW64\PNAV.exeC:\windows\system32\PNAV.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OYD.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:5800 -
C:\windows\SysWOW64\OYD.exeC:\windows\system32\OYD.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XYFQ.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:5720 -
C:\windows\XYFQ.exeC:\windows\XYFQ.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BOLYDMR.exe.bat" "22⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5624 -
C:\windows\system\BOLYDMR.exeC:\windows\system\BOLYDMR.exe23⤵
- Executes dropped EXE
PID:4608 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FWAY.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\windows\system\FWAY.exeC:\windows\system\FWAY.exe25⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GZE.exe.bat" "26⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\windows\GZE.exeC:\windows\GZE.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KPLCH.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\windows\KPLCH.exeC:\windows\KPLCH.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KVDRJS.exe.bat" "30⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\windows\SysWOW64\KVDRJS.exeC:\windows\system32\KVDRJS.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WDR.exe.bat" "32⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\windows\WDR.exeC:\windows\WDR.exe33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5340 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HWMK.exe.bat" "34⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\windows\HWMK.exeC:\windows\HWMK.exe35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5728 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AZQ.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\windows\system\AZQ.exeC:\windows\system\AZQ.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EPFNVA.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\windows\SysWOW64\EPFNVA.exeC:\windows\system32\EPFNVA.exe39⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EKJ.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\windows\EKJ.exeC:\windows\EKJ.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IAPRM.exe.bat" "42⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\windows\SysWOW64\IAPRM.exeC:\windows\system32\IAPRM.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HKSH.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:120 -
C:\windows\SysWOW64\HKSH.exeC:\windows\system32\HKSH.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CYXQXO.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\windows\SysWOW64\CYXQXO.exeC:\windows\system32\CYXQXO.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CBBML.exe.bat" "48⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\windows\CBBML.exeC:\windows\CBBML.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RWK.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\windows\SysWOW64\RWK.exeC:\windows\system32\RWK.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MJPI.exe.bat" "52⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5396 -
C:\windows\MJPI.exeC:\windows\MJPI.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KEOJD.exe.bat" "54⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\windows\system\KEOJD.exeC:\windows\system\KEOJD.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DXEUU.exe.bat" "56⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\windows\system\DXEUU.exeC:\windows\system\DXEUU.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HNK.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:3132 -
C:\windows\system\HNK.exeC:\windows\system\HNK.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CAPL.exe.bat" "60⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\windows\CAPL.exeC:\windows\CAPL.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DDTHWK.exe.bat" "62⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5952 -
C:\windows\SysWOW64\DDTHWK.exeC:\windows\system32\DDTHWK.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GLZPAV.exe.bat" "64⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\windows\system\GLZPAV.exeC:\windows\system\GLZPAV.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SECAJ.exe.bat" "66⤵PID:5084
-
C:\windows\SECAJ.exeC:\windows\SECAJ.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6136 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MRHRTKI.exe.bat" "68⤵
- System Location Discovery: System Language Discovery
PID:1640 -
C:\windows\system\MRHRTKI.exeC:\windows\system\MRHRTKI.exe69⤵
- Executes dropped EXE
PID:2412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YKC.exe.bat" "70⤵
- System Location Discovery: System Language Discovery
PID:4732 -
C:\windows\system\YKC.exeC:\windows\system\YKC.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SFHLD.exe.bat" "72⤵
- System Location Discovery: System Language Discovery
PID:3052 -
C:\windows\SysWOW64\SFHLD.exeC:\windows\system32\SFHLD.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NSMDOR.exe.bat" "74⤵
- System Location Discovery: System Language Discovery
PID:1872 -
C:\windows\system\NSMDOR.exeC:\windows\system\NSMDOR.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZASD.exe.bat" "76⤵
- System Location Discovery: System Language Discovery
PID:5520 -
C:\windows\ZASD.exeC:\windows\ZASD.exe77⤵
- Executes dropped EXE
PID:5028 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BYG.exe.bat" "78⤵
- System Location Discovery: System Language Discovery
PID:6012 -
C:\windows\system\BYG.exeC:\windows\system\BYG.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LWM.exe.bat" "80⤵
- Executes a command shell one-liner
PID:4576 -
C:\windows\LWM.exeC:\windows\LWM.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FJQBZ.exe.bat" "82⤵
- Executes a command shell one-liner
PID:1292 -
C:\windows\FJQBZ.exeC:\windows\FJQBZ.exe83⤵
- Executes dropped EXE
PID:2368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RCTTHH.exe.bat" "84⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4156 -
C:\windows\SysWOW64\RCTTHH.exeC:\windows\system32\RCTTHH.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GSULOVZ.exe.bat" "86⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5680 -
C:\windows\SysWOW64\GSULOVZ.exeC:\windows\system32\GSULOVZ.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PFFDE.exe.bat" "88⤵
- Executes a command shell one-liner
PID:3264 -
C:\windows\system\PFFDE.exeC:\windows\system\PFFDE.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4772 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZDLXLAW.exe.bat" "90⤵PID:3428
-
C:\windows\system\ZDLXLAW.exeC:\windows\system\ZDLXLAW.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5316 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UQPH.exe.bat" "92⤵
- Executes a command shell one-liner
PID:976 -
C:\windows\SysWOW64\UQPH.exeC:\windows\system32\UQPH.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5636 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JGQ.exe.bat" "94⤵PID:2996
-
C:\windows\JGQ.exeC:\windows\JGQ.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CJUCI.exe.bat" "96⤵
- System Location Discovery: System Language Discovery
PID:4840 -
C:\windows\SysWOW64\CJUCI.exeC:\windows\system32\CJUCI.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XULAW.exe.bat" "98⤵
- Executes a command shell one-liner
PID:5012 -
C:\windows\SysWOW64\XULAW.exeC:\windows\system32\XULAW.exe99⤵
- Executes dropped EXE
PID:2672 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VHKBA.exe.bat" "100⤵PID:2800
-
C:\windows\VHKBA.exeC:\windows\VHKBA.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3056 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HYQ.exe.bat" "102⤵PID:6080
-
C:\windows\SysWOW64\HYQ.exeC:\windows\system32\HYQ.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ABUFSHR.exe.bat" "104⤵PID:2492
-
C:\windows\system\ABUFSHR.exeC:\windows\system\ABUFSHR.exe105⤵
- Executes dropped EXE
PID:4604 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FBCT.exe.bat" "106⤵
- Executes a command shell one-liner
PID:5664 -
C:\windows\FBCT.exeC:\windows\FBCT.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PZHNJK.exe.bat" "108⤵
- Executes a command shell one-liner
PID:4264 -
C:\windows\PZHNJK.exeC:\windows\PZHNJK.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6032 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\THON.exe.bat" "110⤵
- Executes a command shell one-liner
PID:200 -
C:\windows\SysWOW64\THON.exeC:\windows\system32\THON.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5648 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DPQSYZR.exe.bat" "112⤵PID:6096
-
C:\windows\system\DPQSYZR.exeC:\windows\system\DPQSYZR.exe113⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4152 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IPYGPCS.exe.bat" "114⤵PID:952
-
C:\windows\system\IPYGPCS.exeC:\windows\system\IPYGPCS.exe115⤵
- Executes dropped EXE
PID:4588 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SQATTZ.exe.bat" "116⤵PID:4452
-
C:\windows\SQATTZ.exeC:\windows\SQATTZ.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JQCYWEX.exe.bat" "118⤵
- System Location Discovery: System Language Discovery
PID:5608 -
C:\windows\system\JQCYWEX.exeC:\windows\system\JQCYWEX.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SDMQM.exe.bat" "120⤵
- System Location Discovery: System Language Discovery
PID:4928 -
C:\windows\system\SDMQM.exeC:\windows\system\SDMQM.exe121⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6020
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-