Analysis
- max time kernel
148s - max time network
133s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/08/2026, 17:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-16_a21f3c327e9776862ed06524160cb34e_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-16_a21f3c327e9776862ed06524160cb34e_elex_emotet_stop.exe
- Size 208KB
- Sample260816-vs48laeg52
- SHA256 8a66470215e09db84d6ea311f4538a8269a0856065267291febe6b67d98c41af
- MD5 a21f3c327e9776862ed06524160cb34e
- SHA1 7b190e8da590b506cd00f11171c0f883de3c8a38
- SHA512 578a7a53d9a105f7ccc76b10a967508bce13bc0e24e5f59dbab15afcf66cf62699f1ee92a3432419ee8e266c3578e5d636e955874f007836ade91bba420b8879
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlcKL+LOfn4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFlcS+LO/kEj1
- TLSH T192247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3136 XIQLCI.exe 1692 FHZBSAH.exe 2496 SEZMCL.exe 1696 IUN.exe 4284 SSA.exe 2004 JAH.exe 5244 ABV.exe 2404 IOIZBHA.exe 620 YEJZHD.exe 3804 LPRP.exe 4544 EUYVBHG.exe 3640 SFHMPSC.exe 2856 LYW.exe 4348 PJU.exe 5396 IBCD.exe 2804 ZMNTYTQ.exe 5712 JKSNGBZ.exe 2628 CCIYP.exe 4184 ZDJBBY.exe 4920 FYVCHN.exe 4820 ZRKNYN.exe 2680 OHLE.exe 2128 KMW.exe 2520 FAADX.exe 5860 INFUHE.exe 5664 GIEV.exe 5052 EGQ.exe 5820 IJWLZF.exe 4956 YEFP.exe 3680 NUGPR.exe 5924 CPQ.exe 8 VSUXPQJ.exe 5660 HAAX.exe 4612 HOALD.exe 2188 ZJEPILJ.exe 264 PMOTT.exe 5084 XRAA.exe 6000 VCD.exe 2140 QPIZX.exe 876 BILSFS.exe 4960 MBGLFZV.exe 1524 CEXPY.exe 880 TERUCRX.exe 5336 MHD.exe 5040 BCNCAC.exe 5648 MVIVBJX.exe 3500 QLWVN.exe 1652 AACQ.exe 1708 AOCEE.exe 1828 LHXXEE.exe 4668 CMHPUBA.exe 5620 CZIDV.exe 4632 XNMNGGJ.exe 5904 OAXFVKF.exe 2596 UNWFA.exe 4868 SOETJ.exe 1260 GBD.exe 2264 XCSB.exe 2096 HKUGSLX.exe 3632 RIAA.exe 2008 ZNMH.exe 3200 BLS.exe 2136 GLZPAV.exe 1868 SECAJ.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\GSULOVZ.exe.bat PHWNOAD.exe File created C:\windows\SysWOW64\JAH.exe SSA.exe File created C:\windows\SysWOW64\ZDJBBY.exe CCIYP.exe File created C:\windows\SysWOW64\JTK.exe IQGG.exe File created C:\windows\SysWOW64\WRUEHMC.exe.bat UEQVX.exe File created C:\windows\SysWOW64\DIDEBOK.exe.bat SQATTZ.exe File created C:\windows\SysWOW64\JHWZFGC.exe.bat PTSQV.exe File created C:\windows\SysWOW64\PHWNOAD.exe JHWZFGC.exe File opened for modification C:\windows\SysWOW64\IBCD.exe PJU.exe File created C:\windows\SysWOW64\DIDEBOK.exe SQATTZ.exe File created C:\windows\SysWOW64\EUYVBHG.exe.bat LPRP.exe File opened for modification C:\windows\SysWOW64\INFUHE.exe FAADX.exe File created C:\windows\SysWOW64\GIEV.exe INFUHE.exe File created C:\windows\SysWOW64\PUYINC.exe WRUEHMC.exe File opened for modification C:\windows\SysWOW64\PJU.exe LYW.exe File created C:\windows\SysWOW64\IBCD.exe PJU.exe File created C:\windows\SysWOW64\IBCD.exe.bat PJU.exe File created C:\windows\SysWOW64\INFUHE.exe.bat FAADX.exe File created C:\windows\SysWOW64\NUGPR.exe YEFP.exe File opened for modification C:\windows\SysWOW64\NUGPR.exe YEFP.exe File opened for modification C:\windows\SysWOW64\GBD.exe JWGY.exe File created C:\windows\SysWOW64\PHWNOAD.exe.bat JHWZFGC.exe File opened for modification C:\windows\SysWOW64\GIEV.exe INFUHE.exe File created C:\windows\SysWOW64\STKMGRJ.exe.bat BNZU.exe File created C:\windows\SysWOW64\ABV.exe JAH.exe File created C:\windows\SysWOW64\ZMNTYTQ.exe IBCD.exe File created C:\windows\SysWOW64\GBD.exe JWGY.exe File opened for modification C:\windows\SysWOW64\GSULOVZ.exe PHWNOAD.exe File created C:\windows\SysWOW64\WRUEHMC.exe UEQVX.exe File created C:\windows\SysWOW64\PUYINC.exe.bat WRUEHMC.exe File created C:\windows\SysWOW64\ABV.exe.bat JAH.exe File opened for modification C:\windows\SysWOW64\EUYVBHG.exe LPRP.exe File created C:\windows\SysWOW64\PJU.exe.bat LYW.exe File created C:\windows\SysWOW64\INFUHE.exe FAADX.exe File created C:\windows\SysWOW64\VCD.exe XRAA.exe File created C:\windows\SysWOW64\JIDSXCA.exe PUYINC.exe File created C:\windows\SysWOW64\JIDSXCA.exe.bat PUYINC.exe File created C:\windows\SysWOW64\FHZBSAH.exe XIQLCI.exe File opened for modification C:\windows\SysWOW64\ZDJBBY.exe CCIYP.exe File created C:\windows\SysWOW64\GIEV.exe.bat INFUHE.exe File opened for modification C:\windows\SysWOW64\VCD.exe XRAA.exe File created C:\windows\SysWOW64\GBD.exe.bat JWGY.exe File opened for modification C:\windows\SysWOW64\GSPCCDY.exe CCIU.exe File created C:\windows\SysWOW64\AOBBIQM.exe DIDEBOK.exe File opened for modification C:\windows\SysWOW64\AOBBIQM.exe DIDEBOK.exe File created C:\windows\SysWOW64\FHZBSAH.exe.bat XIQLCI.exe File created C:\windows\SysWOW64\JAH.exe.bat SSA.exe File opened for modification C:\windows\SysWOW64\ABV.exe JAH.exe File created C:\windows\SysWOW64\EUYVBHG.exe LPRP.exe File created C:\windows\SysWOW64\ZMNTYTQ.exe.bat IBCD.exe File opened for modification C:\windows\SysWOW64\PHWNOAD.exe JHWZFGC.exe File created C:\windows\SysWOW64\AOBBIQM.exe.bat DIDEBOK.exe File opened for modification C:\windows\SysWOW64\FHZBSAH.exe XIQLCI.exe File created C:\windows\SysWOW64\NUGPR.exe.bat YEFP.exe File opened for modification C:\windows\SysWOW64\JTK.exe IQGG.exe File created C:\windows\SysWOW64\JTK.exe.bat IQGG.exe File created C:\windows\SysWOW64\GSULOVZ.exe PHWNOAD.exe File opened for modification C:\windows\SysWOW64\PUYINC.exe WRUEHMC.exe File opened for modification C:\windows\SysWOW64\JIDSXCA.exe PUYINC.exe File created C:\windows\SysWOW64\PJU.exe LYW.exe File opened for modification C:\windows\SysWOW64\ZMNTYTQ.exe IBCD.exe File created C:\windows\SysWOW64\ZDJBBY.exe.bat CCIYP.exe File created C:\windows\SysWOW64\VCD.exe.bat XRAA.exe File created C:\windows\SysWOW64\GSPCCDY.exe CCIU.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\YEFP.exe IJWLZF.exe File created C:\windows\UPS.exe.bat PPQV.exe File created C:\windows\system\DQEBGZK.exe.bat SXBIYS.exe File opened for modification C:\windows\QPIZX.exe VCD.exe File created C:\windows\system\POKUV.exe.bat UBF.exe File created C:\windows\YEFP.exe IJWLZF.exe File created C:\windows\system\HOALD.exe.bat HAAX.exe File created C:\windows\BER.exe POKUV.exe File created C:\windows\system\MVIVBJX.exe BCNCAC.exe File opened for modification C:\windows\system\IOIZBHA.exe ABV.exe File created C:\windows\system\YEJZHD.exe.bat IOIZBHA.exe File created C:\windows\JKSNGBZ.exe.bat ZMNTYTQ.exe File created C:\windows\system\PCXZ.exe.bat BER.exe File opened for modification C:\windows\system\OAXFVKF.exe XNMNGGJ.exe File opened for modification C:\windows\system\PTSQV.exe JTK.exe File created C:\windows\LHCVMIW.exe WRBV.exe File created C:\windows\OHLE.exe ZRKNYN.exe File created C:\windows\system\OAXFVKF.exe.bat XNMNGGJ.exe File created C:\windows\system\ZJL.exe STKMGRJ.exe File created C:\windows\system\EGQ.exe.bat GIEV.exe File created C:\windows\XRAA.exe.bat PMOTT.exe File created C:\windows\WDRYAB.exe.bat SNKQNJM.exe File created C:\windows\FYVCHN.exe.bat ZDJBBY.exe File created C:\windows\PMOTT.exe ZJEPILJ.exe File created C:\windows\system\CMHPUBA.exe LHXXEE.exe File created C:\windows\SQATTZ.exe UPS.exe File opened for modification C:\windows\LPRP.exe YEJZHD.exe File opened for modification C:\windows\system\CPQ.exe NUGPR.exe File created C:\windows\HAAX.exe VSUXPQJ.exe File opened for modification C:\windows\CZIDV.exe CMHPUBA.exe File created C:\windows\TERUCRX.exe.bat CEXPY.exe File opened for modification C:\windows\system\LHXXEE.exe AOCEE.exe File created C:\windows\ZNMH.exe.bat RIAA.exe File created C:\windows\system\BLS.exe.bat ZNMH.exe File created C:\windows\CCIU.exe SECAJ.exe File opened for modification C:\windows\system\PPQV.exe LHCVMIW.exe File created C:\windows\system\POKUV.exe UBF.exe File opened for modification C:\windows\AACQ.exe QLWVN.exe File opened for modification C:\windows\system\CMHPUBA.exe LHXXEE.exe File opened for modification C:\windows\TFJEE.exe JIDSXCA.exe File opened for modification C:\windows\HAAX.exe VSUXPQJ.exe File created C:\windows\XNMNGGJ.exe.bat CZIDV.exe File created C:\windows\ZNMH.exe RIAA.exe File opened for modification C:\windows\system\ZJL.exe STKMGRJ.exe File opened for modification C:\windows\QLWVN.exe MVIVBJX.exe File created C:\windows\CCIU.exe.bat SECAJ.exe File created C:\windows\YNAYQT.exe GSPCCDY.exe File opened for modification C:\windows\LHCVMIW.exe WRBV.exe File created C:\windows\UPS.exe PPQV.exe File created C:\windows\system\ZJEPILJ.exe.bat HOALD.exe File created C:\windows\WRBV.exe DOXAA.exe File opened for modification C:\windows\system\POKUV.exe UBF.exe File created C:\windows\system\IUN.exe.bat SEZMCL.exe File opened for modification C:\windows\system\YEJZHD.exe IOIZBHA.exe File created C:\windows\system\HKUGSLX.exe XCSB.exe File opened for modification C:\windows\system\MVIVBJX.exe BCNCAC.exe File created C:\windows\SSA.exe IUN.exe File created C:\windows\IQGG.exe.bat ODBXOOO.exe File created C:\windows\CEXPY.exe.bat MBGLFZV.exe File created C:\windows\LPRP.exe YEJZHD.exe File opened for modification C:\windows\XRAA.exe PMOTT.exe File created C:\windows\TFJEE.exe JIDSXCA.exe File opened for modification C:\windows\BER.exe POKUV.exe File created C:\windows\system\SXBIYS.exe.bat PCXZ.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5056 cmd.exe 2936 cmd.exe 5488 cmd.exe 6096 cmd.exe 1196 cmd.exe 1120 cmd.exe 3648 cmd.exe 1424 cmd.exe 5456 cmd.exe 468 cmd.exe 1136 cmd.exe 4092 cmd.exe 5140 cmd.exe 776 cmd.exe 4808 cmd.exe 4640 cmd.exe 2616 cmd.exe 4764 cmd.exe 3872 cmd.exe 2448 cmd.exe 4504 cmd.exe 3812 cmd.exe 5764 cmd.exe 2480 cmd.exe 2280 cmd.exe 4076 cmd.exe 4800 cmd.exe 1552 cmd.exe 3104 cmd.exe 4624 cmd.exe 5840 cmd.exe 5676 cmd.exe 5284 cmd.exe 4556 cmd.exe 4340 cmd.exe 3504 cmd.exe 3940 cmd.exe 1076 cmd.exe 2932 cmd.exe 124 cmd.exe 888 cmd.exe 252 cmd.exe 4648 cmd.exe 1628 cmd.exe 5788 cmd.exe 2068 cmd.exe 860 cmd.exe 5880 cmd.exe 2844 cmd.exe 2584 cmd.exe 2984 cmd.exe 3408 cmd.exe 4656 cmd.exe 1016 cmd.exe 5804 cmd.exe 3160 cmd.exe 3376 cmd.exe 4880 cmd.exe 6080 cmd.exe 5476 cmd.exe 4380 cmd.exe 5916 cmd.exe 4264 cmd.exe 6112 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 2916 1208 WerFault.exe 87 4552 3136 WerFault.exe 93 2936 1692 WerFault.exe 99 4396 2496 WerFault.exe 104 3816 1696 WerFault.exe 109 4816 4284 WerFault.exe 114 4896 2004 WerFault.exe 119 1516 5244 WerFault.exe 124 5760 2404 WerFault.exe 129 5636 620 WerFault.exe 134 3332 3804 WerFault.exe 139 1848 4544 WerFault.exe 144 5964 3640 WerFault.exe 149 244 2856 WerFault.exe 154 3440 4348 WerFault.exe 159 2772 5396 WerFault.exe 164 2064 2804 WerFault.exe 169 5388 5712 WerFault.exe 174 2040 2628 WerFault.exe 179 5620 4184 WerFault.exe 184 3220 4920 WerFault.exe 189 4240 4820 WerFault.exe 194 2068 2680 WerFault.exe 199 3452 2128 WerFault.exe 204 3692 2520 WerFault.exe 209 1668 5860 WerFault.exe 214 4688 5664 WerFault.exe 219 3816 5052 WerFault.exe 224 2556 5820 WerFault.exe 229 2264 4956 WerFault.exe 234 5500 3680 WerFault.exe 239 3648 5924 WerFault.exe 244 5372 8 WerFault.exe 249 1940 5660 WerFault.exe 254 5632 4612 WerFault.exe 259 4116 2188 WerFault.exe 264 5624 264 WerFault.exe 270 3748 5084 WerFault.exe 275 1076 6000 WerFault.exe 280 2480 2140 WerFault.exe 285 5456 876 WerFault.exe 290 4168 4960 WerFault.exe 295 1996 1524 WerFault.exe 300 4316 880 WerFault.exe 305 1500 5336 WerFault.exe 310 3388 5040 WerFault.exe 315 2400 5648 WerFault.exe 320 860 3500 WerFault.exe 325 3212 1652 WerFault.exe 330 5856 1708 WerFault.exe 335 1012 1828 WerFault.exe 340 3112 4668 WerFault.exe 345 4432 5620 WerFault.exe 350 1544 4632 WerFault.exe 355 3324 5904 WerFault.exe 360 5560 2596 WerFault.exe 365 3884 4868 WerFault.exe 370 3972 3164 WerFault.exe 375 5248 1260 WerFault.exe 380 2760 2264 WerFault.exe 385 2352 2096 WerFault.exe 390 3268 3632 WerFault.exe 395 4640 2008 WerFault.exe 400 4692 3200 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PJU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XNMNGGJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IQGG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JHWZFGC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IUN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EUYVBHG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GSULOVZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PUYINC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language INFUHE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PHWNOAD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IJWLZF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SOETJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZJL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FYVCHN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KMW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ODBXOOO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XIQLCI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YEJZHD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LHXXEE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TFJEE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SQATTZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZMNTYTQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CCIYP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BCNCAC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YNAYQT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IBCD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HKUGSLX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ABV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LHCVMIW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DIDEBOK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WDRYAB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SNKQNJM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1208 2026-08-16_a21f3c327e9776862ed06524160cb34e_elex_emotet_stop.exe 1208 2026-08-16_a21f3c327e9776862ed06524160cb34e_elex_emotet_stop.exe 3136 XIQLCI.exe 3136 XIQLCI.exe 1692 FHZBSAH.exe 1692 FHZBSAH.exe 2496 SEZMCL.exe 2496 SEZMCL.exe 1696 IUN.exe 1696 IUN.exe 4284 SSA.exe 4284 SSA.exe 2004 JAH.exe 2004 JAH.exe 5244 ABV.exe 5244 ABV.exe 2404 IOIZBHA.exe 2404 IOIZBHA.exe 620 YEJZHD.exe 620 YEJZHD.exe 3804 LPRP.exe 3804 LPRP.exe 4544 EUYVBHG.exe 4544 EUYVBHG.exe 3640 SFHMPSC.exe 3640 SFHMPSC.exe 2856 LYW.exe 2856 LYW.exe 4348 PJU.exe 4348 PJU.exe 5396 IBCD.exe 5396 IBCD.exe 2804 ZMNTYTQ.exe 2804 ZMNTYTQ.exe 5712 JKSNGBZ.exe 5712 JKSNGBZ.exe 2628 CCIYP.exe 2628 CCIYP.exe 4184 ZDJBBY.exe 4184 ZDJBBY.exe 4920 FYVCHN.exe 4920 FYVCHN.exe 4820 ZRKNYN.exe 4820 ZRKNYN.exe 2680 OHLE.exe 2680 OHLE.exe 2128 KMW.exe 2128 KMW.exe 2520 FAADX.exe 2520 FAADX.exe 5860 INFUHE.exe 5860 INFUHE.exe 5664 GIEV.exe 5664 GIEV.exe 5052 EGQ.exe 5052 EGQ.exe 5820 IJWLZF.exe 5820 IJWLZF.exe 4956 YEFP.exe 4956 YEFP.exe 3680 NUGPR.exe 3680 NUGPR.exe 5924 CPQ.exe 5924 CPQ.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1208 2026-08-16_a21f3c327e9776862ed06524160cb34e_elex_emotet_stop.exe 1208 2026-08-16_a21f3c327e9776862ed06524160cb34e_elex_emotet_stop.exe 3136 XIQLCI.exe 3136 XIQLCI.exe 1692 FHZBSAH.exe 1692 FHZBSAH.exe 2496 SEZMCL.exe 2496 SEZMCL.exe 1696 IUN.exe 1696 IUN.exe 4284 SSA.exe 4284 SSA.exe 2004 JAH.exe 2004 JAH.exe 5244 ABV.exe 5244 ABV.exe 2404 IOIZBHA.exe 2404 IOIZBHA.exe 620 YEJZHD.exe 620 YEJZHD.exe 3804 LPRP.exe 3804 LPRP.exe 4544 EUYVBHG.exe 4544 EUYVBHG.exe 3640 SFHMPSC.exe 3640 SFHMPSC.exe 2856 LYW.exe 2856 LYW.exe 4348 PJU.exe 4348 PJU.exe 5396 IBCD.exe 5396 IBCD.exe 2804 ZMNTYTQ.exe 2804 ZMNTYTQ.exe 5712 JKSNGBZ.exe 5712 JKSNGBZ.exe 2628 CCIYP.exe 2628 CCIYP.exe 4184 ZDJBBY.exe 4184 ZDJBBY.exe 4920 FYVCHN.exe 4920 FYVCHN.exe 4820 ZRKNYN.exe 4820 ZRKNYN.exe 2680 OHLE.exe 2680 OHLE.exe 2128 KMW.exe 2128 KMW.exe 2520 FAADX.exe 2520 FAADX.exe 5860 INFUHE.exe 5860 INFUHE.exe 5664 GIEV.exe 5664 GIEV.exe 5052 EGQ.exe 5052 EGQ.exe 5820 IJWLZF.exe 5820 IJWLZF.exe 4956 YEFP.exe 4956 YEFP.exe 3680 NUGPR.exe 3680 NUGPR.exe 5924 CPQ.exe 5924 CPQ.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1208 wrote to memory of 4764 1208 2026-08-16_a21f3c327e9776862ed06524160cb34e_elex_emotet_stop.exe 89 PID 4764 wrote to memory of 3136 4764 cmd.exe 93 PID 3136 wrote to memory of 1136 3136 XIQLCI.exe 95 PID 1136 wrote to memory of 1692 1136 cmd.exe 99 PID 1692 wrote to memory of 3976 1692 FHZBSAH.exe 100 PID 3976 wrote to memory of 2496 3976 cmd.exe 104 PID 2496 wrote to memory of 252 2496 SEZMCL.exe 105 PID 252 wrote to memory of 1696 252 cmd.exe 109 PID 1696 wrote to memory of 6096 1696 IUN.exe 110 PID 6096 wrote to memory of 4284 6096 cmd.exe 114 PID 4284 wrote to memory of 3520 4284 SSA.exe 115 PID 3520 wrote to memory of 2004 3520 cmd.exe 119 PID 2004 wrote to memory of 4556 2004 JAH.exe 120 PID 4556 wrote to memory of 5244 4556 cmd.exe 124 PID 5244 wrote to memory of 2844 5244 ABV.exe 125 PID 2844 wrote to memory of 2404 2844 cmd.exe 129 PID 2404 wrote to memory of 432 2404 IOIZBHA.exe 130 PID 432 wrote to memory of 620 432 cmd.exe 134 PID 620 wrote to memory of 3376 620 YEJZHD.exe 135 PID 3376 wrote to memory of 3804 3376 cmd.exe 139 PID 3804 wrote to memory of 4604 3804 LPRP.exe 140 PID 4604 wrote to memory of 4544 4604 cmd.exe 144 PID 4544 wrote to memory of 4664 4544 EUYVBHG.exe 145 PID 4664 wrote to memory of 3640 4664 cmd.exe 149 PID 3640 wrote to memory of 2584 3640 SFHMPSC.exe 150 PID 2584 wrote to memory of 2856 2584 cmd.exe 154 PID 2856 wrote to memory of 1196 2856 LYW.exe 155 PID 1196 wrote to memory of 4348 1196 cmd.exe 159 PID 4348 wrote to memory of 4864 4348 PJU.exe 160 PID 4864 wrote to memory of 5396 4864 cmd.exe 164 PID 5396 wrote to memory of 4276 5396 IBCD.exe 165 PID 4276 wrote to memory of 2804 4276 cmd.exe 169 PID 2804 wrote to memory of 4076 2804 ZMNTYTQ.exe 170 PID 4076 wrote to memory of 5712 4076 cmd.exe 174 PID 5712 wrote to memory of 3292 5712 JKSNGBZ.exe 175 PID 3292 wrote to memory of 2628 3292 cmd.exe 179 PID 2628 wrote to memory of 4092 2628 CCIYP.exe 180 PID 4092 wrote to memory of 4184 4092 cmd.exe 184 PID 4184 wrote to memory of 3872 4184 ZDJBBY.exe 185 PID 3872 wrote to memory of 4920 3872 cmd.exe 189 PID 4920 wrote to memory of 2984 4920 FYVCHN.exe 190 PID 2984 wrote to memory of 4820 2984 cmd.exe 194 PID 4820 wrote to memory of 5056 4820 ZRKNYN.exe 195 PID 5056 wrote to memory of 2680 5056 cmd.exe 199 PID 2680 wrote to memory of 5140 2680 OHLE.exe 200 PID 5140 wrote to memory of 2128 5140 cmd.exe 204 PID 2128 wrote to memory of 4800 2128 KMW.exe 205 PID 4800 wrote to memory of 2520 4800 cmd.exe 209 PID 2520 wrote to memory of 1312 2520 FAADX.exe 210 PID 1312 wrote to memory of 5860 1312 cmd.exe 214 PID 5860 wrote to memory of 776 5860 INFUHE.exe 215 PID 776 wrote to memory of 5664 776 cmd.exe 219 PID 5664 wrote to memory of 5868 5664 GIEV.exe 220 PID 5868 wrote to memory of 5052 5868 cmd.exe 224 PID 5052 wrote to memory of 1120 5052 EGQ.exe 225 PID 1120 wrote to memory of 5820 1120 cmd.exe 229 PID 5820 wrote to memory of 3008 5820 IJWLZF.exe 230 PID 3008 wrote to memory of 4956 3008 cmd.exe 234 PID 4956 wrote to memory of 5920 4956 YEFP.exe 235 PID 5920 wrote to memory of 3680 5920 cmd.exe 239 PID 3680 wrote to memory of 2448 3680 NUGPR.exe 240 PID 2448 wrote to memory of 5924 2448 cmd.exe 244 PID 5924 wrote to memory of 5976 5924 CPQ.exe 245 PID 5976 wrote to memory of 8 5976 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-16_a21f3c327e9776862ed06524160cb34e_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-16_a21f3c327e9776862ed06524160cb34e_elex_emotet_stop.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XIQLCI.exe.bat" "2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\windows\XIQLCI.exeC:\windows\XIQLCI.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FHZBSAH.exe.bat" "4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\windows\SysWOW64\FHZBSAH.exeC:\windows\system32\FHZBSAH.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SEZMCL.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\windows\system\SEZMCL.exeC:\windows\system\SEZMCL.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IUN.exe.bat" "8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:252 -
C:\windows\system\IUN.exeC:\windows\system\IUN.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SSA.exe.bat" "10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6096 -
C:\windows\SSA.exeC:\windows\SSA.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JAH.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\windows\SysWOW64\JAH.exeC:\windows\system32\JAH.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ABV.exe.bat" "14⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\windows\SysWOW64\ABV.exeC:\windows\system32\ABV.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IOIZBHA.exe.bat" "16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\windows\system\IOIZBHA.exeC:\windows\system\IOIZBHA.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YEJZHD.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:432 -
C:\windows\system\YEJZHD.exeC:\windows\system\YEJZHD.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:620 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LPRP.exe.bat" "20⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\windows\LPRP.exeC:\windows\LPRP.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EUYVBHG.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\windows\SysWOW64\EUYVBHG.exeC:\windows\system32\EUYVBHG.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SFHMPSC.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\windows\system\SFHMPSC.exeC:\windows\system\SFHMPSC.exe25⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LYW.exe.bat" "26⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\windows\system\LYW.exeC:\windows\system\LYW.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PJU.exe.bat" "28⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\windows\SysWOW64\PJU.exeC:\windows\system32\PJU.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IBCD.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\windows\SysWOW64\IBCD.exeC:\windows\system32\IBCD.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZMNTYTQ.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\windows\SysWOW64\ZMNTYTQ.exeC:\windows\system32\ZMNTYTQ.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JKSNGBZ.exe.bat" "34⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\windows\JKSNGBZ.exeC:\windows\JKSNGBZ.exe35⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CCIYP.exe.bat" "36⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\windows\CCIYP.exeC:\windows\CCIYP.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZDJBBY.exe.bat" "38⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\windows\SysWOW64\ZDJBBY.exeC:\windows\system32\ZDJBBY.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FYVCHN.exe.bat" "40⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\windows\FYVCHN.exeC:\windows\FYVCHN.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZRKNYN.exe.bat" "42⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\windows\ZRKNYN.exeC:\windows\ZRKNYN.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OHLE.exe.bat" "44⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\windows\OHLE.exeC:\windows\OHLE.exe45⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KMW.exe.bat" "46⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5140 -
C:\windows\system\KMW.exeC:\windows\system\KMW.exe47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FAADX.exe.bat" "48⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\windows\FAADX.exeC:\windows\FAADX.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\INFUHE.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\windows\SysWOW64\INFUHE.exeC:\windows\system32\INFUHE.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GIEV.exe.bat" "52⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:776 -
C:\windows\SysWOW64\GIEV.exeC:\windows\system32\GIEV.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5664 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EGQ.exe.bat" "54⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5868 -
C:\windows\system\EGQ.exeC:\windows\system\EGQ.exe55⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IJWLZF.exe.bat" "56⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\windows\system\IJWLZF.exeC:\windows\system\IJWLZF.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YEFP.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\windows\YEFP.exeC:\windows\YEFP.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NUGPR.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:5920 -
C:\windows\SysWOW64\NUGPR.exeC:\windows\system32\NUGPR.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CPQ.exe.bat" "62⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\windows\system\CPQ.exeC:\windows\system\CPQ.exe63⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VSUXPQJ.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:5976 -
C:\windows\system\VSUXPQJ.exeC:\windows\system\VSUXPQJ.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:8 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HAAX.exe.bat" "66⤵PID:3220
-
C:\windows\HAAX.exeC:\windows\HAAX.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HOALD.exe.bat" "68⤵
- Executes a command shell one-liner
PID:4648 -
C:\windows\system\HOALD.exeC:\windows\system\HOALD.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZJEPILJ.exe.bat" "70⤵
- System Location Discovery: System Language Discovery
PID:5348 -
C:\windows\system\ZJEPILJ.exeC:\windows\system\ZJEPILJ.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PMOTT.exe.bat" "72⤵
- Executes a command shell one-liner
PID:4880 -
C:\windows\PMOTT.exeC:\windows\PMOTT.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XRAA.exe.bat" "74⤵
- Executes a command shell one-liner
PID:3408 -
C:\windows\XRAA.exeC:\windows\XRAA.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VCD.exe.bat" "76⤵
- Executes a command shell one-liner
PID:4340 -
C:\windows\SysWOW64\VCD.exeC:\windows\system32\VCD.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QPIZX.exe.bat" "78⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1552 -
C:\windows\QPIZX.exeC:\windows\QPIZX.exe79⤵
- Executes dropped EXE
PID:2140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BILSFS.exe.bat" "80⤵
- Executes a command shell one-liner
PID:4656 -
C:\windows\BILSFS.exeC:\windows\BILSFS.exe81⤵
- Executes dropped EXE
PID:876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MBGLFZV.exe.bat" "82⤵
- Executes a command shell one-liner
PID:4264 -
C:\windows\system\MBGLFZV.exeC:\windows\system\MBGLFZV.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CEXPY.exe.bat" "84⤵
- Executes a command shell one-liner
PID:3104 -
C:\windows\CEXPY.exeC:\windows\CEXPY.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TERUCRX.exe.bat" "86⤵PID:2736
-
C:\windows\TERUCRX.exeC:\windows\TERUCRX.exe87⤵
- Executes dropped EXE
PID:880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MHD.exe.bat" "88⤵
- Executes a command shell one-liner
PID:3504 -
C:\windows\MHD.exeC:\windows\MHD.exe89⤵
- Executes dropped EXE
PID:5336 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BCNCAC.exe.bat" "90⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4808 -
C:\windows\system\BCNCAC.exeC:\windows\system\BCNCAC.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5040 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MVIVBJX.exe.bat" "92⤵
- Executes a command shell one-liner
PID:2936 -
C:\windows\system\MVIVBJX.exeC:\windows\system\MVIVBJX.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5648 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QLWVN.exe.bat" "94⤵
- Executes a command shell one-liner
PID:3940 -
C:\windows\QLWVN.exeC:\windows\QLWVN.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AACQ.exe.bat" "96⤵PID:6060
-
C:\windows\AACQ.exeC:\windows\AACQ.exe97⤵
- Executes dropped EXE
PID:1652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AOCEE.exe.bat" "98⤵
- Executes a command shell one-liner
PID:1076 -
C:\windows\system\AOCEE.exeC:\windows\system\AOCEE.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LHXXEE.exe.bat" "100⤵
- Executes a command shell one-liner
PID:1016 -
C:\windows\system\LHXXEE.exeC:\windows\system\LHXXEE.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CMHPUBA.exe.bat" "102⤵
- Executes a command shell one-liner
PID:2932 -
C:\windows\system\CMHPUBA.exeC:\windows\system\CMHPUBA.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CZIDV.exe.bat" "104⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:6112 -
C:\windows\CZIDV.exeC:\windows\CZIDV.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5620 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XNMNGGJ.exe.bat" "106⤵
- Executes a command shell one-liner
PID:3648 -
C:\windows\XNMNGGJ.exeC:\windows\XNMNGGJ.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4632 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OAXFVKF.exe.bat" "108⤵PID:4860
-
C:\windows\system\OAXFVKF.exeC:\windows\system\OAXFVKF.exe109⤵
- Executes dropped EXE
PID:5904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UNWFA.exe.bat" "110⤵
- Executes a command shell one-liner
PID:4504 -
C:\windows\system\UNWFA.exeC:\windows\system\UNWFA.exe111⤵
- Executes dropped EXE
PID:2596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SOETJ.exe.bat" "112⤵
- Executes a command shell one-liner
PID:468 -
C:\windows\SOETJ.exeC:\windows\SOETJ.exe113⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JWGY.exe.bat" "114⤵
- System Location Discovery: System Language Discovery
PID:1480 -
C:\windows\system\JWGY.exeC:\windows\system\JWGY.exe115⤵
- Drops file in System32 directory
PID:3164 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GBD.exe.bat" "116⤵PID:5896
-
C:\windows\SysWOW64\GBD.exeC:\windows\system32\GBD.exe117⤵
- Executes dropped EXE
PID:1260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XCSB.exe.bat" "118⤵PID:1360
-
C:\windows\system\XCSB.exeC:\windows\system\XCSB.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HKUGSLX.exe.bat" "120⤵
- System Location Discovery: System Language Discovery
PID:5856 -
C:\windows\system\HKUGSLX.exeC:\windows\system\HKUGSLX.exe121⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2096
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-